Merge master into staging-next

nixos/doc/manual/configuration/wireless.section.md

@@ -1,16 +1,40 @@
 # Wireless Networks {#sec-wireless}
 
-For a desktop installation using NetworkManager (e.g., GNOME), you just
-have to make sure the user is in the `networkmanager` group and you can
-skip the rest of this section on wireless networks.
+For a desktop installation using NetworkManager (e.g., GNOME or KDE), you should
+make sure the user is in the `networkmanager` group and you can just configure
+wireless networks from the Settings app.
+It is also possible to declare (some) wireless networks from the NixOS
+configuration with [](#opt-networking.networkmanager.ensureProfiles.profiles).
 
-NixOS will start wpa_supplicant for you if you enable this setting:
+Alternatively, without NetworkManager, you can configure wireless networks
+using wpa_supplicant by setting
 
 ```nix
 { networking.wireless.enable = true; }
 ```
 
-NixOS lets you specify networks for wpa_supplicant declaratively:
+By default, wpa_supplicant will manage the first wireless interface that becomes
+available. It is however recommended to set the desired interface name with
+[](#opt-networking.wireless.interfaces), as it is more reliable.
+
+If multiple interfaces are set, NixOS will create a separate systemd service
+for each one of them, for example:
+
+```nix
+{
+  networking.wireless.interfaces = [
+    "wlan0"
+    "wlan1"
+  ];
+}
+```
+
+results in `wpa_supplicant-wlan0.service` and `wpa_supplicant-wlan1.service`.
+
+
+## Declarative configuration {#sec-wireless-declarative}
+
+NixOS lets you specify networks declaratively:
 
 ```nix
 {
@@ -33,15 +57,14 @@ NixOS lets you specify networks for wpa_supplicant declaratively:
 }
 ```
 
-Be aware that keys will be written to the nix store in plaintext! When
-no networks are set, it will default to using a configuration file at
-`/etc/wpa_supplicant.conf`. You should edit this file yourself to define
-wireless networks, WPA keys and so on (see wpa_supplicant.conf(5)).
+If the network is using WPA2, the pre-shared key (PSK) can be also specified
+with the `pskRaw` option as 64 hexadecimal digits.
+This is useful to both obfuscate passwords and make the connection slightly
+faster, as the key doesn't need to be derived every time.
 
-If you are using WPA2 you can generate pskRaw key using
-`wpa_passphrase`:
+The `pskRaw` values can be calculated using the `wpa_passphrase` tool:
 
-```ShellSession
+```console
 $ wpa_passphrase ESSID PSK
 network={
         ssid="echelon"
@@ -52,23 +75,152 @@ network={
 
 ```nix
 {
-  networking.wireless.networks = {
-    echelon = {
-      pskRaw = "dca6d6ed41f4ab5a984c9f55f6f66d4efdc720ebf66959810f4329bb391c5435";
-    };
+  networking.wireless.networks.echelon = {
+    pskRaw = "dca6d6ed41f4ab5a984c9f55f6f66d4efdc720ebf66959810f4329bb391c5435";
   };
 }
 ```
 
-or you can use it to directly generate the `wpa_supplicant.conf`:
-
-```ShellSession
-# wpa_passphrase ESSID PSK > /etc/wpa_supplicant.conf
+Other wpa_supplicant configuration can be set using the {option}`extraConfig`
+option, either globally or per-network. For example:
+```
+{
+  networking.wireless.extraConfig = ''
+    # Enable MAC address randomization by default
+    mac_addr=1
+  '';
+  networking.wireless.networks.home = {
+    psk = "abcdefgh";
+    extraConfig = ''
+      # Use the real MAC address at home
+      mac_addr=0
+    '';
+  };
+}
 ```
 
-After you have edited the `wpa_supplicant.conf`, you need to restart the
-wpa_supplicant service.
+::: {.note}
+The generated wpa_supplicant configuration file is linked to
+`/etc/wpa_supplicant/nixos.conf` for easier inspection.
+:::
 
-```ShellSession
+
+Be aware that in the previous examples the keys would be written to the Nix
+store in plain text and readable to every local user.
+It is recommended to specify secrets (PSKs, passwords, etc.) in a safe way using
+[](#opt-networking.wireless.secretsFile) and the `ext:` syntax. For example:
+
+```nix
+{
+  networking.wireless.secretsFile = "/run/secrets/wireless.conf";
+  networking.wireless.networks = {
+    home = {
+      pskRaw = "ext:psk_home";
+    };
+    work.auth = ''
+      eap=PEAP
+      identity="my-user@example.com"
+      password=ext:pass_work
+    '';
+  };
+}
+```
+
+where `/run/secrets/wireless.conf` contains
+
+```
+psk_home=mypassword
+pass_work=myworkpassword
+```
+
+::: {.note}
+The secrets file should be owned and placed in a location accessible (only) by
+the `wpa_supplicant` user. Only certain fields support the `ext:` syntax,
+for example `psk`, `sae_password` and `password`, but not `ssid`.
+:::
+
+
+## Imperative configuration  {#sec-wireless-imperative}
+
+It can be useful to add a new network without rebuilding the NixOS
+configuration, particularly if you don't yet have Internet access.
+Setting [](#opt-networking.wireless.userControlled) to `true` will allow users
+of the `wpa_supplicant` group to configure wpa_supplicant imperatively.
+
+For example, using `wpa_cli` you can add a new network and connect to it as:
+```console
+# wpa_cli
+Selected interface 'wlan0'
+
+Interactive mode
+
+> add_network
+10
+> set_network 10 ssid "echelon"
+OK
+> set_network 10 psk "abcdefgh"
+OK
+> select_network 10
+OK
+```
+
+Note that these changes will be lost when wpa_supplicant is restarted.
+To make them persistent, the option
+[](#opt-networking.wireless.allowAuxiliaryImperativeNetworks) can be set, which
+allows to use the `save` command in `wpa_cli`, or even directly editing the
+file `/etc/wpa_supplicant/imperative.conf`.
+
+::: {.note}
+Remember that after manually editing `imperative.conf` the wpa_supplicant daemon
+needs to be restarted:
+```console
 # systemctl restart wpa_supplicant.service
 ```
+or
+```console
+# systemctl restart wpa_supplicant-<interface>.service
+```
+if [](#opt-networking.wireless.interfaces) has been set.
+:::
+
+
+## Enterprise networks {#sec-wireless-enterprise}
+
+Networks with more sophisticated authentication protocols can be configured
+using the free-form `auth` option, for example:
+
+```
+{
+  networking.wireless.networks = {
+    eduroam.auth = ''
+      key_mgmt=WPA-EAP
+      eap=PEAP
+      identity="alice.smith@example.com"
+      password="veryLongPassword$!3"
+      ca_cert="/etc/wpa_supplicant/eduroam.pem"
+    '';
+  };
+}
+```
+
+For examples and a list of available options, see the
+[wpa_supplicant.conf(5)](man:wpa_supplicant.conf(5)) man page.
+
+::: {.warning}
+By default, security hardening measures that limit access to files, devices and
+network capabilities are applied to the wpa_supplicant daemon.
+
+Certificates and other files supplied here need to be readable by the
+`wpa_supplicant` user; it is therefore recommended to store them in the
+`/etc/wpa_supplicant` directory.
+
+If your network authentication protocol requires write access to files, smart
+cards or TPM devices, you may have to disable security hardening with
+```nix
+{ networking.wireless.enableHardening = false; }
+```
+
+This setting also applies to networks configured from NetworkManager, unless
+the WiFi [backend](#opt-networking.networkmanager.wifi.backend) in use is not
+wpa_supplicant.
+:::

nixos/doc/manual/redirects.json

@@ -91,6 +91,15 @@
   "sec-override-nixos-test": [
     "index.html#sec-override-nixos-test"
   ],
+  "sec-wireless-declarative": [
+    "index.html#sec-wireless-declarative"
+  ],
+  "sec-wireless-enterprise": [
+    "index.html#sec-wireless-enterprise"
+  ],
+  "sec-wireless-imperative": [
+    "index.html#sec-wireless-imperative"
+  ],
   "test-opt-rawTestDerivationArg": [
     "index.html#test-opt-rawTestDerivationArg"
   ],

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -103,7 +103,7 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.
 
 - support for `ecryptfs` in nixpkgs has been removed.
 
-- The `networking.wireless` module has been security hardened: the `wpa_supplicant` daemon now runs under an unprivileged user with restricted access to the system.
+- The `networking.wireless` module has been security hardened by default: the `wpa_supplicant` daemon now runs under an unprivileged user with restricted access to the system.
 
   As part of these changes, `/etc/wpa_supplicant.conf` has been deprecated: the NixOS-generated configuration file is now linked to `/etc/wpa_supplicant/nixos.conf` and `/etc/wpa_supplicant/imperative.conf` has been added for imperatively configuring `wpa_supplicant` or when using [allowAuxiliaryImperativeNetworks](#opt-networking.wireless.allowAuxiliaryImperativeNetworks).
 
@@ -112,6 +112,9 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.
   Also, the {option}`networking.wireless.userControlled.group` option has been removed since there is now a dedicated `wpa_supplicant` group to control the daemon, and {option}`networking.wireless.userControlled.enable` has been renamed to [](#opt-networking.wireless.userControlled).
 
   No functionality should have been impacted by these changes (including controlling via `wpa_cli`, integration with NetworkManager or connman), but if you find any problems, please open an issue on GitHub.
+  If necessary, the security hardening can be reverted with [](#opt-networking.wireless.enableHardening).
+
+  Note for NetworkManager users: before these changes NetworkManager used to spawn its own wpa_supplicant daemon, but now it relies on `networking.wireless`. So, if you had `networking.wireless.enable = false` in your configuration, you should remove that line.
 
 - `kratos` has been updated from 1.3.1 to [25.4.0](https://github.com/ory/kratos/releases/tag/v25.4.0). Upstream switched to a new versioning scheme (year.major.minor). Notable breaking changes:
 

nixos/modules/services/audio/mpd.nix

@@ -26,8 +26,9 @@ let
           "\"" + (toString v) + "\""
       )
     ) a;
-  nonBlockSettings = lib.filterAttrs (n: v: !(builtins.isAttrs v || builtins.isList v)) cfg.settings;
-  pureBlockSettings = removeAttrs cfg.settings (builtins.attrNames nonBlockSettings);
+  settings = lib.filterAttrs (n: v: !(isNull v)) cfg.settings;
+  nonBlockSettings = lib.filterAttrs (n: v: !(builtins.isAttrs v || builtins.isList v)) settings;
+  pureBlockSettings = removeAttrs settings (builtins.attrNames nonBlockSettings);
   blocks =
     pureBlockSettings
     // lib.optionalAttrs cfg.fluidsynth {
@@ -221,7 +222,7 @@ in
             };
 
             db_file = lib.mkOption {
-              type = lib.types.path;
+              type = lib.types.nullOr lib.types.path;
               default = "${cfg.dataDir}/tag_cache";
               defaultText = lib.literalExpression ''"''${dataDir}/tag_cache"'';
               description = ''

nixos/modules/services/misc/taskchampion-sync-server.nix

@@ -7,6 +7,9 @@
 let
   inherit (lib) types;
   cfg = config.services.taskchampion-sync-server;
+  defaultUser = "taskchampion";
+  defaultGroup = "taskchampion";
+  defaultDir = "/var/lib/taskchampion-sync-server";
 in
 {
   options.services.taskchampion-sync-server = {
@@ -15,12 +18,12 @@ in
     user = lib.mkOption {
       description = "Unix User to run the server under";
       type = types.str;
-      default = "taskchampion";
+      default = defaultUser;
     };
     group = lib.mkOption {
       description = "Unix Group to run the server under";
       type = types.str;
-      default = "taskchampion";
+      default = defaultGroup;
     };
     host = lib.mkOption {
       description = "Host address on which to serve";
@@ -37,7 +40,7 @@ in
     dataDir = lib.mkOption {
       description = "Directory in which to store data";
       type = types.path;
-      default = "/var/lib/taskchampion-sync-server";
+      default = defaultDir;
     };
     snapshot = {
       versions = lib.mkOption {
@@ -59,22 +62,12 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    users.users.${cfg.user} = {
+    users.users.${cfg.user} = lib.mkIf (cfg.user == defaultUser) {
       isSystemUser = true;
       inherit (cfg) group;
     };
-    users.groups.${cfg.group} = { };
+    users.groups.${cfg.group} = lib.mkIf (cfg.group == defaultGroup) { };
     networking.firewall.allowedTCPPorts = lib.mkIf (cfg.openFirewall) [ cfg.port ];
-    systemd.tmpfiles.settings = {
-      "10-taskchampion-sync-server" = {
-        "${cfg.dataDir}" = {
-          d = {
-            inherit (cfg) group user;
-            mode = "0750";
-          };
-        };
-      };
-    };
 
     systemd.services.taskchampion-sync-server = {
       wantedBy = [ "multi-user.target" ];
@@ -82,7 +75,13 @@ in
       serviceConfig = {
         User = cfg.user;
         Group = cfg.group;
+        # If we enable DynamicUser, users need to move
+        # /var/lib/taskchampion-sync-server to
+        # /var/lib/private/taskchampion-sync-server manually, which is a
+        # breakage. So we keep the old behavior and we'll do the migration in
+        # another PR.
         DynamicUser = false;
+        StateDirectory = lib.mkIf (cfg.dataDir == defaultDir) "taskchampion-sync-server";
         ExecStart = ''
           ${lib.getExe cfg.package} \
             --listen "${cfg.host}:${toString cfg.port}" \

pkgs/applications/editors/vim/plugins/generated.nix

@@ -4835,6 +4835,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  easyread-nvim = buildVimPlugin {
+    pname = "easyread.nvim";
+    version = "0-unstable-2023-04-22";
+    src = fetchFromGitHub {
+      owner = "JellyApple102";
+      repo = "easyread.nvim";
+      rev = "0b07e315a4cd7d700c4a794bdddbec79fdc2628b";
+      hash = "sha256-RSk/KViWw48IX0NcC5hW4IGawZ6prBYxPa/kXPN4KSI=";
+    };
+    meta.homepage = "https://github.com/JellyApple102/easyread.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
   echodoc-vim = buildVimPlugin {
     pname = "echodoc.vim";
     version = "0-unstable-2022-11-27";
@@ -11929,6 +11942,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  nvim-silicon = buildVimPlugin {
+    pname = "nvim-silicon";
+    version = "1.0.0-unstable-2025-01-09";
+    src = fetchFromGitHub {
+      owner = "michaelrommel";
+      repo = "nvim-silicon";
+      rev = "7f66bda8f60c97a5bf4b37e5b8acb0e829ae3c32";
+      hash = "sha256-XiYn/L2e/B+6LTjak3jAwRgnZ3gCbsyA0J61Dd+jZv4=";
+    };
+    meta.homepage = "https://github.com/michaelrommel/nvim-silicon/";
+    meta.hydraPlatforms = [ ];
+  };
+
   nvim-snippets = buildVimPlugin {
     pname = "nvim-snippets";
     version = "1.0.0-unstable-2024-07-10";

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -370,6 +370,7 @@ https://github.com/stevearc/dressing.nvim/,,
 https://github.com/Bekaboo/dropbar.nvim/,HEAD,
 https://github.com/earthly/earthly.vim/,HEAD,
 https://github.com/GustavEikaas/easy-dotnet.nvim/,HEAD,
+https://github.com/JellyApple102/easyread.nvim/,HEAD,
 https://github.com/Shougo/echodoc.vim/,,
 https://github.com/ph1losof/ecolog.nvim/,HEAD,
 https://github.com/sainnhe/edge/,,
@@ -916,6 +917,7 @@ https://github.com/chrisgrieser/nvim-scissors/,HEAD,
 https://github.com/petertriho/nvim-scrollbar/,HEAD,
 https://github.com/dstein64/nvim-scrollview/,,
 https://github.com/s1n7ax/nvim-search-and-replace/,HEAD,
+https://github.com/michaelrommel/nvim-silicon/,HEAD,
 https://github.com/garymjr/nvim-snippets/,,
 https://github.com/dcampos/nvim-snippy/,HEAD,
 https://github.com/ishan9299/nvim-solarized-lua/,,

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -110,13 +110,13 @@
     "vendorHash": null
   },
   "bpg_proxmox": {
-    "hash": "sha256-eRed1lShDIpQRCC/JvqT5uYbDU+mgpMfEPiSQFoV1QA=",
+    "hash": "sha256-WabJZeEDG8q+tccLbRg/j7N3XgkEW7xyTiIwE5t3SD4=",
     "homepage": "https://registry.terraform.io/providers/bpg/proxmox",
     "owner": "bpg",
     "repo": "terraform-provider-proxmox",
-    "rev": "v0.93.0",
+    "rev": "v0.94.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-+UWPbNHoV3TdeMZdY0ZOLBe1/Dej37hHORatC9Kol58="
+    "vendorHash": "sha256-o9k7Bv33cF9O1ByMn8ZcI/DzmVbmEznzMVnLuxcMA7g="
   },
   "brightbox_brightbox": {
     "hash": "sha256-pwFbCP+qDL/4IUfbPRCkddkbsEEeAu7Wp12/mDL0ABA=",
@@ -1175,13 +1175,13 @@
     "vendorHash": "sha256-f3b4NULINH8XworCn46fiz4GmBM31ROdAJy1j4GKkx4="
   },
   "scaleway_scaleway": {
-    "hash": "sha256-YRap8Y0KAaFD7uWo1J2Qrb0l+OPhxS+DfKwGN/QQOw4=",
+    "hash": "sha256-y58Q3VyXRVThSBm3e6aEUJu/VqbrwyIYPyXKiUz+9QA=",
     "homepage": "https://registry.terraform.io/providers/scaleway/scaleway",
     "owner": "scaleway",
     "repo": "terraform-provider-scaleway",
-    "rev": "v2.68.0",
+    "rev": "v2.69.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-rT8ScPPnrbUBviiK03U96K5vvVEbcLra3MGSJ8+SYyE="
+    "vendorHash": "sha256-zBThWG4Pis0bewKeai7pKupbgKIC7/8ALF/nWIfqYq0="
   },
   "scottwinkler_shell": {
     "hash": "sha256-LTWEdXxi13sC09jh+EFZ6pOi1mzuvgBz5vceIkNE/JY=",
@@ -1193,11 +1193,11 @@
     "vendorHash": "sha256-MIO0VHofPtKPtynbvjvEukMNr5NXHgk7BqwIhbc9+u0="
   },
   "selectel_selectel": {
-    "hash": "sha256-htB1/ptyo+rgAOAt9VZwULU1c3XU1QcKUxxtGFjD3ag=",
+    "hash": "sha256-hmXFDWbo79t15nKsyDOi5SDzyG3tA+6oo7LPoMURzh8=",
     "homepage": "https://registry.terraform.io/providers/selectel/selectel",
     "owner": "selectel",
     "repo": "terraform-provider-selectel",
-    "rev": "v7.5.1",
+    "rev": "v7.5.3",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-OJlD1P+CUEsLk2xSsQ2QQBvGewYNly1dIJh8kMi+ChE="
   },

pkgs/by-name/au/ausweisapp/package.nix

@@ -11,15 +11,21 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "ausweisapp";
-  version = "2.4.0";
+  version = "2.4.1";
 
   src = fetchFromGitHub {
     owner = "Governikus";
     repo = "AusweisApp2";
     rev = finalAttrs.version;
-    hash = "sha256-vMvCnYSj7y6ETGoudV1YJwI2bibXePSkR4nQ4T5HqTo=";
+    hash = "sha256-cLKF5QYDPngvN6+3p7B8YO/MYvDfD1fbnyEMZPmjj8w=";
   };
 
+  postPatch = ''
+    # avoid runtime QML cache to fix GUI loading issues
+    substituteInPlace src/ui/qml/CMakeLists.txt src/ui/qml/modules/CMakeLists.txt \
+      --replace-fail NO_CACHEGEN ""
+  '';
+
   nativeBuildInputs = [
     cmake
     pkg-config
@@ -41,6 +47,8 @@ stdenv.mkDerivation (finalAttrs: {
     qt6.qtwebsockets
   ];
 
+  env.LANG = "C.UTF-8";
+
   passthru = {
     tests.version = testers.testVersion {
       package = finalAttrs.finalPackage;

pkgs/by-name/bi/bitwarden-desktop/package.nix

@@ -33,13 +33,13 @@ let
 in
 buildNpmPackage' rec {
   pname = "bitwarden-desktop";
-  version = "2025.12.1";
+  version = "2026.1.0";
 
   src = fetchFromGitHub {
     owner = "bitwarden";
     repo = "clients";
     rev = "desktop-v${version}";
-    hash = "sha256-yER9LDFwTQkOdjB84UhEiWUDE+5Qa2vlRzq1/Qc/soY=";
+    hash = "sha256-Z6YMAzn1J5n27qqx3PsaMmD9uIK7FTEl1/tEzePD+6Y=";
   };
 
   patches = [
@@ -84,7 +84,7 @@ buildNpmPackage' rec {
     "--ignore-scripts"
   ];
   npmWorkspace = "apps/desktop";
-  npmDepsHash = "sha256-hczwOG30ad5oaTU7APPrW+a7LmjPch+P4dZSb7B+2eU=";
+  npmDepsHash = "sha256-/S0itw2m2k7GiiwBEzeqFQ8oUYD4yIO4knTTn37qkfA=";
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit
@@ -94,7 +94,7 @@ buildNpmPackage' rec {
       cargoRoot
       patches
       ;
-    hash = "sha256-NaomkYqkRW5ir6DI5t0JqoewN8QZtSibGKW93MwsqPQ=";
+    hash = "sha256-Q1FWH46EcITEwLquv52lnLnhbetD8bpTUl3agFZQ0Es=";
   };
   cargoRoot = "apps/desktop/desktop_native";
 

pkgs/by-name/ca/cargo-llvm-cov/Cargo.lock

@@ -13,9 +13,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.100"
+version = "1.0.101"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a23eb6b1614318a8071c9b2521f36b424b2c83db5eb3a0fead4a6c0809af6e61"
+checksum = "5f0e0fee31ef5ed1ba1316088939cea399010ed7731dba877ed44aeb407a75ea"
 
 [[package]]
 name = "autocfg"
@@ -40,6 +40,12 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "build-context"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "86610cb1e9d45d65a31b574f9d69de003a76b6bb0b7d882396a5153fc547c935"
+
 [[package]]
 name = "camino"
 version = "1.2.2"
@@ -60,9 +66,10 @@ dependencies = [
 
 [[package]]
 name = "cargo-llvm-cov"
-version = "0.8.1"
+version = "0.8.3"
 dependencies = [
  "anyhow",
+ "build-context",
  "camino",
  "cargo-config2",
  "duct",
@@ -273,9 +280,9 @@ dependencies = [
 
 [[package]]
 name = "regex"
-version = "1.12.2"
+version = "1.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "843bc0191f75f3e22651ae5f1e72939ab2f72a4bc30fa80a066bd66edefc24d4"
+checksum = "e10754a14b9137dd7b1e3e5b0493cc9171fdd105e0ab477f51b72e7f3ac0e276"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -285,9 +292,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.13"
+version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5276caf25ac86c8d810222b3dbb938e512c55c6831a10f3e6ed1c93b84041f1c"
+checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -296,9 +303,9 @@ dependencies = [
 
 [[package]]
 name = "regex-syntax"
-version = "0.8.8"
+version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a2d987857b319362043e95f5353c0535c1f58eec5336fdfcf626430af7def58"
+checksum = "a96887878f22d7bad8a3b6dc5b7440e0ada9a245242924394987b21cf2210a4c"
 
 [[package]]
 name = "rustc-demangle"
@@ -627,6 +634,6 @@ dependencies = [
 
 [[package]]
 name = "zmij"
-version = "1.0.17"
+version = "1.0.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02aae0f83f69aafc94776e879363e9771d7ecbffe2c7fbb6c14c5e00dfe88439"
+checksum = "3ff05f8caa9038894637571ae6b9e29466c1f4f829d26c9b28f869a29cbe3445"

pkgs/by-name/ca/cargo-llvm-cov/package.nix

@@ -25,7 +25,7 @@
 
 let
   pname = "cargo-llvm-cov";
-  version = "0.8.1";
+  version = "0.8.3";
 
   owner = "taiki-e";
   homepage = "https://github.com/${owner}/${pname}";
@@ -42,7 +42,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     inherit owner;
     repo = "cargo-llvm-cov";
     rev = "v${version}";
-    sha256 = "sha256-w7UHfb5g8g9AYGbxoUpmiBsFEnSuc/RBEAZAYwoFjRg=";
+    sha256 = "sha256-XMv0li/zBNE3FJpcIpja6SqNp4f5GPOET5rfPWLIzRw=";
   };
 
   # Upstream doesn't include the lockfile so we need to add it back
@@ -73,6 +73,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
     git add .
   '';
 
+  checkFlags = [
+    "--skip=trybuild"
+    "--skip=ui_test"
+  ];
+
   meta = {
     inherit homepage;
     changelog = homepage + "/blob/v${version}/CHANGELOG.md";

pkgs/by-name/cl/clevis/package.nix

@@ -126,5 +126,6 @@ stdenv.mkDerivation (finalAttrs: {
     changelog = "https://github.com/latchset/clevis/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.gpl3Plus;
     maintainers = [ ];
+    mainProgram = "clevis";
   };
 })

pkgs/by-name/co/commitlint/package.nix

@@ -12,18 +12,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "commitlint";
-  version = "20.3.1";
+  version = "20.4.0";
 
   src = fetchFromGitHub {
     owner = "conventional-changelog";
     repo = "commitlint";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0UAIpQdvs9oFsV1xL7bR9fAcmrtaqI/79mmmx+NRK4Q=";
+    hash = "sha256-Koi4twmDeCV716rGEUUmkt25gzBROBFL5y48qr+J/FA=";
   };
 
   yarnOfflineCache = fetchYarnDeps {
     inherit (finalAttrs) src;
-    hash = "sha256-ulQLIIWIeVRh5t+IV+980m5vbBG1dmQv9iaxCLznPY8=";
+    hash = "sha256-ihN9DmW46nKeFjcZWdxsutE+Q6ezdqPXO0i/xkNJdI0=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/di/diesel-cli/package.nix

@@ -27,15 +27,15 @@ assert lib.assertMsg (lib.elem true [
 
 rustPlatform.buildRustPackage rec {
   pname = "diesel-cli";
-  version = "2.3.4";
+  version = "2.3.6";
 
   src = fetchCrate {
     inherit version;
     crateName = "diesel_cli";
-    hash = "sha256-92mXE+FHggig2TrY+Mf31MEtfxP3vf2J/mUZmW/bkCI=";
+    hash = "sha256-CNcZd/wIUg4fKnCeT0O7k6Svldg+1RY0xGmp+Y+UFA8=";
   };
 
-  cargoHash = "sha256-/5Bxn0gZfHCz5GVupmkmN1QKkef4q266e+FUbIN1x9E=";
+  cargoHash = "sha256-Yrf9vAVMLoWJpnKaM87gvQUPX2nw3USnU9/l1kYJpaY=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/di/diffnav/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "diffnav";
-  version = "0.8.2";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "dlvhdr";
     repo = "diffnav";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2CAvZyBcWlaTHcDqKlGYjFiZJm9UcwGS3YQpeaphKTE=";
+    hash = "sha256-EkJim0YCdImlf7cNELMwXMQEJPZxSBbmUH0rnNkCuOM=";
   };
 
-  vendorHash = "sha256-FA58Rd+tEiyArDCeKsekpxkM+i8z/KlO3GLzkonSKVM=";
+  vendorHash = "sha256-/GwIxSyH7maY2m9CcqUs3aeX/5OX0VsvUoOGWkBzJ9M=";
 
   ldflags = [
     "-s"
@@ -35,7 +35,10 @@ buildGoModule (finalAttrs: {
     description = "Git diff pager based on delta but with a file tree, à la GitHub";
     homepage = "https://github.com/dlvhdr/diffnav";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ amesgen ];
+    maintainers = with lib.maintainers; [
+      amesgen
+      matthiasbeyer
+    ];
     mainProgram = "diffnav";
   };
 })

pkgs/by-name/eg/ego/package.nix

@@ -4,33 +4,43 @@
   fetchFromGitHub,
   makeBinaryWrapper,
   acl,
+  libxcb,
   xhost,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ego";
-  version = "1.1.7";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "intgr";
     repo = "ego";
-    rev = finalAttrs.version;
-    hash = "sha256-613RM7Ldye0wHAH3VMhzhyT5WVTybph3gS/WNMrsgGI=";
+    tag = finalAttrs.version;
+    hash = "sha256-TO0jyi6XGPfuF7s4vTV8uT43SjCGUx6cVZONyb5e93Q=";
   };
 
-  buildInputs = [ acl ];
+  buildInputs = [
+    acl
+    libxcb
+  ];
 
   nativeBuildInputs = [ makeBinaryWrapper ];
 
-  cargoHash = "sha256-GwWDH3np/YKUx7BLmKxUui2CXLYbHjivWC1av9jaccA=";
+  cargoHash = "sha256-MmcZrjjNvc3C/RRMCQsuaJT4sf+gTAaxVDtKGHjKqc8=";
 
   # requires access to /root
   checkFlags = [
     "--skip=tests::test_check_user_homedir"
   ];
 
+  preCheck = ''
+    export LD_LIBRARY_PATH="${lib.makeLibraryPath [ libxcb ]}:$LD_LIBRARY_PATH"
+  '';
+
   postInstall = ''
-    wrapProgram $out/bin/ego --prefix PATH : ${lib.makeBinPath [ xhost ]}
+    wrapProgram $out/bin/ego \
+      --prefix PATH : ${lib.makeBinPath [ xhost ]} \
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libxcb ]}
   '';
 
   meta = {

pkgs/by-name/el/elinks/package.nix

@@ -33,13 +33,13 @@ assert enablePython -> python != null;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "elinks";
-  version = "0.18.0";
+  version = "0.19.0";
 
   src = fetchFromGitHub {
     owner = "rkd77";
     repo = "elinks";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-TTb/v24gIWKiCQCESHo0Pz6rvRtw5anoXK0b35dzfLM=";
+    hash = "sha256-eFH42PCMF3HPvNqcaXOyIM6AAr3RusgxiRlUa2X8B9U=";
   };
 
   buildInputs = [

pkgs/by-name/et/etherpad-lite/package.nix

@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "etherpad-lite";
-  version = "2.6.0";
+  version = "2.6.1";
 
   src = fetchFromGitHub {
     owner = "ether";
     repo = "etherpad-lite";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zsW4hBilhhkP9H0rTLDr6S0BZBGb9XqGNKcftkoivOs=";
+    hash = "sha256-KzkrJv9eBzzt9PSJGhzC0lxCOfQImSTHcTVlea8HV70=";
   };
 
   patches = [
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_9;
     fetcherVersion = 1;
-    hash = "sha256-2nNjFdirgnciOf5kXwM4MXoBeidnnis4oi2AbYQvTHo=";
+    hash = "sha256-/GqRoGWIQhOwKlbe4I6yTuGs+IOn4crPhwHt4ALJ97E=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/fa/fake-gcs-server/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "fake-gcs-server";
-  version = "1.52.3";
+  version = "1.53.1";
 
   src = fetchFromGitHub {
     owner = "fsouza";
     repo = "fake-gcs-server";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-XoHG0dm565RRke3me/WDy1TRLrSlecy4b3xuYPvOcoo=";
+    hash = "sha256-UNXmbfCmLfY3gvstR2sEQ5SmHJy7PBe38JMCnc2GTz8=";
   };
 
-  vendorHash = "sha256-FMDpQSwLrLaiy5HzdragOmgvLBDax5VDN0DZLzQyhts=";
+  vendorHash = "sha256-+X0/vHHfzz4u7taeUhrH3E3TCZ2ABYwurDwg0THfnKY=";
 
   # Unit tests fail to start the emulator server in some environments (e.g. Hydra) for some reason.
   #

pkgs/by-name/fi/fish-lsp/package.nix

@@ -12,21 +12,22 @@
   which,
   yarnBuildHook,
   yarnConfigHook,
+  testers,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "fish-lsp";
-  version = "1.0.10";
+  version = "1.1.3";
 
   src = fetchFromGitHub {
     owner = "ndonfris";
     repo = "fish-lsp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-OZiqEef4jE1H47mweVCzhaRCSsFdpgUdCSuhWRz2n2M=";
+    hash = "sha256-G0RaDXn3UNkdrlnjNH75ftvcLgAuiY09aXY3MXjaLEE=";
   };
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-N9P2mmqAfbg/Kpqx+vZbb+fhaD1I/3UjiJaEqFPJyO0=";
+    hash = "sha256-uLrdja3G/OwHZXkQbKXsPmGRIs08b3sCPtxtP1a52fg=";
   };
 
   nativeBuildInputs = [
@@ -39,16 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
     fish
   ];
 
-  yarnBuildScript = "setup";
-
-  postBuild = ''
-    yarn --offline compile
-  '';
-
-  # We do it in postPatch, since it needs to be fixed before buildPhase
-  postPatch = ''
-    patchShebangs bin/fish-lsp
-  '';
+  yarnBuildScript = "build:npm";
 
   installPhase = ''
     runHook preInstall
@@ -61,7 +53,7 @@ stdenv.mkDerivation (finalAttrs: {
     cp -r . $out/share/fish-lsp
 
     makeWrapper ${lib.getExe nodejs} "$out/bin/fish-lsp" \
-      --add-flags "$out/share/fish-lsp/out/cli.js" \
+      --add-flags "$out/share/fish-lsp/dist/fish-lsp" \
       --prefix PATH : "${
         lib.makeBinPath [
           fish
@@ -79,15 +71,24 @@ stdenv.mkDerivation (finalAttrs: {
 
   doDist = false;
 
-  # fish-lsp adds tags for all its pre-release versions, which leads to
-  # incorrect r-ryantm bumps. This regex allows a dash at the end followed by a
-  # number (like `v1.0.9-1`). but it prevents matches with a dash followed by
-  # text (like `v1.0.11-pre.10`). or, of course, no dash at all
-  passthru.updateScript = nix-update-script {
-    extraArgs = [
-      "--version-regex"
-      "v(\\d+\\.\\d+\\.\\d+(?:-\\d+)?)$"
-    ];
+  passthru = {
+    # fish-lsp adds tags for all its pre-release versions, which leads to
+    # incorrect r-ryantm bumps. This regex allows a dash at the end followed by a
+    # number (like `v1.0.9-1`). but it prevents matches with a dash followed by
+    # text (like `v1.0.11-pre.10`). or, of course, no dash at all
+    updateScript = nix-update-script {
+      extraArgs = [
+        "--version-regex"
+        "v(\\d+\\.\\d+\\.\\d+(?:-\\d+)?)$"
+      ];
+    };
+
+    tests = {
+      version = testers.testVersion {
+        package = finalAttrs.finalPackage;
+        version = finalAttrs.version;
+      };
+    };
   };
 
   meta = {

pkgs/by-name/fo/forgejo-mcp/package.nix

@@ -0,0 +1,38 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromCodeberg,
+  nix-update-script,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "forgejo-mcp";
+  version = "2.9.0";
+
+  src = fetchFromCodeberg {
+    owner = "goern";
+    repo = "forgejo-mcp";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-9H4UQIKRsmKifE9CGvtlkmwMfdsmczUmPckNVJwJqco=";
+  };
+
+  vendorHash = "sha256-AfQGVq6xeNC+01FdPGqDWvIVXMEp7B6SjAnbswuDdu0=";
+
+  ldflags = [
+    "-s"
+    "-X main.Version=${finalAttrs.version}"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Model Context Protocol (MCP) server for interacting with the Forgejo REST API";
+    longDescription = "This Model Context Protocol (MCP) server provides tools and resources for interacting with the Forgejo (specifically Codeberg.org) REST API";
+    homepage = "https://codeberg.org/goern/forgejo-mcp";
+    changelog = "https://codeberg.org/goern/forgejo-mcp/src/tag/${finalAttrs.src.tag}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ malik ];
+    mainProgram = "forgejo-mcp";
+  };
+})

pkgs/by-name/gg/ggml/package.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ggml";
-  version = "0.9.5";
+  version = "0.9.6";
 
   src = fetchFromGitHub {
     owner = "ggml-org";
     repo = "ggml";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lNrON8vKUJU7cxfpRKsVCIWqZj3xtkaf/Fv8zNZFN6o=";
+    hash = "sha256-qi2ztJdDn3QVy6O1sAOHnWiVn8iDfEM5ijwuvDRMJ1E=";
   };
 
   # The cmake package does not handle absolute CMAKE_INSTALL_LIBDIR and CMAKE_INSTALL_INCLUDEDIR

pkgs/by-name/gl/globus-cli/package.nix

@@ -8,19 +8,20 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "globus-cli";
-  version = "3.38.0";
+  version = "3.41.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "globus";
     repo = "globus-cli";
     tag = version;
-    hash = "sha256-TjJ0GBXRYSMbWfCkGJSBzToHEjoN5ZJAzZe2yiRJhtg=";
+    hash = "sha256-bTS4dXQU49asmPmgUnf4VjAWJ34+1YbXmCJ4KOeOoMI=";
   };
 
   build-system = with python3Packages; [
     setuptools
     ruamel-yaml
+    flit-core
   ];
 
   dependencies = with python3Packages; [
@@ -51,6 +52,10 @@ python3Packages.buildPythonApplication rec {
     versionCheckHook
   ];
 
+  pythonRelaxDeps = [
+    "globus-sdk"
+  ];
+
   versionCheckProgramArg = "version";
 
   postInstall = ''

pkgs/by-name/gp/gpu-screen-recorder/package.nix

@@ -28,12 +28,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gpu-screen-recorder";
-  version = "5.12.1";
+  version = "5.12.3";
 
   src = fetchgit {
     url = "https://repo.dec05eba.com/gpu-screen-recorder";
     tag = finalAttrs.version;
-    hash = "sha256-FUt3R2clnWYNKgW5uo2HtON91zB2+u+Ini15/ccTJdk=";
+    hash = "sha256-sl5apGLA64xgHxk7C47aK+OTVPjAVkpxi2yhN6HoJyk=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/gr/grafana-loki/package.nix

@@ -12,14 +12,14 @@
 }:
 
 buildGoModule (finalAttrs: {
-  version = "3.6.4";
+  version = "3.6.5";
   pname = "grafana-loki";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "loki";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-zzYW0zg0Cg18aDNS4cGDeTW21K/sDB/BkpsoPpxgFok=";
+    hash = "sha256-f9YijC8MH+vPxh6N/LKQIhsSWM6uEqIyHY+5J3mu+aQ=";
   };
 
   vendorHash = null;

pkgs/by-name/hy/hydrus/package.nix

@@ -16,14 +16,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "hydrus";
-  version = "653";
+  version = "658";
   pyproject = false;
 
   src = fetchFromGitHub {
     owner = "hydrusnetwork";
     repo = "hydrus";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-OH07OvN5EaEsjlUHUJMqproiVcN75yL9u7lnCjXSITo=";
+    hash = "sha256-vH+kUnSh7uOy4x6YNkzcTtp3Xmgfmcwt/vE/FbMWKDo=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/is/ispc/package.nix

@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ispc";
-  version = "1.29.1";
+  version = "1.30.0";
 
   src = fetchFromGitHub {
     owner = "ispc";
     repo = "ispc";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4kYyUBGhTS9XurRjxXnEv12+UzZvSnu7DndhS5AhwQo=";
+    hash = "sha256-CzyK38c8fCG7QiVHE0rSzxmyTXNr4sg1WtChbi75Wmw=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ka/kahip/package.nix

@@ -12,13 +12,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "kahip";
-  version = "3.21";
+  version = "3.22";
 
   src = fetchFromGitHub {
     owner = "KaHIP";
     repo = "KaHIP";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-FVbJJpz3ecfME0KZN/5AHuqCkPl/UpR+kHHMyxFzErY=";
+    hash = "sha256-uZRNATfrQgAn5Wsmpk9tU0ojXHbLJ8DOOuXRJJhkhFM=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/kd/kdotool/package.nix

@@ -1,6 +1,7 @@
 {
   lib,
   fetchFromGitHub,
+  fetchpatch,
   rustPlatform,
   pkg-config,
   dbus,
@@ -17,6 +18,18 @@ rustPlatform.buildRustPackage (finalAttrs: {
     hash = "sha256-qx4bWAFQcoLM/r4aNzmoZdjclw8ccAW8lKLda6ON1aQ=";
   };
 
+  patches = [
+    # Remove these two on next release.
+    (fetchpatch {
+      url = "https://github.com/jinliu/kdotool/commit/049e3f5620ad8c5484241d7d06d742bc17d423ed.patch";
+      hash = "sha256-VTpHlT6XMVRgJIeLjxZPHkzaYFZCYtS8IAD0mKZ8rzs=";
+    })
+    (fetchpatch {
+      url = "https://github.com/jinliu/kdotool/commit/e0a3bff3b5d9882033dd72836e5fcff572b64135.patch";
+      hash = "sha256-6IsV9O2h9N/FxGQRHS8qAbEqdr7282ziGza5K52vpPk=";
+    })
+  ];
+
   cargoHash = "sha256-ASR2zMwVCKeEZPYQNoO54J00eZyTn1i6FE0NBCJWSCs=";
 
   nativeBuildInputs = [ pkg-config ];

pkgs/by-name/kt/ktailctl/package.nix

@@ -11,13 +11,13 @@
 }:
 
 let
-  version = "0.21.3";
+  version = "0.21.5";
 
   src = fetchFromGitHub {
     owner = "f-koehler";
     repo = "KTailctl";
     rev = "v${version}";
-    hash = "sha256-BKVq6d8CDmAOGULKoxXtlGbtgNu7wfsQnsyYV7PiFfc=";
+    hash = "sha256-DqPerb8NcNynMMmoG8Ld0ZEyhrNg2q17TaErAbXIHC0=";
   };
 
   goDeps =
@@ -25,7 +25,7 @@ let
       pname = "ktailctl-go-wrapper";
       inherit src version;
       modRoot = "src/wrapper";
-      vendorHash = "sha256-RhVZ1yXm+gJHM993Iw1XM/w/O1YiG6Mt4YMK+0JqRpg=";
+      vendorHash = "sha256-jA1yortzyaBOP9GenmARhBBNDdpkGo9DNz0CXlh3BIU=";
     }).goModules;
 in
 stdenv.mkDerivation {

pkgs/by-name/lu/luau/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "luau";
-  version = "0.707";
+  version = "0.708";
 
   src = fetchFromGitHub {
     owner = "luau-lang";
     repo = "luau";
     tag = finalAttrs.version;
-    hash = "sha256-YUv40STZs5J+xFo5apbyqOpDB+PO+mYsC93pXmxhW+o=";
+    hash = "sha256-mGBwpu7KGCcwmLsx+Nv5xSaHxbAosB6P1x1IEz8/PHg=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/ma/marksman/package.nix

@@ -13,13 +13,13 @@ let
 in
 buildDotnetModule (finalAttrs: {
   inherit pname dotnet-sdk;
-  version = "2025-12-13";
+  version = "2026-01-28";
 
   src = fetchFromGitHub {
     owner = "artempyanykh";
     repo = "marksman";
     tag = finalAttrs.version;
-    hash = "sha256-HgRovSdalRRG1Gx0vNYhRDTbYO/vpz4hB1pgqcVjWF4=";
+    hash = "sha256-jqjf5nDxrw9W+PY9qo5j0dFiWGItRYHWiwEyCpn6ZKA=";
   };
 
   projectFile = "Marksman/Marksman.fsproj";

pkgs/by-name/ma/mattermostLatest/package.nix

@@ -11,10 +11,10 @@ mattermost.override {
     # and make sure the version regex is up to date here.
     # Ensure you also check ../mattermost/package.nix for ESR releases.
     regex = "^v(11\\.[0-9]+\\.[0-9]+)$";
-    version = "11.3.0";
-    srcHash = "sha256-D5LR3kk9HO8vuvykCgaV5k5Y/M7t63afxXj1iUBS1j8=";
-    vendorHash = "sha256-3Ic8ogcLLzcFOmBzhFnsh16hVvhyIsfDeNgZevQlL9A=";
-    npmDepsHash = "sha256-w54D5HMLW5wP6ercgWXv3Hb7Ayrj3M1SvNoUu1aU2Bk=";
+    version = "11.4.0";
+    srcHash = "sha256-w+/slirvft6OQHLmZHwy92GEy0SSJ+5uV/8e3xOB2CE=";
+    vendorHash = "sha256-8Q5jiEsLy3hZLL81tU3xG8zp65KpAYsjSE9jit77fEI=";
+    npmDepsHash = "sha256-MrFV87WslmFxil9zW5JmoT5psM0GAJvmDK3WfkxpoUo=";
     lockfileOverlay = ''
       unlock(.; "@floating-ui/react"; "channels/node_modules/@floating-ui/react")
     '';

pkgs/by-name/mb/mblaze/package.nix

@@ -15,7 +15,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mblaze";
-  version = "1.3";
+  version = "1.4";
 
   nativeBuildInputs = [
     installShellFiles
@@ -29,8 +29,8 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "leahneukirchen";
     repo = "mblaze";
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-398wiXJ/iG9ZfPGDZc57xH37lft3NpEZuLE0Qhb2GGc=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-v7g4kzCZFkkZ/VPogDObduFzgjBVQFziBzHocAdEw9A=";
   };
 
   makeFlags = [ "PREFIX=$(out)" ];

pkgs/by-name/me/meilisearch/package.nix

@@ -8,18 +8,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "meilisearch";
-  version = "1.34.3";
+  version = "1.35.0";
 
   src = fetchFromGitHub {
     owner = "meilisearch";
     repo = "meilisearch";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-aO2OEXnYnejG3/7rVtpgIuPJkFW2clj4HooIWoEWDcE=";
+    hash = "sha256-OMvJBauvL5El/OANN8ACf2MLwclcHnFQVVwul8kKijM=";
   };
 
   cargoBuildFlags = [ "--package=meilisearch" ];
 
-  cargoHash = "sha256-ZnztQOL+q+Bk+Vms5NiBVG2FrzKS0Cn+S3COWMe+tbw=";
+  cargoHash = "sha256-XHL9bfWRiZxzLCd0eLUWWn7KeH3h5bfuXPNQEO11+1c=";
 
   # Default features include mini dashboard which downloads something from the internet.
   buildNoDefaultFeatures = true;

pkgs/by-name/mk/mkvtoolnix/package.nix

@@ -52,13 +52,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "mkvtoolnix";
-  version = "96.0";
+  version = "97.0";
 
   src = fetchFromCodeberg {
     owner = "mbunkus";
     repo = "mkvtoolnix";
     tag = "release-${finalAttrs.version}";
-    hash = "sha256-0jypoZK6lTWAQwcuOVH3EWtA9B01bVIay4HNgEDJIRI=";
+    hash = "sha256-M8A3d6BOed1A/Bvw25bNGphXNDXJvHdg26OjOdwsNf4=";
   };
 
   passthru = {

pkgs/by-name/mo/mongodb-atlas-cli/package.nix

@@ -11,16 +11,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "mongodb-atlas-cli";
-  version = "1.51.2";
+  version = "1.52.0";
 
   src = fetchFromGitHub {
     owner = "mongodb";
     repo = "mongodb-atlas-cli";
     tag = "atlascli/v${finalAttrs.version}";
-    hash = "sha256-0NZh+o8UuiasOO0fJua3vPhJiA/NI/RdwQ203BMVU+U=";
+    hash = "sha256-2JCDUWgMtt1dKqOMn220siSaqqafv12ho84wN9v44sQ=";
   };
 
-  vendorHash = "sha256-KwExYvH9IWFynh12VnkL3G9PKGZ0lQnIImoCY9Kz+OI=";
+  vendorHash = "sha256-bKi+u4FFD6A7HQwJnPTq3JTqOEig8oUQAHI4BQV+Rro=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/mo/monophony/package.nix

@@ -12,14 +12,14 @@
 }:
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "monophony";
-  version = "4.3.1";
+  version = "4.3.3";
   pyproject = true;
 
   src = fetchFromGitLab {
     owner = "zehkira";
     repo = "monophony";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Jp2RwfTcOb4xALIMc4DAQX+fWdqPE+TWv5qRgdSopbM=";
+    hash = "sha256-+K6spOP6m54jR7J0IvArZTZkowN4MzG02VnTDD9WqSY=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/source";

pkgs/by-name/mu/music-assistant/package.nix

@@ -101,7 +101,6 @@ python.pkgs.buildPythonApplication rec {
   pythonRelaxDeps = [
     "aiohttp"
     "aiosqlite"
-    "aiovban" # PyPi and GitHub versioning is out of sync
     "certifi"
     "colorlog"
     "cryptography"

pkgs/by-name/my/mycli/package.nix

@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "mycli";
-  version = "1.43.1";
+  version = "1.44.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "dbcli";
     repo = "mycli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-KybGpi9ZNkAiniZTnyzzjlUf+xISRk+k4kcIxU/iVSM=";
+    hash = "sha256-7G7Yy0jdULzBiQr4JACWuBG4XdXDYZ8IyfbzGQKF428=";
   };
 
   pythonRelaxDeps = [

pkgs/by-name/ne/neo4j/package.nix

@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "neo4j";
-  version = "2025.12.1";
+  version = "2026.01.3";
 
   src = fetchurl {
     url = "https://neo4j.com/artifact.php?name=neo4j-community-${finalAttrs.version}-unix.tar.gz";
-    hash = "sha256-BsPXtsuVMuPsLAPyTQduOsrFq/5tc5T4VZENLBL3xUI=";
+    hash = "sha256-/ZN2GGA0qE7so4SXGy6ePoD45BFmUphD9JxI45CkhpQ=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/by-name/ne/netgen-vlsi/package.nix

@@ -5,17 +5,18 @@
   tcl,
   tk,
   m4,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "netgen";
-  version = "1.5.315";
+  version = "1.5.316";
 
   src = fetchFromGitHub {
     owner = "RTimothyEdwards";
     repo = "netgen";
     tag = finalAttrs.version;
-    hash = "sha256-dXCZm5zVwn23y7DLPSUrTKGMcu/FjdVKsyry59lEt7U=";
+    hash = "sha256-Cw/JZXzkvstfCD3oyWhZ3sWZcXtpGBkZhZIHjq2vQ6Q=";
   };
 
   strictDeps = true;
@@ -42,6 +43,8 @@ stdenv.mkDerivation (finalAttrs: {
     sed -i "1s|#!/bin/bash|#!${stdenv.shell}|" $out/bin/netgen
   '';
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "LVS tool for VLSI circuit netlists";
     mainProgram = "netgen";

pkgs/by-name/ne/networkmanager_dmenu/package.nix

@@ -14,13 +14,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "networkmanager_dmenu";
-  version = "2.6.2";
+  version = "2.6.3";
 
   src = fetchFromGitHub {
     owner = "firecat53";
     repo = "networkmanager-dmenu";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-NTkGKUZ3xA9ZWBLZgjIR5wrUXVhccGkGqnnm0a79p+Q=";
+    sha256 = "sha256-L5aO7mha37q2vjy9+j+TPiFBkqc4+deiZU9Om31HHBs=";
   };
 
   nativeBuildInputs = [ gobject-introspection ];

pkgs/by-name/ox/oxlint/package.nix

@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "oxlint";
-  version = "1.42.0";
+  version = "1.43.0";
 
   src = fetchFromGitHub {
     owner = "oxc-project";
     repo = "oxc";
     tag = "oxlint_v${finalAttrs.version}";
-    hash = "sha256-EAM1DxA/TqnIRN5Tlvg5/jvbyOUtSuwQ4RCBeO9esCw=";
+    hash = "sha256-J32iHYWfUSPgs0TbB9kHxwgdPB7/cPvKTI28K5nUlVU=";
   };
 
-  cargoHash = "sha256-okwkhcT6mekIvo52T8eSrXUcp/LQhcEYvHyIc5CLdrE=";
+  cargoHash = "sha256-2W0X9uy1V6cKJTjIIWNfd5vhptITrmh6uJYeCleXG8E=";
 
   nativeBuildInputs = [
     cmake

pkgs/by-name/pe/peazip/package.nix

@@ -24,13 +24,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "peazip";
-  version = "10.8.0";
+  version = "10.9.0";
 
   src = fetchFromGitHub {
     owner = "peazip";
     repo = "peazip";
     rev = finalAttrs.version;
-    hash = "sha256-A95rFW5kZ+gUbaLkAXRKu8jaBb43ONX+2wZXDWfT2G4=";
+    hash = "sha256-o1gIXq+8qpQcPYcC0py1aB4uWXqBYwU8MRgEFsFS948=";
   };
   sourceRoot = "${finalAttrs.src.name}/peazip-sources";
 

pkgs/by-name/pr/protonmail-desktop/package.nix

@@ -10,9 +10,9 @@
 }:
 let
   mainProgram = "proton-mail";
-  version = "1.11.0";
-  linuxHash = "sha256-kmE4EHp3+Uka83MVfAK1V+MrVUN6YAb6TrZFc64IXLo=";
-  darwinHash = "sha256-IPOHSSHxdSaLkYX0deH1RFpi17liq0tenfpNniAlNUc=";
+  version = "1.12.1";
+  linuxHash = "sha256-CNrL/O2PMXaUVgvXbmrLFZphz7yV4BlRlr388nbMsoE=";
+  darwinHash = "sha256-y8KgHm8pIbLQAb1/pIApNBbsaEi5ldInY4VXNBiTQlI=";
 in
 stdenv.mkDerivation {
   pname = "protonmail-desktop";

pkgs/by-name/re/redpanda-client/package.nix

@@ -7,12 +7,12 @@
   stdenv,
 }:
 let
-  version = "25.3.6";
+  version = "25.3.7";
   src = fetchFromGitHub {
     owner = "redpanda-data";
     repo = "redpanda";
     rev = "v${version}";
-    sha256 = "sha256-4SVd01dbgpjhdhZhQUIGta7OBjSzQNmo5teLQ+w804s=";
+    sha256 = "sha256-AHAxkIXDbND/IjVHqQAAM/ZzzypV0RF+JAtFLq81Cmg=";
   };
 in
 buildGoModule rec {

pkgs/by-name/re/redu/package.nix

@@ -3,6 +3,7 @@
   fetchFromGitHub,
   nix-update-script,
   rustPlatform,
+  restic,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -18,6 +19,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoHash = "sha256-JnjXe2CHO9Namp++UI/V6ND2Y0/WQtaVA2EcUyXUnjQ=";
 
+  buildInputs = [ restic ];
+
   passthru.updateScript = nix-update-script { };
 
   meta = {

pkgs/by-name/re/remind/package.nix

@@ -16,14 +16,14 @@
 
 tcl.mkTclDerivation rec {
   pname = "remind";
-  version = "06.02.02";
+  version = "06.02.03";
 
   src = fetchFromGitea {
     domain = "git.skoll.ca";
     owner = "Skollsoft-Public";
     repo = "Remind";
     rev = version;
-    hash = "sha256-SkQT651LjHCZJRtb4Itbzqhq9x5p05jYUam1XiYT4os=";
+    hash = "sha256-RAbu3XlFf11e6mrEAhXyXCzRsR7AiNJ6Ec5KU1i6t8I=";
   };
 
   propagatedBuildInputs = lib.optionals withGui [

pkgs/by-name/rp/rpcemu/package.nix

@@ -12,6 +12,8 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "rpcemu";
   version = "0.9.5";
 
+  env.NIX_CFLAGS_COMPILE = "-std=gnu17";
+
   src = fetchhg {
     url = "http://www.home.marutan.net/hg/rpcemu";
     rev = "release_${finalAttrs.version}";

pkgs/by-name/rs/rspamd/package.nix

@@ -39,13 +39,13 @@ assert (!withHyperscan) || (!withVectorscan);
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rspamd";
-  version = "3.14.2";
+  version = "3.14.3";
 
   src = fetchFromGitHub {
     owner = "rspamd";
     repo = "rspamd";
-    rev = finalAttrs.version;
-    hash = "sha256-XpCdjS6c9nLi1ngeSPBldmK3HmMFfDNW+tNpxdrUoKg=";
+    tag = finalAttrs.version;
+    hash = "sha256-ntWBcwcPZwRRSTUO4a0JUNd6kc49fm+0/x+fqcZIA/o=";
   };
 
   patches = [

pkgs/by-name/sh/shopify-cli/package.nix

@@ -7,82 +7,93 @@
   pnpm,
   faketty,
   nodejs,
+  nodejs_22,
   versionCheckHook,
   makeBinaryWrapper,
   nix-update-script,
 }:
-stdenv.mkDerivation (finalAttrs: {
-  pname = "shopify";
-  version = "3.86.1";
+stdenv.mkDerivation (
+  finalAttrs:
+  let
+    pnpmForBuild = pnpm.override { nodejs = nodejs_22; };
+  in
+  {
+    pname = "shopify";
+    version = "3.86.1";
 
-  src = fetchFromGitHub {
-    owner = "shopify";
-    repo = "cli";
-    tag = finalAttrs.version;
-    hash = "sha256-wEddzW5/+qdtNTxdUs7YEA5vk6/KjrVOgWvIeo0o2ww=";
-  };
+    src = fetchFromGitHub {
+      owner = "shopify";
+      repo = "cli";
+      tag = finalAttrs.version;
+      hash = "sha256-wEddzW5/+qdtNTxdUs7YEA5vk6/KjrVOgWvIeo0o2ww=";
+    };
 
-  pnpmDeps = fetchPnpmDeps {
-    inherit (finalAttrs) pname version src;
-    fetcherVersion = 2;
-    hash = "sha256-JhyZpkrp78FECH6UKYYuhWF2w/mYW1BQG5FIsWh5GRE=";
-  };
+    pnpmDeps = fetchPnpmDeps {
+      inherit (finalAttrs) pname version src;
+      fetcherVersion = 2;
+      hash = "sha256-JhyZpkrp78FECH6UKYYuhWF2w/mYW1BQG5FIsWh5GRE=";
+    };
 
-  nativeBuildInputs = [
-    faketty
-    nodejs
-    pnpmConfigHook
-    pnpm
-    makeBinaryWrapper
-  ];
-
-  # workaround for https://github.com/nrwl/nx/issues/22445
-  buildPhase = ''
-    runHook preBuild
-
-    faketty pnpm run bundle-for-release --disableRemoteCache=true --nxBail=true --outputStyle=static
-
-    runHook postBuild
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/lib/node_modules/@shopify/cli/{dist,bin}
-    mkdir -p $out/bin
-    pushd packages/cli
-    rm -rf dist/*.map
-    mv dist/* $out/lib/node_modules/@shopify/cli/dist
-    mv bin/run.js $out/lib/node_modules/@shopify/cli/bin/run.js
-    mv package.json oclif.manifest.json $out/lib/node_modules/@shopify/cli
-    popd
-    # Install runtime dependencies
-    rm -rf node_modules
-    pnpm config set nodeLinker hoisted
-    pnpm install --offline --prod --force --ignore-scripts --frozen-lockfile
-    mv node_modules $out/lib/node_modules/@shopify/cli/node_modules
-
-    makeWrapper ${lib.getExe nodejs} $out/bin/shopify \
-      --add-flags "$out/lib/node_modules/@shopify/cli/bin/run.js"
-
-    runHook postInstall
-  '';
-
-  nativeInstallCheckInputs = [ versionCheckHook ];
-  doInstallCheck = true;
-
-  passthru.updateScript = nix-update-script { };
-
-  meta = {
-    platforms = lib.platforms.unix;
-    mainProgram = "shopify";
-    description = "CLI which helps you build against the Shopify platform faster";
-    homepage = "https://github.com/Shopify/cli";
-    changelog = "https://github.com/Shopify/cli/releases/tag/${finalAttrs.version}";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [
-      fd
-      onny
+    nativeBuildInputs = [
+      faketty
+      nodejs
+      pnpmConfigHook
+      pnpmForBuild
+      makeBinaryWrapper
     ];
-  };
-})
+
+    # workaround for https://github.com/nrwl/nx/issues/22445
+    buildPhase = ''
+      runHook preBuild
+
+      faketty pnpm run bundle-for-release --disableRemoteCache=true --nxBail=true --outputStyle=static
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+        runHook preInstall
+
+        mkdir -p $out/lib/node_modules/@shopify/cli/{dist,bin}
+        mkdir -p $out/bin
+        pushd packages/cli
+        rm -rf dist/*.map
+        mv dist/* $out/lib/node_modules/@shopify/cli/dist
+        mv bin/run.js $out/lib/node_modules/@shopify/cli/bin/run.js
+        mv package.json oclif.manifest.json $out/lib/node_modules/@shopify/cli
+        popd
+        # Install runtime dependencies
+        rm -rf node_modules
+      pnpm config set nodeLinker hoisted
+      # Avoid pnpm trying to replace directories with files (ENOTDIR) by
+      # preferring non-symlinked executables and removing --force which can
+      # exacerbate move/rename races during install.
+      pnpm config set preferSymlinkedExecutables false
+      pnpm install --offline --prod --ignore-scripts --frozen-lockfile
+        mv node_modules $out/lib/node_modules/@shopify/cli/node_modules
+
+        makeWrapper ${lib.getExe nodejs} $out/bin/shopify \
+          --add-flags "$out/lib/node_modules/@shopify/cli/bin/run.js"
+
+        runHook postInstall
+    '';
+
+    nativeInstallCheckInputs = [ versionCheckHook ];
+    doInstallCheck = true;
+
+    passthru.updateScript = nix-update-script { };
+
+    meta = {
+      platforms = lib.platforms.unix;
+      mainProgram = "shopify";
+      description = "CLI which helps you build against the Shopify platform faster";
+      homepage = "https://github.com/Shopify/cli";
+      changelog = "https://github.com/Shopify/cli/releases/tag/${finalAttrs.version}";
+      license = lib.licenses.mit;
+      maintainers = with lib.maintainers; [
+        fd
+        onny
+      ];
+    };
+  }
+)

pkgs/by-name/sl/slint-lsp/package.nix

@@ -18,14 +18,14 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "slint-lsp";
-  version = "1.14.1";
+  version = "1.15.0";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-gVRoca4u1TVArDF226JWzLQJhUAIWA2JDyQ3Wo87AkA=";
+    hash = "sha256-+DGQB3HByzvRq7l/FmwfqyYzCWOjJ2pC/+M9GkybVLw=";
   };
 
-  cargoHash = "sha256-f3RLJnxoEUm7gsfqj86wXgfOj9woGmisONv0RZAQCGc=";
+  cargoHash = "sha256-P2h2lkN7t2OD/CcUgoGeadL+LyaDg1ObSnb7fTtg0Hc=";
 
   rpathLibs = [
     fontconfig

pkgs/by-name/sq/sq/package.nix

@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "sq";
-  version = "0.48.10";
+  version = "0.48.12";
 
   src = fetchFromGitHub {
     owner = "neilotoole";
     repo = "sq";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-5JlvG179rZHXsJWg+5uz//7QGdkwdNGULkK/DLCifus=";
+    hash = "sha256-TAQiTZx13rYlJlT41/RE03Ro4CRjECBdQz42YSI1j74=";
   };
 
-  vendorHash = "sha256-UP9+KtFuibwb9fnUcflnIpcf0Ow54D7db9F07PLhBN4=";
+  vendorHash = "sha256-jfUUVbvrdFX/++xRAgz7Tzqgu5AK2ZDmubWnWBIQeKE=";
 
   proxyVendor = true;
 

pkgs/by-name/sw/swayr/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "swayr";
-  version = "0.28.1";
+  version = "0.28.2";
 
   src = fetchFromSourcehut {
     owner = "~tsdh";
     repo = "swayr";
     rev = "swayr-${version}";
-    hash = "sha256-4oGxjtrMiseKU/D9mVnehQSmXl0Cusm+D8dg4KJ3mOQ=";
+    hash = "sha256-uT8MYgH9kANQ0t+7jqjOOvQIZf5ImdQruZLLlCejwcc=";
   };
 
-  cargoHash = "sha256-1rvS0NZDcX1OKDZkWq3AyM2i9heOReA+OOOFVvNuTjw=";
+  cargoHash = "sha256-Aj4U2xyfNhf3HDSEd1SQ5TyO2MXn2/hrfnG0ZayzMtU=";
 
   patches = [
     ./icon-paths.patch

pkgs/by-name/te/texstudio/package.nix

@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "texstudio";
-  version = "4.9.1";
+  version = "4.9.2";
 
   src = fetchFromGitHub {
     owner = "texstudio-org";
     repo = "texstudio";
     rev = finalAttrs.version;
-    hash = "sha256-lSAIlwdOVFd8pcT4rZ17Jn9195BOtZnUgFysDKM6t9U=";
+    hash = "sha256-u4+QUL3bOGo81+8adovqkpCKw3H6Mw6I2V3PfcKhb60=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/v4/v4l-utils/package.nix

@@ -30,7 +30,7 @@
 
 let
   withQt = withUtils && withGUI;
-
+  isCrossBuild = !(lib.systems.equals stdenv.buildPlatform stdenv.hostPlatform);
 in
 # we need to use stdenv.mkDerivation in order not to pollute the libv4l’s closure with Qt
 stdenv.mkDerivation (finalAttrs: {
@@ -112,7 +112,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   # Meson unable to find moc/uic/rcc in case of cross-compilation
   # https://github.com/mesonbuild/meson/issues/13018
-  preConfigure = lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
+  preConfigure = lib.optionalString (isCrossBuild && withQt) ''
     export PATH=${buildPackages.qt6Packages.qtbase}/libexec:$PATH
   '';
 

pkgs/by-name/ve/vector/package.nix

@@ -129,6 +129,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   ]
   ++ lib.optionals (stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isLinux) [
     # Flakey on aarch64-linux
+    "--skip=sources::exec::tests::test_run_command_linux"
     "--skip=topology::test::backpressure::buffer_drop_fan_out"
     "--skip=topology::test::backpressure::default_fan_out"
     "--skip=topology::test::backpressure::serial_backpressure"

pkgs/by-name/wo/woeusb-ng/package.nix

@@ -10,26 +10,19 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "woeusb-ng";
-  version = "0.2.12";
+  version = "0.2.12-unstable-2026-01-25";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "WoeUSB";
     repo = "WoeUSB-ng";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-2opSiXbbk0zDRt6WqMh97iAt6/KhwNDopOas+OZn6TU=";
+    # tag = "v${finalAttrs.version}";
+    rev = "cc52ffc6aedad12540c2315c9101e4a4b919d4be";
+    hash = "sha256-TfrXq8zYtlqcA/jbxQul7HIGdYrn73ljKVY2x4BfS2E=";
   };
 
   build-system = [ python3Packages.setuptools ];
 
-  postPatch = ''
-    substituteInPlace setup.py WoeUSB/utils.py \
-      --replace-fail "/usr/local/" "$out/" \
-      --replace-fail "/usr/" "$out/"
-    substituteInPlace miscellaneous/WoeUSB-ng.desktop \
-      --replace-fail "/usr/" "$out/" \
-  '';
-
   nativeBuildInputs = [
     wrapGAppsHook3
   ];

pkgs/by-name/wo/wofi/package.nix

@@ -12,7 +12,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "wofi";
-  version = "1.5.2";
+  version = "1.5.3";
 
   outputs = [
     "out"
@@ -22,8 +22,8 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromSourcehut {
     repo = "wofi";
     owner = "~scoopta";
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-j0KkmRfTRYpzfqHdIsOXk+pYHCrdzICD1Dm847C5ihs=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-rMvDWJx07Q19ieFlt0e3/zx2ZP0jJfURIwMiGFPmLis=";
     vc = "hg";
   };
 

pkgs/development/libraries/hspell/dicts.nix

@@ -1,58 +0,0 @@
-{
-  lib,
-  stdenv,
-  hspell,
-}:
-
-let
-  dict =
-    variant: a:
-    stdenv.mkDerivation (
-      {
-        inherit (hspell)
-          version
-          src
-          patches
-          postPatch
-          nativeBuildInputs
-          ;
-        buildFlags = [ variant ];
-
-        meta =
-          hspell.meta
-          // {
-            broken = true;
-            description = "${variant} Hebrew dictionary";
-          }
-          // (lib.optionalAttrs (a ? meta) a.meta);
-      }
-      // (removeAttrs a [ "meta" ])
-    );
-in
-{
-  recurseForDerivations = true;
-
-  aspell = dict "aspell" {
-    pname = "aspell-dict-he";
-
-    installPhase = ''
-      mkdir -p $out/lib/aspell
-      cp -v he_affix.dat he.wl $out/lib/aspell'';
-  };
-
-  myspell = dict "myspell" {
-    pname = "myspell-dict-he";
-
-    installPhase = ''
-      mkdir -p $out/lib/myspell
-      cp -v he.dic he.aff $out/lib/myspell'';
-  };
-
-  hunspell = dict "hunspell" {
-    pname = "hunspell-dict-he";
-
-    installPhase = ''
-      mkdir -p $out/lib
-      cp -rv hunspell $out/lib'';
-  };
-}

pkgs/development/python-modules/aiovban/default.nix

@@ -7,17 +7,16 @@
   music-assistant,
 }:
 
-buildPythonPackage {
+buildPythonPackage (finalAttrs: {
   pname = "aiovban";
-  version = "0.6.2";
+  version = "0.7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "wmbest2";
     repo = "aiovban";
-    # https://github.com/wmbest2/aiovban/issues/2
-    rev = "cdcf1ef3328493e600b4e8725a6071c0d180b36a";
-    hash = "sha256-w+pA3225mdPms/PpnJYKZYe6YHn0WMf83LupExgjJZ8=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-0mhpmpsV0zSOWbhrPF9bfR9xAtJe6X57guWDZWMH6f0=";
   };
 
   build-system = [ setuptools ];
@@ -29,9 +28,10 @@ buildPythonPackage {
   ];
 
   meta = {
+    changelog = "https://github.com/wmbest2/aiovban/releases/tag/${finalAttrs.src.tag}";
     description = "Asyncio VBAN Protocol Wrapper";
     homepage = "https://github.com/wmbest2/aiovban";
     license = lib.licenses.mit;
     inherit (music-assistant.meta) maintainers;
   };
-}
+})

pkgs/development/python-modules/camelot/default.nix

@@ -1,31 +1,39 @@
 {
-  buildPythonPackage,
-  chardet,
-  charset-normalizer,
-  click,
-  fetchPypi,
   lib,
+  pkgs,
+  fetchFromGitHub,
+  buildPythonPackage,
+
+  # build system
+  setuptools,
+
+  # dependencies
+  chardet,
+  click,
+  numpy,
   opencv-python-headless,
   openpyxl,
   pandas,
   pdfminer-six,
   pillow,
-  pkgs,
   pypdf,
   pypdfium2,
-  setuptools,
   tabulate,
-}:
 
-buildPythonPackage rec {
+  # tests
+  pytestCheckHook,
+  matplotlib,
+}:
+buildPythonPackage (finalAttrs: {
   pname = "camelot-py";
   version = "1.0.9";
   pyproject = true;
 
-  src = fetchPypi {
-    pname = "camelot_py";
-    inherit version;
-    hash = "sha256-1D2Idm98NGKAP/EUZOfT0VqSI+hFly3ith73w/YtMgA=";
+  src = fetchFromGitHub {
+    owner = "camelot-dev";
+    repo = "camelot";
+    tag = "v${finalAttrs.version}";
+    sha256 = "sha256-msf49Vt0IlwUNTvLIqTWKlMfcFB0LnvGGf7vReqhJec=";
   };
 
   patches = [ ./ghostscript.patch ];
@@ -40,9 +48,8 @@ buildPythonPackage rec {
   build-system = [ setuptools ];
 
   dependencies = [
-    chardet
-    charset-normalizer
     click
+    numpy
     opencv-python-headless
     openpyxl
     pandas
@@ -51,9 +58,27 @@ buildPythonPackage rec {
     pypdf
     pypdfium2
     tabulate
+    # Dependency not present in project's pyproject.toml, but doesn't build without it
+    chardet
   ];
 
-  doCheck = false;
+  nativeCheckInputs = [
+    pytestCheckHook
+    matplotlib
+  ];
+  disabledTests = [
+    # Assertion Error: <Cell cords> != <Cell other_cords>
+    "test_repr_ghostscript"
+    # cv2.error: color.cpp failure
+    "test_repr_ghostscript_custom_backend"
+    # urllib.error.URLError: temporary failure in name
+    "test_url_pdfium"
+    "test_url_ghostscript"
+    "test_url_ghost_script_custom_backend"
+    "test_pages_pdfium"
+    "test_pages_ghostscript"
+    "test_pages_ghostscript_custom_backend"
+  ];
 
   pythonImportsCheck = [ "camelot" ];
 
@@ -61,8 +86,8 @@ buildPythonPackage rec {
     description = "Python library to extract tabular data from PDFs";
     mainProgram = "camelot";
     homepage = "http://camelot-py.readthedocs.io";
-    changelog = "https://github.com/camelot-dev/camelot/blob/v${version}/HISTORY.md";
+    changelog = "https://github.com/camelot-dev/camelot/blob/${finalAttrs.src.tag}/HISTORY.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ _2gn ];
   };
-}
+})

pkgs/development/python-modules/disposable-email-domains/default.nix

@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "disposable-email-domains";
-  version = "0.0.157";
+  version = "0.0.160";
   pyproject = true;
 
   # No tags on GitHub
   src = fetchPypi {
     pname = "disposable_email_domains";
     inherit (finalAttrs) version;
-    hash = "sha256-TxB+NK9z21vqoyBRdTEHOZaxpg4w6LEtO6rJOkwwyiA=";
+    hash = "sha256-lSRgL6pg6qIdhMQ/xEhsAw4hBx0U69+dx13tclevgEI=";
   };
 
   build-system = [

pkgs/development/python-modules/fava-dashboards/default.nix

@@ -11,14 +11,14 @@
 }:
 buildPythonPackage rec {
   pname = "fava-dashboards";
-  version = "1.2.0";
+  version = "2.0.0b4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "andreasgerstmayr";
     repo = "fava-dashboards";
-    rev = "v${version}";
-    hash = "sha256-0524Mx93bJ4DKTb3gYps+C7dzhzuNd7YIvqeCtZz2f0=";
+    tag = "v${version}";
+    hash = "sha256-A00zKQ1vOMCrq/7onyKjf3+rj55dEXd0JvZBY2Ee568=";
   };
 
   build-system = [

pkgs/development/python-modules/globus-sdk/default.nix

@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "globus-sdk";
-  version = "3.63.0";
+  version = "4.3.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "globus";
     repo = "globus-sdk-python";
     tag = version;
-    hash = "sha256-ucVDjOV1NmHguwXSWbomNz9gjrxpeGmoZqF/Je6BL/4=";
+    hash = "sha256-q3fYU8/r6IfoC55iN83jAGdFrhnXx7bTtvuf0R4RBv4=";
   };
 
   build-system = [ setuptools ];
@@ -35,6 +35,8 @@ buildPythonPackage rec {
     pyjwt
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [ pytestCheckHook ];
 
   checkInputs = [

pkgs/development/python-modules/google-genai/default.nix

@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "google-genai";
-  version = "1.61.0";
+  version = "1.62.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "googleapis";
     repo = "python-genai";
     tag = "v${version}";
-    hash = "sha256-21E3Aksi3W74ZLg79rSJJ00FCwAjTUiNQ9uq0TSJ7+s=";
+    hash = "sha256-LxTWMJbkwndbmp3hNL4n4OxSI7GjMkoFc/17LbjaIyo=";
   };
 
   build-system = [

pkgs/development/python-modules/json-schema-to-pydantic/default.nix

@@ -0,0 +1,41 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  hatchling,
+  hatch-vcs,
+  pydantic,
+  pytestCheckHook,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "json-schema-to-pydantic";
+  version = "0.4.9";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "richard-gyiko";
+    repo = "json-schema-to-pydantic";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-j3E3jkb9l5s4JnGeBACG4/GznB1F+S2Fh0ncZEvvXuM=";
+  };
+
+  build-system = [
+    hatchling
+    hatch-vcs
+  ];
+
+  dependencies = [ pydantic ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "json_schema_to_pydantic" ];
+
+  meta = {
+    description = "Generates Pydantic v2 models from JSON Schema definitions";
+    homepage = "https://github.com/richard-gyiko/json-schema-to-pydantic";
+    changelog = "https://github.com/richard-gyiko/json-schema-to-pydantic/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ aos ];
+  };
+})

pkgs/development/python-modules/langgraph-checkpoint-postgres/default.nix

@@ -26,14 +26,14 @@
 
 buildPythonPackage rec {
   pname = "langgraph-checkpoint-postgres";
-  version = "3.0.2";
+  version = "3.0.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langgraph";
     tag = "checkpointpostgres==${version}";
-    hash = "sha256-V+S53ZYTCsaV7WMwuEMf+/NFyvy+8M6haO5oMf7o6wk=";
+    hash = "sha256-fuRfQRepdNAp+gnBbvLTREE8dwdtplKvIUQmDDk1QMY=";
   };
 
   postgresqlTestSetupPost = ''

pkgs/development/python-modules/plopp/default.nix

@@ -36,14 +36,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "plopp";
-  version = "25.11.0";
+  version = "26.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "scipp";
     repo = "plopp";
     tag = finalAttrs.version;
-    hash = "sha256-3vmHRPjv7iUd6ky7XzfdChpAI++ELh6vwmtELK7dwaE=";
+    hash = "sha256-JYgha+gmp9Ht6Ly9+i6dT+jdiDgsAEH5qH5MJ4n9LR8=";
   };
 
   build-system = [
@@ -77,6 +77,7 @@ buildPythonPackage (finalAttrs: {
   disabledTests = lib.optionals (pythonAtLeast "3.14") [
     # RuntimeError: There is no current event loop in thread 'MainThread'
     "test_move_cut"
+    "test_value_cuts"
   ];
 
   env = {

pkgs/development/python-modules/scipp/default.nix

@@ -103,11 +103,5 @@ buildPythonPackage rec {
     homepage = "https://scipp.github.io";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ doronbehar ];
-    # Got:
-    #
-    #   error: a template argument list is expected after a name prefixed by the template keyword [-Wmissing-template-arg-list-after-template-kw]
-    #
-    # Needs debugging along with upstream.
-    broken = stdenv.hostPlatform.isDarwin;
   };
 }

pkgs/development/python-modules/verilogae/default.nix

@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  pythonAtLeast,
   nix-update-script,
   setuptools-rust,
   rustPlatform,
@@ -26,6 +27,9 @@ buildPythonPackage.override { stdenv = llvmPackages.stdenv; } rec {
     hash = "sha256-TDE2Ewokhm2KSKe+sunUbV8KD3kaTSd5dB3CLCWGJ9U=";
   };
 
+  # segfault in pythonImportsCheckPhase
+  disabled = pythonAtLeast "3.14";
+
   postPatch = ''
     substituteInPlace openvaf/osdi/build.rs \
       --replace-fail "-fPIC" ""
@@ -66,6 +70,7 @@ buildPythonPackage.override { stdenv = llvmPackages.stdenv; } rec {
   meta = {
     description = "Verilog-A tool useful for compact model parameter extraction";
     homepage = "https://man.sr.ht/~dspom/openvaf_doc/verilogae/";
+    downloadPage = "https://github.com/OpenVAF/OpenVAF-Reloaded";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [
       jasonodoom

pkgs/development/rocm-modules/migraphx/default.nix

@@ -121,7 +121,7 @@ stdenv.mkDerivation (finalAttrs: {
     "-DMIGRAPHX_ENABLE_GPU=ON"
     "-DMIGRAPHX_ENABLE_CPU=ON"
     "-DMIGRAPHX_ENABLE_FPGA=ON"
-    "-DMIGRAPHX_ENABLE_MLIR=OFF" # LLVM or rocMLIR mismatch?
+    "-DMIGRAPHX_ENABLE_MLIR=ON"
     "-DCMAKE_C_COMPILER=amdclang"
     "-DCMAKE_CXX_COMPILER=amdclang++"
     "-DCMAKE_VERBOSE_MAKEFILE=ON"

pkgs/development/tools/analysis/rizin/default.nix

@@ -30,11 +30,11 @@
 let
   rizin = stdenv.mkDerivation rec {
     pname = "rizin";
-    version = "0.8.1";
+    version = "0.8.2";
 
     src = fetchurl {
       url = "https://github.com/rizinorg/rizin/releases/download/v${version}/rizin-src-v${version}.tar.xz";
-      hash = "sha256-7yseZSXX3DasQ1JblWdJwcyge/F8H+2LZkAtggEKTsI=";
+      hash = "sha256-FjDKUrroby/zfrIgaZ/IL5UbWxgIDt+j9Q3TalJsLZU=";
     };
 
     mesonFlags = [

pkgs/servers/home-assistant/custom-lovelace-modules/vacuum-card/package.nix

@@ -6,16 +6,16 @@
 
 buildNpmPackage rec {
   pname = "vacuum-card";
-  version = "2.11.7";
+  version = "2.12.0";
 
   src = fetchFromGitHub {
     owner = "denysdovhan";
     repo = "vacuum-card";
     rev = "v${version}";
-    hash = "sha256-qlAgkEMEwTq9vc6DoOwf5AhdlS2ezyXxjZQEhkhdrBs=";
+    hash = "sha256-AkwtKh24a2zOkP3MyqxSPbzYWujwj6nIcMyUWMgcdeM=";
   };
 
-  npmDepsHash = "sha256-+vNnManvjv8suqgbsj/XnoDLLGyUGjBLsUUDrDKPXqY=";
+  npmDepsHash = "sha256-/kUed3z6eqiLy9klErmEx3yvOO1jlmlKu2F8aPbFOek=";
 
   installPhase = ''
     runHook preInstall

pkgs/servers/sql/mariadb/default.nix

@@ -378,22 +378,22 @@ self: {
   # see https://mariadb.org/about/#maintenance-policy for EOLs
   mariadb_106 = self.callPackage generic {
     # Supported until 2026-07-06
-    version = "10.6.23";
-    hash = "sha256-uvS/N6BR6JLnFyTudSiRrbfPxpzSjQhzXDYH0wxpPCM=";
+    version = "10.6.24";
+    hash = "sha256-SeK63GdFcMhg48t6LAFhJKpmKMlfMBMwMEEeXImqFy8=";
   };
   mariadb_1011 = self.callPackage generic {
     # Supported until 2028-02-16
-    version = "10.11.14";
-    hash = "sha256-ilccsU+x1ONmPY6Y89QgDAQvyLKkqqq0lYYN6ot9BS8=";
+    version = "10.11.15";
+    hash = "sha256-UxHoV2VAK95agamnsmQ6c3jSAxaigiv61LbdzxBHWaU=";
   };
   mariadb_114 = self.callPackage generic {
     # Supported until 2029-05-29
-    version = "11.4.8";
-    hash = "sha256-UvpNyixfgK/BZn1SOifAYXbZhTIpimsMMe1zUF9J4Vw=";
+    version = "11.4.9";
+    hash = "sha256-jkgcoptadARE1FRRyOotk3Ec9SXW+l0nvJUSz4lzsHU=";
   };
   mariadb_118 = self.callPackage generic {
     # Supported until 2028-06-04
-    version = "11.8.3";
-    hash = "sha256-EBSoXHaN6PnpxtS/C0JhfzsViL4a03H3FnTqMrhxGcA=";
+    version = "11.8.5";
+    hash = "sha256-vLc5RWnAiHfCg+FkmGlQRTG+6MqvowKI8HjjDZn8ufY=";
   };
 }

pkgs/top-level/aliases.nix

@@ -857,6 +857,7 @@ mapAliases {
   hostPlatform = warnAlias "'hostPlatform' has been renamed to/replaced by 'stdenv.hostPlatform'" stdenv.hostPlatform; # Converted to warning 2025-10-28
   hpmyroom = throw "hpmyroom has been removed because it has been marked as broken since May 2024."; # Added 2025-10-11
   hpp-fcl = throw "'hpp-fcl' has been renamed to/replaced by 'coal'"; # Converted to throw 2025-10-27
+  hspellDicts = throw "'hspellDicts' has been removed due to being broken for more than a year; see RFC 180"; # Added 2026-02-05
   http-prompt = throw "'http-prompt' has been removed as it was broken and unmaintained upstream"; # Added 2025-11-26
   hydra_unstable = throw "'hydra_unstable' has been renamed to/replaced by 'hydra'"; # Converted to throw 2025-10-27
   i3-gaps = throw "'i3-gaps' has been renamed to/replaced by 'i3'"; # Converted to throw 2025-10-27

pkgs/top-level/all-packages.nix

@@ -6714,8 +6714,6 @@ with pkgs;
 
   highfive-mpi = highfive.override { hdf5 = hdf5-mpi; };
 
-  hspellDicts = callPackage ../development/libraries/hspell/dicts.nix { };
-
   hunspellDicts = recurseIntoAttrs (callPackages ../by-name/hu/hunspell/dictionaries.nix { });
 
   hunspellDictsChromium = recurseIntoAttrs (

pkgs/top-level/python-packages.nix

@@ -7818,6 +7818,8 @@ self: super: with self; {
 
   json-schema-for-humans = callPackage ../development/python-modules/json-schema-for-humans { };
 
+  json-schema-to-pydantic = callPackage ../development/python-modules/json-schema-to-pydantic { };
+
   json-stream = callPackage ../development/python-modules/json-stream { };
 
   json-stream-rs-tokenizer = callPackage ../development/python-modules/json-stream-rs-tokenizer { };