Merge staging-next into staging

lib/systems/platforms.nix

@@ -152,11 +152,6 @@ rec {
       DTB = true;
       autoModules = true;
       preferBuiltin = true;
-      extraConfig = ''
-        # The default (=y) forces us to have the XHCI firmware available in initrd,
-        # which our initrd builder can't currently do easily.
-        USB_XHCI_TEGRA m
-      '';
       target = "Image";
     };
     gcc = {

maintainers/maintainer-list.nix

@@ -813,6 +813,13 @@
     githubId = 19290901;
     name = "Andrew Brooks";
   };
+  agentelement = {
+    email = "agentelement@agentelement.net";
+    github = "agentelement";
+    githubId = 38045210;
+    name = "AgentElement";
+    keys = [ { fingerprint = "D37E 581D AD71 2378 A622  5BC0 CD13 9E3B 4354 34F1"; } ];
+  };
   agilesteel = {
     email = "agilesteel@gmail.com";
     github = "agilesteel";

maintainers/scripts/luarocks-packages.csv

@@ -12,6 +12,7 @@ cassowary,,,,,,alerque
 cldr,,,,,,alerque
 commons.nvim,,,,,5.1,mrcjkb
 compat53,,,,,,vcunat
+coop.nvim,,,,,,
 cosmo,,,,,,
 coxpcall,,,,1.17.0-1,,
 cqueues,,,,,,vcunat
@@ -53,8 +54,8 @@ lrexlib-pcre2,,,,,,wishstudio
 lrexlib-posix,,,,,,
 lsp-progress.nvim,,,,,5.1,gepbird
 lsqlite3,,,,,,
-ltreesitter-ts,,,,,,
 ltreesitter,,,,,,
+ltreesitter-ts,,,,,,
 lua-cjson,,,,,,
 lua-cmsgpack,,,,,,
 lua-curl,,,,,,
@@ -174,8 +175,8 @@ tree-sitter-http,,,,0.0.33-1,,
 tree-sitter-norg,,,,,5.1,mrcjkb
 tree-sitter-norg-meta,,,,,,
 tree-sitter-orgmode,,,,,5.1,
-utf8,,,,,,
 tree-sitter-teal,,,,,,
+utf8,,,,,,
 vicious,,,,,,
 vstruct,,,,,,
 vusted,,,,,,

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -24,6 +24,8 @@
 
 - Python 2 has been removed from the top-level package set, as it is long past end-of-life. The `python2`, `python27`, `python2Full`, `python27Full`, `python2Packages`, and `python27Packages` attributes, along with the legacy `python`, `pythonFull`, and `pythonPackages` aliases, now throw an error directing you to `python3`. The `isPy2` and `isPy27` package flags have been removed accordingly. The only remaining Python 2 interpreter is vendored inside the `resholve` package for its `oil` dependency and is not exposed for general use.
 
+- `systemd.user.extraConfig` has been removed in favor of the structured [](#opt-systemd.user.settings.Manager) option. Use `systemd.user.settings.Manager` to set any `systemd-user.conf(5)` option directly. For example, replace `systemd.user.extraConfig = "DefaultTimeoutStartSec=60";` with `systemd.user.settings.Manager.DefaultTimeoutStartSec = 60;`.
+
 - `services.timesyncd.extraConfig` has been removed in favor of the structured [](#opt-services.timesyncd.settings.Time) option. Use `services.timesyncd.settings.Time` to set any `timesyncd.conf(5)` option directly. For example, replace `services.timesyncd.extraConfig = "PollIntervalMaxSec=180";` with `services.timesyncd.settings.Time.PollIntervalMaxSec = 180;`.
 
 - `services.firezone.server.provision` has been removed due to it being unmaintanable. Remove all uses of provisioning and use the WebUI to configure firezone.

nixos/lib/testing/driver.nix

@@ -14,7 +14,7 @@ let
 
   inherit (config) sshBackdoor;
 
-  inherit (hostPkgs.stdenv.hostPlatform) isLinux;
+  inherit (hostPkgs.stdenv.hostPlatform) isLinux isAarch64;
 
   # Reifies and correctly wraps the python test driver for
   # the respective qemu version and with or without ocr support
@@ -256,6 +256,10 @@ in
         #
         # If needed, this can still be turned off.
         virtualisation.qemu.enableSharedMemory = lib.mkDefault isLinux;
+        # Needed for screenshots to work (in e.g `nixosTests.login`)
+        virtualisation.qemu.options = lib.optionals (isLinux && isAarch64) [
+          "-device virtio-gpu-pci"
+        ];
 
         assertions = [
           {

nixos/modules/config/users-groups.nix

@@ -950,32 +950,8 @@ in
         };
       };
 
-      # Warn about user accounts with deprecated password hashing schemes
-      # This does not work when the users and groups are created by
-      # systemd-sysusers because the users are created too late then.
-      system.activationScripts.hashes =
-        if !config.systemd.sysusers.enable && !config.services.userborn.enable then
-          {
-            deps = [ "users" ];
-            text = ''
-              users=()
-              while IFS=: read -r user hash _; do
-                if [[ "$hash" = "$"* && ! "$hash" =~ ^\''$${cryptSchemeIdPatternGroup}\$ ]]; then
-                  users+=("$user")
-                fi
-              done </etc/shadow
-
-              if (( "''${#users[@]}" )); then
-                echo "
-              WARNING: The following user accounts rely on password hashing algorithms
-              that have been removed. They need to be renewed as soon as possible, as
-              they do prevent their users from logging in."
-                printf ' - %s\n' "''${users[@]}"
-              fi
-            '';
-          }
-        else
-          ""; # keep around for backwards compatibility
+      # for backwards compatibility
+      system.activationScripts.hashes = stringAfter [ "users" ] "";
 
       # for backwards compatibility
       system.activationScripts.groups = stringAfter [ "users" ] "";

nixos/modules/module-list.nix

@@ -245,6 +245,7 @@
   ./programs/iio-hyprland.nix
   ./programs/immersed.nix
   ./programs/iotop.nix
+  ./programs/jai-jail.nix
   ./programs/java.nix
   ./programs/joycond-cemuhook.nix
   ./programs/k3b.nix

nixos/modules/programs/jai-jail.nix

@@ -0,0 +1,45 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.programs.jai-jail;
+
+in
+{
+  options.programs.jai-jail = {
+    enable = lib.mkEnableOption "jai, a sandbox for AI agents";
+
+    package = lib.mkOption {
+      type = lib.types.package;
+      default = pkgs.jai-jail;
+      defaultText = lib.literalExpression "pkgs.jai-jail";
+      description = "The jai package to use.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    security.wrappers.jai = {
+      setuid = true;
+      owner = "root";
+      group = "root";
+      source = "${cfg.package}/bin/jai";
+    };
+
+    users.users.jai = {
+      isSystemUser = true;
+      group = "jai";
+      home = "/";
+      description = "JAI sandbox untrusted user";
+    };
+
+    users.groups.jai = { };
+
+    environment.systemPackages = [ cfg.package ];
+  };
+
+  meta.maintainers = with lib.maintainers; [ agentelement ];
+}

nixos/modules/services/home-automation/home-assistant.nix

@@ -864,12 +864,19 @@ in
 
     networking.firewall.allowedTCPPorts = mkMerge [
       (mkIf cfg.openFirewall [ cfg.config.http.server_port ])
-      (mkIf cfg.openFirewallForComponents
+      (mkIf cfg.openFirewallForComponents (
+        # https://www.home-assistant.io/integrations/homekit/#firewall
+        optionals (useComponent "homekit") [ 21063 ]
         # https://www.home-assistant.io/integrations/sonos/#network-requirements
-        (optionals (useComponent "sonos") [ 1400 ])
-      )
+        ++ optionals (useComponent "sonos") [ 1400 ]
+      ))
     ];
 
+    networking.firewall.allowedUDPPorts = mkIf cfg.openFirewallForComponents (
+      # https://www.home-assistant.io/integrations/homekit/#firewall
+      optionals (useComponent "homekit") [ 5353 ]
+    );
+
     # symlink the configuration to /etc/home-assistant
     environment.etc = mkMerge [
       (mkIf (cfg.config != null && !cfg.configWritable) {

nixos/modules/services/mail/stalwart.nix

@@ -304,7 +304,6 @@ in
   meta = {
     maintainers = with lib.maintainers; [
       happysalada
-      euxane
       onny
       norpol
     ];

nixos/modules/services/misc/inventree.nix

@@ -252,12 +252,13 @@ in
             in
             {
               "/" = {
+                # recommendedProxySettings sets the standard headers (Host, X-Forwarded-*), so
+                # don't also set them via proxy_set_header in extraConfig below. Nginx would then
+                # send Host twice and Django rejects it with DisallowedHost. Enabled per-location
+                # so it works even if the host's global recommendedProxySettings is off.
+                recommendedProxySettings = true;
                 extraConfig = ''
-                  proxy_set_header Host $host;
                   proxy_set_header X-Forwarded-By $server_addr:$server_port;
-                  proxy_set_header X-Forwarded-For $remote_addr;
-                  proxy_set_header X-Forwarded-Proto $scheme;
-                  proxy_set_header X-Real-IP $remote_addr;
                   proxy_set_header CLIENT_IP $remote_addr;
 
                   proxy_pass_request_headers on;
@@ -272,6 +273,8 @@ in
                 proxyPass = "http://unix:${unixPath}";
               };
               "/auth" = {
+                # same reasoning as "/"; this subrequest also reaches Django
+                recommendedProxySettings = true;
                 extraConfig = ''
                   internal;
                   proxy_pass_request_body off;

nixos/modules/system/boot/systemd.nix

@@ -40,6 +40,7 @@ let
     "network-online.target"
     "nss-lookup.target"
     "nss-user-lookup.target"
+    "time-set.target"
     "time-sync.target"
     "first-boot-complete.target"
   ]
@@ -808,7 +809,7 @@ in
     systemd.targets.remote-fs.unitConfig.X-StopOnReconfiguration = true;
     systemd.services.systemd-importd = lib.mkIf cfg.package.withImportd {
       environment = proxy_env;
-      path = [ pkgs.gnupg ];
+      path = [ pkgs.gnupgMinimal ];
     };
     systemd.services.systemd-pstore.wantedBy = [ "sysinit.target" ]; # see #81138
 

nixos/modules/system/boot/systemd/logind.nix

@@ -64,13 +64,13 @@
     environment.etc."systemd/logind.conf".text =
       utils.systemdUtils.lib.settingsToSections config.services.logind.settings;
 
-    # Restarting systemd-logind breaks X11
+    # Restarting systemd-logind breaks X11 and other user sessions.
+    # However, reloading the service seems to do the trick of loading new configuration without breaking anything.
     # - upstream commit: https://cgit.freedesktop.org/xorg/xserver/commit/?id=dc48bd653c7e101
     # - systemd announcement: https://github.com/systemd/systemd/blob/22043e4317ecd2bc7834b48a6d364de76bb26d91/NEWS#L103-L112
     # - this might be addressed in the future by xorg
     #systemd.services.systemd-logind.restartTriggers = [ config.environment.etc."systemd/logind.conf".source ];
-    systemd.services.systemd-logind.restartIfChanged = false;
-    systemd.services.systemd-logind.stopIfChanged = false;
+    systemd.services.systemd-logind.reloadIfChanged = true;
 
     # The user-runtime-dir@ service is managed by systemd-logind we should not touch it or else we break the users' sessions.
     systemd.services."user-runtime-dir@".stopIfChanged = false;

nixos/modules/system/boot/systemd/sysupdate.nix

@@ -138,7 +138,7 @@ in
 
     systemd.services.systemd-sysupdated = {
       aliases = [ "dbus-org.freedesktop.sysupdate1.service" ];
-      path = [ pkgs.gnupg ];
+      path = [ pkgs.gnupgMinimal ];
     };
 
     systemd.timers = {

nixos/modules/system/boot/systemd/user.nix

@@ -5,16 +5,13 @@
   utils,
   ...
 }:
-with utils;
-with systemdUtils.unitOptions;
-with lib;
 
 let
   cfg = config.systemd.user;
 
   systemd = config.systemd.package;
 
-  inherit (systemdUtils.lib)
+  inherit (utils.systemdUtils.lib)
     generateUnits
     targetToUnit
     serviceToUnit
@@ -53,7 +50,7 @@ let
       user ? null,
     }:
     let
-      suffix = optionalString (user != null) "-${user}";
+      suffix = lib.optionalString (user != null) "-${user}";
     in
     pkgs.writeTextFile {
       name = "nixos-user-tmpfiles.d${suffix}";
@@ -61,74 +58,86 @@ let
       text = ''
         # This file is created automatically and should not be modified.
         # Please change the options ‘systemd.user.tmpfiles’ instead.
-        ${concatStringsSep "\n" rules}
+        ${lib.concatStringsSep "\n" rules}
       '';
     };
 in
 {
+  imports = [
+    (lib.mkRemovedOptionModule [
+      "systemd"
+      "user"
+      "extraConfig"
+    ] "Use systemd.user.settings.Manager instead.")
+  ];
+
   options = {
-    systemd.user.extraConfig = mkOption {
-      default = "";
-      type = types.lines;
-      example = "DefaultTimeoutStartSec=60";
+    systemd.user.settings.Manager = lib.mkOption {
+      default = { };
+      type = lib.types.submodule {
+        freeformType = lib.types.attrsOf utils.systemdUtils.unitOptions.unitOption;
+      };
+      example = {
+        DefaultTimeoutStartSec = 60;
+      };
       description = ''
-        Extra config options for systemd user instances. See {manpage}`systemd-user.conf(5)` for
-        available options.
+        Settings for systemd user instances. See {manpage}`systemd-user.conf(5)`
+        for available options.
       '';
     };
 
-    systemd.user.units = mkOption {
+    systemd.user.units = lib.mkOption {
       description = "Definition of systemd per-user units.";
       default = { };
-      type = systemdUtils.types.units;
+      type = utils.systemdUtils.types.units;
     };
 
-    systemd.user.paths = mkOption {
+    systemd.user.paths = lib.mkOption {
       default = { };
-      type = systemdUtils.types.paths;
+      type = utils.systemdUtils.types.paths;
       description = "Definition of systemd per-user path units.";
     };
 
-    systemd.user.services = mkOption {
+    systemd.user.services = lib.mkOption {
       default = { };
-      type = systemdUtils.types.services;
+      type = utils.systemdUtils.types.services;
       description = "Definition of systemd per-user service units.";
     };
 
-    systemd.user.slices = mkOption {
+    systemd.user.slices = lib.mkOption {
       default = { };
-      type = systemdUtils.types.slices;
+      type = utils.systemdUtils.types.slices;
       description = "Definition of systemd per-user slice units.";
     };
 
-    systemd.user.sockets = mkOption {
+    systemd.user.sockets = lib.mkOption {
       default = { };
-      type = systemdUtils.types.sockets;
+      type = utils.systemdUtils.types.sockets;
       description = "Definition of systemd per-user socket units.";
     };
 
-    systemd.user.targets = mkOption {
+    systemd.user.targets = lib.mkOption {
       default = { };
-      type = systemdUtils.types.targets;
+      type = utils.systemdUtils.types.targets;
       description = "Definition of systemd per-user target units.";
     };
 
-    systemd.user.timers = mkOption {
+    systemd.user.timers = lib.mkOption {
       default = { };
-      type = systemdUtils.types.timers;
+      type = utils.systemdUtils.types.timers;
       description = "Definition of systemd per-user timer units.";
     };
 
     systemd.user.tmpfiles = {
       enable =
-        (mkEnableOption "systemd user units systemd-tmpfiles-setup.service and systemd-tmpfiles-clean.timer")
+        (lib.mkEnableOption "systemd user units systemd-tmpfiles-setup.service and systemd-tmpfiles-clean.timer")
         // {
           default = true;
           example = false;
         };
 
-      rules = mkOption {
-        type = types.listOf types.str;
+      rules = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [ ];
         example = [ "D %C - - - 7d" ];
         description = ''
@@ -139,17 +148,17 @@ in
         '';
       };
 
-      users = mkOption {
+      users = lib.mkOption {
         description = ''
           Per-user rules for creation, deletion and cleaning of volatile and
           temporary files automatically.
         '';
         default = { };
-        type = types.attrsOf (
-          types.submodule {
+        type = lib.types.attrsOf (
+          lib.types.submodule {
             options = {
-              rules = mkOption {
-                type = types.listOf types.str;
+              rules = lib.mkOption {
+                type = lib.types.listOf lib.types.str;
                 default = [ ];
                 example = [ "D %C - - - 7d" ];
                 description = ''
@@ -165,8 +174,8 @@ in
       };
     };
 
-    systemd.user.generators = mkOption {
-      type = types.attrsOf types.path;
+    systemd.user.generators = lib.mkOption {
+      type = lib.types.attrsOf lib.types.path;
       default = { };
       example = {
         systemd-gpt-auto-generator = "/dev/null";
@@ -179,9 +188,9 @@ in
       '';
     };
 
-    systemd.additionalUpstreamUserUnits = mkOption {
+    systemd.additionalUpstreamUserUnits = lib.mkOption {
       default = [ ];
-      type = types.listOf types.str;
+      type = lib.types.listOf lib.types.str;
       example = [ ];
       description = ''
         Additional units shipped with systemd that should be enabled for per-user systemd instances.
@@ -203,29 +212,26 @@ in
         upstreamWants = [ ];
       };
 
-      "systemd/user.conf".text = ''
-        [Manager]
-        ${cfg.extraConfig}
-      '';
+      "systemd/user.conf".text = utils.systemdUtils.lib.settingsToSections cfg.settings;
     };
 
     systemd.user.units =
-      mapAttrs' (n: v: nameValuePair "${n}.path" (pathToUnit v)) cfg.paths
-      // mapAttrs' (n: v: nameValuePair "${n}.service" (serviceToUnit v)) cfg.services
-      // mapAttrs' (n: v: nameValuePair "${n}.slice" (sliceToUnit v)) cfg.slices
-      // mapAttrs' (n: v: nameValuePair "${n}.socket" (socketToUnit v)) cfg.sockets
-      // mapAttrs' (n: v: nameValuePair "${n}.target" (targetToUnit v)) cfg.targets
-      // mapAttrs' (n: v: nameValuePair "${n}.timer" (timerToUnit v)) cfg.timers;
+      lib.mapAttrs' (n: v: lib.nameValuePair "${n}.path" (pathToUnit v)) cfg.paths
+      // lib.mapAttrs' (n: v: lib.nameValuePair "${n}.service" (serviceToUnit v)) cfg.services
+      // lib.mapAttrs' (n: v: lib.nameValuePair "${n}.slice" (sliceToUnit v)) cfg.slices
+      // lib.mapAttrs' (n: v: lib.nameValuePair "${n}.socket" (socketToUnit v)) cfg.sockets
+      // lib.mapAttrs' (n: v: lib.nameValuePair "${n}.target" (targetToUnit v)) cfg.targets
+      // lib.mapAttrs' (n: v: lib.nameValuePair "${n}.timer" (timerToUnit v)) cfg.timers;
 
     systemd.user.timers = {
       # enable systemd user tmpfiles
-      systemd-tmpfiles-clean.wantedBy = optional cfg.tmpfiles.enable "timers.target";
+      systemd-tmpfiles-clean.wantedBy = lib.optional cfg.tmpfiles.enable "timers.target";
     }
     # Generate timer units for all services that have a ‘startAt’ value.
-    // (mapAttrs (name: service: {
+    // (lib.mapAttrs (name: service: {
       wantedBy = [ "timers.target" ];
       timerConfig.OnCalendar = service.startAt;
-    }) (filterAttrs (name: service: service.startAt != [ ]) cfg.services));
+    }) (lib.filterAttrs (name: service: service.startAt != [ ]) cfg.services));
 
     # Provide the systemd-user PAM service, required to run systemd
     # user instances.
@@ -244,18 +250,19 @@ in
     systemd.services.systemd-user-sessions.restartIfChanged = false; # Restart kills all active sessions.
 
     # enable systemd user tmpfiles
-    systemd.user.services.systemd-tmpfiles-setup.wantedBy = optional cfg.tmpfiles.enable "basic.target";
+    systemd.user.services.systemd-tmpfiles-setup.wantedBy =
+      lib.optional cfg.tmpfiles.enable "basic.target";
 
     # /run/current-system/sw/etc/xdg is in systemd's $XDG_CONFIG_DIRS so we can
     # write the tmpfiles.d rules for everyone there
-    environment.systemPackages = optional (cfg.tmpfiles.rules != [ ]) (writeTmpfiles {
+    environment.systemPackages = lib.optional (cfg.tmpfiles.rules != [ ]) (writeTmpfiles {
       inherit (cfg.tmpfiles) rules;
     });
 
     # /etc/profiles/per-user/$USER/etc/xdg is in systemd's $XDG_CONFIG_DIRS so
     # we can write a single user's tmpfiles.d rules there
-    users.users = mapAttrs (user: cfg': {
-      packages = optional (cfg'.rules != [ ]) (writeTmpfiles {
+    users.users = lib.mapAttrs (user: cfg': {
+      packages = lib.optional (cfg'.rules != [ ]) (writeTmpfiles {
         inherit (cfg') rules;
         inherit user;
       });

nixos/modules/testing/test-instrumentation.nix

@@ -238,11 +238,11 @@ in
     '';
 
     systemd.settings.Manager = managerSettings;
-    systemd.user.extraConfig = ''
+    systemd.user.settings.Manager = {
       # Allow very slow start
-      DefaultTimeoutStartSec=300
-      DefaultDeviceTimeoutSec=300
-    '';
+      DefaultTimeoutStartSec = 300;
+      DefaultDeviceTimeoutSec = 300;
+    };
 
     boot.consoleLogLevel = 7;
 

nixos/modules/virtualisation/qemu-vm.nix

@@ -1379,7 +1379,6 @@ in
         "-device usb-tablet,bus=usb-bus.0"
       ])
       (mkIf pkgs.stdenv.hostPlatform.isAarch [
-        "-device virtio-gpu-pci"
         "-device usb-ehci,id=usb0"
         "-device usb-kbd"
         "-device usb-tablet"

nixos/tests/all-tests.nix

@@ -1674,6 +1674,7 @@ in
   systemd-timesyncd-nscd-dnssec = runTest ./systemd-timesyncd-nscd-dnssec.nix;
   systemd-user-linger = runTest ./systemd-user-linger.nix;
   systemd-user-linger-purge = runTest ./systemd-user-linger-purge.nix;
+  systemd-user-settings = runTest ./systemd-user-settings.nix;
   systemd-user-tmpfiles-rules = runTest ./systemd-user-tmpfiles-rules.nix;
   systemd-userdbd = runTest ./systemd-userdbd.nix;
   systemtap = handleTest ./systemtap.nix { };

nixos/tests/stalwart/stalwart.nix

@@ -79,7 +79,6 @@ in
   meta = {
     maintainers = with lib.maintainers; [
       happysalada
-      euxane
       onny
     ];
   };

nixos/tests/systemd-user-settings.nix

@@ -0,0 +1,24 @@
+{
+  name = "systemd-user-settings";
+  meta = {
+    maintainers = [ ];
+  };
+
+  nodes.machine =
+    { lib, ... }:
+    {
+      systemd.user.settings.Manager = {
+        DefaultTimeoutStartSec = lib.mkForce "60";
+        DefaultEnvironment = "FOO=bar";
+      };
+    };
+
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+
+    with subtest("settings.Manager renders user.conf"):
+      machine.succeed("grep -F '[Manager]' /etc/systemd/user.conf")
+      machine.succeed("grep -F 'DefaultTimeoutStartSec=60' /etc/systemd/user.conf")
+      machine.succeed("grep -F 'DefaultEnvironment=FOO=bar' /etc/systemd/user.conf")
+  '';
+}

nixos/tests/systemd.nix

@@ -34,7 +34,7 @@
         RebootWatchdogSec = "10min";
         KExecWatchdogSec = "5min";
       };
-      systemd.user.extraConfig = "DefaultEnvironment=\"XXX_USER=bar\"";
+      systemd.user.settings.Manager.DefaultEnvironment = "\"XXX_USER=bar\"";
       services.journald.extraConfig = "Storage=volatile";
       test-support.displayManager.auto.user = "alice";
 

pkgs/applications/editors/emacs/make-emacs.nix

@@ -408,6 +408,8 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.withFeature withSelinux "selinux")
   ];
 
+  __structuredAttrs = true;
+
   env =
     lib.optionalAttrs withNativeCompilation {
       NATIVE_FULL_AOT = "1";

pkgs/applications/editors/rednotebook/default.nix

@@ -1,6 +1,6 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchFromGitHub,
   gdk-pixbuf,
   glib,
@@ -9,12 +9,9 @@
   gtksourceview,
   pango,
   webkitgtk_4_1,
-  pygobject3,
-  pyyaml,
-  setuptools,
 }:
 
-buildPythonApplication (finalAttrs: {
+python3Packages.buildPythonApplication (finalAttrs: {
   pname = "rednotebook";
   version = "2.42";
   pyproject = true;
@@ -31,7 +28,7 @@ buildPythonApplication (finalAttrs: {
 
   nativeBuildInputs = [ gobject-introspection ];
 
-  build-system = [ setuptools ];
+  build-system = with python3Packages; [ setuptools ];
 
   propagatedBuildInputs = [
     gdk-pixbuf
@@ -40,9 +37,11 @@ buildPythonApplication (finalAttrs: {
     gtksourceview
     pango
     webkitgtk_4_1
+  ]
+  ++ (with python3Packages; [
     pygobject3
     pyyaml
-  ];
+  ]);
 
   makeWrapperArgs = [
     "--set GI_TYPELIB_PATH $GI_TYPELIB_PATH"

pkgs/applications/editors/vim/plugins/generated.nix

@@ -4043,20 +4043,6 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
-  coop-nvim = buildVimPlugin {
-    pname = "coop.nvim";
-    version = "0-unstable-2026-04-20";
-    src = fetchFromGitHub {
-      owner = "gregorias";
-      repo = "coop.nvim";
-      rev = "b156e541316aee14be4ae64c93ed8bddb6d03bc1";
-      hash = "sha256-S6iGmdakI714Im0tetgfASbe0K4/olYsjj26+WP+rSU=";
-    };
-    meta.homepage = "https://github.com/gregorias/coop.nvim/";
-    meta.license = getLicenseFromSpdxId "GPL-3.0-only";
-    meta.hydraPlatforms = [ ];
-  };
-
   copilot-cmp = buildVimPlugin {
     pname = "copilot-cmp";
     version = "0-unstable-2024-12-11";

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -287,7 +287,6 @@ https://github.com/niklasdewally/conjure.nvim/,,
 https://github.com/wellle/context.vim/,,
 https://github.com/Shougo/context_filetype.vim/,,
 https://github.com/banjo/contextfiles.nvim/,,
-https://github.com/gregorias/coop.nvim/,,
 https://github.com/zbirenbaum/copilot-cmp/,,
 https://github.com/copilotlsp-nvim/copilot-lsp/,,
 https://github.com/AndreM222/copilot-lualine/,,

pkgs/applications/editors/vscode/vscode.nix

@@ -113,6 +113,9 @@ buildVscode {
     '';
     homepage = "https://code.visualstudio.com/";
     downloadPage = "https://code.visualstudio.com/Updates";
+    changelog = "https://code.visualstudio.com/updates/v${
+      lib.replaceString "." "_" (lib.versions.majorMinor version)
+    }";
     license = lib.licenses.unfree;
     maintainers = with lib.maintainers; [
       eadwu

pkgs/applications/editors/vscode/vscodium.nix

@@ -79,6 +79,7 @@ buildVscode rec {
     '';
     homepage = "https://github.com/VSCodium/vscodium";
     downloadPage = "https://github.com/VSCodium/vscodium/releases";
+    changelog = "https://github.com/VSCodium/vscodium/releases/tag/${version}";
     license = lib.licenses.mit;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     maintainers = with lib.maintainers; [

pkgs/applications/emulators/libretro/cores/opera.nix

@@ -6,13 +6,13 @@
 }:
 mkLibretroCore {
   core = "opera";
-  version = "0-unstable-2026-05-30";
+  version = "0-unstable-2026-06-09";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "opera-libretro";
-    rev = "d0a3b910f8bef6b8d48fb5eec4ad72ea5f022394";
-    hash = "sha256-OH9gkbMC4PJnpboiYrKV+XkQqq5ldq5tneyVJHfDzsM=";
+    rev = "5e36d4a9fbb2afbb8de2313b8e2bf83998ec2341";
+    hash = "sha256-TmSk0PIXOLToElUnyRkDFfpq3bvBh7+P8r8brYICJSY=";
   };
 
   makefile = "Makefile";

pkgs/applications/misc/bitwarden-menu/default.nix

@@ -1,14 +1,10 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchPypi,
-  hatch-vcs,
-  hatchling,
-  pynput,
-  xdg-base-dirs,
 }:
 
-buildPythonApplication (finalAttrs: {
+python3Packages.buildPythonApplication (finalAttrs: {
   pname = "bitwarden-menu";
   version = "0.4.5";
   pyproject = true;
@@ -19,12 +15,12 @@ buildPythonApplication (finalAttrs: {
     hash = "sha256-vUlNqSVdGhfN5WjDjf1ub32Y2WoBndIdFzfCNwo5+Vg=";
   };
 
-  nativeBuildInputs = [
+  nativeBuildInputs = with python3Packages; [
     hatch-vcs
     hatchling
   ];
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
     pynput
     xdg-base-dirs
   ];

pkgs/applications/misc/bluetooth_battery/default.nix

@@ -1,11 +1,10 @@
 {
   lib,
+  python3Packages,
   fetchFromGitHub,
-  buildPythonApplication,
-  pybluez,
 }:
 
-buildPythonApplication (finalAttrs: {
+python3Packages.buildPythonApplication (finalAttrs: {
   pname = "bluetooth_battery";
   version = "1.3.1";
 
@@ -16,7 +15,7 @@ buildPythonApplication (finalAttrs: {
     sha256 = "067qfxh228cy1x95bnjp88dx4k00ajj7ay7fz5vr1gkj2yfa203s";
   };
 
-  propagatedBuildInputs = [ pybluez ];
+  propagatedBuildInputs = with python3Packages; [ pybluez ];
 
   pyproject = false;
 

pkgs/applications/misc/mu-repo/default.nix

@@ -1,14 +1,13 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchFromGitHub,
-  pytestCheckHook,
   git,
   testers,
   mu-repo,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "mu-repo";
   version = "1.9.0";
   format = "setuptools";
@@ -23,7 +22,7 @@ buildPythonApplication rec {
   dependencies = [ git ];
 
   nativeCheckInputs = [
-    pytestCheckHook
+    python3Packages.pytestCheckHook
     git
   ];
 

pkgs/applications/misc/remarkable/remarkable-mouse/default.nix

@@ -1,16 +1,10 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchFromGitHub,
-  libevdev,
-  paramiko,
-  pynput,
-  setuptools,
-  screeninfo,
-  tkinter,
 }:
 
-buildPythonApplication {
+python3Packages.buildPythonApplication {
   pname = "remarkable-mouse";
   version = "unstable-2024-02-23";
 
@@ -22,9 +16,9 @@ buildPythonApplication {
   };
 
   pyproject = true;
-  build-system = [ setuptools ];
+  build-system = with python3Packages; [ setuptools ];
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
     screeninfo
     paramiko
     pynput

pkgs/applications/misc/termpdf.py/default.nix

@@ -1,19 +1,11 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchFromGitHub,
   bibtool,
-  pybtex,
-  pymupdf,
-  pynvim,
-  pyperclip,
-  roman,
-  pdfrw,
-  pagelabels,
-  setuptools,
 }:
 
-buildPythonApplication {
+python3Packages.buildPythonApplication {
   pname = "termpdf.py";
   version = "2022-03-28";
   format = "setuptools";
@@ -27,6 +19,8 @@ buildPythonApplication {
 
   propagatedBuildInputs = [
     bibtool
+  ]
+  ++ (with python3Packages; [
     pybtex
     pymupdf
     pyperclip
@@ -35,7 +29,7 @@ buildPythonApplication {
     pdfrw
     pynvim
     setuptools
-  ];
+  ]);
 
   # upstream doesn't contain tests
   doCheck = false;

pkgs/applications/misc/yokadi/default.nix

@@ -1,15 +1,10 @@
 {
   lib,
+  python3Packages,
   fetchurl,
-  buildPythonApplication,
-  python-dateutil,
-  sqlalchemy,
-  setproctitle,
-  icalendar,
-  colorama,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "yokadi";
   version = "1.3.0";
   format = "setuptools";
@@ -19,7 +14,7 @@ buildPythonApplication rec {
     hash = "sha256-zF2ffHeU+i7wzu1u4DhQ5zJXr8AjXboiyFAisXNX6TM=";
   };
 
-  dependencies = [
+  dependencies = with python3Packages; [
     python-dateutil
     sqlalchemy
     setproctitle

pkgs/applications/networking/droopy/default.nix

@@ -1,9 +1,9 @@
 {
-  stdenv,
   lib,
+  stdenv,
   fetchFromGitHub,
-  wrapPython,
   fetchpatch,
+  python3Packages,
 }:
 
 stdenv.mkDerivation {
@@ -28,7 +28,7 @@ stdenv.mkDerivation {
     })
   ];
 
-  nativeBuildInputs = [ wrapPython ];
+  nativeBuildInputs = [ python3Packages.wrapPython ];
 
   installPhase = ''
     install -vD droopy $out/bin/droopy
@@ -43,5 +43,4 @@ stdenv.mkDerivation {
     maintainers = [ ];
     mainProgram = "droopy";
   };
-
 }

pkgs/applications/networking/instant-messengers/matrix-commander/default.nix

@@ -1,22 +1,11 @@
 {
   lib,
+  python3Packages,
   fetchFromGitHub,
-  buildPythonApplication,
   cacert,
-  setuptools,
-  matrix-nio,
-  python-magic,
-  markdown,
-  pillow,
-  aiofiles,
-  notify2,
-  dbus-python,
-  pyxdg,
-  python-olm,
-  emoji,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "matrix-commander";
   version = "8.0.5";
 
@@ -41,6 +30,8 @@ buildPythonApplication rec {
 
   propagatedBuildInputs = [
     cacert
+  ]
+  ++ (with python3Packages; [
     setuptools
     (matrix-nio.override { withOlm = true; })
     python-magic
@@ -52,7 +43,7 @@ buildPythonApplication rec {
     pyxdg
     python-olm
     emoji
-  ];
+  ]);
 
   meta = {
     description = "Simple but convenient CLI-based Matrix client app for sending and receiving";

pkgs/applications/science/robotics/mavproxy/default.nix

@@ -1,24 +1,13 @@
 {
-  stdenv,
   lib,
-  billiard,
-  buildPythonApplication,
+  stdenv,
+  python3Packages,
   fetchFromGitHub,
   fetchpatch,
-  gnureadline,
-  lxml,
-  matplotlib,
-  numpy,
-  opencv-python,
-  pymavlink,
-  pynmeagps,
-  pyserial,
-  setuptools,
   versionCheckHook,
-  wxpython,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "MAVProxy";
   version = "1.8.74";
   pyproject = true;
@@ -38,23 +27,25 @@ buildPythonApplication rec {
     })
   ];
 
-  build-system = [ setuptools ];
+  build-system = with python3Packages; [ setuptools ];
 
-  dependencies = [
-    lxml
-    matplotlib
-    numpy
-    opencv-python
-    pymavlink
-    pynmeagps
-    pyserial
-    setuptools # Imports `pkg_resources` at runtime
-    wxpython
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    billiard
-    gnureadline
-  ];
+  dependencies =
+    with python3Packages;
+    [
+      lxml
+      matplotlib
+      numpy
+      opencv-python
+      pymavlink
+      pynmeagps
+      pyserial
+      setuptools # Imports `pkg_resources` at runtime
+      wxpython
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      billiard
+      gnureadline
+    ];
 
   pythonImportsCheck = [ "MAVProxy" ];
 

pkgs/applications/science/robotics/sumorobot-manager/default.nix

@@ -1,12 +1,9 @@
 {
   lib,
   stdenv,
-  python,
+  python3Packages,
   qt5,
   fetchFromGitHub,
-  wrapPython,
-  pyqt5,
-  pyserial,
   dos2unix,
 }:
 
@@ -21,14 +18,15 @@ stdenv.mkDerivation rec {
     sha256 = "07snhwmqqp52vdgr66vx50zxx0nmpmns5cdjgh50hzlhji2z1fl9";
   };
 
-  buildInputs = [ python ];
-  pythonPath = [
+  buildInputs = [ python3Packages.python ];
+
+  pythonPath = with python3Packages; [
     pyqt5.dev
     pyserial
   ];
 
   nativeBuildInputs = [
-    wrapPython
+    python3Packages.wrapPython
     qt5.wrapQtAppsHook
     dos2unix
   ];

pkgs/applications/video/jellyfin-mpv-shim/default.nix

@@ -1,25 +1,14 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   copyDesktopItems,
   fetchPypi,
   gobject-introspection,
-  jellyfin-apiclient-python,
-  jinja2,
   makeDesktopItem,
-  mpv,
-  pillow,
-  pystray,
-  python,
-  python-mpv-jsonipc,
-  pywebview,
-  setuptools,
-  tkinter,
   wrapGAppsHook3,
-  pypresence,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "jellyfin-mpv-shim";
   version = "2.9.0";
   pyproject = true;
@@ -35,9 +24,9 @@ buildPythonApplication rec {
     gobject-introspection
   ];
 
-  build-system = [ setuptools ];
+  build-system = with python3Packages; [ setuptools ];
 
-  dependencies = [
+  dependencies = with python3Packages; [
     jellyfin-apiclient-python
     mpv
     pillow
@@ -51,7 +40,7 @@ buildPythonApplication rec {
     jinja2
     pywebview
 
-    # discord rich presence dependencie
+    # discord rich presence dependency
     pypresence
   ];
 
@@ -80,7 +69,7 @@ buildPythonApplication rec {
   postInstall = ''
     for s in 16 32 48 64 128 256; do
       mkdir -p $out/share/icons/hicolor/''${s}x''${s}/apps
-      ln -s $out/${python.sitePackages}/jellyfin_mpv_shim/integration/jellyfin-''${s}.png \
+      ln -s $out/${python3Packages.python.sitePackages}/jellyfin_mpv_shim/integration/jellyfin-''${s}.png \
         $out/share/icons/hicolor/''${s}x''${s}/apps/${pname}.png
     done
   '';

pkgs/applications/video/plex-mpv-shim/default.nix

@@ -1,20 +1,13 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchFromGitHub,
-  fetchpatch,
-  python,
-  mpv,
-  requests,
-  python-mpv-jsonipc,
-  pystray,
-  tkinter,
   wrapGAppsHook3,
   gobject-introspection,
   mpv-shim-default-shaders,
 }:
 
-buildPythonApplication {
+python3Packages.buildPythonApplication {
   pname = "plex-mpv-shim";
   version = "1.11.0-unstable-2025-03-17";
   format = "setuptools";
@@ -31,7 +24,7 @@ buildPythonApplication {
     gobject-introspection
   ];
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
     mpv
     requests
     python-mpv-jsonipc
@@ -47,7 +40,7 @@ buildPythonApplication {
 
   postInstall = ''
     # put link to shaders where upstream package expects them
-    ln -s ${mpv-shim-default-shaders}/share/mpv-shim-default-shaders $out/${python.sitePackages}/plex_mpv_shim/default_shader_pack
+    ln -s ${mpv-shim-default-shaders}/share/mpv-shim-default-shaders $out/${python3Packages.python.sitePackages}/plex_mpv_shim/default_shader_pack
   '';
 
   # does not contain tests

pkgs/applications/window-managers/hyprwm/hyprshade/default.nix

@@ -1,15 +1,12 @@
 {
   lib,
-  buildPythonPackage,
+  python3Packages,
   fetchFromGitHub,
-  hatchling,
-  more-itertools,
-  click,
   hyprland,
   makeWrapper,
 }:
 
-buildPythonPackage (finalAttrs: {
+python3Packages.buildPythonPackage (finalAttrs: {
   pname = "hyprshade";
   version = "4.0.1";
   pyproject = true;
@@ -22,11 +19,11 @@ buildPythonPackage (finalAttrs: {
   };
 
   nativeBuildInputs = [
-    hatchling
+    python3Packages.hatchling
     makeWrapper
   ];
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
     more-itertools
     click
   ];

pkgs/by-name/al/alvr/ffmpeg.nix

@@ -0,0 +1,38 @@
+{
+  lib,
+  ffmpeg_6,
+  alvr,
+}:
+
+(ffmpeg_6.override {
+  version = "6.0";
+  hash = "sha256-RVbgsafIbeUUNXmUbDQ03ZN42oaUo0njqROo7KOQgv0=";
+
+  withHardcodedTables = false;
+
+  withHtmlDoc = false;
+  withManPages = false;
+  withPodDoc = false;
+  withTxtDoc = false;
+  withDocumentation = false;
+}).overrideAttrs
+  (old: {
+    # apply our own ffmpeg patches, but skip texinfo-7.1.patch as it does not apply to 6.0.
+    # apply upstream patches for ALVR as well.
+    patches =
+      (lib.filter (p: !(lib.hasSuffix "texinfo-7.1.patch" (baseNameOf (toString p)))) old.patches)
+      ++ [
+        (alvr.src + "/alvr/xtask/patches/0001-Add-AV_VAAPI_DRIVER_QUIRK_HEVC_ENCODER_ALIGN_64_16-f.patch")
+        (alvr.src + "/alvr/xtask/patches/0001-av1-encode-backport.patch")
+        (alvr.src + "/alvr/xtask/patches/0001-clip-constants-used-with-shift-instr.patch")
+        (alvr.src + "/alvr/xtask/patches/0001-guid-conftest.patch")
+        (alvr.src + "/alvr/xtask/patches/0001-lavu-hwcontext_vulkan-Fix-importing-RGBx-frames-to-C.patch")
+        (alvr.src + "/alvr/xtask/patches/0001-update-rc-modes.patch")
+        (alvr.src + "/alvr/xtask/patches/0001-vaapi_encode-Add-filler_data-option.patch")
+        (alvr.src + "/alvr/xtask/patches/0001-vaapi_encode-Allow-to-dynamically-change-bitrate-and.patch")
+        (alvr.src + "/alvr/xtask/patches/0001-vaapi_encode-Enable-global-header.patch")
+        (alvr.src + "/alvr/xtask/patches/0001-vaapi_encode_h265-Set-vui_parameters_present_flag.patch")
+      ];
+
+    doCheck = false;
+  })

pkgs/by-name/al/alvr/package.nix

@@ -2,8 +2,10 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
+  fetchpatch,
   replaceVars,
   nix-update-script,
+  callPackage,
   pkg-config,
   autoAddDriverRunpath,
   alsa-lib,
@@ -11,7 +13,7 @@
   brotli,
   bzip2,
   celt,
-  ffmpeg_7,
+  ffmpeg-alvr ? callPackage ./ffmpeg.nix { },
   gmp,
   jack2,
   lame,
@@ -42,6 +44,7 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "alvr";
+
   version = "20.14.1";
 
   src = fetchFromGitHub {
@@ -56,20 +59,15 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   patches = [
     (replaceVars ./fix-finding-libs.patch {
-      ffmpeg = lib.getDev ffmpeg_7;
+      ffmpeg = lib.getDev ffmpeg-alvr;
       x264 = lib.getDev x264;
     })
+    (fetchpatch {
+      url = "https://github.com/alvr-org/ALVR/commit/12a238b9ac9d63438163ff82cbd689733558a1e4.patch";
+      hash = "sha256-yvIGjopXIwGXajs5/RlAo+eqfVNnXlomKy/VO/dL+gc=";
+    })
   ];
 
-  postPatch = ''
-    substituteInPlace alvr/server_openvr/cpp/platform/linux/EncodePipelineVAAPI.cpp \
-      --replace-fail 'FF_PROFILE_H264_MAIN' 'AV_PROFILE_H264_MAIN' \
-      --replace-fail 'FF_PROFILE_H264_BASELINE' 'AV_PROFILE_H264_BASELINE' \
-      --replace-fail 'FF_PROFILE_H264_HIGH' 'AV_PROFILE_H264_HIGH' \
-      --replace-fail 'FF_PROFILE_HEVC_MAIN' 'AV_PROFILE_HEVC_MAIN' \
-      --replace-fail 'FF_PROFILE_AV1_MAIN' 'AV_PROFILE_AV1_MAIN'
-  '';
-
   env = {
     NIX_CFLAGS_COMPILE = toString [
       "-lbrotlicommon"
@@ -107,7 +105,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     brotli
     bzip2
     celt
-    ffmpeg_7
+    ffmpeg-alvr
     gmp
     jack2
     lame
@@ -153,7 +151,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     ln -s $out/lib $out/lib64
   '';
 
-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    inherit ffmpeg-alvr;
+    updateScript = nix-update-script { };
+  };
 
   meta = {
     description = "Stream VR games from your PC to your headset via Wi-Fi";
@@ -164,6 +165,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     maintainers = with lib.maintainers; [
       luNeder
       jopejoe1
+      eyjhb
     ];
     platforms = lib.platforms.linux;
   };

pkgs/by-name/an/anytype-heart/package.nix

@@ -26,7 +26,7 @@ buildGoModule (finalAttrs: {
 
   # Use only versions specified in anytype-ts middleware.version file:
   #  https://github.com/anyproto/anytype-ts/blob/v<anytype-ts-version>/middleware.version
-  version = "0.49.0-rc08";
+  version = "0.50.8";
 
   # Update only together with 'anytype' package.
   # nixpkgs-update: no auto update
@@ -34,10 +34,10 @@ buildGoModule (finalAttrs: {
     owner = "anyproto";
     repo = "anytype-heart";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gTUesFf6cDwsFCEUjpcy9VA67GwuZ9mNTih4HC0Vi7g=";
+    hash = "sha256-h59Vnmv+iB0NbLQPCHPlmHBDaYoFimrZP/4Cv/IQ7b8=";
   };
 
-  vendorHash = "sha256-1D7v/lgmoKOOHNG3vgpzDpWQ66lmmP8IeZ5rvXe4D9M=";
+  vendorHash = "sha256-uJ/Z2zxqIne3UuxAglZejoqHV/IchYdPhefL9K51U2I=";
 
   subPackages = [ "cmd/grpcserver" ];
   tags = [
@@ -59,16 +59,11 @@ buildGoModule (finalAttrs: {
     cp ${tantivy-go}/lib/libtantivy_go.a deps/libs/${arch}
   '';
 
-  postBuild = ''
-    protoc -I ./  --js_out=import_style=commonjs,binary:./dist/js/pb pb/protos/service/*.proto pb/protos/*.proto pkg/lib/pb/model/protos/*.proto
-    protoc -I ./  --grpc-web_out=import_style=commonjs+dts,mode=grpcwebtext:./dist/js/pb pb/protos/service/*.proto pb/protos/*.proto pkg/lib/pb/model/protos/*.proto
-  '';
-
   postInstall = ''
     mv $out/bin/grpcserver $out/bin/anytypeHelper
-    mkdir -p $out/lib
-    cp -r dist/js/pb/* $out/lib
-    cp -r dist/js/pb/* $out/lib
+    mkdir -p $out/lib/protos
+    find pb -type f -name "*.proto" -exec cp {} $out/lib/protos/ \;
+    find pkg/lib/pb -type f -name "*.proto" -exec cp {} $out/lib/protos/ \;
 
     mkdir -p $out/lib/json/generated
     cp pkg/lib/bundle/system*.json $out/lib/json/generated

pkgs/by-name/an/anytype/0001-feat-update-Disable-auto-checking-for-updates-and-updating-manually.patch

@@ -1,18 +1,8 @@
-From d236396b1da80a7233168e01e8164256e7f69cc1 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?David=20Chocholat=C3=BD?= <chocholaty.david@protonmail.com>
-Date: Fri, 25 Apr 2025 12:29:37 +0200
-Subject: [PATCH] feat(update): Disable auto checking for updates and updating
- manually
-
----
- electron/js/update.js | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/electron/js/update.js b/electron/js/update.js
-index 0e34efa..9386c90 100644
---- a/electron/js/update.js
-+++ b/electron/js/update.js
-@@ -29,7 +29,8 @@ class UpdateManager {
+diff --git a/electron/ts/update.ts b/electron/ts/update.ts
+index 8d63cb8eb7..ea2dadf0c9 100644
+--- a/electron/ts/update.ts
++++ b/electron/ts/update.ts
+@@ -31,7 +31,8 @@ class UpdateManager {
  		autoUpdater.autoInstallOnAppQuit = false;
  		autoUpdater.channel = channel;
  
@@ -22,16 +12,13 @@ index 0e34efa..9386c90 100644
  
  		autoUpdater.on('checking-for-update', () => {
  			Util.log('info', 'Checking for update');
-@@ -93,6 +94,9 @@ class UpdateManager {
+@@ -79,6 +80,9 @@ class UpdateManager {
  	};
  
- 	isAllowed () {
+ 	isAllowed (): boolean {
 +		// PATCH(update): Always disallow update check, even when requested by the user manually or when Anytype starts.
 +		return false;
 +
  		const { config } = ConfigManager;
  
  		if (config.updateDisabled) {
--- 
-2.49.0
-

pkgs/by-name/an/anytype/0002-remove-grpc-devtools.patch

@@ -1,12 +1,12 @@
-diff --git a/electron.js b/electron.js
-index c5d6760882..17afc05e26 100644
---- a/electron.js
-+++ b/electron.js
-@@ -15,7 +15,6 @@ const store = new Store({ name: [ 'localStorage', suffix ].join('-') });
- 
- // gRPC DevTools extension ID
- const GRPC_DEVTOOLS_ID = 'fohdnlaeecihjiendkfhifhlgldpeopm';
--const { installExtension } = require('@tomjs/electron-devtools-installer');
- 
- // Fix notifications app name
- if (is.windows) {
+diff --git a/electron/ts/main.ts b/electron/ts/main.ts
+index 373518ee2d..8eefcd58be 100644
+--- a/electron/ts/main.ts
++++ b/electron/ts/main.ts
+@@ -15,7 +15,6 @@ import storage from 'electron-json-storage';
+ import * as remote from '@electron/remote/main';
+ import { installNativeMessagingHost } from './lib/installNativeMessagingHost';
+ import { getSafeStorage } from './safeStorage';
+-import { installExtension } from '@tomjs/electron-devtools-installer';
+ import Api from './api';
+ import ConfigManager from './config';
+ import UpdateManager from './update';

pkgs/by-name/an/anytype/0003-remove-desktop-entry.patch

@@ -1,13 +1,12 @@
-diff --git a/electron/js/util.js b/electron/js/util.js
-index da18f41ad0..bb07ec9f21 100644
---- a/electron/js/util.js
-+++ b/electron/js/util.js
-@@ -314,7 +314,9 @@ class Util {
- 		if (!is.linux) {
+diff --git a/electron/ts/util.ts b/electron/ts/util.ts
+index 1c5d6fd4b4..8c7811b58e 100644
+--- a/electron/ts/util.ts
++++ b/electron/ts/util.ts
+@@ -318,6 +318,9 @@ class Util {
  			return;
  		};
--
-+		// NixOS: desktop entries are managed by the package, avoid 
+ 
++		// NixOS: desktop entries are managed by the package, avoid
 +		// writing user-local anytype.desktop which goes stale on updates
 +		return;
  		const { execFile } = require('child_process');

pkgs/by-name/an/anytype/package.nix

@@ -1,57 +1,116 @@
 {
   lib,
   stdenv,
+  stdenvNoCC,
   fetchFromGitHub,
-  buildNpmPackage,
-  nodejs_22,
+  makeWrapper,
+  coreutils,
+  nodejs,
+  node-gyp,
+  python3,
+  bun,
   pkg-config,
   anytype-heart,
   libsecret,
   electron,
   go,
   lsof,
+  protobuf,
   makeDesktopItem,
   copyDesktopItems,
+  writableTmpDirAsHomeHook,
   commandLineArgs ? "",
 }:
 
-buildNpmPackage (finalAttrs: {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "anytype";
-  version = "0.54.11";
+  version = "0.55.5";
+
+  strictDeps = true;
 
   src = fetchFromGitHub {
     owner = "anyproto";
     repo = "anytype-ts";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HF7bP3Ry3djNQnFDl0v6x9hzMpSLMXyI6UBItgGT+DI=";
+    hash = "sha256-9myOd7LTH/NoRY4SjU7+FSSNIhDMGKRPTBOQOURk/Hs=";
   };
 
   locales = fetchFromGitHub {
     owner = "anyproto";
     repo = "l10n-anytype-ts";
-    rev = "afa12aeb0cea6c77ce38c3e3bfd082d532948a1c";
-    hash = "sha256-YpOkmm7vW97t19twfLNExRHQvLVcrC+oDtHjwJL9dx8=";
+    rev = "b96bf7b76f10e764e7a60c7f284854aaabedcec6";
+    hash = "sha256-+vkProHi25CWxG74QB5eo0Pnwj0u5vXoZeeCoXyMOv4=";
   };
 
-  npmDepsHash = "sha256-/QWHJ2grw34LOEIDn93WDTEpQH001vVtuQgncR2SRYQ=";
+  node_modules = stdenvNoCC.mkDerivation {
+    pname = "${finalAttrs.pname}-node_modules";
+    inherit (finalAttrs) version src;
 
-  # npm dependency install fails with nodejs_24: https://github.com/NixOS/nixpkgs/issues/474535
-  nodejs = nodejs_22;
+    impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [
+      "GIT_PROXY_COMMAND"
+      "SOCKS_SERVER"
+    ];
+
+    nativeBuildInputs = [
+      bun
+      writableTmpDirAsHomeHook
+    ];
+
+    dontConfigure = true;
+
+    buildPhase = ''
+      runHook preBuild
+
+      export BUN_INSTALL_CACHE_DIR=$(mktemp -d)
+      # https://bun.com/docs/pm/cli/install#configuring-with-environment-variables
+
+      # Bun always tries to use the fastest available installation method for the target platform. On macOS, that’s clonefile and on Linux, that’s hardlink.
+      bun install \
+        --backend=copyfile \
+        --cpu="*" \
+        --frozen-lockfile \
+        --ignore-scripts \
+        --no-progress \
+        --os="*"
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out
+      find . -type d -name node_modules -exec cp -R --parents {} $out \;
+
+      runHook postInstall
+    '';
+
+    dontFixup = true;
+
+    #TODO: update it in update script
+    outputHash = "sha256-6IHFidjVDDzUOCRXVwjvzcLGKV6dWWS7k2jwrOuJ748=";
+    outputHashMode = "recursive";
+  };
 
   env = {
     ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
   };
 
   nativeBuildInputs = [
+    bun
+    nodejs
     pkg-config
     go
+    protobuf
     copyDesktopItems
+    makeWrapper
+    node-gyp
+    stdenv.cc
+    python3
   ];
-  buildInputs = [ libsecret ];
 
-  npmFlags = [
-    # keytar needs to be built against electron's ABI
-    "--nodedir=${electron.headers}"
+  buildInputs = [
+    libsecret
   ];
 
   patches = [
@@ -60,26 +119,54 @@ buildNpmPackage (finalAttrs: {
     ./0003-remove-desktop-entry.patch
   ];
 
+  configurePhase = ''
+    runHook preConfigure
+
+    cp -R ${finalAttrs.node_modules}/. .
+    patchShebangs node_modules
+
+    runHook postConfigure
+  '';
+
   buildPhase = ''
     runHook preBuild
 
+    # Building keytar against electron's ABI
+    # Trying to build in temp dir, will not work due to the keytar calling the node -p require('node-addon-api').include_dir
+    # but building inside the node_modules/keytar will find the ../node-addon-api automatically
+    chmod -R u+w node_modules/keytar node_modules/node-addon-api
+    pushd node_modules/keytar
+    HOME=$(mktemp -d) node-gyp rebuild --nodedir=${electron.headers}
+    popd
+
+    substituteInPlace scripts/generate-protos.sh \
+      --replace-fail "/usr/bin/env" "${coreutils}/bin/env"
+
     cp -r ${anytype-heart}/lib dist/
     cp -r ${anytype-heart}/bin/anytypeHelper dist/
 
+    # Without this, build fails when trying to copy/write into that directory during the js bundle step
+    chmod -R u+w dist/
+
+    bash ./scripts/generate-protos.sh --from-dist
+
+    bun run build
+
     for lang in ${finalAttrs.locales}/locales/*; do
       cp "$lang" "dist/lib/json/lang/$(basename $lang)"
     done
 
-    npm run build
-    npm run build:nmh
+    # $HOME/.cache/go-build.
+    export GOCACHE=$(mktemp -d)
+    # Runs "go build -o dist/nativeMessagingHost ./go/nativeMessagingHost.go"
+    bun run build:nmh
 
     runHook postBuild
   '';
 
   # remove unnecessary files
   preInstall = ''
-    npm prune --omit=dev
-    chmod u+w -R dist
+    chmod u+w -R dist node_modules
     find -type f \( -name "*.ts" -o -name "*.map" \) -exec rm -rf {} +
   '';
 
@@ -103,7 +190,7 @@ buildNpmPackage (finalAttrs: {
       --add-flags ${lib.escapeShellArg commandLineArgs}
 
     wrapProgram $out/lib/anytype/dist/nativeMessagingHost \
-       --prefix PATH : ${lib.makeBinPath [ lsof ]}
+      --prefix PATH : ${lib.makeBinPath [ lsof ]}
 
     runHook postInstall
   '';

pkgs/by-name/ba/bazaar/package.nix

@@ -34,7 +34,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bazaar";
-  version = "0.8.1";
+  version = "0.8.3";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -50,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "bazaar-org";
     repo = "bazaar";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Ni2WfZu4LpCIXueGJYnZ2c7sCQ9VJAeI9zVNNrh7BLE=";
+    hash = "sha256-s0l548kuVD+eNAxA3BnbpuMHD1alq0/xGBIkXb7WpC0=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ba/bazel_9/package.nix

@@ -29,7 +29,7 @@
   cctools,
   # Allow to independently override the jdks used to build and run respectively
   jdk_headless,
-  version ? "9.1.0",
+  version ? "9.1.1",
 }:
 
 let
@@ -89,7 +89,7 @@ let
 
   src = fetchzip {
     url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel-${version}-dist.zip";
-    hash = "sha256-RbRM9HxcBij5gbd0aeArslc/IyjvycM5v7zOnaDT3cU=";
+    hash = "sha256-NwZQcycUMAzos1wLdSlwv2EjhDcPVJgQTkLT57AjFvI=";
     stripRoot = false;
   };
 

pkgs/by-name/bl/blackfire/package.nix

@@ -107,7 +107,7 @@ stdenv.mkDerivation rec {
     homepage = "https://blackfire.io/";
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfree;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ spk ];
     platforms = [
       "x86_64-linux"
       "aarch64-linux"

pkgs/by-name/bl/blackfire/php-probe.nix

@@ -16,57 +16,57 @@ let
   phpMajor = lib.versions.majorMinor php.version;
   inherit (stdenv.hostPlatform) system;
 
-  version = "1.92.51";
+  version = "2026.5.0";
 
   hashes = {
     "x86_64-linux" = {
       system = "amd64";
       hash = {
-        "8.1" = "sha256-HxVqkPupo3LrKfbQGOqoxpGJjFN17Jlkdya4BjBsBVw=";
-        "8.2" = "sha256-ssbMa4Wa27nwhJZ16FT+qrB4LH/HztOtCx+MI+i16Pg=";
-        "8.3" = "sha256-p9SXxHQGmsjtSeRFt9vYS5XK6nouT7qbqmlWbEpb2Hk=";
-        "8.4" = "sha256-ArI/SNjPIbjwEBMHvKCdSOkth8qqBWT6W0RnoWyWA+o=";
-        "8.5" = "sha256-5e4f9iEn5QPZY6Z+05O7QxTwaW+cjmP6nB5fkpValoM=";
+        "8.1" = "sha256-FQzmRL1Dk4HBnrfbfOclDWGvqflFXTUMK8b1NLIb880=";
+        "8.2" = "sha256-e2+hVsoBXt8gURRvGC4bgAkLpB1GriefokAjFFUuO8c=";
+        "8.3" = "sha256-C/NsbJ8XlkBPlZ0lPeNL4SWxfVWSLxvQYDxTVf2PfyA=";
+        "8.4" = "sha256-gqEV9thI/oe38/dyrGZxhPtv4+ufzMDXJL0zgt8IbOA=";
+        "8.5" = "sha256-kw57CBFOcRpaToXD/V2veXjcQnVaM3uTLC3tgrKyNzc=";
       };
     };
     "i686-linux" = {
       system = "i386";
       hash = {
-        "8.1" = "sha256-mTw8v5DaP7D5qb3XwRZvx8XH4bTiuu2xzzo82KsrrZU=";
-        "8.2" = "sha256-Vtb0DVfPBC0JtK1XOPQ8KmA0Jq0pBBA3jkDaCV7icGg=";
-        "8.3" = "sha256-vnL8gfA6ejMcpnfKXalSOvl7vixwQLJBC3DTO4Dafow=";
-        "8.4" = "sha256-x9/BcZPJib0hal6M2vUVk1cLmN1gc3k6hypViTqForo=";
-        "8.5" = "sha256-aVmQ8vHS/oQeb44RyV5hggOt+VXLqP7wKDxgfpbopQQ=";
+        "8.1" = "sha256-Cccapa4s6Wvo/MOjReCbbJY4H1HNe5uF8Fe4UX8ftFs=";
+        "8.2" = "sha256-1k8m4Mram806XIbR4x0Kf6IH7rvhbLbaqPgM9v1SHS4=";
+        "8.3" = "sha256-Si0boOO5BRDKARZbAbPPrxRIaUjwViQLepZ5tNvkjGk=";
+        "8.4" = "sha256-BOjlJy48fS2SWK28Lcd9/MVhciDEaBJe6mRIhTa9JhI=";
+        "8.5" = "sha256-OBySA7eGI+YqvMnsOlr7p6RznqYq7DJptnYjhMfqk2Q=";
       };
     };
     "aarch64-linux" = {
       system = "arm64";
       hash = {
-        "8.1" = "sha256-S41qr5wU2dsK0IBsR/mTALguPQU+SKYVTLP7DwGQo40=";
-        "8.2" = "sha256-eQkvDRxwQNXlkZ9XzcSRfkKjp/CTZGaFwolXq6TZWaE=";
-        "8.3" = "sha256-GBjjx0cSJjYCOdDiArUPA4iqOcgpk3y9o0wi6b6UJgM=";
-        "8.4" = "sha256-s4zcHogsOy1GjTAGJuO6i7S6dp/lmRVzbjJk3/t8Zn4=";
-        "8.5" = "sha256-/lFwv6p9izXj7X+pqZe9clcp+wSYtzIPnwqeE/HFqNk=";
+        "8.1" = "sha256-Od+c9X4yg4xW9aAI0x1CacUNp7PdJl1KRIi++m4DLY8=";
+        "8.2" = "sha256-ZI2n0lXkwUg8BvpjdhqHz1F3Z7dlX+oGv6IsjRVzzWA=";
+        "8.3" = "sha256-6NMvylxdwPpbmIN5EDVcBuplP2kEQDyY+fD23k89k48=";
+        "8.4" = "sha256-356ECFSrqu5kJX/qP+SNtKl7bsGGD/ROJd9vgEX5wSM=";
+        "8.5" = "sha256-z7GMQ9wqIr2/BKi3G2Wf3cZBtU/ZC+uKMcbnmYfmm8w=";
       };
     };
     "aarch64-darwin" = {
       system = "arm64";
       hash = {
-        "8.1" = "sha256-+ko465G24UELdMmEg4ZqOA9p0/0DSs3p+On6Gg2IVMM=";
-        "8.2" = "sha256-TERILY6E1vnl+L6t+oel+1H3HTHWTTeEb1rVXtriJ8w=";
-        "8.3" = "sha256-R5Ue3erVCe1gOPk1SuDRXGA05WPm1IisHCnbXfmjFcw=";
-        "8.4" = "sha256-qqbmZa4qd7Ck87GylHeHP9m3K47DAEiTxlKdtXEnzVo=";
-        "8.5" = "sha256-3d9glqfXCMXwtLZm8fuj9DVzCIczynX7MRxnbMC7/NE=";
+        "8.1" = "sha256-vlb6HCz9KqSL+bSuVixiHVgVVkEAuCaoR7ww0/ZSdR8=";
+        "8.2" = "sha256-3XVHonZ7UW3LENuKgywyZ5q3Mo/6XBhnbiuARRGqPAg=";
+        "8.3" = "sha256-Dw+L0Bo/6BeFi+w3sm5kekR0mXoMUcsCuEksCdFpVA0=";
+        "8.4" = "sha256-i5R+vUn08yNWvPaJGRRHBPAbpxdqDmvPq3l9NPCuqxg=";
+        "8.5" = "sha256-vyBbyS8Y1mD+zFO01bMbim8Riq45+ns9YA4k41KQup8=";
       };
     };
     "x86_64-darwin" = {
       system = "amd64";
       hash = {
-        "8.1" = "sha256-XvV6x8LKjR4j081PIdKpYCVl+ayXOmPsXf+gsMeFOro=";
-        "8.2" = "sha256-qxFWj1HpWokwzsFTiRhi4vw67H8yLwu1xbhja+fAxqY=";
-        "8.3" = "sha256-ffrwc48MZzX0MJHbaDmWQpday1LicOxhR2+fwylItD0=";
-        "8.4" = "sha256-P8j8gc8lZRbuVd1UmSpYmle88h50vhJfNxTZp3v9/Sg=";
-        "8.5" = "sha256-zy24hLCTajY+BVdkJCiXoy8abhQ82Ntw7Wuqn6zJKOQ=";
+        "8.1" = "sha256-0xf09E58+kOGZbfpUeaCNdeeJx/Sv4QazfgcdV3Fqho=";
+        "8.2" = "sha256-BU3INTjuVXJ+WB16Q/6I1I5y0k+7sR158vKOiuh6H4w=";
+        "8.3" = "sha256-TBTuabrEpQR7ff+ULjZCD99a1xX4KNjTWlMQTJ1l6NU=";
+        "8.4" = "sha256-45R0CrE6MZ4RU4HslaF5/jbMOz32fCMnzj8R1F9tu34=";
+        "8.5" = "sha256-40+kki7h6DLQemLyoKOSdd8hmQXJE+Yt4rcC4V706vs=";
       };
     };
   };
@@ -161,7 +161,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Blackfire Profiler PHP module";
     homepage = "https://blackfire.io/";
     license = lib.licenses.unfree;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ spk ];
     platforms = [
       "x86_64-linux"
       "aarch64-linux"

pkgs/by-name/bl/bluesky-pds/package.nix

@@ -8,7 +8,7 @@
   fetchPnpmDeps,
   pnpmConfigHook,
   fetchFromGitHub,
-  nodejs_22,
+  nodejs_24,
   vips,
   pkg-config,
   nixosTests,
@@ -18,22 +18,22 @@
 }:
 
 let
-  # build failure against better-sqlite3, so we use nodejs_22; upstream
-  # bluesky-pds uses 20
-  nodejs = nodejs_22;
+  # upstream bluesky-social/atproto uses nodejs 22+
+  nodejs = nodejs_24;
   nodeSources = srcOnly nodejs;
   pythonEnv = python3.withPackages (p: [ p.setuptools ]);
+  pnpm = pnpm_9;
 in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pds";
-  version = "0.4.219";
+  version = "0.4.5001";
 
   src = fetchFromGitHub {
     owner = "bluesky-social";
     repo = "pds";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zXNg1rtXN9qdTBvRlSiPlRu6k1Pv3T8nhROsEarev5U=";
+    hash = "sha256-j7XNZYZHHj5HdtEuTAhNU9TD7S7eMILMflZJn0nDVaY=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/service";
@@ -44,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
     pythonEnv
     pkg-config
     pnpmConfigHook
-    pnpm_9
+    pnpm
     removeReferencesTo
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
@@ -61,9 +61,9 @@ stdenv.mkDerivation (finalAttrs: {
       src
       sourceRoot
       ;
-    pnpm = pnpm_9;
-    fetcherVersion = 3;
-    hash = "sha256-rZpimxX4oDXIaUdAkkNPEff6qYJ9C8KptsPWJKwPiFo=";
+    inherit pnpm;
+    fetcherVersion = 4;
+    hash = "sha256-3/gjhQIMxI/mwqmKV1wZ6oMiCGHutXuDY2CFSN3QnE4=";
   };
 
   buildPhase = ''
@@ -76,7 +76,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     makeWrapper "${lib.getExe nodejs}" "$out/bin/pds" \
       --add-flags --enable-source-maps \
-      --add-flags "$out/lib/pds/index.js" \
+      --add-flags "$out/lib/pds/index.ts" \
       --set-default NODE_ENV production
 
     runHook postBuild
@@ -87,7 +87,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     mkdir -p $out/{bin,lib/pds}
     mv node_modules $out/lib/pds
-    mv index.js $out/lib/pds
+    mv index.ts $out/lib/pds
 
     runHook postInstall
   '';

pkgs/by-name/cl/clickhouse/package.nix

@@ -1,6 +1,6 @@
 import ./generic.nix {
-  version = "26.5.1.882-stable";
-  rev = "5b96a8d8a5e2f4800b43a780911a39dc5a666e1c";
-  hash = "sha256-Z+xcmHIkCuYSqOFdWSRWk2BFuCeI9yXnJIntSa4zXUk=";
+  version = "26.5.2.39-stable";
+  rev = "8462fd8f3dea8603e67666414b2781ab57a8adb6";
+  hash = "sha256-lbVveT6cFT9ZhSl+0qh3NhtO4FHakFWDBJd757J8WJg=";
   lts = false;
 }

pkgs/by-name/cl/clj-kondo/package.nix

@@ -6,11 +6,11 @@
 
 buildGraalvmNativeImage (finalAttrs: {
   pname = "clj-kondo";
-  version = "2026.04.15";
+  version = "2026.05.25";
 
   src = fetchurl {
     url = "https://github.com/clj-kondo/clj-kondo/releases/download/v${finalAttrs.version}/clj-kondo-${finalAttrs.version}-standalone.jar";
-    sha256 = "sha256-BJw4A5c9F6S6T5d3dP0VdfEaayqoLbHiXUyEyqKFP94=";
+    sha256 = "sha256-SzrfsIHUW+KzZITesZ9aS00Gx7S4hekLsXXdjQJJxLM=";
   };
 
   extraNativeImageBuildArgs = [

pkgs/by-name/co/copyq/package.nix

@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "CopyQ";
-  version = "15.0.0";
+  version = "16.0.0";
 
   src = fetchFromGitHub {
     owner = "hluk";
     repo = "CopyQ";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-D1huGKvYa/GsVeLQcP69MCWF8p+ytcQxlu0qynmYbGw=";
+    hash = "sha256-QO7iOFwO++tXZMWvJVmzUDrjnuz0Fl2XYsqfIPl5GBA=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/dc/dcp/package.nix

@@ -15,13 +15,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "dcp";
-  version = "0.24.3";
+  version = "0.25.0";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "dcp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-SHMthGpQ3zKJXmltIjSEI0vq1fysdUCs1rIiaBHi0JI=";
+    hash = "sha256-9+z+umhxnu4X9Yk76qk5Li/6ltT9qR3IVgkKgFrLf2c=";
   };
 
   vendorHash = "sha256-hcuVUUr3kr3iBmSEhHy365LIWGGLFTYnBRa5jnt7kPw=";

pkgs/by-name/di/dix/package.nix

@@ -7,7 +7,7 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "dix";
-  version = "2.0.0";
+  version = "2.0.1";
 
   __structuredAttrs = true;
 
@@ -15,18 +15,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "manic-systems";
     repo = "dix";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5aH8zX/Wm+KHzd1fjmjlxjDB+psDG42JAY5U8lrjGDU=";
+    hash = "sha256-KTlFgBEVKJIXymfN2UU8hvGM71PYRcNgJ1XWUmG2AI4=";
   };
 
-  cargoHash = "sha256-llStz2BaHBH9iHhfbptAE+Td5HPsvzAlPtXohrCxY4w=";
-
-  env.TMPDIR = "/tmp/";
-  checkFlags = [
-    "--skip=store::nix_command::tests::test_query_closure_path_info"
-    "--skip=store::nix_command::tests::test_query_closure_size"
-    "--skip=store::nix_command::tests::test_query_dependents"
-    "--skip=store::nix_command::tests::test_query_system_derivations"
-  ];
+  cargoHash = "sha256-pNkSdsxOpv0E/xXs7tMg2vtP0PBU7p8fh3H4IX/u5k4=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;

pkgs/by-name/dt/dtop/package.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "dtop";
-  version = "0.7.6";
+  version = "0.7.7";
 
   src = fetchFromGitHub {
     owner = "amir20";
     repo = "dtop";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-v4LG0k9eMZiFYmIecHXwQqrTINaMAiqPYiXYEuQxx2A=";
+    hash = "sha256-kYSOJCQfoYXhdZ3cyRv/+Ifov4VzOv0gqvjueVMmnuQ=";
   };
 
-  cargoHash = "sha256-4F5eCt8AaVtGJRe7uBMHqdM3g1mLlWDXIpZCojRUjjc=";
+  cargoHash = "sha256-fspIjgctyhQwyDygrSrtJBb/EYxY8o00/UJy/z89yso=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = "--version";

pkgs/by-name/gi/git-bug/package.nix

@@ -53,6 +53,7 @@ buildGoModule (finalAttrs: {
 
   postInstall = ''
     installShellCompletion \
+      --cmd git-bug \
       --bash misc/completion/bash/git-bug \
       --zsh misc/completion/zsh/git-bug \
       --fish misc/completion/fish/git-bug

pkgs/by-name/gi/gitsign/package.nix

@@ -10,15 +10,15 @@
 
 buildGoModule (finalAttrs: {
   pname = "gitsign";
-  version = "0.16.0";
+  version = "0.16.1";
 
   src = fetchFromGitHub {
     owner = "sigstore";
     repo = "gitsign";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-XFeKU956FIfQhaca2M/OtYgCF8qErzPcyMBEGvzPAcc=";
+    hash = "sha256-BkaEI3YSnfMbRQ0r/rGUgZqUaCe3L1BXGxO4Ft19TdQ=";
   };
-  vendorHash = "sha256-fjrdQZVXgBvdKQFnmjtLShBHsKNIp5Y/uW7aU2cP1aY=";
+  vendorHash = "sha256-Sltj/DwS3T7puIaH5HAZ+BE9vlv79+FlvK+t5O2VSM0=";
 
   subPackages = [
     "."

pkgs/by-name/he/helmify/package.nix

@@ -0,0 +1,44 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "helmify";
+  version = "0.4.20";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "arttor";
+    repo = "helmify";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Az/rNrNwWkQCZ8iy2qkix8xqsWA+eUbFw7YstA9usdw=";
+  };
+
+  vendorHash = "sha256-a2uA2P9eenpgb2bFMvy3ioI9crG0FpvD1vEXqCwwwyw=";
+
+  ldflags = [
+    "-s"
+    "-X main.version=${finalAttrs.version}"
+    "-X main.commit=${finalAttrs.src.tag}"
+    "-X main.date=19700101"
+  ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Creates Helm chart from Kubernetes yaml";
+    homepage = "https://github.com/arttor/helmify";
+    changelog = "https://github.com/arttor/helmify/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jlesquembre ];
+    mainProgram = "helmify";
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/ib/ibm-plex/fonts.nix

@@ -0,0 +1,99 @@
+{
+  math = {
+    hash = "sha256-dJA6uqxa/yb3eLY4l39NeP0yIl2NfrbaRpf6h0/F7Xc=";
+    name = "IBM Plex Math";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-math@1.1.0/ibm-plex-math.zip";
+    version = "1.1.0";
+  };
+  mono = {
+    hash = "sha256-OwUmrPfEehLDz0fl2ChYLK8FQM2p0G1+EMrGsYEq+6g=";
+    name = "IBM Plex Mono";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-mono@1.1.0/ibm-plex-mono.zip";
+    version = "1.1.0";
+  };
+  sans = {
+    hash = "sha256-mK+8GGl2ugF2+fS6yd3p5NWPHHcKEJWiShDS3lihOlI=";
+    name = "IBM Plex Sans";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans@1.1.0/ibm-plex-sans.zip";
+    version = "1.1.0";
+  };
+  sans-arabic = {
+    hash = "sha256-qi4k7kMLftIuq87idyxq46FOD6QYycdG6j3zJmu8mhI=";
+    name = "IBM Plex Sans Arabic";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans-arabic@1.1.0/ibm-plex-sans-arabic.zip";
+    version = "1.1.0";
+  };
+  sans-condensed = {
+    hash = "sha256-prqyJIPs+UpQxFTbn/eAfsG/jKwQTOO72fZNzAtXUWg=";
+    name = "IBM Plex Sans Condensed";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans-condensed@2.0.0/ibm-plex-sans-condensed.zip";
+    version = "2.0.0";
+  };
+  sans-devanagari = {
+    hash = "sha256-K57OVqcH5r9tZx8NFEoz1P3xpUooqpF7xxJzNmnObwE=";
+    name = "IBM Plex Sans Devanagari";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans-devanagari@1.1.0/ibm-plex-sans-devanagari.zip";
+    version = "1.1.0";
+  };
+  sans-hebrew = {
+    hash = "sha256-rTuBQYLI+6gEFTumCdaWpeoLzRoyFSmqWbXziq+UG6I=";
+    name = "IBM Plex Sans Hebrew";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans-hebrew@1.1.0/ibm-plex-sans-hebrew.zip";
+    version = "1.1.0";
+  };
+  sans-jp = {
+    hash = "sha256-2BbhqsutMXEoS2JoZjJprrElIpFa9lgvPaM65pnYdfs=";
+    name = "IBM Plex Sans Japanese";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans-jp@3.0.0/ibm-plex-sans-jp.zip";
+    version = "3.0.0";
+  };
+  sans-kr = {
+    hash = "sha256-FsHxMvLlI4yylgG96DOZIdW2DYpk7I+c5QgkVIkNZIE=";
+    name = "IBM Plex Sans Korean";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans-kr@1.1.0/ibm-plex-sans-kr.zip";
+    version = "1.1.0";
+  };
+  sans-sc = {
+    hash = "sha256-Q3cEVlR/UkNZaGIhNMIdojId6fHmAsZdLwMsKq1zLRY=";
+    name = "IBM Plex Sans Chinese SC";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans-sc@1.1.0/ibm-plex-sans-sc.zip";
+    version = "1.1.0";
+  };
+  sans-tc = {
+    hash = "sha256-kZvzSK6fEjfVMR4kxC4lxtD7GskqvJZx8BBJVT4T9MU=";
+    name = "IBM Plex Sans Chinese TC";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans-tc@1.1.1/ibm-plex-sans-tc.zip";
+    version = "1.1.1";
+  };
+  sans-thai = {
+    hash = "sha256-JZVbvZdj+IfBthiqivOXHrvAUe392M9ECGsiJkm0saE=";
+    name = "IBM Plex Sans Thai";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans-thai@1.1.0/ibm-plex-sans-thai.zip";
+    version = "1.1.0";
+  };
+  sans-thai-looped = {
+    hash = "sha256-cry/Ctwt1bsrdbvWkJIYWLjsvV6a1lLFsT85znqERnw=";
+    name = "IBM Plex Sans Thai Looped";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans-thai-looped@1.1.0/ibm-plex-sans-thai-looped.zip";
+    version = "1.1.0";
+  };
+  sans-variable = {
+    hash = "sha256-W45wPOmmP4KuJ3TVes2x0n25KgyDzX48ce1lQrjAXpw=";
+    name = "IBM Plex Sans (Variable)";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans-variable@0.2.0/plex-sans-variable.zip";
+    version = "0.2.0";
+  };
+  serif = {
+    hash = "sha256-PO9KxV4K3a7fB4fR/i7LSf0mhK4I2eUDMsbSYWDQcb4=";
+    name = "IBM Plex Serif";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-serif@2.0.0/ibm-plex-serif.zip";
+    version = "2.0.0";
+  };
+  serif-variable = {
+    hash = "sha256-xhjmeIMT7FAFhfR8fekAxzQEl1hOtPdQ6qsVpnZN6Xg=";
+    name = "IBM Plex Serif (Variable)";
+    stripRoot = false;
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-serif-variable@2.0.0/plex-serif-variable.zip";
+    version = "2.0.0";
+  };
+}

pkgs/by-name/ib/ibm-plex/hashes.nix

@@ -1,16 +0,0 @@
-{
-  "serif" = "sha256-8ygaAeMKygYS4GCub4YUQmkh87pYHfi3s0PQ6AbaeGw=";
-  "sans" = "sha256-mK+8GGl2ugF2+fS6yd3p5NWPHHcKEJWiShDS3lihOlI=";
-  "sans-condensed" = "sha256-/aJTXmrHuoPSrtCKNodBY7I0CriayNTx5LCXw+/MFvE=";
-  "sans-arabic" = "sha256-qi4k7kMLftIuq87idyxq46FOD6QYycdG6j3zJmu8mhI=";
-  "sans-devanagari" = "sha256-K57OVqcH5r9tZx8NFEoz1P3xpUooqpF7xxJzNmnObwE=";
-  "sans-thai" = "sha256-JZVbvZdj+IfBthiqivOXHrvAUe392M9ECGsiJkm0saE=";
-  "sans-thai-looped" = "sha256-cry/Ctwt1bsrdbvWkJIYWLjsvV6a1lLFsT85znqERnw=";
-  "sans-sc" = "sha256-Q3cEVlR/UkNZaGIhNMIdojId6fHmAsZdLwMsKq1zLRY=";
-  "sans-tc" = "sha256-kZvzSK6fEjfVMR4kxC4lxtD7GskqvJZx8BBJVT4T9MU=";
-  "sans-kr" = "sha256-FsHxMvLlI4yylgG96DOZIdW2DYpk7I+c5QgkVIkNZIE=";
-  "sans-jp" = "sha256-hUl/SSkN6q3pDTtrY2mJepw3ljhhLJskGbxfsTl9TuI=";
-  "sans-hebrew" = "sha256-rTuBQYLI+6gEFTumCdaWpeoLzRoyFSmqWbXziq+UG6I=";
-  "mono" = "sha256-OwUmrPfEehLDz0fl2ChYLK8FQM2p0G1+EMrGsYEq+6g=";
-  "math" = "sha256-dJA6uqxa/yb3eLY4l39NeP0yIl2NfrbaRpf6h0/F7Xc=";
-}

pkgs/by-name/ib/ibm-plex/package.nix

@@ -1,60 +1,71 @@
 {
   lib,
   stdenvNoCC,
-  fetchzip,
   symlinkJoin,
+  fetchzip,
   installFonts,
   families ? [ ],
 }:
 let
-  version = import ./version.nix;
-  availableFamilies = import ./hashes.nix;
-
-  availableFamilyNames = builtins.attrNames availableFamilies;
+  allFonts = import ./fonts.nix;
+  availableFamilyNames = builtins.attrNames allFonts;
   selectedFamilies = if (families == [ ]) then availableFamilyNames else families;
-
   unknownFamilies = lib.subtractLists availableFamilyNames families;
-in
-assert lib.assertMsg (unknownFamilies == [ ]) "Unknown font(s): ${toString unknownFamilies}";
-stdenvNoCC.mkDerivation {
-  pname = "ibm-plex";
-  inherit version;
+  fontsToBuild = lib.filterAttrs (name: _: lib.elem name selectedFamilies) allFonts;
+  makeFont =
+    font:
+    stdenvNoCC.mkDerivation (finalAttrs: {
+      pname = lib.toLower (lib.replaceStrings [ " (" ")" " " ] [ "-" "" "-" ] font.name);
+      inherit (font) version;
 
-  src = symlinkJoin {
-    name = "ibm-plex-src";
-    paths = map (
-      family:
-      fetchzip {
-        url = "https://github.com/IBM/plex/releases/download/%40ibm%2Fplex-${family}%40${version}/ibm-plex-${family}.zip";
-        hash = availableFamilies.${family};
-      }
-    ) selectedFamilies;
-    postBuild = ''
-      find "$out" \( -name unhinted -or -name split \) -exec rm -fr {} +
-    '';
-  };
+      nativeBuildInputs = [ installFonts ];
 
-  sourceRoot = ".";
+      outputs = [
+        "out"
+        "webfont"
+      ];
 
-  nativeBuildInputs = [ installFonts ];
+      src = fetchzip {
+        inherit (font) hash url;
+        stripRoot = font.stripRoot or true;
+      };
 
-  outputs = [
-    "out"
-    "webfont"
-  ];
-
-  passthru.updateScript = ./update.sh;
+      # Some fonts, e.g. "ibm-plex-sans-korean" and "ibm-plex-sans-japanese"
+      # include both unhinted and hinted variants of the ttf and woff/woff2 type
+      # fonts, which collide when using the `installFonts` hook.
+      # Default to installing the hinted variant of the fonts.
+      #
+      # Additionally, fonts with webfonts include complete and split forms.
+      # Default to the complete forms.
+      preInstall = ''
+        find . -type d \( -name unhinted -or -name split \) -exec rm -rf {} +
+      '';
 
+      meta = meta // {
+        description = font.name;
+      };
+    });
+  fontDerivations = lib.mapAttrs (_: v: makeFont v) fontsToBuild;
   meta = {
     description = "IBM Plex Typeface";
     homepage = "https://www.ibm.com/plex/";
-    changelog = "https://github.com/IBM/plex/raw/v${version}/CHANGELOG.md";
     license = lib.licenses.ofl;
     platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [
+      magicquark
       ners
       romildo
       ryanccn
     ];
   };
+in
+assert lib.assertMsg (unknownFamilies == [ ]) "Unknown font(s): ${toString unknownFamilies}";
+symlinkJoin {
+  pname = "ibm-plex";
+  version = "0-unstable-2026-02-12";
+  paths = lib.attrValues fontDerivations;
+  passthru = fontDerivations // {
+    updateScript = ./update.py;
+  };
+  inherit meta;
 }

pkgs/by-name/ib/ibm-plex/update.py

@@ -0,0 +1,85 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -i python3 -p nix nix-prefetch python3
+import json
+import subprocess
+import urllib.request
+
+fonts_file = "fonts.nix"
+fonts_data = json.loads(
+    subprocess.check_output(["nix", "eval", "--json", "-f", fonts_file])
+)
+
+releases_url = "https://api.github.com/repos/IBM/plex/releases"
+releases = json.loads(urllib.request.urlopen(releases_url).read())
+
+for font in fonts_data.keys():
+    font_tag = f"@ibm/plex-{font}@"
+    font_file = f"plex-{font}.zip"
+    current_version = fonts_data.get(font, {}).get("version")
+
+    latest_release = next(
+        (r for r in releases if r["tag_name"].lower().startswith(font_tag)), None
+    )
+
+    if latest_release is None:
+        print(f"No release found for {font}")
+        continue
+
+    latest_version = latest_release["tag_name"].split("@")[-1]
+
+    if current_version == latest_version:
+        print(f"Font {font} is up-to-date")
+        continue
+
+    print(f"Updating {font} from {current_version} to {latest_version}")
+
+    asset = next(
+        (
+            a
+            for a in latest_release["assets"]
+            if font_file.lower() in a["name"].lower()
+        ),
+        None,
+    )
+
+    if asset is None:
+        print(f"Warning: No asset found for {font}")
+        continue
+
+    asset_url = asset["browser_download_url"]
+
+    raw_hash = (
+        subprocess.check_output(["nix-prefetch-url", "--unpack", asset_url])
+        .decode()
+        .strip()
+    )
+
+    sri_hash = (
+        subprocess.check_output(
+            ["nix", "--extra-experimental-features", "nix-command", "hash", "convert", "--hash-algo", "sha256", raw_hash]
+        )
+        .decode()
+        .strip()
+    )
+
+    for x, y in zip(
+        ["version", "hash", "url"],
+        [latest_version, sri_hash, asset_url]
+    ):
+        if fonts_data[font].get(x) != y:
+            fonts_data[font][x] = y
+
+
+with open(fonts_file, "w") as f:
+    f.write("{\n")
+    for font in sorted(fonts_data.keys()):
+        attrs = fonts_data[font]
+        f.write(f"  {font} = {{\n")
+        for k in sorted(attrs.keys()):
+            v = attrs[k]
+            if isinstance(v, bool):
+                f.write(f"    {k} = {'true' if v else 'false'};\n")
+            else:
+                f.write(f'    {k} = "{v}";\n')
+        f.write("  };\n")
+    f.write("}\n")

pkgs/by-name/ib/ibm-plex/update.sh

@@ -1,43 +0,0 @@
-#! /usr/bin/env nix-shell
-#! nix-shell -i bash -p nix nix-prefetch jq
-#  shellcheck shell=bash
-set -eo pipefail
-
-families=(
-    "serif"
-    "sans"
-    "sans-condensed"
-    "sans-arabic"
-    "sans-devanagari"
-    "sans-thai"
-    "sans-thai-looped"
-    "sans-sc"
-    "sans-tc"
-    "sans-kr"
-    "sans-jp"
-    "sans-hebrew"
-    "mono"
-    "math"
-)
-
-version=$(curl --silent 'https://api.github.com/repos/IBM/plex/releases/latest' | jq -r '.tag_name | sub("^@ibm/[\\w-]+@"; "")')
-
-dirname="$(dirname "$0")"
-echo \""${version}"\" >"$dirname/version-new.nix"
-if diff -q "$dirname/version-new.nix" "$dirname/version.nix"; then
-    echo No new version available, current: "$version"
-    rm "$dirname/version-new.nix"
-    exit 0
-else
-    echo Updated to version "$version"
-    mv "$dirname/version-new.nix" "$dirname/version.nix"
-fi
-
-printf '{\n' > "$dirname/hashes.nix"
-
-for family in "${families[@]}"; do
-    url="https://github.com/IBM/plex/releases/download/%40ibm%2Fplex-${family}%40${version}/ibm-plex-${family}.zip"
-    printf '  "%s" = "%s";\n' "$family" "$(nix-prefetch-url --unpack "$url" | xargs nix --extra-experimental-features nix-command hash convert --hash-algo sha256)" >>"$dirname/hashes.nix"
-done
-
-printf '}\n' >> "$dirname/hashes.nix"

pkgs/by-name/ib/ibm-plex/version.nix

@@ -1 +0,0 @@
-"1.1.0"

pkgs/by-name/ja/jai-jail/package.nix

@@ -0,0 +1,50 @@
+{
+  lib,
+  gcc15Stdenv,
+  fetchFromGitHub,
+  autoreconfHook,
+  pkg-config,
+  pandoc,
+  systemd,
+  util-linux,
+  acl,
+}:
+
+gcc15Stdenv.mkDerivation (finalAttrs: {
+  pname = "jai-jail";
+  version = "0.3";
+
+  src = fetchFromGitHub {
+    owner = "stanford-scs";
+    repo = "jai";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-AByC7Xh1FYbQ/4Au396m2zYUxsLqcF1PEbpdz7x6LaQ=";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    pandoc
+    systemd
+  ];
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  buildInputs = [
+    util-linux # libmount
+    acl
+  ];
+
+  configureFlags = [ "--with-untrusted-user=jai" ];
+
+  meta = {
+    description = "Lightweight jail for AI CLIs";
+    mainProgram = "jai";
+    homepage = "https://jai.scs.stanford.edu";
+    changelog = "https://github.com/stanford-scs/jai/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ agentelement ];
+    platforms = lib.platforms.linux;
+  };
+})

pkgs/by-name/je/jellyfin-ffmpeg/package.nix

@@ -5,7 +5,7 @@
 }:
 
 let
-  version = "7.1.4-1";
+  version = "7.1.4-3";
 in
 
 (ffmpeg_7-full.override {
@@ -14,7 +14,7 @@ in
     owner = "jellyfin";
     repo = "jellyfin-ffmpeg";
     tag = "v${version}";
-    hash = "sha256-VijSSbtcaeQNf1UwpPKTIfzAHHp2BHvBdhXeigTQEbI=";
+    hash = "sha256-3aPiR4BJrR/5UFKRbrK8IbyW6HN9wC6oTSYKH4Ak4EU=";
   };
 }).overrideAttrs
   (old: {

pkgs/by-name/je/jellyfin-web/package.nix

@@ -13,7 +13,7 @@
 }:
 buildNpmPackage (finalAttrs: {
   pname = "jellyfin-web";
-  version = "10.11.10";
+  version = "10.11.11";
 
   src =
     assert finalAttrs.version == jellyfin.version;
@@ -21,7 +21,7 @@ buildNpmPackage (finalAttrs: {
       owner = "jellyfin";
       repo = "jellyfin-web";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-fSpzF6Arx0JfL9fuQHjzf3m82XZR2BZkV0lA37L4DN4=";
+      hash = "sha256-3Gyg0eSbOXO0wgdgzuOtD8nDmSM37z7Bc0fKcbo9ffA=";
     };
 
   nodejs = nodejs_22;
@@ -31,7 +31,7 @@ buildNpmPackage (finalAttrs: {
       --replace-fail "git describe --always --dirty" "echo ${finalAttrs.src.rev}"
   '';
 
-  npmDepsHash = "sha256-DCFgivbZrDufRaB+4PeFxO6ISbEM9lXhXmlzc/5GbVU=";
+  npmDepsHash = "sha256-4kZo50xY/SvjpHToeIt0E91yeM7ab6Q6XtBMU5zSrF4=";
 
   preBuild = ''
     # using sass-embedded fails at executing node_modules/sass-embedded-linux-x64/dart-sass/src/dart

pkgs/by-name/je/jellyfin/package.nix

@@ -14,13 +14,13 @@
 
 buildDotnetModule (finalAttrs: {
   pname = "jellyfin";
-  version = "10.11.10"; # ensure that jellyfin-web has matching version
+  version = "10.11.11"; # ensure that jellyfin-web has matching version
 
   src = fetchFromGitHub {
     owner = "jellyfin";
     repo = "jellyfin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bad532F8Ln5Y3TV4x5c7mgsiI+ZJGTZoahuSZhefMvQ=";
+    hash = "sha256-HCs4ZsutVoVH+bBZANjpPeMyV8e63Yemjg9DSr0R9zg=";
   };
 
   propagatedBuildInputs = [ sqlite ];

pkgs/by-name/k3/k3d/package.nix

@@ -17,16 +17,16 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "k3d";
-  version = "5.8.3";
+  version = "5.9.0";
 
   src = fetchFromGitHub {
     owner = "k3d-io";
     repo = "k3d";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-UBiDDZf/UtgPGRV9WUnoC32wc64nthBpBheEYOTp6Hk=";
+    hash = "sha256-W/fcpIgpE6kn87EXNVU+K9rFis5QAvVC2LgthI9M6yg=";
   };
 
-  vendorHash = "sha256-lFmIRtkUiohva2Vtg4AqHaB5McVOWW5+SFShkNqYVZ8=";
+  vendorHash = "sha256-QRr8dmiqoNHu30OILwrS9AXK68hnNIqXlKMkASbcKVo=";
   deleteVendor = true;
 
   nativeBuildInputs = [ installShellFiles ];

pkgs/by-name/ke/keepassxc/package.nix

@@ -196,6 +196,7 @@ stdenv.mkDerivation (finalAttrs: {
       using the KeePassXC Browser Extension (https://github.com/keepassxreboot/keepassxc-browser)
     '';
     homepage = "https://keepassxc.org/";
+    donationPage = "https://keepassxc.org/donate/";
     changelog = "https://github.com/keepassxreboot/keepassxc/blob/${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.gpl2Plus;
     mainProgram = "keepassxc";

pkgs/by-name/li/libslirp/package.nix

@@ -10,14 +10,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libslirp";
-  version = "4.9.1";
+  version = "4.9.3";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "slirp";
     repo = "libslirp";
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-MKP3iBExaPQryiahI1l/4bTgVht5Vu8AxaDyMotqmMo=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Spr3dO5ehuUlzx3EnJi8najANWOirwQcTsWTVRVXYuY=";
   };
 
   separateDebugInfo = true;
@@ -35,6 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   meta = {
+    changelog = "https://gitlab.freedesktop.org/slirp/libslirp/-/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     description = "General purpose TCP-IP emulator";
     homepage = "https://gitlab.freedesktop.org/slirp/libslirp";
     license = lib.licenses.bsd3;

pkgs/by-name/mi/misskey/package.nix

@@ -108,6 +108,7 @@ stdenv.mkDerivation (finalAttrs: {
       runHook preInstall
 
       mkdir -p $out/data
+      sed -i '/"packageManager":/d' package.json
       cp -r . $out/data
 
       # Set up symlink for use at runtime
@@ -119,6 +120,7 @@ stdenv.mkDerivation (finalAttrs: {
       makeWrapper ${pnpm}/bin/pnpm $out/bin/misskey \
         --run "${checkEnvVarScript} || exit" \
         --chdir $out/data \
+        --add-flag "--config.store-dir=/tmp/pnpm-store" \
         --add-flag "--config.verify-deps-before-run=false" \
         --add-flag run \
         --set-default NODE_ENV production \

pkgs/by-name/mu/muffet/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "muffet";
-  version = "2.11.4";
+  version = "2.11.5";
 
   src = fetchFromGitHub {
     owner = "raviqqe";
     repo = "muffet";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xczs3H1Jcr+WH8SCOhXRZx7Aft2BNpI+Kg4He8YEVVA=";
+    hash = "sha256-dPScTdOGR3cgcFBa09iez0/DkCugXseIGGRMiCPJeYo=";
   };
 
-  vendorHash = "sha256-94ytPGPbpXADIyDl28wWU2KmtwT17GyQFUe/bUc4RkA=";
+  vendorHash = "sha256-FXV+wP22R3gPAMGbhyz/v1Rk7w6z2ovoWirbLM1Wl24=";
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];

pkgs/by-name/ne/necesse-server/package.nix

@@ -6,7 +6,7 @@
 }:
 
 let
-  version = "1.2.0-22728942";
+  version = "1.2.0-23522718";
   urlVersion = lib.replaceStrings [ "." ] [ "-" ] version;
 
 in
@@ -15,8 +15,8 @@ stdenvNoCC.mkDerivation {
   inherit version;
 
   src = fetchzip {
-    url = "https://necessegame.com/content/server/${urlVersion}/necesse-server-linux64-${urlVersion}.zip";
-    hash = "sha256-kSBql3oHG368DczSM7FkWeAZcfTrNP1x31LX7HRrgTE=";
+    url = "https://necesse.pwn.sh/server/necesse-server-linux64-${urlVersion}.zip";
+    hash = "sha256-PIguTYULddLKj6PpoSvX3gNSvqrS7oRTOPuwoA0/XOc=";
   };
 
   # removing packaged jre since we use our own

pkgs/by-name/ne/necesse-server/update.sh

@@ -3,13 +3,30 @@
 
 set -eu -o pipefail
 
+website=$(curl -sL https://necessegame.com/server)
+
 version=$(
-    curl -s http://www.necessegame.com/server \
+    echo "$website" \
         | pup 'a[href*="linux64"] text{}' \
         | awk -F'[v ]' '/Linux64/ {print $4"-"$6}' \
         | sort -Vu \
         | tail -n1
 )
 
-[[ $version =~ ^[0-9]+\.[0-9]+\.[0-9]+\-[0-9]+$ ]] \
-    && update-source-version necesse-server "$version"
+if [[ $version =~ ^[0-9]+\.[0-9]+\.[0-9]+\-[0-9]+$ ]]; then
+    version_url=${version//./-}
+
+    # extract the expiring presigned S3 URL for the new zip
+    url=$(
+        echo "$website" \
+            | pup "a[href*=\"linux64-${version_url}\"] attr{href}" \
+            | sed 's/\&/\&/g'
+    )
+
+    # call API to remote-fetch the zip immediately and keep it cached,
+    # then fetch the zip locally to get the SRI hash, then update.
+    # fails early if the zip cannot be remote-fetched / cached.
+    curl -s --fail-with-body "https://necesse.pwn.sh/cache.php?version=${version_url}" \
+        && sri=$(nix-prefetch-url --unpack "$url" | xargs nix hash convert --hash-algo sha256 --to sri) \
+        && update-source-version necesse-server "$version" "$sri"
+fi

pkgs/by-name/ne/neovim-unwrapped/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   gettext,
   libuv,
@@ -123,6 +124,11 @@ stdenv.mkDerivation (
       # necessary so that nix can handle `UpdateRemotePlugins` for the plugins
       # it installs. See https://github.com/neovim/neovim/issues/9413.
       ./system_rplugin_manifest.patch
+      (fetchpatch {
+        name = "CVE-2026-11487.patch";
+        url = "https://github.com/neovim/neovim/commit/f83e0dcaf8cf18de94828341b0a1a61a86c75baf.patch";
+        hash = "sha256-iWnq0ezbKYJqjvevVlcTJBvUc17ZvrhsanhtuKrh8zM=";
+      })
     ];
 
     inherit lua;

pkgs/by-name/ni/nixos-rebuild-ng/nixos-rebuild.8.scd

@@ -314,13 +314,16 @@ It must be one of the following:
 	be made using _nixos_ function in nixpkgs or importing and calling
 	nixos/lib/eval-config.nix from nixpkgs. If specified without *--attr*
 	option, builds the configuration from the top-level attribute set of the
-	file.
+	file. Using this option disables automatic flake detection, same as
+	*--no-flake*.
 
 *--attr* _attrPath_, *-A* _attrPath_
 	Build the NixOS system from a nix file and use the specified
 	attribute path from the file specified by the *--file* option.
 	If specified without *--file* option, uses _system.nix_ in current directory,
 	the system-wide _<nixos-system>_ file, or finally, /etc/nixos/system.nix.
+	Using this option disables automatic flake detection, same as
+	*--no-flake*.
 
 *--flake* _flake-uri[#name]_, *-F* _flake-uri[#name]_
 	Build the NixOS system from the specified flake. It defaults to the
@@ -379,6 +382,10 @@ NIX_SSHOPTS
 NIX_SUDOOPTS
 	Additional options to be passed to sudo on the command line.
 
+NIXOS_REBUILD_NO_SYSTEMD_RUN
+	If set, then *nixos-rebuild* will run without the
+	_systemd-run_ wrapper.
+
 # FILES
 
 /etc/nixos/system.nix

pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py

@@ -329,6 +329,10 @@ def parse_args(
     if args.flake and (args.file or args.attr):
         parser.error("--flake cannot be used with --file or --attr")
 
+    if (args.file or args.attr) and args.flake is None:
+        # Disable flake auto-detection when --file or --attr is used
+        args.flake = False
+
     if args.store_path:
         if args.rollback:
             parser.error("--store-path and --rollback are mutually exclusive")

pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py

@@ -708,6 +708,8 @@ def switch_to_configuration(
             "not working in target host"
         )
         cmd = []
+    elif os.environ.get("NIXOS_REBUILD_NO_SYSTEMD_RUN"):
+        cmd = []
 
     run_wrapper(
         [*cmd, path_to_config / "bin/switch-to-configuration", str(action)],

pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py

@@ -89,6 +89,22 @@ def test_parse_args() -> None:
     assert r_store_path.flake is False
     assert r_store_path.store_path == "/nix/store/foo"
 
+    # --file and --attr should disable flake auto-detection
+    r_file, _ = nr.parse_args(["nixos-rebuild", "switch", "--file", "foo.nix"])
+    assert r_file.flake is False
+    assert r_file.file == "foo.nix"
+
+    r_attr, _ = nr.parse_args(["nixos-rebuild", "switch", "--attr", "bar"])
+    assert r_attr.flake is False
+    assert r_attr.attr == "bar"
+
+    r_file_attr, _ = nr.parse_args(
+        ["nixos-rebuild", "switch", "--file", "foo.nix", "--attr", "bar"]
+    )
+    assert r_file_attr.flake is False
+    assert r_file_attr.file == "foo.nix"
+    assert r_file_attr.attr == "bar"
+
     r1, g1 = nr.parse_args(
         [
             "nixos-rebuild",

pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py

@@ -819,6 +819,38 @@ def test_switch_to_configuration_without_systemd_run(
     )
 
 
+@patch(get_qualified_name(n.run_wrapper, n), autospec=True)
+def test_switch_to_configuration_without_systemd_run_env_var(
+    mock_run: Any, monkeypatch: MonkeyPatch
+) -> None:
+    profile_path = Path("/path/to/profile")
+    mock_run.return_value = CompletedProcess([], 0)
+
+    with monkeypatch.context() as mp:
+        mp.setenv("LOCALE_ARCHIVE", "")
+        mp.setenv("NIXOS_REBUILD_NO_SYSTEMD_RUN", "1")
+
+        n.switch_to_configuration(
+            profile_path,
+            m.Action.SWITCH,
+            elevate=e.NO_ELEVATOR,
+            target_host=None,
+            specialisation=None,
+            install_bootloader=False,
+        )
+    mock_run.assert_called_with(
+        [profile_path / "bin/switch-to-configuration", "switch"],
+        env={
+            "LOCALE_ARCHIVE": e.PRESERVE_ENV,
+            "NIXOS_NO_CHECK": e.PRESERVE_ENV,
+            "NIXOS_INSTALL_BOOTLOADER": "0",
+        },
+        elevate=e.NO_ELEVATOR,
+        remote=None,
+        stdout=sys.stderr,
+    )
+
+
 @patch(get_qualified_name(n.run_wrapper, n), autospec=True)
 def test_switch_to_configuration_with_systemd_run(
     mock_run: Mock, monkeypatch: MonkeyPatch

pkgs/by-name/ol/ollama/package.nix

@@ -152,13 +152,13 @@ let
 in
 goBuild (finalAttrs: {
   pname = "ollama";
-  version = "0.30.5";
+  version = "0.30.6";
 
   src = fetchFromGitHub {
     owner = "ollama";
     repo = "ollama";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jh/B/FkmAliCVzqc8DGCPYa5+XejE3cFZTzSuRxjPvw=";
+    hash = "sha256-qO+Tsjg64QekGHNNiNy5YGSDoToGSnqiN5hN+0LCp4Q=";
   };
 
   vendorHash = "sha256-lZdGzGb9xRjTm1Rm7/wHjqM490gLznLEndmb4mNbCX0=";

pkgs/by-name/op/openfga-cli/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "openfga-cli";
-  version = "0.7.13";
+  version = "0.7.15";
 
   src = fetchFromGitHub {
     owner = "openfga";
     repo = "cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-nV0Y0oCPH0zRWdhjGhXqX7dkMwhlEjwucr3K6dN0vDg=";
+    hash = "sha256-KChWGGbrgAAbIW6JU6FBaxMbkxv50hNzcOK44ebt7hI=";
   };
 
-  vendorHash = "sha256-kzxuFP1D3oD2P2goU48nj40/4KyY9bDhf9gTtpuoz1I=";
+  vendorHash = "sha256-4PLtThxswBnxHhCI6zDePOge8lpqTfAYXkKbktP+C5E=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/op/openfga/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "openfga";
-  version = "1.14.2";
+  version = "1.16.1";
 
   src = fetchFromGitHub {
     owner = "openfga";
     repo = "openfga";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-nY5HRkZCKgjr1a5XxxRcUwCms9PCQs3IZiFgAEaD7To=";
+    hash = "sha256-4vp2lyONLP5YJzbzJidg3+LAsQ/NhJAh+mvI2IrZWKI=";
   };
 
-  vendorHash = "sha256-q5NZLPtdwFeHzLi+ZmRzGScxkl0OOxTVo/W6yUL1lO8=";
+  vendorHash = "sha256-S47vnGCnDiXUMINc53X1n0vVqU8fs0LHz3vbdtNZjlY=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/pi/pipeform/package.nix

@@ -0,0 +1,36 @@
+{
+  lib,
+  stdenv,
+  buildGoModule,
+  fetchFromGitHub,
+  libx11,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "pipeform";
+  version = "0.2.1";
+
+  src = fetchFromGitHub {
+    owner = "magodo";
+    repo = "pipeform";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-qmA+4xNstR1VRoYZW+xukNCEuEq6aGVkja3DYxZZVyY=";
+  };
+
+  vendorHash = "sha256-QI6Rnq3JxQuKRMkeo9Fvv6wfcTMgDEQ3Ot+es3IAUIA=";
+
+  subPackages = [ "." ];
+
+  __structuredAttrs = true;
+
+  # Clipboard support
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ libx11 ];
+
+  meta = {
+    description = "TUI for Terraform runtime progress";
+    homepage = "https://github.com/magodo/pipeform";
+    license = lib.licenses.mpl20;
+    mainProgram = "pipeform";
+    maintainers = with lib.maintainers; [ jlesquembre ];
+  };
+})

pkgs/by-name/po/pocketbase/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "pocketbase";
-  version = "0.39.0";
+  version = "0.39.3";
 
   src = fetchFromGitHub {
     owner = "pocketbase";
     repo = "pocketbase";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-4myp2MleKb6mAwDKhN39uyc5PZJhB3lvm2x/KDR9u0g=";
+    hash = "sha256-eCOGApbp/PLFpsX1GC2p56t3H+ksjiw5TL3iT7wnPGM=";
   };
 
-  vendorHash = "sha256-VBsClxCOA9Mp/kCHQKuBPd2Nt5sfXkVRx/8mGk5Gkcg=";
+  vendorHash = "sha256-ZKDMy+XUjCAvyis8wp9ddjuH+nFHh/A4bl5QZ33wtLE=";
 
   # This is the released subpackage from upstream repo
   subPackages = [ "examples/base" ];

pkgs/by-name/pr/pretix/package.nix

@@ -54,14 +54,14 @@ let
 in
 pythonPackages.buildPythonApplication (finalAttrs: {
   pname = "pretix";
-  version = "2026.5.0";
+  version = "2026.5.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pretix";
     repo = "pretix";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-twXz3RaFujhZmARzZ5zIjGAwWchwhV8knq8Cr3h0Gjg=";
+    hash = "sha256-p4ZZzfoR4Wg65xeqk9JyCdZ+S7RqBVd1drWpHjj8oqc=";
   };
 
   patches = [

pkgs/by-name/ra/rabbitmqadmin-ng/package.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rabbitmqadmin-ng";
-  version = "2.29.0";
+  version = "2.32.0";
 
   src = fetchFromGitHub {
     owner = "rabbitmq";
     repo = "rabbitmqadmin-ng";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-On4eUeFM4/GDfbGJ7249LTAu3srAbxU6vizsGP3sXj4=";
+    hash = "sha256-RCDjMOKPRRm1l9hcLPyxa6Qzf7fHXe1898SLqwZ+n7I=";
   };
 
-  cargoHash = "sha256-Xr6j5lCdl0CXj3nWBMawHAWoizrMR7KABC3nIFc9kgk=";
+  cargoHash = "sha256-VO7Kwm2mtED4/eirL6lsYSFMsyE8A2LdAFkXIjHFgUE=";
 
   buildInputs = [ openssl ];
   nativeBuildInputs = [ pkg-config ];

pkgs/by-name/ru/ruff/package.nix

@@ -16,7 +16,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ruff";
-  version = "0.15.15";
+  version = "0.15.16";
 
   __structuredAttrs = true;
 
@@ -24,12 +24,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "astral-sh";
     repo = "ruff";
     tag = finalAttrs.version;
-    hash = "sha256-WpjOOCYLZ1d8XPUx3qNHD+fuK6t65u/1/ZezABWpBD0=";
+    hash = "sha256-krmHCLijp+D4gBjKV9cdicPob4ry5I6QwB3MUz0z7zA=";
   };
 
   cargoBuildFlags = [ "--package=ruff" ];
 
-  cargoHash = "sha256-SfkoLl43Y1DNqIRW+HljVcEHWhedTS99SGhMvkQ4dmo=";
+  cargoHash = "sha256-d2iV7iWf7lVhj1Bbaxxk5Zao4KK3oC7whppRvk0erzA=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/sp/spotiflac/package.nix

@@ -18,14 +18,14 @@
 
 buildGoModule (finalAttrs: {
   pname = "spotiflac";
-  version = "7.1.7";
+  version = "7.1.8";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "afkarxyz";
     repo = "SpotiFLAC";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2bCKsgrJH8jfggluNdNqX+LdG8NLcsuhrJwkaRTXAOs=";
+    hash = "sha256-Uz+9vsneP8xLGi5pgwYIufCPUzKSH4CRAdt0o+FifAM=";
   };
 
   nativeBuildInputs = [
@@ -88,7 +88,7 @@ buildGoModule (finalAttrs: {
     runHook postInstall;
   '';
 
-  vendorHash = "sha256-0H3U+i7SbbO7WkF9O8U8JoRxtroyEofzi2XrrWi6HWY=";
+  vendorHash = "sha256-dTrfLnuo7W3m3mg32wBDv8IbmQA44KXsazRLdanIi/Y=";
 
   desktopItems = [
     (makeDesktopItem {

pkgs/by-name/te/telemt/package.nix

@@ -5,16 +5,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "telemt";
-  version = "3.4.13";
+  version = "3.4.15";
 
   src = fetchFromGitHub {
     owner = "telemt";
     repo = "telemt";
     tag = version;
-    hash = "sha256-ChzvbbWS/h7bZXqG4h3Iftslzsv2Rad+hXx+SyY2p30=";
+    hash = "sha256-YnV6lE+NyI8Wqj4Lf37G0McJyWYatebTnGn7yObXs5k=";
   };
 
-  cargoHash = "sha256-UicmtNQvGUZJtj3I8zztyGiy+oU66LWwNV+MNpZ3omc=";
+  cargoHash = "sha256-ekVPICi/UyVrtAB9kHaFhBe0PXoxjgF85cQMtVEPGjY=";
 
   checkFlags = [
     # flaky: races between MiddleClientWriterCancelled and TrafficBudgetWaitCancelled observation paths

pkgs/by-name/te/tempo/package.nix

@@ -7,14 +7,14 @@
 
 buildGoModule (finalAttrs: {
   pname = "tempo";
-  version = "2.10.5";
+  version = "3.0.1";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "tempo";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-1eacaqyKyHF/uS0Ja7oq+YKn/3K2QpDmd6jysGVBOjg=";
+    hash = "sha256-KYb3QJ4jdPsEmxVCezpakRRDtdyeGc4JUgeCHkZTG50=";
   };
 
   vendorHash = null;

pkgs/by-name/tr/traccar/package.nix

@@ -6,13 +6,13 @@
 }:
 stdenvNoCC.mkDerivation rec {
   pname = "traccar";
-  version = "6.13.0";
+  version = "6.13.3";
   nativeBuildInputs = [ pkgs.makeWrapper ];
 
   src = fetchzip {
     stripRoot = false;
     url = "https://github.com/traccar/traccar/releases/download/v${version}/traccar-other-${version}.zip";
-    hash = "sha256-nrAT/ewMpRXTN7bTU02VIJ4YoK5yvgfVZqMvQ1fXPo8=";
+    hash = "sha256-QQJ3+QByXkdfGBPA38F8+sQ72NnRbet6zcD3K82JLbI=";
   };
 
   installPhase = ''

pkgs/by-name/tr/treefmt/check-wrapper.nix

@@ -0,0 +1,50 @@
+{
+  lib,
+  gitMinimal,
+  runCommandLocal,
+  stdenv,
+  wrapper,
+}:
+/**
+  Test that the given project tree is formatted with the treefmt config.
+
+  Input argument is the path to the project tree.
+*/
+project:
+runCommandLocal "${lib.getName wrapper}-check"
+  {
+    __structuredAttrs = true;
+    strictDeps = true;
+    nativeBuildInputs = [
+      gitMinimal
+      wrapper
+    ];
+    inherit project;
+    env = {
+      LANG = if stdenv.buildPlatform.isDarwin then "en_US.UTF-8" else "C.UTF-8";
+      LC_ALL = if stdenv.buildPlatform.isDarwin then "en_US.UTF-8" else "C.UTF-8";
+    };
+    meta.description = "Check that the project tree is formatted";
+  }
+  ''
+    # Copy project files into the build-dir
+    cp -r "$project" project
+    chmod -R a+w project
+    cd project
+
+    # Setup a git repo
+    git init --initial-branch main
+    git config user.name nixbld
+    git config user.email nixbld@example.com
+    git add .
+    git commit -m init --quiet
+
+    # Run treefmt
+    treefmt --version
+    treefmt --no-cache
+
+    # Ensure nothing changed
+    git status
+    git --no-pager diff --exit-code
+    touch "$out"
+  ''

pkgs/by-name/tr/treefmt/lib.nix

@@ -40,6 +40,20 @@
   /**
     Wrap treefmt, configured using structured settings.
 
+    # Check
+
+    The resulting package has a `check` attribute of type `Path -> Derivation`.
+    The derivation returned will only build if the path supplied is already formatted correctly.
+
+    ```
+    { pkgs }:
+    let
+      myTreefmt = pkgs.treefmt.withConfig ./treefmt-config.nix;
+      project = ../.;
+    in
+    myTreefmt.check project
+    ```
+
     # Type
 
     ```

pkgs/by-name/tr/treefmt/modules/wrapper.nix

@@ -15,7 +15,7 @@
     internal = true;
   };
 
-  config.result = pkgs.symlinkJoin {
+  config.result = pkgs.symlinkJoin (finalAttrs: {
     pname = config.name;
     inherit (config.package) meta version;
     nativeBuildInputs = [ pkgs.makeBinaryWrapper ];
@@ -27,11 +27,14 @@
     passthru = {
       inherit (config) runtimeInputs;
       inherit config options;
+      check = pkgs.callPackage ../check-wrapper.nix {
+        wrapper = finalAttrs.finalPackage;
+      };
     };
     postBuild = ''
       wrapProgram "$out/bin/treefmt" \
         --prefix PATH : "$binPath" \
         --add-flags "--config-file $configFile"
     '';
-  };
+  });
 }