Merge master into staging-nixos

maintainers/maintainer-list.nix

@@ -16024,6 +16024,11 @@
     githubId = 401263;
     keys = [ { fingerprint = "1147 43F1 E707 6F3E 6F4B  2C96 B9A8 B592 F126 F8E8"; } ];
   };
+  macbucheron = {
+    name = "Nathan Deprat";
+    github = "Macbucheron1";
+    githubId = 95475157;
+  };
   macronova = {
     name = "Sicheng Pan";
     email = "trivial@invariantspace.com";

nixos/modules/hardware/video/nvidia.nix

@@ -93,6 +93,20 @@ in
         the NVIDIA docs, on Chapter 22. PCI-Express Runtime D3 (RTD3) Power Management
       '';
 
+      powerManagement.kernelSuspendNotifier =
+        lib.mkEnableOption ''
+          NVIDIA driver support for kernel suspend notifiers, which allows the driver
+          to be notified of suspend and resume events by the kernel, rather than
+          relying on systemd services.
+          Requires NVIDIA driver version 595 or newer, and the open source kernel modules.
+        ''
+        // {
+          default = useOpenModules && lib.versionAtLeast nvidia_x11.version "595";
+          defaultText = lib.literalExpression ''
+            config.hardware.nvidia.open == true && lib.versionAtLeast config.hardware.nvidia.package.version "595"
+          '';
+        };
+
       dynamicBoost.enable = lib.mkEnableOption ''
         dynamic Boost balances power between the CPU and the GPU for improved
         performance on supported laptops using the nvidia-powerd daemon. For more
@@ -465,6 +479,13 @@ in
               assertion = cfg.dynamicBoost.enable -> lib.versionAtLeast nvidia_x11.version "510.39.01";
               message = "NVIDIA's Dynamic Boost feature only exists on versions >= 510.39.01";
             }
+
+            {
+              assertion =
+                cfg.powerManagement.kernelSuspendNotifier
+                -> (useOpenModules && lib.versionAtLeast nvidia_x11.version "595");
+              message = "NVIDIA driver support for kernel suspend notifiers requires NVIDIA driver version 595 or newer, and the open source kernel modules.";
+            }
           ];
 
           # If Optimus/PRIME is enabled, we:
@@ -576,7 +597,9 @@ in
               ''
             );
 
-          systemd.packages = lib.optional cfg.powerManagement.enable nvidia_x11.out;
+          systemd.packages = lib.optional (
+            cfg.powerManagement.enable && !cfg.powerManagement.kernelSuspendNotifier
+          ) nvidia_x11.out;
 
           systemd.services =
             let
@@ -592,7 +615,7 @@ in
               };
             in
             lib.mkMerge [
-              (lib.mkIf cfg.powerManagement.enable {
+              (lib.mkIf (cfg.powerManagement.enable && !cfg.powerManagement.kernelSuspendNotifier) {
                 nvidia-suspend = nvidiaService "suspend";
                 nvidia-hibernate = nvidiaService "hibernate";
                 nvidia-resume = (nvidiaService "resume") // {
@@ -669,6 +692,9 @@ in
               ++ lib.optional (
                 (offloadCfg.enable || cfg.modesetting.enable) && lib.versionAtLeast nvidia_x11.version "545"
               ) "nvidia-drm.fbdev=1"
+              ++ lib.optional (
+                cfg.powerManagement.enable && cfg.powerManagement.kernelSuspendNotifier
+              ) "nvidia.NVreg_UseKernelSuspendNotifiers=1"
               ++ lib.optional cfg.powerManagement.enable "nvidia.NVreg_PreserveVideoMemoryAllocations=1"
               ++ lib.optional useOpenModules "nvidia.NVreg_OpenRmEnableUnsupportedGpus=1"
               ++ lib.optional (config.boot.kernelPackages.kernel.kernelAtLeast "6.2" && !ibtSupport) "ibt=off";

nixos/modules/services/development/zammad.nix

@@ -279,6 +279,7 @@ in
           locations = {
             "/" = {
               proxyPass = "http://127.0.0.1:${toString config.services.zammad.port}";
+              recommendedProxySettings = true;
               root = "${config.services.zammad.package}/public/";
               extraConfig = # nginx
                 ''
@@ -422,5 +423,6 @@ in
   meta.maintainers = with lib.maintainers; [
     taeer
     netali
+    meenzen
   ];
 }

nixos/modules/services/mail/tlsrpt.nix

@@ -244,12 +244,12 @@ in
               type = with types; nullOr str;
               default =
                 if config.services.postfix.enable && config.services.postfix.setSendmail then
-                  "/run/wrappers/bin/sendmail -i -t"
+                  "/run/wrappers/bin/sendmail -i -t -f ${cfg.reportd.settings.sender_address}"
                 else
                   null;
               defaultText = lib.literalExpression ''
                 if config.services.postfix.enable && config.services.postfix.setSendmail then
-                  "/run/wrappers/bin/sendmail -i -t"
+                  "/run/wrappers/bin/sendmail -i -t -f $${cfg.reportd.settings.sender_address}"
                 else
                   null
               '';

nixos/modules/services/networking/prosody.nix

@@ -8,6 +8,13 @@
 with lib;
 let
   cfg = config.services.prosody;
+  communityModulesToEnable =
+    let
+      componentSpecificModules = [ "muc_notifications" ];
+    in
+    lib.concatMap (
+      mod: lib.optional (!(lib.elem mod componentSpecificModules)) "${toLua mod};"
+    ) cfg.package.communityModules;
 
   sslOpts = _: {
     options = {
@@ -546,7 +553,7 @@ let
         ${lib.concatStringsSep "\n  " (
           lib.mapAttrsToList (name: val: optionalString val "${toLua name};") cfg.modules
         )}
-        ${lib.concatStringsSep "\n" (map (x: "${toLua x};") cfg.package.communityModules)}
+        ${lib.concatStringsSep "\n" communityModulesToEnable}
         ${lib.concatStringsSep "\n" (map (x: "${toLua x};") cfg.extraModules)}
       };
 
@@ -577,7 +584,7 @@ let
 
       ${lib.concatMapStrings (muc: ''
         Component ${toLua muc.domain} "muc"
-            modules_enabled = {${optionalString cfg.modules.mam ''"muc_mam",''}${optionalString muc.allowners_muc ''"muc_allowners",''}${optionalString muc.moderation ''"muc_moderation",''} }
+            modules_enabled = {${optionalString cfg.modules.mam ''"muc_mam",''}${optionalString muc.allowners_muc ''"muc_allowners",''}${optionalString muc.moderation ''"muc_moderation",''}${optionalString (lib.elem "muc_notifications" cfg.package.communityModules) ''"muc_notifications",''} }
             name = ${toLua muc.name}
             restrict_room_creation = ${toLua muc.restrictRoomCreation}
             max_history_messages = ${toLua muc.maxHistoryMessages}

nixos/modules/services/search/hound.nix

@@ -11,7 +11,7 @@ let
     name = "hound-config.json";
     text = builtins.toJSON cfg.settings;
     checkPhase = ''
-      ${cfg.package}/bin/houndd -check-conf -conf $out
+      ${cfg.package}/bin/houndd -check-config -conf $out
     '';
   };
 in

nixos/modules/services/web-apps/nextcloud-notify_push.nix

@@ -72,6 +72,13 @@ in
   );
 
   config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = config.services.nextcloud.config.dbtype != "sqlite";
+        message = "notify_push only supports Nextcloud's with either a Postgres or MariaDB database, not sqlite.";
+      }
+    ];
+
     systemd.services = {
       nextcloud-notify_push = {
         description = "Push daemon for Nextcloud clients";

nixos/modules/tasks/filesystems/zfs.nix

@@ -696,6 +696,10 @@ in
             This error can be triggered by using an absolute path, such as `"/dev/disk/..."`.
           '';
         }
+        {
+          assertion = cfgZED.enableMail -> config.services.mail.sendmailSetuidWrapper.enable;
+          message = "services.zfs.zed.enableMail requires services.mail.sendmailSetuidWrapper.enable to be enabled as otherwise no mail can be sent.";
+        }
       ];
 
       boot = {

pkgs/applications/editors/vscode/extensions/default.nix

@@ -3760,6 +3760,8 @@ let
 
       prince781.vala = callPackage ./prince781.vala { };
 
+      pranaygp.vscode-css-peek = callPackage ./pranaygp.vscode-css-peek { };
+
       prisma.prisma = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "prisma";

pkgs/applications/editors/vscode/extensions/pranaygp.vscode-css-peek/default.nix

@@ -0,0 +1,25 @@
+{
+  lib,
+  vscode-utils,
+}:
+let
+  version = "4.4.3";
+in
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    publisher = "pranaygp";
+    name = "vscode-css-peek";
+    inherit version;
+    hash = "sha256-oY+mpDv2OTy5hFEk2DMNHi9epFm4Ay4qi0drCXPuYhU=";
+  };
+
+  meta = {
+    description = "Allow peeking to css ID and class strings as definitions from html files to respective CSS";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=pranaygp.vscode-css-peek";
+    homepage = "https://github.com/pranaygp/vscode-css-peek";
+    changelog = "https://github.com/pranaygp/vscode-css-peek/blob/v${version}/README.md#changelog";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.kozm9000 ];
+  };
+}

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -1004,13 +1004,13 @@
     "vendorHash": "sha256-ucXmHK7jrahc78nE2cf5p5PPCSNV5DAQ53KM2SfJnjo="
   },
   "okta_okta": {
-    "hash": "sha256-rWmlXxWijaaoeU7Yo4xeBFNfdt+Jd+Byt75Ah7dXkxI=",
+    "hash": "sha256-2uQgmzz2dRkOb6OgM3w+IKe1/AY435wZbNmQmkiy8dM=",
     "homepage": "https://registry.terraform.io/providers/okta/okta",
     "owner": "okta",
     "repo": "terraform-provider-okta",
-    "rev": "v6.5.5",
+    "rev": "v6.6.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-7oOk9M92RuEZbVdV4eVvgkF7pndR/QI3A5/ao3A8H2U="
+    "vendorHash": "sha256-EqXLfVayaOG/G3c6EkgQoPGNwnG2qKSlDo2ai/onmQE="
   },
   "oktadeveloper_oktaasa": {
     "hash": "sha256-2LhxgowqKvDDDOwdznusL52p2DKP+UiXALHcs9ZQd0U=",

pkgs/applications/office/libreoffice/default.nix

@@ -706,7 +706,7 @@ stdenv.mkDerivation (finalAttrs: {
       gst-plugins-base
       gst-plugins-good
       gst-plugins-ugly
-      gstreamer
+      gstreamer.out
     ];
     qmlPackages = [
       kdePackages.ki18n

pkgs/applications/office/libreoffice/wrapper.nix

@@ -54,7 +54,7 @@ let
       "--prefix"
       "GST_PLUGIN_SYSTEM_PATH_1_0"
       ":"
-      "${lib.makeSearchPath "lib/girepository-1.0" unwrapped.gst_packages}"
+      "${lib.makeSearchPath "lib/gstreamer-1.0" unwrapped.gst_packages}"
       "--suffix"
       "PATH"
       ":"

pkgs/applications/window-managers/2bwm/default.nix

@@ -25,6 +25,8 @@ stdenv.mkDerivation rec {
   # Allow users set their own list of patches
   inherit patches;
 
+  env.NIX_CFLAGS_COMPILE = "-std=gnu17";
+
   buildInputs = [
     libxcb
     libxcb-keysyms

pkgs/build-support/rust/fetch-cargo-vendor.nix

@@ -5,6 +5,7 @@
   writers,
   python3Packages,
   cargo,
+  gitMinimal,
   nix-prefetch-git,
   cacert,
 }:
@@ -61,9 +62,12 @@ let
       nativeBuildInputs = [
         fetchCargoVendorUtil
         cacert
-        # break loop of nix-prefetch-git -> git-lfs -> asciidoctor -> ruby (yjit) -> fetchCargoVendor -> nix-prefetch-git
-        # Cargo does not currently handle git-lfs: https://github.com/rust-lang/cargo/issues/9692
-        (nix-prefetch-git.override { git-lfs = null; })
+        (nix-prefetch-git.override {
+          git = gitMinimal;
+          # break loop of nix-prefetch-git -> git-lfs -> asciidoctor -> ruby (yjit) -> fetchCargoVendor -> nix-prefetch-git
+          # Cargo does not currently handle git-lfs: https://github.com/rust-lang/cargo/issues/9692
+          git-lfs = null;
+        })
       ]
       ++ nativeBuildInputs;
 

pkgs/by-name/ab/abctl/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "abctl";
-  version = "0.30.3";
+  version = "0.30.4";
 
   src = fetchFromGitHub {
     owner = "airbytehq";
     repo = "abctl";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pQvLFfj7/uZQUqtWAsTcw2RQ3KHFuoQCBP3lBvb2LTs=";
+    hash = "sha256-pnzXE3yv/0m0vsiC8iNiPBBrGnzSxbzMBwzFv0Y+O94=";
   };
 
   checkFlags =
@@ -31,7 +31,7 @@ buildGoModule (finalAttrs: {
     in
     [ "-skip=^${lib.concatStringsSep "$|^" skippedTests}$" ];
 
-  vendorHash = "sha256-ZJbZDfVB6gxToinuUNLsjBEB+7+OgC19Cc2Q8Ej7kfo=";
+  vendorHash = "sha256-hxiR1zv5TlDPuNv2X4VY3p/uTuETQkV+ifc4w09XC2I=";
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/co/copilot-language-server/package.nix

@@ -10,11 +10,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "copilot-language-server";
-  version = "1.434.0";
+  version = "1.448.0";
 
   src = fetchzip {
     url = "https://github.com/github/copilot-language-server-release/releases/download/${finalAttrs.version}/copilot-language-server-js-${finalAttrs.version}.zip";
-    hash = "sha256-GxbSgKy2UgDNjVEwmNrZe4BMYM5VIgP3goubdpLVnIA=";
+    hash = "sha256-0baWiU6fwJFprJG05YpsXFWXj17ff920sL7hCGV83GI=";
     stripRoot = false;
   };
 

pkgs/by-name/dg/dgraph/package.nix

@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "dgraph";
-  version = "25.2.0";
+  version = "25.3.0";
 
   src = fetchFromGitHub {
     owner = "dgraph-io";
     repo = "dgraph";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-uXH+qg+YmX/C1smgHO4tEWfFM77fAFaov573prV5bH8=";
+    sha256 = "sha256-3k8JTg+F2fWdsaUns3RV46P+Etq9wkVT1jHA1MWm8mU=";
   };
 
-  vendorHash = "sha256-cXi5rbGjWhFFJj5OGK6s+C16KxxnVCbodsk+dT252i4=";
+  vendorHash = "sha256-3+t2MyXQs6mciwuHQK9z7RqV7q61aoiTQphh5Fspy/c=";
 
   doCheck = false;
 

pkgs/by-name/dp/dprint/plugins/dprint-plugin-biome.nix

@@ -1,7 +1,7 @@
 { mkDprintPlugin }:
 mkDprintPlugin {
   description = "Biome (JS/TS/JSON) wrapper plugin";
-  hash = "sha256-oVhS76n0SVoSrheKv3ynpKKS7s4Zj1s2ER3FaG8r4WM=";
+  hash = "sha256-EZg0l50VGrEDGKEMX64d7EzvdO3+tQfCtTIJp8JUYX4=";
   initConfig = {
     configExcludes = [ "**/node_modules" ];
     configKey = "biome";
@@ -17,6 +17,6 @@ mkDprintPlugin {
   };
   pname = "dprint-plugin-biome";
   updateUrl = "https://plugins.dprint.dev/dprint/biome/latest.json";
-  url = "https://plugins.dprint.dev/biome-0.11.14.wasm";
-  version = "0.11.14";
+  url = "https://plugins.dprint.dev/biome-0.12.1.wasm";
+  version = "0.12.1";
 }

pkgs/by-name/go/gosec/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "gosec";
-  version = "2.23.0";
+  version = "2.24.7";
 
   src = fetchFromGitHub {
     owner = "securego";
     repo = "gosec";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-dkKpoP/Tp1I4KXlHeyyau3KKAXi6HbMSqJx3d2bIRY8=";
+    hash = "sha256-a350HsTvcXEmJC6mWF4kF2RuZ3LwS0buFMwpFi+nCSQ=";
   };
 
-  vendorHash = "sha256-wBLk7XSept6+7eQei1hEcbiAoLNvSwaGcxQTqDVsclU=";
+  vendorHash = "sha256-anuAY4Z9rEOlkdNEcCCySW3ci79OdhiuhH+/uXX/6sU=";
 
   subPackages = [
     "cmd/gosec"

pkgs/by-name/gv/gvfs/package.nix

@@ -49,11 +49,11 @@
 assert googleSupport -> gnomeSupport;
 stdenv.mkDerivation (finalAttrs: {
   pname = "gvfs";
-  version = "1.58.1";
+  version = "1.58.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gvfs/${lib.versions.majorMinor finalAttrs.version}/gvfs-${finalAttrs.version}.tar.xz";
-    hash = "sha256-/FN9a7qx/6dpct99ShgZsMD+GevR3+gkIdHzLhS13Ds=";
+    hash = "sha256-rZ1b8LRcryMlIN8K3uUetlAgCwNwaA+Ao1Dq2dHWHd8=";
   };
 
   patches = [
@@ -143,7 +143,6 @@ stdenv.mkDerivation (finalAttrs: {
     "-Ddnssd=false"
   ]
   ++ lib.optionals (samba == null) [
-    # Xfce don't want samba
     "-Dsmb=false"
   ];
 

pkgs/by-name/ho/hound/check-config-flag.diff

@@ -0,0 +1,494 @@
+diff --git a/cmds/hound/main.go b/cmds/hound/main.go
+index 9f947fa..209ed3d 100644
+--- a/cmds/hound/main.go
++++ b/cmds/hound/main.go
+@@ -34,19 +34,24 @@ func newPresenter(likeGrep bool) client.Presenter {
+
+ // Attempt to populate a client.Config from the json found in
+ // filename.
+-func loadConfigFrom(filename string, cfg *client.Config) error {
++func loadConfigFrom(filename string, cfg *client.Config, disallowUnknownFields bool) error {
+ 	r, err := os.Open(filename)
+ 	if err != nil {
+ 		return err
+ 	}
+ 	defer r.Close()
+ 
+-	return json.NewDecoder(r).Decode(cfg)
++	decoder := json.NewDecoder(r)
++	if disallowUnknownFields {
++		decoder.DisallowUnknownFields()
++	}
++
++	return decoder.Decode(cfg)
+ }
+ 
+ // Attempt to populate a client.Config from the json found in
+ // any of the configPaths.
+-func loadConfig(cfg *client.Config) error {
++func loadConfig(cfg *client.Config, disallowUnknownFields bool) error {
+ 	u, err := user.Current()
+ 	if err != nil {
+ 		return err
+@@ -59,7 +64,7 @@ func loadConfig(cfg *client.Config) error {
+ 	for _, path := range configPaths {
+ 		err = loadConfigFrom(os.Expand(path, func(name string) string {
+ 			return env[name]
+-		}), cfg)
++		}), cfg, disallowUnknownFields)
+ 
+ 		if os.IsNotExist(err) {
+ 			continue
+@@ -88,6 +93,7 @@ func main() {
+ 	flagCase := flag.Bool("ignore-case", false, "")
+ 	flagStats := flag.Bool("show-stats", false, "")
+ 	flagGrep := flag.Bool("like-grep", false, "")
++	flagCheckCfg := flag.Bool("check-config", false, "")
+ 
+ 	flag.Parse()
+ 
+@@ -109,10 +115,14 @@ func main() {
+ 		HttpHeaders: nil,
+ 	}
+ 
+-	if err := loadConfig(&cfg); err != nil {
++	if err := loadConfig(&cfg, *flagCheckCfg); err != nil {
+ 		log.Panic(err)
+ 	}
+
++  if *flagCheckCfg {
++    return
++  }
++
+ 	res, repos, err := client.SearchAndLoadRepos(&cfg,
+ 		flag.Arg(0),
+ 		*flagRepos,
+diff --git a/cmds/houndd/main.go b/cmds/houndd/main.go
+index eb8038a2..7e51d776 100644
+--- a/cmds/houndd/main.go
++++ b/cmds/houndd/main.go
+@@ -31,15 +31,17 @@
+ 	basepath   = filepath.Dir(b)
+ )
+ 
+-func makeSearchers(cfg *config.Config) (map[string]*searcher.Searcher, bool, error) {
++func makeSearchers(cfg *config.Config, disallowUnknownFields bool) (map[string]*searcher.Searcher, bool, error) {
+ 	// Ensure we have a dbpath
+-	if _, err := os.Stat(cfg.DbPath); err != nil {
+-		if err := os.MkdirAll(cfg.DbPath, os.ModePerm); err != nil {
+-			return nil, false, err
++	if !disallowUnknownFields {
++		if _, err := os.Stat(cfg.DbPath); err != nil {
++			if err := os.MkdirAll(cfg.DbPath, os.ModePerm); err != nil {
++				return nil, false, err
++			}
+ 		}
+ 	}
+ 
+-	searchers, errs, err := searcher.MakeAll(cfg)
++	searchers, errs, err := searcher.MakeAll(cfg, disallowUnknownFields)
+ 	if err != nil {
+ 		return nil, false, err
+ 	}
+@@ -130,6 +130,7 @@ func main() {
+ 	error_log = log.New(os.Stderr, "", log.LstdFlags)
+ 
+ 	flagConf := flag.String("conf", "config.json", "")
++	flagCheckCfg := flag.Bool("check-config", false, "")
+ 	flagAddr := flag.String("addr", ":6080", "")
+ 	flagDev := flag.Bool("dev", false, "")
+ 	flagVer := flag.Bool("version", false, "Display version and exit")
+@@ -142,7 +143,7 @@ func main() {
+ 	}
+ 
+ 	var cfg config.Config
+-	if err := cfg.LoadFromFile(*flagConf); err != nil {
++	if err := cfg.LoadFromFile(*flagConf, *flagCheckCfg); err != nil {
+ 		panic(err)
+ 	}
+
+@@ -152,12 +152,18 @@ func main() {
+ 	// It's not safe to be killed during makeSearchers, so register the
+ 	// shutdown signal here and defer processing it until we are ready.
+ 	shutdownCh := registerShutdownSignal()
+-	idx, ok, err := makeSearchers(&cfg)
++	idx, ok, err := makeSearchers(&cfg, *flagCheckCfg)
+ 	if err != nil {
+ 		log.Panic(err)
+ 	}
+ 	if !ok {
++		if *flagCheckCfg {
++			log.Panic("Config check failed")
++		}
+ 		info_log.Println("Some repos failed to index, see output above")
+ 	} else {
+ 		info_log.Println("All indexes built!")
++		if *flagCheckCfg {
++			os.Exit(0)
++		}
+ 	}
+diff --git a/config/config.go b/config/config.go
+index c978c009..338e053e 100644
+--- a/config/config.go
++++ b/config/config.go
+@@ -1,6 +1,7 @@
+ package config
+ 
+ import (
++	"bytes"
+ 	"encoding/json"
+ 	"errors"
+ 	"os"
+@@ -123,7 +124,7 @@ func initRepo(r *Repo) {
+ 
+ // Populate missing config values with default values and
+ // merge global VCS configs into repo level configs.
+-func initConfig(c *Config) error {
++func initConfig(c *Config, disallowUnknownFields bool) error {
+ 	if c.MaxConcurrentIndexers == 0 {
+ 		c.MaxConcurrentIndexers = defaultMaxConcurrentIndexers
+ 	}
+@@ -136,10 +137,10 @@ func initConfig(c *Config) error {
+ 		c.ResultLimit = defaultResultLimit
+ 	}
+ 
+-	return mergeVCSConfigs(c)
++	return mergeVCSConfigs(c, disallowUnknownFields)
+ }
+ 
+-func mergeVCSConfigs(cfg *Config) error {
++func mergeVCSConfigs(cfg *Config, disallowUnknownFields bool) error {
+ 	globalConfigLen := len(cfg.VCSConfigMessages)
+ 	if globalConfigLen == 0 {
+ 		return nil
+@@ -148,7 +149,11 @@ func mergeVCSConfigs(cfg *Config) error {
+ 	globalConfigVals := make(map[string]map[string]interface{}, globalConfigLen)
+ 	for vcs, configBytes := range cfg.VCSConfigMessages {
+ 		var configVals map[string]interface{}
+-		if err := json.Unmarshal(*configBytes, &configVals); err != nil {
++		decoder := json.NewDecoder(bytes.NewReader(*configBytes))
++		if disallowUnknownFields {
++			decoder.DisallowUnknownFields()
++		}
++		if err := decoder.Decode(&configVals); err != nil {
+ 			return err
+ 		}
+ 
+@@ -166,8 +171,14 @@ func mergeVCSConfigs(cfg *Config) error {
+ 		var repoVals map[string]interface{}
+ 		if len(repoBytes) == 0 {
+ 			repoVals = make(map[string]interface{}, len(globalVals))
+-		} else if err := json.Unmarshal(repoBytes, &repoVals); err != nil {
+-			return err
++		} else {
++			decoder := json.NewDecoder(bytes.NewReader(repoBytes))
++			if disallowUnknownFields {
++				decoder.DisallowUnknownFields()
++			}
++			if err := decoder.Decode(&repoVals); err != nil {
++				return err
++			}
+ 		}
+ 
+ 		for name, val := range globalVals {
+@@ -188,14 +199,19 @@ func mergeVCSConfigs(cfg *Config) error {
+ 	return nil
+ }
+ 
+-func (c *Config) LoadFromFile(filename string) error {
++func (c *Config) LoadFromFile(filename string, disallowUnknownFields bool) error {
+ 	r, err := os.Open(filename)
+ 	if err != nil {
+ 		return err
+ 	}
+ 	defer r.Close()
+ 
+-	if err := json.NewDecoder(r).Decode(c); err != nil {
++	decoder := json.NewDecoder(r)
++	if disallowUnknownFields {
++		decoder.DisallowUnknownFields()
++	}
++
++	if err := decoder.Decode(c); err != nil {
+ 		return err
+ 	}
+ 
+@@ -216,7 +232,7 @@ func (c *Config) LoadFromFile(filename string) error {
+ 		initRepo(repo)
+ 	}
+ 
+-	return initConfig(c)
++	return initConfig(c, disallowUnknownFields)
+ }
+ 
+ func (c *Config) ToJsonString() (string, error) {
+diff --git a/config/config_test.go b/config/config_test.go
+index 5b3328af..fab21e97 100644
+--- a/config/config_test.go
++++ b/config/config_test.go
+@@ -20,7 +20,7 @@ func rootDir() string {
+ // add examples, we don't muck them up.
+ func TestExampleConfigsAreValid(t *testing.T) {
+ 	var cfg Config
+-	if err := cfg.LoadFromFile(filepath.Join(rootDir(), exampleConfigFile)); err != nil {
++	if err := cfg.LoadFromFile(filepath.Join(rootDir(), exampleConfigFile), true); err != nil {
+ 		t.Fatalf("Unable to parse %s: %s", exampleConfigFile, err)
+ 	}
+ 
+@@ -30,7 +30,7 @@ func TestExampleConfigsAreValid(t *testing.T) {
+ 
+ 	// Ensure that each of the declared vcs's are legit
+ 	for _, repo := range cfg.Repos {
+-		_, err := vcs.New(repo.Vcs, repo.VcsConfig())
++		_, err := vcs.New(repo.Vcs, repo.VcsConfig(), true)
+ 		if err != nil {
+ 			t.Fatal(err)
+ 		}
+@@ -40,7 +40,7 @@ func TestExampleConfigsAreValid(t *testing.T) {
+ 	repo := cfg.Repos["SomeGitRepo"]
+ 	vcsConfigBytes := repo.VcsConfig()
+ 	var vcsConfigVals map[string]interface{}
+-	json.Unmarshal(vcsConfigBytes, &vcsConfigVals)  //nolint
++	json.Unmarshal(vcsConfigBytes, &vcsConfigVals) //nolint
+ 	if detectRef, ok := vcsConfigVals["detect-ref"]; !ok || !detectRef.(bool) {
+ 		t.Error("global detectRef vcs config setting not set for repo")
+ 	}
+@@ -51,9 +51,9 @@ func TestExampleConfigsAreValid(t *testing.T) {
+ 
+ 	repo = cfg.Repos["GitRepoWithDetectRefDisabled"]
+ 	vcsConfigBytes = repo.VcsConfig()
+-	json.Unmarshal(vcsConfigBytes, &vcsConfigVals)  //nolint
++	json.Unmarshal(vcsConfigBytes, &vcsConfigVals) //nolint
+ 	if detectRef, ok := vcsConfigVals["detect-ref"]; !ok || detectRef.(bool) {
+-		t.Error("global detectRef vcs config setting not overriden by repo-level setting")
++		t.Error("global detectRef vcs config setting not overridden by repo-level setting")
+ 	}
+
+ }
+diff --git a/searcher/searcher.go b/searcher/searcher.go
+index 791ce810..12234992 100644
+--- a/searcher/searcher.go
++++ b/searcher/searcher.go
+@@ -264,7 +264,7 @@ func reportOnMemory() {
+ // Utility function for producing a hex encoded sha1 hash for a string.
+ func hashFor(name string) string {
+ 	h := sha1.New()
+-	h.Write([]byte(name))  //nolint
++	h.Write([]byte(name)) //nolint
+ 	return hex.EncodeToString(h.Sum(nil))
+ }
+ 
+@@ -282,7 +282,7 @@ func init() {
+ // occurred and no other return values are valid. If an error occurs that is specific
+ // to a particular searcher, that searcher will not be present in the searcher map and
+ // will have an error entry in the error map.
+-func MakeAll(cfg *config.Config) (map[string]*Searcher, map[string]error, error) {
++func MakeAll(cfg *config.Config, disallowUnknownFields bool) (map[string]*Searcher, map[string]error, error) {
+ 	errs := map[string]error{}
+ 	searchers := map[string]*Searcher{}
+ 
+@@ -300,7 +300,7 @@ func MakeAll(cfg *config.Config) (map[string]*Searcher, map[string]error, error)
+ 	// Start new searchers for all repos in different go routines while
+ 	// respecting cfg.MaxConcurrentIndexers.
+ 	for name, repo := range cfg.Repos {
+-		go newSearcherConcurrent(cfg.DbPath, name, repo, refs, lim, resultCh)
++		go newSearcherConcurrent(cfg.DbPath, name, repo, refs, lim, disallowUnknownFields, resultCh)
+ 	}
+ 
+ 	// Collect the results on resultCh channel for all repos.
+@@ -320,6 +320,9 @@ func MakeAll(cfg *config.Config, disallowUnknownFields bool) (map[string]*Search
+ 
+ 	// after all the repos are in good shape, we start their polling
+ 	for _, s := range searchers {
++		if s == nil {
++			continue
++		}
+ 		s.begin()
+ 	}
+ 
+@@ -328,8 +328,8 @@ func MakeAll(cfg *config.Config) (map[string]*Searcher, map[string]error, error)
+
+ // Creates a new Searcher that is available for searches as soon as this returns.
+ // This will pull or clone the target repo and start watching the repo for changes.
+-func New(dbpath, name string, repo *config.Repo) (*Searcher, error) {
+-	s, err := newSearcher(dbpath, name, repo, &foundRefs{}, makeLimiter(1))
++func New(dbpath, name string, repo *config.Repo, disallowUnknownFields bool) (*Searcher, error) {
++	s, err := newSearcher(dbpath, name, repo, &foundRefs{}, makeLimiter(1), disallowUnknownFields)
+ 	if err != nil {
+ 		return nil, err
+ 	}
+@@ -396,17 +396,21 @@ func newSearcher(
+ 	dbpath, name string,
+ 	repo *config.Repo,
+ 	refs *foundRefs,
+-	lim limiter) (*Searcher, error) {
++	lim limiter,
++	disallowUnknownFields bool) (*Searcher, error) {
+ 
+ 	vcsDir := filepath.Join(dbpath, vcsDirFor(repo))
+ 
+ 	log.Printf("Searcher started for %s", name)
+ 
+-	wd, err := vcs.New(repo.Vcs, repo.VcsConfig())
++	wd, err := vcs.New(repo.Vcs, repo.VcsConfig(), disallowUnknownFields)
+ 	if err != nil {
+ 		return nil, err
+ 	}
+ 
++	if disallowUnknownFields {
++		return nil, nil
++	}
+ 
+ 	rev, err := wd.PullOrClone(vcsDir, repo.Url)
+ 	if err != nil {
+@@ -508,13 +512,14 @@ func newSearcherConcurrent(
+ 	repo *config.Repo,
+ 	refs *foundRefs,
+ 	lim limiter,
++	disallowUnknownFields bool,
+ 	resultCh chan searcherResult) {
+ 
+ 	// acquire a token from the rate limiter
+ 	lim.Acquire()
+ 	defer lim.Release()
+ 
+-	s, err := newSearcher(dbpath, name, repo, refs, lim)
++	s, err := newSearcher(dbpath, name, repo, refs, lim, disallowUnknownFields)
+ 	if err != nil {
+ 		resultCh <- searcherResult{
+ 			name: name,
+diff --git a/vcs/bzr.go b/vcs/bzr.go
+index 1797635d..0ef407c5 100644
+--- a/vcs/bzr.go
++++ b/vcs/bzr.go
+@@ -13,7 +13,7 @@ func init() {
+ 	Register(newBzr, "bzr")
+ }
+ 
+-func newBzr(b []byte) (Driver, error) {
++func newBzr(b []byte, disallowUnknownFields bool) (Driver, error) {
+ 	return &BzrDriver{}, nil
+ }
+ 
+diff --git a/vcs/git.go b/vcs/git.go
+index 54f1dfc5..6fdda644 100644
+--- a/vcs/git.go
++++ b/vcs/git.go
+@@ -34,11 +34,15 @@ type refDetetector interface {
+ type headBranchDetector struct {
+ }
+ 
+-func newGit(b []byte) (Driver, error) {
++func newGit(b []byte, disallowUnknownFields bool) (Driver, error) {
+ 	var d GitDriver
+ 
+ 	if b != nil {
+-		if err := json.Unmarshal(b, &d); err != nil {
++		decoder := json.NewDecoder(bytes.NewReader(b))
++		if disallowUnknownFields {
++			decoder.DisallowUnknownFields()
++		}
++		if err := decoder.Decode(&d); err != nil {
+ 			return nil, err
+ 		}
+ 	}
+diff --git a/vcs/hg.go b/vcs/hg.go
+index ac285836..7a7ec717 100644
+--- a/vcs/hg.go
++++ b/vcs/hg.go
+@@ -15,7 +15,7 @@ func init() {
+ 
+ type MercurialDriver struct{}
+ 
+-func newHg(b []byte) (Driver, error) {
++func newHg(b []byte, disallowUnknownFields bool) (Driver, error) {
+ 	return &MercurialDriver{}, nil
+ }
+
+diff --git a/vcs/svn.go b/vcs/svn.go
+index 0c8571a3..ad0cdced 100644
+--- a/vcs/svn.go
++++ b/vcs/svn.go
+@@ -19,11 +19,15 @@ type SVNDriver struct {
+ 	Password string `json:"password"`
+ }
+ 
+-func newSvn(b []byte) (Driver, error) {
++func newSvn(b []byte, disallowUnknownFields bool) (Driver, error) {
+ 	var d SVNDriver
+ 
+ 	if b != nil {
+-		if err := json.Unmarshal(b, &d); err != nil {
++		decoder := json.NewDecoder(bytes.NewReader(b))
++		if disallowUnknownFields {
++			decoder.DisallowUnknownFields()
++		}
++		if err := decoder.Decode(&d); err != nil {
+ 			return nil, err
+ 		}
+ 	}
+diff --git a/vcs/svn_test.go b/vcs/svn_test.go
+index fe836691..056f29b8 100644
+--- a/vcs/svn_test.go
++++ b/vcs/svn_test.go
+@@ -8,7 +8,7 @@
+ func TestSvnConfig(t *testing.T) {
+ 	cfg := `{"username" : "svn_username", "password" : "svn_password"}`
+ 
+-	d, err := New("svn", []byte(cfg))
++	d, err := New("svn", []byte(cfg), true)
+ 	if err != nil {
+ 		t.Fatal(err)
+ 	}
+diff --git a/vcs/vcs.go b/vcs/vcs.go
+index 26f0d4d8..2c730665 100644
+--- a/vcs/vcs.go
++++ b/vcs/vcs.go
+@@ -9,7 +9,7 @@
+ // A collection that maps vcs names to their underlying
+ // factory. A factory allows the vcs to have unserialized
+ // json config passed in to be parsed.
+-var drivers = make(map[string]func(c []byte) (Driver, error))
++var drivers = make(map[string]func(c []byte, disallowUnknownFields bool) (Driver, error))
+ 
+ // A "plugin" for each vcs that supports the very limited set of vcs
+ // operations that hound needs.
+@@ -39,7 +38,7 @@ type WorkDir struct {
+ }
+ 
+ // Register a new vcs driver under 1 or more names.
+-func Register(fn func(c []byte) (Driver, error), names ...string) {
++func Register(fn func(c []byte, disallowUnknownFields bool) (Driver, error), names ...string) {
+ 	if fn == nil {
+ 		log.Panic("vcs: cannot register nil factory")
+ 	}
+@@ -50,13 +49,13 @@ func Register(fn func(c []byte) (Driver, error), names ...string) {
+ }
+ 
+ // Create a new WorkDir from the name and configuration data.
+-func New(name string, cfg []byte) (*WorkDir, error) {
++func New(name string, cfg []byte, disallowUnknownFields bool) (*WorkDir, error) {
+ 	f := drivers[name]
+ 	if f == nil {
+ 		return nil, fmt.Errorf("vcs: %s is not a valid vcs driver.", name)
+ 	}
+ 
+-	d, err := f(cfg)
++	d, err := f(cfg, disallowUnknownFields)
+ 	if err != nil {
+ 		return nil, err
+ 	}
+diff --git a/vcs/vcs_test.go b/vcs/vcs_test.go
+index 5ef41e6b..009504db 100644
+--- a/vcs/vcs_test.go
++++ b/vcs/vcs_test.go
+@@ -8,8 +8,8 @@
+
+ // Just make sure all drivers are tolerant of nil
+ func TestNilConfigs(t *testing.T) {
+ 	for name, _ := range drivers {  //nolint
+-		d, err := New(name, nil)
++		d, err := New(name, nil, true)
+ 		if err != nil {
+ 			t.Fatal(err)
+ 		}

pkgs/by-name/ho/hound/package.nix

@@ -7,7 +7,6 @@
   git,
   openssh,
   nixosTests,
-  fetchpatch,
 }:
 
 buildGoModule (finalAttrs: {
@@ -23,15 +22,8 @@ buildGoModule (finalAttrs: {
 
   patches = [
     # add check config flag
-    # https://github.com/hound-search/hound/pull/485/files
-    (fetchpatch {
-      url = "https://github.com/MarcelCoding/hound/commit/b2f1cef335eff235394de336593687236a3b88bb.patch";
-      hash = "sha256-3+EBvnA8JIx2P6YM+8LpojDIX7hNXJ0vwVN4oSAouZ4=";
-    })
-    (fetchpatch {
-      url = "https://github.com/MarcelCoding/hound/commit/f917a457570ad8659d02fca4311cc91cadcadc00.patch";
-      hash = "sha256-CGvcIoSbgiayli5B8JRjvGfLuH2fscNpNTEm7xwkfpo=";
-    })
+    # https://github.com/hound-search/hound/pull/485
+    ./check-config-flag.diff
   ];
 
   vendorHash = "sha256-0psvz4bnhGuwwSAXvQp0ju0GebxoUyY2Rjp/D43KF78=";

pkgs/by-name/ig/igir/package.nix

@@ -18,16 +18,16 @@
 
 buildNpmPackage rec {
   pname = "igir";
-  version = "4.2.0";
+  version = "4.3.2";
 
   src = fetchFromGitHub {
     owner = "emmercm";
     repo = "igir";
     rev = "v${version}";
-    hash = "sha256-t0iGQC3U95707n4iVLbWynh3CadOPFKBEoXPg4rNjVo=";
+    hash = "sha256-I87Ssynu4kbJs7Ip23fwYTH5NCvoMWxxOU1STbLKVNM=";
   };
 
-  npmDepsHash = "sha256-qFgyqh3e2A6D+MaEUoV1jGRp1wJKvB8Dcr5XPrezlSk=";
+  npmDepsHash = "sha256-uWuuYU9eK8AFnxHeyFjXlgHFmI2TwVNKrM8vU4IBdjw=";
 
   # I have no clue why I have to do this
   postPatch = ''

pkgs/by-name/kl/klassy/package.nix

@@ -9,13 +9,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "klassy";
-  version = "6.5";
+  version = "6.5.3";
 
   src = fetchFromGitHub {
     owner = "paulmcauley";
     repo = "klassy";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zf+RO+GolA9Gnf1/izIG7jCSu8Qlo0d0kRc90llMRIc=";
+    hash = "sha256-2M1SGmYSEnZ1AlsOvhrM25oQi8mz/H8df4pzyFYybN8=";
   };
 
   nativeBuildInputs = [
@@ -54,7 +54,9 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "BUILD_QT5" false)
   ];
 
-  passthru.updateScript = gitUpdater { };
+  passthru.updateScript = gitUpdater {
+    rev-prefix = "v";
+  };
 
   meta = {
     description = "Highly customizable binary Window Decoration, Application Style and Global Theme plugin for recent versions of the KDE Plasma desktop";

pkgs/by-name/mi/mirrord/manifest.json

@@ -1,21 +1,21 @@
 {
-  "version": "3.191.0",
+  "version": "3.193.0",
   "assets": {
     "x86_64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.191.0/mirrord_linux_x86_64",
-      "hash": "sha256-2v3H+Hkf47k6b8I2YCtuhIhX06MtmjoG9DfaHtmYLV0="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.193.0/mirrord_linux_x86_64",
+      "hash": "sha256-IeOilRMOzEYXEF0qbAwTSr4Y6zIz8dIzCiTzE4VadxI="
     },
     "aarch64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.191.0/mirrord_linux_aarch64",
-      "hash": "sha256-3HT3SYpEsdgDSdoIlKcOWb31scMpsAl0oosHMQgIfGU="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.193.0/mirrord_linux_aarch64",
+      "hash": "sha256-LOLf1q7vA/SZvOIxj0mAYZrPwccuU90Shghkk94xxPo="
     },
     "aarch64-darwin": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.191.0/mirrord_mac_universal",
-      "hash": "sha256-SQrzND8ZRytbs4Nw87YEXTQfDOIWZFlvJw8SWdGXk5o="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.193.0/mirrord_mac_universal",
+      "hash": "sha256-oa5dJxSfZKaKub8WxuOZ8Nut1cIcvl3E/zT6xNQJy00="
     },
     "x86_64-darwin": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.191.0/mirrord_mac_universal",
-      "hash": "sha256-SQrzND8ZRytbs4Nw87YEXTQfDOIWZFlvJw8SWdGXk5o="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.193.0/mirrord_mac_universal",
+      "hash": "sha256-oa5dJxSfZKaKub8WxuOZ8Nut1cIcvl3E/zT6xNQJy00="
     }
   }
 }

pkgs/by-name/ne/nezha-agent/package.nix

@@ -8,16 +8,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "nezha-agent";
-  version = "1.15.0";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner = "nezhahq";
     repo = "agent";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zweSBpzyh8nbiiW4RgtiKN5zC54JjGBL8v+1l8S0bA8=";
+    hash = "sha256-edhRvK7Y+rb3vLfa11M0qv/6Iwh3J1i/wR1mQnQvoI0=";
   };
 
-  vendorHash = "sha256-d9FYXcVyWEA6HkHYG4mQzZXq0Btb9WgzEr+e99YofA4=";
+  vendorHash = "sha256-oWbmRpDX98ocSZMlj240lWd3cckrT1FFxP8WfB0yliY=";
 
   ldflags = [
     "-s"

pkgs/by-name/ne/nezha-theme-admin/package.nix

@@ -5,15 +5,15 @@
   nix-update-script,
 }:
 
-buildNpmPackage rec {
+buildNpmPackage (finalAttrs: {
   pname = "nezha-theme-admin";
-  version = "1.14.4";
+  version = "2.0.4";
 
   src = fetchFromGitHub {
     owner = "nezhahq";
     repo = "admin-frontend";
-    tag = "v${version}";
-    hash = "sha256-bQJGAw6q7yJoPDKOEqx35iTpyD/jGtATIjDi8C9D8dA=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-oZFIkeHkuSLlu++FwzCUet7tmBe5zhCP5MGHhU528DA=";
   };
 
   # TODO: Switch to the bun build function once available in nixpkgs
@@ -21,10 +21,8 @@ buildNpmPackage rec {
     cp ${./package-lock.json} package-lock.json
   '';
 
-  npmDepsHash = "sha256-ZXEBSrQsZ6e18LK/LFttEmZY4nK9+vrQ3ryw5xw/5YE=";
-
+  npmDepsHash = "sha256-2DkCVefxSfnlJkaEFZrjsWbwzddtqiNg1UUajRG5tLA=";
   npmPackFlags = [ "--ignore-scripts" ];
-
   npmBuildScript = "build-ignore-error";
 
   dontNpmInstall = true;
@@ -41,8 +39,8 @@ buildNpmPackage rec {
   meta = {
     description = "Nezha monitoring admin frontend";
     homepage = "https://github.com/nezhahq/admin-frontend";
-    changelog = "https://github.com/nezhahq/admin-frontend/releases/tag/v${version}";
+    changelog = "https://github.com/nezhahq/admin-frontend/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ moraxyc ];
   };
-}
+})

pkgs/by-name/ne/nezha-theme-user/package.nix

@@ -5,15 +5,15 @@
   nix-update-script,
 }:
 
-buildNpmPackage rec {
+buildNpmPackage (finalAttrs: {
   pname = "nezha-theme-user";
-  version = "1.32.0";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner = "hamster1963";
     repo = "nezha-dash-v1";
-    tag = "v${version}";
-    hash = "sha256-W3UnDDvzj5AWT8EQyNL7TtDxQlgQpfYeLZsvSCF/dGw=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-3zaA3T4zW18caOQe5DBF8Zsms3cjks3Ywyfkyk6N2N0=";
   };
 
   # TODO: Switch to the bun build function once available in nixpkgs
@@ -22,12 +22,12 @@ buildNpmPackage rec {
 
     # We cannot directly get the git commit hash from the tarball
     substituteInPlace vite.config.ts \
-      --replace-fail 'git rev-parse --short HEAD' 'echo refs/tags/v${version}'
+      --replace-fail 'git rev-parse --short HEAD' 'echo refs/tags/v${finalAttrs.version}'
     substituteInPlace src/components/Footer.tsx \
       --replace-fail '/commit/' '/tree/'
   '';
 
-  npmDepsHash = "sha256-nILKXXFOp+Ix6gYpCgcKpAPiLAV9sgMqZ+oTfWZhSIs=";
+  npmDepsHash = "sha256-hjVvp2dWBHqXrq/7+kLDmcUUrV15ln/8tNNqDmJ/Sh4=";
 
   npmPackFlags = [ "--ignore-scripts" ];
 
@@ -46,9 +46,9 @@ buildNpmPackage rec {
 
   meta = {
     description = "Nezha monitoring user frontend based on next.js";
-    changelog = "https://github.com/hamster1963/nezha-dash-v1/releases/tag/v${version}";
+    changelog = "https://github.com/hamster1963/nezha-dash-v1/releases/tag/v${finalAttrs.version}";
     homepage = "https://github.com/hamster1963/nezha-dash-v1";
     license = lib.licenses.apsl20;
     maintainers = with lib.maintainers; [ moraxyc ];
   };
-}
+})

pkgs/by-name/ne/nezha/package.nix

@@ -1,6 +1,6 @@
 {
   lib,
-  buildGoModule,
+  buildGo126Module,
   fetchFromGitHub,
   go-swag,
   versionCheckHook,
@@ -46,15 +46,15 @@ let
     in
     (formats.yaml { }).generate "frontend-templates.yaml" (officialThemes ++ communityThemes);
 in
-buildGoModule (finalAttrs: {
+buildGo126Module (finalAttrs: {
   pname = "nezha";
-  version = "1.14.14";
+  version = "2.0.4";
 
   src = fetchFromGitHub {
     owner = "nezhahq";
     repo = "nezha";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-F6M/bpuupQDDxKrafWlB3vk6iKf1QfJU1x0p3MAzzhM=";
+    hash = "sha256-JzdjIAeWswW/6ZnwfRZAexzl/ehvzKmyiNyzCHBDqgA=";
   };
 
   proxyVendor = true;
@@ -90,11 +90,11 @@ buildGoModule (finalAttrs: {
   nativeBuildInputs = [ go-swag ];
 
   # Generate code for Swagger documentation endpoints (see cmd/dashboard/docs).
-  preBuild = ''
-    GOROOT=''${GOROOT-$(go env GOROOT)} swag init --pd -d . -g ./cmd/dashboard/main.go -o ./cmd/dashboard/docs --parseGoList=false
+  postConfigure = ''
+    GOROOT=''${GOROOT-$(go env GOROOT)} swag init --pd -d cmd/dashboard -g main.go -o cmd/dashboard/docs
   '';
 
-  vendorHash = "sha256-9vJzQqXkoENRapcHp/afSCcdOrt8bxrIyJT/cBeas+A=";
+  vendorHash = "sha256-k1Xcmsx1QnkDCmSijtdG+rB34L6d1AbNLuU14zWTDhY=";
 
   ldflags = [
     "-s"

pkgs/by-name/nf/nfs-utils/package.nix

@@ -40,11 +40,11 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nfs-utils";
-  version = "2.8.5";
+  version = "2.8.6";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/nfs-utils/${finalAttrs.version}/nfs-utils-${finalAttrs.version}.tar.xz";
-    hash = "sha256-sTykqd9EGGvb4QdRSyJzLUJD94X5Xa8vuGr8HtuhW7s=";
+    hash = "sha256-K9ezToCafv8vS8X8X9luvNZqVFi0caJwy9LcFpsBFVA=";
   };
 
   # libnfsidmap is built together with nfs-utils from the same source,

pkgs/by-name/oa/oathkeeper/package.nix

@@ -32,15 +32,18 @@ buildGoModule {
   ldflags = [
     "-s"
     "-w"
-    "-X github.com/ory/oathkeeper/internal/driver/config.Version=${version}"
-    "-X github.com/ory/oathkeeper/internal/driver/config.Commit=${commit}"
+    "-X github.com/ory/oathkeeper/x.Version=${version}"
+    "-X github.com/ory/oathkeeper/x.Commit=${commit}"
   ];
 
   meta = {
     description = "Open-source identity and access proxy that authorizes HTTP requests based on sets of rules";
     homepage = "https://www.ory.sh/oathkeeper/";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ camcalaquian ];
+    maintainers = with lib.maintainers; [
+      camcalaquian
+      debtquity
+    ];
     mainProgram = "oathkeeper";
   };
 }

pkgs/by-name/op/opensmtpd-filter-dkimsign/package.nix

@@ -29,6 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
     "HAVE_ED25519=1"
     "DESTDIR=$(out)"
     "LOCALBASE="
+    "BINDIR=/libexec/smtpd/"
   ];
 
   meta = {

pkgs/by-name/sl/sledtool/package.nix

@@ -0,0 +1,31 @@
+{
+  fetchFromGitHub,
+  rustPlatform,
+  lib,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "sledtool";
+  version = "0.1.3";
+
+  cargoHash = "sha256-BrI4Xq3Kuj06aPKSXNhCKCWZurO1npIsbBil3MrbQfk=";
+
+  src = fetchFromGitHub {
+    owner = "vi";
+    repo = "sledtool";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-8D1zrRecU3s4EWKRAnnQ8Ga/kvKR0TCG6agoBCw+bEI=";
+  };
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    mainProgram = "sledtool";
+    description = "CLI tool to work with Sled key-value databases";
+    homepage = "https://github.com/vi/sledtool";
+    changelog = "https://github.com/vi/sledtool/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ cilki ];
+  };
+})

pkgs/by-name/sl/slimevr/package.nix

@@ -22,13 +22,13 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "slimevr";
-  version = "18.1.0";
+  version = "18.2.0";
 
   src = fetchFromGitHub {
     owner = "SlimeVR";
     repo = "SlimeVR-Server";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vU/dcKRlNsixr3TaCrqNkCd2ewAb38fLymb+ZslAum4=";
+    hash = "sha256-7QU+xQ72t722DOhrurI1XXpILLNnk8lE0yrD1P5XJbA=";
     # solarxr
     fetchSubmodules = true;
   };

pkgs/by-name/sl/slskd/package.nix

@@ -19,13 +19,13 @@ let
 in
 buildDotnetModule rec {
   pname = "slskd";
-  version = "0.24.4";
+  version = "0.24.5";
 
   src = fetchFromGitHub {
     owner = "slskd";
     repo = "slskd";
     tag = version;
-    hash = "sha256-TMi4RG5hdd2zR2d5O6zwxifd3zcEqSiqsuz16yyrH38=";
+    hash = "sha256-B0LAd9Fn1E5heGPk5dd7DoHWreHRxe42Xew5PmLId7g=";
   };
 
   nativeBuildInputs = [
@@ -40,7 +40,7 @@ buildDotnetModule rec {
     name = "${pname}-${version}-npm-deps";
     inherit src;
     sourceRoot = "${src.name}/${npmRoot}";
-    hash = "sha256-w2+O8Kx1nYyLbhnFovfHZSBVCPY0eDvdUoLO9cYnVY0=";
+    hash = "sha256-hmN91Y9ePJ7ZUyQX8jJbOgf0SuhsgmhO1ifi4sWhPUM=";
   };
 
   projectFile = "slskd.sln";

pkgs/by-name/sp/sparkle/package.nix

@@ -0,0 +1,149 @@
+{
+  lib,
+  stdenvNoCC,
+  buildGoModule,
+  fetchFromGitHub,
+  pnpm_10,
+  pnpm ? pnpm_10,
+  fetchPnpmDeps,
+  pnpmConfigHook,
+  nodejs,
+  makeWrapper,
+  electron,
+  dbip-asn-lite,
+  dbip-country-lite,
+  v2ray-geoip,
+  v2ray-domain-list-community,
+  sub-store,
+  sub-store-frontend,
+  mihomo,
+  copyDesktopItems,
+  makeDesktopItem,
+  nix-update-script,
+}:
+
+let
+  sparkle-service = buildGoModule {
+    pname = "sparkle-service";
+    version = "0-unstable-2025-10-24";
+
+    src = fetchFromGitHub {
+      owner = "xishang0128";
+      repo = "sparkle-service";
+      rev = "fb7006438d6335c7ee9fbf4530b1821428385cab";
+      hash = "sha256-V1HwYbdUunLTWFhfW7EHDDkIQyKFq2mbUysndttIlTE=";
+    };
+
+    vendorHash = "sha256-1n4CJT7zh6uxg6fGAVQz/KVKqXelFoTtETFPARcbPb8=";
+
+    meta.mainProgram = "sparkle-service";
+  };
+in
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "sparkle";
+  version = "1.26.2";
+
+  src = fetchFromGitHub {
+    owner = "xishang0128";
+    repo = "sparkle";
+    tag = finalAttrs.version;
+    hash = "sha256-6/VdWVobiBjjggC215g/zZmVAx1EzGbPE6+xp6ekcJw=";
+  };
+
+  pnpmDeps = fetchPnpmDeps {
+    inherit (finalAttrs) pname version src;
+    inherit pnpm;
+    fetcherVersion = 3;
+    hash = "sha256-P0KwmLwj1FIWBduT2DzOaRCYrbQ+kvcCdCgabAhmMm8=";
+  };
+
+  nativeBuildInputs = [
+    pnpmConfigHook
+    pnpm
+    nodejs
+    makeWrapper
+    copyDesktopItems
+  ];
+
+  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+
+  # workaround for https://github.com/electron/electron/issues/31121
+  postPatch = ''
+    sed -i "s#process\.resourcesPath#'$out/lib/sparkle/resources'#g" \
+      src/main/utils/dirs.ts
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    npm exec electron-vite -- build
+    npm exec electron-builder -- \
+      --dir \
+      -c.electronDist=${electron.dist} \
+      -c.electronVersion=${electron.version}
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib/sparkle
+    cp -r dist/*-unpacked/{locales,resources{,.pak}} $out/lib/sparkle/
+
+    install -D resources/icon.png $out/share/icons/hicolor/512x512/apps/sparkle.png
+
+    mkdir -p $out/lib/sparkle/resources/{files,sidecar}
+    ln -s ${sub-store-frontend} $out/lib/sparkle/resources/files/sub-store-frontend
+    ln -s ${sub-store}/share/sub-store/sub-store.bundle.js $out/lib/sparkle/resources/files/sub-store.bundle.js
+    ln -s ${dbip-asn-lite.mmdb} $out/lib/sparkle/resources/files/ASN.mmdb
+    ln -s ${dbip-country-lite.mmdb} $out/lib/sparkle/resources/files/country.mmdb
+    ln -s ${v2ray-geoip}/share/v2ray/geoip.dat $out/lib/sparkle/resources/files/geoip.dat
+    ln -s ${v2ray-domain-list-community}/share/v2ray/geosite.dat $out/lib/sparkle/resources/files/geosite.dat
+    ln -s ${lib.getExe sparkle-service} $out/lib/sparkle/resources/files/sparkle-service
+    ln -s ${lib.getExe mihomo} $out/lib/sparkle/resources/sidecar/mihomo
+
+    makeWrapper '${lib.getExe electron}' $out/bin/sparkle \
+      --add-flags $out/lib/sparkle/resources/app.asar \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true --wayland-text-input-version=3}}" \
+      --set-default ELECTRON_FORCE_IS_PACKAGED 1 \
+      --set-default ELECTRON_IS_DEV 0 \
+      --inherit-argv0
+
+    runHook postInstall
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "sparkle";
+      desktopName = "Sparkle";
+      exec = "sparkle %U";
+      terminal = false;
+      type = "Application";
+      icon = "sparkle";
+      startupWMClass = "sparkle";
+      comment = "Another Mihomo GUI";
+      categories = [
+        "Utility"
+        "Network"
+      ];
+      mimeTypes = [
+        "x-scheme-handler/clash"
+        "x-scheme-handler/mihomo"
+        "x-scheme-handler/sparkle"
+      ];
+    })
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Another Mihomo GUI";
+    homepage = "https://github.com/xishang0128/sparkle";
+    license = lib.licenses.gpl3Plus;
+    mainProgram = "sparkle";
+    maintainers = with lib.maintainers; [ chillcicada ];
+    platforms = lib.platforms.linux;
+  };
+})

pkgs/by-name/to/tombi/package.nix

@@ -9,19 +9,19 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tombi";
-  version = "0.7.33";
+  version = "0.9.2";
 
   src = fetchFromGitHub {
     owner = "tombi-toml";
     repo = "tombi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-MNzz4mgHiKdmrkKwh2E6XlQK2jelEnjoFHolpZJxjw0=";
+    hash = "sha256-K3kdIGOUADliz0X2UMwFpzOnQ9/q0HnmHCz45A2Zi8w=";
   };
 
   # Tests relies on the presence of network
   doCheck = false;
   cargoBuildFlags = [ "--package tombi-cli" ];
-  cargoHash = "sha256-5EZNL5aBdS+1TI4Gx2AQw6Di+5rYQBR3ukexSnFFIcs=";
+  cargoHash = "sha256-+MKyDJIbPyfnQPJV3pM+USdMrxIgloTGbSwpi1R+eTg=";
 
   postPatch = ''
     substituteInPlace Cargo.toml \

pkgs/by-name/za/zammad/package.nix

@@ -13,7 +13,7 @@
   jq,
   moreutils,
   nodejs,
-  pnpm_9,
+  pnpm_10,
   fetchPnpmDeps,
   pnpmConfigHook,
   cacert,
@@ -23,18 +23,12 @@
 
 let
   pname = "zammad";
-  version = "6.5.2";
+  version = "7.0.0";
 
   src = applyPatches {
     src = fetchFromGitHub (lib.importJSON ./source.json);
     patches = [
       ./fix-sendmail-location.diff
-      # Fix mail fetch failing with OpenSSL 3.6
-      # https://github.com/zammad/zammad/pull/5888
-      (fetchpatch {
-        url = "https://github.com/zammad/zammad/commit/01376d45f48df057e4377518e6f7e4a0db7de624.patch";
-        hash = "sha256-uH1/t0dP5nvh12GsJz6Yf/RXpf8+hkYoVJnLJAXqpuc=";
-      })
     ];
 
     postPatch = ''
@@ -80,7 +74,7 @@ stdenvNoCC.mkDerivation {
     valkey
     postgresql
     pnpmConfigHook
-    pnpm_9
+    pnpm_10
     nodejs
     procps
     cacert
@@ -90,10 +84,10 @@ stdenvNoCC.mkDerivation {
 
   pnpmDeps = fetchPnpmDeps {
     inherit pname src;
-    pnpm = pnpm_9;
+    pnpm = pnpm_10;
 
-    fetcherVersion = 1;
-    hash = "sha256-mfdzb/LXQYL8kaQpWi9wD3OOroOOonDlJrhy9Dwl1no";
+    fetcherVersion = 3;
+    hash = "sha256-oqVlhOzkqv+2mj/nDUR/PBXkRy5O7gtx2msEchGywfo=";
   };
 
   buildPhase = ''
@@ -150,6 +144,7 @@ stdenvNoCC.mkDerivation {
     maintainers = with lib.maintainers; [
       taeer
       netali
+      meenzen
     ];
   };
 }

pkgs/by-name/za/zammad/source.json

@@ -1,8 +1,8 @@
 {
   "owner": "zammad",
   "repo": "zammad",
-  "rev": "700e2fa128e3778783d3d299e20fae6c84a43537",
-  "hash": "sha256-MeH9xe/wjmc6wHp71z+VH5twQbrjBvobu9zltgXeVJ8=",
+  "rev": "f3228274c4feefac470d7efad12f240debd678bc",
+  "hash": "sha256-rMb8/owMhcxzFwN5yZ0t3ABtfPTrUd5CzDm1QwQOvek=",
   "fetchSubmodules": true
 }
 

pkgs/development/cuda-modules/packages/nccl-tests.nix

@@ -30,13 +30,13 @@ backendStdenv.mkDerivation (finalAttrs: {
   # NOTE: Depends on the CUDA package set, so use cudaNamePrefix.
   name = "${cudaNamePrefix}-${finalAttrs.pname}-${finalAttrs.version}";
   pname = "nccl-tests";
-  version = "2.17.9";
+  version = "2.17.10";
 
   src = fetchFromGitHub {
     owner = "NVIDIA";
     repo = "nccl-tests";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ldGhYc5oGlPBNwyksATH2RXXLIdlvNNeobRwPlmFjA8=";
+    hash = "sha256-FXeEoJGTEJ942qKURvwWNc55Bx6b5Xeg8LP3LddkawM=";
   };
 
   postPatch = ''

pkgs/development/python-modules/django-tasks/default.nix

@@ -3,12 +3,20 @@
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
+
+  # build-system
   setuptools,
+
+  # dependencies
   django,
   django-stubs-ext,
   typing-extensions,
+
+  # optional-dependencies
   mysqlclient,
   psycopg,
+
+  # tests
   dj-database-url,
   django-rq,
   fakeredis,
@@ -17,16 +25,16 @@
   redisTestHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "django-tasks";
-  version = "0.11.0";
+  version = "0.12.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "RealOrangeOne";
     repo = "django-tasks";
-    tag = version;
-    hash = "sha256-WU2TQa4FMEqtNtetH4qAyXqkrP/9PTw/K63MfUWEWGw=";
+    tag = finalAttrs.version;
+    hash = "sha256-pAVpsQXoiqneQaXrHNbBW7LumyYeJ4/9b0dg2qx7LZo=";
   };
 
   build-system = [
@@ -84,8 +92,8 @@ buildPythonPackage rec {
   meta = {
     description = "Reference implementation and backport of background workers and tasks in Django";
     homepage = "https://github.com/RealOrangeOne/django-tasks";
-    changelog = "https://github.com/RealOrangeOne/django-tasks/releases/tag/${src.tag}";
+    changelog = "https://github.com/RealOrangeOne/django-tasks/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ GaetanLepage ];
   };
-}
+})

pkgs/development/python-modules/hypothesis/hypothesis_6_136.nix

@@ -0,0 +1,151 @@
+{
+  lib,
+  buildPythonPackage,
+  isPyPy,
+  fetchFromGitHub,
+  setuptools,
+  attrs,
+  exceptiongroup,
+  pexpect,
+  doCheck ? true,
+  pytestCheckHook,
+  pytest-xdist,
+  sortedcontainers,
+  pythonAtLeast,
+  pythonOlder,
+  tzdata,
+}:
+
+buildPythonPackage rec {
+  pname = "hypothesis";
+  version = "6.136.9";
+  pyproject = true;
+
+  disabled = pythonOlder "3.9";
+
+  src = fetchFromGitHub {
+    owner = "HypothesisWorks";
+    repo = "hypothesis";
+    tag = "hypothesis-python-${version}";
+    hash = "sha256-Q1wxIJwAYKZ0x6c85CJSGgcdKw9a3xFw8YpJROElSNU=";
+  };
+
+  # I tried to package sphinx-selective-exclude, but it throws
+  # error about "module 'sphinx' has no attribute 'directives'".
+  #
+  # It probably has to do with monkey-patching internals of Sphinx.
+  # On bright side, this extension does not introduces new commands,
+  # only changes "::only" command, so we probably okay with stock
+  # implementation.
+  #
+  # I wonder how upstream of "hypothesis" builds documentation.
+  postPatch = ''
+    sed -i -e '/sphinx_selective_exclude.eager_only/ d' docs/conf.py
+  '';
+
+  postUnpack = "sourceRoot=$sourceRoot/hypothesis-python";
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    attrs
+    sortedcontainers
+  ]
+  ++ lib.optionals (pythonOlder "3.11") [ exceptiongroup ];
+
+  nativeCheckInputs = [
+    pexpect
+    pytest-xdist
+    pytestCheckHook
+  ]
+  ++ lib.optionals isPyPy [ tzdata ];
+
+  inherit doCheck;
+
+  # tox.ini changes how pytest runs and breaks it.
+  # Activate the CI profile (similar to setupHook below)
+  # by setting HYPOTHESIS_PROFILE [1].
+  #
+  # [1]: https://github.com/HypothesisWorks/hypothesis/blob/hypothesis-python-6.130.9/hypothesis-python/tests/common/setup.py#L78
+  preCheck = ''
+    rm tox.ini
+    export HYPOTHESIS_PROFILE=ci
+  '';
+
+  enabledTestPaths = [ "tests/cover" ];
+
+  # Hypothesis by default activates several "Health Checks", including one that fires if the builder is "too slow".
+  # This check is disabled [1] if Hypothesis detects a CI environment, i.e. either `CI` or `TF_BUILD` is defined [2].
+  # We set `CI=1` here using a setup hook to avoid spurious failures [3].
+  #
+  # Example error message for reference:
+  # hypothesis.errors.FailedHealthCheck: Data generation is extremely slow: Only produced 2 valid examples in 1.28 seconds (1 invalid ones and 0 exceeded maximum size). Try decreasing size of the data you're generating (with e.g. max_size or max_leaves parameters).
+  #
+  # [1]: https://github.com/HypothesisWorks/hypothesis/blob/hypothesis-python-6.130.9/hypothesis-python/src/hypothesis/_settings.py#L816-L828
+  # [2]: https://github.com/HypothesisWorks/hypothesis/blob/hypothesis-python-6.130.9/hypothesis-python/src/hypothesis/_settings.py#L756
+  # [3]: https://github.com/NixOS/nixpkgs/issues/393637
+  setupHook = ./setup-hook.sh;
+
+  disabledTests = [
+    # racy, fails to find a file sometimes
+    "test_recreate_charmap"
+    "test_uses_cached_charmap"
+    # fail when using CI profile
+    "test_given_does_not_pollute_state"
+    "test_find_does_not_pollute_state"
+    "test_does_print_on_reuse_from_database"
+    "test_prints_seed_only_on_healthcheck"
+    # calls script with the naked interpreter
+    "test_constants_from_running_file"
+  ]
+  ++ lib.optionals (pythonOlder "3.10") [
+    # not sure why these tests fail with only 3.9
+    # FileNotFoundError: [Errno 2] No such file or directory: 'git'
+    "test_observability"
+    "test_assume_has_status_reason"
+    "test_observability_captures_stateful_reprs"
+  ]
+  ++ lib.optionals (pythonAtLeast "3.12") [
+    # AssertionError: assert [b'def      \...   f(): pass'] == [b'def\\', b'    f(): pass']
+    # https://github.com/HypothesisWorks/hypothesis/issues/4355
+    "test_clean_source"
+  ]
+  ++ lib.optionals (pythonAtLeast "3.14") [
+    "test_attrs_inference_builds"
+    "test_bound_missing_dot_access_forward_ref"
+    "test_bound_missing_forward_ref"
+    "test_bound_type_checking_only_forward_ref_wrong_type"
+    "test_bound_type_cheking_only_forward_ref"
+    "test_builds_suggests_from_type"
+    "test_bytestring_not_treated_as_generic_sequence"
+    "test_evil_prng_registration_nonsense"
+    "test_issue_4194_regression"
+    "test_passing_referenced_instance_within_function_scope_warns"
+    "test_registering_a_Random_is_idempotent"
+    "test_register_random_within_nested_function_scope"
+    "test_resolve_fwd_refs"
+    "test_resolves_forwardrefs_to_builtin_types"
+    "test_resolving_standard_collection_as_generic"
+    "test_resolving_standard_container_as_generic"
+    "test_resolving_standard_contextmanager_as_generic"
+    "test_resolving_standard_iterable_as_generic"
+    "test_resolving_standard_reversible_as_generic"
+    "test_resolving_standard_sequence_as_generic"
+    "test_specialised_collection_types"
+  ];
+
+  pythonImportsCheck = [ "hypothesis" ];
+
+  meta = {
+    description = "Library for property based testing";
+    mainProgram = "hypothesis";
+    homepage = "https://github.com/HypothesisWorks/hypothesis";
+    changelog = "https://hypothesis.readthedocs.io/en/latest/changes.html#v${
+      lib.replaceStrings [ "." ] [ "-" ] version
+    }";
+    license = lib.licenses.mpl20;
+    maintainers = [
+      lib.maintainers.fliegendewurst
+    ];
+  };
+}

pkgs/development/python-modules/modelsearch/default.nix

@@ -35,6 +35,9 @@ buildPythonPackage (finalAttrs: {
     setuptools
   ];
 
+  pythonRelaxDeps = [
+    "django-tasks"
+  ];
   dependencies = [
     django
     django-tasks

pkgs/development/python-modules/panel/default.nix

@@ -4,9 +4,14 @@
   fetchPypi,
   bleach,
   bokeh,
+  linkify-it-py,
+  markdown,
+  markdown-it-py,
+  mdit-py-plugins,
+  narwhals,
+  pandas,
   param,
   pyviz-comms,
-  markdown,
   pyct,
   requests,
   setuptools,
@@ -36,7 +41,12 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     bleach
     bokeh
+    linkify-it-py
     markdown
+    markdown-it-py
+    mdit-py-plugins
+    narwhals
+    pandas
     param
     pyct
     pyviz-comms
@@ -57,6 +67,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/holoviz/panel";
     changelog = "https://github.com/holoviz/panel/releases/tag/v${version}";
     license = lib.licenses.bsd3;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ locnide ];
   };
 }

pkgs/development/python-modules/postgrest/default.nix

@@ -1,61 +1,68 @@
 {
-  lib,
   buildPythonPackage,
   fetchFromGitHub,
-  deprecation,
-  h2,
+  lib,
+  uv-build,
   httpx,
-  poetry-core,
   pydantic,
+  yarl,
+  strenum,
+  deprecation,
+  pytest-asyncio,
+  pytest-cov-stub,
   pytestCheckHook,
-  pythonPackages,
+  unasync,
 }:
 
 buildPythonPackage rec {
   pname = "postgrest";
-  version = "1.1.1";
+  version = "2.28.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "supabase";
-    repo = "postgrest-py";
+    repo = "supabase-py";
     tag = "v${version}";
-    hash = "sha256-WTS8J8XhHPSe6N1reY3j2QYHaRY1goiVoqQCUKSgbVY=";
+    hash = "sha256-nK+IZRrKjNy84EC8krBvAZll5E0+jV3bLJh8qIVRElI=";
   };
 
-  build-system = [ poetry-core ];
+  sourceRoot = "${src.name}/src/postgrest";
+
+  build-system = [ uv-build ];
 
   dependencies = [
-    deprecation
     httpx
+    deprecation
     pydantic
-  ];
+    strenum
+    yarl
+  ]
+  ++ httpx.optional-dependencies.http2;
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail 'uv_build>=0.8.3,<0.9.0' 'uv_build>=0.8.3'
+  '';
 
   nativeCheckInputs = [
     pytestCheckHook
-    h2
-  ];
-
-  # Lots of tests fail without network access
-  disabledTestPaths = [
-    "tests/_async/test_client.py"
-    "tests/_async/test_filter_request_builder.py"
-    "tests/_async/test_filter_request_builder_integration.py"
-    "tests/_async/test_query_request_builder.py"
-    "tests/_async/test_request_builder.py"
-    "tests/_sync/test_filter_request_builder_integration.py"
-  ];
-  disabledTests = [
-    "test_params_purged_after_execute"
+    pytest-asyncio
+    pytest-cov-stub
+    unasync
   ];
 
   pythonImportsCheck = [ "postgrest" ];
 
+  disabledTestPaths = [
+    "tests/_sync/"
+    "tests/_async/"
+  ];
+
   meta = {
-    description = "PostgREST client for Python, provides an ORM interface to PostgREST";
-    homepage = "https://github.com/supabase/postgrest-py";
-    changelog = "https://github.com/supabase/postgrest-py/releases/tag/v${version}";
+    description = "Client library for Supabase Functions";
+    homepage = "https://github.com/supabase/supabase-py";
+    changelog = "https://github.com/supabase/supabase-py/blob/v${src.tag}/CHANGELOG.md";
+    maintainers = with lib.maintainers; [ macbucheron ];
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ jherland ];
   };
 }

pkgs/development/python-modules/realtime/default.nix

@@ -1,58 +1,65 @@
 {
-  lib,
   buildPythonPackage,
   fetchFromGitHub,
+  lib,
   poetry-core,
-  pydantic,
-  typing-extensions,
-  websockets,
   aiohttp,
+  websockets,
+  typing-extensions,
+  pydantic,
   pytest-asyncio,
-  pytestCheckHook,
+  pytest-cov-stub,
   python-dotenv,
+  pytestCheckHook,
+  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
-  pname = "realtime-py";
-  version = "2.7.0";
+  pname = "realtime";
+  version = "2.28.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "supabase";
-    repo = "realtime-py";
+    repo = "supabase-py";
     tag = "v${version}";
-    hash = "sha256-cWWgVs+ZNRvBje3kuDQS5L5utkY3z7MluGFNmjf9LFc=";
+    hash = "sha256-nK+IZRrKjNy84EC8krBvAZll5E0+jV3bLJh8qIVRElI=";
   };
 
+  sourceRoot = "${src.name}/src/realtime";
+
+  build-system = [ poetry-core ];
+
   dependencies = [
-    pydantic
-    typing-extensions
     websockets
+    typing-extensions
+    pydantic
   ];
 
-  pythonRelaxDeps = [
-    "websockets"
-  ];
+  nativeBuildInputs = [ pythonRelaxDepsHook ];
+
+  pythonRelaxDeps = [ "websockets" ];
 
   nativeCheckInputs = [
     aiohttp
-    pytest-asyncio
     pytestCheckHook
+    pytest-cov-stub
     python-dotenv
+    pytest-asyncio
   ];
 
   pythonImportsCheck = [ "realtime" ];
 
-  build-system = [ poetry-core ];
-
-  # requires running Supabase
-  doCheck = false;
+  disabledTestPaths = [
+    "tests/test_connection.py"
+    "tests/test_presence.py"
+  ];
 
   meta = {
-    changelog = "https://github.com/supabase/realtime-py/blob/${src.tag}/CHANGELOG.md";
-    homepage = "https://github.com/supabase/realtime-py";
-    license = lib.licenses.mit;
-    description = "Python Realtime Client for Supabase";
+    description = "Client library for Supabase Functions";
+    homepage = "https://github.com/supabase/supabase-py";
+    changelog = "https://github.com/supabase/supabase-py/blob/v${src.tag}/CHANGELOG.md";
     maintainers = with lib.maintainers; [ siegema ];
+    license = lib.licenses.mit;
   };
 }

pkgs/development/python-modules/returns/default.nix

@@ -4,7 +4,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   httpx,
-  hypothesis,
+  hypothesis_6_136,
   mypy,
   poetry-core,
   pytest-aio,
@@ -41,14 +41,7 @@ buildPythonPackage rec {
     anyio
     httpx
     # https://github.com/dry-python/returns/issues/2224
-    (hypothesis.overrideAttrs (old: {
-      src = fetchFromGitHub {
-        owner = "HypothesisWorks";
-        repo = "hypothesis";
-        tag = "hypothesis-python-6.136.9";
-        hash = "sha256-Q1wxIJwAYKZ0x6c85CJSGgcdKw9a3xFw8YpJROElSNU=";
-      };
-    }))
+    hypothesis_6_136
     mypy
     pytestCheckHook
     pytest-aio

pkgs/development/python-modules/storage3/default.nix

@@ -1,43 +1,68 @@
 {
-  lib,
   buildPythonPackage,
   fetchFromGitHub,
-  poetry-core,
-  python-dateutil,
+  lib,
+  uv-build,
   httpx,
-  h2,
+  pydantic,
+  yarl,
+  pyiceberg,
   deprecation,
+  pytest-asyncio,
+  pytest-cov-stub,
+  python-dotenv,
+  pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "storage3";
-  version = "0.12.2";
+  version = "2.28.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "supabase";
-    repo = "storage-py";
+    repo = "supabase-py";
     tag = "v${version}";
-    hash = "sha256-ACilbwSCNEsXyr2lUTkhOgfw/SiTnwj+rA07tnuFy5A=";
+    hash = "sha256-nK+IZRrKjNy84EC8krBvAZll5E0+jV3bLJh8qIVRElI=";
   };
 
-  dependencies = [
-    python-dateutil
-    httpx
-    h2
-    deprecation
-  ];
+  sourceRoot = "${src.name}/src/storage";
 
-  build-system = [ poetry-core ];
+  build-system = [ uv-build ];
+
+  dependencies = [
+    httpx
+    pydantic
+    yarl
+    pyiceberg
+    deprecation
+  ]
+  ++ httpx.optional-dependencies.http2;
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail 'uv_build>=0.8.3,<0.9.0' 'uv_build>=0.8.3'
+  '';
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-asyncio
+    pytest-cov-stub
+    python-dotenv
+  ];
 
   pythonImportsCheck = [ "storage3" ];
 
-  # tests fail due to mock server not starting
+  disabledTestPaths = [
+    "tests/_sync/"
+    "tests/_async/"
+  ];
 
   meta = {
-    homepage = "https://github.com/supabase/storage-py";
-    license = lib.licenses.mit;
-    description = "Supabase Storage client for Python.";
+    description = "Client library for Supabase Functions";
+    homepage = "https://github.com/supabase/supabase-py";
+    changelog = "https://github.com/supabase/supabase-py/blob/v${src.tag}/CHANGELOG.md";
     maintainers = with lib.maintainers; [ siegema ];
+    license = lib.licenses.mit;
   };
 }

pkgs/development/python-modules/supabase-auth/default.nix

@@ -0,0 +1,66 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  uv-build,
+  httpx,
+  pydantic,
+  pyjwt,
+  pytestCheckHook,
+  faker,
+  respx,
+  pytest-mock,
+  pytest-asyncio,
+}:
+buildPythonPackage rec {
+  pname = "supabase-auth";
+  version = "2.28.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "supabase";
+    repo = "supabase-py";
+    tag = "v${version}";
+    hash = "sha256-nK+IZRrKjNy84EC8krBvAZll5E0+jV3bLJh8qIVRElI=";
+  };
+
+  sourceRoot = "${src.name}/src/auth";
+
+  build-system = [ uv-build ];
+
+  dependencies = [
+    httpx
+    pydantic
+    pyjwt
+  ]
+  ++ httpx.optional-dependencies.http2
+  ++ pyjwt.optional-dependencies.crypto;
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail 'uv_build>=0.8.3,<0.9.0' 'uv_build>=0.8.3'
+  '';
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    faker
+    respx
+    pytest-mock
+    pytest-asyncio
+  ];
+
+  disabledTestPaths = [
+    "tests/_sync/"
+    "tests/_async/"
+  ];
+
+  pythonImportsCheck = [ "supabase_auth" ];
+
+  meta = {
+    description = "Client library for Supabase Auth";
+    homepage = "https://github.com/supabase/supabase-py/";
+    changelog = "https://github.com/supabase/supabase-py/blob/v${src.tag}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ macbucheron ];
+  };
+}

pkgs/development/python-modules/supabase-functions/default.nix

@@ -0,0 +1,60 @@
+{
+  buildPythonPackage,
+  fetchFromGitHub,
+  httpx,
+  lib,
+  pyjwt,
+  pytest-asyncio,
+  pytestCheckHook,
+  strenum,
+  uv-build,
+  yarl,
+}:
+
+buildPythonPackage rec {
+  pname = "supabase-functions";
+  version = "2.28.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "supabase";
+    repo = "supabase-py";
+    tag = "v${version}";
+    hash = "sha256-nK+IZRrKjNy84EC8krBvAZll5E0+jV3bLJh8qIVRElI=";
+  };
+
+  sourceRoot = "${src.name}/src/functions";
+
+  build-system = [ uv-build ];
+
+  dependencies = [
+    strenum
+    yarl
+    httpx
+  ]
+  ++ httpx.optional-dependencies.http2;
+
+  # Upstream pins `uv_build>=0.8.3,<0.9.0`, but nixpkgs ships `uv-build` 0.9.x.
+  # Relax the upper bound to accept the 0.9 series, consistent with uv’s documentation examples:
+  # https://docs.astral.sh/uv/concepts/build-backend/#using-the-uv-build-backend
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail 'uv_build>=0.8.3,<0.9.0' 'uv_build>=0.8.3'
+  '';
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pyjwt
+    pytest-asyncio
+  ];
+
+  pythonImportsCheck = [ "supabase_functions" ];
+
+  meta = {
+    description = "Client library for Supabase Functions";
+    homepage = "https://github.com/supabase/supabase-py";
+    changelog = "https://github.com/supabase/supabase-py/blob/v${src.tag}/CHANGELOG.md";
+    maintainers = with lib.maintainers; [ macbucheron ];
+    license = lib.licenses.mit;
+  };
+}

pkgs/development/python-modules/supabase/default.nix

@@ -2,50 +2,60 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  poetry-core,
-  gotrue,
-  postgrest,
+  uv-build,
   realtime,
-  storage3,
-  supafunc,
+  supabase-functions,
+  supabase-auth,
+  postgrest,
   httpx,
+  yarl,
+  storage3,
   pytestCheckHook,
   python-dotenv,
   pytest-asyncio,
+  pytest-cov-stub,
 }:
 
 buildPythonPackage rec {
   pname = "supabase";
-  version = "2.27.2";
+  version = "2.28.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "supabase";
     repo = "supabase-py";
     tag = "v${version}";
-    hash = "sha256-TRATa+lDRm2MDuARXfBRWnWYUak8i1fW7rr5ujWN8TY=";
+    hash = "sha256-nK+IZRrKjNy84EC8krBvAZll5E0+jV3bLJh8qIVRElI=";
   };
 
-  build-system = [ poetry-core ];
+  sourceRoot = "${src.name}/src/supabase";
 
-  # FIXME remove for supabase >= 2.18.0
-  pythonRelaxDeps = true;
+  build-system = [ uv-build ];
+
+  doCheck = true;
 
   dependencies = [
-    postgrest
     realtime
-    gotrue
+    supabase-auth
+    supabase-functions
+    postgrest
     httpx
+    yarl
     storage3
-    supafunc
   ];
 
   nativeBuildInputs = [
     pytestCheckHook
     python-dotenv
     pytest-asyncio
+    pytest-cov-stub
   ];
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail 'uv_build>=0.8.3,<0.9.0' 'uv_build>=0.8.3'
+  '';
+
   pythonImportsCheck = [ "supabase" ];
 
   meta = {

pkgs/development/python-modules/tesserocr/default.nix

@@ -22,21 +22,18 @@
 
 buildPythonPackage rec {
   pname = "tesserocr";
-  version = "2.9.2";
+  version = "2.8.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-L6H+PHlXXW/VtSd4Xnc/oZsFXwf5Iv6yrJ1sHmIjNSI=";
+    hash = "sha256-vlGNGxtf9UwRqtoeD9EpQlCepwWB4KizmipHOgstvTY=";
   };
 
   patches = [
-    # Fix a broken test. The issue has been reported upstream at
-    # https://github.com/sirfz/tesserocr/issues/363
-    # Check the status of the issue before removing this patch at the next
-    # update.
+    # Backport https://github.com/sirfz/tesserocr/pull/364 to fix tests
     (fetchpatch {
-      url = "https://github.com/sirfz/tesserocr/commit/78d9e8187bd4d282d572bd5221db2c69e560e017.patch";
+      url = "https://github.com/sirfz/tesserocr/commit/853a885d0154a0345e1ea7db80febe04893a3da8.patch";
       hash = "sha256-s51s9EIV9AZT6UoqwTuQ8lOjToqwIIUkDLjsvCsyYFU=";
     })
   ];

pkgs/development/python-modules/torchtitan/default.nix

@@ -0,0 +1,82 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  setuptools,
+
+  # dependencies
+  datasets,
+  einops,
+  fsspec,
+  pillow,
+  tensorboard,
+  tokenizers,
+  tomli,
+  torch,
+  torchdata,
+  transformers,
+  tyro,
+
+  # tests
+  pytestCheckHook,
+  tomli-w,
+  writableTmpDirAsHomeHook,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "torchtitan";
+  version = "0.2.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "pytorch";
+    repo = "torchtitan";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-YXbbqNjmPBIFDRbvagHRIy5ph1pZmSerUxlqaF6f4cY=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    datasets
+    einops
+    fsspec
+    pillow
+    tensorboard
+    tokenizers
+    tomli
+    torch
+    torchdata
+    tyro
+  ];
+
+  pythonImportsCheck = [ "torchtitan" ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    tomli-w
+    transformers
+    writableTmpDirAsHomeHook
+  ];
+
+  disabledTests = [
+    # Require internet access
+    "test_list_files"
+  ];
+
+  disabledTestPaths = [
+    # Require internet access
+    "tests/unit_tests/test_tokenizer.py"
+  ];
+
+  meta = {
+    description = "PyTorch native platform for training generative AI models";
+    homepage = "https://github.com/pytorch/torchtitan";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+  };
+})

pkgs/os-specific/linux/digimend/default.nix

@@ -17,6 +17,13 @@ stdenv.mkDerivation {
     hash = "sha256-5kJj3SJfzrQ3n9r1YOn5xt0KO9WcEf0YpNMjiZEYMEo=";
   };
 
+  patches = [
+    # `del_timer_sync` was renamed to `timer_delete_sync` in Linux 6.2.
+    # The `del_timer_sync` compatibility wrapper was removed in Linux 6.15.
+    # Upstream PR: https://github.com/DIGImend/digimend-kernel-drivers/pull/729
+    ./linux-6.15.patch
+  ];
+
   postPatch = ''
     sed 's/udevadm /true /' -i Makefile
     sed 's/depmod /true /' -i Makefile

pkgs/os-specific/linux/digimend/linux-6.15.patch

@@ -0,0 +1,34 @@
+From 011686d1018e18c7c5cf5c2468ac43f275ecec82 Mon Sep 17 00:00:00 2001
+From: Dominik Kummer <devel@arkades.org>
+Date: Sat, 14 Feb 2026 10:13:46 +0100
+Subject: [PATCH] add conditional function definition based on kernel version
+ for backwards compability
+
+---
+ hid-uclogic-core.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/hid-uclogic-core.c b/hid-uclogic-core.c
+index 72680dd..75e7882 100644
+--- a/hid-uclogic-core.c
++++ b/hid-uclogic-core.c
+@@ -25,6 +25,10 @@
+ #include "compat.h"
+ #include <linux/version.h>
+ 
++#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 1, 84)
++#define timer_delete_sync del_timer_sync
++#endif
++
+ /**
+  * uclogic_inrange_timeout - handle pen in-range state timeout.
+  * Emulate input events normally generated when pen goes out of range for
+@@ -491,7 +495,7 @@ static void uclogic_remove(struct hid_device *hdev)
+ {
+ 	struct uclogic_drvdata *drvdata = hid_get_drvdata(hdev);
+ 
+-	del_timer_sync(&drvdata->inrange_timer);
++	timer_delete_sync(&drvdata->inrange_timer);
+ 	hid_hw_stop(hdev);
+ 	kfree(drvdata->desc_ptr);
+ 	uclogic_params_cleanup(&drvdata->params);

pkgs/os-specific/linux/evdi/default.nix

@@ -17,13 +17,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "evdi";
-  version = "1.14.13";
+  version = "1.14.15";
 
   src = fetchFromGitHub {
     owner = "DisplayLink";
     repo = "evdi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-59Tr2l2RHOW/TMgSW0HY0l60L7mBZKmYyx/r+Y0NatQ=";
+    hash = "sha256-tms+UNws+oBmwLvDFaDSIa/bUdSpK+CADodbsip3tRg=";
   };
 
   prePatch = ''
@@ -33,7 +33,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   env.CFLAGS = toString [
     "-Wno-error"
-    "-Wno-error=discarded-qualifiers" # for Linux 4.19 compatibility
     "-Wno-error=sign-compare"
   ];
 
@@ -77,7 +76,8 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Extensible Virtual Display Interface";
     homepage = "https://www.displaylink.com/";
     license = with lib.licenses; [
-      lgpl21Only
+      mit
+      lgpl21Plus
       gpl2Only
     ];
     maintainers = [ ];

pkgs/os-specific/linux/nvidia-x11/default.nix

@@ -61,6 +61,11 @@ let
     stripLen = 1;
     extraPrefix = "kernel/";
   };
+
+  kernel_6_19_patch = fetchpatch {
+    url = "https://github.com/CachyOS/CachyOS-PKGBUILDS/raw/d5629d64ac1f9e298c503e407225b528760ffd37/nvidia/nvidia-utils/kernel-6.19.patch";
+    hash = "sha256-YuJjSUXE6jYSuZySYGnWSNG5sfVei7vvxDcHx3K+IN4=";
+  };
 in
 rec {
   mkDriver = generic;
@@ -87,6 +92,7 @@ rec {
     openSha256 = "sha256-hECHfguzwduEfPo5pCDjWE/MjtRDhINVr4b1awFdP44=";
     settingsSha256 = "sha256-NWsqUciPa4f1ZX6f0By3yScz3pqKJV1ei9GvOF8qIEE=";
     persistencedSha256 = "sha256-wsNeuw7IaY6Qc/i/AzT/4N82lPjkwfrhxidKWUtcwW8=";
+    patchesOpen = [ kernel_6_19_patch ];
   });
 
   beta = selectHighestVersion latest (generic {

pkgs/tools/package-management/nix-prefetch-scripts/default.nix

@@ -12,7 +12,7 @@
   findutils,
   fossil,
   gawk,
-  gitMinimal,
+  git,
   git-lfs,
   gnugrep,
   gnused,
@@ -77,7 +77,7 @@ rec {
   nix-prefetch-git = mkPrefetchScript "git" ../../../build-support/fetchgit/nix-prefetch-git [
     findutils
     gawk
-    gitMinimal
+    git
     git-lfs
     gnused
   ];

pkgs/top-level/aliases.nix

@@ -1824,7 +1824,6 @@ mapAliases {
   SPAdes = throw "'SPAdes' has been renamed to/replaced by 'spades'"; # Converted to throw 2025-10-27
   spago = spago-legacy; # Added 2025-09-23, pkgs.spago should become spago@next which hasn't been packaged yet
   spark2014 = throw "'spark2014' has been renamed to/replaced by 'gnatprove'"; # Converted to throw 2025-10-27
-  sparkle = throw "'sparkle' has been removed because upstream repository source code has been deleted"; # Added 2025-12-29
   spectrojack = throw "'spectrojack' was remove due to lack of upstream maintenance and relying on gtk2"; # Added 2025-12-02
   speed_dreams = speed-dreams; # Added 2026-01-19
   spidermonkey_91 = throw "'spidermonkey_91 is EOL since 2022/09"; # Added 2025-08-26

pkgs/top-level/python-packages.nix

@@ -7272,6 +7272,8 @@ self: super: with self; {
 
   hypothesis-auto = callPackage ../development/python-modules/hypothesis-auto { };
 
+  hypothesis_6_136 = callPackage ../development/python-modules/hypothesis/hypothesis_6_136.nix { };
+
   hypothesmith = callPackage ../development/python-modules/hypothesmith { };
 
   hyppo = callPackage ../development/python-modules/hyppo { };
@@ -18624,7 +18626,9 @@ self: super: with self; {
 
   supabase = callPackage ../development/python-modules/supabase { };
 
-  supabase-functions = self.supafunc;
+  supabase-auth = callPackage ../development/python-modules/supabase-auth { };
+
+  supabase-functions = callPackage ../development/python-modules/supabase-functions { };
 
   supafunc = callPackage ../development/python-modules/supafunc { };
 
@@ -19397,6 +19401,8 @@ self: super: with self; {
 
   torchsummary = callPackage ../development/python-modules/torchsummary { };
 
+  torchtitan = callPackage ../development/python-modules/torchtitan { };
+
   torchtnt = callPackage ../development/python-modules/torchtnt { };
 
   torchtune = callPackage ../development/python-modules/torchtune { };