Merge staging-next into staging

doc/release-notes/rl-2511.section.md

@@ -239,7 +239,7 @@
 
 - The systemd initrd will now respect `x-systemd.wants` and `x-systemd.requires` for reliably unlocking multi-disk bcachefs volumes.
 
-- [`homebox` 0.20.0](https://github.com/sysadminsmedia/homebox/releases/tag/v0.20.0) changed how assets are stored and hashed. It is recommended to back up your database before this update.
+- [`homebox` 0.20.0](https://github.com/sysadminsmedia/homebox/releases/tag/v0.20.0) changed how assets are stored and hashed. It is recommended to back up your database before this update. In particular, `--storage-data` was replaced with `--storage-conn-string` and `--storage-prefix-path`. If your configuration set `HBOX_STORAGE_DATA` manually, you must migrate it to `HBOX_STORAGE_CONN_STRING` and `HBOX_STORAGE_PREFIX_PATH`.
 
 - GIMP now defaults to version 3. Use `gimp2` for the old version.
 

maintainers/maintainer-list.nix

@@ -24981,6 +24981,17 @@
     githubId = 4572854;
     name = "Shawn Warren";
   };
+  swarsel = {
+    name = "Leon Schwarzäugl";
+    email = "leon@swarsel.win";
+    github = "Swarsel";
+    githubId = 32304731;
+    keys = [
+      {
+        fingerprint = "4BE7 9252 6228 9B47 6DBB  C17B 76FD 3810 215A E097";
+      }
+    ];
+  };
   swdunlop = {
     email = "swdunlop@gmail.com";
     github = "swdunlop";

nixos/modules/services/networking/sing-box.nix

@@ -75,6 +75,7 @@ in
         StateDirectoryMode = "0700";
         RuntimeDirectory = "sing-box";
         RuntimeDirectoryMode = "0700";
+        WorkingDirectory = "/var/lib/sing-box";
         ExecStartPre =
           let
             script = pkgs.writeShellScript "sing-box-pre-start" ''
@@ -95,6 +96,7 @@ in
       users.sing-box = {
         isSystemUser = true;
         group = "sing-box";
+        home = "/var/lib/sing-box";
       };
       groups.sing-box = { };
     };

nixos/modules/services/web-apps/homebox.nix

@@ -10,19 +10,34 @@ let
     mkEnableOption
     mkPackageOption
     mkDefault
+    mkOption
     types
     mkIf
     ;
+
+  defaultUser = "homebox";
+  defaultGroup = "homebox";
 in
 {
   options.services.homebox = {
     enable = mkEnableOption "homebox";
     package = mkPackageOption pkgs "homebox" { };
-    settings = lib.mkOption {
-      type = types.attrsOf types.str;
+    user = mkOption {
+      type = types.str;
+      default = defaultUser;
+      description = "User account under which Homebox runs.";
+    };
+    group = mkOption {
+      type = types.str;
+      default = defaultGroup;
+      description = "Group under which Homebox runs.";
+    };
+    settings = mkOption {
+      type = types.submodule { freeformType = types.attrsOf (types.nullOr types.str); };
       defaultText = lib.literalExpression ''
         {
-          HBOX_STORAGE_DATA = "/var/lib/homebox/data";
+          HBOX_STORAGE_CONN_STRING = "file:///var/lib/homebox";
+          HBOX_STORAGE_PREFIX_PATH = "data";
           HBOX_DATABASE_DRIVER = "sqlite3";
           HBOX_DATABASE_SQLITE_PATH = "/var/lib/homebox/data/homebox.db?_pragma=busy_timeout=999&_pragma=journal_mode=WAL&_fk=1";
           HBOX_OPTIONS_ALLOW_REGISTRATION = "false";
@@ -31,12 +46,12 @@ in
         }
       '';
       description = ''
-        The homebox configuration as Environment variables. For definitions and available options see the upstream
+        The homebox configuration as environment variables. For definitions and available options see the upstream
         [documentation](https://homebox.software/en/configure/#configure-homebox).
       '';
     };
     database = {
-      createLocally = lib.mkOption {
+      createLocally = mkOption {
         type = lib.types.bool;
         default = false;
         description = ''
@@ -47,14 +62,31 @@ in
   };
 
   config = mkIf cfg.enable {
-    users.users.homebox = {
-      isSystemUser = true;
-      group = "homebox";
+    assertions = [
+      {
+        assertion = !(cfg.settings ? HBOX_STORAGE_DATA);
+        message = ''
+          `services.homebox.settings.HBOX_STORAGE_DATA` has been deprecated.
+          Please use `services.homebox.settings.HBOX_STORAGE_CONN_STRING` and `services.homebox.settings.HBOX_STORAGE_PREFIX_PATH` instead.
+        '';
+      }
+    ];
+
+    users = {
+      users = mkIf (cfg.user == defaultUser) {
+        ${defaultUser} = {
+          description = "homebox service user";
+          inherit (cfg) group;
+          isSystemUser = true;
+        };
+      };
+      groups = mkIf (cfg.group == defaultGroup) { ${defaultGroup} = { }; };
     };
-    users.groups.homebox = { };
+
     services.homebox.settings = lib.mkMerge [
       (lib.mapAttrs (_: mkDefault) {
-        HBOX_STORAGE_DATA = "/var/lib/homebox/data";
+        HBOX_STORAGE_CONN_STRING = "file:///var/lib/homebox";
+        HBOX_STORAGE_PREFIX_PATH = "data";
         HBOX_DATABASE_DRIVER = "sqlite3";
         HBOX_DATABASE_SQLITE_PATH = "/var/lib/homebox/data/homebox.db?_pragma=busy_timeout=999&_pragma=journal_mode=WAL&_fk=1";
         HBOX_OPTIONS_ALLOW_REGISTRATION = "false";
@@ -62,7 +94,7 @@ in
         HBOX_MODE = "production";
       })
 
-      (lib.mkIf cfg.database.createLocally {
+      (mkIf cfg.database.createLocally {
         HBOX_DATABASE_DRIVER = "postgres";
         HBOX_DATABASE_HOST = "/run/postgresql";
         HBOX_DATABASE_USERNAME = "homebox";
@@ -70,7 +102,8 @@ in
         HBOX_DATABASE_PORT = toString config.services.postgresql.settings.port;
       })
     ];
-    services.postgresql = lib.mkIf cfg.database.createLocally {
+
+    services.postgresql = mkIf cfg.database.createLocally {
       enable = true;
       ensureDatabases = [ "homebox" ];
       ensureUsers = [
@@ -83,18 +116,16 @@ in
     systemd.services.homebox = {
       requires = lib.optional cfg.database.createLocally "postgresql.target";
       after = lib.optional cfg.database.createLocally "postgresql.target";
-      environment = cfg.settings;
+      environment = lib.filterAttrs (_: v: v != null) cfg.settings;
       serviceConfig = {
-        User = "homebox";
-        Group = "homebox";
+        User = cfg.user;
+        Group = cfg.group;
         ExecStart = lib.getExe cfg.package;
-        StateDirectory = "homebox";
-        WorkingDirectory = "/var/lib/homebox";
         LimitNOFILE = "1048576";
         PrivateTmp = true;
         PrivateDevices = true;
-        StateDirectoryMode = "0700";
         Restart = "always";
+        StateDirectory = "homebox";
 
         # Hardening
         CapabilityBoundingSet = "";
@@ -131,5 +162,8 @@ in
       wantedBy = [ "multi-user.target" ];
     };
   };
-  meta.maintainers = with lib.maintainers; [ patrickdag ];
+  meta.maintainers = with lib.maintainers; [
+    patrickdag
+    swarsel
+  ];
 }

pkgs/applications/editors/vscode/extensions/amazonwebservices.amazon-q-vscode/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
   mktplcRef = {
     name = "amazon-q-vscode";
     publisher = "AmazonWebServices";
-    version = "1.96.0";
-    hash = "sha256-VnPCVcV3UFZZWOTk52Z4hfAgzzqk7G6cMGiScEHb0Y8=";
+    version = "1.98.0";
+    hash = "sha256-eSngVjKU74G7Gmqg3/wbYt8JZzBP5LtmegHIEXmaz70=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/default.nix

@@ -771,8 +771,8 @@ let
         mktplcRef = {
           name = "vscode-tailwindcss";
           publisher = "bradlc";
-          version = "0.14.26";
-          hash = "sha256-agntfMsLAYASviH7Wuw/W8JwfHRi6qAfuMkqmFWT0bg=";
+          version = "0.14.27";
+          hash = "sha256-3OcEKPdwRispdS1Jz3ldbJ15GAvsq975lLjOHMKVgPo=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/bradlc.vscode-tailwindcss/changelog";
@@ -1003,8 +1003,8 @@ let
         mktplcRef = {
           name = "coder-remote";
           publisher = "coder";
-          version = "1.11.0";
-          hash = "sha256-gyhvLFFGVUxOYr33SeWJIlVYQGEDUkuGyATylI+loUM=";
+          version = "1.11.2";
+          hash = "sha256-7peB8y2cNPCYXbdey4POzFcdra/j/RNzSF2gO3SLlGA=";
         };
         meta = {
           description = "Extension for Visual Studio Code to open any Coder workspace in VS Code with a single click";
@@ -1152,8 +1152,8 @@ let
         mktplcRef = {
           publisher = "DanielSanMedium";
           name = "dscodegpt";
-          version = "3.14.118";
-          hash = "sha256-jAFlmF7HE0pfYx5jqnUjObM+awdc62DvayV9FdEx70E=";
+          version = "3.14.124";
+          hash = "sha256-WAafRTdaAujaCR3EAHAE3dNoxhOeEkiJF2M3sZGb4o4=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/DanielSanMedium.dscodegpt/changelog";
@@ -1723,8 +1723,8 @@ let
         mktplcRef = {
           name = "foam-vscode";
           publisher = "foam";
-          version = "0.28.1";
-          hash = "sha256-VO3rJsKKZJWGBrNYnRXh5QedN13RR7qdcYmDn5WmOkg=";
+          version = "0.28.3";
+          hash = "sha256-rRJrzCle1/epqJL+gaUb3QZwrmdaLvagUwxRx1Aq1ZY=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/foam.foam-vscode/changelog";
@@ -1933,8 +1933,8 @@ let
         mktplcRef = {
           name = "vscode-github-actions";
           publisher = "github";
-          version = "0.27.2";
-          hash = "sha256-yWQQxYRdU5WWaIiGvCtLYH3mrwDv+frm2ml1S1KPThk=";
+          version = "0.28.0";
+          hash = "sha256-9DUS1wUeK4vBw/QIqOW8R7T7ho9hmTKuu7gRnM35Ahw=";
         };
         meta = {
           description = "Visual Studio Code extension for GitHub Actions workflows and runs for github.com hosted repositories";
@@ -1961,8 +1961,8 @@ let
         mktplcRef = {
           name = "gitlab-workflow";
           publisher = "gitlab";
-          version = "6.47.0";
-          hash = "sha256-UeQbz64ow/VJ2yDenXGYKAcaIwMM2RLkhHf2Ck4Vlek=";
+          version = "6.49.7";
+          hash = "sha256-jvVQFaHcXcZeg1xli5PCTo5RDouUBMFjMpJ3HC8GF4c=";
         };
         meta = {
           description = "GitLab extension for Visual Studio Code";
@@ -2537,8 +2537,8 @@ let
         mktplcRef = {
           publisher = "jnoortheen";
           name = "nix-ide";
-          version = "0.4.23";
-          hash = "sha256-MnuFMrP52CcWZTyf2OKSqQ/oqCS3PPivwEIja25N2D0=";
+          version = "0.4.24";
+          hash = "sha256-xtMXd8GVHygl9+9X+QamI5YXXSlvEWOoYKf3OWmIoHw=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/jnoortheen.nix-ide/changelog";
@@ -3439,8 +3439,8 @@ let
         mktplcRef = {
           name = "remote-wsl";
           publisher = "ms-vscode-remote";
-          version = "0.104.2";
-          hash = "sha256-kkMrsElu+QrIJXWpSHwKtJF+E5lpkVUVFO090DwXmM8=";
+          version = "0.104.3";
+          hash = "sha256-IlNBcrgJ2qkbJtNOonZGkuJHYL8Ho7EVb2HlbMimxK8=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/ms-vscode-remote.remote-wsl/changelog";
@@ -4520,8 +4520,8 @@ let
         mktplcRef = {
           name = "vscode-tailscale";
           publisher = "tailscale";
-          version = "1.0.0";
-          sha256 = "sha256-MKiCZ4Vu+0HS2Kl5+60cWnOtb3udyEriwc+qb/7qgUg=";
+          version = "1.1.0";
+          sha256 = "sha256-kDvA4Yw+iFoBwHKrmQCwrPZRRSDvDyxTFc1Z1vAJwc0=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/tailscale.vscode-tailscale/changelog";

pkgs/applications/editors/vscode/extensions/fstarlang.fstar-vscode-assistant/default.nix

@@ -4,8 +4,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "fstar-vscode-assistant";
     publisher = "FStarLang";
-    version = "0.20.0";
-    hash = "sha256-GVlXzKXZmkewRIAHPpiHQsHFfPlNI2GswBdhfFtzgrA=";
+    version = "0.21.0";
+    hash = "sha256-p1Gh7HKcEXGiObzFt0P/hGS0e5g8ekktmAqSWi6sJwA=";
   };
   meta = {
     description = "Interactive editing mode VS Code extension for F*";

pkgs/applications/editors/vscode/extensions/ms-pyright.pyright/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "ms-pyright";
     name = "pyright";
-    version = "1.1.405";
-    hash = "sha256-2UULr/D2ym5kBhbexl6U0r3dugZUuU+ks8FFfCi1A2k=";
+    version = "1.1.406";
+    hash = "sha256-Lz8x/op0RUluE7R6xssg2nVviT0O1tZXUopzKt0f99U=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/rust-lang.rust-analyzer/default.nix

@@ -73,9 +73,15 @@ vscode-utils.buildVscodeExtension {
   ];
 
   preInstall = lib.optionalString setDefaultServerPath ''
-    jq '(.contributes.configuration[] | select(.title == "server") | .properties."rust-analyzer.server.path".default) = $s' \
+    jq '(.contributes.configuration[] | select(.title == "Server") | .properties."rust-analyzer.server.path".default) = $s' \
       --arg s "${rust-analyzer}/bin/rust-analyzer" \
       package.json | sponge package.json
+
+    # Ensure that the previous modification worked, by searching for the binary path
+    grep -Fq ${rust-analyzer}/bin/rust-analyzer package.json || {
+      echo "Modifying 'rust-analyzer.server.path' in 'package.json' failed."
+      exit 1
+    }
   '';
 
   meta = {

pkgs/applications/editors/vscode/extensions/tboby.cwtools-vscode/default.nix

@@ -6,8 +6,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "cwtools-vscode";
     publisher = "tboby";
-    version = "0.10.30";
-    hash = "sha256-C/2K1o6AOWumOwVjyNQZhqHe2T6LGW32dDJtLXIZguc=";
+    version = "0.10.31";
+    hash = "sha256-vECWkXwMWW6ZYQ+6lVpD1KAje1DY6z0APBS/0wIDMd4=";
   };
   meta = {
     description = "Paradox Language Features for Visual Studio Code";

pkgs/applications/editors/vscode/extensions/yy0931.vscode-sqlite3-editor/default.nix

@@ -6,8 +6,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "vscode-sqlite3-editor";
     publisher = "yy0931";
-    version = "1.0.207";
-    hash = "sha256-HToO43MnqJlWcKx4O5C0b7RXyeKY5PzxMY5/3cNOtgE=";
+    version = "1.0.208";
+    hash = "sha256-4NOyMHp42RS7qsx0Zy86kqQzKgQkh3WprRoEI6GIXvg=";
   };
   meta = {
     changelog = "https://marketplace.visualstudio.com/items/yy0931.vscode-sqlite3-editor/changelog";

pkgs/applications/emulators/libretro/cores/pcsx2.nix

@@ -11,13 +11,13 @@
 }:
 mkLibretroCore {
   core = "pcsx2";
-  version = "0-unstable-2025-09-14";
+  version = "0-unstable-2025-09-29";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "ps2";
-    rev = "bb03c99fa968b50309bd80d74598f053fe9168ce";
-    hash = "sha256-qIdrsLQWH29PGL0TNcUtFw6aSFUJKJccKrhMoi/vYCA=";
+    rev = "9485a53fa5aa2bff17e04518116107f81a8c82e3";
+    hash = "sha256-xkRPESbLNX9AFOIdEA9iW4Xn7hdJXfdi+TEbegC8KXA=";
     fetchSubmodules = true;
   };
 
@@ -33,14 +33,20 @@ mkLibretroCore {
     xz
   ];
 
-  # libretro/ps2 needs at least those flags to compile, and probably doesn't
-  # work on x86_64-v1
-  # https://github.com/libretro/ps2/blob/397b8f54b92aeffd2dd502c2c9b601305fb1de9d/cmake/BuildParameters.cmake#L101
-  env.NIX_CFLAGS_COMPILE = toString [
-    "-msse"
-    "-msse2"
-    "-msse4.1"
-    "-mfxsr"
+  cmakeFlags = with lib.strings; [
+    # Workaround the following error:
+    # > CMake Error at 3rdparty/libzip/libzip/CMakeLists.txt:1 (cmake_minimum_required):
+    # > Compatibility with CMake < 3.5 has been removed from CMake.
+    #
+    # > Update the VERSION argument <min> value.  Or, use the <min>...<max> syntax
+    # > to tell CMake that the project requires at least <min> but has been updated
+    # > to work with policies introduced by <max> or earlier.
+    #
+    # > Or, add -DCMAKE_POLICY_VERSION_MINIMUM=3.5 to try configuring anyway.
+    (cmakeFeature "CMAKE_POLICY_VERSION_MINIMUM" "3.5")
+    # Explicitly set ARCH_FLAG to avoid -march=native
+    # https://github.com/libretro/ps2/blob/9485a53fa5aa2bff17e04518116107f81a8c82e3/cmake/BuildParameters.cmake#L106-L117
+    (cmakeFeature "ARCH_FLAG" "-msse4.1")
   ];
 
   makefile = "Makefile";

pkgs/applications/networking/browsers/av-98/default.nix

@@ -1,34 +0,0 @@
-{
-  lib,
-  python3Packages,
-  fetchgit,
-}:
-python3Packages.buildPythonApplication {
-  pname = "av-98";
-  version = "1.0.2dev";
-  format = "setuptools";
-
-  src = fetchgit {
-    url = "https://tildegit.org/solderpunk/AV-98.git";
-    rev = "96cf8e13fe5714c8cdc754f51eef9f0293b8ca1f";
-    sha256 = "09iskh33hl5aaif763j1fmbz7yvf0yqsxycfd41scj7vbwdsbxl0";
-  };
-
-  propagatedBuildInputs = with python3Packages; [
-    ansiwrap
-    cryptography
-  ];
-
-  # No tests are available
-  doCheck = false;
-  pythonImportsCheck = [ "av98" ];
-
-  meta = with lib; {
-    homepage = "https://tildegit.org/solderpunk/AV-98";
-    description = "Experimental console client for the Gemini protocol";
-    mainProgram = "av98";
-    license = licenses.bsd2;
-
-    broken = true;
-  };
-}

pkgs/applications/networking/browsers/chromium/info.json

@@ -808,7 +808,7 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "141.0.7390.54",
+    "version": "141.0.7390.65",
     "deps": {
       "depot_tools": {
         "rev": "3f41e54ae17d53d4a39feecad64c3d3e6871b219",
@@ -820,16 +820,16 @@
         "hash": "sha256-WERLGrReUATmn3RhxtmyZcJBxdIY/WZqBDranCLDYEg="
       },
       "ungoogled-patches": {
-        "rev": "141.0.7390.54-1",
-        "hash": "sha256-Lu74ipJFj194vDPHmIXQ9FyPvexTNdbKJ/SlLZpW4B8="
+        "rev": "141.0.7390.65-1",
+        "hash": "sha256-xjfr2nSoytbbAEQg9WkWQCp4TuPadrBx8JSxJzjPZMI="
       },
       "npmHash": "sha256-i1eQ4YlrWSgY522OlFtGDDPmxE2zd1hDM03AzR8RafE="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "b95610d5c4a562d9cd834bc0a098d3316e2f533f",
-        "hash": "sha256-jraDPodJBdyFFHS30BcQTZOEUD+h9SFHQrO0GoMhtk8=",
+        "rev": "b2ec783d2b51a396804a4e3e33f6586be09a4e2d",
+        "hash": "sha256-9jZ7411NThelyL0R5yoLXB0lOkydOI3v6K5ORhjqfF4=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -1059,8 +1059,8 @@
       },
       "src/third_party/devtools-frontend/src": {
         "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "65f160d43dc97a2e8eb5e1c2814179a519313884",
-        "hash": "sha256-VLMJ/WWCIzk92mmuBdx+P6Gi0ouiXuMGkiR0KVK5GWI="
+        "rev": "9c2c4cc7cf6c82ad460e1f3b49f34bb702d5fe11",
+        "hash": "sha256-qj1vR0FW2jiR2v18Nv8RqYgy/UEw2rgGUsQ68EhdHos="
       },
       "src/third_party/dom_distiller_js/dist": {
         "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -126,13 +126,13 @@
     "vendorHash": "sha256-j4tAFLBdQR35EvQNd12XwQ0kD5wSSVi9/f/N1YbI6IM="
   },
   "awscc": {
-    "hash": "sha256-wAQLtx+eVtKucdokQLfq1zTAOdMPI2Frio5ILxLGyt8=",
+    "hash": "sha256-qxCrBJo8oPy9+2e7Pq9Ex5jslJMEkfOzpTdhn/ouV0c=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/awscc",
     "owner": "hashicorp",
     "repo": "terraform-provider-awscc",
-    "rev": "v1.57.0",
+    "rev": "v1.58.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-xIROXf39bvPjtiKpfn7bfL7SXwHOqUxNqlhrCmDLYGA="
+    "vendorHash": "sha256-BNc2pwbIBPkLiUaGjBbUayysgIgS58AUA9nfr/KGMZo="
   },
   "azuread": {
     "hash": "sha256-9vGXzFLRaQPXECcFtZMnbhHQvEm0FeGwYm4K9utpZf4=",
@@ -534,11 +534,11 @@
     "vendorHash": "sha256-JS0moRxd+Vxzg4Wq5Med4/daVSZPver+JifAdgt2sQk="
   },
   "gridscale": {
-    "hash": "sha256-52EVQm2YsbEOY7R6W1Xd7FAFKTuzIhlyb0gek7iZwSc=",
+    "hash": "sha256-gkOAV1iKv7r2OouHAemlresb9sLcjZ5i8tLQazQrgyA=",
     "homepage": "https://registry.terraform.io/providers/gridscale/gridscale",
     "owner": "gridscale",
     "repo": "terraform-provider-gridscale",
-    "rev": "v2.2.1",
+    "rev": "v2.2.2",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -552,13 +552,13 @@
     "vendorHash": "sha256-UmlhKa2SVgrhRc1EOO9sEkherIS77CP+hkAL3Y79h3U="
   },
   "hcloud": {
-    "hash": "sha256-2IEi5YE7iXGmf1bKDZgswf5v5Hw9SdhSb1GxNzsm8qM=",
+    "hash": "sha256-Y7W4pMH9wuiTasobEWtQOZNyeZ6MJKuegveZnlORxm0=",
     "homepage": "https://registry.terraform.io/providers/hetznercloud/hcloud",
     "owner": "hetznercloud",
     "repo": "terraform-provider-hcloud",
-    "rev": "v1.53.1",
+    "rev": "v1.54.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-vwuWz881nn901lAubv2xNCCIoNtyaVQJ77PM8E1LHjg="
+    "vendorHash": "sha256-jwDezL9gI6A9pCdD1CUgEOJT8dqVuPX/sFjTO4Jiqs4="
   },
   "helm": {
     "hash": "sha256-i4ceWiEXJYL1x9DmqAfcUidiW5+x/sRCxevDz4MnzHs=",

pkgs/applications/window-managers/hyprwm/hyprland-plugins/hypr-dynamic-cursors.nix

@@ -7,13 +7,13 @@
 
 mkHyprlandPlugin {
   pluginName = "hypr-dynamic-cursors";
-  version = "0-unstable-2025-09-01";
+  version = "0-unstable-2025-10-04";
 
   src = fetchFromGitHub {
     owner = "VirtCode";
     repo = "hypr-dynamic-cursors";
-    rev = "0e11ed12dbd4d0c62b362dda2559c2e374814d56";
-    hash = "sha256-2JQ/KxMEVDjauaFU62T0udjKXKSiCyKO5frjVf4b4A8=";
+    rev = "acac1f9a5c896ba934af1fc2414670c752ae529d";
+    hash = "sha256-SoJqyXFKKg1jAUHSY7JqOLlxBpToejnIQ6QOOW5gNFM=";
   };
 
   dontUseCmakeConfigure = true;

pkgs/by-name/al/all-the-package-names/package.nix

@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "all-the-package-names";
-  version = "2.0.2219";
+  version = "2.0.2228";
 
   src = fetchFromGitHub {
     owner = "nice-registry";
     repo = "all-the-package-names";
     tag = "v${version}";
-    hash = "sha256-Bf7ea9UX8zNZJyeYjjmmbEM40a/PnQlZG0PppMLDwds=";
+    hash = "sha256-Qq5dHI6Z33MbGvOKSzONeYgb/u0kgH3PFPV9zhfjkyY=";
   };
 
-  npmDepsHash = "sha256-+PWL1tDKhsmX1+u55sJYecALwM5Z9cv6h8eAsfwcIyY=";
+  npmDepsHash = "sha256-NxyOqp3chgionveBfCVN5VnMF7cLZhmV15Ff5n91lQQ=";
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/ca/cargo-release/package.nix

@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-release";
-  version = "0.25.19";
+  version = "0.25.20";
 
   src = fetchFromGitHub {
     owner = "crate-ci";
     repo = "cargo-release";
     tag = "v${version}";
-    hash = "sha256-CroarDNmLSMQJy4Hy7TcK8LYcqQ+xVFj8iG8HLTKS60=";
+    hash = "sha256-z2QsQvB+j8yGJPHCoOwpYq8Z1P5paybpA9FfKSAnRgg=";
   };
 
-  cargoHash = "sha256-4Y1wTgS5C4VadOWb9Uv5Jrblfjz6Caqv+XQUETalIH0=";
+  cargoHash = "sha256-3PGvqxxdFIwv15Pa/FrQcp3kKLjC78LZcNNlEDbFKYs=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/ch/chessx/package.nix

@@ -3,18 +3,17 @@
   lib,
   pkg-config,
   zlib,
-  fetchpatch,
   fetchurl,
   libsForQt5,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "chessx";
-  version = "1.6.0";
+  version = "1.6.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/chessx/chessx-${finalAttrs.version}.tgz";
-    hash = "sha256-76YOe1WpB+vdEoEKGTHeaWJLpCVE4RoyYu1WLy3Dxhg=";
+    hash = "sha256-uwkdhJywLWMJl4/ihMnxqFwnTzUSL+kca5wwiabiD4A=";
   };
 
   nativeBuildInputs = [
@@ -35,30 +34,20 @@ stdenv.mkDerivation (finalAttrs: {
     qttools
   ]);
 
-  patches =
-    # needed to backport patches to successfully build, due to broken release
-    let
-      repo = "https://github.com/Isarhamster/chessx/";
-    in
-    [
-      (fetchpatch {
-        url = "${repo}/commit/9797d46aa28804282bd58ce139b22492ab6881e6.diff";
-        hash = "sha256-RnIf6bixvAvyp1CKuri5LhgYFqhDNiAVYWUmSUDMgVw=";
-      })
-      (fetchpatch {
-        url = "${repo}/commit/4fab4d2f649d1cae2b54464c4e28337d1f20c214.diff";
-        hash = "sha256-EJVHricN+6uabKLfn77t8c7JjO7tMmZGsj7ZyQUGcXA=";
-      })
-    ];
-
   enableParallelBuilding = true;
 
+  # Fails to start on Native Wayland.
+  # See https://sourceforge.net/p/chessx/bugs/299/
+  qtWrapperArgs = [
+    "--set"
+    "QT_QPA_PLATFORM"
+    "xcb"
+  ];
+
   installPhase = ''
     runHook preInstall
-
     install -Dm555 release/chessx -t "$out/bin"
     install -Dm444 unix/chessx.desktop -t "$out/share/applications"
-
     runHook postInstall
   '';
 

pkgs/by-name/ci/cirrus-cli/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "cirrus-cli";
-  version = "0.153.5";
+  version = "0.154.0";
 
   src = fetchFromGitHub {
     owner = "cirruslabs";
     repo = "cirrus-cli";
     rev = "v${version}";
-    hash = "sha256-VBicOIZD4J2kh5U8c86d1vyDoqsEyQzZ5mc0wmW16WY=";
+    hash = "sha256-jmjCqdoJj9ggxC6JaW7BObWCWKdfB0ZOSOfUA2BgUCc=";
   };
 
-  vendorHash = "sha256-3lqqCzMeesZi1TcEjlQXNCQLLFqybiz3OtrhxprG9Rk=";
+  vendorHash = "sha256-ag1HzNrSqGTJGXxhdspxHsJRBu7tuB5nDFiEWh1VOsU=";
 
   ldflags = [
     "-X github.com/cirruslabs/cirrus-cli/internal/version.Version=v${version}"

pkgs/by-name/cl/clboss/package.nix

@@ -13,12 +13,12 @@
 
 stdenv.mkDerivation rec {
   pname = "clboss";
-  version = "0.14.1";
+  version = "0.15.1";
 
   # The release tarball includes the pre-generated file `commit_hash.h` that is required for building
   src = fetchzip {
     url = "https://github.com/ZmnSCPxj/clboss/releases/download/v${version}/clboss-v${version}.tar.gz";
-    hash = "sha256-JMbNHEI0j78LJYsBZ/Z4qvEdRqgQtWG1HlGW3SBXUCg=";
+    hash = "sha256-9wrgJzXVBKGSNB2UbP+CnUmaRwdXgRAnHBZbvm/Am7Q=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/cl/clusterctl/package.nix

@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "clusterctl";
-  version = "1.11.1";
+  version = "1.11.2";
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
     repo = "cluster-api";
     rev = "v${version}";
-    hash = "sha256-rm88e5GmWpP9lwtVT9mCrQuxilC2R+f73/yHEPbpMsk=";
+    hash = "sha256-2l9Mk9CWmmzTflyC+ZWr2A7NyT78rf0bXQETvCYlLuM=";
   };
 
-  vendorHash = "sha256-UcvdN9t8+YD3eQ4BdV905xwtaHsHTTisIsqPgZhMCnU=";
+  vendorHash = "sha256-hnyw2n82nFBN+6Km9usIKSMSTxucdY497J957mP2eEo=";
 
   subPackages = [ "cmd/clusterctl" ];
 

pkgs/by-name/co/coldsnap/package.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "coldsnap";
-  version = "0.8.0";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "coldsnap";
     rev = "v${version}";
-    hash = "sha256-ZN+gSoWrmGmN1jYxKLO06hRVyTM5WUXRjsfkcKcdXfM=";
+    hash = "sha256-8+YPKjHi3VURzSOflIa0x4uBkoDMYGFJiFcNJ+8NJ7Q=";
   };
 
-  cargoHash = "sha256-ZWJa/J5sfBA/F28TkXyspygN1ZkNz2TIEKTsusN4SOc=";
+  cargoHash = "sha256-4w79zZcgIulLIArY2ErOHwaWA8g/mA2cSKCzJx4X9vM=";
 
   buildInputs = [ openssl ];
   nativeBuildInputs = [ pkg-config ];

pkgs/by-name/co/commitizen/package.nix

@@ -1,15 +1,31 @@
 {
   lib,
+  python3,
+  fetchPypi,
   fetchFromGitHub,
   gitMinimal,
   stdenv,
   installShellFiles,
   nix-update-script,
-  python3Packages,
   versionCheckHook,
   writableTmpDirAsHomeHook,
 }:
-
+let
+  # commitizen 4.9.1 is not compatible with version 3.0.52 of prompt-toolkit
+  python = python3.override {
+    packageOverrides = self: super: {
+      prompt-toolkit = super.prompt-toolkit.overridePythonAttrs (oldAttrs: rec {
+        version = "3.0.51";
+        pname = "prompt_toolkit";
+        src = fetchPypi {
+          inherit pname version;
+          hash = "sha256-kxoWLjsn/JDIbxtIux+yxSjCdhR15XycBt4TMRx7VO0=";
+        };
+      });
+    };
+  };
+  python3Packages = python.pkgs;
+in
 python3Packages.buildPythonPackage rec {
   pname = "commitizen";
   version = "4.9.1";
@@ -41,6 +57,7 @@ python3Packages.buildPythonPackage rec {
     importlib-metadata
     jinja2
     packaging
+    prompt-toolkit
     pyyaml
     questionary
     termcolor

pkgs/by-name/co/contact/package.nix

@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "contact";
-  version = "1.4.0";
+  version = "1.4.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pdxlocations";
     repo = "contact";
     tag = version;
-    hash = "sha256-6yPXwYfFL8gU7hBF1BJ/Zv9GRbqeccbzsB+5Ny6o0WI=";
+    hash = "sha256-od0sF+c6ToNNtGmGxikGsXniQ3HCm4Hz3ynrzXCNJmw=";
   };
 
   dependencies = [ python3Packages.meshtastic ];

pkgs/by-name/di/discordo/package.nix

@@ -11,16 +11,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "discordo";
-  version = "0-unstable-2025-09-27";
+  version = "0-unstable-2025-09-30";
 
   src = fetchFromGitHub {
     owner = "ayn2op";
     repo = "discordo";
-    rev = "5cecfddae7a092a1cbb91a8bdec1ce27d013467f";
-    hash = "sha256-jbZJAUrwgbwcc1vugrTzW1P74Ll3OWh+5MQCdwnAVrw=";
+    rev = "6f670612e889dfcd7991d570b154d1039b1afc10";
+    hash = "sha256-0YdOKXiI/popKhMJgQXJCHIiCEST4aPcLXCQxx6WzzA=";
   };
 
-  vendorHash = "sha256-RASyQEesppDckC/bE1vbKiVqZ4f72RI8IAbSTGGgzmo=";
+  vendorHash = "sha256-9u861o/pF272PzspTdLkrXdCf/AquG2GmGQ4Nuvx7GE=";
 
   env.CGO_ENABLED = 0;
 

pkgs/by-name/do/dolphin-emu/package.nix

@@ -132,8 +132,9 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeFeature "DISTRIBUTOR" "NixOS")
     (lib.cmakeFeature "DOLPHIN_WC_DESCRIBE" finalAttrs.version)
     (lib.cmakeFeature "DOLPHIN_WC_BRANCH" "master")
-    # Fix building v2509, should be removed in the future
-    "-DCMAKE_POLICY_VERSION_MINIMUM=3.5"
+    # CMake 4 dropped support of versions lower than 3.5,
+    # versions lower than 3.10 are deprecated.
+    (lib.cmakeFeature "CMAKE_POLICY_VERSION_MINIMUM" "3.10")
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     (lib.cmakeBool "OSX_USE_DEFAULT_SEARCH_PATH" true)

pkgs/by-name/el/elf2uf2-rs/package.nix

@@ -9,14 +9,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "elf2uf2-rs";
-  version = "2.1.1";
+  version = "2.2.0";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-7RS2OC00tjsSBYFvg0/FQf1HN515FdrmCoKhJBu4fvI=";
+    hash = "sha256-e0i8ecjfNZxQgX5kDU1T8yAGUl4J7mbgG+ueBFsyTNA=";
   };
 
-  cargoHash = "sha256-OiZGM/cfGwJA3uCg5sf3eo99BJXFoSzL/2k8AioQeyM=";
+  cargoHash = "sha256-+oByDYfC5yA4xzJdTAoji1S0LDc4w+pGhFPFHBgeL8A=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/en/ente-auth/package.nix

@@ -60,6 +60,9 @@ flutter324.buildFlutterApplication rec {
     jdk17_headless # JDK version used by upstream CI
   ];
 
+  # https://github.com/juliansteenbakker/flutter_secure_storage/issues/965
+  CXXFLAGS = [ "-Wno-deprecated-literal-operator" ];
+
   # Based on https://github.com/ente-io/ente/blob/main/auth/linux/packaging/rpm/make_config.yaml
   # and https://github.com/ente-io/ente/blob/main/auth/linux/packaging/enteauth.appdata.xml
   desktopItems = [

pkgs/by-name/ga/gammu/package.nix

@@ -45,6 +45,7 @@ stdenv.mkDerivation rec {
   ];
 
   cmakeFlags = [
+    "-DCMAKE_POLICY_VERSION_MINIMUM=3.5"
     # Fix build with CMake 4
     (lib.cmakeFeature "CMAKE_POLICY_VERSION_MINIMUM" "3.10")
   ];
@@ -69,7 +70,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://wammu.eu/gammu/";
     description = "Command line utility and library to control mobile phones";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     platforms = platforms.linux;
     maintainers = [ maintainers.coroa ];
   };

pkgs/by-name/ga/gatus/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "gatus";
-  version = "5.25.0";
+  version = "5.26.0";
 
   src = fetchFromGitHub {
     owner = "TwiN";
     repo = "gatus";
     rev = "v${version}";
-    hash = "sha256-mTj3lMdgWlIZO4qxGNyd5il9MXMg2nOBZ6yFQhWKTzM=";
+    hash = "sha256-Aib8s1iHkUnp80MdDAgTleXLzOc2B3Z6rnhqffOIzg0=";
   };
 
-  vendorHash = "sha256-v8fnooABoHxdK2dyTgkmukMdjR73a5p8g20J1a+WYnE=";
+  vendorHash = "sha256-vm+M2U0EhRjBe7AgpPsukIynHTuvACA/NBL2cdUtKNw=";
 
   subPackages = [ "." ];
 

pkgs/by-name/ge/gemini-cli-bin/package.nix

@@ -8,11 +8,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "gemini-cli-bin";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchurl {
     url = "https://github.com/google-gemini/gemini-cli/releases/download/v${finalAttrs.version}/gemini.js";
-    hash = "sha256-Xb9cE5Gz6V//dOe6AbQ2y9MFk0yeBuvcOoK5Z1L62s0=";
+    hash = "sha256-SRtl8FPMI0VBz0hzmyvtGYPO3mdnm60gu2zlStb5r98=";
   };
 
   phases = [

pkgs/by-name/gh/ghostty-bin/package.nix

@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "ghostty-bin";
-  version = "1.2.1";
+  version = "1.2.2";
 
   src = fetchurl {
     url = "https://release.files.ghostty.org/${finalAttrs.version}/Ghostty.dmg";
-    hash = "sha256-rFXYJxz6UPE8KKhrPLvksLLvxUdlZzvoxLGhIF3hTGM=";
+    hash = "sha256-gSuOOWZUzKKihCGmqEnieJJ8iP4xFeoSQIL536ka454=";
   };
 
   sourceRoot = ".";

pkgs/by-name/gh/ghostty/package.nix

@@ -38,7 +38,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "ghostty";
-  version = "1.2.1";
+  version = "1.2.2";
 
   outputs = [
     "out"
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "ghostty-org";
     repo = "ghostty";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LIJ8ZzOzpZMwgJOlOE/n6yiJ/mVKHI4pt/1Bm93gbG8=";
+    hash = "sha256-BTIH8G1GKrcoMasvlA3fje8f1vZvr4uuAUHfvZq6LVY=";
   };
 
   deps = callPackage ./deps.nix {
@@ -159,6 +159,7 @@ stdenv.mkDerivation (finalAttrs: {
       inherit (nixosTests) allTerminfo;
       nixos = nixosTests.terminal-emulators.ghostty;
     };
+    updateScript = ./update.nu;
   };
 
   meta = {

pkgs/by-name/gh/ghostty/update.nu

@@ -0,0 +1,34 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i nu -p nushell nixfmt common-updater-scripts
+
+let latest = ^list-git-tags --url=https://github.com/ghostty-org/ghostty
+  | lines
+  | sort --natural
+  | last
+  | str trim --left --char "v"
+
+let current = ^nix-instantiate --eval -A ghostty.version | str trim -c '"'
+
+if $latest == $current {
+  print "Up to date!"
+  exit
+}
+
+print $"Updating Ghostty: ($current) -> ($latest)"
+
+^update-source-version ghostty $latest --file=./pkgs/by-name/gh/ghostty/package.nix
+
+# Update deps.nix
+http get $"https://raw.githubusercontent.com/ghostty-org/ghostty/refs/tags/v($latest)/build.zig.zon.nix"
+  | ^nixfmt
+  | save -f ./pkgs/by-name/gh/ghostty/deps.nix
+
+# In extraordinary cases the DMG might take a while to be notarized by Apple
+# and so it's possible for a Git tag to have no corresponding notarized DMG download.
+# Don't fail here if that happens.
+try {
+  ^update-source-version ghostty-bin $latest --file=./pkgs/by-name/gh/ghostty-bin/package.nix
+} catch {
+  print "Failed to update bin package (is the DMG file uploaded yet?)"
+}
+

pkgs/by-name/gl/glab/package.nix

@@ -13,13 +13,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "glab";
-  version = "1.68.0";
+  version = "1.73.0";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-KSjgnoUwzHtRZtSUdWSDathmQgJdrtGhb7JR200NYIk=";
+    hash = "sha256-2beWB7QD2oeGZIjDWxKyqZLGzNJKWlRuqA1h7GRu1G4=";
     leaveDotGit = true;
     postFetch = ''
       cd "$out"
@@ -28,7 +28,7 @@ buildGoModule (finalAttrs: {
     '';
   };
 
-  vendorHash = "sha256-rt7HATHyaHufAPJ3fcrukrKOvFBeqpTCq7j+qKlHFbo=";
+  vendorHash = "sha256-pQK3cRNxvGm+NH4zBlw8jm+fPgSg65FIe7zxZ99jl5Q=";
 
   ldflags = [
     "-s"

pkgs/by-name/go/gotosocial/package.nix

@@ -10,11 +10,11 @@ let
   owner = "superseriousbusiness";
   repo = "gotosocial";
 
-  version = "0.19.2";
+  version = "0.20.0";
 
   web-assets = fetchurl {
     url = "https://${domain}/${owner}/${repo}/releases/download/v${version}/${repo}_${version}_web-assets.tar.gz";
-    hash = "sha256-et1jguboadjJJdUpugmRvkAtpdfHxn4+ftXUH/hWTdE=";
+    hash = "sha256-poG+j5WfbTN7853cOdngv+uIblcL19ySgtguXW5TX+w=";
   };
 in
 buildGo124Module rec {
@@ -24,7 +24,7 @@ buildGo124Module rec {
   src = fetchFromGitea {
     inherit domain owner repo;
     tag = "v${version}";
-    hash = "sha256-06ZBfOD222bt8nwlGCd7uuHS3P8YiaCKWWeYqlyJXns=";
+    hash = "sha256-RN2U/hYJcmuTGMnTCQCLX74qdxANF8nkIx98uWT/Aww=";
   };
 
   vendorHash = null;

pkgs/by-name/hu/hugo/package.nix

@@ -11,16 +11,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "hugo";
-  version = "0.150.1";
+  version = "0.151.0";
 
   src = fetchFromGitHub {
     owner = "gohugoio";
     repo = "hugo";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-FNAGdau+czPy+4jtugs+ZHtHrMCsXoZZgJIG4a4r0bs=";
+    hash = "sha256-gDbKYL1jCqV6yjCklTucTxK0oQYvy1kfEqE+4k3viXw=";
   };
 
-  vendorHash = "sha256-/jbShK+wEybD8hh5+1+Qd+NJkmp3w+BYf2UsTPEgwhw=";
+  vendorHash = "sha256-swxlm9APcwLQzFFoz9PDT7vdxWFayKAfQx3IADhwnEs=";
 
   checkFlags =
     let

pkgs/by-name/ka/kaidan/package.nix

@@ -15,14 +15,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "kaidan";
-  version = "0.12.2";
+  version = "0.13.0";
 
   src = fetchFromGitLab {
     domain = "invent.kde.org";
     owner = "network";
     repo = "kaidan";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+9L1NuyHnyX7yThC3LGqKJd9XU8Mo7NAdnGoJSdq4TM=";
+    hash = "sha256-4+jW3fuUi1OpwbcGccxvrPro/fiW9yBOlhc2KUbUExc=";
   };
 
   nativeBuildInputs = [
@@ -40,6 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
     kdePackages.kquickimageedit
     kdePackages.prison
     kdePackages.qtbase
+    kdePackages.qtkeychain
     kdePackages.qttools
     kdePackages.qtmultimedia
     kdePackages.qtlocation

pkgs/by-name/la/lazyhetzner/package.nix

@@ -8,13 +8,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "lazyhetzner";
-  version = "0.0.5";
+  version = "0.0.6";
 
   src = fetchFromGitHub {
     owner = "grammeaway";
     repo = "lazyhetzner";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1FXltNM+M8Txp1xoTqKcNI14dvbRQHl7izXtBQLYZTc=";
+    hash = "sha256-Hk1ZJ1DMotPVoR77dMb9deVbO/YUjORC+KVYBRIuLH0=";
 
     leaveDotGit = true;
     postFetch = ''

pkgs/by-name/li/libation/deps.json

@@ -11,8 +11,8 @@
   },
   {
     "pname": "AudibleApi",
-    "version": "9.4.4.1",
-    "hash": "sha256-eH1gOfnZDNdIInwnH6Nct/uTl1UuP7VIQd2LHjnad0k="
+    "version": "9.4.5.1",
+    "hash": "sha256-EE2GpXsVakLqN5JiK8LvPG/lNTbQk6r/MW6MFZwEA+E="
   },
   {
     "pname": "Avalonia",
@@ -116,8 +116,8 @@
   },
   {
     "pname": "Dinah.Core",
-    "version": "9.0.2.1",
-    "hash": "sha256-pm5wFnKjzh5f4c9wIqQcaWf4E26EHXfHBLK1N0oUybE="
+    "version": "9.0.3.1",
+    "hash": "sha256-RQQ27ECECPCTHnmdPZ6YjvGpCY9xRg39VOASMtJKJL0="
   },
   {
     "pname": "Dinah.EntityFrameworkCore",
@@ -176,8 +176,8 @@
   },
   {
     "pname": "HtmlAgilityPack",
-    "version": "1.12.0",
-    "hash": "sha256-Ps3IfNHKCosY4yg1QAj4aldMHni8u1JnlMre0fLcjHo="
+    "version": "1.12.2",
+    "hash": "sha256-SbzDudru9uTMuMjSTxnKyoT0KbAkd8SVNH9VOfCiR50="
   },
   {
     "pname": "Humanizer.Core",
@@ -686,8 +686,8 @@
   },
   {
     "pname": "System.Collections.Immutable",
-    "version": "9.0.2",
-    "hash": "sha256-brMJqQ4PyRDOJCNq+HTFdFEphlyPD1x9YZGeHUbmtTo="
+    "version": "9.0.8",
+    "hash": "sha256-/5757YLLlbkDL29+ZSoTiJ4TpFy6HQSKwdMPlT7KYQw="
   },
   {
     "pname": "System.Collections.NonGeneric",
@@ -746,8 +746,8 @@
   },
   {
     "pname": "System.Diagnostics.EventLog",
-    "version": "9.0.2",
-    "hash": "sha256-IoiQbH8To9UqzYgJzYpFbuiRV3KGU85y4ccPTyttP/w="
+    "version": "9.0.8",
+    "hash": "sha256-u10dcgug0Pwp83YNagVto8Pu3ieuByflYLNwAdX9Fm0="
   },
   {
     "pname": "System.Globalization",
@@ -846,8 +846,8 @@
   },
   {
     "pname": "System.ServiceProcess.ServiceController",
-    "version": "9.0.2",
-    "hash": "sha256-7H8oHNlgRX1BK5sP0bZvMhKVGznOjeTgnqiPkgXW+0g="
+    "version": "9.0.8",
+    "hash": "sha256-Cb/kCaHXKtuGva1lsog1NDzEWVkHL5UUhBBGlA36N9Q="
   },
   {
     "pname": "System.Text.Encoding.CodePages",

pkgs/by-name/li/libation/package.nix

@@ -13,13 +13,13 @@
 
 buildDotnetModule rec {
   pname = "libation";
-  version = "12.5.3";
+  version = "12.5.4";
 
   src = fetchFromGitHub {
     owner = "rmcrackan";
     repo = "Libation";
     tag = "v${version}";
-    hash = "sha256-4XBbpjxcC5SWLGz0SLKF70G6Gk5bKqKvEwD/My7siUA=";
+    hash = "sha256-W2wCtXcvft450A2cdLPbOFjHrQahSbTEbfyoSXUtH/E=";
   };
 
   sourceRoot = "${src.name}/Source";

pkgs/by-name/li/libosmium/package.nix

@@ -33,7 +33,11 @@ stdenv.mkDerivation (finalAttrs: {
     lz4
   ];
 
-  cmakeFlags = [ (lib.cmakeBool "INSTALL_GDALCPP" true) ];
+  cmakeFlags = [
+    # Fix the build with CMake 4.
+    "-DCMAKE_POLICY_VERSION_MINIMUM=3.5"
+    (lib.cmakeBool "INSTALL_GDALCPP" true)
+  ];
 
   doCheck = true;
 

pkgs/by-name/li/libsignal-protocol-c/package.nix

@@ -21,7 +21,10 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ openssl ];
 
-  cmakeFlags = [ "-DBUILD_SHARED_LIBS=ON" ];
+  cmakeFlags = [
+    "-DBUILD_SHARED_LIBS=ON"
+    "-DCMAKE_POLICY_VERSION_MINIMUM=3.10"
+  ];
 
   outputs = [
     "out"

pkgs/by-name/ma/maim/package.nix

@@ -31,6 +31,8 @@ stdenv.mkDerivation rec {
     hash = "sha256-bbjV3+41cxAlKCEd1/nvnZ19GhctWOr5Lu4X+Vg3EAk=";
   };
 
+  # TODO: drop -DCMAKE_POLICY_VERSION_MINIMUM once maim adds CMake 4 support
+  cmakeFlags = [ "-DCMAKE_POLICY_VERSION_MINIMUM=3.10" ];
   nativeBuildInputs = [
     cmake
     pkg-config

pkgs/by-name/me/melange/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "melange";
-  version = "0.31.5";
+  version = "0.31.6";
 
   src = fetchFromGitHub {
     owner = "chainguard-dev";
     repo = "melange";
     rev = "v${version}";
-    hash = "sha256-aa5r7755c2b69HB7bLk6ccs8k34iuNXATqRgZ98MyB4=";
+    hash = "sha256-C7aYI30ExREoIDzCMqGQtfjAf74wyA+6zcanmUoOAuI=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;

pkgs/by-name/mi/mint-l-icons/package.nix

@@ -10,14 +10,14 @@
 
 stdenvNoCC.mkDerivation {
   pname = "mint-l-icons";
-  version = "1.7.6";
+  version = "1.7.8";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "mint-l-icons";
     # They don't really do tags, this is just a named commit.
-    rev = "b046353fa23951746e9bfa3d54f745819802649e";
-    hash = "sha256-b+7YgIUGD2m92lzcnoVDk4K+f80zzv1tzEfeXPKAKFc=";
+    rev = "5d96655e37a85aa5e3d20bc7b38c9675a6145d13";
+    hash = "sha256-9MdGMbxJKZTchYKEc/cV4m4M4tgraF1XlSNVT5PInVY=";
   };
 
   propagatedBuildInputs = [

pkgs/by-name/mo/mozjpeg/package.nix

@@ -21,6 +21,8 @@ stdenv.mkDerivation rec {
   };
 
   cmakeFlags = [
+    # Fix the build with CMake 4
+    "-DCMAKE_POLICY_VERSION_MINIMUM=3.5"
     "-DENABLE_STATIC=NO"
     "-DPNG_SUPPORTED=TRUE"
   ]; # See https://github.com/mozilla/mozjpeg/issues/351
@@ -29,6 +31,7 @@ stdenv.mkDerivation rec {
     cmake
     pkg-config
   ];
+
   buildInputs = [
     libpng
     zlib

pkgs/by-name/mp/mprisence/package.nix

@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mprisence";
-  version = "1.2.7";
+  version = "1.2.8";
 
   src = fetchFromGitHub {
     owner = "lazykern";
     repo = "mprisence";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qacyRPFtGrSBame9oOg7AktuI0iU+9VushSj9+zN4ZQ=";
+    hash = "sha256-d03rctXUsjU5YjEtQ79JXPXs1nM0ORiHRDHJXlTCCR8=";
   };
 
-  cargoHash = "sha256-TvIQUGT/floLv2RQcVhbhPTO59xwzFSFEVK2Gz3XOwA=";
+  cargoHash = "sha256-V5j2NzryAOJBZKy41ah6Hsw7LPTbxdx3b9+7p6iUHNo=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/ms/msedit/package.nix

@@ -22,6 +22,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
   # Requires nightly features
   env.RUSTC_BOOTSTRAP = 1;
 
+  # Without -headerpad, the following error occurs on x86_64-darwin
+  # error: install_name_tool: changing install names or rpaths can't be redone for: ... because larger updated load commands do not fit (the program must be relinked, and you may need to use -headerpad or -headerpad_max_install_names)
+  NIX_LDFLAGS = lib.optionals (with stdenv.hostPlatform; isDarwin && isx86_64) [
+    "-headerpad_max_install_names"
+  ];
+
   buildInputs = [
     icu
   ];

pkgs/by-name/ne/netbird-dashboard/package.nix

@@ -6,16 +6,16 @@
 
 buildNpmPackage rec {
   pname = "netbird-dashboard";
-  version = "2.17.0";
+  version = "2.19.2";
 
   src = fetchFromGitHub {
     owner = "netbirdio";
     repo = "dashboard";
     rev = "v${version}";
-    hash = "sha256-i6nwLOkfznr99B9UikRXMezZ2h/qmnwYNWZyVunlgn8=";
+    hash = "sha256-3rHNk/rc0j5mWF2jbrMOtFrDkosph1YWnFoh1lLHTPs=";
   };
 
-  npmDepsHash = "sha256-W9tR151QLP+xprPn52pi2I8JD3BSTsxim96WS0sqTvU=";
+  npmDepsHash = "sha256-pC4Vvkb+NAGyhd090LAeGZTLVGufnC9LylJGQt8aEZg=";
   npmFlags = [ "--legacy-peer-deps" ];
 
   installPhase = ''

pkgs/by-name/ne/networkmanager_dmenu/package.nix

@@ -14,13 +14,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "networkmanager_dmenu";
-  version = "2.6.1";
+  version = "2.6.2";
 
   src = fetchFromGitHub {
     owner = "firecat53";
     repo = "networkmanager-dmenu";
     rev = "v${version}";
-    sha256 = "sha256-LOCU9RoxXprKBhh0kAcSauW6WhU4hQZfdKrRqMkZ2gM=";
+    sha256 = "sha256-NTkGKUZ3xA9ZWBLZgjIR5wrUXVhccGkGqnnm0a79p+Q=";
   };
 
   nativeBuildInputs = [ gobject-introspection ];

pkgs/by-name/ov/ov/package.nix

@@ -12,16 +12,16 @@
 
 buildGoModule rec {
   pname = "ov";
-  version = "0.43.1";
+  version = "0.44.0";
 
   src = fetchFromGitHub {
     owner = "noborus";
     repo = "ov";
     tag = "v${version}";
-    hash = "sha256-G0oP+c/SBF2sFZnVrs+/3l+fvnmPtol3NP2XXsdcOro=";
+    hash = "sha256-GsOxN+Ya90PeGdICbghj/eFJK7gOLAG/Bk0/zoStxgQ=";
   };
 
-  vendorHash = "sha256-Jko2nKmqx8ly6QLSKxarucpADHDoDG+Q6bRHR7w7yVk=";
+  vendorHash = "sha256-faJjRFtnl7KdCAe+nFE793+cejQggauhJtvKdt9IRvY=";
 
   ldflags = [
     "-s"

pkgs/by-name/pe/petsc/package.nix

@@ -110,13 +110,26 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "petsc";
-  version = "3.23.7";
+  version = "3.24.0";
 
   src = fetchzip {
     url = "https://web.cels.anl.gov/projects/petsc/download/release-snapshots/petsc-${finalAttrs.version}.tar.gz";
-    hash = "sha256-6jP1EEYGMkttmEh0Fvtm0Fgp0NwHQlG21fY7cnLmXTI=";
+    hash = "sha256-5jqYTo5sfwLNByOlpry0zpI+q3u7ErwJJ97h7w5bvNQ=";
   };
 
+  patches = [
+    (replaceVars ./fix-petsc4py-install-prefix.patch {
+      PYTHON_SITEPACKAGES = python3Packages.python.sitePackages;
+    })
+  ];
+
+  postPatch = ''
+    patchShebangs ./lib/petsc/bin
+
+    substituteInPlace config/example_template.py \
+      --replace-fail "/usr/bin/env bash" "${bash}/bin/bash"
+  '';
+
   strictDeps = true;
 
   nativeBuildInputs = [
@@ -151,19 +164,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   propagatedBuildInputs = lib.optional pythonSupport python3Packages.numpy;
 
-  patches = [
-    (replaceVars ./fix-petsc4py-install-prefix.patch {
-      PYTHON_SITEPACKAGES = python3Packages.python.sitePackages;
-    })
-  ];
-
-  postPatch = ''
-    patchShebangs ./lib/petsc/bin
-
-    substituteInPlace config/example_template.py \
-      --replace-fail "/usr/bin/env bash" "${bash}/bin/bash"
-  '';
-
   configureFlags = [
     "--with-blaslapack=1"
     "--with-scalar-type=${scalarType}"

pkgs/by-name/pl/plasticity/package.nix

@@ -33,11 +33,11 @@
 }:
 stdenv.mkDerivation rec {
   pname = "plasticity";
-  version = "25.2.9";
+  version = "25.2.11";
 
   src = fetchurl {
     url = "https://github.com/nkallen/plasticity/releases/download/v${version}/Plasticity-${version}-1.x86_64.rpm";
-    hash = "sha256-Ey1APUOGw2zAVdn5C96bIwe5+PHXzMtXVI5f1xHISFU=";
+    hash = "sha256-aqc6CDR3yBOGaRr+VjXQrTXZKvr9kqzaqcu5y30clCA=";
   };
 
   passthru.updateScript = ./update.sh;

pkgs/by-name/pn/pnetcdf/package.nix

@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pnetcdf";
-  version = "1.14.0";
+  version = "1.14.1";
 
   src = fetchFromGitHub {
     owner = "Parallel-NetCDF";
     repo = "PnetCDF";
     tag = "checkpoint.${finalAttrs.version}";
-    hash = "sha256-Zyhzyvdh9Pf5GkcJW3duGgI6m3Dy0RR5B9YtA83Hpr4=";
+    hash = "sha256-nz40Ji9qh6UatlLOuChsWYvHwfVNacJI87usGBcYyFk=";
   };
 
   nativeBuildInputs = [
@@ -30,9 +30,11 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [ mpi ];
 
   postPatch = ''
-    patchShebangs src/binding/f77/buildiface
+    patchShebangs src/binding/f77/buildiface test examples benchmarks
   '';
 
+  __darwinAllowLocalNetworking = true;
+
   doCheck = true;
 
   nativeCheckInputs = [ mpiCheckPhaseHook ];

pkgs/by-name/po/pocket-id/package.nix

@@ -11,13 +11,13 @@
 
 buildGo125Module (finalAttrs: {
   pname = "pocket-id";
-  version = "1.11.2";
+  version = "1.13.1";
 
   src = fetchFromGitHub {
     owner = "pocket-id";
     repo = "pocket-id";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-thKPYbHx9w75hUgWkLS5fX4R3QLLqFtAJqcvfTxAFiY=";
+    hash = "sha256-ayMPyc90bnkIhYfBQ8SgcKayjUQSyrcp5SOLGHTKQwE=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/backend";

pkgs/by-name/pr/prismlauncher/package.nix

@@ -55,7 +55,8 @@ let
 in
 
 symlinkJoin {
-  name = "prismlauncher-${prismlauncher'.version}";
+  pname = "prismlauncher";
+  inherit (prismlauncher') version;
 
   paths = [ prismlauncher' ];
 

pkgs/by-name/ra/rabbitmqadmin-ng/package.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rabbitmqadmin-ng";
-  version = "2.13.0";
+  version = "2.15.0";
 
   src = fetchFromGitHub {
     owner = "rabbitmq";
     repo = "rabbitmqadmin-ng";
     tag = "v${version}";
-    hash = "sha256-zbxe+pu5db0D32UpPF4Np0rtha1lmavwafcvyWBli9k=";
+    hash = "sha256-OaSCqK3VwR5b6tQUfGFM/clHynwG0TgMy2ZEcFsLFx0=";
   };
 
-  cargoHash = "sha256-Qzj9hhVNnlrRA355nYRep2YEUD/CXqXo2XTOXGE/bEo=";
+  cargoHash = "sha256-dynUbe6UCVdPEpy+fXABhzSsrF/OV5z1eMvrXtzKs70=";
 
   buildInputs = [ openssl ];
   nativeBuildInputs = [ pkg-config ];

pkgs/by-name/re/retool/package.nix

@@ -8,7 +8,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "retool";
-  version = "2.4.1";
+  version = "2.4.2";
 
   pyproject = true;
   disabled = python3.pkgs.pythonOlder "3.10";
@@ -17,7 +17,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "unexpectedpanda";
     repo = "retool";
     tag = "v${version}";
-    hash = "sha256-u2MKyNT9L/rq4rvX6an2tS8xFFZhjDuU+py9rJL57xY=";
+    hash = "sha256-jb2HJjXBxfdOY9TI37D5xwtySlYoSJwckrLC+h7YqoM=";
   };
 
   nativeBuildInputs = with python3.pkgs; [

pkgs/by-name/sa/saucectl/package.nix

@@ -5,7 +5,7 @@
 }:
 let
   pname = "saucectl";
-  version = "0.197.0";
+  version = "0.197.1";
 in
 buildGoModule {
   inherit pname version;
@@ -14,7 +14,7 @@ buildGoModule {
     owner = "saucelabs";
     repo = "saucectl";
     tag = "v${version}";
-    hash = "sha256-VUP/wSG7i4h/bMyu3dbdCCbnU+/v80WiXUG4akXxaLs=";
+    hash = "sha256-Vk09bh8c3NqHVr3FzbgQU2Xxw7J3SPmtvrOv7CFcLXk=";
   };
 
   ldflags = [

pkgs/by-name/sc/sc-controller/package.nix

@@ -20,14 +20,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "sc-controller";
-  version = "0.5.3";
+  version = "0.5.4";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "C0rn3j";
     repo = "sc-controller";
     tag = "v${version}";
-    hash = "sha256-iieSKUTZwb1cInh/hz2cDvUFHf3p9Y5E4kR+YyZoNxI=";
+    hash = "sha256-7rSsRoxFCXSHSIIoBrIPPY+4/+M99Hdop8+EeryJues=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/se/sentry-cli/package.nix

@@ -9,13 +9,13 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "sentry-cli";
-  version = "2.55.0";
+  version = "2.56.0";
 
   src = fetchFromGitHub {
     owner = "getsentry";
     repo = "sentry-cli";
     rev = version;
-    hash = "sha256-QOYk/WT/4rOjNMU4h22+Lbl9X6Ezw1oBE5yVZZwLNo4=";
+    hash = "sha256-p9ym9yKGD8AMMU+3TfcLFEqH3Z/bI5NBEPnZtFvk+1E=";
   };
   doCheck = false;
 
@@ -28,7 +28,7 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  cargoHash = "sha256-8OIBIMlR0XAhJrYNd0gtBhApuZF6r2+7iHrATQdMfr0=";
+  cargoHash = "sha256-wPJSFxojR8tDfRBcRlhCCDzakghRTYbpQvmZ+F45T5c=";
 
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd sentry-cli \

pkgs/by-name/se/sentry-native/package.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sentry-native";
-  version = "0.11.1";
+  version = "0.11.2";
 
   src = fetchFromGitHub {
     owner = "getsentry";
     repo = "sentry-native";
     tag = version;
-    hash = "sha256-1BZtlGeSnop0ti/XhrmDxzZOFwzS6bagcZ4+7tM5zEk=";
+    hash = "sha256-t1wv6/HFOo6UVkrurIg/GbqZTfZBrfrdIEKyqg86M/4=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/si/signalbackup-tools/package.nix

@@ -6,6 +6,7 @@
   cmake,
   pkg-config,
 
+  darwinMinVersionHook,
   dbus,
   openssl,
   sqlite,
@@ -13,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "signalbackup-tools";
-  version = "20250925";
+  version = "20251006-1";
 
   src = fetchFromGitHub {
     owner = "bepaald";
     repo = "signalbackup-tools";
     tag = version;
-    hash = "sha256-xukBIxndZPkg54u5MIJgLzQcJFwy2iwaLQRLB6EML2M=";
+    hash = "sha256-DVJYwiE1AW79vzH+aBFSKyTuKAnoyQrHI3gfsNeIg88=";
   };
 
   nativeBuildInputs = [
@@ -33,6 +34,9 @@ stdenv.mkDerivation rec {
     openssl
     sqlite
   ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    (darwinMinVersionHook "13.3")
+  ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     dbus
   ];

pkgs/by-name/si/sioyek/package.nix

@@ -15,13 +15,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "sioyek";
-  version = "2.0.0-unstable-2025-09-23";
+  version = "2.0.0-unstable-2025-10-04";
 
   src = fetchFromGitHub {
     owner = "ahrm";
     repo = "sioyek";
-    rev = "c835e6be266168807fd82fb13129c4728c9a0cab";
-    hash = "sha256-IB9lVQnFVDkluCpuzrZJ/9xZjF8Q/FIM3NpVi+ZQ2e0=";
+    rev = "b18c359ed70e3aece0a56b0889fd0b6464b05b8f";
+    hash = "sha256-3VXGLeOVJ8ucRYuFteux+jHPgubFx7eiK/liVHV9Huk=";
   };
 
   buildInputs = [

pkgs/by-name/sl/slepc/package.nix

@@ -15,13 +15,13 @@ assert petsc.mpiSupport;
 assert pythonSupport -> petsc.pythonSupport;
 stdenv.mkDerivation (finalAttrs: {
   pname = "slepc";
-  version = "3.23.3";
+  version = "3.24.0";
 
   src = fetchFromGitLab {
     owner = "slepc";
     repo = "slepc";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-j0sUJet4eViFxOR0XOAxNSprnL+kN4OW1npGihT0Q4Y=";
+    hash = "sha256-nvzX0p/H3EYR8+7jD+I4FdvU+WstxR/U4Upcn7yZULk=";
   };
 
   postPatch = ''
@@ -33,14 +33,6 @@ stdenv.mkDerivation (finalAttrs: {
     patchShebangs lib/slepc/bin
   '';
 
-  # Usually this project is being built as part of a `petsc` build or as part of
-  # other projects, e.g when `petsc` is `./configure`d with
-  # `--download-slepc=1`. This instructs the slepc to be built as a standalone
-  # project.
-  preConfigure = ''
-    export SLEPC_DIR=$PWD
-  '';
-
   nativeBuildInputs = [
     python3Packages.python
   ]
@@ -99,7 +91,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Scalable Library for Eigenvalue Problem Computations";
     homepage = "https://slepc.upv.es";
-    changelog = "https://gitlab.com/slepc/slepc/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    changelog = "https://gitlab.com/slepc/slepc/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = with lib.licenses; [
       bsd2
     ];

pkgs/by-name/su/su-exec/package.nix

@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "su-exec";
-  version = "0.2";
+  version = "0.3";
 
   src = fetchFromGitHub {
     owner = "ncopa";
     repo = "su-exec";
     rev = "v${version}";
-    hash = "sha256-eymE9r9Rm/u4El5wXHbkAh7ma5goWV0EdJIhsq+leIs=";
+    hash = "sha256-VUaparvPZhVOtAVPULIDQmpLUypl9aYYZlZrIIxuoTI=";
   };
 
   installPhase = ''

pkgs/by-name/su/superlu/package.nix

@@ -7,14 +7,11 @@
   ninja,
   gfortran,
   blas,
-  lapack,
 }:
 
-assert (!blas.isILP64) && (!lapack.isILP64);
-
 stdenv.mkDerivation (finalAttrs: {
   pname = "superlu";
-  version = "7.0.0";
+  version = "7.0.1";
 
   src = fetchFromGitHub {
     owner = "xiaoyeli";
@@ -27,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
     # * <https://github.com/xiaoyeli/superlu/blob/0bbd6571bd839d866bff6a8ff1eaa812a8c31463/License.txt#L32-L65>
     # * <https://salsa.debian.org/science-team/superlu/-/blob/0acab1b41f332f2f2e3b0b5d28ba7fc9f7539533/debian/copyright>
     postFetch = "rm $out/SRC/mc64ad.* $out/DOC/*.pdf";
-    hash = "sha256-iJiVyY+/vr6kll8FCunvZ8rKBj+w+Rnj4F696XW9xFc=";
+    hash = "sha256-MiQPhYIGZbvmtpIojrNzTG4Xao7lc4Ks/FtxlfdAKmQ=";
   };
 
   patches = [
@@ -37,6 +34,11 @@ stdenv.mkDerivation (finalAttrs: {
     })
   ];
 
+  # Prevent clang from crashing when compiling slatms.c from SuperLU’s matgen test code.
+  postPatch = lib.optionalString stdenv.cc.isClang ''
+    echo 'target_compile_options(matgen PRIVATE -fno-vectorize)' >> TESTING/MATGEN/CMakeLists.txt
+  '';
+
   nativeBuildInputs = [
     cmake
     ninja
@@ -48,11 +50,9 @@ stdenv.mkDerivation (finalAttrs: {
   cmakeFlags = [
     (lib.cmakeBool "BUILD_SHARED_LIBS" true)
     (lib.cmakeBool "enable_fortran" true)
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
     # prevent cmake from using Accelerate, which causes tests to segfault
     # https://github.com/xiaoyeli/superlu/issues/155
-    "-DBLA_VENDOR=Generic"
+    (lib.cmakeFeature "BLA_VENDOR" "Generic")
   ];
 
   doCheck = true;

pkgs/by-name/sy/systemd-lsp/package.nix

@@ -3,31 +3,22 @@
   fetchFromGitHub,
   nix-update-script,
   rustPlatform,
-  versionCheckHook,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "systemd-lsp";
-  version = "0.1.0";
+  version = "2025.07.14";
 
   src = fetchFromGitHub {
     owner = "JFryy";
     repo = "systemd-lsp";
-    rev = "43e0a26b12653b97939612ce8f4e2f3bae562ea1";
-    hash = "sha256-l2/8khzXZjyga4nEdl4pcl3AOscCBxZHH3tW3Cv+RUk=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-JjrPgpQ94C01nZ3E1NE88TBzI03YFs+x37edtYStlnc=";
   };
 
-  cargoHash = "sha256-bYksgHTXomeEJuSk800+/PYXzMvrixSjfPnoqxStWAA=";
+  cargoHash = "sha256-G1cQWOgtx+Bmi05ji9Z4TBj5pnhglNcfLRoq2zSmyK0=";
 
-  nativeInstallCheckInputs = [ versionCheckHook ];
-  versionCheckProgramArg = "--version";
-  doInstallCheck = true;
-
-  passthru = {
-    updateScript = nix-update-script {
-      extraArgs = [ "--version=branch" ];
-    };
-  };
+  passthru.updateScript = nix-update-script { };
 
   meta = {
     description = "Language server implementation for systemd unit files made in Rust";

pkgs/by-name/ta/talhelper/package.nix

@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "talhelper";
-  version = "3.0.36";
+  version = "3.0.37";
 
   src = fetchFromGitHub {
     owner = "budimanjojo";
     repo = "talhelper";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qs7hFsCsiPRvLXYV4QvSl0gkASK9Fl4E8BnUKyK4Doo=";
+    hash = "sha256-GWm2ZTBq+g9mF7KktI+A6Sec8iHzfTtGt59PZjPW2B0=";
   };
 
-  vendorHash = "sha256-f3odaPTeoXKQKlJFOX+csWHL2nIPZEtr6wMqccJUjys=";
+  vendorHash = "sha256-vqec4Hd+jLKDuiwdfweWonitX3g5Hot0COpU5GKrpbE=";
 
   ldflags = [
     "-s"

pkgs/by-name/ta/tana/package.nix

@@ -62,7 +62,7 @@ let
     stdenv.cc.cc
     stdenv.cc.libc
   ];
-  version = "1.0.46";
+  version = "1.0.47";
 in
 stdenv.mkDerivation {
   pname = "tana";
@@ -70,7 +70,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://github.com/tanainc/tana-desktop-releases/releases/download/v${version}/tana_${version}_amd64.deb";
-    hash = "sha256-WBPTJ2eca5XuccblC31DZ5mCdFm46cXjP4GHyakSalY=";
+    hash = "sha256-Si02dSMH7hnUNz3kxJavhfZLO46RAcanRvl8F/DrLY0=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/tf/tf/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "tf";
-  version = "2.11.1";
+  version = "2.11.2";
 
   src = fetchFromGitHub {
     owner = "dex4er";
     repo = "tf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-EWD6BfOAZR/PucDhJmLStjBNVgXCLW45g8stVhoMyO8=";
+    hash = "sha256-JuGAUMOzAaiVjJf0R8I9PMc+g2m3SppQ+mdow7Qrvjc=";
   };
 
-  vendorHash = "sha256-lcgLEj6NELZS0LoakbuektO4epieY7ctl8ya1JnXim8=";
+  vendorHash = "sha256-tI/Fk3jDaEdCnDc4VTLpJnVlsaSW4i00KfftEMIiWog=";
 
   subPackages = [ "." ];
 

pkgs/by-name/ty/typos/package.nix

@@ -8,19 +8,27 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "typos";
-  version = "1.35.6";
+  version = "1.38.1";
 
   src = fetchFromGitHub {
     owner = "crate-ci";
     repo = "typos";
     tag = "v${version}";
-    hash = "sha256-THkmrZJt5+qtaErqceG9dppo0LPNq6fHdvLAHmie3/o=";
+    hash = "sha256-xr3k3wx9EWKm00kt1GxE31Mw5wa3N3VJJCKaUbQa4ic=";
   };
 
-  cargoHash = "sha256-V/OYr+XWSP43O2ShVpd9n0i/D3BW3qjkoOgZNj/+H40=";
+  cargoHash = "sha256-2XgnCXYqBvx7LRWaPt4iXznIXIEzYBlWMXbwEVZyGA8=";
 
   passthru.updateScript = nix-update-script { };
 
+  preCheck = ''
+    export LC_ALL=C.UTF-8
+  '';
+
+  postCheck = ''
+    unset LC_ALL
+  '';
+
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
   versionCheckProgramArg = "--version";

pkgs/by-name/un/unordered_dense/package.nix

@@ -7,13 +7,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "unordered-dense";
-  version = "4.5.0";
+  version = "4.6.0";
 
   src = fetchFromGitHub {
     owner = "martinus";
     repo = "unordered_dense";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TfbW+Pu8jKS+2oKldA6sE4Xzt0R+VBPitGv89OWxUjs=";
+    hash = "sha256-PgrbNHodhFruGP6n6MZ3FtFTyyNRCIEytChFUbbiZOU=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/us/usql/package.nix

@@ -11,13 +11,13 @@
 
 buildGoModule rec {
   pname = "usql";
-  version = "0.19.25";
+  version = "0.19.26";
 
   src = fetchFromGitHub {
     owner = "xo";
     repo = "usql";
     tag = "v${version}";
-    hash = "sha256-k6zXXtttW6AXLK/DoRqYOz39kqwamOE/xfT6TOa22jc=";
+    hash = "sha256-Qs/P7WFoc9w3jYLX48F7KSXLYBjrX0DppJmfZvY6Cq8=";
   };
 
   buildInputs = [
@@ -25,7 +25,7 @@ buildGoModule rec {
     icu
   ];
 
-  vendorHash = "sha256-RdIf/1Vu37y+xoF2I8XJYqgeOxGHG+hLe3JOMbVLofw=";
+  vendorHash = "sha256-gkC9o7aBZPqHoYODwstRehfaE+Gvtnv7gvKxbnc+BNI=";
   proxyVendor = true;
 
   # Exclude drivers from the bad group

pkgs/by-name/wt/wttrbar/package.nix

@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "wttrbar";
-  version = "0.12.3";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "bjesus";
     repo = "wttrbar";
     tag = finalAttrs.version;
-    hash = "sha256-gJJnmJ1dpKVCRZtzL1R86s607hOCHTpsFDPsQKOnvvA=";
+    hash = "sha256-TYWbC9TMHRWLPQ199SMbg2ROVVCFYbZDqB54IAbeTUQ=";
   };
 
-  cargoHash = "sha256-WMRDUAefYjXY03EqTZf3VNJuypxu07RTyDmdlB6a0kk=";
+  cargoHash = "sha256-yqfg/tDLCEwkgSAD2B63y7tVNx7RLblfD2yvywPzbz0=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl ];

pkgs/development/interpreters/ruby/default.nix

@@ -428,8 +428,8 @@ in
   };
 
   ruby_3_4 = generic {
-    version = rubyVersion "3" "4" "6" "";
-    hash = "sha256-48Gauej0GzcjEk+8ARTN58v1XmWqnFjBKs2J7JwN0bk=";
+    version = rubyVersion "3" "4" "7" "";
+    hash = "sha256-I4FabQlWlveRkJD9w+L5RZssg9VyJLLkRs4fX3Mz7zY=";
     cargoHash = "sha256-5Tp8Kth0yO89/LIcU8K01z6DdZRr8MAA0DPKqDEjIt0=";
   };
 

pkgs/development/interpreters/supercollider/default.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   mkDerivation,
+  fetchpatch,
   fetchurl,
   cmake,
   runtimeShell,
@@ -41,6 +42,12 @@ mkDerivation rec {
   patches = [
     # add support for SC_DATA_DIR and SC_PLUGIN_DIR env vars to override compile-time values
     ./supercollider-3.12.0-env-dirs.patch
+
+    # Fixes the build with CMake 4
+    (fetchpatch {
+      url = "https://github.com/supercollider/supercollider/commit/7d1f3fbe54e122889489a2f60bbc6cd6bb3bce28.patch";
+      hash = "sha256-gyE0B2qTbj0ppbLlYTMa2ooY3FHzzIrdrpWYr81Hy1Y=";
+    })
   ];
 
   postPatch = ''

pkgs/development/interpreters/supercollider/plugins/sc3-plugins.nix

@@ -1,6 +1,7 @@
 {
   stdenv,
   lib,
+  fetchpatch2,
   fetchurl,
   cmake,
   supercollider,
@@ -17,6 +18,13 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-+N7rhh1ALipy21HUC0jEQ2kCYbWlOveJg9TPe6dnF6I=";
   };
 
+  patches = [
+    (fetchpatch2 {
+      url = "https://github.com/supercollider/sc3-plugins/commit/3dc56bf7fcc1f2261afc13f96da762b78bcbfa51.patch";
+      hash = "sha256-lvXvGunfmjt6i+XPog14IKdnH1Qk8vefxplSDkXXXHU=";
+    })
+  ];
+
   strictDeps = true;
 
   nativeBuildInputs = [ cmake ];

pkgs/development/libraries/qmlbox2d/default.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation {
   pname = "qml-box2d";
-  version = "0-unstable-2024-04-15";
+  version = "0-unstable-2025-09-30";
 
   src = fetchFromGitHub {
     owner = "qml-box2d";
     repo = "qml-box2d";
-    rev = "3a85439726d1ac4d082308feba45f23859ba71e0";
-    hash = "sha256-lTgzPJWSwNfPRj5Lc63C69o4ILuyhVRLvltTo5E7yq0=";
+    rev = "e3674e0fe030c406a1d915e47eab760624fffa55";
+    hash = "sha256-kxDSPO2ifffJng9rKgEwdKRoP6alnYWwItbvE1t4Hbo=";
   };
 
   dontWrapQtApps = true;

pkgs/development/libraries/quarto/default.nix

@@ -65,9 +65,12 @@ stdenv.mkDerivation (final: {
       --set-default QUARTO_DART_SASS ${lib.getExe dart-sass} \
       --set-default QUARTO_TYPST ${lib.getExe typst} \
       ${lib.optionalString (rWrapper != null) "--set-default QUARTO_R ${rWithPackages}/bin/R"} \
+      ${
+        lib.optionalString (python3 != null) "--set-default QUARTO_PYTHON ${pythonWithPackages}/bin/python3"
+      } \
       ${lib.optionalString (
-        python3 != null
-      ) "--set-default QUARTO_PYTHON ${pythonWithPackages}/bin/python3"}
+        rWrapper != null
+      ) "--set-default RETICULATE_PYTHON ${pythonWithPackages.interpreter}"}
   '';
 
   installPhase = ''

pkgs/development/python-modules/ansiwrap/default.nix

@@ -1,52 +0,0 @@
-{
-  lib,
-  ansicolors,
-  buildPythonPackage,
-  fetchPypi,
-  pytestCheckHook,
-  pythonAtLeast,
-  pythonOlder,
-  setuptools,
-  textwrap3,
-}:
-buildPythonPackage rec {
-  pname = "ansiwrap";
-  version = "0.8.4";
-  pyproject = true;
-
-  disabled = pythonOlder "3.7" || pythonAtLeast "3.12";
-
-  src = fetchPypi {
-    inherit pname version;
-    extension = "zip";
-    hash = "sha256-ygx0BzTN5Zv5Gfj/LDhvdPmjaYGM3GDv6UiT0B6o2bc=";
-  };
-
-  postPatch = ''
-    # https://github.com/jonathaneunice/ansiwrap/issues/18
-    substituteInPlace test/test_ansiwrap.py \
-      --replace-fail "set(range(20, 120)).difference(LINE_LENGTHS)" "sorted(set(range(20, 120)).difference(LINE_LENGTHS))" \
-      --replace-fail "set(range(120, 400)).difference(LINE_LENGTHS)" "sorted(set(range(120, 400)).difference(LINE_LENGTHS))"
-  '';
-
-  build-system = [ setuptools ];
-
-  dependencies = [ textwrap3 ];
-
-  nativeCheckInputs = [
-    ansicolors
-    pytestCheckHook
-  ];
-
-  pythonImportsCheck = [ "ansiwrap" ];
-
-  meta = with lib; {
-    description = "Textwrap, but savvy to ANSI colors and styles";
-    homepage = "https://github.com/jonathaneunice/ansiwrap";
-    changelog = "https://github.com/jonathaneunice/ansiwrap/blob/master/CHANGES.yml";
-    license = licenses.asl20;
-    maintainers = [ ];
-
-    broken = true;
-  };
-}

pkgs/development/python-modules/ar/default.nix

@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "ar";
-  version = "1.0.0";
+  version = "1.0.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "vidstige";
     repo = "ar";
     tag = "v${version}";
-    hash = "sha256-azbqlSO5YE6zMrDoVNLDyGeed5H4mSyNEE02AmoZIDs=";
+    hash = "sha256-uaEkp2uCiRMj8pTBgA6NESJO3Eh5pVc+FfX/enIBcNA=";
   };
 
   build-system = [

pkgs/development/python-modules/bilibili-api-python/default.nix

@@ -20,17 +20,17 @@
   setuptools-scm,
   tqdm,
   yarl,
-  nix-update-script,
 }:
+
 buildPythonPackage rec {
   pname = "bilibili-api-python";
-  version = "17.3.0";
+  version = "17.4.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "bilibili_api_python";
     inherit version;
-    hash = "sha256-Rlnz3ws023x5MiwabGR4gARH0bdUgucoixIMRqj+Z64=";
+    hash = "sha256-OWMQwYIP2TGkahDGEVIzviUOjbMVombupgjA9iXN8e8=";
   };
 
   # The upstream uses requirements.txt, which overly strict version constraints.
@@ -69,8 +69,6 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "bilibili_api" ];
 
-  passthru.updateScript = nix-update-script { };
-
   meta = {
     changelog = "https://github.com/Nemo2011/bilibili-api/releases/tag/${version}";
     description = "Python module providing convenient integration for various Bilibili API along with some additional common features";

pkgs/development/python-modules/billiard/default.nix

@@ -5,21 +5,18 @@
   setuptools,
   pytestCheckHook,
   psutil,
-  pythonOlder,
 }:
 
 buildPythonPackage rec {
   pname = "billiard";
-  version = "4.2.1";
+  version = "4.2.2";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
-
   src = fetchFromGitHub {
     owner = "celery";
     repo = "billiard";
     tag = "v${version}";
-    hash = "sha256-9LuAlIn6hNiZGvWuaaDQxx9g0aBVF6Z2krxEOrssqRs=";
+    hash = "sha256-KUA1ydRoDIALhapDPG4c0C4q0Z72MReHeFCqqGviCNw=";
   };
 
   build-system = [ setuptools ];
@@ -39,7 +36,7 @@ buildPythonPackage rec {
   meta = {
     description = "Python multiprocessing fork with improvements and bugfixes";
     homepage = "https://github.com/celery/billiard";
-    changelog = "https://github.com/celery/billiard/blob/v${version}/CHANGES.txt";
+    changelog = "https://github.com/celery/billiard/blob/${src.tag}/CHANGES.txt";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ nickcao ];
   };

pkgs/development/python-modules/bitarray/default.nix

@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "bitarray";
-  version = "3.6.0";
+  version = "3.7.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-IP68hJofhY5qV6fUezI/6ecnxXnd1SbTF62IMXSKZqg=";
+    hash = "sha256-eVsXYEGKt1CCZCCuJPBvOSwI4h3CNPCjaaacwARE+Ow=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/ckzg/default.nix

@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "ckzg";
-  version = "2.1.4";
+  version = "2.1.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ethereum";
     repo = "c-kzg-4844";
     tag = "v${version}";
-    hash = "sha256-692u5EFiA3sfJbd3CUdTO/9LP2y4+WjLZZaFkY9vlP4=";
+    hash = "sha256-Sv22Cj1PRMUi9k+0Yj6yi8vCsOr+bVF7QdmQOqJIkBY=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/ctranslate2/default.nix

@@ -39,6 +39,8 @@ buildPythonPackage rec {
     pyyaml
   ];
 
+  cmakeFlags = [ "-DCMAKE_POLICY_VERSION_MINIMUM=3.5" ];
+
   pythonImportsCheck = [
     # https://opennmt.net/CTranslate2/python/overview.html
     "ctranslate2"

pkgs/development/python-modules/cypherpunkpay/default.nix

@@ -79,6 +79,7 @@ buildPythonPackage rec {
 
   pytestFlags = [
     "-Wignore::DeprecationWarning"
+    "-Wignore::UserWarning"
   ];
 
   disabledTestPaths = [

pkgs/development/python-modules/demesdraw/default.nix

@@ -17,13 +17,13 @@
 
 buildPythonPackage rec {
   pname = "demesdraw";
-  version = "0.4.0";
+  version = "0.4.1";
   format = "pyproject";
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-n7dz+kYf2yyr66TBx452W6z4qT6bT81u0J4aMAYuGCc=";
+    hash = "sha256-sPxdSXWRh6qnUKmP9g/AghOX5Ydrxv2Le2iadefQDws=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];

pkgs/development/python-modules/django-allauth/default.nix

@@ -41,7 +41,7 @@
 
 buildPythonPackage rec {
   pname = "django-allauth";
-  version = "65.11.2";
+  version = "65.12.0";
   pyproject = true;
 
   src = fetchFromGitea {
@@ -49,7 +49,7 @@ buildPythonPackage rec {
     owner = "allauth";
     repo = "django-allauth";
     tag = version;
-    hash = "sha256-JqG4fAm5aOUbySQpgLi1NiSvip1/ndVGP6JCe8QmsRs=";
+    hash = "sha256-LM9XU8oMzg2WlYnwPmmZY+8gzZWT1br2ciZ7gCTbH7I=";
   };
 
   nativeBuildInputs = [ gettext ];

pkgs/development/python-modules/docling-core/default.nix

@@ -29,14 +29,14 @@
 
 buildPythonPackage rec {
   pname = "docling-core";
-  version = "2.48.2";
+  version = "2.48.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "docling-project";
     repo = "docling-core";
     tag = "v${version}";
-    hash = "sha256-nZ9uPy6H8VhtoC7TXuFfXHefqvQ72jfUSwM6VmuFyxo=";
+    hash = "sha256-nGV0/8lL+JCGml8TF8+wBRax4WsAXQ0+f8fzy5k2gZI=";
   };
 
   build-system = [

pkgs/development/python-modules/docling-parse/default.nix

@@ -33,6 +33,13 @@ buildPythonPackage rec {
     hash = "sha256-8eHYMvfjPuGgrgrlqEh061ug+yer+1nQLbeDR1dQu68=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail \
+        '"cmake>=3.27.0,<4.0.0"' \
+        '"cmake>=3.27.0"'
+  '';
+
   dontUseCmakeConfigure = true;
 
   nativeBuildInputs = [

pkgs/development/python-modules/f90nml/default.nix

@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "f90nml";
-  version = "1.4.5";
+  version = "1.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "marshallward";
     repo = "f90nml";
     rev = "v" + version;
-    hash = "sha256-EbfQU4+JuFEfHiivVOCOuTCqtBVbILapJ7A0Bx90cdQ=";
+    hash = "sha256-AtFyHCbt74246uFBhDjw144CfxVq8r7fsgDC36plz+I=";
   };
 
   build-system = [ setuptools-scm ];

pkgs/development/python-modules/google-cloud-bigtable/default.nix

@@ -25,13 +25,13 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-bigtable";
-  version = "2.32.0";
+  version = "2.33.0";
 
   src = fetchFromGitHub {
     owner = "googleapis";
     repo = "python-bigtable";
     tag = "v${version}";
-    hash = "sha256-9yU0xNh5GuVbQuAmoFEHJBmHCVvFOOxEw+b/3B9O1OY=";
+    hash = "sha256-32+UMTfnSncDsSnN54MjRE4eL1PXsUdblnxe/rj5Pqc=";
   };
 
   pyproject = true;

pkgs/development/python-modules/great-tables/default.nix

@@ -34,14 +34,14 @@
 
 buildPythonPackage rec {
   pname = "great-tables";
-  version = "0.18.0";
+  version = "0.19.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "posit-dev";
     repo = "great-tables";
     tag = "v${version}";
-    hash = "sha256-AuhcIQGBroWa2+Rg6qLTtB4ulq+vvCoouPcTZcZhnbQ=";
+    hash = "sha256-bxeVVBGLS1yUaEnySCu1Ty1+bmoygMwQzBHMmtzm/+U=";
   };
 
   build-system = [

pkgs/development/python-modules/kantoku/default.nix

@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
   flit-core,
@@ -46,8 +47,15 @@ buildPythonPackage rec {
   disabledTests = [
     # AssertionError
     "test_streams"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    # Assertion error when test_socketstats hits a permission error
+    "test_resource_watcher_max_mem"
+    "test_resource_watcher_max_mem_abs"
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   meta = {
     description = "A Process & Socket Manager built with zmq";
     homepage = "https://github.com/bentoml/kantoku";

pkgs/development/python-modules/migen/default.nix

@@ -10,14 +10,14 @@
 
 buildPythonPackage {
   pname = "migen";
-  version = "0.9.2-unstable-2025-06-10";
+  version = "0.9.2-unstable-2025-10-03";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "m-labs";
     repo = "migen";
-    rev = "6e3a9e150fb006dabc4b55043d3af18dbfecd7e8";
-    hash = "sha256-NshlPiORBHWljSUP5bB7YBxe7k8dW0t8UXOsIq2EK8I=";
+    rev = "147f003fb7076ac4c7cf76a9a5ce152dc10e0ca6";
+    hash = "sha256-gRAvl5cUvrjq4t7htXsDBt4F8MEbHXFZoS0jbhrEs1I=";
   };
 
   nativeBuildInputs = [ setuptools ];

pkgs/development/python-modules/mozilla-django-oidc/cryptography.patch

@@ -0,0 +1,11 @@
+--- a/tests/test_auth.py
++++ b/tests/test_auth.py
+@@ -1234,7 +1234,7 @@ class OIDCAuthenticationBackendES256WithJwksEndpointTestCase(TestCase):
+         self.backend = OIDCAuthenticationBackend()
+ 
+         # Generate a private key to create a test token with
+-        private_key = ec.generate_private_key(ec.SECP256R1, default_backend())
++        private_key = ec.generate_private_key(ec.SECP256R1(), default_backend())
+         private_key_pem = private_key.private_bytes(
+             serialization.Encoding.PEM,
+             serialization.PrivateFormat.PKCS8,