Merge 92661251e0 into haskell-updates

.github/workflows/build.yml

@@ -3,6 +3,9 @@ name: Build
 on:
   workflow_call:
     inputs:
+      artifact-prefix:
+        required: true
+        type: string
       baseBranch:
         required: true
         type: string
@@ -100,5 +103,5 @@ jobs:
           contains(fromJSON(inputs.baseBranch).type, 'primary')
         uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
-          name: nixos-manual-${{ matrix.name }}
+          name: ${{ inputs.artifact-prefix }}nixos-manual-${{ matrix.name }}
           path: nixos-manual

.github/workflows/eval.yml

@@ -3,6 +3,9 @@ name: Eval
 on:
   workflow_call:
     inputs:
+      artifact-prefix:
+        required: true
+        type: string
       mergedSha:
         required: true
         type: string
@@ -110,7 +113,7 @@ jobs:
           MATRIX_SYSTEM: ${{ matrix.system }}
           MATRIX_VERSION: ${{ matrix.version || 'nixVersions.latest' }}
         run: |
-          nix-build nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned  -A eval.singleSystem \
+          nix-build nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A eval.singleSystem \
             --argstr evalSystem "$MATRIX_SYSTEM" \
             --arg chunkSize 8000 \
             --argstr nixPath "$MATRIX_VERSION" \
@@ -119,19 +122,29 @@ jobs:
           # Note: Keep the same further down in sync!
 
       - name: Evaluate the ${{ matrix.system }} output paths at the target commit
-        if: inputs.targetSha
         env:
           MATRIX_SYSTEM: ${{ matrix.system }}
-        # This is very quick, because it pulls the eval results from Cachix.
         run: |
-          nix-build nixpkgs/trusted/ci --arg nixpkgs ./nixpkgs/trusted-pinned -A eval.singleSystem \
+          TARGET_DRV=$(nix-instantiate nixpkgs/trusted/ci --arg nixpkgs ./nixpkgs/trusted-pinned -A eval.singleSystem \
             --argstr evalSystem "$MATRIX_SYSTEM" \
             --arg chunkSize 8000 \
-            --argstr nixPath "nixVersions.latest" \
-            --out-link target
+            --argstr nixPath "nixVersions.latest")
+
+          # Try to fetch this from Cachix a few times, for up to 30 seconds. This avoids running Eval
+          # twice in the Merge Queue, when a later item finishes Eval at the merge commit earlier.
+          for _i in {1..6}; do
+            # Using --max-jobs 0 will cause nix-build to fail if this can't be substituted from cachix.
+            if nix-build "$TARGET_DRV" --max-jobs 0; then
+              break
+            fi
+            sleep 5
+          done
+
+          # Either fetches from Cachix or runs Eval itself. The fallback is required
+          # for pull requests into wip-branches without merge queue.
+          nix-build "$TARGET_DRV" --out-link target
 
       - name: Compare outpaths against the target branch
-        if: inputs.targetSha
         env:
           MATRIX_SYSTEM: ${{ matrix.system }}
         run: |
@@ -142,16 +155,15 @@ jobs:
             --out-link diff
 
       - name: Upload outpaths diff and stats
-        if: inputs.targetSha
         uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
-          name: ${{ matrix.version && format('{0}-', matrix.version) || '' }}diff-${{ matrix.system }}
+          name: ${{ inputs.artifact-prefix }}${{ matrix.version && format('{0}-', matrix.version) || '' }}diff-${{ matrix.system }}
           path: diff/*
 
   compare:
     runs-on: ubuntu-24.04-arm
     needs: [eval]
-    if: inputs.targetSha && !cancelled() && !failure()
+    if: ${{ !cancelled() && !failure() }}
     permissions:
       statuses: write
     timeout-minutes: 5
@@ -169,7 +181,7 @@ jobs:
       - name: Download output paths and eval stats for all systems
         uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
         with:
-          pattern: diff-*
+          pattern: ${{ inputs.artifact-prefix }}diff-*
           path: diff
           merge-multiple: true
 
@@ -182,6 +194,12 @@ jobs:
             --arg diffDir ./diff \
             --out-link combined
 
+      - name: Upload the maintainer list
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        with:
+          name: ${{ inputs.artifact-prefix }}maintainers
+          path: combined/maintainers.json
+
       - name: Compare against the target branch
         env:
           AUTHOR_ID: ${{ github.event.pull_request.user.id }}
@@ -202,7 +220,7 @@ jobs:
       - name: Upload the comparison results
         uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
-          name: comparison
+          name: ${{ inputs.artifact-prefix }}comparison
           path: comparison/*
 
       - name: Add eval summary to commit statuses
@@ -250,6 +268,7 @@ jobs:
       - name: Add version comparison table to job summary
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
+          ARTIFACT_PREFIX: ${{ inputs.artifact-prefix }}
           SYSTEMS: ${{ inputs.systems }}
           VERSIONS: ${{ needs.versions.outputs.versions }}
         with:
@@ -257,6 +276,7 @@ jobs:
             const { readFileSync } = require('node:fs')
             const path = require('node:path')
 
+            const prefix = process.env.ARTIFACT_PREFIX
             const systems = JSON.parse(process.env.SYSTEMS)
             const versions = JSON.parse(process.env.VERSIONS)
 
@@ -272,7 +292,7 @@ jobs:
                   [{ data: version }].concat(
                     systems.map((system) => {
                       try {
-                        const artifact = path.join('versions', `${version}-diff-${system}`)
+                        const artifact = path.join('versions', `${prefix}${version}-diff-${system}`)
                         const time = Math.round(
                           parseFloat(
                             readFileSync(

.github/workflows/merge-group.yml

@@ -4,6 +4,9 @@ on:
   merge_group:
   workflow_call:
     inputs:
+      artifact-prefix:
+        required: true
+        type: string
       mergedSha:
         required: true
         type: string
@@ -54,7 +57,9 @@ jobs:
     secrets:
       CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
     with:
+      artifact-prefix: ${{ inputs.artifact-prefix }}
       mergedSha: ${{ inputs.mergedSha || github.event.merge_group.head_sha }}
+      targetSha: ${{ inputs.targetSha || github.event.merge_group.base_sha }}
       systems: ${{ needs.prepare.outputs.systems }}
 
   # This job's only purpose is to create the target for the "Required Status Checks" branch ruleset.

.github/workflows/pr.yml

@@ -3,6 +3,10 @@ name: PR
 on:
   pull_request_target:
   workflow_call:
+    inputs:
+      artifact-prefix:
+        required: true
+        type: string
     secrets:
       CACHIX_AUTH_TOKEN:
         required: true
@@ -42,6 +46,11 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           retries: 3
+          # The default for this includes code 422, which happens regularly for us when comparing commits:
+          #   422 - Server Error: Sorry, this diff is taking too long to generate.
+          # Listing all other values from here to effectively remove 422:
+          #   https://github.com/octokit/plugin-retry.js/blob/9a2443746c350b3beedec35cf26e197ea318a261/src/index.ts#L14
+          retry-exempt-status-codes: 400,401,403,404
           script: |
             require('./ci/github-script/prepare.js')({
               github,
@@ -85,6 +94,7 @@ jobs:
     secrets:
       CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
     with:
+      artifact-prefix: ${{ inputs.artifact-prefix }}
       mergedSha: ${{ needs.prepare.outputs.mergedSha }}
       targetSha: ${{ needs.prepare.outputs.targetSha }}
       systems: ${{ needs.prepare.outputs.systems }}
@@ -111,6 +121,8 @@ jobs:
     uses: ./.github/workflows/reviewers.yml
     secrets:
       OWNER_APP_PRIVATE_KEY: ${{ secrets.OWNER_APP_PRIVATE_KEY }}
+    with:
+      artifact-prefix: ${{ inputs.artifact-prefix }}
 
   build:
     name: Build
@@ -119,6 +131,7 @@ jobs:
     secrets:
       CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
     with:
+      artifact-prefix: ${{ inputs.artifact-prefix }}
       baseBranch: ${{ needs.prepare.outputs.baseBranch }}
       mergedSha: ${{ needs.prepare.outputs.mergedSha }}
 

.github/workflows/reviewers.yml

@@ -7,6 +7,10 @@ on:
   pull_request_target:
     types: [ready_for_review]
   workflow_call:
+    inputs:
+      artifact-prefix:
+        required: true
+        type: string
     secrets:
       OWNER_APP_PRIVATE_KEY:
         required: true
@@ -91,6 +95,8 @@ jobs:
       - name: Wait for comparison to be done
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         id: eval
+        env:
+          ARTIFACT: ${{ inputs.artifact-prefix }}comparison
         with:
           script: |
             const run_id = (await github.rest.actions.listWorkflowRuns({
@@ -111,7 +117,7 @@ jobs:
                 owner: context.repo.owner,
                 repo: context.repo.repo,
                 run_id,
-                name: 'comparison'
+                name: process.env.ARTIFACT,
               })
               if (result.data.total_count > 0) return
               await new Promise(resolve => setTimeout(resolve, 5000))
@@ -128,7 +134,7 @@ jobs:
         with:
           run-id: ${{ steps.eval.outputs.run-id }}
           github-token: ${{ github.token }}
-          pattern: comparison
+          pattern: ${{ inputs.artifact-prefix }}comparison
           path: comparison
           merge-multiple: true
 

.github/workflows/test.yml

@@ -79,6 +79,7 @@ jobs:
     secrets:
       CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
     with:
+      artifact-prefix: mg-
       mergedSha: ${{ needs.prepare.outputs.mergedSha }}
       targetSha: ${{ needs.prepare.outputs.targetSha }}
 
@@ -95,3 +96,5 @@ jobs:
     secrets:
       CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
       NIXPKGS_CI_APP_PRIVATE_KEY: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
+    with:
+      artifact-prefix: pr-

ci/eval/compare/utils.nix

@@ -22,7 +22,7 @@ rec {
       splittedPath = lib.splitString "." packagePlatformPath;
 
       # ["python312Packages" "numpy" "aarch64-linux"] -> ["python312Packages" "numpy"]
-      packagePath = lib.sublist 0 (lib.length splittedPath - 1) splittedPath;
+      packagePath = lib.init splittedPath;
 
       # "python312Packages.numpy"
       name = lib.concatStringsSep "." packagePath;

ci/eval/default.nix

@@ -111,6 +111,7 @@ let
           --option allow-import-from-derivation false \
           --query --available \
           --out-path --json \
+          --meta \
           --show-trace \
           --arg chunkSize "$chunkSize" \
           --arg myChunk "$myChunk" \
@@ -204,6 +205,7 @@ let
         fi
 
         cat "$chunkOutputDir"/result/* | jq -s 'add | map_values(.outputs)' > $out/${evalSystem}/paths.json
+        cat "$chunkOutputDir"/result/* | jq -s 'add | map_values(.meta)' > $out/${evalSystem}/meta.json
       '';
 
   diff = callPackage ./diff.nix { };
@@ -232,6 +234,14 @@ let
           })
         ' > $out/combined-diff.json
 
+        # Combine maintainers from all systems
+        cat ${diffDir}/*/maintainers.json | jq -s '
+          add | group_by(.package) | map({
+            key: .[0].package,
+            value: map(.maintainers) | flatten | unique
+          }) | from_entries
+        ' > $out/maintainers.json
+
         mkdir -p $out/before/stats
         for d in ${diffDir}/before/*; do
           cp -r "$d"/stats-by-chunk $out/before/stats/$(basename "$d")

ci/eval/diff.nix

@@ -76,11 +76,36 @@ let
   afterAttrs = getAttrs after;
   diffAttrs = diff beforeAttrs afterAttrs;
   diffJson = writeText "diff.json" (builtins.toJSON diffAttrs);
+
+  # The maintainer list is not diffed, but just taken as is, to provide a map
+  # of maintainers on the target branch. A list of GitHub IDs is sufficient for
+  # all our purposes and reduces size massively.
+  meta = lib.importJSON "${after}/${evalSystem}/meta.json";
+  maintainers = lib.pipe meta [
+    (lib.mapAttrsToList (
+      k: v: {
+        # splits off the platform suffix
+        package = lib.pipe k [
+          (lib.splitString ".")
+          lib.init
+          (lib.concatStringsSep ".")
+        ];
+        maintainers = map (m: m.githubId) v.maintainers or [ ];
+      }
+    ))
+    # Some paths don't have a platform suffix, those will appear with an empty package here.
+    (lib.filter ({ package, maintainers }: package != "" && maintainers != [ ]))
+  ];
+  maintainersJson = writeText "maintainers.json" (builtins.toJSON maintainers);
 in
 runCommand "diff" { } ''
   mkdir -p $out/${evalSystem}
 
-  cp -r ${before} $out/before
-  cp -r ${after} $out/after
+  cp -r --no-preserve=mode ${before} $out/before
+  cp -r --no-preserve=mode ${after} $out/after
+  # JSON files will be processed above explicitly, so avoid copying over
+  # the source files to keep the artifacts smaller.
+  find $out/before $out/after -iname '*.json' -delete
   cp ${diffJson} $out/${evalSystem}/diff.json
+  cp ${maintainersJson} $out/${evalSystem}/maintainers.json
 ''

default.nix

@@ -9,7 +9,7 @@ if missingFeatures != [ ] then
     This version of Nixpkgs requires an implementation of Nix with the following features:
     - ${builtins.concatStringsSep "\n- " missingFeatures}
 
-    Your are evaluating with Nix ${builtins.nixVersion or "(too old to know)"}, please upgrade:
+    You are evaluating with Nix ${builtins.nixVersion or "(too old to know)"}, please upgrade:
 
     - If you are running NixOS, `nixos-rebuild' can be used to upgrade your system.
 

doc/build-helpers/images/dockertools.section.md

@@ -202,6 +202,10 @@ Similarly, if you encounter errors similar to `Error_Protocol ("certificate has
 
   _Default value:_ `false`.
 
+`meta` (Attribute Set)
+
+: The `meta` attribute of the resulting derivation, as in `stdenv.mkDerivation`. Accepts `description`, `maintainers` and any other `meta` attributes.
+
 `contents` **DEPRECATED**
 
 : This attribute is deprecated, and users are encouraged to use `copyToRoot` instead.
@@ -635,6 +639,10 @@ This allows the function to produce reproducible images.
 
   _Default value:_ `false`.
 
+`meta` (Attribute Set)
+
+: The `meta` attribute of the resulting derivation, as in `stdenv.mkDerivation`. Accepts `description`, `maintainers` and any other `meta` attributes.
+
 `passthru` (Attribute Set; _optional_)
 
 : Use this to pass any attributes as [`passthru`](#chap-passthru) for the resulting derivation.

doc/packages/darwin-builder.section.md

@@ -64,13 +64,15 @@ builders = ssh-ng://builder@linux-builder ${ARCH}-linux /etc/nix/builder_ed25519
 builders-use-substitutes = true
 ```
 
-To allow Nix to connect to a remote builder not running on port 22, you will also need to create a new file at `/etc/ssh/ssh_config.d/100-linux-builder.conf`:
+To allow Nix to connect to the default remote builder, which does not run on port 22, you will also need to create a new file at `/etc/ssh/ssh_config.d/100-linux-builder.conf`:
 
 ```
 Host linux-builder
   Hostname localhost
   HostKeyAlias linux-builder
   Port 31022
+  User builder
+  IdentityFile /etc/nix/builder_ed25519
 ```
 
 … and then restart your Nix daemon to apply the change:
@@ -79,6 +81,8 @@ Host linux-builder
 $ sudo launchctl kickstart -k system/org.nixos.nix-daemon
 ```
 
+Note that if the builder is running and you have created the above ssh conf file, you can ssh into the builder with `sudo ssh builder@linux-builder`.
+
 ## Example flake usage {#sec-darwin-builder-example-flake}
 
 ```nix

lib/customisation.nix

@@ -864,4 +864,139 @@ rec {
         transformDrv
         ;
     };
+
+  /**
+    Removes a prefix from the attribute names of a cross index.
+
+    A cross index (short for "Cross Platform Pair Index") is a 6-field structure
+    organizing values by cross-compilation platform relationships.
+
+    # Inputs
+
+    `prefix`
+    : The prefix to remove from cross index attribute names
+
+    `crossIndex`
+    : A cross index with prefixed names
+
+    # Type
+
+    ```
+    renameCrossIndexFrom :: String -> AttrSet -> AttrSet
+    ```
+
+    # Examples
+
+    :::{.example}
+    ## `lib.customisation.renameCrossIndexFrom` usage example
+
+    ```nix
+    renameCrossIndexFrom "pkgs" { pkgsBuildBuild = ...; pkgsBuildHost = ...; ... }
+    => { buildBuild = ...; buildHost = ...; ... }
+    ```
+    :::
+  */
+  renameCrossIndexFrom = prefix: x: {
+    buildBuild = x."${prefix}BuildBuild";
+    buildHost = x."${prefix}BuildHost";
+    buildTarget = x."${prefix}BuildTarget";
+    hostHost = x."${prefix}HostHost";
+    hostTarget = x."${prefix}HostTarget";
+    targetTarget = x."${prefix}TargetTarget";
+  };
+
+  /**
+    Adds a prefix to the attribute names of a cross index.
+
+    A cross index (short for "Cross Platform Pair Index") is a 6-field structure
+    organizing values by cross-compilation platform relationships.
+
+    # Inputs
+
+    `prefix`
+    : The prefix to add to cross index attribute names
+
+    `crossIndex`
+    : A cross index to be prefixed
+
+    # Type
+
+    ```
+    renameCrossIndexTo :: String -> AttrSet -> AttrSet
+    ```
+
+    # Examples
+
+    :::{.example}
+    ## `lib.customisation.renameCrossIndexTo` usage example
+
+    ```nix
+    renameCrossIndexTo "self" { buildBuild = ...; buildHost = ...; ... }
+    => { selfBuildBuild = ...; selfBuildHost = ...; ... }
+    ```
+    :::
+  */
+  renameCrossIndexTo = prefix: x: {
+    "${prefix}BuildBuild" = x.buildBuild;
+    "${prefix}BuildHost" = x.buildHost;
+    "${prefix}BuildTarget" = x.buildTarget;
+    "${prefix}HostHost" = x.hostHost;
+    "${prefix}HostTarget" = x.hostTarget;
+    "${prefix}TargetTarget" = x.targetTarget;
+  };
+
+  /**
+    Takes a function and applies it pointwise to each field of a cross index.
+
+    A cross index (short for "Cross Platform Pair Index") is a 6-field structure
+    organizing values by cross-compilation platform relationships.
+
+    # Inputs
+
+    `f`
+    : Function to apply to each cross index value
+
+    `crossIndex`
+    : A cross index to transform
+
+    # Type
+
+    ```
+    mapCrossIndex :: (a -> b) -> AttrSet -> AttrSet
+    ```
+
+    # Examples
+
+    :::{.example}
+    ## `lib.customisation.mapCrossIndex` usage example
+
+    ```nix
+    mapCrossIndex (x: x * 10) { buildBuild = 1; buildHost = 2; ... }
+    => { buildBuild = 10; buildHost = 20; ... }
+    ```
+
+    ```nix
+    # Extract a package from package sets
+    mapCrossIndex (pkgs: pkgs.hello) crossIndexedPackageSets
+    ```
+    :::
+  */
+  mapCrossIndex =
+    f:
+    {
+      buildBuild,
+      buildHost,
+      buildTarget,
+      hostHost,
+      hostTarget,
+      targetTarget,
+    }:
+    {
+      buildBuild = f buildBuild;
+      buildHost = f buildHost;
+      buildTarget = f buildTarget;
+      hostHost = f hostHost;
+      hostTarget = f hostTarget;
+      targetTarget = f targetTarget;
+    };
 }

lib/default.nix

@@ -397,6 +397,9 @@ let
         makeScopeWithSplicing
         makeScopeWithSplicing'
         extendMkDerivation
+        renameCrossIndexFrom
+        renameCrossIndexTo
+        mapCrossIndex
         ;
       inherit (self.derivations) lazyDerivation optionalDrvAttr warnOnInstantiate;
       inherit (self.generators) mkLuaInline;

lib/tests/misc.nix

@@ -4741,4 +4741,82 @@ runTests {
     expected = "/non-existent/this/does/not/exist/for/real/please-dont-mess-with-your-local-fs/default.nix";
   };
 
+  # Tests for cross index utilities
+
+  testRenameCrossIndexFrom = {
+    expr = lib.renameCrossIndexFrom "pkgs" {
+      pkgsBuildBuild = "dummy-build-build";
+      pkgsBuildHost = "dummy-build-host";
+      pkgsBuildTarget = "dummy-build-target";
+      pkgsHostHost = "dummy-host-host";
+      pkgsHostTarget = "dummy-host-target";
+      pkgsTargetTarget = "dummy-target-target";
+    };
+    expected = {
+      buildBuild = "dummy-build-build";
+      buildHost = "dummy-build-host";
+      buildTarget = "dummy-build-target";
+      hostHost = "dummy-host-host";
+      hostTarget = "dummy-host-target";
+      targetTarget = "dummy-target-target";
+    };
+  };
+
+  testRenameCrossIndexTo = {
+    expr = lib.renameCrossIndexTo "self" {
+      buildBuild = "dummy-build-build";
+      buildHost = "dummy-build-host";
+      buildTarget = "dummy-build-target";
+      hostHost = "dummy-host-host";
+      hostTarget = "dummy-host-target";
+      targetTarget = "dummy-target-target";
+    };
+    expected = {
+      selfBuildBuild = "dummy-build-build";
+      selfBuildHost = "dummy-build-host";
+      selfBuildTarget = "dummy-build-target";
+      selfHostHost = "dummy-host-host";
+      selfHostTarget = "dummy-host-target";
+      selfTargetTarget = "dummy-target-target";
+    };
+  };
+
+  testMapCrossIndex = {
+    expr = lib.mapCrossIndex (x: x * 10) {
+      buildBuild = 1;
+      buildHost = 2;
+      buildTarget = 3;
+      hostHost = 4;
+      hostTarget = 5;
+      targetTarget = 6;
+    };
+    expected = {
+      buildBuild = 10;
+      buildHost = 20;
+      buildTarget = 30;
+      hostHost = 40;
+      hostTarget = 50;
+      targetTarget = 60;
+    };
+  };
+
+  testMapCrossIndexString = {
+    expr = lib.mapCrossIndex (x: "prefix-${x}") {
+      buildBuild = "bb";
+      buildHost = "bh";
+      buildTarget = "bt";
+      hostHost = "hh";
+      hostTarget = "ht";
+      targetTarget = "tt";
+    };
+    expected = {
+      buildBuild = "prefix-bb";
+      buildHost = "prefix-bh";
+      buildTarget = "prefix-bt";
+      hostHost = "prefix-hh";
+      hostTarget = "prefix-ht";
+      targetTarget = "prefix-tt";
+    };
+  };
+
 }

maintainers/maintainer-list.nix

@@ -5239,12 +5239,6 @@
     githubId = 3077118;
     name = "David McFarland";
   };
-  coroa = {
-    email = "jonas@chaoflow.net";
-    github = "coroa";
-    githubId = 2552981;
-    name = "Jonas Hörsch";
-  };
   costrouc = {
     email = "chris.ostrouchov@gmail.com";
     github = "costrouc";
@@ -18061,6 +18055,12 @@
     name = "Nasir Hussain";
     keys = [ { fingerprint = "7A10 AB8E 0BEC 566B 090C  9BE3 D812 6E55 9CE7 C35D"; } ];
   };
+  nasrally = {
+    email = "suffer.ring@ya.ru";
+    github = "nasrally";
+    githubId = 50599445;
+    name = "Nikita Grishko";
+  };
   nat-418 = {
     github = "nat-418";
     githubId = 93013864;
@@ -29047,6 +29047,13 @@
     github = "zeri42";
     githubId = 68825133;
   };
+  zerodya = {
+    name = "Nicola";
+    email = "nicola.pagliuca@pm.me";
+    matrix = "@zerodya:beeper.com";
+    github = "Zerodya";
+    githubId = 73220426;
+  };
   zestsystem = {
     email = "mk337337@gmail.com";
     github = "zestsystem";

maintainers/scripts/remove-old-aliases.py

@@ -98,8 +98,8 @@ def get_date_lists(
             date_too_complex_list.append(f"{lineno:>5} {line}")
         elif "= with " in line:
             date_too_complex_list.append(f"{lineno:>5} {line}")
-        elif "lib.warnOnInstantiate" in line or "warning" in line:
-            if 'lib.warnOnInstantiate "' in line:
+        elif "warnAlias" in line or "warning" in line:
+            if 'warnAlias "' in line:
                 date_older_warning_list.append(line)
             else:
                 date_too_complex_list.append(f"{lineno:>5} {line}")
@@ -140,7 +140,7 @@ def convert(lines: list[str], convert_to: str) -> list[tuple[str, str]]:
                 before_equal, after_equal = (
                     x.strip() for x in line.split("=", maxsplit=2)
                 )
-                if after_equal.startswith("lib.warnOnInstantiate"):
+                if after_equal.startswith("warnAlias"):
                     after_equal = after_equal.split("\"", maxsplit=3)[2].strip()
             except ValueError as err:
                 print(err, line, "\n")
@@ -162,7 +162,7 @@ def convert(lines: list[str], convert_to: str) -> list[tuple[str, str]]:
             converted_lines[line] = converted
         elif convert_to == "warnings":
             converted = (
-                f"{indent}{alias} = lib.warnOnInstantiate \"'{alias_unquoted}' has been"
+                f"{indent}{alias} = warnAlias \"'{alias_unquoted}' has been"
                 f" renamed to/replaced by '{replacement}'\" {replacement};"
                 f" # Converted to warning {datetime.today().strftime('%Y-%m-%d')}"
             )

nixos/doc/manual/release-notes/rl-2505.section.md

@@ -379,6 +379,8 @@ Alongside many enhancements to NixOS modules and general system improvements, th
 
 - `virtualisation.azure.agent` option provided by `azure-agent.nix` is replaced by `services.waagent`, and will be removed in a future release.
 
+- Netdata removed support for non cloud deployments in version 2, so the `withCloud` option has been removed.
+
 - The ZFS import service now respects `fileSystems.*.options = [ "noauto" ];` and does not add that pool's import service to `zfs-import.target`, meaning it will not be automatically imported at boot.
 
 - Default file names of images generated by several builders in `system.build` have been changed as outlined in the table below.

nixos/doc/manual/release-notes/rl-2511.section.md

@@ -49,6 +49,8 @@
 
 - [Homebridge](https://github.com/homebridge/homebridge), a lightweight Node.js server you can run on your home network that emulates the iOS HomeKit API. Available as [services.homebridge](#opt-services.homebridge.enable).
 
+- [XPPen](https://www.xp-pen.com/), the official closed-source driver for XP Pen tablets. Available as [programs.xppen](#opt-programs.xppen.enable).
+
 - [LACT](https://github.com/ilya-zlobintsev/LACT), a GPU monitoring and configuration tool, can now be enabled through [services.lact.enable](#opt-services.lact.enable).
   Note that for LACT to work properly on AMD GPU systems, you need to enable [hardware.amdgpu.overdrive.enable](#opt-hardware.amdgpu.overdrive.enable).
 
@@ -172,6 +174,8 @@
 
 - [Tenstorrent](https://tenstorrent.com) hardware module has been added.
 
+- [nixbit](https://github.com/pbek/nixbit), a GUI application for updating your NixOS system from a Nix Flakes Git repository. Available as [programs.nixbit](#opt-programs.nixbit.enable).
+
 ## Backward Incompatibilities {#sec-release-25.11-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -261,6 +265,8 @@
 
 - The `services.siproxd` module has been removed as `siproxd` is unmaintained and broken with libosip 5.x.
 
+- The `services.postfixadmin` module has been removed due to a lack of active maintainers.
+
 - `services.tor.torsocks.enable` no longer defaults to true if Tor and Tor client functionality is enabled.
 
 - `netbox-manage` script created by the `netbox` module no longer uses `sudo -u netbox` internally. It can be run as root and will change it's user to `netbox` using `runuser`

nixos/modules/module-list.nix

@@ -277,6 +277,7 @@
   ./programs/nix-index.nix
   ./programs/nix-ld.nix
   ./programs/nix-required-mounts.nix
+  ./programs/nixbit.nix
   ./programs/nm-applet.nix
   ./programs/nncp.nix
   ./programs/noisetorch.nix
@@ -361,6 +362,7 @@
   ./programs/xfconf.nix
   ./programs/xfs_quota.nix
   ./programs/xonsh.nix
+  ./programs/xppen.nix
   ./programs/xss-lock.nix
   ./programs/xwayland.nix
   ./programs/yazi.nix

nixos/modules/programs/nixbit.nix

@@ -0,0 +1,49 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib)
+    mkEnableOption
+    mkIf
+    mkOption
+    mkPackageOption
+    types
+    ;
+  cfg = config.programs.nixbit;
+in
+{
+  options.programs.nixbit = {
+    enable = mkEnableOption "Nixbit configuration";
+
+    package = mkPackageOption pkgs "nixbit" { };
+
+    repository = mkOption {
+      type = types.str;
+      description = "Git repository URL for Nixbit";
+    };
+
+    forceAutostart = mkEnableOption "" // {
+      description = "Force creation of autostart desktop entry when application starts";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment = {
+      systemPackages = [ cfg.package ];
+
+      etc."nixbit.conf".text =
+        lib.optionalString (cfg.repository != "") ''
+          [Repository]
+          Url = ${cfg.repository}
+        ''
+        + ''
+          [Autostart]
+          Force = ${if cfg.forceAutostart then "true" else "false"}
+        '';
+    };
+  };
+}

nixos/modules/programs/wayland/uwsm.nix

@@ -16,7 +16,7 @@ let
         [Desktop Entry]
         Name=${opts.prettyName} (UWSM)
         Comment=${opts.comment}
-        Exec=${lib.getExe cfg.package} start -F ${opts.binPath}
+        Exec=${lib.getExe cfg.package} start -F -- ${opts.binPath} ${lib.strings.escapeShellArgs opts.extraArgs}
         Type=Application
       '';
       destination = "/share/wayland-sessions/${opts.name}-uwsm.desktop";
@@ -84,6 +84,13 @@ in
                 '';
                 example = "/run/current-system/sw/bin/ExampleCompositor";
               };
+              extraArgs = lib.mkOption {
+                type = with lib.types; listOf str;
+                default = [ ];
+                description = ''
+                  Extra command-line arguments pass to to the compsitor.
+                '';
+              };
             };
           }
         )
@@ -117,7 +124,12 @@ in
         name: value:
         mk_uwsm_desktop_entry {
           inherit name;
-          inherit (value) prettyName comment binPath;
+          inherit (value)
+            prettyName
+            comment
+            binPath
+            extraArgs
+            ;
         }
       ) cfg.waylandCompositors;
     };

nixos/modules/programs/xppen.nix

@@ -0,0 +1,55 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.programs.xppen;
+in
+
+{
+  options.programs.xppen = {
+    enable = lib.mkEnableOption "XPPen PenTablet application";
+    package = lib.mkPackageOption pkgs "xppen_4" {
+      example = "pkgs.xppen_3";
+      extraDescription = ''
+        Use xppen_4 for newer and xppen_3 for older tablets.
+        To check which version of the driver you need, go to
+        https://www.xp-pen.com/download/ then select your tablet
+        and look for the major version in the available files for Linux.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    hardware.uinput.enable = true;
+
+    environment.systemPackages = [ cfg.package ];
+
+    services.udev.packages = [ cfg.package ];
+
+    systemd.tmpfiles.rules = [
+      "d /var/lib/pentablet/conf/xppen 0777 - - -"
+    ];
+
+    systemd.services.xppen-create-config-dir = {
+      restartTriggers = [ cfg.package ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Type = "oneshot";
+        TimeoutSec = 60;
+        ExecStart = pkgs.writeShellScript "xppen-create-config-dir" ''
+          readarray -d "" files < <(find ${cfg.package}/usr/lib/pentablet/conf -type f -print0)
+          for file in "''${files[@]}"; do
+            file_new="/var''${file#${cfg.package + "/usr"}}"
+            if [ ! -f $file_new ]; then
+              install -m 666 "''$file" "''$file_new"
+            fi
+          done
+        '';
+      };
+    };
+  };
+}

nixos/modules/security/apparmor.nix

@@ -1,4 +1,5 @@
 {
+  options,
   config,
   lib,
   pkgs,
@@ -10,11 +11,6 @@ let
   cfg = config.security.apparmor;
   enabledPolicies = lib.filterAttrs (n: p: p.state != "disable") cfg.policies;
   buildPolicyPath = n: p: lib.defaultTo (pkgs.writeText n p.profile) p.path;
-
-  # Accessing submodule options when not defined results in an error thunk rather than a regular option object
-  # We can emulate the behavior of `<option>.isDefined` by attempting to evaluate it instead
-  # This is required because getting isDefined on a submodule is not possible in global module asserts.
-  submoduleOptionIsDefined = value: (builtins.tryEval value).success;
 in
 
 {
@@ -130,7 +126,9 @@ in
           # which does not recurse into sub-directories.
         }
         {
-          assertion = lib.xor (policyCfg.path != null) (submoduleOptionIsDefined policyCfg.profile);
+          assertion =
+            lib.xor (policyCfg.path != null)
+              options.security.apparmor.policies.valueMeta.attrs.${policyName}.configuration.options.profile.isDefined;
           message = "`security.apparmor.policies.\"${policyName}\"` must define exactly one of either path or profile.";
         }
       ]) cfg.policies

nixos/modules/security/doas.nix

@@ -7,8 +7,6 @@
 let
   cfg = config.security.doas;
 
-  inherit (pkgs) doas;
-
   mkUsrString = user: toString user;
 
   mkGrpString = group: ":${toString group}";
@@ -67,6 +65,8 @@ in
       '';
     };
 
+    package = lib.mkPackageOption pkgs "doas" { };
+
     wheelNeedsPassword = lib.mkOption {
       type = with lib.types; bool;
       default = true;
@@ -256,11 +256,11 @@ in
       setuid = true;
       owner = "root";
       group = "root";
-      source = "${doas}/bin/doas";
+      source = lib.getExe cfg.package;
     };
 
     environment.systemPackages = [
-      doas
+      cfg.package
     ];
 
     security.pam.services.doas = {

nixos/modules/security/ipa.nix

@@ -7,7 +7,6 @@
 with lib;
 let
   cfg = config.security.ipa;
-  pyBool = x: if x then "True" else "False";
 
   ldapConf = pkgs.writeText "ldap.conf" ''
     # Turning this off breaks GSSAPI used with krb5 when rdns = false
@@ -236,50 +235,53 @@ in
 
     services.sssd = {
       enable = true;
-      config = ''
-        [domain/${cfg.domain}]
-        id_provider = ipa
-        auth_provider = ipa
-        access_provider = ipa
-        chpass_provider = ipa
+      settings = {
+        "domain/${cfg.domain}" = {
+          id_provider = "ipa";
+          auth_provider = "ipa";
+          access_provider = "ipa";
+          chpass_provider = "ipa";
 
-        ipa_domain = ${cfg.domain}
-        ipa_server = _srv_, ${cfg.server}
-        ipa_hostname = ${cfg.ipaHostname}
+          ipa_domain = cfg.domain;
+          ipa_server = "_srv_, ${cfg.server}";
+          ipa_hostname = cfg.ipaHostname;
 
-        cache_credentials = ${pyBool cfg.cacheCredentials}
-        krb5_store_password_if_offline = ${pyBool cfg.offlinePasswords}
-        ${optionalString ((toLower cfg.domain) != (toLower cfg.realm)) "krb5_realm = ${cfg.realm}"}
+          cache_credentials = cfg.cacheCredentials;
+          krb5_store_password_if_offline = cfg.offlinePasswords;
+          krb5_realm = lib.mkIf ((toLower cfg.domain) != (toLower cfg.realm)) cfg.realm;
 
-        dyndns_update = ${pyBool cfg.dyndns.enable}
-        dyndns_iface = ${cfg.dyndns.interface}
+          dyndns_update = cfg.dyndns.enable;
+          dyndns_iface = cfg.dyndns.interface;
 
-        ldap_tls_cacert = /etc/ipa/ca.crt
-        ldap_user_extra_attrs = mail:mail, sn:sn, givenname:givenname, telephoneNumber:telephoneNumber, lock:nsaccountlock
+          ldap_tls_cacert = "/etc/ipa/ca.crt";
+          ldap_user_extra_attrs = "mail:mail, sn:sn, givenname:givenname, telephoneNumber:telephoneNumber, lock:nsaccountlock";
+        };
 
-        [sssd]
-        services = nss, sudo, pam, ssh, ifp
-        domains = ${cfg.domain}
+        sssd = {
+          services = "nss, sudo, pam, ssh, ifp";
+          domains = cfg.domain;
+        };
 
-        [nss]
-        homedir_substring = /home
+        nss.homedir_substring = "/home";
 
-        [pam]
-        pam_pwd_expiration_warning = 3
-        pam_verbosity = 3
+        pam = {
+          pam_pwd_expiration_warning = 3;
+          pam_verbosity = 3;
+        };
 
-        [sudo]
+        sudo = { };
 
-        [autofs]
+        autofs = { };
 
-        [ssh]
+        ssh = { };
 
-        [pac]
+        pac = { };
 
-        [ifp]
-        user_attributes = +mail, +telephoneNumber, +givenname, +sn, +lock
-        allowed_uids = ${concatStringsSep ", " cfg.ifpAllowedUids}
-      '';
+        ifp = {
+          user_attributes = "+mail, +telephoneNumber, +givenname, +sn, +lock";
+          allowed_uids = concatStringsSep ", " cfg.ifpAllowedUids;
+        };
+      };
     };
 
     networking.timeServers = singleton cfg.server;

nixos/modules/services/cluster/kubernetes/kubelet.nix

@@ -362,7 +362,6 @@ in
         '';
         serviceConfig = {
           Slice = "kubernetes.slice";
-          CPUAccounting = true;
           MemoryAccounting = true;
           Restart = "on-failure";
           RestartSec = "1000ms";

nixos/modules/services/hardware/handheld-daemon.nix

@@ -7,6 +7,10 @@
 with lib;
 let
   cfg = config.services.handheld-daemon;
+  hhdPackage = cfg.package.override {
+    withAdjustor = cfg.adjustor.enable;
+    adjustor = cfg.adjustor.package;
+  };
 in
 {
   options.services.handheld-daemon = {
@@ -18,6 +22,18 @@ in
       package = mkPackageOption pkgs "handheld-daemon-ui" { };
     };
 
+    adjustor = {
+      enable = mkEnableOption "Handheld Daemon TDP control plugin";
+      package = mkPackageOption pkgs "adjustor" { };
+      loadAcpiCallModule = mkOption {
+        type = types.bool;
+        description = ''
+          Whether to load the acpi_call kernel module.
+          Required for TDP control by adjustor on most devices.
+        '';
+      };
+    };
+
     user = mkOption {
       type = types.str;
       description = ''
@@ -28,13 +44,19 @@ in
 
   config = mkIf cfg.enable {
     services.handheld-daemon.ui.enable = mkDefault true;
+    services.handheld-daemon.adjustor.loadAcpiCallModule = mkDefault cfg.adjustor.enable;
     environment.systemPackages = [
-      cfg.package
+      hhdPackage
     ]
     ++ lib.optional cfg.ui.enable cfg.ui.package;
     services.udev.packages = [ cfg.package ];
     systemd.packages = [ cfg.package ];
 
+    boot.kernelModules = mkIf cfg.adjustor.loadAcpiCallModule [ "acpi_call" ];
+    boot.extraModulePackages = mkIf cfg.adjustor.loadAcpiCallModule [
+      config.boot.kernelPackages.acpi_call
+    ];
+
     systemd.services.handheld-daemon = {
       description = "Handheld Daemon";
 
@@ -48,7 +70,7 @@ in
       ];
 
       serviceConfig = {
-        ExecStart = "${lib.getExe cfg.package} --user ${cfg.user}";
+        ExecStart = "${lib.getExe hhdPackage} --user ${cfg.user}";
         Nice = "-12";
         Restart = "on-failure";
         RestartSec = "10";
@@ -56,5 +78,5 @@ in
     };
   };
 
-  meta.maintainers = [ maintainers.appsforartists ];
+  meta.maintainers = [ maintainers.toast ];
 }

nixos/modules/services/mail/postfix-tlspol.nix

@@ -8,7 +8,6 @@
 let
   inherit (lib)
     hasPrefix
-    literalExpression
     mkEnableOption
     mkIf
     mkMerge
@@ -143,7 +142,7 @@ in
               else
                 "inet:${cfg.settings.server.address}";
           in
-          [ "socketmap:${address}:QUERYwithTLSRPT" ];
+          [ "socketmap:${address}:${if config.services.tlsrpt.enable then "QUERYwithTLSRPT" else "QUERY"}" ];
       };
 
       systemd.services.postfix = {

nixos/modules/services/matrix/synapse-auto-compressor.nix

@@ -30,7 +30,7 @@ in
   options = {
     services.synapse-auto-compressor = {
       enable = lib.mkEnableOption "synapse-auto-compressor";
-      package = lib.mkPackageOption pkgs "rust-synapse-state-compress" { };
+      package = lib.mkPackageOption pkgs "rust-synapse-compress-state" { };
       postgresUrl = lib.mkOption {
         default =
           let

nixos/modules/services/misc/sssd.nix

@@ -6,20 +6,59 @@
 }:
 let
   cfg = config.services.sssd;
+  settingsFormat = pkgs.formats.ini { };
 
   dataDir = "/var/lib/sssd";
   settingsFile = "${dataDir}/sssd.conf";
-  settingsFileUnsubstituted = pkgs.writeText "${dataDir}/sssd-unsubstituted.conf" cfg.config;
+  mkSettingsFileUnsubstituted =
+    settings:
+    let
+      pyBool = x: if x then "True" else "False";
+      finalSettings = lib.mapAttrs (
+        _: lib.mapAttrs (_: v: if lib.isBool v then pyBool v else v)
+      ) settings;
+    in
+    settingsFormat.generate "sssd-unsubstituted.conf" finalSettings;
+  settingsFileUnsubstituted =
+    if cfg.settings == { } then
+      pkgs.writeText "sssd-unsubstituted.conf" cfg.config
+    else
+      mkSettingsFileUnsubstituted cfg.settings;
 in
 {
   options = {
     services.sssd = {
       enable = lib.mkEnableOption "the System Security Services Daemon";
 
+      settings = lib.mkOption {
+        inherit (settingsFormat) type;
+        description = "Contents of {file}`sssd.conf`.";
+        default = { };
+        example = {
+          sssd = {
+            services = "nss, pam";
+            domains = "shadowutils";
+          };
+
+          nss = { };
+
+          pam = { };
+
+          "domain/shadowutils" = {
+            id_provider = "proxy";
+            proxy_lib_name = "files";
+            auth_provider = "proxy";
+            proxy_pam_target = "sssd-shadowutils";
+            proxy_fast_alias = true;
+          };
+        };
+      };
+
       config = lib.mkOption {
         type = lib.types.lines;
         description = "Contents of {file}`sssd.conf`.";
-        default = ''
+        default = "";
+        example = ''
           [sssd]
           services = nss, pam
           domains = shadowutils
@@ -80,6 +119,13 @@ in
   };
   config = lib.mkMerge [
     (lib.mkIf cfg.enable {
+      assertions = [
+        {
+          assertion = lib.xor (cfg.settings != { }) (cfg.config != "");
+          message = "services.sssd.settings and services.sssd.config are mutually exclusive";
+        }
+      ];
+
       # For `sssctl` to work.
       environment.etc."sssd/sssd.conf".source = settingsFile;
       environment.etc."sssd/conf.d".source = "${dataDir}/conf.d";

nixos/modules/services/networking/kismet.nix

@@ -28,7 +28,14 @@ let
     typeOf
     match
     ;
-  inherit (lib.lists) all isList flatten;
+  inherit (lib.lists)
+    all
+    isList
+    head
+    tail
+    flatten
+    foldl'
+    ;
   inherit (lib.attrsets)
     attrsToList
     filterAttrs
@@ -48,19 +55,60 @@ let
     in
     prev
     // {
-      check = value: prev.check value && (override type value);
+      check =
+        value:
+        let
+          prevResult = builtins.tryEval (prev.check value);
+          nextResult = builtins.tryEval (override type value);
+        in
+        prevResult.success && prevResult.value && nextResult.success && nextResult.value;
+
+      # We need to typecheck prior to merging, so deoptimize in case prev.merge is a functor.
+      merge = opts: prev.merge opts;
     };
 
   # Deep listOf.
-  listOf' = deep types.listOf (type: value: all type.check value);
+  inherit (types) listOf;
+  listOf' = deep listOf (type: value: all type.check value);
 
   # Deep attrsOf.
-  attrsOf' = deep types.attrsOf (type: value: all (item: type.check item.value) (attrsToList value));
+  inherit (types) attrsOf;
+  attrsOf' = deep attrsOf (type: value: all (item: type.check item.value) (attrsToList value));
+
+  # Deep either and oneOf that performs typecheck prior to merging.
+  inherit (types) either;
+  either' =
+    first: second:
+    let
+      prev = either first second;
+    in
+    prev
+    // {
+      check =
+        value:
+        let
+          firstResult = builtins.tryEval (first.check value);
+          secondResult = builtins.tryEval (second.check value);
+        in
+        firstResult.success && firstResult.value || secondResult.success && secondResult.value;
+
+      # We need to typecheck prior to merging, so deoptimize in case prev.merge is a functor.
+      merge = opts: prev.merge opts;
+    };
+
+  oneOf' =
+    ts:
+    let
+      head' =
+        if ts == [ ] then throw "types.oneOf needs to get at least one type in its argument" else head ts;
+      tail' = tail ts;
+    in
+    foldl' either' head' tail';
 
   # Kismet config atoms.
   atom =
     with types;
-    oneOf [
+    oneOf' [
       number
       bool
       str
@@ -68,7 +116,10 @@ let
 
   # Composite types.
   listOfAtom = listOf' atom;
-  atomOrList = with types; either atom listOfAtom;
+  atomOrList = oneOf' [
+    atom
+    listOfAtom
+  ];
   lists = listOf' atomOrList;
   kvPair = attrsOf' atomOrList;
   kvPairs = listOf' kvPair;
@@ -80,19 +131,17 @@ let
   # Toplevel config type.
   topLevel =
     let
-      topLevel' =
-        with types;
-        oneOf [
-          headerKvPairs
-          headerKvPair
-          kvPairs
-          kvPair
-          listOfAtom
-          lists
-          atom
-        ];
+      topLevel' = oneOf' [
+        headerKvPairs
+        headerKvPair
+        kvPairs
+        kvPair
+        listOfAtom
+        lists
+        atom
+      ];
     in
-    topLevel'
+    attrsOf' topLevel'
     // {
       description = "Kismet config stanza";
     };
@@ -239,7 +288,7 @@ in
         https://www.kismetwireless.net/docs/readme/configuring/configfiles/
       '';
       default = { };
-      type = with types; attrsOf topLevel;
+      type = topLevel;
       example = literalExpression ''
         {
           /* Examples for atoms */

nixos/modules/services/networking/openvpn.nix

@@ -11,8 +11,6 @@ let
 
   cfg = config.services.openvpn;
 
-  inherit (pkgs) openvpn;
-
   makeOpenVPNJob =
     cfg: name:
     let
@@ -77,7 +75,7 @@ let
         pkgs.net-tools
       ];
 
-      serviceConfig.ExecStart = "@${openvpn}/sbin/openvpn openvpn --suppress-timestamps --config ${configFile}";
+      serviceConfig.ExecStart = "@${config.services.openvpn.package}/sbin/openvpn openvpn --suppress-timestamps --config ${configFile}";
       serviceConfig.Restart = "always";
       serviceConfig.Type = "notify";
     };
@@ -104,6 +102,7 @@ in
   ###### interface
 
   options = {
+    services.openvpn.package = lib.mkPackageOption pkgs "openvpn" { };
 
     services.openvpn.servers = mkOption {
       default = { };
@@ -254,7 +253,7 @@ in
       ))
       // restartService;
 
-    environment.systemPackages = [ openvpn ];
+    environment.systemPackages = [ cfg.package ];
 
     boot.kernelModules = [ "tun" ];
 

nixos/modules/services/scheduling/prefect.nix

@@ -173,7 +173,6 @@ in
           ProtectKernelLogs = true;
           ProtectControlGroups = true;
           MemoryAccounting = true;
-          CPUAccounting = true;
 
           ExecStart = "${pkgs.prefect}/bin/prefect server start --host ${cfg.host} --port ${toString cfg.port}";
           Restart = "always";
@@ -216,7 +215,6 @@ in
           ProtectKernelLogs = true;
           ProtectControlGroups = true;
           MemoryAccounting = true;
-          CPUAccounting = true;
           ExecStart = ''
             ${pkgs.prefect}/bin/prefect worker start \
               --pool ${poolName} \

nixos/modules/services/torrent/transmission.nix

@@ -19,6 +19,8 @@ let
     optionalString
     optional
     mkDefault
+    mkOptionDefault
+    versionOlder
     escapeShellArgs
     optionalAttrs
     mkMerge
@@ -176,17 +178,12 @@ in
             };
             umask = mkOption {
               type = types.either types.int types.str;
-              default = if cfg.package == pkgs.transmission_3 then 18 else "022";
-              defaultText = literalExpression "if cfg.package == pkgs.transmission_3 then 18 else \"022\"";
+              default = "022";
               description = ''
                 Sets transmission's file mode creation mask.
                 See the {manpage}`umask(2)` manpage for more information.
                 Users who want their saved torrents to be world-writable
                 may want to set this value to 0/`"000"`.
-
-                Keep in mind, that if you are using Transmission 3, this has to
-                be passed as a base 10 integer, whereas Transmission 4 takes
-                an octal number in a string instead.
               '';
             };
             utp-enabled = mkOption {
@@ -222,10 +219,19 @@ in
         };
       };
 
-      package = mkPackageOption pkgs "transmission" {
-        default = "transmission_3";
-        example = "pkgs.transmission_4";
-      };
+      package =
+        mkPackageOption pkgs "transmission" {
+          default = "transmission_4";
+          example = "pkgs.transmission_4";
+        }
+        // {
+          defaultText = ''
+            if lib.versionAtLeast config.system.stateVersion "25.11" then
+              pkgs.transmission_4
+            else
+              «error message»
+          '';
+        };
 
       downloadDirPermissions = mkOption {
         type = with types; nullOr str;
@@ -331,6 +337,19 @@ in
   };
 
   config = mkIf cfg.enable {
+    services.transmission.package = mkIf (versionOlder config.system.stateVersion "25.11") (
+      mkOptionDefault (throw ''
+        `services.transmission.package` previously defaulted to
+        `pkgs.transmission_3`, which has been removed in favour
+        of `pkgs.transmission_4`.
+
+        Please set `services.transmission.package` to
+        `pkgs.transmission_4` explicitly. Note that upgrade
+        caused data loss for some users so backup is recommended
+        (see NixOS 24.11 release notes for details)
+      '')
+    );
+
     # Note that using systemd.tmpfiles would not work here
     # because it would fail when creating a directory
     # with a different owner than its parent directory, by saying:

nixos/modules/services/web-apps/actual.nix

@@ -32,6 +32,16 @@ in
       description = "Whether to open the firewall for the specified port.";
     };
 
+    environmentFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = ''
+        Environment file for specifying additional settings such as secrets.
+
+        See <https://actualbudget.org/docs/config/oauth-auth#environment-variables>.
+      '';
+    };
+
     settings = mkOption {
       default = { };
       description = "Server settings, refer to [the documentation](https://actualbudget.org/docs/config/) for available options.";
@@ -76,6 +86,7 @@ in
         Group = "actual";
         StateDirectory = "actual";
         WorkingDirectory = dataDir;
+        EnvironmentFile = cfg.environmentFile;
         LimitNOFILE = "1048576";
         PrivateTmp = true;
         PrivateDevices = true;

nixos/modules/services/web-apps/discourse.nix

@@ -17,7 +17,10 @@ let
   upstreamPostgresqlVersion = lib.getVersion pkgs.postgresql_15;
 
   postgresqlPackage =
-    if config.services.postgresql.enable then config.services.postgresql.package else pkgs.postgresql;
+    if config.services.postgresql.enable then
+      config.services.postgresql.finalPackage
+    else
+      pkgs.postgresql;
 
   postgresqlVersion = lib.getVersion postgresqlPackage;
 
@@ -540,7 +543,7 @@ in
     assertions = [
       {
         assertion = (cfg.database.host != null) -> (cfg.database.passwordFile != null);
-        message = "When services.gitlab.database.host is customized, services.discourse.database.passwordFile must be set!";
+        message = "When services.discourse.database.host is customized, services.discourse.database.passwordFile must be set!";
       }
       {
         assertion = cfg.hostname != "";
@@ -694,6 +697,9 @@ in
 
     services.postgresql = lib.mkIf databaseActuallyCreateLocally {
       enable = true;
+      extensions = ps: [
+        ps.pgvector
+      ];
       ensureUsers = [ { name = "discourse"; } ];
     };
 
@@ -719,6 +725,7 @@ in
           psql -tAc "SELECT 1 FROM pg_database WHERE datname = 'discourse'" | grep -q 1 || psql -tAc 'CREATE DATABASE "discourse" OWNER "discourse"'
           psql '${cfg.database.name}' -tAc "CREATE EXTENSION IF NOT EXISTS pg_trgm"
           psql '${cfg.database.name}' -tAc "CREATE EXTENSION IF NOT EXISTS hstore"
+          psql '${cfg.database.name}' -tAc "CREATE EXTENSION IF NOT EXISTS vector"
         '';
 
         serviceConfig = {
@@ -805,8 +812,11 @@ in
 
           cp -r ${cfg.package}/share/discourse/config.dist/* /run/discourse/config/
           cp -r ${cfg.package}/share/discourse/public.dist/* /run/discourse/public/
+          cp -r ${cfg.package.assets.generated}/* /run/discourse/assets-generated/
           ln -sf /var/lib/discourse/uploads /run/discourse/public/uploads
           ln -sf /var/lib/discourse/backups /run/discourse/public/backups
+          # discourse creates images in this folder, and by default it only has u=rx
+          chmod 750 /run/discourse/public/images
 
           (
               umask u=rwx,g=,o=
@@ -839,6 +849,7 @@ in
           "assets/javascripts/plugins"
           "public"
           "sockets"
+          "assets-generated"
         ];
         RuntimeDirectoryMode = "0750";
         StateDirectory = map (p: "discourse/" + p) [

nixos/modules/services/web-apps/glance.nix

@@ -172,7 +172,14 @@ in
     systemd.services.glance = {
       description = "Glance feed dashboard server";
       wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ];
+      # adding nss-user-lookup.target is a fix for https://github.com/NixOS/nixpkgs/issues/409348
+      after = [
+        "network.target"
+        "nss-user-lookup.target"
+      ];
+      requires = [
+        "nss-user-lookup.target"
+      ];
       path = [ pkgs.replace-secret ];
 
       serviceConfig = {

nixos/modules/system/boot/systemd/user.nix

@@ -71,7 +71,7 @@ in
     systemd.user.extraConfig = mkOption {
       default = "";
       type = types.lines;
-      example = "DefaultCPUAccounting=yes";
+      example = "DefaultTimeoutStartSec=60";
       description = ''
         Extra config options for systemd user instances. See {manpage}`systemd-user.conf(5)` for
         available options.

nixos/modules/virtualisation/qemu-vm.nix

@@ -136,14 +136,20 @@ let
             ''
               # Create a writable qcow2 image using the systemImage as a backing
               # image.
+              BACKING_SIZE_MB=$(( $(${lib.getExe' qemu "qemu-img"} info ${systemImage}/nixos.qcow2 --output=json | ${lib.getExe hostPkgs.jq} -r '."virtual-size"') / 1024 / 1024 ))
+              DISK_SIZE_MB=${toString cfg.diskSize}
+              if (( DISK_SIZE_MB < BACKING_SIZE_MB )); then
+                OVERLAY_SIZE_MB=$BACKING_SIZE_MB
+              else
+                OVERLAY_SIZE_MB=$DISK_SIZE_MB
+              fi
 
-              # CoW prevent size to be attributed to an image.
-              # FIXME: raise this issue to upstream.
               ${qemu}/bin/qemu-img create \
                 -f qcow2 \
                 -b ${systemImage}/nixos.qcow2 \
                 -F qcow2 \
-                "$NIX_DISK_IMAGE"
+                "$NIX_DISK_IMAGE" \
+                 ''${OVERLAY_SIZE_MB}M
             ''
           else if cfg.useDefaultFilesystems then
             ''

nixos/modules/virtualisation/waagent.nix

@@ -370,7 +370,6 @@ in
         Type = "simple";
         Restart = "always";
         Slice = "azure.slice";
-        CPUAccounting = true;
         MemoryAccounting = true;
       };
     };

nixos/tests/all-tests.nix

@@ -14,10 +14,15 @@
 # where said tests are unsupported.
 # Example callTest that just extracts the derivation from the test:
 #   callTest = t: t.test;
-
-with pkgs.lib;
-
 let
+  inherit (pkgs.lib)
+    isAttrs
+    isFunction
+    mapAttrs
+    elem
+    recurseIntoAttrs
+    ;
+
   # TODO: remove when handleTest is gone (make sure nixosTests and nixos/release.nix#tests are unaffected)
   # TODO: when removing, also deprecate `test` attribute in ../lib/testing/run.nix
   discoverTests =
@@ -452,6 +457,7 @@ in
   devpi-server = runTest ./devpi-server.nix;
   dex-oidc = runTest ./dex-oidc.nix;
   dhparams = runTest ./dhparams.nix;
+  dictd = runTest ./dictd.nix;
   disable-installer-tools = runTest ./disable-installer-tools.nix;
   discourse = runTest {
     imports = [ ./discourse.nix ];
@@ -666,7 +672,7 @@ in
   guacamole-server = runTest ./guacamole-server.nix;
   guix = handleTest ./guix { };
   gvisor = runTest ./gvisor.nix;
-  h2o = import ./web-servers/h2o { inherit recurseIntoAttrs runTest; };
+  h2o = import ./web-servers/h2o { inherit runTest; };
   hadoop = import ./hadoop {
     inherit handleTestOn;
     package = pkgs.hadoop;
@@ -736,13 +742,13 @@ in
   immich-vectorchord-migration = runTest ./web-apps/immich-vectorchord-migration.nix;
   immich-vectorchord-reindex = runTest ./web-apps/immich-vectorchord-reindex.nix;
   incron = runTest ./incron.nix;
-  incus = pkgs.recurseIntoAttrs (
+  incus = recurseIntoAttrs (
     handleTest ./incus {
       lts = false;
       inherit system pkgs;
     }
   );
-  incus-lts = pkgs.recurseIntoAttrs (handleTest ./incus { inherit system pkgs; });
+  incus-lts = recurseIntoAttrs (handleTest ./incus { inherit system pkgs; });
   influxdb = runTest ./influxdb.nix;
   influxdb2 = runTest ./influxdb2.nix;
   initrd-luks-empty-passphrase = runTest ./initrd-luks-empty-passphrase.nix;
@@ -753,7 +759,7 @@ in
   initrdNetwork = runTest ./initrd-network.nix;
   input-remapper = runTest ./input-remapper.nix;
   inspircd = runTest ./inspircd.nix;
-  installed-tests = pkgs.recurseIntoAttrs (handleTest ./installed-tests { });
+  installed-tests = recurseIntoAttrs (handleTest ./installed-tests { });
   installer = handleTest ./installer.nix { };
   installer-systemd-stage-1 = handleTest ./installer-systemd-stage-1.nix { };
   intune = runTest ./intune.nix;
@@ -807,7 +813,7 @@ in
   ksm = runTest ./ksm.nix;
   kthxbye = runTest ./kthxbye.nix;
   kubernetes = handleTestOn [ "x86_64-linux" ] ./kubernetes { };
-  kubo = import ./kubo { inherit recurseIntoAttrs runTest; };
+  kubo = import ./kubo { inherit runTest; };
   lact = runTest ./lact.nix;
   ladybird = runTest ./ladybird.nix;
   languagetool = runTest ./languagetool.nix;
@@ -857,6 +863,7 @@ in
   localsend = runTest ./localsend.nix;
   locate = runTest ./locate.nix;
   login = runTest ./login.nix;
+  logkeys = runTest ./logkeys.nix;
   logrotate = runTest ./logrotate.nix;
   loki = runTest ./loki.nix;
   #logstash = handleTest ./logstash.nix {};
@@ -889,7 +896,7 @@ in
   man = runTest ./man.nix;
   mariadb-galera = handleTest ./mysql/mariadb-galera.nix { };
   marytts = runTest ./marytts.nix;
-  mastodon = pkgs.recurseIntoAttrs (handleTest ./web-apps/mastodon { inherit handleTestOn; });
+  mastodon = recurseIntoAttrs (handleTest ./web-apps/mastodon { inherit handleTestOn; });
   mate = runTest ./mate.nix;
   mate-wayland = runTest ./mate-wayland.nix;
   matomo = runTest ./matomo.nix;
@@ -951,12 +958,13 @@ in
   mopidy = runTest ./mopidy.nix;
   morph-browser = runTest ./morph-browser.nix;
   mosquitto = runTest ./mosquitto.nix;
-  movim = import ./web-apps/movim { inherit recurseIntoAttrs runTest; };
+  movim = import ./web-apps/movim { inherit runTest; };
   mpd = runTest ./mpd.nix;
   mpv = runTest ./mpv.nix;
   mtp = runTest ./mtp.nix;
   multipass = runTest ./multipass.nix;
   mumble = runTest ./mumble.nix;
+  munge = runTest ./munge.nix;
   munin = runTest ./munin.nix;
   # Fails on aarch64-linux at the PDF creation step - need to debug this on an
   # aarch64 machine..
@@ -1362,6 +1370,7 @@ in
   silverbullet = runTest ./silverbullet.nix;
   simple = runTest ./simple.nix;
   sing-box = runTest ./sing-box.nix;
+  sks = runTest ./sks.nix;
   slimserver = runTest ./slimserver.nix;
   slipshow = runTest ./slipshow.nix;
   slurm = runTest ./slurm.nix;
@@ -1387,8 +1396,8 @@ in
   ssh-audit = runTest ./ssh-audit.nix;
   sshwifty = runTest ./web-apps/sshwifty/default.nix;
   sslh = handleTest ./sslh.nix { };
-  sssd = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./sssd.nix { };
   sssd-ldap = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./sssd-ldap.nix { };
+  sssd-legacy-config = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./sssd-legacy-config.nix { };
   stalwart-mail = runTest ./stalwart/stalwart-mail.nix;
   stargazer = runTest ./web-servers/stargazer.nix;
   starship = runTest ./starship.nix;
@@ -1406,8 +1415,9 @@ in
   suricata = runTest ./suricata.nix;
   suwayomi-server = import ./suwayomi-server.nix {
     inherit runTest;
-    lib = pkgs.lib;
+    inherit (pkgs) lib;
   };
+  svnserve = runTest ./svnserve.nix;
   swap-file-btrfs = runTest ./swap-file-btrfs.nix;
   swap-partition = runTest ./swap-partition.nix;
   swap-random-encryption = runTest ./swap-random-encryption.nix;
@@ -1539,8 +1549,7 @@ in
   traefik = runTestOn [ "aarch64-linux" "x86_64-linux" ] ./traefik.nix;
   trafficserver = runTest ./trafficserver.nix;
   transfer-sh = runTest ./transfer-sh.nix;
-  transmission_3 = handleTest ./transmission.nix { transmission = pkgs.transmission_3; };
-  transmission_4 = handleTest ./transmission.nix { transmission = pkgs.transmission_4; };
+  transmission_4 = handleTest ./transmission.nix { };
   trezord = runTest ./trezord.nix;
   trickster = runTest ./trickster.nix;
   trilium-server = runTestOn [ "x86_64-linux" ] ./trilium-server.nix;

nixos/tests/bittorrent.nix

@@ -6,12 +6,12 @@
 # which only works if the first client successfully uses the UPnP-IGD
 # protocol to poke a hole in the NAT.
 
-{ pkgs, ... }:
+{ lib, hostPkgs, ... }:
 
 let
 
   # Some random file to serve.
-  file = pkgs.hello.src;
+  file = hostPkgs.hello.src;
 
   internalRouterAddress = "192.168.3.1";
   internalClient1Address = "192.168.3.2";
@@ -23,7 +23,6 @@ let
   transmissionConfig =
     { pkgs, ... }:
     {
-      environment.systemPackages = [ pkgs.transmission_3 ];
       services.transmission = {
         enable = true;
         settings = {
@@ -37,7 +36,7 @@ in
 
 {
   name = "bittorrent";
-  meta = with pkgs.lib.maintainers; {
+  meta = with lib.maintainers; {
     maintainers = [
       rob
       bobvanderlinden

nixos/tests/dep-scan.nix

@@ -31,16 +31,16 @@
     # the program will try to download them at runtime.
     # https://github.com/owasp-dep-scan/dep-scan/issues/443
     environment.etc."vdb/data.index.vdb6".source = pkgs.fetchurl {
-      url = "https://huggingface.co/datasets/AppThreat/vdb/resolve/72377024f9742c6e700a113fc7059b18f738081c/app-2y/data.index.vdb6";
-      hash = "sha256-/9RIL6KVwmUmcKteOhWlnzjtZzGUbmRzua5o4Z8Mu9I=";
+      url = "https://huggingface.co/datasets/AppThreat/vdb/resolve/40609f230dd7c83178e054e0219c367b49a2c920/app-2y/data.index.vdb6";
+      hash = "sha256-UyE0xiLT0T4ygBdEvDi4VQW/vxwalN6YV9EJ9RoLYy4=";
     };
     environment.etc."vdb/data.vdb6".source = pkgs.fetchurl {
-      url = "https://huggingface.co/datasets/AppThreat/vdb/resolve/72377024f9742c6e700a113fc7059b18f738081c/app-2y/data.vdb6";
-      hash = "sha256-6gCftnjal9ZMXV+25fVANdJRuI/CN083OOnc8yA5TTw=";
+      url = "https://huggingface.co/datasets/AppThreat/vdb/resolve/40609f230dd7c83178e054e0219c367b49a2c920/app-2y/data.vdb6";
+      hash = "sha256-k5QIowFD8H/hwaRz1p8RXlFEIrKjnFUtxtZTfD67B+U=";
     };
     environment.etc."vdb/vdb.meta".source = pkgs.fetchurl {
-      url = "https://huggingface.co/datasets/AppThreat/vdb/resolve/72377024f9742c6e700a113fc7059b18f738081c/app-2y/vdb.meta";
-      hash = "sha256-i0oI3ODrmm8PF9UGJ9gy9QzQ0SKjLo9DdqYX/kqoHak=";
+      url = "https://huggingface.co/datasets/AppThreat/vdb/resolve/40609f230dd7c83178e054e0219c367b49a2c920/app-2y/vdb.meta";
+      hash = "sha256-eQB0dHlNw31sKsRcVUByhIfuIN35+m3VAcBHIfusNPY=";
     };
     environment.variables = {
       VDB_HOME = "/tmp/vdb";

nixos/tests/dictd.nix

@@ -0,0 +1,29 @@
+{ lib, pkgs, ... }:
+{
+  name = "dictd";
+  meta.maintainers = with lib.maintainers; [
+    h7x4
+  ];
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.dictd = {
+        enable = true;
+        DBs = with pkgs.dictdDBs; [
+          jpn2eng
+          eng2jpn
+        ];
+      };
+    };
+
+  testScript = ''
+    machine.wait_for_unit("dictd.service")
+    machine.wait_for_open_port(2628)
+
+    machine.succeed("dict --serverinfo | grep 'On machine: up'")
+    machine.succeed("dict --dbs | grep '${pkgs.dictdDBs.jpn2eng.name}'")
+    machine.succeed("dict -d '${pkgs.dictdDBs.jpn2eng.name}' 例え | grep example")
+    machine.succeed("dict -d '${pkgs.dictdDBs.eng2jpn.name}' example | grep 例え")
+  '';
+}

nixos/tests/discourse.nix

@@ -29,7 +29,7 @@ in
   nodes.discourse =
     { nodes, ... }:
     {
-      virtualisation.memorySize = 2048;
+      virtualisation.memorySize = 4096;
       virtualisation.cores = 4;
       virtualisation.useNixStoreImage = true;
       virtualisation.writableStore = false;

nixos/tests/kismet.nix

@@ -69,7 +69,7 @@ in
         };
 
       station =
-        { config, ... }:
+        { config, pkgs, ... }:
         {
           networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
             {
@@ -98,10 +98,11 @@ in
               inherit serverAddress;
             };
           };
+          environment.systemPackages = [ pkgs.nettools ];
         };
 
       monitor =
-        { config, ... }:
+        { config, pkgs, ... }:
         {
           networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
             {
@@ -189,10 +190,10 @@ in
             };
           };
 
-          environment.systemPackages = with pkgs; [
+          environment.systemPackages = [
             config.services.kismet.package
             config.services.vwifi.package
-            jq
+            pkgs.jq
           ];
         };
     };

nixos/tests/kubo/default.nix

@@ -1,5 +1,5 @@
-{ recurseIntoAttrs, runTest }:
-recurseIntoAttrs {
+{ lib, runTest }:
+lib.recurseIntoAttrs {
   kubo = runTest ./kubo.nix;
   kubo-fuse = runTest ./kubo-fuse.nix;
 }

nixos/tests/logkeys.nix

@@ -0,0 +1,34 @@
+{ lib, ... }:
+{
+  name = "logkeys";
+  meta.maintainers = with lib.maintainers; [ h7x4 ];
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      imports = [ ./common/user-account.nix ];
+
+      services.getty.autologinUser = "alice";
+
+      services.logkeys = {
+        enable = true;
+        device = "virtio-kbd";
+      };
+
+      # logkeys doesn't support specifying a device in `by-path`.
+      # In order not to make the test dependend on the ordering of the input event devices,
+      # we'll create a custom symlink before starting the service.
+      systemd.services.logkeys.serviceConfig.ExecStartPre = [
+        "+${lib.getExe' pkgs.coreutils "ln"} -s /dev/input/by-path/pci-0000:00:0a.0-event-kbd /dev/input/virtio-kbd"
+      ];
+    };
+
+  testScript = ''
+    machine.wait_for_unit("getty@tty1.service")
+    machine.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
+    machine.wait_for_unit("logkeys.service")
+
+    machine.send_chars("hello world\n")
+    machine.wait_until_succeeds("grep 'hello world' /var/log/logkeys.log")
+  '';
+}

nixos/tests/munge.nix

@@ -0,0 +1,28 @@
+{ lib, ... }:
+{
+  name = "munge";
+  meta.maintainers = with lib.maintainers; [ h7x4 ];
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      imports = [ ./common/user-account.nix ];
+
+      services.munge.enable = true;
+    };
+
+  testScript =
+    { nodes }:
+    let
+      aliceUid = toString nodes.machine.users.users.alice.uid;
+    in
+    ''
+      machine.succeed("mkdir -p /etc/munge && echo '${lib.strings.replicate 5 "hunter2"}' > /etc/munge/munge.key && chown munge: /etc/munge/munge.key")
+      machine.systemctl("restart munged.service")
+      machine.wait_for_unit("munged.service")
+
+      machine.succeed("sudo -u bob -- munge -u ${aliceUid} -s 'top secret' -o ./secret.txt")
+      machine.succeed("grep -v 'top secret' ./secret.txt")
+      machine.succeed("sudo -u alice unmunge -i ./secret.txt | grep 'top secret'")
+    '';
+}

nixos/tests/nominatim.nix

@@ -11,8 +11,8 @@ in
   name = "nominatim";
   meta = {
     maintainers = with lib.teams; [
-      geospatial
-      ngi
+      geospatial.members
+      ngi.members
     ];
   };
 

nixos/tests/sks.nix

@@ -0,0 +1,57 @@
+{ lib, pkgs, ... }:
+let
+  gpgKeyring = (
+    pkgs.runCommand "gpg-keyring" { buildInputs = [ pkgs.gnupg ]; } ''
+      mkdir -p $out
+      export GNUPGHOME=$out
+      cat > foo <<EOF
+        %echo Generating a basic OpenPGP key
+        %no-protection
+        Key-Type: DSA
+        Key-Length: 1024
+        Subkey-Type: ELG-E
+        Subkey-Length: 1024
+        Name-Real: Foo Example
+        Name-Email: foo@example.org
+        Expire-Date: 0
+        # Do a commit here, so that we can later print "done"
+        %commit
+        %echo done
+      EOF
+      gpg --batch --generate-key foo
+      rm $out/S.gpg-agent $out/S.gpg-agent.*
+    ''
+  );
+in
+{
+  name = "sks";
+  meta.maintainers = with lib.maintainers; [ h7x4 ];
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [ pkgs.gnupg ];
+
+      services.sks.enable = true;
+    };
+
+  testScript = ''
+    machine.wait_for_unit("sks-db.service")
+    machine.wait_for_open_port(11371)
+
+    response = machine.succeed("curl -f -s http://127.0.0.1:11371/")
+    assert "<title>SKS OpenPGP Public Key Server</title>" in response, "HTML title not found"
+
+    # Copy the keyring
+    machine.succeed("cp -R ${gpgKeyring} /tmp/GNUPGHOME")
+
+    # Extract our GPG key id
+    keyId = machine.succeed("GNUPGHOME=/tmp/GNUPGHOME gpg --list-keys | grep dsa1024 --after-context=1 | grep -v dsa1024").strip()
+
+    # Send the key to our local keyserver
+    machine.succeed("GNUPGHOME=/tmp/GNUPGHOME gpg --keyserver hkp://127.0.0.1:11371 --send-keys " + keyId)
+
+    # Receive the key from our local keyserver to a separate directory
+    machine.succeed("GNUPGHOME=$(mktemp -d) gpg --keyserver hkp://127.0.0.1:11371 --recv-keys " + keyId)
+  '';
+}

nixos/tests/sssd-ldap.nix

@@ -112,23 +112,25 @@ import ./make-test-python.nix (
           enable = true;
           # just for testing purposes, don't put this into the Nix store in production!
           environmentFile = "${pkgs.writeText "ldap-root" "LDAP_BIND_PW=${ldapRootPassword}"}";
-          config = ''
-            [sssd]
-            config_file_version = 2
-            services = nss, pam, sudo
-            domains = ${dbDomain}
+          settings = {
+            sssd = {
+              config_file_version = 2;
+              services = "nss, pam, sudo";
+              domains = dbDomain;
+            };
 
-            [domain/${dbDomain}]
-            auth_provider = ldap
-            id_provider = ldap
-            ldap_uri = ldaps://127.0.0.1:636
-            ldap_tls_reqcert = allow
-            ldap_tls_cacert = /etc/cert.pem
-            ldap_search_base = ${dbSuffix}
-            ldap_default_bind_dn = cn=${ldapRootUser},${dbSuffix}
-            ldap_default_authtok_type = password
-            ldap_default_authtok = $LDAP_BIND_PW
-          '';
+            "domain/${dbDomain}" = {
+              auth_provider = "ldap";
+              id_provider = "ldap";
+              ldap_uri = "ldaps://127.0.0.1:636";
+              ldap_tls_reqcert = "allow";
+              ldap_tls_cacert = "/etc/cert.pem";
+              ldap_search_base = dbSuffix;
+              ldap_default_bind_dn = "cn=${ldapRootUser},${dbSuffix}";
+              ldap_default_authtok_type = "password";
+              ldap_default_authtok = "$LDAP_BIND_PW";
+            };
+          };
         };
       };
 

nixos/tests/sssd-legacy-config.nix

@@ -0,0 +1,37 @@
+import ./make-test-python.nix (
+  { pkgs, ... }:
+
+  {
+    name = "sssd-legacy-config";
+    meta = with pkgs.lib.maintainers; {
+      maintainers = [ bbigras ];
+    };
+    nodes.machine.services.sssd = {
+      enable = true;
+      config = # ini
+        ''
+          [sssd]
+          services = nss, pam
+          domains = shadowutils
+
+          [nss]
+
+          [pam]
+
+          [domain/shadowutils]
+          id_provider = proxy
+          proxy_lib_name = files
+          auth_provider = proxy
+          proxy_pam_target = sssd-shadowutils
+          proxy_fast_alias = True
+        '';
+    };
+
+    testScript = ''
+      start_all()
+      machine.wait_for_unit("multi-user.target")
+      machine.wait_for_unit("sssd.service")
+      machine.succeed("sssctl config-check")
+    '';
+  }
+)

nixos/tests/sssd.nix

@@ -1,22 +0,0 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-
-  {
-    name = "sssd";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ bbigras ];
-    };
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.sssd.enable = true;
-      };
-
-    testScript = ''
-      start_all()
-      machine.wait_for_unit("multi-user.target")
-      machine.wait_for_unit("sssd.service")
-      machine.succeed("sssctl config-check")
-    '';
-  }
-)

nixos/tests/svnserve.nix

@@ -0,0 +1,60 @@
+{ pkgs, ... }:
+{
+  name = "svnserve";
+
+  nodes = {
+    server = {
+      virtualisation.vlans = [ 1 ];
+
+      networking = {
+        useNetworkd = true;
+        useDHCP = false;
+        firewall.allowedTCPPorts = [ 3690 ];
+      };
+
+      systemd.network.networks."01-eth1" = {
+        name = "eth1";
+        networkConfig.Address = "10.0.0.1/24";
+      };
+
+      services.svnserve.enable = true;
+
+      environment.systemPackages = [ pkgs.subversion ];
+    };
+
+    client =
+      { pkgs, ... }:
+      {
+        virtualisation.vlans = [ 1 ];
+
+        networking = {
+          useNetworkd = true;
+          useDHCP = false;
+        };
+
+        systemd.network.networks."01-eth1" = {
+          name = "eth1";
+          networkConfig.Address = "10.0.0.2/24";
+        };
+
+        environment.systemPackages = [ pkgs.subversion ];
+      };
+  };
+
+  testScript =
+    { nodes, ... }:
+    ''
+      start_all()
+
+      server.wait_for_unit("svnserve")
+      server.wait_for_open_port(3690)
+      server.succeed("svnadmin create '${nodes.server.services.svnserve.svnBaseDir}/project'")
+      server.succeed("sed -i 's/# anon-access = read/anon-access = write/' '${nodes.server.services.svnserve.svnBaseDir}/project/conf/svnserve.conf'")
+
+      client.succeed("svn checkout svn://10.0.0.1/project")
+      client.succeed("cd ./project && echo hello > ./file.txt && svn add ./file.txt && svn commit -m 'Added file.txt'")
+
+      client.succeed("svn checkout svn://10.0.0.1/project project-copy")
+      client.succeed("grep hello project-copy/file.txt")
+    '';
+}

nixos/tests/transmission.nix

@@ -1,5 +1,5 @@
 import ./make-test-python.nix (
-  { pkgs, transmission, ... }:
+  { pkgs, ... }:
   {
     name = "transmission";
     meta = with pkgs.lib.maintainers; {
@@ -16,7 +16,6 @@ import ./make-test-python.nix (
         security.apparmor.enable = true;
 
         services.transmission.enable = true;
-        services.transmission.package = transmission;
       };
 
     testScript = ''

nixos/tests/web-apps/movim/default.nix

@@ -1,6 +1,5 @@
-{ recurseIntoAttrs, runTest }:
-
-recurseIntoAttrs {
+{ lib, runTest }:
+lib.recurseIntoAttrs {
   ejabberd-h2o = runTest ./ejabberd-h2o.nix;
   prosody-nginx = runTest ./prosody-nginx.nix;
 }

nixos/tests/web-servers/h2o/default.nix

@@ -1,6 +1,5 @@
-{ recurseIntoAttrs, runTest }:
-
-recurseIntoAttrs {
+{ lib, runTest }:
+lib.recurseIntoAttrs {
   basic = runTest ./basic.nix;
   mruby = runTest ./mruby.nix;
   tls-recommendations = runTest ./tls-recommendations.nix;

pkgs/applications/audio/quodlibet/default.nix

@@ -192,7 +192,6 @@ python3.pkgs.buildPythonApplication rec {
     homepage = "https://quodlibet.readthedocs.io/en/latest";
     license = lib.licenses.gpl2Plus;
     maintainers = with lib.maintainers; [
-      coroa
       pbogdan
     ];
   };

pkgs/applications/editors/emacs/make-emacs.nix

@@ -53,7 +53,6 @@
   ncurses,
   nixosTests,
   pkg-config,
-  recurseIntoAttrs,
   sigtool,
   sqlite,
   replaceVars,
@@ -496,7 +495,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit withNativeCompilation;
     inherit withTreeSitter;
     inherit withXwidgets;
-    pkgs = recurseIntoAttrs (emacsPackagesFor finalAttrs.finalPackage);
+    pkgs = lib.recurseIntoAttrs (emacsPackagesFor finalAttrs.finalPackage);
     tests = {
       inherit (nixosTests) emacs-daemon;
       withPackages = callPackage ./build-support/wrapper-test.nix {

pkgs/applications/editors/jetbrains/bin/versions.json

@@ -11,10 +11,10 @@
     "clion": {
       "update-channel": "CLion RELEASE",
       "url-template": "https://download.jetbrains.com/cpp/CLion-{version}.tar.gz",
-      "version": "2025.2.3",
-      "sha256": "364502648a5f1480bd06a00ee410968d224f96b263c78f5148614063f7bc3961",
-      "url": "https://download.jetbrains.com/cpp/CLion-2025.2.3.tar.gz",
-      "build_number": "252.26830.83"
+      "version": "2025.2.4",
+      "sha256": "72c89e91f6636aa53930288fe02466e5e09a50a3c8b6ed5ad2f69b35ec9bacc5",
+      "url": "https://download.jetbrains.com/cpp/CLion-2025.2.4.tar.gz",
+      "build_number": "252.27397.114"
     },
     "datagrip": {
       "update-channel": "DataGrip RELEASE",
@@ -100,10 +100,10 @@
     "rider": {
       "update-channel": "Rider RELEASE",
       "url-template": "https://download.jetbrains.com/rider/JetBrains.Rider-{version}.tar.gz",
-      "version": "2025.2.3",
-      "sha256": "1cfc4e756007c5a8b749c0848e4c050303aeeaabc0917f19732d908201b69446",
-      "url": "https://download.jetbrains.com/rider/JetBrains.Rider-2025.2.3.tar.gz",
-      "build_number": "252.26830.109"
+      "version": "2025.2.4",
+      "sha256": "cd428f7d6db5055cd2594c3d1ef91241843d263cb6301369d3121a847ffb6589",
+      "url": "https://download.jetbrains.com/rider/JetBrains.Rider-2025.2.4.tar.gz",
+      "build_number": "252.27397.121"
     },
     "ruby-mine": {
       "update-channel": "RubyMine RELEASE",
@@ -116,10 +116,10 @@
     "rust-rover": {
       "update-channel": "RustRover RELEASE",
       "url-template": "https://download.jetbrains.com/rustrover/RustRover-{version}.tar.gz",
-      "version": "2025.2.3",
-      "sha256": "b96846e7257d14ef38154017cdbe9c63c66d19b59e94ad096db2c9ae2380103b",
-      "url": "https://download.jetbrains.com/rustrover/RustRover-2025.2.3.tar.gz",
-      "build_number": "252.26830.136"
+      "version": "2025.2.4",
+      "sha256": "3da078b5e68bac2283c0dd60fe3ff17d6025d92d6237bc6fab74f1f35ff6fbe5",
+      "url": "https://download.jetbrains.com/rustrover/RustRover-2025.2.4.tar.gz",
+      "build_number": "252.27397.120"
     },
     "webstorm": {
       "update-channel": "WebStorm RELEASE",
@@ -150,10 +150,10 @@
     "clion": {
       "update-channel": "CLion RELEASE",
       "url-template": "https://download.jetbrains.com/cpp/CLion-{version}-aarch64.tar.gz",
-      "version": "2025.2.3",
-      "sha256": "e4cc668cb1e0cf5b976ab8eb3997388f1e7cc673e51af3f3c6afa3666a9c47b6",
-      "url": "https://download.jetbrains.com/cpp/CLion-2025.2.3-aarch64.tar.gz",
-      "build_number": "252.26830.83"
+      "version": "2025.2.4",
+      "sha256": "b89010db5272eb6490a0084bd3247c9de657ffd0d12a827147f2c77a406f85b5",
+      "url": "https://download.jetbrains.com/cpp/CLion-2025.2.4-aarch64.tar.gz",
+      "build_number": "252.27397.114"
     },
     "datagrip": {
       "update-channel": "DataGrip RELEASE",
@@ -239,10 +239,10 @@
     "rider": {
       "update-channel": "Rider RELEASE",
       "url-template": "https://download.jetbrains.com/rider/JetBrains.Rider-{version}-aarch64.tar.gz",
-      "version": "2025.2.3",
-      "sha256": "bd03e42b3a04cc1e1b234333285873746bd4d04bf3746fb62b171334a168e976",
-      "url": "https://download.jetbrains.com/rider/JetBrains.Rider-2025.2.3-aarch64.tar.gz",
-      "build_number": "252.26830.109"
+      "version": "2025.2.4",
+      "sha256": "75c38a2bd94e31200fc4e3a6cfad83b35c65d36c9d61b9a7b208e3ec82f8c81a",
+      "url": "https://download.jetbrains.com/rider/JetBrains.Rider-2025.2.4-aarch64.tar.gz",
+      "build_number": "252.27397.121"
     },
     "ruby-mine": {
       "update-channel": "RubyMine RELEASE",
@@ -255,10 +255,10 @@
     "rust-rover": {
       "update-channel": "RustRover RELEASE",
       "url-template": "https://download.jetbrains.com/rustrover/RustRover-{version}-aarch64.tar.gz",
-      "version": "2025.2.3",
-      "sha256": "5ffdff2a6617fcc75b68a145bc9dce14a71d0d9dc31a1adde5c8630d954a370d",
-      "url": "https://download.jetbrains.com/rustrover/RustRover-2025.2.3-aarch64.tar.gz",
-      "build_number": "252.26830.136"
+      "version": "2025.2.4",
+      "sha256": "03052ead61bd13eaa616d1126add5b6b6fa9dbc6ef591109b358005d5b630606",
+      "url": "https://download.jetbrains.com/rustrover/RustRover-2025.2.4-aarch64.tar.gz",
+      "build_number": "252.27397.120"
     },
     "webstorm": {
       "update-channel": "WebStorm RELEASE",
@@ -289,10 +289,10 @@
     "clion": {
       "update-channel": "CLion RELEASE",
       "url-template": "https://download.jetbrains.com/cpp/CLion-{version}.dmg",
-      "version": "2025.2.3",
-      "sha256": "4763233873139a0adf8c5cb285ace830eb0be363bb132de2f7ac4b4c1a58b2f2",
-      "url": "https://download.jetbrains.com/cpp/CLion-2025.2.3.dmg",
-      "build_number": "252.26830.83"
+      "version": "2025.2.4",
+      "sha256": "04383caba9ba670841dd336e546f2027b28286d23ea30298e66f422fbc081272",
+      "url": "https://download.jetbrains.com/cpp/CLion-2025.2.4.dmg",
+      "build_number": "252.27397.114"
     },
     "datagrip": {
       "update-channel": "DataGrip RELEASE",
@@ -378,10 +378,10 @@
     "rider": {
       "update-channel": "Rider RELEASE",
       "url-template": "https://download.jetbrains.com/rider/JetBrains.Rider-{version}.dmg",
-      "version": "2025.2.3",
-      "sha256": "09717e33d640052143492fe7e4485c93218c04c9efc1615e8f0d5dbdb4fe5526",
-      "url": "https://download.jetbrains.com/rider/JetBrains.Rider-2025.2.3.dmg",
-      "build_number": "252.26830.109"
+      "version": "2025.2.4",
+      "sha256": "f8cabc370393b6be2bd244413fd5692714c02e11cf24eb9c32438367d2895750",
+      "url": "https://download.jetbrains.com/rider/JetBrains.Rider-2025.2.4.dmg",
+      "build_number": "252.27397.121"
     },
     "ruby-mine": {
       "update-channel": "RubyMine RELEASE",
@@ -394,10 +394,10 @@
     "rust-rover": {
       "update-channel": "RustRover RELEASE",
       "url-template": "https://download.jetbrains.com/rustrover/RustRover-{version}.dmg",
-      "version": "2025.2.3",
-      "sha256": "7c9e08ded178f233cabc8b0bebdda8504ef10a6afaf1856b33da582d69ca378d",
-      "url": "https://download.jetbrains.com/rustrover/RustRover-2025.2.3.dmg",
-      "build_number": "252.26830.136"
+      "version": "2025.2.4",
+      "sha256": "71f0735c546b659d4d1ed9ce58411848146ac0216b4b971583ce682311e9e075",
+      "url": "https://download.jetbrains.com/rustrover/RustRover-2025.2.4.dmg",
+      "build_number": "252.27397.120"
     },
     "webstorm": {
       "update-channel": "WebStorm RELEASE",
@@ -428,10 +428,10 @@
     "clion": {
       "update-channel": "CLion RELEASE",
       "url-template": "https://download.jetbrains.com/cpp/CLion-{version}-aarch64.dmg",
-      "version": "2025.2.3",
-      "sha256": "87d1b9d0188ee540ce26572d648a4a7ef1b2b2d90c18227932a28d9d263b58df",
-      "url": "https://download.jetbrains.com/cpp/CLion-2025.2.3-aarch64.dmg",
-      "build_number": "252.26830.83"
+      "version": "2025.2.4",
+      "sha256": "7bdef6d73e0edfbc5ef02b7e74e5508e5b18a9c21afb5ba82488527d837e2a94",
+      "url": "https://download.jetbrains.com/cpp/CLion-2025.2.4-aarch64.dmg",
+      "build_number": "252.27397.114"
     },
     "datagrip": {
       "update-channel": "DataGrip RELEASE",
@@ -517,10 +517,10 @@
     "rider": {
       "update-channel": "Rider RELEASE",
       "url-template": "https://download.jetbrains.com/rider/JetBrains.Rider-{version}-aarch64.dmg",
-      "version": "2025.2.3",
-      "sha256": "67c9c8f73844d9705c8e64f03afc659ef3146caccc079f183a758b0d7666a468",
-      "url": "https://download.jetbrains.com/rider/JetBrains.Rider-2025.2.3-aarch64.dmg",
-      "build_number": "252.26830.109"
+      "version": "2025.2.4",
+      "sha256": "e6bd0a07f5922c05c73d9170bbaa2219534fa8e5350b99f37c6a4bc9eb7c0870",
+      "url": "https://download.jetbrains.com/rider/JetBrains.Rider-2025.2.4-aarch64.dmg",
+      "build_number": "252.27397.121"
     },
     "ruby-mine": {
       "update-channel": "RubyMine RELEASE",
@@ -533,10 +533,10 @@
     "rust-rover": {
       "update-channel": "RustRover RELEASE",
       "url-template": "https://download.jetbrains.com/rustrover/RustRover-{version}-aarch64.dmg",
-      "version": "2025.2.3",
-      "sha256": "3ebf05feabd5858df21b0215dec39142427b4df50d929c0d94751425478d295d",
-      "url": "https://download.jetbrains.com/rustrover/RustRover-2025.2.3-aarch64.dmg",
-      "build_number": "252.26830.136"
+      "version": "2025.2.4",
+      "sha256": "8bad55d714d388c115c0d35c297eb5bdb140bc024b2bf602efc8d07a3327cad9",
+      "url": "https://download.jetbrains.com/rustrover/RustRover-2025.2.4-aarch64.dmg",
+      "build_number": "252.27397.120"
     },
     "webstorm": {
       "update-channel": "WebStorm RELEASE",

pkgs/applications/editors/neovim/tests/default.nix

@@ -128,7 +128,7 @@ let
     }
   );
 in
-pkgs.recurseIntoAttrs rec {
+pkgs.lib.recurseIntoAttrs rec {
 
   inherit nmt;
 

pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix

@@ -242,12 +242,12 @@
   };
   c3 = buildGrammar {
     language = "c3";
-    version = "0.0.0+rev=057a75d";
+    version = "0.0.0+rev=e457069";
     src = fetchFromGitHub {
       owner = "c3lang";
       repo = "tree-sitter-c3";
-      rev = "057a75df0c866034d8edce989f701ee2cb0481d8";
-      hash = "sha256-MeeyiX9ZozGDbTNbO/Tvs97tQyzic5pu2sIPgXow2ok=";
+      rev = "e4570693b8064a83cd7826795d5ef29400313d3c";
+      hash = "sha256-gzlLKP/BE5sNM8tJ7ObKQNvd36CqWipFWhMkb4XqjjU=";
     };
     meta.homepage = "https://github.com/c3lang/tree-sitter-c3";
   };
@@ -518,14 +518,14 @@
   };
   diff = buildGrammar {
     language = "diff";
-    version = "0.0.0+rev=e42b8de";
+    version = "0.0.0+rev=2520c3f";
     src = fetchFromGitHub {
-      owner = "the-mikedavis";
+      owner = "tree-sitter-grammars";
       repo = "tree-sitter-diff";
-      rev = "e42b8def4f75633568f1aecfe01817bf15164928";
-      hash = "sha256-1ibGin1e6+geAQNoV/KLCBOoXYcZo7S5+Q2XgsZPIfU=";
+      rev = "2520c3f934b3179bb540d23e0ef45f75304b5fed";
+      hash = "sha256-8rYLNGgoZSvvfqO2++nAgFKmvbkKJ3m+9B8bTXp6Us4=";
     };
-    meta.homepage = "https://github.com/the-mikedavis/tree-sitter-diff";
+    meta.homepage = "https://github.com/tree-sitter-grammars/tree-sitter-diff";
   };
   disassembly = buildGrammar {
     language = "disassembly";
@@ -562,12 +562,12 @@
   };
   dot = buildGrammar {
     language = "dot";
-    version = "0.0.0+rev=71e2c52";
+    version = "0.0.0+rev=80327ab";
     src = fetchFromGitHub {
       owner = "rydesun";
       repo = "tree-sitter-dot";
-      rev = "71e2c5241eef9de920a4efedfefd1d527dd9a118";
-      hash = "sha256-Z1XtNX1zV8xGlsaFbqh2VXPAx0fs4D7JxwqaEWSWcB0=";
+      rev = "80327abbba6f47530edeb0df9f11bd5d5c93c14d";
+      hash = "sha256-sepmaKnpbj/bgMBa06ksQFOMPtcCqGaINiJqFBJN/0Y=";
     };
     meta.homepage = "https://github.com/rydesun/tree-sitter-dot";
   };
@@ -1082,12 +1082,12 @@
   };
   gomod = buildGrammar {
     language = "gomod";
-    version = "0.0.0+rev=6efb596";
+    version = "0.0.0+rev=2e88687";
     src = fetchFromGitHub {
       owner = "camdencheek";
       repo = "tree-sitter-go-mod";
-      rev = "6efb59652d30e0e9cd5f3b3a669afd6f1a926d3c";
-      hash = "sha256-KD6Fio9qie3wbGAvQaYsMdYOK1QjnRrGExt1oL/6mis=";
+      rev = "2e886870578eeba1927a2dc4bd2e2b3f598c5f9a";
+      hash = "sha256-OfhV3lxdyIhA3XZYbafEtdOsQsTCSSCBrN3WbzSVg0g=";
     };
     meta.homepage = "https://github.com/camdencheek/tree-sitter-go-mod";
   };
@@ -1369,23 +1369,23 @@
   };
   hyprlang = buildGrammar {
     language = "hyprlang";
-    version = "0.0.0+rev=d626ec0";
+    version = "0.0.0+rev=b23e85d";
     src = fetchFromGitHub {
       owner = "tree-sitter-grammars";
       repo = "tree-sitter-hyprlang";
-      rev = "d626ec06e4d876fc41200a30b3e6f2b4714c7367";
-      hash = "sha256-f8CjiLd2tof+zfr7ze/CxZWtKRqQv8sK9Q21ZxEg6C8=";
+      rev = "b23e85dded5d150ffee0ac83c01cbeb1520aad2f";
+      hash = "sha256-COIl7ngqTzQQBxgmRNCwF8x7OHNGCrUa5G/hPrlXsmw=";
     };
     meta.homepage = "https://github.com/tree-sitter-grammars/tree-sitter-hyprlang";
   };
   idl = buildGrammar {
     language = "idl";
-    version = "0.0.0+rev=3632e92";
+    version = "0.0.0+rev=86d434e";
     src = fetchFromGitHub {
       owner = "cathaysia";
       repo = "tree-sitter-idl";
-      rev = "3632e926ef4ba924b05993683111480af0d5c9e3";
-      hash = "sha256-fywOjqJ0yrG/QayyBXdc2iOtaytdc9bqd1leQ8kxR/0=";
+      rev = "86d434e732f971ecec24571e0dcb6b14c8b19952";
+      hash = "sha256-u+2KBpk9ctry5cHlvqarYS8l5ERFlWrs9D09u2C6cvI=";
     };
     meta.homepage = "https://github.com/cathaysia/tree-sitter-idl";
   };
@@ -1624,12 +1624,12 @@
   };
   kitty = buildGrammar {
     language = "kitty";
-    version = "0.0.0+rev=064d1b4";
+    version = "0.0.0+rev=2e9b602";
     src = fetchFromGitHub {
       owner = "OXY2DEV";
       repo = "tree-sitter-kitty";
-      rev = "064d1b4d8ae1b93244de0ff6bc9f0ee0cffee3b5";
-      hash = "sha256-DN6SWXZM1HedUtV7mDEEgictaI2V/pQHh5cg906qfO0=";
+      rev = "2e9b602ca676cac63887cca5a4535106f3475c82";
+      hash = "sha256-9knYf4/0G8zX2grWJi6U/1TQmUWQCjdMK3Vd/fw93C0=";
     };
     meta.homepage = "https://github.com/OXY2DEV/tree-sitter-kitty";
   };
@@ -1891,12 +1891,12 @@
   };
   mlir = buildGrammar {
     language = "mlir";
-    version = "0.0.0+rev=47c3f2c";
+    version = "0.0.0+rev=6543579";
     src = fetchFromGitHub {
       owner = "artagnon";
       repo = "tree-sitter-mlir";
-      rev = "47c3f2cf3b10016503f2577c2d99c15bb2053402";
-      hash = "sha256-1NmkSEGh6Y9BIGcdW4HrMNdqlKKfVHgcY1Amk4EKf8U=";
+      rev = "65435795eb4132d5eff66d62347050e863e5ebe5";
+      hash = "sha256-s7oNzU7rTjejwgW9F28GayuxEe/Gn51+yQi7iPqgFfw=";
     };
     generate = true;
     meta.homepage = "https://github.com/artagnon/tree-sitter-mlir";
@@ -2692,14 +2692,13 @@
   };
   scfg = buildGrammar {
     language = "scfg";
-    version = "0.0.0+rev=2f3709e";
+    version = "0.0.0+rev=d850fd4";
     src = fetchFromGitHub {
       owner = "rockorager";
       repo = "tree-sitter-scfg";
-      rev = "2f3709e7656fa2c443f92041c91a9f843f8cd625";
-      hash = "sha256-2/n+pSR6Ojahm8iBnpNsQscrXQqzZflKBA42gX29u50=";
+      rev = "d850fd470445d73de318a21d734d1e09e29b773c";
+      hash = "sha256-AnyOcQFA3N6AFZiG7eLS1xCm1qX6hko9lFV4oV9p/E8=";
     };
-    generate = true;
     meta.homepage = "https://github.com/rockorager/tree-sitter-scfg";
   };
   scheme = buildGrammar {

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -1862,6 +1862,10 @@ assertNoAdditions {
       ];
   };
 
+  maple-nvim = super.maple-nvim.overrideAttrs {
+    dependencies = [ self.plenary-nvim ];
+  };
+
   markdown-preview-nvim =
     let
       # We only need its dependencies `node-modules`.
@@ -3186,6 +3190,7 @@ assertNoAdditions {
       "snacks.dashboard"
       "snacks.debug"
       "snacks.dim"
+      "snacks.explorer.init"
       "snacks.git"
       "snacks.image.convert"
       "snacks.image.image"
@@ -4086,8 +4091,9 @@ assertNoAdditions {
 
   wiki-vim = super.wiki-vim.overrideAttrs {
     checkInputs = [
-      # Optional telescope integration
+      # Optional picker integration
       self.telescope-nvim
+      self.fzf-lua
     ];
   };
 

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -618,6 +618,7 @@ https://github.com/lopi-py/luau-lsp.nvim/,HEAD,
 https://github.com/mkasa/lushtags/,,
 https://github.com/Bilal2453/luvit-meta/,HEAD,
 https://github.com/dccsillag/magma-nvim/,HEAD,
+https://github.com/forest-nvim/maple.nvim/,HEAD,
 https://github.com/winston0410/mark-radar.nvim/,HEAD,
 https://github.com/iamcco/markdown-preview.nvim/,,
 https://github.com/tadmccorkle/markdown.nvim/,HEAD,

pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "claude-code";
     publisher = "anthropic";
-    version = "2.0.28";
-    hash = "sha256-RfZDKiGPnmfNuq4D8dSO+Rk97g+Amo4G1apqgqVZttg=";
+    version = "2.0.30";
+    hash = "sha256-KQ+3yk5WmHIiu6evpPSWfzEbqVKFj2XY8wwGxcqGOJc=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/augment.vscode-augment/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "vscode-augment";
     publisher = "augment";
-    version = "0.603.0";
-    hash = "sha256-1CBZnBTu03iubIcIrUvCKeN6RtjKO3NUEXggdXTAwM8=";
+    version = "0.613.0";
+    hash = "sha256-2HvDCfNX+snwnqd9XI6rHBkGBydxnf5OYYfBnAAxjZk=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/betterthantomorrow.calva/default.nix

@@ -11,8 +11,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "calva";
     publisher = "betterthantomorrow";
-    version = "2.0.538";
-    hash = "sha256-lJ9AnTNN9TkPDh9u2KV1BLn/fgZOWSOXNOTAdV+r6s4=";
+    version = "2.0.539";
+    hash = "sha256-nNlEBm89sVQzLMfQjeE4uBUH/bH/mw8mYF+3/JfB78U=";
   };
 
   nativeBuildInputs = [

pkgs/applications/editors/vscode/extensions/biomejs.biome/default.nix

@@ -11,8 +11,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "biome";
     publisher = "biomejs";
-    version = "2025.7.41733";
-    hash = "sha256-wWyLIjNOBjIe72ed+wwfQWGH7Vzuea/0Xux0XJkhAkY=";
+    version = "2025.10.241456";
+    hash = "sha256-tihEFcDDYr/khLIcJbR5VSC/RujEvp/gcnWlokAqNBc=";
   };
 
   postInstall = ''

pkgs/applications/editors/vscode/extensions/default.nix

@@ -89,8 +89,8 @@ let
         mktplcRef = {
           publisher = "42Crunch";
           name = "vscode-openapi";
-          version = "4.38.0";
-          hash = "sha256-J9hZhPrHkJEFkiyD8eACiJwbsPfYGMK42FkcwkTQ0RE=";
+          version = "4.40.0";
+          hash = "sha256-nV7RZpDd+15YmINKrFSIlFurC955bnE4A8esrKWYVnE=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/42Crunch.vscode-openapi/changelog";
@@ -2350,8 +2350,8 @@ let
         mktplcRef = {
           name = "Ionide-fsharp";
           publisher = "Ionide";
-          version = "7.28.1";
-          hash = "sha256-JDrJAZB1QvLG/dXHOhg6VM8dgwEc1eV6BycoRfEQmuY=";
+          version = "7.28.3";
+          hash = "sha256-MUoYoElDVMZZHsUZ17fhfwZaHNAJ4j50lTqhhRw8EBI=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/Ionide.Ionide-fsharp/changelog";
@@ -2476,8 +2476,8 @@ let
         mktplcRef = {
           publisher = "jeff-hykin";
           name = "better-nix-syntax";
-          version = "2.2.3";
-          hash = "sha256-KhmkCMBWagi0JjZvupgaU7LA6hsGRE6SiHqdJlXyyX8=";
+          version = "2.3.0";
+          hash = "sha256-Zb4RFs2qkSMeQKkNXk4brrZBDiRK4e08taOOgdRWQEk=";
         };
         meta = {
           description = "Visual Studio Code extension providing Nix Syntax highlighting";
@@ -3641,8 +3641,8 @@ let
         mktplcRef = {
           name = "ocaml-platform";
           publisher = "ocamllabs";
-          version = "1.32.3";
-          hash = "sha256-KUzLrt7y3I6szpWVGk0NtBfXncw6ovNAkm1HyHj+MDk=";
+          version = "1.32.4";
+          hash = "sha256-ySJ6SLm+L2LPGbnus/skbk4WUPJ3VMXpCMEins3F8cc=";
         };
       };
 
@@ -3768,8 +3768,8 @@ let
         mktplcRef = {
           name = "prisma";
           publisher = "Prisma";
-          version = "6.17.1";
-          hash = "sha256-P+D6fQg30C2nJFv8z/+51cSk5etCvugAbRj7h7nyGd0=";
+          version = "6.18.0";
+          hash = "sha256-wStFklnjX+UDykxLjl+vDYnvAgjrqFG4ahDuCX2glwI=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/Prisma.prisma/changelog";

pkgs/applications/graphics/tesseract/default.nix

@@ -1,9 +1,10 @@
 {
+  lib,
   callPackage,
-  lowPrio,
 }:
 
 let
+  inherit (lib) lowPrio;
   base3 = callPackage ./tesseract3.nix { };
   base4 = callPackage ./tesseract4.nix { };
   base5 = callPackage ./tesseract5.nix { };

pkgs/applications/misc/ausweisapp/default.nix

@@ -16,13 +16,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "ausweisapp";
-  version = "2.3.2";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "Governikus";
     repo = "AusweisApp2";
     rev = finalAttrs.version;
-    hash = "sha256-xY5V5Z6HVtkFzLzWOVRTKdms356OO0EKnG+Nymurowo=";
+    hash = "sha256-vMvCnYSj7y6ETGoudV1YJwI2bibXePSkR4nQ4T5HqTo=";
   };
 
   nativeBuildInputs = [

pkgs/applications/misc/opentrack/default.nix

@@ -1,111 +0,0 @@
-{
-  pkgs,
-  mkDerivation,
-  lib,
-  callPackage,
-  fetchzip,
-  fetchFromGitHub,
-  cmake,
-  pkg-config,
-  ninja,
-  copyDesktopItems,
-  qtbase,
-  qttools,
-  opencv4,
-  procps,
-  eigen,
-  libXdmcp,
-  libevdev,
-  makeDesktopItem,
-  fetchurl,
-  fetchpatch,
-  wineWowPackages,
-  onnxruntime,
-}:
-let
-  version = "2023.3.0";
-
-  aruco = callPackage ./aruco.nix { };
-
-  # license.txt inside the zip file is MIT
-  xplaneSdk = fetchzip {
-    url = "https://developer.x-plane.com/wp-content/plugins/code-sample-generation/sdk_zip_files/XPSDK401.zip";
-    hash = "sha256-tUT9yV1949QVr5VebU/7esg7wwWkyak2TSA/kQSrbeo=";
-  };
-in
-mkDerivation {
-  pname = "opentrack";
-  inherit version;
-
-  src = fetchFromGitHub {
-    owner = "opentrack";
-    repo = "opentrack";
-    rev = "opentrack-${version}";
-    hash = "sha256-C0jLS55DcLJh/e5yM8kLG7fhhKvBNllv5HkfCWRIfc4=";
-  };
-
-  patches = [
-    # https://github.com/opentrack/opentrack/pull/1754
-    (fetchpatch {
-      url = "https://github.com/opentrack/opentrack/commit/d501d7e0b237ed0c305525788b423d842ffa356d.patch";
-      hash = "sha256-XMGHV78vt/Xn3hS+4V//pqtsdBQCfJPjIXxfwtdXX+Q=";
-    })
-  ];
-
-  nativeBuildInputs = [
-    cmake
-    pkg-config
-    ninja
-    copyDesktopItems
-  ];
-  buildInputs = [
-    qtbase
-    qttools
-    opencv4
-    procps
-    eigen
-    libXdmcp
-    libevdev
-    aruco
-    onnxruntime
-  ]
-  ++ lib.optionals pkgs.stdenv.targetPlatform.isx86_64 [ wineWowPackages.stable ];
-
-  env.NIX_CFLAGS_COMPILE = "-Wall -Wextra -Wpedantic -ffast-math -O3";
-  dontWrapQtApps = true;
-
-  cmakeFlags = [
-    "-GNinja"
-    "-DCMAKE_BUILD_TYPE=Release"
-    "-DSDK_ARUCO_LIBPATH=${aruco}/lib/libaruco.a"
-    "-DSDK_XPLANE=${xplaneSdk}"
-  ]
-  ++ lib.optionals pkgs.stdenv.targetPlatform.isx86_64 [ "-DSDK_WINE=ON" ];
-
-  postInstall = ''
-    wrapQtApp $out/bin/opentrack
-  '';
-
-  desktopItems = [
-    (makeDesktopItem rec {
-      name = "opentrack";
-      exec = "opentrack";
-      icon = fetchurl {
-        url = "https://github.com/opentrack/opentrack/raw/opentrack-${version}/gui/images/opentrack.png";
-        hash = "sha256-9k3jToEpdW14ErbNGHM4c0x/LH7k14RmtvY4dOYnITQ=";
-      };
-      desktopName = name;
-      genericName = "Head tracking software";
-      categories = [ "Utility" ];
-    })
-  ];
-
-  meta = {
-    homepage = "https://github.com/opentrack/opentrack";
-    description = "Head tracking software for MS Windows, Linux, and Apple OSX";
-    mainProgram = "opentrack";
-    changelog = "https://github.com/opentrack/opentrack/releases/tag/${version}";
-    license = lib.licenses.isc;
-    maintainers = with lib.maintainers; [ zaninime ];
-  };
-}

pkgs/applications/misc/xppen/default.nix

@@ -0,0 +1,19 @@
+{
+  callPackage,
+}:
+
+# to update: try to find the latest 3.x.x or 4.x.x .tar.gz on https://www.xp-pen.com/download
+{
+  xppen_3 = callPackage ./generic.nix {
+    pname = "xppen_3";
+    version = "3.4.9-240607";
+    url = "https://www.xp-pen.com/download/file.html?id=2901&pid=819&ext=gz";
+    hash = "sha256-ZXeTlDjhryXamb7x2LxDdOtf8R9rgKPyUsdx96XchWM=";
+  };
+  xppen_4 = callPackage ./generic.nix {
+    pname = "xppen_4";
+    version = "4.0.7-250117";
+    url = "https://www.xp-pen.com/download/file.html?id=3652&pid=1211&ext=gz";
+    hash = "sha256-sH05Qquo2u0npSlv8Par/mn1w/ESO9g42CCGwBauHhU=";
+  };
+}

pkgs/applications/misc/xppen/generic.nix

@@ -0,0 +1,71 @@
+{
+  lib,
+  stdenv,
+  fetchzip,
+  autoPatchelfHook,
+  qt5,
+  libusb1,
+  pname,
+  version,
+  url,
+  hash,
+}:
+
+stdenv.mkDerivation {
+  inherit pname version;
+
+  src = fetchzip {
+    name = "XPPenLinux${version}.tar.gz";
+    extension = "tar.gz";
+    inherit url hash;
+  };
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    qt5.wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    qt5.qtbase
+    libusb1
+  ];
+
+  dontConfigure = true;
+  dontBuild = true;
+  dontCheck = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    rm -r App/usr/lib/pentablet/{lib,platforms,PenTablet.sh}
+    mkdir -p $out/{bin,usr}
+    cp -r App/lib $out/lib
+    cp -r App/usr/share $out/share
+    cp -r App/usr/lib $out/usr/lib
+
+    # hack: edit the binary directly
+    # TODO: replace it with buildFHSEnv if possible? last time it caused other issues
+    sed -i 's#/usr/lib/pentablet#/var/lib/pentablet#g' $out/usr/lib/pentablet/PenTablet
+    ln -s $out/usr/lib/pentablet/PenTablet $out/bin/PenTablet
+
+    substituteInPlace $out/share/applications/xppentablet.desktop \
+      --replace-fail "/usr/lib/pentablet/PenTablet.sh" "PenTablet" \
+      --replace-fail "/usr/share/icons/hicolor/256x256/apps/xppentablet.png" "xppentablet"
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "XPPen driver";
+    downloadPage = "https://www.xp-pen.com/download/";
+    homepage = "https://www.xp-pen.com/";
+    license = lib.licenses.unfree;
+    mainProgram = "PenTablet";
+    maintainers = with lib.maintainers; [
+      gepbird
+      nasrally
+    ];
+    platforms = [ "x86_64-linux" ];
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+  };
+}

pkgs/applications/networking/browsers/chromium/common.nix

@@ -467,10 +467,13 @@ let
       # Chromium reads initial_preferences from its own executable directory
       # This patch modifies it to read /etc/chromium/initial_preferences
       ./patches/chromium-initial-prefs.patch
+    ]
+    ++ lib.optionals (!chromiumVersionAtLeast "142") [
       # https://github.com/chromium/chromium/commit/02b6456643700771597c00741937e22068b0f956
       # https://github.com/chromium/chromium/commit/69736ffe943ff996d4a88d15eb30103a8c854e29
       # Rebased variant of patch to build M126+ with LLVM 17.
       # staging-next will bump LLVM to 18, so we will be able to drop this soon.
+      # Started failing to apply with M142, but this is no longer needed anyway.
       ./patches/chromium-126-llvm-17.patch
     ]
     ++ lib.optionals (!chromiumVersionAtLeast "140") [
@@ -529,7 +532,7 @@ let
       # electron 35 (M134) and 36 (M136)
       ./patches/chromium-134-rust-1.86-mismatched_lifetime_syntaxes.patch
     ]
-    ++ lib.optionals (chromiumVersionAtLeast "141") [
+    ++ lib.optionals (versionRange "141" "142") [
       (fetchpatch {
         # Fix "invalid application of 'sizeof' to an incomplete type 'blink::CSSStyleSheet'"
         # by reverting https://chromium-review.googlesource.com/c/chromium/src/+/6892157
@@ -539,6 +542,49 @@ let
         revert = true;
         hash = "sha256-pnEus2NHpNWZ6ZSXLgdTn+it7oy1MPZPbD8SOAKLWbw=";
       })
+    ]
+    ++ lib.optionals (chromiumVersionAtLeast "142" && lib.versionOlder rustcVersion "1.90") [
+      (fetchpatch {
+        # Fix "ld.lld: error: undefined symbol: __rustc::__rust_alloc_error_handler_should_panic'"
+        # with Rust < 1.90 by reverting https://chromium-review.googlesource.com/c/chromium/src/+/6935385
+        name = "chromium-142-Revert-rust-Remove-the-old-__rust_alloc_error_handler_should_panic-symbol.patch";
+        url = "https://chromium.googlesource.com/chromium/src/+/e33287758f2234d6aabfc5d4e011c4e81e3a47cf^!?format=TEXT";
+        decode = "base64 -d";
+        revert = true;
+        hash = "sha256-0vRDz7wwGCsqm38fVvkLLzOOtEtd8CnqyjDLgGofh/o=";
+      })
+    ]
+    ++ lib.optionals (versionRange "142" "143") [
+      (fetchpatch {
+        # Fix https://issues.chromium.org/issues/450752866 by backporting
+        # https://chromium-review.googlesource.com/c/chromium/src/+/7030724 from M143
+        name = "chromium-142-Backport-Add-missing-include-for-FormFieldData-type-completeness.patch";
+        url = "https://chromium.googlesource.com/chromium/src/+/069d424e41f42c6f4a4551334eafc7cfaed6e880^!?format=TEXT";
+        decode = "base64 -d";
+        hash = "sha256-0ueOCHYheSFHRFzEat3TDhnU3Avf0TcNBBBpTkz+saw=";
+      })
+    ]
+    ++ lib.optionals (chromiumVersionAtLeast "142" && lib.versionOlder rustcVersion "1.91") [
+      # Fix the following error when compiling CrabbyAvif with Rust < 1.91 due to
+      # https://github.com/rust-lang/rust/pull/142681 by reverting
+      # https://github.com/webmproject/CrabbyAvif/pull/663 and
+      # https://github.com/webmproject/CrabbyAvif/pull/654 and
+      # https://chromium-review.googlesource.com/c/chromium/src/+/6960510
+      #
+      #  error: cannot find attribute `sanitize` in this scope
+      #    --> ../../third_party/crabbyavif/src/src/capi/io.rs:210:41
+      #      |
+      #  210 |     #[cfg_attr(feature = "disable_cfi", sanitize(cfi = "off"))]
+      #      |                                         ^^^^^^^^
+      #
+      ./patches/chromium-142-crabbyavif-rust-no_sanitize.patch
+      (fetchpatch {
+        name = "chromium-142-crabbyavif-Revert-Enable-disable_cfi-feature.patch";
+        url = "https://chromium.googlesource.com/chromium/src/+/9415f40bc6f853547f791e633be638c71368ce56^!?format=TEXT";
+        decode = "base64 -d";
+        revert = true;
+        hash = "sha256-bYcJqPMbE7hMvhZVnzqHok1crUAdqrzqxr+4IHNzAtg=";
+      })
     ];
 
     postPatch =
@@ -568,7 +614,9 @@ let
         /* Generated by lastchange.py, do not edit.*/
         #ifndef SKIA_EXT_SKIA_COMMIT_HASH_H_
         #define SKIA_EXT_SKIA_COMMIT_HASH_H_
-        #define SKIA_COMMIT_HASH "${upstream-info.DEPS."src/third_party/skia".rev}-"
+        #define SKIA_COMMIT_HASH "${upstream-info.DEPS."src/third_party/skia".rev}${
+          lib.optionalString (!chromiumVersionAtLeast "142") "-"
+        }"
         #endif  // SKIA_EXT_SKIA_COMMIT_HASH_H_
         EOF
 
@@ -576,6 +624,15 @@ let
 
         mkdir -p third_party/jdk/current/bin
       ''
+      + lib.optionalString (chromiumVersionAtLeast "142") ''
+        cat << EOF > gpu/webgpu/dawn_commit_hash.h
+        /* Generated by lastchange.py, do not edit.*/
+        #ifndef GPU_WEBGPU_DAWN_COMMIT_HASH_H_
+        #define GPU_WEBGPU_DAWN_COMMIT_HASH_H_
+        #define DAWN_COMMIT_HASH "${upstream-info.DEPS."src/third_party/dawn".rev}"
+        #endif  // GPU_WEBGPU_DAWN_COMMIT_HASH_H_
+        EOF
+      ''
       + ''
         # Workaround/fix for https://bugs.chromium.org/p/chromium/issues/detail?id=1313361:
         substituteInPlace BUILD.gn \

pkgs/applications/networking/browsers/chromium/info.json

@@ -1,28 +1,28 @@
 {
   "chromium": {
-    "version": "141.0.7390.122",
+    "version": "142.0.7444.59",
     "chromedriver": {
-      "version": "141.0.7390.123",
-      "hash_darwin": "sha256-grFBdZXToIZiHOrKs3EkVcl3+Bpj4tbui63oUstkpT4=",
-      "hash_darwin_aarch64": "sha256-Da3LogG0JRRI9iuTw4vWUh9CGCnicMzIDea641teQII="
+      "version": "142.0.7444.60",
+      "hash_darwin": "sha256-5Atr7h0jIneU4VbSF20j+3tcYVneYvqOsJ0GG8sD7r4=",
+      "hash_darwin_aarch64": "sha256-sh2BTEKJaAYbiuNYiSW6iChiCroo95EHoGqxVgX6Jw0="
     },
     "deps": {
       "depot_tools": {
-        "rev": "3f41e54ae17d53d4a39feecad64c3d3e6871b219",
-        "hash": "sha256-ow0L+KQuUTsz29yfO1qvqPu4XVgdoUe+yexMPi7POoA="
+        "rev": "675a3a9ccd7cf9367bb4caa58c30f08b56d45ef5",
+        "hash": "sha256-oL/WjK90HWqtyE0sJhDUp3UxlC8jr4dZfp+Q80xu3sM="
       },
       "gn": {
-        "version": "0-unstable-2025-08-29",
-        "rev": "5d0a4153b0bcc86c5a23310d5b648a587be3c56d",
-        "hash": "sha256-WERLGrReUATmn3RhxtmyZcJBxdIY/WZqBDranCLDYEg="
+        "version": "0-unstable-2025-09-18",
+        "rev": "81b24e01531ecf0eff12ec9359a555ec3944ec4e",
+        "hash": "sha256-sm5GWbkm3ua7EkCWTuY4TG6EXKe3asXTrH1APnNARJQ="
       },
       "npmHash": "sha256-i1eQ4YlrWSgY522OlFtGDDPmxE2zd1hDM03AzR8RafE="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "b477534e7e10d193e916cd4e2967c589383625b2",
-        "hash": "sha256-3sVHRzERwlLzXl2qSn2Lil4U4d6N63MUOomSUrjy2YY=",
+        "rev": "4b8153ab58d3c3f4c9f7e4baad9616ecf80db5fa",
+        "hash": "sha256-RZQD9aL/YglC8chM7tqtB1Y2u6DF+6kkgwklUohaBXc=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -32,28 +32,28 @@
       },
       "src/third_party/compiler-rt/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/compiler-rt.git",
-        "rev": "d1877a8622be9c5a692dc5ed9ea5a54a78c9360e",
-        "hash": "sha256-Vtz6Xj4ktP/8q2QDVt2bQnwkz7eDKuPx9KswagxgqmY="
+        "rev": "05f2a5dd0d1386777ae9d7fac9da776f82e7e0f2",
+        "hash": "sha256-XTPhIXHzTW4EjyER/49mKJVDQQVNGuyLu2OBAxSt+CQ="
       },
       "src/third_party/libc++/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx.git",
-        "rev": "9ce37ed6b68eda96a67199e6564ceb958ad4b37e",
-        "hash": "sha256-2URJyICEyBwIXJRDkJt1B27DXq6nLZTCbW7dD8MBQk0="
+        "rev": "b77132b512d5411f8393fd3decb3abaeaf1d3ec8",
+        "hash": "sha256-IemCFOw1X+Kcna6cuj9e29FUhitqvVGn1DeMCShkbOs="
       },
       "src/third_party/libc++abi/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi.git",
-        "rev": "f7f5a32b3e9582092d8a4511acec036a09ae8524",
-        "hash": "sha256-8hqb7ZtY3PAC8R9S0KTay79xlD8QBKjy0ZR5oUVr4p0="
+        "rev": "864f61dc9253d56586ada34c388278565ef513f6",
+        "hash": "sha256-7TUY05CW5OCyd1C1oq69rptr1RkvOMS+1CAJc7yKRFQ="
       },
       "src/third_party/libunwind/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind.git",
-        "rev": "92fb77dfd4d86aa120730359f5e4d6bb47f1c129",
-        "hash": "sha256-n7U+CKQ839Oa35JpygygPUhk9JqWIyafJRj0jYSMlwg="
+        "rev": "322be580a5a193a921c349a15747eeeb9a716ad1",
+        "hash": "sha256-veSxr/ICnBsdP+3vWjCbPxduHiEzbT0DUdwfo0xcM30="
       },
       "src/third_party/llvm-libc/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libc.git",
-        "rev": "46f8689c0b3999bd4b3a60adef01ceb3d8c0071f",
-        "hash": "sha256-qItKSIS5p4iIN+iSXgXYbFXq1CFFgwQV5NCQxunl0Zg="
+        "rev": "0c61a55402c6a0d9d6ca2aeb3c6a2613a8bc8c55",
+        "hash": "sha256-U/ToyQwIzZlaPic6LAnR17ySrZ6eGhReJ6iKVFrIHPg="
       },
       "src/chrome/test/data/perf/canvas_bench": {
         "url": "https://chromium.googlesource.com/chromium/canvas_bench.git",
@@ -72,8 +72,8 @@
       },
       "src/docs/website": {
         "url": "https://chromium.googlesource.com/website.git",
-        "rev": "c6edf98e7fab2385c90caac6211f00b62e9b773d",
-        "hash": "sha256-i08iEbbV+RAvSQKxWutCSjpZkfcbTQdRUZkgtPZfLck="
+        "rev": "3913dbd6fdde06b914d0e1119fcc884f8115e4f8",
+        "hash": "sha256-+2OBUpLLVPB/fDlF/9mEwTsvH2Una3ZYKUJY06nZauo="
       },
       "src/media/cdm/api": {
         "url": "https://chromium.googlesource.com/chromium/cdm.git",
@@ -82,8 +82,8 @@
       },
       "src/net/third_party/quiche/src": {
         "url": "https://quiche.googlesource.com/quiche.git",
-        "rev": "62826931e84c49c94192065c896931576d8273c8",
-        "hash": "sha256-YZFFKQKFyJUvrfG1bm84Hl3AGOkSgpqefwY5mHh1O0A="
+        "rev": "c0df0d316bd7e4ddf44e5ba094b5c5b061d94b0c",
+        "hash": "sha256-ACXkivQ4tqePgNIg2hpl4DQFa8n0CUkCOqPlgh56oLs="
       },
       "src/testing/libfuzzer/fuzzers/wasm_corpus": {
         "url": "https://chromium.googlesource.com/v8/fuzzer_wasm_corpus.git",
@@ -92,8 +92,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "bb55ea10fcef3759e4db7ef8a473a9ceac2c6aa6",
-        "hash": "sha256-NIy3fOwfheHeGo0MX8tmZbaGMBwqM5+k7cCypeoS6GI="
+        "rev": "e5b338502c7c65bd38d4695bc557938ca4cc3aa7",
+        "hash": "sha256-FWPyOxpsXvFtOD6OJ950NQUBcpVIeYvjuAKaqnER6A0="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -107,13 +107,13 @@
       },
       "src/third_party/angle/third_party/VK-GL-CTS/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/VK-GL-CTS",
-        "rev": "15469c3d00394c8c365d1b1951fcf6255c589afb",
-        "hash": "sha256-Bd/Q181NBMJkLwkEmttNvjNBQqtRRT7p+nbevqvt2HI="
+        "rev": "c67cffddd65aba724950e062343fa1cc89560b33",
+        "hash": "sha256-VYROUPvcpkV+skw3RKXoCpB+4xVA2Qem+15YKjV7pMg="
       },
       "src/third_party/anonymous_tokens/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/anonymous-tokens.git",
-        "rev": "50b2ee441f1c3bad73ab7430c41fd1ea5a7a06a6",
-        "hash": "sha256-NiqQy4CEK8qWb2khi4zTSb3fAf3n9LvBsmceSeyQ+Q0="
+        "rev": "50e04fb27eacd49a5e2bfde5977ac689e13ebeeb",
+        "hash": "sha256-jwfszvnWRtTmzPm5x/lyceX1Y0G0hyIATcKlYkKj/SY="
       },
       "src/third_party/readability/src": {
         "url": "https://chromium.googlesource.com/external/github.com/mozilla/readability.git",
@@ -132,8 +132,8 @@
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "9caf49389e5e0564d18e0504c6cfa45c88b4e4fd",
-        "hash": "sha256-d6WHeELxGtZ7nZzHIm18QaHY+2sc8KSRJgdH+vTuWN8="
+        "rev": "cee9cb0d67e749bf42f5e90cb3b8a6f525dbb920",
+        "hash": "sha256-loKRLJfTxBxlTbPVWZqGdx0DyPvEopbs2zIf4gaxoLo="
       },
       "src/third_party/dawn/third_party/glfw": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -142,8 +142,8 @@
       },
       "src/third_party/dawn/third_party/dxc": {
         "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectXShaderCompiler",
-        "rev": "4e0f5364a3692f4122de0874ebb0f5550a27c867",
-        "hash": "sha256-ocnWUgw3rBYTsKS7j+Zq6hTGhhB4VRgifASMqBO66Os="
+        "rev": "2b58d6d865832f7146d6e22e2106e562458bbd0a",
+        "hash": "sha256-kcmuSCdAAzyQrg33b3dlkUErd0x5TDZkE8iXMEYW8wo="
       },
       "src/third_party/dawn/third_party/dxheaders": {
         "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectX-Headers",
@@ -162,33 +162,38 @@
       },
       "src/third_party/dawn/third_party/webgpu-cts": {
         "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts",
-        "rev": "0558b1933531e6379ac5875129b92aac9d1ce035",
-        "hash": "sha256-247bXbblup/bg+iWeIwlUxLinvvQK5hX+Jm0jKiaEbM="
+        "rev": "18f1cc77dea7254258eeee21839d1c249b506576",
+        "hash": "sha256-lZgUbs1+6+tLeHmJTIWMbpT6oSVzC3A9/J3vKONgxSs="
       },
       "src/third_party/dawn/third_party/webgpu-headers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/webgpu-native/webgpu-headers",
-        "rev": "c8b371dd2ff8a2b028fdc0206af5958521181ba8",
-        "hash": "sha256-rHDN4ln5kTMzabW427Xktl93E+8EVhWa2i8n4Mh2BgQ="
+        "rev": "53a87a3d8cb4c32ec026978ce003020741df6f53",
+        "hash": "sha256-V/JhZyjLNSElllXbLduqyNjJqjrxB4SwwPpRHIcfIis="
       },
       "src/third_party/highway/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/highway.git",
-        "rev": "00fe003dac355b979f36157f9407c7c46448958e",
-        "hash": "sha256-IS7m1wBwpPBUNhx2GttY1fzvmLIeAp3o2gXfrFpRdvY="
+        "rev": "84379d1c73de9681b54fbe1c035a23c7bd5d272d",
+        "hash": "sha256-HNrlqtAs1vKCoSJ5TASs34XhzjEbLW+ISco1NQON+BI="
       },
       "src/third_party/google_benchmark/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/benchmark.git",
         "rev": "761305ec3b33abf30e08d50eb829e19a802581cc",
         "hash": "sha256-cH8s1gP6kCcojAAfTt5iQCVqiAaSooNk4BdaILujM3w="
       },
+      "src/third_party/libpfm4/src": {
+        "url": "https://chromium.googlesource.com/external/git.code.sf.net/p/perfmon2/libpfm4.git",
+        "rev": "964baf9d35d5f88d8422f96d8a82c672042e7064",
+        "hash": "sha256-awpZ22rovLZWQkX/qog93vL4u2gJ+F3w5IGFNlZ0heQ="
+      },
       "src/third_party/boringssl/src": {
         "url": "https://boringssl.googlesource.com/boringssl.git",
-        "rev": "40e035a9e5d721b3b7c15c46259d782ffe7d9e96",
-        "hash": "sha256-m2WNsjSwlg57ACftIDCcIWJ/jwbD7FU43lhGcpGDhCw="
+        "rev": "91f3df0a20f6d3dd3e2f749b4a2730b68c3d585e",
+        "hash": "sha256-rhUF9fuWbiAkaGbHnhANZxCYEhkkoMQoiYzn1EfR270="
       },
       "src/third_party/breakpad/breakpad": {
         "url": "https://chromium.googlesource.com/breakpad/breakpad.git",
-        "rev": "44ba5b579bf2f5c8548ad5016664fef8458c43b4",
-        "hash": "sha256-b8+7NGE9SelVFFuDOVr/k/nrk3jr/r8zwuW7vpm4c74="
+        "rev": "a1220f673dc44632e821bd1a217089e5a159a203",
+        "hash": "sha256-jGdQyM3+p3qt+Hjt44Wpg7XKiUt7kz9Lv1xRG7vp+dM="
       },
       "src/third_party/cast_core/public/src": {
         "url": "https://chromium.googlesource.com/cast_core/public",
@@ -197,8 +202,8 @@
       },
       "src/third_party/catapult": {
         "url": "https://chromium.googlesource.com/catapult.git",
-        "rev": "3c5077921dbacc75db5768cf4fc0b1d9ca05d2e0",
-        "hash": "sha256-w/tFeyek51/izvLSMkGP3RCW2j6KJdIa3l1PzxKjnaM="
+        "rev": "04c85a1d0e324464c6be4b3d193b47cb6177d03a",
+        "hash": "sha256-Is8yDmTyNyseTBPIDwIlhRthqfkFPgQIvu3b6u5c0m0="
       },
       "src/third_party/ced/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/compact_enc_det.git",
@@ -222,8 +227,8 @@
       },
       "src/third_party/cpuinfo/src": {
         "url": "https://chromium.googlesource.com/external/github.com/pytorch/cpuinfo.git",
-        "rev": "e414c0446436ed34151de3158d18f8ae32e55d03",
-        "hash": "sha256-748MwxVi7oONccrirjUWgtDNBWWijrXSXlZdHoowYz0="
+        "rev": "877328f188a3c7d1fa855871a278eb48d530c4c0",
+        "hash": "sha256-JW83AgI1cWv4TSpXNe9sv/hNYAA7MOdUeTHY8+0lHgc="
       },
       "src/third_party/crc32c/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/crc32c.git",
@@ -232,13 +237,13 @@
       },
       "src/third_party/cros_system_api": {
         "url": "https://chromium.googlesource.com/chromiumos/platform2/system_api.git",
-        "rev": "ed91ea4a3cd063cbace42360d769983fb08163b4",
-        "hash": "sha256-vauYEQW9iTs8VZwyKAYeahLl9LTzkOR0krzcBR4VYus="
+        "rev": "c33ff08e2b27ddaed22c8799fefd3a4b7d3c49a9",
+        "hash": "sha256-N8/0tVMBi6yFe9HkR5wxDJ1+QAP1IV1Bz99Il3RZNFU="
       },
       "src/third_party/crossbench": {
         "url": "https://chromium.googlesource.com/crossbench.git",
-        "rev": "b560604e8f2261a2c685c28359b69af74b92a196",
-        "hash": "sha256-vgWATYq/7UXnFhfdJZ0JXvGpr4eI08sSU115MWpD1js="
+        "rev": "f6e9d3627685e3bcb82d5a24c1f075b8dd0d881c",
+        "hash": "sha256-JbgzTTFEFuA8ZyRLih3T/Fa3RhcOK4fi+9RuzZioiPI="
       },
       "src/third_party/crossbench-web-tests": {
         "url": "https://chromium.googlesource.com/chromium/web-tests.git",
@@ -247,13 +252,13 @@
       },
       "src/third_party/depot_tools": {
         "url": "https://chromium.googlesource.com/chromium/tools/depot_tools.git",
-        "rev": "3f41e54ae17d53d4a39feecad64c3d3e6871b219",
-        "hash": "sha256-ow0L+KQuUTsz29yfO1qvqPu4XVgdoUe+yexMPi7POoA="
+        "rev": "675a3a9ccd7cf9367bb4caa58c30f08b56d45ef5",
+        "hash": "sha256-oL/WjK90HWqtyE0sJhDUp3UxlC8jr4dZfp+Q80xu3sM="
       },
       "src/third_party/devtools-frontend/src": {
         "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "9c2c4cc7cf6c82ad460e1f3b49f34bb702d5fe11",
-        "hash": "sha256-qj1vR0FW2jiR2v18Nv8RqYgy/UEw2rgGUsQ68EhdHos="
+        "rev": "38cfe98a56a034da33ee62a5f1ea235fe47f58a7",
+        "hash": "sha256-bUJuFEDqgUFdMfmMyroX4s2ky/2n37PsTWaV+iQHCJg="
       },
       "src/third_party/dom_distiller_js/dist": {
         "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
@@ -267,8 +272,8 @@
       },
       "src/third_party/eigen3/src": {
         "url": "https://chromium.googlesource.com/external/gitlab.com/libeigen/eigen.git",
-        "rev": "81044ec13df7608d0d9d86aff2ef9805fc69bed1",
-        "hash": "sha256-W0uonGzjDaN2RbY2U+Kl1a5/nrEZ9T9W426f+a7NUzY="
+        "rev": "430e35fbd15d3c946d2d2ba19ec41c16ba217cb3",
+        "hash": "sha256-ZXDzAuvTu46YhieLIQ7MSQ0os+v2RF+KBtFuKU9fCWE="
       },
       "src/third_party/farmhash/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/farmhash.git",
@@ -282,8 +287,8 @@
       },
       "src/third_party/federated_compute/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google-parfait/federated-compute.git",
-        "rev": "cf49f95f941eb872f596522890055878240c3a22",
-        "hash": "sha256-R8KE0Whpb4qsZ6HxWG4/uFSsrT2nnpwNV2nQcNYHEXg="
+        "rev": "e51058dfe7888094ecc09cda38bfceffd4d4664b",
+        "hash": "sha256-5kuTp0TXOUCQQ7XcnwBRsQRxugl869hZhx8MbxDLwYk="
       },
       "src/third_party/ffmpeg": {
         "url": "https://chromium.googlesource.com/chromium/third_party/ffmpeg.git",
@@ -297,28 +302,28 @@
       },
       "src/third_party/flatbuffers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/flatbuffers.git",
-        "rev": "8db59321d9f02cdffa30126654059c7d02f70c32",
-        "hash": "sha256-tbc45o0MbMvK5XqRUJt5Eg8BU6+TJqlmwFgQhHq6wRM="
+        "rev": "1c514626e83c20fffa8557e75641848e1e15cd5e",
+        "hash": "sha256-u5AVjbep3iWwGNXLrkPJUnF8SbmIXlHOYoy3NIlUl/E="
       },
       "src/third_party/fontconfig/src": {
         "url": "https://chromium.googlesource.com/external/fontconfig.git",
-        "rev": "86b48ec01ece451d5270d0c5181a43151e45a042",
-        "hash": "sha256-6HLV0U/MA1XprKJ70TKvwUBdkGQPwgqP4Oj5dINsKp0="
+        "rev": "f0ed9c3f43161d3555f6f7a5234b22fe7ca60727",
+        "hash": "sha256-2h0dWn7MxAX+4o2tMZLyjRFAES+FTMaGaf8M7ySkSV8="
       },
       "src/third_party/fp16/src": {
         "url": "https://chromium.googlesource.com/external/github.com/Maratyszcza/FP16.git",
-        "rev": "b3720617faf1a4581ed7e6787cc51722ec7751f0",
-        "hash": "sha256-nDJH3Jmztrglr9hnwegfS7NNLAXklnwdeH9iWWwwZt4="
+        "rev": "3d2de1816307bac63c16a297e8c4dc501b4076df",
+        "hash": "sha256-CR7h1d9RFE86l6btk4N8vbQxy0KQDxSMvckbiO87JEg="
       },
       "src/third_party/gemmlowp/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/gemmlowp.git",
-        "rev": "13d57703abca3005d97b19df1f2db731607a7dc2",
-        "hash": "sha256-O5wD8wxgis0qYMaY+xZ21GBDVQFphMRvInCOswS6inA="
+        "rev": "16e8662c34917be0065110bfcd9cc27d30f52fdf",
+        "hash": "sha256-e6AeRhZioIiTG5R+IA9g2GBqI4o74wijJYmqINLOtQs="
       },
       "src/third_party/freetype/src": {
         "url": "https://chromium.googlesource.com/chromium/src/third_party/freetype2.git",
-        "rev": "61a423426089e65c27699d824303f209026b2f05",
-        "hash": "sha256-XaSl1YJk5TUR72PDbKwnn5IGT46VR7ip1wVxUMEkvu8="
+        "rev": "d3668e00da732654b50e4e81f982544ed6e26390",
+        "hash": "sha256-b74O5i4xhHq8y0qepP8Wup2nuj9LFzBX7ahMCCVhc98="
       },
       "src/third_party/fxdiv/src": {
         "url": "https://chromium.googlesource.com/external/github.com/Maratyszcza/FXdiv.git",
@@ -352,8 +357,8 @@
       },
       "src/third_party/oak/src": {
         "url": "https://chromium.googlesource.com/external/github.com/project-oak/oak.git",
-        "rev": "bd9e19ed20525444be0882bd5848ec475ac8c040",
-        "hash": "sha256-F/qSxLpbPPOBjY4/Gowq6HUINb1hH+ll9T+mDMGeJ7c="
+        "rev": "96c00a6c99ac382f3f3a8f376bc7a70890d1adaa",
+        "hash": "sha256-+ouwII+i5CbWoJ3NAxQPmczofzkPwtZTtjIPaXyyXt8="
       },
       "src/third_party/ots/src": {
         "url": "https://chromium.googlesource.com/external/github.com/khaledhosny/ots.git",
@@ -397,8 +402,8 @@
       },
       "src/third_party/fuzztest/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/fuzztest.git",
-        "rev": "169baf17795850fd4b2c29e4d52136aa8d955b61",
-        "hash": "sha256-jcpUwHKWV4aWJSOZ4AlFk5YXZoTuXrrSE4jmwrrvoKI="
+        "rev": "e101ca021a40733d0fa76a3bd9b49b5f76da4f8a",
+        "hash": "sha256-gMIDf/Alh9BCk0Gm0m+mmhHoKreHCiN7/WOomcMbS/k="
       },
       "src/third_party/domato/src": {
         "url": "https://chromium.googlesource.com/external/github.com/googleprojectzero/domato.git",
@@ -412,18 +417,18 @@
       },
       "src/third_party/libaom/source/libaom": {
         "url": "https://aomedia.googlesource.com/aom.git",
-        "rev": "4703185b29b381e5651eb1caed66630f623bf752",
-        "hash": "sha256-f3IPUpLB0jYrBwwJCBzatJgzayGtUxV6NsCLU2TiIqs="
+        "rev": "2a70ad7bee390757eaa83aff12f310ba53915e9f",
+        "hash": "sha256-RWm/xaX3WGgCy6o4lM5g6j0vS6mc6ZbDAhRw6OQgJlU="
       },
       "src/third_party/crabbyavif/src": {
         "url": "https://chromium.googlesource.com/external/github.com/webmproject/CrabbyAvif.git",
-        "rev": "4c70b98d1ebc8a210f2919be7ccabbcf23061cb5",
-        "hash": "sha256-PHtOD9HWxgwlfmcoDDHYyjhHpV/LclCVIk+ci9eUaIc="
+        "rev": "3ba05863e84fd3acb4f4af2b4545221b317a2e55",
+        "hash": "sha256-HUGkuQWfUGsE6crsluI7l5H2DYalruoDKqBjbVfE7BM="
       },
       "src/third_party/nearby/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/nearby-connections.git",
-        "rev": "5f27145da57a32eb8db215c40fe867a20beea987",
-        "hash": "sha256-ZbrbLnL/5LYu8cW06KnjNaUjMSlJCrzl0ywthOjNeX0="
+        "rev": "0bad8b0c9877f92eeeb550654f1ea51a71a085e4",
+        "hash": "sha256-Mwuo2RlKweqZPkDw4OcJDD+QNRiXVysSyzLdjHsG1mA="
       },
       "src/third_party/securemessage/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/securemessage.git",
@@ -432,8 +437,8 @@
       },
       "src/third_party/jetstream/main": {
         "url": "https://chromium.googlesource.com/external/github.com/WebKit/JetStream.git",
-        "rev": "f8e3d7e50ed5c7ac071a9d90d3ee36cb68a8678c",
-        "hash": "sha256-7JF4A2ayMOAFOP3DH2Z2iBx9MHvMN9hogCY5unJZDbQ="
+        "rev": "b400dd340af3457890ec7b4a903fefb02fcf2dc6",
+        "hash": "sha256-jn6Twi+fc/qKjsqLqkrWxhQ677wY3rSCx3JfWCGhxr0="
       },
       "src/third_party/jetstream/v2.2": {
         "url": "https://chromium.googlesource.com/external/github.com/WebKit/JetStream.git",
@@ -527,8 +532,8 @@
       },
       "src/third_party/libvpx/source/libvpx": {
         "url": "https://chromium.googlesource.com/webm/libvpx.git",
-        "rev": "b122dc0932009e78f928386c5081bb69d3c2de5c",
-        "hash": "sha256-y5yD3YwsQjWZn60VPUH4H2D1AwkBoGGmTNpyxGneciY="
+        "rev": "8d00aca60b951444582b1373e4e47f0ca6e0871c",
+        "hash": "sha256-44k28SJ7AbcABv1YV1tICtJ1II4AXTuvcAELSTUht6c="
       },
       "src/third_party/libwebm/source": {
         "url": "https://chromium.googlesource.com/webm/libwebm.git",
@@ -542,8 +547,8 @@
       },
       "src/third_party/libyuv": {
         "url": "https://chromium.googlesource.com/libyuv/libyuv.git",
-        "rev": "36edc5fa8b2da5aa00b8c2c68b25ffd64219d0ba",
-        "hash": "sha256-RTgcspt8hOHN79ZD5jjwuX7XFrFkuAJemIXmjoBKVMk="
+        "rev": "94417b9d213364905ce849c25719b819b8dbbaaa",
+        "hash": "sha256-8sxr0TMQaCzBqQ39FADqWTATcmQlL6TOV3nFM/YySyY="
       },
       "src/third_party/lss": {
         "url": "https://chromium.googlesource.com/linux-syscall-support.git",
@@ -577,8 +582,8 @@
       },
       "src/third_party/openscreen/src": {
         "url": "https://chromium.googlesource.com/openscreen",
-        "rev": "9756d3a568a78213678eeb52e044b9658e195e15",
-        "hash": "sha256-LK1b2O4pgLyGBViXLid2w6+DxtstK44msyOJUNFn1ek="
+        "rev": "4654d7968ac1a1e825a84bd4d85acadd7993c49a",
+        "hash": "sha256-gg9PtdIuCN3eQJhutbBz411zIsyCpagb5BARGdCWLMA="
       },
       "src/third_party/openscreen/src/buildtools": {
         "url": "https://chromium.googlesource.com/chromium/src/buildtools",
@@ -592,13 +597,13 @@
       },
       "src/third_party/pdfium": {
         "url": "https://pdfium.googlesource.com/pdfium.git",
-        "rev": "0a74b90b9a53b2033de1a53ed8401730f906a453",
-        "hash": "sha256-eTq4d9nE9J6ZbX2b7QK5gVacApSv6EQXUmvy1P641Eo="
+        "rev": "e95c6ead2f97716c98526ec42d5fd9ebb50e6e23",
+        "hash": "sha256-tZXu+3w+CplXbP8TgRetyl1Q2gacAqWtP9uJ6XZchHk="
       },
       "src/third_party/perfetto": {
         "url": "https://chromium.googlesource.com/external/github.com/google/perfetto.git",
-        "rev": "43afaf571d990c0f3275c6800cf3ed42138bdc26",
-        "hash": "sha256-I5MrV4zYZjH0iSnc1aZ95xAg6e3OxQXX/rQoD8/OQIk="
+        "rev": "d5bbee7afdf259af4212929ccbff467dd5349953",
+        "hash": "sha256-FfOCX3Z7aKGkMAf8hK5itt7+8N5kBRd9NJGjOLiUjQs="
       },
       "src/third_party/protobuf-javascript/src": {
         "url": "https://chromium.googlesource.com/external/github.com/protocolbuffers/protobuf-javascript",
@@ -607,8 +612,8 @@
       },
       "src/third_party/pthreadpool/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/pthreadpool.git",
-        "rev": "149f0a86f5ad215e9f0441684385ce09f345dbe4",
-        "hash": "sha256-3/FnJ2FL6fQSlymqJS/UoXTB4ZiW9d7xpvK3Ur8Ynp4="
+        "rev": "f5a07eddbf4be8f23e29e60a2ccf66b78b71f119",
+        "hash": "sha256-M9uMq/ZkvrWNep+CIFzx6xLfepLkfY8tjgL7ed2vjU0="
       },
       "src/third_party/pyelftools": {
         "url": "https://chromium.googlesource.com/chromiumos/third_party/pyelftools.git",
@@ -627,8 +632,8 @@
       },
       "src/third_party/re2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/re2.git",
-        "rev": "6569a9a3df256f4c0c3813cb8ee2f8eef6e2c1fb",
-        "hash": "sha256-e18aSNVEE42LNzCDMay/Fa3BNg36pBPeEtfNvWqlnWE="
+        "rev": "cd7b2823a8375371f7efe6dae17837c9ab407693",
+        "hash": "sha256-YXYRgSWUrX+tkaMiRpaCFrrP3vyhzGIP9ApsxWX08VQ="
       },
       "src/third_party/ruy/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/ruy.git",
@@ -637,13 +642,13 @@
       },
       "src/third_party/search_engines_data/resources": {
         "url": "https://chromium.googlesource.com/external/search_engines_data.git",
-        "rev": "629f034fd4473fca4ee8886ed886943672fc72fa",
-        "hash": "sha256-iWtSJ8AL2rbjltg+FHO/w4mL1XHsemCc39lEFWKAVGA="
+        "rev": "94eb2a9a225078cb5f40e82fd890bce387c8121a",
+        "hash": "sha256-WWkOOnOI3ohPuO+M9/x53hyDO11P6E6Z6ZZvKmQEyjI="
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "5eefbe51d17d2e379fa2d7353827e0ccb1e1f601",
-        "hash": "sha256-hjihCH6CykIfNcQ8TWCD8+buN0ZBYDwQr4I2Z2hUmxM="
+        "rev": "f4ed99d2443962782cf5f8b4dd27179f131e7cbe",
+        "hash": "sha256-7dpaRB/du2Y13BV3K7/Zx6lQwMtgtF17oKPoBtyEc64="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -662,8 +667,8 @@
       },
       "src/third_party/swiftshader": {
         "url": "https://swiftshader.googlesource.com/SwiftShader.git",
-        "rev": "7cd1022cdc50fa3ac4f0ca5d0cdd64ce20af3c4f",
-        "hash": "sha256-YNQYUe3xgnPny6tYmlYOjC6/jszy896y+/u5aXjthvU="
+        "rev": "5f1c459a11bb4899301e89609cbf7547f9f31e20",
+        "hash": "sha256-raNaqoF6CYdBowrQOGRZk6vDdpr/2xAXR2+RaDF0ypk="
       },
       "src/third_party/text-fragments-polyfill/src": {
         "url": "https://chromium.googlesource.com/external/github.com/GoogleChromeLabs/text-fragments-polyfill.git",
@@ -672,18 +677,18 @@
       },
       "src/third_party/tflite/src": {
         "url": "https://chromium.googlesource.com/external/github.com/tensorflow/tensorflow.git",
-        "rev": "fe38b1b8c23d86ed93c13ef367b19496e398462d",
-        "hash": "sha256-51tpID94hoxm0I2Mf3WFQBf5MsuzIzlkS9lOto/8tC4="
+        "rev": "313f58ae85278ced9ccc7f90ee630bdf8735c52f",
+        "hash": "sha256-9RWrxIDA2vvobr9Cg13SkwfScw+Lk/NCeaPVIXTCKmY="
       },
       "src/third_party/vulkan-deps": {
         "url": "https://chromium.googlesource.com/vulkan-deps",
-        "rev": "a493d027dfa1ebf220dea834757f5114494f0f92",
-        "hash": "sha256-n52ZDzn4/SxcdUzCENBpUfjJk3+0IQSe+qj9FVgFn2w="
+        "rev": "02470a3c2773a9fa236c7e8dacd72deb4b5131e3",
+        "hash": "sha256-zziYZlVaxG5UQPm/SlodT85f+pAoGwuAO9FKnkSN53E="
       },
       "src/third_party/glslang/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/glslang",
-        "rev": "3289b1d61b69a6c66c4b7cd2c6d3ab2a6df031e5",
-        "hash": "sha256-9xGshr6ts0TdER7Sy86XpKrUItukeM59ozCIwkFy26A="
+        "rev": "a57276bf558f5cf94d3a9854ebdf5a2236849a5a",
+        "hash": "sha256-/DwdyuSGCx22zsXZrcZGTECfsIqvzPQzTZ2mU8EkjxY="
       },
       "src/third_party/spirv-cross/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Cross",
@@ -692,38 +697,38 @@
       },
       "src/third_party/spirv-headers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Headers",
-        "rev": "3397e1e4fe0a9964e1837c2934b81835093494b8",
-        "hash": "sha256-Yp+HE/XIPJD/Baj9Nvs3H7J5Bx816qkYFpL6zARyY/8="
+        "rev": "01e0577914a75a2569c846778c2f93aa8e6feddd",
+        "hash": "sha256-gewCQvcVRw+qdWPWRlYUMTt/aXrZ7Lea058WyqL5c08="
       },
       "src/third_party/spirv-tools/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Tools",
-        "rev": "392b4893c4955125c1873c33a97f2a8ee8363bd3",
-        "hash": "sha256-HMzQps2F9TAnHHPvBeqowADHPlTvfRWUekE37AKMcaw="
+        "rev": "d5d5b61e2d5ae9b98ef403b3f3f922711812888a",
+        "hash": "sha256-wP/ZjSXXB1NrRVmtaqxoJ+jdHlRNsXg7dRxYp9zfKKc="
       },
       "src/third_party/vulkan-headers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Headers",
-        "rev": "d1cd37e925510a167d4abef39340dbdea47d8989",
-        "hash": "sha256-WUj4nmr4SJFTDoaOuZBVfqOrJykzW9Kg2sqaplm8E1A="
+        "rev": "a4f8ada9f4f97c45b8c89c57997be9cebaae65d2",
+        "hash": "sha256-Sg/zp6UhRC5wqBS3vdfs0sQL8cBgLiwvfG0oY0v9MWU="
       },
       "src/third_party/vulkan-loader/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Loader",
-        "rev": "fe92c7d7e54664b1d3f3a0d734fd6f2ffd92e485",
-        "hash": "sha256-9Oe3JIuOT/yc+pUgKptnex9gKQFsHo1uBb3zeTegL6Q="
+        "rev": "f703f919c30c5b67958d35d40a4297cb3823ed78",
+        "hash": "sha256-3BBltVh3M9OnBk1uf+xpaaJaaF9QP9DHeX7tu6ET05Y="
       },
       "src/third_party/vulkan-tools/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Tools",
-        "rev": "8ce6f121d1fcbdf60f0f4264e23fbcd247b9101d",
-        "hash": "sha256-3OcmtPp8mhrVYrPoCe9qnisXllMhYLdZ4dEulDhlq8k="
+        "rev": "d643b80d6ba8c191bc289fdda52867c3bb3c190b",
+        "hash": "sha256-E8VEn0s/ZuIIx4sH9ItLx+3+FOPi8gbQ0Ht7iIyYBUU="
       },
       "src/third_party/vulkan-utility-libraries/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Utility-Libraries",
-        "rev": "a528f95dc2f92bdd83c0c32efe2d13c806428c9d",
-        "hash": "sha256-7VEYvq1x+BYPuMGi47a7/R9ZrIR9CoIaV15wLpk97bg="
+        "rev": "4322db5906e67b57ec9c327e6afe3d98ed893df7",
+        "hash": "sha256-qcCATZWM0YJ02Dl5VxjvbFYoE2b0r7Ku+ELr2is2VIg="
       },
       "src/third_party/vulkan-validation-layers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-ValidationLayers",
-        "rev": "88a897d5921f737c9826fdd4db1ae2010d23dbb3",
-        "hash": "sha256-X5JFPq+4rqpfKLO7ImHOcR1nvO3+PCCglP0+hhUeiJ0="
+        "rev": "83d96b88de7b85c3f29545170857e54e348421b2",
+        "hash": "sha256-ugV2Gwgrerbqbtc5SgKN5wm4eT4JbXRCiryu1bLGR+M="
       },
       "src/third_party/vulkan_memory_allocator": {
         "url": "https://chromium.googlesource.com/external/github.com/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator.git",
@@ -762,18 +767,18 @@
       },
       "src/third_party/webgpu-cts/src": {
         "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts.git",
-        "rev": "b500efdd5fdd62404322ab9ecd70b938ac59a47f",
-        "hash": "sha256-gGyXYaHH0nk3rbJTtazNyj9vO4PqDPJ0OG1/CisrIq0="
+        "rev": "b62c3fc76c9c644a8597399b0d23f7032cabb366",
+        "hash": "sha256-L3DuBVH7x1vxpDp/wrykcyPCjVLJr4ox4gEl76f320A="
       },
       "src/third_party/webpagereplay": {
         "url": "https://chromium.googlesource.com/webpagereplay.git",
-        "rev": "eebd5c62cb5c6a5afbb36eccdcc3b3e01f28adc9",
-        "hash": "sha256-WXiWUVTX4JBuavc3qxPpWeM2qZsyMr64iqF/fu9fzRI="
+        "rev": "9057e5d942f2bfcee71cc20415a7f86c966241f8",
+        "hash": "sha256-W/f+vYNC9xiCPVvHezlVPFAze77OTCMMj7PgNN5ixaw="
       },
       "src/third_party/webrtc": {
         "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "d2eaa5570fc9959f8dbde32912a16366b8ee75f4",
-        "hash": "sha256-vWz+CAlgvavAmoCgy+D5FDGSyYoe15vfKI2fw33K8cc="
+        "rev": "29d6eabaf0b5c1a62af6e7fd03adebf5e1a446e8",
+        "hash": "sha256-kVzks2ncpgd+aQ7JT2pAV/WJXxFIE7Es5Yzd/XGgm4w="
       },
       "src/third_party/wuffs/src": {
         "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@@ -792,18 +797,18 @@
       },
       "src/third_party/xnnpack/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/XNNPACK.git",
-        "rev": "63e7e89ddc0cf5671d2659cd34a3eb64a008dd63",
-        "hash": "sha256-cqzSTeRziIZFdArk6Ty/1JyeSM8w/aH2buoNy5GOIdg="
+        "rev": "4d098efeac50c44a7c03e6feb1794908db4c3158",
+        "hash": "sha256-oxpMzIFwJ3L5cYLkwcSL7a8XS1AGHXKQjwtHoe/2mZw="
       },
       "src/third_party/zstd/src": {
         "url": "https://chromium.googlesource.com/external/github.com/facebook/zstd.git",
-        "rev": "e128976193546dceb24249206a02ff8f444f7120",
-        "hash": "sha256-09KBWIUdz53TOSGhi32BJ2/FIA/BXxRNvgZMZJYiWgw="
+        "rev": "89d685e42dbcf815a16ed0fcd7d050ef74ccad96",
+        "hash": "sha256-xFObjxA4LKOnCugxaYek3cU4ld3JwLj5jFoRJ20hje4="
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "ad8af0fc661d278e87627fcaa3a7cf795ee80dd8",
-        "hash": "sha256-NOhavmx5NYJx6MSDwRS6RXHcn3DB7kNlTjIFZr6rMMY="
+        "rev": "bb294624702efbb17691b642333f06bf5108e600",
+        "hash": "sha256-ovlKdiBYD9RAjA1XI0PLp/pt25LAvm3fn5AqWlJQfgs="
       }
     }
   },

pkgs/applications/networking/browsers/chromium/patches/chromium-142-crabbyavif-rust-no_sanitize.patch

@@ -0,0 +1,48 @@
+diff --git a/third_party/crabbyavif/src/src/capi/io.rs b/third_party/crabbyavif/src/src/capi/io.rs
+index e7994ce3129c4d7f46553f527bf8f10376ff9ed8..60a3c13b788a560e9669db013e3b8e88e5f9947b 100644
+--- a/third_party/crabbyavif/src/src/capi/io.rs
++++ b/third_party/crabbyavif/src/src/capi/io.rs
+@@ -207,7 +207,7 @@ impl Drop for avifIOWrapper {
+ }
+ 
+ impl crate::decoder::IO for avifIOWrapper {
+-    #[cfg_attr(feature = "disable_cfi", sanitize(cfi = "off"))]
++    #[cfg_attr(feature = "disable_cfi", no_sanitize(cfi))]
+     fn read(&mut self, offset: u64, size: usize) -> AvifResult<&[u8]> {
+         // SAFETY: Calling into a C function.
+         let res = unsafe {
+diff --git a/third_party/crabbyavif/src/src/lib.rs b/third_party/crabbyavif/src/src/lib.rs
+index 90fa41188905a8aaf7b74594937b3a335ceed18d..a05f0a5e8b6cbffbf6e1a0f5fefc8a1e1480273f 100644
+--- a/third_party/crabbyavif/src/src/lib.rs
++++ b/third_party/crabbyavif/src/src/lib.rs
+@@ -13,7 +13,7 @@
+ // limitations under the License.
+ 
+ #![deny(unsafe_op_in_unsafe_fn)]
+-#![cfg_attr(feature = "disable_cfi", feature(sanitize))]
++#![cfg_attr(feature = "disable_cfi", feature(no_sanitize))]
+ 
+ #[macro_use]
+ mod internal_utils;
+diff --git a/third_party/crabbyavif/src/src/reformat/libyuv.rs b/third_party/crabbyavif/src/src/reformat/libyuv.rs
+index 9df874ccf7b6a943c6dcebe495ce15b7a7e9cd66..3f68c16f2b2e8e22b3edfd0dcedbb95fe34887f9 100644
+--- a/third_party/crabbyavif/src/src/reformat/libyuv.rs
++++ b/third_party/crabbyavif/src/src/reformat/libyuv.rs
+@@ -372,7 +372,7 @@ fn find_conversion_function(
+ // Returns Ok(Some(false)) if only YUV was converted and alpha
+ // needs to be imported separately.
+ // Returns Ok(None) if the conversion is not implemented.
+-#[cfg_attr(feature = "disable_cfi", sanitize(cfi = "off"))]
++#[cfg_attr(feature = "disable_cfi", no_sanitize(cfi))]
+ pub(crate) fn yuv_to_rgb(image: &image::Image, rgb: &mut rgb::Image) -> AvifResult<Option<bool>> {
+     if (rgb.depth != 8 && rgb.depth != 10) || !image.depth_valid() {
+         return Ok(None); // Not implemented.
+@@ -833,7 +833,7 @@ fn rgb_to_yuv_conversion_function(
+     }
+ }
+ 
+-#[cfg_attr(feature = "disable_cfi", sanitize(cfi = "off"))]
++#[cfg_attr(feature = "disable_cfi", no_sanitize(cfi))]
+ pub(crate) fn rgb_to_yuv(rgb: &rgb::Image, image: &mut image::Image) -> AvifResult<Option<()>> {
+     let conversion_function = match rgb_to_yuv_conversion_function(rgb, image) {
+         Some(conversion_function) => conversion_function,

pkgs/applications/networking/cluster/k3s/builder.nix

@@ -68,7 +68,7 @@ lib:
   socat,
   sqlite,
   stdenv,
-  su,
+  shadow,
   systemdMinimal,
   util-linuxMinimal,
   yq-go,
@@ -373,7 +373,7 @@ buildGoModule (finalAttrs: {
     conntrack-tools
     runc
     bash
-    su
+    shadow # kubelet wants 'getsubids' when using user namespaces
   ];
 
   k3sKillallDeps = [

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -181,13 +181,13 @@
     "vendorHash": "sha256-jK7JuARpoxq7hvq5+vTtUwcYot0YqlOZdtDwq4IqKvk="
   },
   "cloudamqp_cloudamqp": {
-    "hash": "sha256-WjmZTm04m0iTrXg2/B4I64ccXnfT+qYHZzaYgnJRy3c=",
+    "hash": "sha256-h/QAHh5hpTtpyKcq6LqqJunN9+U2GIEpm8+yEeevHjM=",
     "homepage": "https://registry.terraform.io/providers/cloudamqp/cloudamqp",
     "owner": "cloudamqp",
     "repo": "terraform-provider-cloudamqp",
-    "rev": "v1.37.0",
+    "rev": "v1.38.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-p/vZYmNBkUGHjZHYzmixOzOWi55YUrbbEdVbOeX1JIs="
+    "vendorHash": "sha256-q942GCRd5czCdlpLYsXzj8Kt91GjCpyzhOkgWfkyHo8="
   },
   "cloudflare_cloudflare": {
     "hash": "sha256-Lc9bC1dM4wNe+ZN2EYFRYfoZosocBEOI9SHvxJIOQCY=",
@@ -741,11 +741,11 @@
     "vendorHash": null
   },
   "integrations_github": {
-    "hash": "sha256-FVDx8KH7foy1rZigDVEWMEalQ9nJnLkRjkJsFi0aEuM=",
+    "hash": "sha256-EjCL6RcTw+2uhfwgyiFRfsXYkkDHZqlSSzEcb4CRvIo=",
     "homepage": "https://registry.terraform.io/providers/integrations/github",
     "owner": "integrations",
     "repo": "terraform-provider-github",
-    "rev": "v6.7.1",
+    "rev": "v6.7.3",
     "spdx": "MIT",
     "vendorHash": null
   },
@@ -886,13 +886,13 @@
     "vendorHash": "sha256-I8yMdS+yOk5doWGU9VPdl5ITGNrPhs5tGwluwXSrnI0="
   },
   "metio_migadu": {
-    "hash": "sha256-FDZOBxxoY9fZ9g24onNoFn4e0xtBMYLCoqdYcdhIj4E=",
+    "hash": "sha256-Itfy/EZiBI6j4GU9I3pQGpsMkykN8FVZ4FPhcUre8a0=",
     "homepage": "https://registry.terraform.io/providers/metio/migadu",
     "owner": "metio",
     "repo": "terraform-provider-migadu",
-    "rev": "2025.10.16",
+    "rev": "2025.10.30",
     "spdx": "0BSD",
-    "vendorHash": "sha256-bxq4AB9qvhZPxtG4lmfVXQL3mil7UaJ46EWU1iD0ymE="
+    "vendorHash": "sha256-LMCFXZYZ9qwuu0/hA8mRNktCwwC4DRaqveW2dAJWQTQ="
   },
   "mongey_kafka": {
     "hash": "sha256-rTa6c7jAMH027V7h/yUGVGz6TS0PDdObilxU0Vpr6FI=",
@@ -1003,13 +1003,13 @@
     "vendorHash": "sha256-0UM4I/oxIsWIP1G93KJsJxYofXrO4Yy86PEk0FnB1DE="
   },
   "okta_okta": {
-    "hash": "sha256-Y0gNIhJDJoK6wL5FoCjyhccywYBkCygovXGxVTylTn8=",
+    "hash": "sha256-7vjNorBNdfF3cTu1ANx+5Uh5chAL54lWZ7R9cMI/gpA=",
     "homepage": "https://registry.terraform.io/providers/okta/okta",
     "owner": "okta",
     "repo": "terraform-provider-okta",
-    "rev": "v6.3.0",
+    "rev": "v6.4.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-oE4nB0dFsiz82kj9QOr0vIjD3aBR+jxeAW5/ZWUxp44="
+    "vendorHash": "sha256-gLFMFVw44jJcuVzY6OcUHJ74rRCIQuon4p9RNoQPLPs="
   },
   "oktadeveloper_oktaasa": {
     "hash": "sha256-2LhxgowqKvDDDOwdznusL52p2DKP+UiXALHcs9ZQd0U=",
@@ -1129,13 +1129,13 @@
     "vendorHash": "sha256-M2lJKmIR66lQKFkInjizn68ax2Gq4sim5Y3vZKyDhZ8="
   },
   "rootlyhq_rootly": {
-    "hash": "sha256-4YjmP7DMaqsDADi0+B39Wn0CA2M3MEhV3VKA+M/gHMg=",
+    "hash": "sha256-215PagKhONN483SGvYsLWQfKnSWmUKL1vCM4mr2xuGo=",
     "homepage": "https://registry.terraform.io/providers/rootlyhq/rootly",
     "owner": "rootlyhq",
     "repo": "terraform-provider-rootly",
-    "rev": "v4.3.3",
+    "rev": "v4.3.5",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-auyQLDDQ+tfMQCqICDR5tfvaYrO89Eani7lAsfoPwwU="
+    "vendorHash": "sha256-MNddgnKFdrOCfpj84McqW/8lmU/t36x2Whsl9xkmrhM="
   },
   "rundeck_rundeck": {
     "hash": "sha256-g8unbz8+UGLiAOJju6E2bLkygvZgHkv173PdMDefmrc=",
@@ -1273,22 +1273,22 @@
     "vendorHash": "sha256-IR6KjFW5GbsOIm3EEFyx3ctwhbifZlcNaZeGhbeK/Wo="
   },
   "sysdiglabs_sysdig": {
-    "hash": "sha256-b30SVfem2G3lBX9J5KGyxow0KK7kksOZLZ9135PyYPY=",
+    "hash": "sha256-hqcnyBWB7PWTTRCOczgF6hSBibvlGl+x9EkYn3vi4v8=",
     "homepage": "https://registry.terraform.io/providers/sysdiglabs/sysdig",
     "owner": "sysdiglabs",
     "repo": "terraform-provider-sysdig",
-    "rev": "v3.0.1",
+    "rev": "v3.1.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-rWiafaFE1RolO9JUN1WoW4EWJjR7kpfeVEOTLf21j50="
   },
   "tailscale_tailscale": {
-    "hash": "sha256-hkqlstHLHBERVenwyVUew+b26liFQpRh99vIMI0TCBY=",
+    "hash": "sha256-EiaQKO4Pg+89Mc8nwSarKhHBtr+yEKWEyZ4i0LeOfu4=",
     "homepage": "https://registry.terraform.io/providers/tailscale/tailscale",
     "owner": "tailscale",
     "repo": "terraform-provider-tailscale",
-    "rev": "v0.23.0",
+    "rev": "v0.24.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-9VyRFLpwF/+5iidLdzilztAdv/YaujUKoRwIyLgiV6o="
+    "vendorHash": "sha256-GhXplzkv0ouWSo4fNs7C0h87sFguhre6ez4d0Pgd/5w="
   },
   "telmate_proxmox": {
     "hash": "sha256-1aKKlOIk1mH4yx66eD635d1IaUWXIiBGHEt4A2F2mGM=",

pkgs/applications/office/libreoffice/default.nix

@@ -156,6 +156,7 @@
   lp_solve,
   xmlsec,
   libcmis,
+  frozen-containers,
 }:
 
 assert builtins.elem variant [
@@ -491,6 +492,7 @@ stdenv.mkDerivation (finalAttrs: {
       which
       xmlsec
       zlib
+      frozen-containers
     ]
     ++ optionals kdeIntegration [
       qt6.qtbase
@@ -583,10 +585,10 @@ stdenv.mkDerivation (finalAttrs: {
     "--with-system-orcus"
     "--with-system-postgresql"
     "--with-system-xmlsec"
+    "--with-system-frozen"
 
     # TODO: package these as system libraries
     "--without-system-altlinuxhyph"
-    "--without-system-frozen"
     "--without-system-libeot"
     "--without-system-libfreehand"
     "--without-system-libmspub"

pkgs/applications/science/chemistry/avogadro2/default.nix

@@ -7,6 +7,7 @@
   avogadrolibs,
   molequeue,
   hdf5,
+  jkqtplotter,
   openbabel,
   qttools,
   wrapQtAppsHook,
@@ -17,20 +18,20 @@ let
   avogadroI18N = fetchFromGitHub {
     owner = "OpenChemistry";
     repo = "avogadro-i18n";
-    tag = "1.101.0";
-    hash = "sha256-3qFx/rc5xqfrLq3Kr5b/Rid2LR/gfP6uqhhATyQL6Y8=";
+    tag = "1.102.1";
+    hash = "sha256-doY+AWJ0GiE6VsTolgmFIRcRVl52lTgwNJLpXgVQ57c=";
   };
 
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "avogadro2";
-  version = "1.101.0";
+  version = "1.102.1";
 
   src = fetchFromGitHub {
     owner = "OpenChemistry";
     repo = "avogadroapp";
-    rev = version;
-    hash = "sha256-F8to1DyeyyhsivkXDB/KH10/7teVnsoSU/ZHIsNISqc=";
+    rev = finalAttrs.version;
+    hash = "sha256-nBkOiw6JO/cG1Ob9gw7Tt/076OoRaRRmDc/a9YAfZCA=";
   };
 
   postUnpack = ''
@@ -47,6 +48,7 @@ stdenv.mkDerivation rec {
     molequeue
     eigen
     hdf5
+    jkqtplotter
     qttools
   ];
 
@@ -62,4 +64,4 @@ stdenv.mkDerivation rec {
     inherit (mesa.meta) platforms;
     license = licenses.bsd3;
   };
-}
+})

pkgs/applications/science/electronics/librepcb/default.nix

@@ -48,12 +48,22 @@ stdenv.mkDerivation rec {
 
   cargoRoot = "libs/librepcb/rust-core";
 
+  postPatch = ''
+    substituteInPlace libs/muparser/CMakeLists.txt \
+      --replace-fail "cmake_minimum_required (VERSION 3.1.0)" "cmake_minimum_required(VERSION 3.10)"
+    substituteInPlace libs/type_safe{/,/external/debug_assert/}CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 3.1)" "cmake_minimum_required(VERSION 3.10)"
+    substituteInPlace libs/googletest{/,/googlemock/,/googletest/}CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 3.2)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
   meta = with lib; {
     description = "Free EDA software to develop printed circuit boards";
     homepage = "https://librepcb.org/";
     maintainers = with maintainers; [
       luz
       thoughtpolice
+      iedame
     ];
     license = licenses.gpl3Plus;
     platforms = platforms.linux;

pkgs/applications/version-management/subversion/default.nix

@@ -27,6 +27,7 @@
   perl ? null,
   sasl ? null,
   serf ? null,
+  nixosTests,
 }:
 
 assert bdbSupport -> aprutil.bdbSupport;
@@ -156,6 +157,8 @@ let
         nativeCheckInputs = [ python3 ];
         doCheck = false; # fails 10 out of ~2300 tests
 
+        passthru.tests = { inherit (nixosTests) svnserve; };
+
         meta = with lib; {
           description = "Version control system intended to be a compelling replacement for CVS in the open source community";
           license = licenses.asl20;

pkgs/applications/virtualization/singularity/packages.nix

@@ -9,19 +9,19 @@ let
     callPackage
       (import ./generic.nix rec {
         pname = "apptainer";
-        version = "1.4.3";
+        version = "1.4.4";
         projectName = "apptainer";
 
         src = fetchFromGitHub {
           owner = "apptainer";
           repo = "apptainer";
           tag = "v${version}";
-          hash = "sha256-VUtTv6kH08CCOLlRq4lPyOOlduf/oSiGcQ3cHl7ks8I=";
+          hash = "sha256-d3XcN+Jc9KHzVCHOatgpId/DeY/HhVkI9eF+48rzxO4=";
         };
 
         # Override vendorHash with overrideAttrs.
         # See https://nixos.org/manual/nixpkgs/unstable/#buildGoModule-vendorHash
-        vendorHash = "sha256-Q56kFnWw5TqeNGyv2n9QempfIdfPXX1qzdf/G68Pfp8=";
+        vendorHash = "sha256-l8c85M9IdLNhZ40FkC+zH+0wHKcYHcXFbhMklCLULzs=";
 
         extraDescription = " (previously known as Singularity)";
         extraMeta.homepage = "https://apptainer.org";

pkgs/build-support/docker/default.nix

@@ -579,10 +579,16 @@ rec {
     {
       name,
       compressor ? "gz",
+      meta ? { },
       ...
     }@args:
     let
-      stream = streamLayeredImage (removeAttrs args [ "compressor" ]);
+      stream = streamLayeredImage (
+        removeAttrs args [
+          "compressor"
+          "meta"
+        ]
+      );
       compress = compressorForImage compressor name;
     in
     runCommand "${baseNameOf name}.tar${compress.ext}" {
@@ -592,6 +598,7 @@ rec {
         inherit stream;
       };
       nativeBuildInputs = compress.nativeInputs;
+      inherit meta;
     } "${stream} | ${compress.compress} > $out"
   );
 
@@ -641,6 +648,8 @@ rec {
       includeNixDB ? false,
       # Deprecated.
       contents ? null,
+      # Meta options to set on the resulting derivation.
+      meta ? { },
     }:
 
     let
@@ -735,6 +744,7 @@ rec {
                 lib.head (
                   lib.strings.splitString "-" (baseNameOf (builtins.unsafeDiscardStringContext result.outPath))
                 );
+            inherit meta;
           }
           ''
             ${lib.optionalString (tag == null) ''
@@ -1008,6 +1018,7 @@ rec {
       includeStorePaths ? true,
       includeNixDB ? false,
       passthru ? { },
+      meta ? { },
       # Pipeline used to produce docker layers. If not set, popularity contest
       # algorithm is used. If set, maxLayers is ignored as the author of the
       # pipeline can use one of the available functions (like "limit_layers")
@@ -1233,6 +1244,7 @@ rec {
               isExe = true;
             };
             nativeBuildInputs = [ makeWrapper ];
+            inherit meta;
           }
           ''
             makeWrapper $streamScript $out --add-flags $conf

pkgs/build-support/docker/examples.nix

@@ -77,6 +77,8 @@ let
           "${nginxPort}/tcp" = { };
         };
       };
+
+      meta.description = "Basic nginx docker image example";
     };
 
 in
@@ -91,6 +93,8 @@ rec {
       paths = [ pkgs.bashInteractive ];
       pathsToLink = [ "/bin" ];
     };
+
+    meta.description = "Basic example image";
   };
 
   # 2. service example, layered on another image
@@ -138,6 +142,8 @@ rec {
         Retries = 3;
       };
     };
+
+    meta.description = "Service example, layered on another image";
   };
 
   # 3. another service example
@@ -204,6 +210,8 @@ rec {
         "USER=nobody"
       ];
     };
+
+    meta.description = "nix example to play with the container nix store";
   };
 
   # 7. example of adding something on top of an image pull by our

pkgs/build-support/fetchnextcloudapp/default.nix

@@ -39,6 +39,10 @@ applyPatches {
       ${if longDescription == null then null else "longDescription"} = longDescription;
       ${if homepage == null then null else "homepage"} = homepage;
       inherit maintainers teams;
+      sourceProvenance = with lib.sourceTypes; [
+        fromSource
+        binaryBytecode # vendored deps, compiled vue templates, etc
+      ];
     };
   };
   prePatch = ''

pkgs/build-support/fetchpypi/default.nix

@@ -1,7 +1,7 @@
 # `fetchPypi` function for fetching artifacts from PyPI.
 {
+  lib,
   fetchurl,
-  makeOverridable,
 }:
 
 let
@@ -46,7 +46,7 @@ let
     compute (removeAttrs attrs [ "format" ]);
 
 in
-makeOverridable (
+lib.makeOverridable (
   {
     format ? "setuptools",
     sha256 ? "",

pkgs/build-support/fetchtorrent/default.nix

@@ -1,7 +1,7 @@
 {
   lib,
   runCommand,
-  transmission_3_noSystemd,
+  transmission_4,
   rqbit,
   writeShellScript,
   formats,
@@ -97,7 +97,7 @@ runCommand name
     ]
     ++ (
       if (backend == "transmission") then
-        [ transmission_3_noSystemd ]
+        [ transmission_4 ]
       else if (backend == "rqbit") then
         [ rqbit ]
       else
@@ -132,7 +132,6 @@ runCommand name
             --portmap \
             --finish ${transmissionFinishScript} \
             --download-dir "$downloadedDirectory" \
-            --config-dir "$HOME"/.config/transmission \
             "$url"
       ''
     else

pkgs/build-support/go/module.nix

@@ -24,8 +24,8 @@ lib.extendMkDerivation {
       modRoot ? "./",
 
       # The SRI hash of the vendored dependencies.
-      # If `vendorHash` is `null`, no dependencies are fetched and
-      # the build relies on the vendor folder within the source.
+      # If `null`, it means the project either has no external dependencies
+      # or the vendored dependencies are already present in the source tree.
       vendorHash ? throw (
         if args ? vendorSha256 then
           "buildGoModule: Expect vendorHash instead of vendorSha256"

pkgs/build-support/prefer-remote-fetch/default.nix

@@ -22,6 +22,12 @@ self: super: {
   fetchrepoproject = args: super.fetchrepoproject ({ preferLocalBuild = false; } // args);
   fetchs3 = args: super.fetchs3 ({ preferLocalBuild = false; } // args);
   fetchsvn = args: super.fetchsvn ({ preferLocalBuild = false; } // args);
-  fetchurl = args: super.fetchurl ({ preferLocalBuild = false; } // args);
+  fetchurl =
+    fpArgs:
+    super.fetchurl (
+      super.lib.extends (finalAttrs: args: { preferLocalBuild = args.preferLocalBuild or false; }) (
+        super.lib.toFunction fpArgs
+      )
+    );
   mkNugetSource = args: super.mkNugetSource ({ preferLocalBuild = false; } // args);
 }

pkgs/by-name/_1/_1password-cli/package.nix

@@ -93,6 +93,7 @@ stdenv.mkDerivation {
     maintainers = with lib.maintainers; [
       joelburget
       khaneliman
+      iedame
     ];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfree;

pkgs/by-name/_1/_1password-gui/package.nix

@@ -35,6 +35,7 @@ let
       timstott
       sebtm
       bdd
+      iedame
     ];
     platforms = [
       "x86_64-linux"

pkgs/by-name/ad/adjustor/package.nix

@@ -0,0 +1,55 @@
+{
+  fetchFromGitHub,
+  lib,
+  python3Packages,
+  # Dependencies
+  kmod,
+  util-linux,
+}:
+python3Packages.buildPythonPackage rec {
+  pname = "adjustor";
+  version = "3.11.8";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "hhd-dev";
+    repo = "adjustor";
+    tag = "v${version}";
+    hash = "sha256-BS0zV8nan61fTUs3v6nmGBuqPEDjATxBG792ZrrreAI=";
+  };
+
+  # This package relies on several programs expected to be on the user's PATH.
+  # We take a more reproducible approach by patching the absolute path to each of these required
+  # binaries.
+  postPatch = ''
+    substituteInPlace src/adjustor/core/acpi.py \
+      --replace-fail '"modprobe"' '"${lib.getExe' kmod "modprobe"}"'
+    substituteInPlace src/adjustor/fuse/utils.py \
+      --replace-fail 'f"mount' 'f"${lib.getExe' util-linux "mount"}'
+  '';
+
+  build-system = with python3Packages; [
+    setuptools
+  ];
+
+  dependencies = with python3Packages; [
+    rich
+    pyroute2
+    fuse
+    pygobject3
+    dbus-python
+    kmod
+  ];
+
+  # This package doesn't have upstream tests.
+  doCheck = false;
+
+  meta = {
+    homepage = "https://github.com/hhd-dev/adjustor/";
+    description = "Adjustor TDP plugin for Handheld Daemon";
+    platforms = lib.platforms.linux;
+    license = lib.licenses.gpl3Only;
+    maintainers = [ lib.maintainers.toast ];
+    mainProgram = "hhd";
+  };
+}

pkgs/by-name/ae/aerc/package.nix

@@ -11,6 +11,7 @@
   dante,
   gawk,
   versionCheckHook,
+  bashNonInteractive,
   nix-update-script,
 }:
 
@@ -52,6 +53,7 @@ buildGoModule (finalAttrs: {
   buildInputs = [
     python3Packages.python
     gawk
+    bashNonInteractive
   ]
   ++ lib.optional withNotmuch notmuch;
 
@@ -73,14 +75,6 @@ buildGoModule (finalAttrs: {
           dante
         ]
       }
-    wrapProgram $out/libexec/aerc/filters/html-unsafe \
-      --prefix PATH : ${
-        lib.makeBinPath [
-          w3m
-          dante
-        ]
-      }
-    patchShebangs $out/libexec/aerc/filters
   '';
 
   nativeInstallCheckInputs = [ versionCheckHook ];

pkgs/by-name/ai/aitrack/package.nix

@@ -3,12 +3,10 @@
   lib,
   fetchFromGitHub,
   pkg-config,
-  qmake,
-  wrapQtAppsHook,
   opencv,
   spdlog,
   onnxruntime,
-  qtx11extras,
+  libsForQt5,
 }:
 stdenv.mkDerivation {
   pname = "aitrack";
@@ -23,14 +21,14 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [
     pkg-config
-    qmake
-    wrapQtAppsHook
+    libsForQt5.qmake
+    libsForQt5.wrapQtAppsHook
   ];
 
   buildInputs = [
     opencv
     spdlog
-    qtx11extras
+    libsForQt5.qtx11extras
     onnxruntime
   ];