Merge master into staging-next

lib/modules.nix

@@ -254,11 +254,11 @@ let
                   inherit
                     lib
                     options
-                    config
                     specialArgs
                     ;
                   _class = class;
                   _prefix = prefix;
+                  config = addErrorContext "if you get an infinite recursion here, you probably reference `config` in `imports`. If you are trying to achieve a conditional import behavior dependent on `config`, consider importing unconditionally, and using `mkEnableOption` and `mkIf` to control its effect." config;
                 }
                 // specialArgs
               );
@@ -651,7 +651,13 @@ let
       # evaluation of the option.
       context = name: ''while evaluating the module argument `${name}' in "${key}":'';
       extraArgs = mapAttrs (
-        name: _: addErrorContext (context name) (args.${name} or config._module.args.${name})
+        name: _:
+        addErrorContext (context name) (
+          args.${name} or (addErrorContext
+            "noting that argument `${name}` is not externally provided, so querying `_module.args` instead, requiring `config`"
+            config._module.args.${name}
+          )
+        )
       ) (functionArgs f);
 
       # Note: we append in the opposite order such that we can add an error

lib/tests/modules.sh

@@ -82,6 +82,30 @@ checkConfigOutput() {
     fi
 }
 
+invertIfUnset() {
+    gate="$1"
+    shift
+    if [[ -n "${!gate:-}" ]]; then
+        "$@"
+    else
+        ! "$@"
+    fi
+}
+
+globalErrorLogCheck() {
+    invertIfUnset "REQUIRE_INFINITE_RECURSION_HINT" \
+      grep -i 'if you get an infinite recursion here' \
+      <<<"$err" >/dev/null \
+      || {
+        if [[ -n "${REQUIRE_INFINITE_RECURSION_HINT:-}" ]]; then
+            echo "Unexpected infinite recursion hint"
+        else
+            echo "Expected infinite recursion hint, but none found"
+        fi
+        return 1
+      }
+}
+
 checkConfigError() {
     local errorContains=$1
     local err=""
@@ -94,6 +118,14 @@ checkConfigError() {
         logFailure
         logEndFailure
     else
+        if ! globalErrorLogCheck "$err"; then
+            logStartFailure
+            echo "LOG:"
+            reportFailure "$@"
+            echo "GLOBAL ERROR LOG CHECK FAILED"
+            logFailure
+            logEndFailure
+        fi
         if echo "$err" | grep -zP --silent "$errorContains" ; then
             ((++pass))
         else
@@ -283,8 +315,8 @@ checkConfigOutput '^true$' "$@" ./define-_module-args-custom.nix
 # Check that using _module.args on imports cause infinite recursions, with
 # the proper error context.
 set -- "$@" ./define-_module-args-custom.nix ./import-custom-arg.nix
-checkConfigError 'while evaluating the module argument .*custom.* in .*import-custom-arg.nix.*:' "$@"
-checkConfigError 'infinite recursion encountered' "$@"
+REQUIRE_INFINITE_RECURSION_HINT=1 checkConfigError 'while evaluating the module argument .*custom.* in .*import-custom-arg.nix.*:' "$@"
+REQUIRE_INFINITE_RECURSION_HINT=1 checkConfigError 'infinite recursion encountered' "$@"
 
 # Check _module.check.
 set -- config.enable ./declare-enable.nix ./define-enable.nix ./define-attrsOfSub-foo.nix
@@ -488,7 +520,7 @@ checkConfigOutput '^"bar"$' config.nest.bar ./freeform-attrsOf.nix ./freeform-ne
 checkConfigOutput '^null$' config.foo ./freeform-attrsOf.nix ./freeform-str-dep-unstr.nix
 checkConfigOutput '^"24"$' config.foo ./freeform-attrsOf.nix ./freeform-str-dep-unstr.nix ./define-value-string.nix
 # Check whether an freeform-typed value can depend on a declared option, this can only work with lazyAttrsOf
-checkConfigError 'infinite recursion encountered' config.foo ./freeform-attrsOf.nix ./freeform-unstr-dep-str.nix
+REQUIRE_INFINITE_RECURSION_HINT=1 checkConfigError 'infinite recursion encountered' config.foo ./freeform-attrsOf.nix ./freeform-unstr-dep-str.nix
 checkConfigError 'The option .* was accessed but has no value defined. Try setting the option.' config.foo ./freeform-lazyAttrsOf.nix ./freeform-unstr-dep-str.nix
 checkConfigOutput '^"24"$' config.foo ./freeform-lazyAttrsOf.nix ./freeform-unstr-dep-str.nix ./define-value-string.nix
 # submodules in freeformTypes should have their locations annotated

nixos/doc/manual/release-notes/rl-2511.section.md

@@ -133,6 +133,8 @@
 
 - [`services.victorialogs.package`](#opt-services.victorialogs.package) now defaults to `victorialogs`, as `victoriametrics` no longer contains the VictoriaLogs binaries.
 
+- The `services.traccar.settings` attribute has been reworked. Instead of the previous flat attribute set the new implementation uses nested attribute sets. You need to update you configuration manually. For instance, `services.traccar.settings.loggerConsole` becomes `services.traccar.settings.logger.console`.
+
 - The `wstunnel` module was converted to RFC42-style settings, you will need to update your NixOS config if you make use of this module.
 
 - [private-gpt](https://github.com/zylon-ai/private-gpt) service has been removed by lack of maintenance upstream.

nixos/modules/profiles/installation-device.nix

@@ -102,11 +102,10 @@ with lib;
     boot.kernel.sysctl."vm.overcommit_memory" = "1";
 
     # To speed up installation a little bit, include the complete
-    # stdenv in the Nix store on the CD.
+    # stdenvNoCC in the Nix store on the CD.
     system.extraDependencies =
       with pkgs;
       [
-        stdenv
         stdenvNoCC # for runCommand
         busybox
         # For boot.initrd.systemd

nixos/modules/security/auditd.nix

@@ -4,16 +4,260 @@
   pkgs,
   ...
 }:
+let
+  cfg = config.security.auditd;
 
+  settingsType =
+    with lib.types;
+    nullOr (oneOf [
+      bool
+      nonEmptyStr
+      path
+      int
+    ]);
+
+  pluginOptions = lib.types.submodule {
+    options = {
+      active = lib.mkEnableOption "Whether to enable this plugin";
+      direction = lib.mkOption {
+        type = lib.types.enum [
+          "in"
+          "out"
+        ];
+        default = "out";
+        description = ''
+          The option is dictated by the plugin. In or out are the only choices.
+          You cannot make a plugin operate in a way it wasn't  designed just by
+          changing this option. This option is to give a clue to the event dispatcher
+          about which direction events flow.
+
+          ::: {.note}
+          Inbound events are not supported yet.
+          :::
+        '';
+      };
+      path = lib.mkOption {
+        type = lib.types.path;
+        description = "This is the absolute path to the plugin executable.";
+      };
+      type = lib.mkOption {
+        type = lib.types.enum [ "always" ];
+        readOnly = true;
+        default = "always";
+        description = ''
+          This tells the dispatcher how the plugin wants to be run. There is only
+          one valid option, `always`, which means the plugin is external and should
+          always be run. The default is `always` since there are no more builtin plugins.
+        '';
+      };
+      args = lib.mkOption {
+        type = lib.types.nullOr (lib.types.listOf lib.types.nonEmptyStr);
+        default = null;
+        description = ''
+          This allows you to pass arguments to the child program.
+          Generally plugins do not take arguments and have their own
+          config file that instructs them how they should be configured.
+        '';
+      };
+      format = lib.mkOption {
+        type = lib.types.enum [
+          "binary"
+          "string"
+        ];
+        default = "string";
+        description = ''
+          Binary passes the data exactly as the audit event dispatcher gets it from
+          the audit daemon. The string option tells the dispatcher to completely change
+          the event into a string suitable for parsing with the audit parsing library.
+        '';
+      };
+      settings = lib.mkOption {
+        type = lib.types.nullOr (
+          lib.types.submodule {
+            freeformType = lib.types.attrsOf settingsType;
+          }
+        );
+        default = null;
+        description = "Plugin-specific config file to link to /etc/audit/<plugin>.conf";
+      };
+    };
+  };
+
+  prepareConfigValue =
+    v:
+    if lib.isBool v then
+      (if v then "yes" else "no")
+    else if lib.isList v then
+      lib.concatStringsSep " " (map prepareConfigValue v)
+    else
+      builtins.toString v;
+  prepareConfigText =
+    conf:
+    lib.concatLines (
+      lib.mapAttrsToList (k: v: if v == null then "#${k} =" else "${k} = ${prepareConfigValue v}") conf
+    );
+in
 {
-  options.security.auditd.enable = lib.mkEnableOption "the Linux Audit daemon";
+  options.security.auditd = {
+    enable = lib.mkEnableOption "the Linux Audit daemon";
+
+    settings = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = lib.types.attrsOf settingsType;
+        options = {
+          # space_left needs to be larger than admin_space_left, yet they default to be the same if left open.
+          space_left = lib.mkOption {
+            type = lib.types.either lib.types.int (lib.types.strMatching "[0-9]+%");
+            default = 75;
+            description = ''
+              If the free space in the filesystem containing log_file drops below this value, the audit daemon takes the action specified by
+              {option}`space_left_action`. If the value of {option}`space_left` is specified as a whole number, it is interpreted as an absolute size in mebibytes
+              (MiB). If the value is specified as a number between 1 and 99 followed by a percentage sign (e.g., 5%), the audit daemon calculates
+              the absolute size in megabytes based on the size of the filesystem containing {option}`log_file`. (E.g., if the filesystem containing
+              {option}`log_file` is 2 gibibytes in size, and {option}`space_left` is set to 25%, then the audit daemon sets {option}`space_left` to approximately 500 mebibytes.
+
+              ::: {.note}
+              This calculation is performed when the audit daemon starts, so if you resize the filesystem containing {option}`log_file` while the
+              audit daemon is running, you should send the audit daemon SIGHUP to re-read the configuration file and recalculate the correct per‐
+              centage.
+              :::
+            '';
+          };
+          admin_space_left = lib.mkOption {
+            type = lib.types.either lib.types.int (lib.types.strMatching "[0-9]+%");
+            default = 50;
+            description = ''
+              This is a numeric value in mebibytes (MiB) that tells the audit daemon when to perform a configurable action because the system is running
+              low on disk space. This should be considered the last chance to do something before running out of disk space. The numeric value for
+              this parameter should be lower than the number for {option}`space_left`. You may also append a percent sign (e.g. 1%) to the number to have
+              the audit daemon calculate the number based on the disk partition size.
+            '';
+          };
+        };
+      };
+
+      default = { };
+      description = "auditd configuration file contents. See {auditd.conf} for supported values.";
+    };
+
+    plugins = lib.mkOption {
+      type = lib.types.attrsOf pluginOptions;
+      default = { };
+      defaultText = lib.literalExpression ''
+        {
+          af_unix = {
+            path = lib.getExe' pkgs.audit "audisp-af_unix";
+            args = [
+              "0640"
+              "/var/run/audispd_events"
+              "string"
+            ];
+            format = "binary";
+          };
+          remote = {
+            path = lib.getExe' pkgs.audit "audisp-remote";
+            settings = { };
+          };
+          filter = {
+            path = lib.getExe' pkgs.audit "audisp-filter";
+            args = [
+              "allowlist"
+              "/etc/audit/audisp-filter.conf"
+              (lib.getExe' pkgs.audit "audisp-syslog")
+              "LOG_USER"
+              "LOG_INFO"
+              "interpret"
+            ];
+            settings = { };
+          };
+          syslog = {
+            path = lib.getExe' pkgs.audit "audisp-syslog";
+            args = [ "LOG_INFO" ];
+          };
+        }
+      '';
+      description = "Plugin definitions to register with auditd";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion =
+          let
+            cfg' = cfg.settings;
+          in
+          (
+            (lib.isInt cfg'.space_left && lib.isInt cfg'.admin_space_left)
+            -> cfg'.space_left > cfg'.admin_space_left
+          )
+          && (
+            let
+              get_percent = s: lib.toInt (lib.strings.removeSuffix "%" s);
+            in
+            (lib.isString cfg'.space_left && lib.isString cfg'.admin_space_left)
+            -> (get_percent cfg'.space_left) > (get_percent cfg'.admin_space_left)
+          );
+        message = "`security.auditd.settings.space_left` must be larger than `security.auditd.settings.admin_space_left`";
+      }
+    ];
 
-  config = lib.mkIf config.security.auditd.enable {
     # Starting auditd should also enable loading the audit rules..
     security.audit.enable = lib.mkDefault true;
 
     environment.systemPackages = [ pkgs.audit ];
 
+    # setting this to anything other than /etc/audit/plugins.d will break, so we pin it here
+    security.auditd.settings.plugin_dir = "/etc/audit/plugins.d";
+
+    environment.etc = {
+      "audit/auditd.conf".text = prepareConfigText cfg.settings;
+    }
+    // (lib.mapAttrs' (
+      pluginName: pluginDefinitionConfigValue:
+      lib.nameValuePair "audit/plugins.d/${pluginName}.conf" {
+        text = prepareConfigText (lib.removeAttrs pluginDefinitionConfigValue [ "settings" ]);
+      }
+    ) cfg.plugins)
+    // (lib.mapAttrs' (
+      pluginName: pluginDefinitionConfigValue:
+      lib.nameValuePair "audit/audisp-${pluginName}.conf" {
+        text = prepareConfigText pluginDefinitionConfigValue.settings;
+      }
+    ) (lib.filterAttrs (_: v: v.settings != null) cfg.plugins));
+
+    security.auditd.plugins = {
+      af_unix = {
+        path = lib.getExe' pkgs.audit "audisp-af_unix";
+        args = [
+          "0640"
+          "/var/run/audispd_events"
+          "string"
+        ];
+        format = "binary";
+      };
+      remote = {
+        path = lib.getExe' pkgs.audit "audisp-remote";
+        settings = { };
+      };
+      filter = {
+        path = lib.getExe' pkgs.audit "audisp-filter";
+        args = [
+          "allowlist"
+          "/etc/audit/audisp-filter.conf"
+          (lib.getExe' pkgs.audit "audisp-syslog")
+          "LOG_USER"
+          "LOG_INFO"
+          "interpret"
+        ];
+        settings = { };
+      };
+      syslog = {
+        path = lib.getExe' pkgs.audit "audisp-syslog";
+        args = [ "LOG_INFO" ];
+      };
+    };
+
     systemd.services.auditd = {
       description = "Security Audit Logging Service";
       documentation = [ "man:auditd(8)" ];

nixos/modules/services/monitoring/traccar.nix

@@ -8,44 +8,62 @@ let
   cfg = config.services.traccar;
   stateDirectory = "/var/lib/traccar";
   configFilePath = "${stateDirectory}/config.xml";
-  expandCamelCase = lib.replaceStrings lib.upperChars (map (s: ".${s}") lib.lowerChars);
-  mkConfigEntry = key: value: "<entry key='${expandCamelCase key}'>${value}</entry>";
+
+  # Map leafs to XML <entry> elements as expected by traccar, using
+  # dot-separated keys for nested attribute paths.
+  mapLeafs = lib.mapAttrsRecursive (
+    path: value: "<entry key='${lib.concatStringsSep "." path}'>${value}</entry>"
+  );
+
+  mkConfigEntry = config: lib.collect builtins.isString (mapLeafs config);
+
   mkConfig =
     configurationOptions:
     pkgs.writeText "traccar.xml" ''
       <?xml version='1.0' encoding='UTF-8'?>
       <!DOCTYPE properties SYSTEM 'http://java.sun.com/dtd/properties.dtd'>
       <properties>
-          ${builtins.concatStringsSep "\n" (lib.mapAttrsToList mkConfigEntry configurationOptions)}
+          ${builtins.concatStringsSep "\n" (mkConfigEntry configurationOptions)}
       </properties>
     '';
 
   defaultConfig = {
-    databaseDriver = "org.h2.Driver";
-    databasePassword = "";
-    databaseUrl = "jdbc:h2:${stateDirectory}/traccar";
-    databaseUser = "sa";
-    loggerConsole = "true";
-    mediaPath = "${stateDirectory}/media";
-    templatesRoot = "${stateDirectory}/templates";
+    database = {
+      driver = "org.h2.Driver";
+      password = "";
+      url = "jdbc:h2:${stateDirectory}/traccar";
+      user = "sa";
+    };
+    logger.console = "true";
+    media.path = "${stateDirectory}/media";
+    templates.root = "${stateDirectory}/templates";
   };
+
 in
 {
   options.services.traccar = {
     enable = lib.mkEnableOption "Traccar, an open source GPS tracking system";
+    settingsFile = lib.mkOption {
+      type = with lib.types; nullOr path;
+      default = null;
+      description = ''
+        File used as configuration for traccar. When specified, {option}`settings` is ignored.
+      '';
+    };
     settings = lib.mkOption {
       apply = lib.recursiveUpdate defaultConfig;
       default = defaultConfig;
       description = ''
         {file}`config.xml` configuration as a Nix attribute set.
-        Attribute names are translated from camelCase to dot-separated strings. For instance:
-        {option}`mailSmtpPort = "25"`
-        would result in the following configuration property:
+        This option is ignored if `settingsFile` is set.
+
+        Nested attributes get translated to a properties entry in the traccar configuration.
+        For instance: `mail.smtp.port = "25"` results in the following entry:
         `<entry key='mail.smtp.port'>25</entry>`
-        Configuration options should match those described in
-        [Traccar - Configuration File](https://www.traccar.org/configuration-file/).
-        Secret tokens should be specified using {option}`environmentFile`
+
+        Secrets should be specified using {option}`environmentFile`
         instead of this world-readable attribute set.
+        [Traccar - Configuration File](https://www.traccar.org/configuration-file/).
       '';
     };
     environmentFile = lib.mkOption {
@@ -56,7 +74,7 @@ in
 
         Can be used for storing the secrets without making them available in the world-readable Nix store.
 
-        For example, you can set {option}`services.traccar.settings.databasePassword = "$TRACCAR_DB_PASSWORD"`
+        For example, you can set {option}`services.traccar.settings.database.password = "$TRACCAR_DB_PASSWORD"`
         and then specify `TRACCAR_DB_PASSWORD="<secret>"` in the environment file.
         This value will get substituted in the configuration file.
       '';
@@ -65,7 +83,7 @@ in
 
   config =
     let
-      configuration = mkConfig cfg.settings;
+      configuration = if cfg.settingsFile != null then cfg.settingsFile else mkConfig cfg.settings;
     in
     lib.mkIf cfg.enable {
       systemd.services.traccar = {
@@ -92,7 +110,7 @@ in
 
         serviceConfig = {
           DynamicUser = true;
-          EnvironmentFile = cfg.environmentFile;
+          EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
           ExecStart = "${lib.getExe pkgs.traccar} ${configFilePath}";
           LockPersonality = true;
           NoNewPrivileges = true;

nixos/tests/audit.nix

@@ -1,7 +1,12 @@
+{ lib, ... }:
 {
 
   name = "audit";
 
+  meta = {
+    maintainers = with lib.maintainers; [ grimmauld ];
+  };
+
   nodes = {
     machine =
       { lib, pkgs, ... }:
@@ -12,7 +17,13 @@
             "-a always,exit -F exe=${lib.getExe pkgs.hello} -k nixos-test"
           ];
         };
-        security.auditd.enable = true;
+        security.auditd = {
+          enable = true;
+          plugins.af_unix.active = true;
+          plugins.syslog.active = true;
+          # plugins.remote.active = true; # needs configuring a remote server for logging
+          # plugins.filter.active = true; # needs configuring allowlist/denylist
+        };
 
         environment.systemPackages = [ pkgs.hello ];
       };
@@ -25,6 +36,9 @@
     with subtest("Audit subsystem gets enabled"):
       assert "enabled 1" in machine.succeed("auditctl -s")
 
+    with subtest("unix socket plugin activated"):
+      machine.succeed("stat /var/run/audispd_events")
+
     with subtest("Custom rule produces audit traces"):
       machine.succeed("hello")
       print(machine.succeed("ausearch -k nixos-test -sc exit_group"))

nixos/tests/installer.nix

@@ -709,6 +709,10 @@ let
               system.extraDependencies =
                 with pkgs;
                 [
+                  # TODO: Remove this when we can install systems
+                  # without `stdenv`.
+                  stdenv
+
                   bintools
                   brotli
                   brotli.dev

pkgs/applications/audio/seq66/default.nix

@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "seq66";
-  version = "0.99.20";
+  version = "0.99.21";
 
   src = fetchFromGitHub {
     owner = "ahlstromcj";
     repo = "seq66";
     rev = version;
-    hash = "sha256-YFSvwviC2f5PJD91jcmLuqf+kDqDeMhXNXD3n45kJL8=";
+    hash = "sha256-0joa69nSX3lcpoRq9YToNA75Sg9dlYMGRZEfcJm9Vjg=";
   };
 
   nativeBuildInputs = [

pkgs/applications/virtualization/docker/buildx.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "docker-buildx";
-  version = "0.25.0";
+  version = "0.26.1";
 
   src = fetchFromGitHub {
     owner = "docker";
     repo = "buildx";
     rev = "v${version}";
-    hash = "sha256-DdG2z0raDHcbBMDl7C0WORKhG0ZB9Gvie8u4/isE8ow=";
+    hash = "sha256-+ubv/8UdejxY7u3RdgS7L18hZHohlqGu9E3L0bTAmLY=";
   };
 
   doCheck = false;

pkgs/by-name/a2/a2ps/package.nix

@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation rec {
   pname = "a2ps";
-  version = "4.15.6";
+  version = "4.15.7";
 
   src = fetchurl {
     url = "mirror://gnu/a2ps/a2ps-${version}.tar.gz";
-    hash = "sha256-h/+dgByxGWkYHVuM+LZeZeWyS7DHahuCXoCY8pBvvfQ=";
+    hash = "sha256-cV84Zwr9lQtMpxwB9Gj+760mXKUtPxEpNMY8Cov7uK8=";
   };
 
   postPatch = ''

pkgs/by-name/ai/airgeddon/package.nix

@@ -114,13 +114,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "airgeddon";
-  version = "11.50";
+  version = "11.51";
 
   src = fetchFromGitHub {
     owner = "v1s1t0r1sh3r3";
     repo = "airgeddon";
     tag = "v${version}";
-    hash = "sha256-hy6q25hWGEFlih0IuwoqDRjbUk1/iShj6uY+mz6hlFU=";
+    hash = "sha256-PkP8sPpX/z3yjvTpsRYJ9fKzUaMsnCp+p6AAoTlcAA0=";
   };
 
   strictDeps = true;

pkgs/by-name/ar/ark-pixel-font/package.nix

@@ -7,14 +7,14 @@
 
 python312Packages.buildPythonPackage rec {
   pname = "ark-pixel-font";
-  version = "2025.03.14";
+  version = "2025.07.21";
   pyproject = false;
 
   src = fetchFromGitHub {
     owner = "TakWolf";
     repo = "ark-pixel-font";
     tag = version;
-    hash = "sha256-B/XsZEpSxY4k8uj3Vy31c9+GcO7d3NFcADLtPU6p/CI=";
+    hash = "sha256-NnkXKe4qlWl4lDHNcO5aVJWwyeSrHoHxqlla+RMgtQw=";
   };
 
   dependencies = with python312Packages; [

pkgs/by-name/ar/arrow/package.nix

@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "arrow";
-  version = "3.0.0";
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "mhgolkar";
     repo = "Arrow";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-oodW6XvesBWic0yK1Se/tycjqblE4qUSuAk+3MY3x8I=";
+    hash = "sha256-+Tlqh0Xn2xnF2AWv9u5xIWo6Mvg/uEsqqxWx70kd3+k=";
   };
 
   desktopItems = [

pkgs/by-name/as/ashuffle/package.nix

@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "joshkunz";
     repo = "ashuffle";
-    rev = "v${version}";
+    tag = "v${version}";
     hash = "sha256-HQ4+vyTvX0mhfuRclbiC+MvllV3300ztAwL0IxrUiC8=";
     fetchSubmodules = true;
   };

pkgs/by-name/au/augeas/package.nix

@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "hercules-team";
     repo = "augeas";
-    rev = "release-${version}";
+    tag = "release-${version}";
     fetchSubmodules = true;
     hash = "sha256-U5tm3LDUeI/idHtL2Zy33BigkyvHunXPjToDC59G9VE=";
   };

pkgs/by-name/av/avalonia/package.nix

@@ -51,7 +51,7 @@ stdenvNoCC.mkDerivation (
       src = fetchFromGitHub {
         owner = "AvaloniaUI";
         repo = "Avalonia";
-        rev = version;
+        tag = version;
         fetchSubmodules = true;
         hash = "sha256-b7K8h2hqkLnXj3YIaRKUqlbWsDNhfWCEqH1W8K0lP6g=";
       };

pkgs/by-name/aw/awk-language-server/package.nix

@@ -13,7 +13,7 @@ mkYarnPackage rec {
   src = fetchFromGitHub {
     owner = "Beaglefoot";
     repo = "awk-language-server";
-    rev = "server-${version}";
+    tag = "server-${version}";
     hash = "sha256-YtduDfMAUAoQY9tgyhgERFwx9TEgD52KdeHnX2MrjjI=";
     sparseCheckout = [ "server" ];
     postFetch = ''

pkgs/by-name/bc/bchoppr/package.nix

@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "sjaehn";
     repo = "bchoppr";
-    rev = version;
+    tag = version;
     hash = "sha256-/aLoLUpWu66VKd9lwjli+FZZctblrZUPSEsdYH85HwQ=";
     fetchSubmodules = true;
   };

pkgs/by-name/be/bespokesynth/package.nix

@@ -47,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "BespokeSynth";
     repo = "bespokesynth";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-ad8wdLos3jM0gRMpcfRKeaiUxJsPGqWd/7XeDz87ToQ=";
     fetchSubmodules = true;
   };

pkgs/by-name/bi/bio-gappa/package.nix

@@ -17,7 +17,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "lczech";
     repo = "gappa";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-WV8PO0v+e14tyjEm+xQGveQ0Pslgeh+osEMCqF8mue0=";
     fetchSubmodules = true;
   };

pkgs/by-name/bi/biodiff/package.nix

@@ -12,7 +12,7 @@ rustPlatform.buildRustPackage rec {
   src = fetchFromGitHub {
     owner = "8051Enthusiast";
     repo = "biodiff";
-    rev = "v${version}";
+    tag = "v${version}";
     hash = "sha256-ZLxjOV08sC5dKICvRUyL6FLMORkxwdLgNq7L45CDwa4=";
     fetchSubmodules = true;
   };

pkgs/by-name/bi/bitbox/package.nix

@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "BitBoxSwiss";
     repo = "bitbox-wallet-app";
-    rev = "v${version}";
+    tag = "v${version}";
     fetchSubmodules = true;
     hash = "sha256-zpkjYnGsmPKjxUpp2H1qSzqthOO1mTmki3bPqo35sBo=";
   };

pkgs/by-name/bl/blink1-tool/package.nix

@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "todbot";
     repo = "blink1-tool";
-    rev = "v${version}";
+    tag = "v${version}";
     fetchSubmodules = true;
     hash = "sha256-xuCjPSQUQ/KOcdsie/ndecUiEt+t46m4eI33PXJoAAY=";
   };

pkgs/by-name/bl/blobfuse/package.nix

@@ -9,19 +9,19 @@
 }:
 
 let
-  version = "2.4.2";
+  version = "2.5.0";
   src = fetchFromGitHub {
     owner = "Azure";
     repo = "azure-storage-fuse";
     rev = "blobfuse2-${version}";
-    sha256 = "sha256-bpMX7flbb/QYZUtq1I1s2lAvrBhW7esPwxN/JupryDo=";
+    sha256 = "sha256-BRLORwEY8PeD9hFkpm3Gup+eXzdFkW1Rkr73ncyKrso=";
   };
 in
 buildGoModule {
   pname = "blobfuse";
   inherit version src;
 
-  vendorHash = "sha256-uWesaZshuBVf4yJiX6YqNMr0GiBkrHhOqefnCrpPCHg=";
+  vendorHash = "sha256-L1ix9pRal5Ssfwf+kl9SFC9bbveuKeiuzrBwapvbFZY=";
 
   buildInputs = [ fuse3 ];
 

pkgs/by-name/bo/boa/package.nix

@@ -15,7 +15,7 @@ rustPlatform.buildRustPackage rec {
   src = fetchFromGitHub {
     owner = "boa-dev";
     repo = "boa";
-    rev = "v${version}";
+    tag = "v${version}";
     hash = "sha256-foCIzzFoEpcE6i0QrSbiob3YHIOeTpjwpAMtcPGL8Vg=";
     fetchSubmodules = true;
   };

pkgs/by-name/bo/bom/package.nix

@@ -12,7 +12,7 @@ buildGoModule rec {
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
     repo = "bom";
-    rev = "v${version}";
+    tag = "v${version}";
     hash = "sha256-nYzBaFtOJhqO0O6MJsxTw/mxsIOa+cnU27nOFRe2/uI=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.

pkgs/by-name/br/brewtarget/package.nix

@@ -20,7 +20,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "Brewtarget";
     repo = "brewtarget";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-VVdihVdNIAtPlugqGWDWvxMdOFGLnRmewPt6BgvbxBk=";
     fetchSubmodules = true;
   };

pkgs/by-name/br/brickstore/package.nix

@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "rgriebl";
     repo = "brickstore";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-4sxPplZ1t8sSfwTCeeBtfU4U0gcE9FROt6dKvkfyO6Q=";
     fetchSubmodules = true;
   };

pkgs/by-name/bs/bs2b-lv2/package.nix

@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "nilninull";
     repo = "bs2b-lv2";
-    rev = "v${version}";
+    tag = "v${version}";
     fetchSubmodules = true;
     hash = "sha256-dOcDPtiKN9Kfs2cdaeDO/GkWrh5tfJSHfiHPBtxJXvc=";
   };

pkgs/by-name/bu/budgie-control-center/package.nix

@@ -75,7 +75,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "BuddiesOfBudgie";
     repo = "budgie-control-center";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
     hash = "sha256-W5PF7BPdQdg/7xJ4J+fEnuDdpoG/lyhX56RDnX2DXoY=";
   };

pkgs/by-name/bu/budgie-desktop/package.nix

@@ -50,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "BuddiesOfBudgie";
     repo = "budgie-desktop";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
     hash = "sha256-lDsQlUAa79gnM8wC5pwyquvFyEiayH4W4gD/uyC5Koo=";
   };

pkgs/by-name/bu/buf/package.nix

@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "buf";
-  version = "1.55.1";
+  version = "1.56.0";
 
   src = fetchFromGitHub {
     owner = "bufbuild";
     repo = "buf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-41IY2P2s9kCV6aQh5vg7xVmu4Ovl9gakGmgcI/QSwfw=";
+    hash = "sha256-a2yU8KgMRNEz5fgFx/e0U6Hrtw53neeO5PWsTU8AV14=";
   };
 
-  vendorHash = "sha256-2kg7VXIFKXXY1uDUSV3+4vo6GYwnxyvJIZ/a8j99lhk=";
+  vendorHash = "sha256-lWcqXMkOpa+bh40zH8LQ86mIbTAqB2mk8naN1oY7Xuc=";
 
   patches = [
     # Skip a test that requires networking to be available to work.

pkgs/by-name/bu/bugdom/package.nix

@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "jorio";
     repo = "bugdom";
-    rev = version;
+    tag = version;
     hash = "sha256-0c7v5tSqYuqtLOFl4sqD7+naJNqX/wlKHVntkZQGJ8A=";
     fetchSubmodules = true;
   };

pkgs/by-name/bu/bulk_extractor/package.nix

@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "simsong";
     repo = "bulk_extractor";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-Jj/amXESFBu/ZaiIRlDKmtWTBVQ2TEvOM2jBYP3y1L8=";
     fetchSubmodules = true;
   };

pkgs/by-name/ca/capacities/package.nix

@@ -7,12 +7,12 @@
 }:
 let
   pname = "capacities";
-  version = "1.48.7";
+  version = "1.50.4";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "https://web.archive.org/web/20250519011655/https://capacities-desktop-app.fra1.cdn.digitaloceanspaces.com/capacities-${version}.AppImage";
-    hash = "sha256-fa1Wk3w+f467n0JtRz+Zjw9QKDKKnhS23biEtNqO17Y=";
+    hash = "sha256-8sp6q86C36FbJ1azhX5QWbb2PmqJ/bbZQX31yzNByU4=";
   };
 
   appimageContents = appimageTools.extractType2 {

pkgs/by-name/ca/catppuccin-gtk/package.nix

@@ -70,7 +70,7 @@ lib.checkListOfEnum "${pname}: theme accent" validAccents accents lib.checkListO
     src = fetchFromGitHub {
       owner = "catppuccin";
       repo = "gtk";
-      rev = "v${version}";
+      tag = "v${version}";
       fetchSubmodules = true;
       hash = "sha256-q5/VcFsm3vNEw55zq/vcM11eo456SYE5TQA3g2VQjGc=";
     };

pkgs/by-name/ch/chow-centaur/package.nix

@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "jatinchowdhury18";
     repo = "KlonCentaur";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-kDDom6q0Tgni0/L+FgBVZC1/sL9W9fRP60U4o4ijP1c=";
     fetchSubmodules = true;
   };

pkgs/by-name/ch/chow-kick/package.nix

@@ -43,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "Chowdhury-DSP";
     repo = "ChowKick";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-YYcNiJGGw21aVY03tyQLu3wHCJhxYiDNJZ+LWNbQdj4=";
     fetchSubmodules = true;
   };

pkgs/by-name/ch/chow-phaser/package.nix

@@ -40,7 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "jatinchowdhury18";
     repo = "ChowPhaser";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
     hash = "sha256-9wo7ZFMruG3QNvlpILSvrFh/Sx6J1qnlWc8+aQyS4tQ=";
   };

pkgs/by-name/ch/chow-tape-model/package.nix

@@ -47,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "jatinchowdhury18";
     repo = "AnalogTapeModel";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-WriHi68Y6hAsrwE+74JtVlAKUR9lfTczj6UK9h2FOGM=";
     fetchSubmodules = true;
   };

pkgs/by-name/cl/closurecompiler/package.nix

@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "closure-compiler";
-  version = "20250528";
+  version = "20250706";
 
   src = fetchurl {
     url = "mirror://maven/com/google/javascript/closure-compiler/v${version}/closure-compiler-v${version}.jar";
-    sha256 = "sha256-P7NzTMgMdvG4LMKcmJx+x2LsPvmjtrr+RC6Oy/CVvD0=";
+    sha256 = "sha256-yf2w6a04S1Y60nL1hkxrhdLAiYO7yjdrUUqTPbyT2Ow=";
   };
 
   dontUnpack = true;

pkgs/by-name/cl/cloudcompare/package.nix

@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "CloudCompare";
     repo = "CloudCompare";
-    rev = "v${version}";
+    tag = "v${version}";
     hash = "sha256-a/0lf3Mt5ZpLFRM8jAoqZer8pY1ROgPRY4dPt34Bk3E=";
     fetchSubmodules = true;
   };

pkgs/by-name/cm/cmdstan/package.nix

@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "stan-dev";
     repo = "cmdstan";
-    rev = "v${version}";
+    tag = "v${version}";
     fetchSubmodules = true;
     hash = "sha256-9Dan86C0nxxxkIXaOSKExY0hngAgWTpL4RlI3rTnBZo=";
   };

pkgs/by-name/co/codebook/package.nix

@@ -7,17 +7,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "codebook";
-  version = "0.3.5";
+  version = "0.3.6";
 
   src = fetchFromGitHub {
     owner = "blopker";
     repo = "codebook";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lQfk4dJ9WFraxMDWJVSBiTGumikfHYlMBe+0NHa/3nY=";
+    hash = "sha256-zSxMvWRpH1AtvHo/odQZftxgAMdOd8p2ZiMUcsOWhes=";
   };
 
   buildAndTestSubdir = "crates/codebook-lsp";
-  cargoHash = "sha256-MLd7V5Pp8yx4pFAXSjZf4KUGp964ombrnGKbrtXhC0I=";
+  cargoHash = "sha256-FS8ZEjFFoNCJGkfL8C5hBgwj9o9XT239/9Qh/Xea2wk=";
 
   # Integration tests require internet access for dictionaries
   doCheck = false;

pkgs/by-name/co/codecrafters-cli/package.nix

@@ -12,7 +12,7 @@ buildGoModule rec {
   src = fetchFromGitHub {
     owner = "codecrafters-io";
     repo = "cli";
-    rev = "v${version}";
+    tag = "v${version}";
     hash = "sha256-YgQPDc5BUIoEd44NLpRluxCKooW99qvcSTrFPm6qJKM=";
     # A shortened git commit hash is part of the version output, and is
     # needed at build time. Use the `.git` directory to retrieve the

pkgs/by-name/co/colima/package.nix

@@ -19,7 +19,7 @@ buildGoModule rec {
   src = fetchFromGitHub {
     owner = "abiosoft";
     repo = "colima";
-    rev = "v${version}";
+    tag = "v${version}";
     hash = "sha256-RQnHqEabxyoAKr8BfmVhk8z+l5oy8pa5JPTWk/0FV5g=";
     # We need the git revision
     leaveDotGit = true;

pkgs/by-name/co/convimg/package.nix

@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "mateoconlechuga";
     repo = "convimg";
-    rev = "v${version}";
+    tag = "v${version}";
     hash = "sha256-5insJ391Usef8GF3Yh74PEqE534zitQg9udFRPcz69g=";
     fetchSubmodules = true;
   };

pkgs/by-name/cp/cp2k/package.nix

@@ -68,7 +68,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "cp2k";
     repo = "cp2k";
-    rev = "v${version}";
+    tag = "v${version}";
     hash = "sha256-04AFiEuv+EYubZVoYErQDdr9zipKlF7Gqy8DrUaYUMk=";
     fetchSubmodules = true;
   };

pkgs/by-name/cp/cpp-netlib/package.nix

@@ -18,7 +18,7 @@ stdenvForCppNetlib.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "cpp-netlib";
     repo = "cpp-netlib";
-    rev = "cpp-netlib-${version}";
+    tag = "cpp-netlib-${version}";
     sha256 = "18782sz7aggsl66b4mmi1i0ijwa76iww337fi9sygnplz2hs03a3";
     fetchSubmodules = true;
   };

pkgs/by-name/cp/cpp-redis/package.nix

@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "cpp-redis";
     repo = "cpp_redis";
-    rev = version;
+    tag = version;
     hash = "sha256-dLAnxgldylWWKO3WIyx+F7ylOpRH+0nD7NZjWSOxuwQ=";
     fetchSubmodules = true;
   };

pkgs/by-name/cp/cppcheck/package.nix

@@ -21,7 +21,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cppcheck";
-  version = "2.17.1";
+  version = "2.18.0";
 
   outputs = [
     "out"
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "danmar";
     repo = "cppcheck";
     tag = finalAttrs.version;
-    hash = "sha256-jsLhVKNr/4RWw2SVNkycm/xbcy1BKIf983oTnaJKV6U=";
+    hash = "sha256-trbL2Me1VWmVMfL45H50xbR36izifFmoLHKQvte6oZQ=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/cr/crc32c/package.nix

@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "google";
     repo = "crc32c";
-    rev = version;
+    tag = version;
     sha256 = "0c383p7vkfq9rblww6mqxz8sygycyl27rr0j3bzb8l8ga71710ii";
     fetchSubmodules = true;
   };

pkgs/by-name/cr/criterion/package.nix

@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "Snaipe";
     repo = "Criterion";
-    rev = "v${version}";
+    tag = "v${version}";
     fetchSubmodules = true;
     hash = "sha256-5GH7AYjrnBnqiSmp28BoaM1Xmy8sPs1atfqJkGy3Yf0=";
   };

pkgs/by-name/cr/crun/package.nix

@@ -40,13 +40,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "crun";
-  version = "1.22";
+  version = "1.23.1";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "crun";
     rev = version;
-    hash = "sha256-6XhwGuV9btN7wuwJuQITHtVTKBcawTuMG8lY22RMdWk=";
+    hash = "sha256-jGRL/P4pR3nNikTYZxxqFvOK63pepClVhwBmeCF/dNU=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/de/design/package.nix

@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "dubstar-04";
     repo = "Design";
-    rev = "v${version}";
+    tag = "v${version}";
     fetchSubmodules = true;
     hash = "sha256-Q4R/Ztu4w8IRvq15xNXN/iP/6hIHe/W+me1jROGpYc8=";
   };

pkgs/by-name/de/detect-it-easy/package.nix

@@ -18,7 +18,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "horsicq";
     repo = "DIE-engine";
-    rev = finalAttrs.version;
+    tag = finalAttrs.version;
     fetchSubmodules = true;
     hash = "sha256-yHgxYig5myY2nExweUk2muKbJTKN3SiwOLgQcMIY/BQ=";
   };

pkgs/by-name/di/dix/package.nix

@@ -7,16 +7,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "dix";
-  version = "1.2.1";
+  version = "1.2.2";
 
   src = fetchFromGitHub {
     owner = "faukah";
     repo = "dix";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cSmxpzj5bNcMgfxJQiYwcwKjCrsTHxY+loRi+pzpFd4=";
+    hash = "sha256-Gq5Nr6xVGpAf1XnYrmoeyvqVgffAi8R6QETJU3xv22M=";
   };
 
-  cargoHash = "sha256-iYjDN3t1rZaZEm6TCUl/mZkVzxqYNHRTZkPipheG9EY=";
+  cargoHash = "sha256-IEsZNuLXKa+MInuortG4ifHTZ0Ngs0ugm02BK6shzHA=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;

pkgs/by-name/dr/dragmap/package.nix

@@ -14,7 +14,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "Illumina";
     repo = "DRAGMAP";
-    rev = finalAttrs.version;
+    tag = finalAttrs.version;
     fetchSubmodules = true;
     hash = "sha256-f1jsOErriS1I/iUS4CzJ3+Dz8SMUve/ccb3KaE+L7U8=";
   };

pkgs/by-name/dr/dragonfly-reverb/package.nix

@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "michaelwillis";
     repo = "dragonfly-reverb";
-    rev = version;
+    tag = version;
     hash = "sha256-YXJ4U5J8Za+DlXvp6QduvCHIVC2eRJ3+I/KPihCaIoY=";
     fetchSubmodules = true;
   };

pkgs/by-name/dr/dragonflydb/package.nix

@@ -32,7 +32,7 @@ let
   src = fetchFromGitHub {
     owner = pname;
     repo = "dragonfly";
-    rev = "v${version}";
+    tag = "v${version}";
     hash = "sha256-P6WMW/n+VezWDXGagT4B+ZYyCp8oufDV6MTrpKpLZcs=";
     fetchSubmodules = true;
   };

pkgs/by-name/dr/drogon/package.nix

@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "drogonframework";
     repo = "drogon";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-eFOYmqfyb/yp83HRa0hWSMuROozR/nfnEp7k5yx8hj0=";
     fetchSubmodules = true;
   };

pkgs/by-name/dx/dxvk_2/package.nix

@@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "doitsujin";
     repo = "dxvk";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-edu9JQAKu8yUZLh+37RB1s1A3+s8xeUYQ5Oibdes9ZI=";
     fetchSubmodules = true; # Needed for the DirectX headers and libdisplay-info
   };

pkgs/by-name/ec/ecs-agent/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "amazon-ecs-agent";
-  version = "1.96.0";
+  version = "1.97.0";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "aws";
     repo = "amazon-ecs-agent";
-    hash = "sha256-jKqGKSPjHQvRKAxqB81u/i7LeIV8IeiCF9O5dSmebQQ=";
+    hash = "sha256-QdEmV78bQDw3YaJCPCFlLpo1rLsRu4Hn8e/JrZVkGQc=";
   };
 
   vendorHash = null;

pkgs/by-name/ed/editorconfig-core-c/package.nix

@@ -19,7 +19,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "editorconfig";
     repo = "editorconfig-core-c";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-myJNJxKwgmgm+P2MqnYmW8OC0oYcInL+Suyf/xwX9xo=";
     fetchSubmodules = true;
   };

pkgs/by-name/ei/eiwd/package.nix

@@ -17,7 +17,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "illiliti";
     repo = "eiwd";
-    rev = finalAttrs.version;
+    tag = finalAttrs.version;
     hash = "sha256-rmkXR4RZbtD6lh8cGrHLWVGTw4fQqP9+Z9qaftG1ld0=";
     fetchSubmodules = true;
   };

pkgs/by-name/en/encpipe/package.nix

@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "jedisct1";
     repo = "encpipe";
-    rev = version;
+    tag = version;
     hash = "sha256-YlEKSWzZuQyDi0mbwJh9Dfn4gKiOeqihSHPt4yY6YdY=";
     fetchSubmodules = true;
   };

pkgs/by-name/eo/eos-installer/package.nix

@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "endlessm";
     repo = "eos-installer";
-    rev = "Release_${version}";
+    tag = "Release_${version}";
     sha256 = "BqvZglzFJabGXkI8hnLiw1r+CvM7kSKQPj8IKYBB6S4=";
     fetchSubmodules = true;
   };

pkgs/by-name/er/erigon/package.nix

@@ -15,7 +15,7 @@ buildGoModule {
   src = fetchFromGitHub {
     owner = "ledgerwatch";
     repo = "erigon";
-    rev = "v${version}";
+    tag = "v${version}";
     hash = "sha256-MQpHRlKxWCBD2Tj9isxMKwvYBy9HtDkQPyKPse8uB3g=";
     fetchSubmodules = true;
   };

pkgs/by-name/et/eternity/package.nix

@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "team-eternity";
     repo = "eternity";
-    rev = version;
+    tag = version;
     sha256 = "0dlz7axbiw003bgwk2hl43w8r2bwnxhi042i1xwdiwaja0cpnf5y";
     fetchSubmodules = true;
   };

pkgs/by-name/ez/ezquake/package.nix

@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "QW-Group";
     repo = pname + "-source";
-    rev = version;
+    tag = version;
     fetchSubmodules = true;
     hash = "sha256-ThrsJfj+eP7Lv2ZSNLO6/b98VHrL6/rhwf2p0qMvTF8=";
   };

pkgs/by-name/fa/fastddsgen/package.nix

@@ -20,7 +20,7 @@ stdenv.mkDerivation {
   src = fetchFromGitHub {
     owner = "eProsima";
     repo = "Fast-DDS-Gen";
-    rev = "v${version}";
+    tag = "v${version}";
     fetchSubmodules = true;
     hash = "sha256-4w6DYz0QhD8L27FE+SzptfoMjhiuJ6OFex2LNAqwmPw=";
   };

pkgs/by-name/fa/faust2/package.nix

@@ -28,7 +28,7 @@ let
   src = fetchFromGitHub {
     owner = "grame-cncm";
     repo = "faust";
-    rev = version;
+    tag = version;
     hash = "sha256-Rn+Cjpk4vttxARrkDSnpKdBdSRtgElsit8zu1BA8Jd4=";
     fetchSubmodules = true;
   };

pkgs/by-name/fa/faustlive/package.nix

@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "grame-cncm";
     repo = "faustlive";
-    rev = version;
+    tag = version;
     hash = "sha256-RqtdDkP63l/30sL5PDocvpar5TI4LdKfeeliSNeOHog=";
     fetchSubmodules = true;
   };

pkgs/by-name/fe/feather/package.nix

@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "feather-wallet";
     repo = "feather";
-    rev = finalAttrs.version;
+    tag = finalAttrs.version;
     hash = "sha256-DZBRZBcoba32Z/bFThn/9siC8VESg5gdfoFO4Nw8JqM=";
     fetchSubmodules = true;
   };

pkgs/by-name/fi/firestarter/package.nix

@@ -64,7 +64,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "tud-zih-energy";
     repo = "FIRESTARTER";
-    rev = "v${version}";
+    tag = "v${version}";
     sha256 = "1ik6j1lw5nldj4i3lllrywqg54m9i2vxkxsb2zr4q0d2rfywhn23";
     fetchSubmodules = true;
   };

pkgs/by-name/fl/flutter_rust_bridge_codegen/package.nix

@@ -12,7 +12,7 @@ rustPlatform.buildRustPackage rec {
   src = fetchFromGitHub {
     owner = "fzyzcjy";
     repo = "flutter_rust_bridge";
-    rev = "v${version}";
+    tag = "v${version}";
     hash = "sha256-Us+LwT6tjBcTl2xclVsiLauSlIO8w+PiokpiDB+h1fI=";
     fetchSubmodules = true;
   };

pkgs/by-name/fl/flycast/package.nix

@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "flyinghead";
     repo = "flycast";
-    rev = "v${version}";
+    tag = "v${version}";
     hash = "sha256-OnlSkwPDUrpj9uEPEAxZO1iSgd5ZiQUJLneu14v9pKQ=";
     fetchSubmodules = true;
   };

pkgs/by-name/fn/fna3d/package.nix

@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "FNA-XNA";
     repo = "FNA3D";
-    rev = version;
+    tag = version;
     fetchSubmodules = true;
     hash = "sha256-0rRwIbOciPepo+ApvJiK5IyhMdq/4jsMlCSv0UeDETs=";
   };

pkgs/by-name/fo/foxotron/package.nix

@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "Gargaj";
     repo = "Foxotron";
-    rev = version;
+    tag = version;
     fetchSubmodules = true;
     hash = "sha256-OnZWoiQ5ASKQV73/W6nl17B2ANwqCy/PlybHbNwrOyQ=";
   };

pkgs/by-name/fr/freebayes/package.nix

@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
     name = "freebayes-${version}-src";
     owner = "ekg";
     repo = "freebayes";
-    rev = "v${version}";
+    tag = "v${version}";
     sha256 = "035nriknjqq8gvil81vvsmvqwi35v80q8h1cw24vd1gdyn1x7bys";
     fetchSubmodules = true;
   };

pkgs/by-name/fr/freecad/package.nix

@@ -62,7 +62,7 @@ freecad-utils.makeCustomizable (
     src = fetchFromGitHub {
       owner = "FreeCAD";
       repo = "FreeCAD";
-      rev = finalAttrs.version;
+      tag = finalAttrs.version;
       hash = "sha256-VFTNawXxu2ofjj2Frg4OfVhiMKFywBhm7lZunP85ZEQ=";
       fetchSubmodules = true;
     };

pkgs/by-name/fu/fulcio/package.nix

@@ -20,7 +20,7 @@ buildGoModule rec {
   src = fetchFromGitHub {
     owner = "sigstore";
     repo = "fulcio";
-    rev = "v${version}";
+    tag = "v${version}";
     hash = "sha256-UVUVT4RvNHvzIwV6azu2h1O9lnNu0PQnnkj4wbrY8BA=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.

pkgs/by-name/ge/gebaar-libinput/package.nix

@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "Coffee2CodeNL";
     repo = "gebaar-libinput";
-    rev = "v${version}";
+    tag = "v${version}";
     sha256 = "1kqcgwkia1p195xr082838dvj1gqif9d63i8a52jb0lc32zzizh6";
     fetchSubmodules = true;
   };

pkgs/by-name/ge/gerbolyze/package.nix

@@ -12,7 +12,7 @@ let
   src = fetchFromGitHub {
     owner = "jaseg";
     repo = "gerbolyze";
-    rev = "v${version}";
+    tag = "v${version}";
     hash = "sha256-bisLln3Y239HuJt0MkrCU+6vLLbEDxfTjEJMkcbE/wE=";
     fetchSubmodules = true;
   };

pkgs/by-name/gf/gfxreconstruct/package.nix

@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "LunarG";
     repo = "gfxreconstruct";
-    rev = "v${version}";
+    tag = "v${version}";
     hash = "sha256-MuCdJoBFxKwDCOCltlU3oBS9elFS6F251dHjHcIb4Jg=";
     fetchSubmodules = true;
   };

pkgs/by-name/gi/gildas/package.nix

@@ -24,8 +24,8 @@ let
 in
 
 stdenv.mkDerivation rec {
-  srcVersion = "jul25a";
-  version = "20250701_a";
+  srcVersion = "jul25b";
+  version = "20250701_b";
   pname = "gildas";
 
   src = fetchurl {
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
       "http://www.iram.fr/~gildas/dist/gildas-src-${srcVersion}.tar.xz"
       "http://www.iram.fr/~gildas/dist/archive/gildas/gildas-src-${srcVersion}.tar.xz"
     ];
-    hash = "sha256-t64lcbdrPXu4II5IGyd9Un6yJGrH+wqKRt5jmr/F5y4=";
+    hash = "sha256-TU9UdvyzlIWGJWAAJIIGBO5NgXuKDYTdjHhFHRwTagU=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/gi/gimx/package.nix

@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "matlo";
     repo = "GIMX";
-    rev = "v${version}";
+    tag = "v${version}";
     fetchSubmodules = true;
     hash = "sha256-BcFLdQgEAi6Sxyb5/P9YAIkmeXNZXrKcOa/6g817xQg=";
   };

pkgs/by-name/gi/git-get/package.nix

@@ -14,7 +14,7 @@ buildGoModule rec {
   src = fetchFromGitHub {
     owner = "grdl";
     repo = "git-get";
-    rev = "v${version}";
+    tag = "v${version}";
     hash = "sha256-v98Ff7io7j1LLzciHNWJBU3LcdSr+lhwYrvON7QjyCI=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.

pkgs/by-name/gi/gitqlient/package.nix

@@ -13,7 +13,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "francescmm";
     repo = "gitqlient";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
     hash = "sha256-gfWky5KTSj+5FC++QIVTJbrDOYi/dirTzs6LvTnO74A=";
   };

pkgs/by-name/gl/glslls/package.nix

@@ -14,7 +14,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "svenstaro";
     repo = "glsl-language-server";
-    rev = finalAttrs.version;
+    tag = finalAttrs.version;
     fetchSubmodules = true;
     hash = "sha256-wi1QiqaWRh1DmIhwmu94lL/4uuMv6DnB+whM61Jg1Zs=";
   };

pkgs/by-name/gl/glslviewer/package.nix

@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     owner = "patriciogonzalezvivo";
     repo = "glslViewer";
     fetchSubmodules = true;
-    rev = version;
+    tag = version;
     hash = "sha256-Ve3wmX5+kABCu8IRe4ySrwsBJm47g1zvMqDbqrpQl88=";
   };
   nativeBuildInputs = [

pkgs/by-name/gn/gnustep-libobjc/package.nix

@@ -13,7 +13,7 @@ clangStdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "gnustep";
     repo = "libobjc2";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-+NP214bbisk7dCFAHaxnhNOfC/0bZLp8Dd2A9F2vK+s=";
     fetchSubmodules = true;
   };

pkgs/by-name/go/gossa/package.nix

@@ -11,7 +11,7 @@ buildGoModule rec {
   src = fetchFromGitHub {
     owner = "pldubouilh";
     repo = "gossa";
-    rev = "v${version}";
+    tag = "v${version}";
     fetchSubmodules = true;
     hash = "sha256-FGlUj0BJ8KeCfvdN9+NG4rqtaUIxgpqQ+09Ie1/TpAQ=";
   };

pkgs/by-name/gr/grandorgue/package.nix

@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "GrandOrgue";
     repo = "grandorgue";
-    rev = version;
+    tag = version;
     fetchSubmodules = true;
     hash = "sha256-9H7YpTtv9Y36Nc0WCyRy/ohpOQ3WVUd9gMahnGhANRc=";
   };

pkgs/by-name/gr/grenedalf/package.nix

@@ -35,7 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "lczech";
     repo = "grenedalf";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-DJ7nZjOvYFQlN/L+S2QcMVvH/M9Dhla4VXl2nxc22m4=";
     fetchSubmodules = true;
   };

pkgs/by-name/gr/grpc-tools/package.nix

@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "grpc";
     repo = "grpc-node";
-    rev = "grpc-tools@${version}";
+    tag = "grpc-tools@${version}";
     hash = "sha256-708lBIGW5+vvSTrZHl/kc+ck7JKNXElrghIGDrMSyx8=";
     fetchSubmodules = true;
   };

pkgs/by-name/gr/grpc/package.nix

@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "grpc";
     repo = "grpc";
-    rev = "v${version}";
+    tag = "v${version}";
     hash = "sha256-VAr+f+xqZfrP4XfCnZ9KxVTO6pHQe9gB2DgaQuen840=";
     fetchSubmodules = true;
   };

pkgs/by-name/gw/gwyddion/package.nix

@@ -34,10 +34,10 @@
 
 stdenv.mkDerivation rec {
   pname = "gwyddion";
-  version = "2.68";
+  version = "2.69";
   src = fetchurl {
     url = "mirror://sourceforge/gwyddion/gwyddion-${version}.tar.xz";
-    sha256 = "sha256-clw/cXODYrELHiz3bTkWhM8vFacaKzTvHK3avW1am/o=";
+    sha256 = "sha256-WX62tR7ldaB/NQzAVzvHTQBaNJDZgyrRNqNp5w0w76Y=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/gx/gxplugins-lv2/package.nix

@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "brummer10";
     repo = "GxPlugins.lv2";
-    rev = "v${version}";
+    tag = "v${version}";
     hash = "sha256-NvmFoOAQtAnKrZgzG1Shy1HuJEWgjJloQEx6jw59hag=";
     fetchSubmodules = true;
   };