Merge master into staging-nixos

ci/OWNERS

@@ -361,7 +361,8 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /pkgs/development/lua-modules         @NixOS/lua
 
 # Neovim
-/pkgs/applications/editors/neovim      @NixOS/neovim
+/pkgs/applications/editors/neovim           @NixOS/neovim
+/doc/languages-frameworks/neovim.section.md @NixOS/neovim
 
 # VimPlugins
 /pkgs/applications/editors/vim/plugins         @NixOS/neovim

doc/languages-frameworks/neovim.section.md

@@ -25,7 +25,7 @@ neovim.override {
   withRuby = false;
   configure = {
     customRC = ''
-      # here your custom viml configuration goes!
+      " here your custom viml configuration goes!
     '';
     packages.myVimPackage = with pkgs.vimPlugins; {
       # See examples below on how to use custom packages.
@@ -47,7 +47,7 @@ neovim-qt.override {
   neovim = neovim.override {
     configure = {
       customRC = ''
-        # your custom viml configuration
+        " your custom viml configuration
       '';
     };
   };
@@ -64,11 +64,14 @@ For instance, `sqlite-lua` needs `g:sqlite_clib_path` to be set to work. Nixpkgs
 - `wrapRc`: Nix, not being able to write in your `$HOME`, loads the
   generated Neovim configuration via the `$VIMINIT` environment variable, i.e. : `export VIMINIT='lua dofile("/nix/store/…-init.lua")'`. This has side effects like preventing Neovim from sourcing your `init.lua` in `$XDG_CONFIG_HOME/nvim` (see bullet 7 of [`:help startup`](https://neovim.io/doc/user/starting.html#startup) in Neovim). Disable it if you want to generate your own wrapper. You can still reuse the generated vimscript init code via `neovim.passthru.initRc`.
 - `plugins`: A list of plugins to add to the wrapper.
-- `extraLuaPackages`: A function passed on to `lua.withPackages`
-- `withPython3`, `withNodeJs`, `withRuby` control when to enable neovim
+- `extraLuaPackages`: A function passed on to `lua.withPackages`.
+- `extraPython3Packages`: A function passed on to `python3.withPackages`.
+- `withPython3`, `withNodeJs`, `withRuby`, `withPerl` control when to enable neovim
   providers (see `:h provider`).
+- `vimAlias` and `viAlias` control whether to symlink the `vim` and `vi` binaries to `nvim` respectively.
+- `extraName` is a string appended to the package name and derivation name.
 
-```
+```nix
 wrapNeovimUnstable neovim-unwrapped {
   autoconfigure = true;
   autowrapRuntimeDeps = true;
@@ -80,7 +83,8 @@ wrapNeovimUnstable neovim-unwrapped {
     vim.opt.colorcolumn = { 100 }
     vim.opt.termguicolors = true
   '';
-  # plugins accepts a list of either plugins or { plugin = ...; config = ..vimscript.. };
+  # plugins accepts a list of either plugins or attribute sets containing:
+  # { plugin = ...; config = ...; type = "viml"|"lua"; } (type defaults to "viml")
   plugins = with vimPlugins; [
     {
       plugin = vim-obsession;
@@ -88,7 +92,19 @@ wrapNeovimUnstable neovim-unwrapped {
         map <Leader>$ <Cmd>Obsession<CR>
       '';
     }
-    (nvim-treesitter.withPlugins (p: [ p.nix p.python ]))
+    {
+      plugin = grug-far-nvim;
+      type = "lua";
+      config = ''
+        require('grug-far').setup({
+          startInInsertMode = false,
+        })
+      '';
+    }
+    (nvim-treesitter.withPlugins (p: [
+      p.nix
+      p.python
+    ]))
     hex-nvim
   ];
   extraLuaPackages = lp: [ lp.mpack ];
@@ -98,12 +114,12 @@ wrapNeovimUnstable neovim-unwrapped {
 }
 ```
 
-You can explore the configuration with`nix repl` to discover these options and
+You can explore the configuration with `nix repl` to discover these options and
 override them. For instance:
 ```nix
-neovim.overrideAttrs (oldAttrs: {
+neovim.override {
   autowrapRuntimeDeps = false;
-})
+}
 ```
 
 ## Specificities for some plugins {#neovim-plugin-specificities}

doc/release-notes/rl-2611.section.md

@@ -56,6 +56,8 @@
 
 - `librest` providing 0.7 ABI was removed. `librest_1_0` providing 1.0 ABI was renamed to `librest` and `librest_1_0` was kept as an alias.
 
+- `pnpm_10` was upgraded to version 10.34.1+, which introduced stricter integrity checks. If you encounter `ERR_PNPM_MISSING_TARBALL_INTEGRITY`, you can fall back to the older `pnpm_10_34_0`.
+
 - `fetchPnpmDeps`' `fetcherVersion = 1` and `fetcherVersion = 2` have been
   removed, as announced in the 26.05 release. Packages still using them now
   throw an evaluation error and must migrate to `fetcherVersion = 3` (or later)

nixos/modules/services/networking/ntp/ntpd-rs.nix

@@ -70,6 +70,7 @@ in
 
     services.ntpd-rs.settings = {
       observability = {
+        log-level = lib.mkDefault "warn";
         observation-path = lib.mkDefault "/var/run/ntpd-rs/observe";
       };
       source = lib.mkIf cfg.useNetworkingTimeServers (

nixos/modules/services/web-apps/tabbyapi.nix

@@ -167,6 +167,13 @@ in
       wantedBy = [ "multi-user.target" ];
       description = "TabbyAPI - OAI compatible server for Exllama";
 
+      # Triton & huggingface downloader need writable cache folders
+      environment = {
+        HOME = "/var/lib/tabbyapi";
+        XDG_CACHE_HOME = "/var/lib/tabbyapi/.cache";
+        TRITON_CACHE_DIR = "/tmp/triton";
+      };
+
       serviceConfig = {
         ExecStart = "${lib.getExe cfg.package} --config=${configFile}";
         Restart = "on-failure";

pkgs/applications/editors/neovim/tests/default.nix

@@ -204,23 +204,23 @@ pkgs.lib.recurseIntoAttrs rec {
     ${nvim_with_plug}/bin/nvim -V3log.txt -i NONE -c 'color base16-tomorrow-night'  +quit! -e
   '';
 
-  nvim_with_autoconfigure = pkgs.neovim.overrideAttrs {
-    plugins = [
-      vimPlugins.unicode-vim
-      vimPlugins.fzf-hoogle-vim
-    ];
+  nvim_with_autoconfigure = pkgs.neovim.override {
+    configure = {
+      packages.myPlugins.start = [
+        vimPlugins.unicode-vim
+        vimPlugins.fzf-hoogle-vim
+      ];
+    };
     autoconfigure = true;
-    # legacy wrapper sets it to false
-    wrapRc = true;
   };
 
-  nvim_with_runtimeDeps = pkgs.neovim.overrideAttrs {
-    plugins = [
-      pkgs.vimPlugins.hex-nvim
-    ];
+  nvim_with_runtimeDeps = pkgs.neovim.override {
+    configure = {
+      packages.myPlugins.start = [
+        pkgs.vimPlugins.hex-nvim
+      ];
+    };
     autowrapRuntimeDeps = true;
-    # legacy wrapper sets it to false
-    wrapRc = true;
   };
 
   nvim_with_ftplugin =

pkgs/applications/emulators/libretro/cores/opera.nix

@@ -6,13 +6,13 @@
 }:
 mkLibretroCore {
   core = "opera";
-  version = "0-unstable-2026-06-15";
+  version = "0-unstable-2026-06-19";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "opera-libretro";
-    rev = "78f834b175bf2de3cc2cf05122d10d4c3d980c34";
-    hash = "sha256-E8/mD+4HKAZQciJBy0CsUIvCkfufkQCcudpMzvVoBhg=";
+    rev = "eb3a9162e99a71da221107aa58e7650fd076bbca";
+    hash = "sha256-swFdGY8ScsQG/8E/JWzGRL80jdMVzsr1BJ+UAisSJ9g=";
   };
 
   makefile = "Makefile";

pkgs/by-name/ay/ayatana-indicator-power/package.nix

@@ -13,7 +13,7 @@
   libayatana-common,
   libnotify,
   librda,
-  lomiri,
+  lomiri-qt6,
   pkg-config,
   python3,
   systemd,
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     # Path needed for build-time codegen
     substituteInPlace src/CMakeLists.txt \
-      --replace-fail '/usr/share/accountsservice/interfaces/com.lomiri.touch.AccountsService.Sound.xml' '${lomiri.lomiri-schemas}/share/accountsservice/interfaces/com.lomiri.touch.AccountsService.Sound.xml'
+      --replace-fail '/usr/share/accountsservice/interfaces/com.lomiri.touch.AccountsService.Sound.xml' '${lomiri-qt6.lomiri-schemas}/share/accountsservice/interfaces/com.lomiri.touch.AccountsService.Sound.xml'
   '';
 
   strictDeps = true;
@@ -58,7 +58,7 @@ stdenv.mkDerivation (finalAttrs: {
     librda
     systemd
   ]
-  ++ (with lomiri; [
+  ++ (with lomiri-qt6; [
     cmake-extras
     deviceinfo
     lomiri-schemas

pkgs/by-name/ay/ayatana-indicator-session/package.nix

@@ -13,7 +13,7 @@
   intltool,
   libayatana-common,
   librda,
-  lomiri,
+  lomiri-qt6,
   mate-settings-daemon,
   pkg-config,
   systemd,
@@ -48,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
-    lomiri.cmake-extras
+    lomiri-qt6.cmake-extras
     glib
     gsettings-desktop-schemas
     libayatana-common

pkgs/by-name/co/context7-mcp/package.nix

@@ -18,13 +18,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "context7-mcp";
-  version = "3.2.1";
+  version = "3.2.2";
 
   src = fetchFromGitHub {
     owner = "upstash";
     repo = "context7";
     tag = "${tag-prefix}@${finalAttrs.version}";
-    hash = "sha256-Gf3GnVOceAMzsc1SYGQVriDzDD/dQYSoBSrCuQ5M4UI=";
+    hash = "sha256-v3zKMnZsc0gWVAdgZwFTskWcFVlOU6sG2i+qDwjx+dw=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/co/copilot-language-server/package.nix

@@ -10,11 +10,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "copilot-language-server";
-  version = "1.509.0";
+  version = "1.513.0";
 
   src = fetchzip {
     url = "https://github.com/github/copilot-language-server-release/releases/download/${finalAttrs.version}/copilot-language-server-js-${finalAttrs.version}.zip";
-    hash = "sha256-PY4pr9FHKHSJjNctq7bGlsZ1yvDM6IqbmfobI1WsDP0=";
+    hash = "sha256-wVibxZjUW6BX4YhdYlyE0/zp0fst2H/XmmqZLqxGXH8=";
     stripRoot = false;
   };
 

pkgs/by-name/di/dioxus-cli/package.nix

@@ -9,7 +9,7 @@
   installShellFiles,
   makeWrapper,
   esbuild,
-  wasm-bindgen-cli_0_2_118,
+  wasm-bindgen-cli_0_2_126,
   testers,
   dioxus-cli,
   withTelemetry ? false,
@@ -81,7 +81,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --suffix PATH : ${
         lib.makeBinPath [
           esbuild
-          wasm-bindgen-cli_0_2_118
+          wasm-bindgen-cli_0_2_126
         ]
       }
   '';

pkgs/by-name/dw/dwproton-bin/package.nix

@@ -11,11 +11,11 @@ proton-ge-bin.overrideAttrs (
     inherit steamDisplayName;
 
     pname = "dwproton-bin";
-    version = "dwproton-11.0-3";
+    version = "dwproton-11.0-5";
 
     src = fetchzip {
       url = "https://dawn.wine/dawn-winery/dwproton/releases/download/${finalAttrs.version}/${finalAttrs.version}-x86_64.tar.xz";
-      hash = "sha256-e/YzKvwe30KveLHRUsntKDwzdEbr7a3Wfkqe/pu93WE=";
+      hash = "sha256-2x4xotJ2aJYbg+G2TDPqyU7uuoc/hZQon9CA6SFGin0=";
     };
 
     preFixup = ''

pkgs/by-name/in/incus-ui-canonical/package.nix

@@ -20,14 +20,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "incus-ui-canonical";
-  version = "0.21.0";
+  version = "0.21.2";
 
   src = fetchFromGitHub {
     owner = "zabbly";
     repo = "incus-ui-canonical";
     # only use tags prefixed by incus- they are the tested fork versions
     tag = "incus-${finalAttrs.version}";
-    hash = "sha256-X5s9pxNI+XjL4mp/C/bS8K0lAJ/HsRJNTwLiF3mzY4s=";
+    hash = "sha256-nCussrzWjFbZ6its3X74KBktv/dZO76OJGwG7upjkMw=";
   };
 
   offlineCache = fetchYarnDeps {

pkgs/by-name/ki/kicad/versions.nix

@@ -47,23 +47,23 @@
   };
   "kicad-unstable" = {
     kicadVersion = {
-      version = "2026-05-08";
+      version = "2026-06-27";
       src = {
-        rev = "76f8839fd232594f81180f644e3370c390025144";
-        sha256 = "0nbr3cmrz1ca4rcwbfxvlrnwxy091lscgsqd92pqyy9sjcvqdfjg";
+        rev = "26010f14414a39852891c13a5f37261691608bb6";
+        sha256 = "1jd7dc7vabi2zl38aci3xlg3qwyrnwj0j2jzlfln7zq9p8h3fnsc";
       };
     };
     libVersion = {
-      version = "2026-05-08";
+      version = "2026-06-27";
       libSources = {
-        symbols.rev = "5a41d2112853c72129a9128df01021278c1aec11";
-        symbols.sha256 = "05h8dbygch2kp4s5ikspxngwv999j7jwsiwm4pzwwcrir7dqzdfl";
+        symbols.rev = "c7e226a4946cbd123ac57131b79a73979891d82f";
+        symbols.sha256 = "0sj2kxr48wqz075fda6jiwk9ajdf6iirbiw92wlilq3w8i3xa431";
         templates.rev = "3ed4538b0f965d821df63a5fffc4441e723cfe7f";
         templates.sha256 = "0zs29zn8qjgxv0w1vyr8yxmj02m8752zagn4vcraqgik46dwg2id";
-        footprints.rev = "098da23b916d287a0c7913752df53e6bfdf640a2";
-        footprints.sha256 = "1h1v44qc5lvvqvmi1i7b79jhxsfq8snk0mcfl6r73hj6w0b25l84";
-        packages3d.rev = "394aeaa41d7be7f717715d9ba004d7d0d8b74b36";
-        packages3d.sha256 = "01nbjcs3890hyfmafc623ldmfi9n8sjr5m0wripz5fq5fjdnzqxl";
+        footprints.rev = "645402ed82e16096cf827fea7114fdbef4c46948";
+        footprints.sha256 = "0plw6h6vr3rj9y7i59wa9c9qx9l8lsvzgan48q2k87wbs4x1gwsl";
+        packages3d.rev = "0bc64e922178140eb6890377646efd45e15011bd";
+        packages3d.sha256 = "0mkc9km540n6ri5is4fjw5abv8afidwj9q7fmbs66l6kx1z3lxky";
       };
     };
   };

pkgs/by-name/kn/knossosnet/package.nix

@@ -11,13 +11,13 @@
 
 buildDotnetModule rec {
   pname = "knossosnet";
-  version = "1.3.7";
+  version = "1.3.8";
 
   src = fetchFromGitHub {
     owner = "KnossosNET";
     repo = "Knossos.NET";
     tag = "v${version}";
-    hash = "sha256-zUV+sQdQ71ORKOZzd4yxgRK1HjtZc9wgkmnzz6bG8FA=";
+    hash = "sha256-G/RSopDFn6ma5rXFkRth3NncbTVrVF6OqgqaJZl3EkE=";
   };
 
   patches = [ ./dotnet-8-upgrade.patch ];

pkgs/by-name/kt/ktailctl/package.nix

@@ -11,21 +11,21 @@
 }:
 
 let
-  version = "0.21.5";
+  version = "0.22.0";
 
   src = fetchFromGitHub {
     owner = "f-koehler";
     repo = "KTailctl";
     rev = "v${version}";
-    hash = "sha256-DqPerb8NcNynMMmoG8Ld0ZEyhrNg2q17TaErAbXIHC0=";
+    hash = "sha256-20hR/N3m1BsbMGiaWVV/SH/OHgfk7ZC1+WWhYqQpIls=";
   };
 
   goDeps =
     (buildGoModule {
       pname = "ktailctl-go-wrapper";
       inherit src version;
-      modRoot = "src/wrapper";
-      vendorHash = "sha256-jA1yortzyaBOP9GenmARhBBNDdpkGo9DNz0CXlh3BIU=";
+      modRoot = "src/tailscale/wrapper";
+      vendorHash = "sha256-h2gf9igVOguNRroGK6qvinUlEkpeZ2YJTtKArvlMj88=";
     }).goModules;
 in
 stdenv.mkDerivation {
@@ -33,7 +33,7 @@ stdenv.mkDerivation {
   inherit version src;
 
   postPatch = ''
-    cp -r --reflink=auto ${goDeps} src/wrapper/vendor
+    cp -r --reflink=auto ${goDeps} src/tailscale/wrapper/vendor
   '';
 
   # needed for go build to work

pkgs/by-name/ma/manifold/package.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "manifold";
-  version = "3.5.1";
+  version = "3.5.2";
 
   src = fetchFromGitHub {
     owner = "elalish";
     repo = "manifold";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ZsTGokNpWDT0EgA3VaU/aMh8WtUygIqcSxzLikeyQ9c=";
+    hash = "sha256-jzVIQ90H90szzZSUWvqgBB+5UMgZ9I/uYhYJbexCifk=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/ma/matcha/package.nix

@@ -14,16 +14,16 @@ buildGoLatestModule (finalAttrs: {
   __structuredAttrs = true;
 
   pname = "matcha";
-  version = "0.40.1";
+  version = "0.43.0";
 
   src = fetchFromGitHub {
     owner = "floatpane";
     repo = "matcha";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4GbuiFFHQ14O+S2TtWiP1UWg3h6J9Cys6A8k5+0Ww/I=";
+    hash = "sha256-x+k1/k7pwJ0MW0t31ieaOkbP8LtqDSmHOBrNEGA0K6Q=";
   };
 
-  vendorHash = "sha256-TFc7e7gNtFNiCJHARngWSBKGqGhH7PiX48VkU9kD9Bs=";
+  vendorHash = "sha256-5smWIw8ofG61ugHxFbmQ9r9vcxi098/UmxUE15lx4wE=";
   proxyVendor = true;
 
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [

pkgs/by-name/re/repomix/package.nix

@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "repomix";
-  version = "1.14.0";
+  version = "1.15.0";
 
   src = fetchFromGitHub {
     owner = "yamadashy";
     repo = "repomix";
     tag = "v${version}";
-    hash = "sha256-xvRCblm7WRvxFBjsxe3AjvLt8AvL4Q9F6SQuOv39ADA=";
+    hash = "sha256-M96q1oJ2ipDMfeos5P0FBbngjStC86qBlQcRFXitkt4=";
   };
 
-  npmDepsHash = "sha256-Pw2/w0rn5UloUqPZrze2l1Qi7JEdAXxlpPm7dxEHzWU=";
+  npmDepsHash = "sha256-3AP+mMFipVUfO7vLY7ZjaJ8FG4uwpxC2+jYtaHz49YI=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;

pkgs/by-name/sd/sdl_gamecontrollerdb/package.nix

@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "sdl_gamecontrollerdb";
-  version = "0-unstable-2026-06-12";
+  version = "0-unstable-2026-06-26";
 
   src = fetchFromGitHub {
     owner = "mdqinc";
     repo = "SDL_GameControllerDB";
-    rev = "998d5b08b5b33bdf3a63b2ef8f2ac4ccc664e2f6";
-    hash = "sha256-OdamCeHnPH0zc5Uac6KMpltIIEQMAfQwcopzg5ytUy8=";
+    rev = "513c72e34569e0f471dde7aa26eecb23946c3ef7";
+    hash = "sha256-IZ6BYtxFRu8Kt+Ege3xf+E9dlMBHXFWvdvYdKEFAIM8=";
   };
 
   dontBuild = true;

pkgs/by-name/sh/shaperglot-cli/package.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "shaperglot-cli";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "googlefonts";
     repo = "shaperglot";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Jh2/Rr7bIPFiblUZFS8KiQtMwmtMuOGCSV2w7LMCbq8=";
+    hash = "sha256-g8f8Q2DvYNvm8i6S+9K/jhhUiuGw366dht0Khx3/INg=";
   };
 
-  cargoHash = "sha256-3cHUSRvrvywfiYA/WpUrCIJV+hEQQwRNTPvSmCN50ho=";
+  cargoHash = "sha256-ivl3Zq0HRn4yP9JKfbjSaaERjbQ3SAEWhHk6toFp8dE=";
 
   cargoBuildFlags = [
     "--package=shaperglot-cli"

pkgs/by-name/sh/sharkey/package.nix

@@ -15,7 +15,7 @@
   pango,
   pixman,
   pkg-config,
-  pnpm_10,
+  pnpm_10_34_0,
   fetchPnpmDeps,
   pnpmConfigHook,
   python3,
@@ -24,7 +24,7 @@
 }:
 
 let
-  pnpm = pnpm_10.override { nodejs-slim = nodejs-slim_22; };
+  pnpm = pnpm_10_34_0.override { nodejs-slim = nodejs-slim_22; };
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "sharkey";

pkgs/by-name/ta/tabbyapi/package.nix

@@ -7,14 +7,14 @@
 }:
 python3Packages.buildPythonApplication {
   pname = "tabbyapi";
-  version = "0-unstable-2026-06-13";
+  version = "0-unstable-2026-06-27";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "theroyallab";
     repo = "tabbyAPI";
-    rev = "54850882315d509c984f9fe07fb8f5d04a0b4ba9";
-    hash = "sha256-rIpI3pCJtfU1AEHBwQCIwuOh4c14N/z8VlX0hdxOC60=";
+    rev = "3cf468c28362c28be1c8fc731ce1ccaf7b2206d0";
+    hash = "sha256-s97YFyij2/oYlClmV2laDrCkkoK4uVZgRsn5WwftLag=";
   };
 
   build-system = with python3Packages; [

pkgs/by-name/to/tola/package.nix

@@ -0,0 +1,44 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  cmake,
+  pkg-config,
+  openssl,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  __structuredAttrs = true;
+  pname = "tola";
+  version = "0.7.1";
+
+  src = fetchFromGitHub {
+    owner = "KawaYww";
+    repo = "tola";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-zgPKsIRXp5na2d0X7j5+9xJBGFSlvIKIRmzVVo/dcLk=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+    cmake
+  ];
+
+  buildInputs = [
+    openssl
+  ];
+
+  cargoHash = "sha256-3Y7+UJD2QyNs+GjijvOAyTQ9ZP7lRf/MpaWThN2/e5s=";
+
+  # There are not any tests in source project.
+  doCheck = false;
+
+  meta = {
+    description = "A static site generator for typst-based blog, written in Rust";
+    homepage = "https://github.com/KawaYww/tola";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      matthiasbeyer
+    ];
+  };
+})

pkgs/by-name/v2/v2ray-domain-list-community/package.nix

@@ -9,12 +9,12 @@
 let
   generator = pkgsBuildBuild.buildGoModule rec {
     pname = "v2ray-domain-list-community";
-    version = "20260618031303";
+    version = "20260627053650";
     src = fetchFromGitHub {
       owner = "v2fly";
       repo = "domain-list-community";
       rev = version;
-      hash = "sha256-pDWnXhwR+/NNVlYepa6TKCbJmbLF9lxXu4lhr5impaY=";
+      hash = "sha256-UhPtWbCojuLRP0ATj592OIAQkuc3ZtHpllhPzbUoAp4=";
     };
     vendorHash = "sha256-9tXv+rDBowxDN9gH4zHCr4TRbic4kijco3Y6bojJKRk=";
     meta = {

pkgs/by-name/vi/vicinae/package.nix

@@ -21,13 +21,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "vicinae";
-  version = "0.21.7";
+  version = "0.22.0";
 
   src = fetchFromGitHub {
     owner = "vicinaehq";
     repo = "vicinae";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-r4BuhKyW4sxin0YG3/EJjed/MiP5NwN7QGiM1ySozjE=";
+    hash = "sha256-f1d88cdqe1PfeuzY90JIRCoHKLV1Uuakc4TpSNvNBKA=";
   };
 
   apiDeps = fetchNpmDeps {

pkgs/by-name/vu/vue-language-server/package.nix

@@ -4,13 +4,13 @@
   fetchFromGitHub,
   fetchPnpmDeps,
   pnpmConfigHook,
-  pnpm_10,
+  pnpm_10_34_0,
   nodejs,
   nix-update-script,
   makeBinaryWrapper,
 }:
 let
-  pnpm = pnpm_10;
+  pnpm = pnpm_10_34_0;
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "vue-language-server";

pkgs/by-name/wa/wasm-bindgen-cli_0_2_126/package.nix

@@ -0,0 +1,19 @@
+{
+  buildWasmBindgenCli,
+  fetchCrate,
+  rustPlatform,
+}:
+
+buildWasmBindgenCli rec {
+  src = fetchCrate {
+    pname = "wasm-bindgen-cli";
+    version = "0.2.126";
+    hash = "sha256-H6Is3fiZVxZCfOMWK5dWMSrtn50VGv0sfdnsT+cTtyk=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit src;
+    inherit (src) pname version;
+    hash = "sha256-VucqkXbCi4qtQzY/HrXiDnbSURsagPsdNVMn1Tw3UiY=";
+  };
+}

pkgs/by-name/wa/waydroid-helper/package.nix

@@ -21,6 +21,7 @@
   libxml2,
   systemd,
   unzip,
+  vte-gtk4,
   nix-update-script,
   fetchpatch,
 }:
@@ -83,6 +84,7 @@ python3Packages.buildPythonApplication {
     libadwaita
     libxml2
     systemd
+    vte-gtk4
   ];
 
   dontUseCmakeConfigure = true;

pkgs/by-name/zw/zwave-js-ui/package.nix

@@ -7,15 +7,15 @@
 
 buildNpmPackage rec {
   pname = "zwave-js-ui";
-  version = "11.20.0";
+  version = "11.21.1";
 
   src = fetchFromGitHub {
     owner = "zwave-js";
     repo = "zwave-js-ui";
     tag = "v${version}";
-    hash = "sha256-No9s6fZk8b2eE4LPYbX7juSBNDpG49kMTdEeAcC62Ms=";
+    hash = "sha256-TBSc1dMOjZhJFffVm0SHbwDzDQFhXVjpeQ6qkYV14ew=";
   };
-  npmDepsHash = "sha256-/mAUsCdOd9aDzUnJCEI9gr++55xdwDy6OXgUkF8EcM0=";
+  npmDepsHash = "sha256-AS4/eOZG2nXErCacXR4FerUkqpt4BNwUjohuLMsauks=";
 
   passthru.tests.zwave-js-ui = nixosTests.zwave-js-ui;
 

pkgs/development/python-modules/flash-linear-attention/default.nix

@@ -21,7 +21,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "flash-linear-attention";
-  version = "0.5.0";
+  version = "0.5.1";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -30,7 +30,7 @@ buildPythonPackage (finalAttrs: {
     owner = "fla-org";
     repo = "flash-linear-attention";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-g66yGHaBwEyjb+of76tKTtV/7as/2xQuqcjbGs4E3rU=";
+    hash = "sha256-vxNbZ+FkxJh2E0TF09Z7ghkm8eas7Q96heeSXwgV4uU=";
   };
 
   build-system = [ setuptools ];

pkgs/development/tools/continuous-integration/woodpecker/common.nix

@@ -1,8 +1,8 @@
 { lib, fetchFromGitHub }:
 let
-  version = "3.15.0";
-  vendorHash = "sha256-7Hiyf/W1os1+Rd5VY4j96U3n6chub13fhbh0V3hPcCg=";
-  nodeModulesHash = "sha256-TX/2gtaq1MyXhfPtZpYIGKIvVbn6DwbFDL58GBWqtmg=";
+  version = "3.16.0";
+  vendorHash = "sha256-z87enzlH2jVq/BI6uVbpLG6jKsO5Wr2alJOcFjt/+MM=";
+  nodeModulesHash = "sha256-6sWSybiSJj7G1KO2iv81yylmOV6DBVN1D15PFYpilC0=";
 in
 {
   inherit version vendorHash nodeModulesHash;
@@ -11,7 +11,7 @@ in
     owner = "woodpecker-ci";
     repo = "woodpecker";
     tag = "v${version}";
-    hash = "sha256-enWZkYlZq2sWez4Uz78ZdNc+bqiN/UHnI5oOCicyjDI=";
+    hash = "sha256-9Bc7225CZFELgra5gnmo7KeNeY4X7+YpyvVGG/Y+sAs=";
   };
 
   postInstall = ''

pkgs/development/tools/pnpm/default.nix

@@ -30,9 +30,21 @@ let
         "CVE-2026-55699"
       ];
     };
-    "10" = {
+    # 10.34.1 made a breaking change that causes
+    # ERR_PNPM_MISSING_TARBALL_INTEGRITY error for some packages.
+    "10_34_0" = {
       version = "10.34.0";
       hash = "sha256-WOFDJYhx31FYm2UcBiBdq+xIdmpdu6PCWZm2m1C+WY4=";
+      knownVulnerabilities = [
+        "CVE-2026-55487"
+        "CVE-2026-55698"
+        "CVE-2026-55180"
+        "CVE-2026-55697"
+      ];
+    };
+    "10" = {
+      version = "10.34.4";
+      hash = "sha256-mM1XGNvYxLJokVZJO5WWzs9rZLGpjUoIfoITWhdbQOs=";
     };
     "11" = {
       version = "11.9.0";

pkgs/servers/home-assistant/custom-components/powercalc/package.nix

@@ -17,13 +17,13 @@
 buildHomeAssistantComponent rec {
   owner = "bramstroker";
   domain = "powercalc";
-  version = "1.21.0";
+  version = "1.21.2";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "homeassistant-powercalc";
     tag = "v${version}";
-    hash = "sha256-XVLemGYPuArcwek6zEZW/MS79sUWL2qbeUSTNarsZ8I=";
+    hash = "sha256-D8gFEhitQjryZLLcP2ZsXNqWLvPyayuoYGq5C0B2D5w=";
   };
 
   dependencies = [ numpy ];

pkgs/servers/sql/postgresql/ext/age.nix

@@ -16,7 +16,6 @@ let
     "16" = "sha256-iukdi2c3CukGvjuTojybFFAZBlAw8GEfzFPr2qJuwTA=";
     "15" = "sha256-webZWgWZGnSoXwTpk816tjbtHV1UIlXkogpBDAEL4gM=";
     "14" = "sha256-jZXhcYBubpjIJ8M5JHXKV5f6VK/2BkypH3P7nLxZz3E=";
-    "13" = "sha256-HR6nnWt/V2a0rD5eHHUsFIZ1y7lmvLz36URt9pPJnCw=";
   };
 in
 postgresqlBuildExtension (finalAttrs: {

pkgs/servers/sql/postgresql/ext/pg_hint_plan.nix

@@ -27,10 +27,6 @@ let
       version = "1.4.4";
       hash = "sha256-8rJ4Ck0Axf9zKhOXaJ4EA/M783YZRLuWx+GMGccadVo=";
     };
-    "13" = {
-      version = "1.3.11";
-      hash = "sha256-XTxCw1Uj6rVLcXJuHoT3RkEhdKVLGjOdR7rhFI8YJas=";
-    };
   };
 
   source =

pkgs/servers/sql/postgresql/ext/pg_safeupdate.nix

@@ -5,59 +5,23 @@
   postgresqlBuildExtension,
 }:
 
-let
-  sources = {
-    "13" = {
-      version = "1.4";
-      hash = "sha256-1cyvVEC9MQGMr7Tg6EUbsVBrMc8ahdFS3+CmDkmAq4Y=";
-    };
-    "14" = {
-      version = "1.5";
-      hash = "sha256-RRSpkWLFuif+6RCncnsb1NnjKnIIRY9KgebKkjCN5cs=";
-    };
-    "15" = {
-      version = "1.5";
-      hash = "sha256-RRSpkWLFuif+6RCncnsb1NnjKnIIRY9KgebKkjCN5cs=";
-    };
-    "16" = {
-      version = "1.5";
-      hash = "sha256-RRSpkWLFuif+6RCncnsb1NnjKnIIRY9KgebKkjCN5cs=";
-    };
-    "17" = {
-      version = "1.5";
-      hash = "sha256-RRSpkWLFuif+6RCncnsb1NnjKnIIRY9KgebKkjCN5cs=";
-    };
-    "18" = {
-      version = "1.5";
-      hash = "sha256-RRSpkWLFuif+6RCncnsb1NnjKnIIRY9KgebKkjCN5cs=";
-    };
-  };
-
-  source =
-    sources."${lib.versions.major postgresql.version}" or {
-      version = "";
-      hash = throw "pg_safeupdate: version specification for pg ${postgresql.version} missing.";
-    };
-in
-
-postgresqlBuildExtension {
+postgresqlBuildExtension (finalAttrs: {
   pname = "pg-safeupdate";
-  inherit (source) version;
+  version = "1.6";
 
   src = fetchFromGitHub {
     owner = "eradman";
     repo = "pg-safeupdate";
-    tag = source.version;
-    inherit (source) hash;
+    tag = finalAttrs.version;
+    hash = "sha256-xky2tlb0EoKzyIYftVr7/2BYLdinhxHjXiVO3lR57MM=";
   };
 
   meta = {
-    broken = !builtins.elem (lib.versions.major postgresql.version) (builtins.attrNames sources);
     description = "Simple extension to PostgreSQL that requires criteria for UPDATE and DELETE";
     homepage = "https://github.com/eradman/pg-safeupdate";
-    changelog = "https://github.com/eradman/pg-safeupdate/raw/${source.version}/NEWS";
+    changelog = "https://github.com/eradman/pg-safeupdate/raw/${finalAttrs.version}/NEWS";
     platforms = postgresql.meta.platforms;
     maintainers = with lib.maintainers; [ wolfgangwalther ];
     license = lib.licenses.postgresql;
   };
-}
+})

pkgs/servers/sql/postgresql/ext/pgaudit.nix

@@ -9,7 +9,10 @@
 
 let
   sources = {
-    # v18: No upstream ticket, yet (2025-07-07)
+    "18" = {
+      version = "18.0";
+      hash = "sha256-+1YKJxMFkok7MsYeA9GRkc2FLxuBGRLpC+JzdK/xqoM=";
+    };
     "17" = {
       version = "17.1";
       hash = "sha256-9St/ESPiFq2NiPKqbwHLwkIyATKUkOGxFcUrWgT+Iqo=";
@@ -26,10 +29,6 @@ let
       version = "1.6.3";
       hash = "sha256-KgLidJHjUK9BTp6ffmGUj1chcwIe6IzlcadRpGCfNdM=";
     };
-    "13" = {
-      version = "1.5.3";
-      hash = "sha256-IU4Clec3DkKWT7+kw0VtQNybt94i7M2rSSgJG/XdcRs=";
-    };
   };
 
   source =

pkgs/top-level/all-packages.nix

@@ -2812,6 +2812,7 @@ with pkgs;
     pnpm_8
     pnpm_9
     pnpm_10_29_2
+    pnpm_10_34_0
     pnpm_10
     pnpm_11
     ;