From e6b1423c2f4a2d4402b56c91befae639b49b34d6 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Fri, 28 Nov 2025 19:20:43 +0000 Subject: [PATCH 01/67] ocamlPackages.colombe: 0.12.0 -> 0.12.1 --- pkgs/development/ocaml-modules/colombe/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/ocaml-modules/colombe/default.nix b/pkgs/development/ocaml-modules/colombe/default.nix index d0ed2b870e54..8b67fc6e21d3 100644 --- a/pkgs/development/ocaml-modules/colombe/default.nix +++ b/pkgs/development/ocaml-modules/colombe/default.nix @@ -12,14 +12,14 @@ let pname = "colombe"; - version = "0.12.0"; + version = "0.12.1"; in buildDunePackage { inherit pname version; minimalOCamlVersion = "4.03"; src = fetchurl { url = "https://github.com/mirage/colombe/releases/download/v${version}/colombe-${version}.tbz"; - hash = "sha256-9g9l0wTzlXtESNeoBxhjMxlX0bRFY19T2+PN1lZ7ojE="; + hash = "sha256-6LHsxHUe5zGuNvgcIpJjg17gmx4QrKiO4UDIZcTB2CM="; }; propagatedBuildInputs = [ angstrom From 4f4188ca20299b6c6bd6f38b5fbe88571f185b3b Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 10 Dec 2025 19:57:44 +0000 Subject: [PATCH 02/67] podman: 5.7.0 -> 5.7.1 --- pkgs/by-name/po/podman/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/po/podman/package.nix b/pkgs/by-name/po/podman/package.nix index 6ec4a19e901c..f1c11eac4ad0 100644 --- a/pkgs/by-name/po/podman/package.nix +++ b/pkgs/by-name/po/podman/package.nix @@ -42,13 +42,13 @@ }: buildGoModule (finalAttrs: { pname = "podman"; - version = "5.7.0"; + version = "5.7.1"; src = fetchFromGitHub { owner = "containers"; repo = "podman"; tag = "v${finalAttrs.version}"; - hash = "sha256-SHIWfY8eKdimwpLfB1NtpF1DBh6qaR5KCDTU4vWAMFw="; + hash = "sha256-wfzkn8sv7LajwTZzlWi2gy7Uox4rWGc0i8/OjTIqi5o="; }; patches = [ From 91ca6a70e9a058ff4e26b42d19ea225db3584b7f Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Thu, 18 Dec 2025 15:11:51 +0000 Subject: [PATCH 03/67] tree-sitter-grammars.tree-sitter-vim: 0-unstable-2023-05-05 -> 0.2.0-unstable-2023-05-05 --- .../tools/parsing/tree-sitter/grammars/grammar-sources.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix b/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix index 5adf5f2b26a4..0eb9aaf73107 100644 --- a/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix +++ b/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix @@ -751,7 +751,7 @@ }; vim = { - version = "0-unstable-2023-05-05"; + version = "0.2.0-unstable-2023-05-05"; url = "github:vigoux/tree-sitter-viml/7c317fbade4b40baa7babcd6c9097c157d148e60"; hash = "sha256-/TyPUBsKRcF9Ig8psqd4so2IMbHtTu4weJXgfd96Vrs="; }; From 064cac389574b873e238233204b1bab98c641016 Mon Sep 17 00:00:00 2001 From: matthewcroughan Date: Tue, 23 Dec 2025 20:36:25 +0000 Subject: [PATCH 04/67] signls: init at 0.7.1 Co-authored-by: Aleksana --- pkgs/by-name/si/signls/package.nix | 38 ++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 pkgs/by-name/si/signls/package.nix diff --git a/pkgs/by-name/si/signls/package.nix b/pkgs/by-name/si/signls/package.nix new file mode 100644 index 000000000000..043d6aca1cbc --- /dev/null +++ b/pkgs/by-name/si/signls/package.nix @@ -0,0 +1,38 @@ +{ + lib, + buildGoModule, + fetchFromGitHub, + alsa-lib, +}: + +buildGoModule (finalAttrs: { + pname = "signls"; + version = "0.7.1"; + + src = fetchFromGitHub { + owner = "emprcl"; + repo = "signls"; + tag = "v${finalAttrs.version}"; + hash = "sha256-fITsfMgMdv6zW4KEmteCYQdm2NfI2RLbrW44KOwtLOg="; + }; + + buildInputs = [ + alsa-lib + ]; + + vendorHash = "sha256-reNMOb8QRJ+nMa7S2aM/f8wur0yeMDks2b6Skh6uTQQ="; + + ldflags = [ + "-s" + "-w" + "-X main.AppVersion=v${finalAttrs.version}" + ]; + + meta = { + description = "Non-linear, generative midi sequencer in the terminal"; + homepage = "https://github.com/emprcl/signls"; + license = lib.licenses.mit; + maintainers = with lib.maintainers; [ matthewcroughan ]; + mainProgram = "signls"; + }; +}) From 30ddf0069970149f1301ec4ec0dff8462ba98a5f Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 14 Jan 2026 07:59:35 +0000 Subject: [PATCH 05/67] ocamlPackages.lambda-term: 3.3.2 -> 3.3.3 --- pkgs/development/ocaml-modules/lambda-term/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/ocaml-modules/lambda-term/default.nix b/pkgs/development/ocaml-modules/lambda-term/default.nix index 6b5751f22636..04bcf1aee022 100644 --- a/pkgs/development/ocaml-modules/lambda-term/default.nix +++ b/pkgs/development/ocaml-modules/lambda-term/default.nix @@ -12,13 +12,13 @@ buildDunePackage (finalAttrs: { pname = "lambda-term"; - version = "3.3.2"; + version = "3.3.3"; src = fetchFromGitHub { owner = "ocaml-community"; repo = "lambda-term"; tag = finalAttrs.version; - hash = "sha256-T2DDpHqLar1sgmju0PLvhAZef5VzOpPWcFVhuZlPQmM="; + hash = "sha256-WAn3gTTHjfsEG5sLk3c1YHcyyzPUDzkcU+/fKBcGZFo="; }; propagatedBuildInputs = [ From 8d76e4c7cac46764431d96eab61f4f4cba591689 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Na=C3=AFm=20Camille=20Favier?= Date: Tue, 27 Jan 2026 03:35:04 +0100 Subject: [PATCH 06/67] mpd-mpris: apply https://github.com/natsukagami/mpd-mpris/pull/76 Fixes a difficult-to-diagnose bug where mpd skips the last half-second or so of every track. --- pkgs/by-name/mp/mpd-mpris/package.nix | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/pkgs/by-name/mp/mpd-mpris/package.nix b/pkgs/by-name/mp/mpd-mpris/package.nix index b1bc34480ba3..edaabd5af9e7 100644 --- a/pkgs/by-name/mp/mpd-mpris/package.nix +++ b/pkgs/by-name/mp/mpd-mpris/package.nix @@ -2,6 +2,7 @@ lib, buildGoModule, fetchFromGitHub, + fetchpatch, }: buildGoModule (finalAttrs: { @@ -19,6 +20,13 @@ buildGoModule (finalAttrs: { subPackages = [ "cmd/mpd-mpris" ]; + patches = [ + (fetchpatch { + url = "https://github.com/natsukagami/mpd-mpris/commit/1591f15548aed0f9741d723f24fb505cb24fafe8.patch"; + hash = "sha256-6ZqR4woKiIjwLxyafmidTM8eBXtvBzKNXZvtS1+KKKI="; + }) + ]; + postPatch = '' substituteInPlace services/mpd-mpris.service --replace-fail "ExecStart=" "ExecStart=$out/bin/" ''; From 59462e258373365b189eeb6b870dfaa0ac50de6c Mon Sep 17 00:00:00 2001 From: Tom van Dijk <18gatenmaker6@gmail.com> Date: Thu, 29 Jan 2026 22:41:35 +0100 Subject: [PATCH 07/67] jj-pre-push: remove unused fetchpatch2 import --- pkgs/by-name/jj/jj-pre-push/package.nix | 1 - 1 file changed, 1 deletion(-) diff --git a/pkgs/by-name/jj/jj-pre-push/package.nix b/pkgs/by-name/jj/jj-pre-push/package.nix index 6e12c8d9b188..2a7d58086192 100644 --- a/pkgs/by-name/jj/jj-pre-push/package.nix +++ b/pkgs/by-name/jj/jj-pre-push/package.nix @@ -2,7 +2,6 @@ lib, python3Packages, fetchFromGitHub, - fetchpatch2, }: python3Packages.buildPythonApplication rec { From a75a80b7b0b1d262497530634f2871c04aaac9c0 Mon Sep 17 00:00:00 2001 From: Tom van Dijk <18gatenmaker6@gmail.com> Date: Thu, 29 Jan 2026 22:44:47 +0100 Subject: [PATCH 08/67] jj-pre-push: install shell completion files --- pkgs/by-name/jj/jj-pre-push/package.nix | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/pkgs/by-name/jj/jj-pre-push/package.nix b/pkgs/by-name/jj/jj-pre-push/package.nix index 2a7d58086192..628a905620b3 100644 --- a/pkgs/by-name/jj/jj-pre-push/package.nix +++ b/pkgs/by-name/jj/jj-pre-push/package.nix @@ -1,7 +1,9 @@ { lib, + stdenv, python3Packages, fetchFromGitHub, + installShellFiles, }: python3Packages.buildPythonApplication rec { @@ -24,6 +26,14 @@ python3Packages.buildPythonApplication rec { typer-slim ]; + nativeBuildInputs = [ installShellFiles ]; + postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) '' + installShellCompletion --cmd jj-pre-push \ + --bash <($out/bin/jj-pre-push --show-completion bash) \ + --fish <($out/bin/jj-pre-push --show-completion fish) \ + --zsh <($out/bin/jj-pre-push --show-completion zsh) + ''; + pythonImportsCheck = [ "jj_pre_push" ]; From fd5702f308e09235afa4cda624c33e6fa90c3421 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Fri, 30 Jan 2026 15:50:06 +0000 Subject: [PATCH 09/67] xfd: 1.1.4 -> 1.1.5 --- pkgs/by-name/xf/xfd/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/xf/xfd/package.nix b/pkgs/by-name/xf/xfd/package.nix index 8c570195f841..16f0a1fcb70f 100644 --- a/pkgs/by-name/xf/xfd/package.nix +++ b/pkgs/by-name/xf/xfd/package.nix @@ -18,7 +18,7 @@ }: stdenv.mkDerivation (finalAttrs: { pname = "xfd"; - version = "1.1.4"; + version = "1.1.5"; src = fetchFromGitLab { domain = "gitlab.freedesktop.org"; @@ -26,7 +26,7 @@ stdenv.mkDerivation (finalAttrs: { owner = "app"; repo = "xfd"; tag = "xfd-${finalAttrs.version}"; - hash = "sha256-8kkoJILNlVgDIV029mF3err6es5V001FQqUnTtD9/LQ="; + hash = "sha256-mdDnS6315po8/DafpGJDzGJTPV0HsRbSLlqSaN11d6o="; }; strictDeps = true; From 4006a9b21c618a150f27facb3034b66ff3afe9ff Mon Sep 17 00:00:00 2001 From: rnhmjoj Date: Fri, 30 Jan 2026 12:20:37 +0100 Subject: [PATCH 10/67] nixos/wireless: add enableHardening option This may be necessary for more complex enterprise networks (for example requiring access to mutable files, smart cards or TPM devices), as pointed out in https://github.com/NixOS/nixpkgs/issues/480355#issuecomment-3803880025. --- .../services/networking/wpa_supplicant.nix | 47 +++++++++++++------ nixos/tests/wpa_supplicant.nix | 13 +++++ .../wpa_supplicant/unprivileged-daemon.patch | 39 +++++---------- 3 files changed, 57 insertions(+), 42 deletions(-) diff --git a/nixos/modules/services/networking/wpa_supplicant.nix b/nixos/modules/services/networking/wpa_supplicant.nix index f73622af3458..04cbe84308df 100644 --- a/nixos/modules/services/networking/wpa_supplicant.nix +++ b/nixos/modules/services/networking/wpa_supplicant.nix @@ -117,9 +117,24 @@ let path = [ pkgs.wpa_supplicant ]; serviceConfig = { + RuntimeDirectory = "wpa_supplicant"; + ExecStartPre = + lib.optionals (cfg.allowAuxiliaryImperativeNetworks || !hasDeclarative) [ + # set up imperative config file + "+${pkgs.coreutils}/bin/touch /etc/wpa_supplicant/imperative.conf" + "+${pkgs.coreutils}/bin/chmod 664 /etc/wpa_supplicant/imperative.conf" + "+${pkgs.coreutils}/bin/chown -R wpa_supplicant:wpa_supplicant /etc/wpa_supplicant" + ] + ++ lib.optionals cfg.userControlled [ + # set up client sockets directory + "+${pkgs.coreutils}/bin/mkdir /run/wpa_supplicant/client" + "+${pkgs.coreutils}/bin/chown wpa_supplicant:wpa_supplicant /run/wpa_supplicant/client" + "+${pkgs.coreutils}/bin/chmod g=u /run/wpa_supplicant/client" + ]; + } + // lib.optionalAttrs cfg.enableHardening { User = "wpa_supplicant"; Group = "wpa_supplicant"; - RuntimeDirectory = "wpa_supplicant"; AmbientCapabilities = [ "CAP_NET_ADMIN" "CAP_NET_RAW" @@ -180,20 +195,6 @@ let ]; SystemCallArchitectures = "native"; UMask = "0077"; - - ExecStartPre = - lib.optionals (cfg.allowAuxiliaryImperativeNetworks || !hasDeclarative) [ - # set up imperative config file - "+${pkgs.coreutils}/bin/touch /etc/wpa_supplicant/imperative.conf" - "+${pkgs.coreutils}/bin/chmod 664 /etc/wpa_supplicant/imperative.conf" - "+${pkgs.coreutils}/bin/chown -R wpa_supplicant:wpa_supplicant /etc/wpa_supplicant" - ] - ++ lib.optionals cfg.userControlled [ - # set up client sockets directory - "+${pkgs.coreutils}/bin/mkdir /run/wpa_supplicant/client" - "+${pkgs.coreutils}/bin/chown wpa_supplicant:wpa_supplicant /run/wpa_supplicant/client" - "+${pkgs.coreutils}/bin/chmod g=u /run/wpa_supplicant/client" - ]; }; script = '' @@ -598,6 +599,22 @@ in ''; }; + enableHardening = mkOption { + default = true; + description = '' + Whether to apply security hardening measures to wpa_supplicant. + These include limiting access to the filesystem, devices and network + capabilities. + + ::: {.note} + Disabling this will increase the potential attack surface if the + wpa_supplicant daemon becomes compromised, but it may be necessary + for more complex enterprise networks (for example requiring + access to mutable files, smart cards or TPM devices). + ::: + ''; + }; + extraConfig = mkOption { type = types.lines; default = ""; diff --git a/nixos/tests/wpa_supplicant.nix b/nixos/tests/wpa_supplicant.nix index 1adda72186f4..8b3321822b03 100644 --- a/nixos/tests/wpa_supplicant.nix +++ b/nixos/tests/wpa_supplicant.nix @@ -226,6 +226,19 @@ in machine.succeed(dbus_command) # as root machine.succeed(f"sudo -g wpa_supplicant {dbus_command}") # as wpa_supplicant group + with subtest("D-Bus auto-starting is working"): + # stop service + machine.systemctl("stop wpa_supplicant.service") + machine.require_unit_state("wpa_supplicant.service", "inactive") + + # send wake up + dbus_command = "dbus-send --system --print-reply --dest=fi.w1.wpa_supplicant1 " \ + "/fi/w1/wpa_supplicant1 fi.w1.wpa_supplicant1.GetInterface string:wlan0" + machine.succeed(dbus_command) + + # should be up again + machine.require_unit_state("wpa_supplicant.service", "active") + # generated configuration file config_file = "/etc/static/wpa_supplicant/nixos.conf" diff --git a/pkgs/os-specific/linux/wpa_supplicant/unprivileged-daemon.patch b/pkgs/os-specific/linux/wpa_supplicant/unprivileged-daemon.patch index e7105017b7c8..8df587722b79 100644 --- a/pkgs/os-specific/linux/wpa_supplicant/unprivileged-daemon.patch +++ b/pkgs/os-specific/linux/wpa_supplicant/unprivileged-daemon.patch @@ -1,22 +1,22 @@ -commit 4608dab78e6ac78be7ab625fb066861549daa37f +commit 47cc80d3056f8a783ce1caabeb0a8b5379cba3d1 Author: rnhmjoj -Date: Wed Dec 31 01:43:26 2025 +0100 +Date: Mon Feb 2 08:24:24 2026 +0100 Fixes for running wpa_supplicant unprivileged - 1. Change the dbus service user to "wpa_supplicant" - - 2. Ensure appropriate group ownership and permissions on the client sockets. + 1. Ensure appropriate group ownership and permissions on the client sockets. Motivation: clients communicate with the daemon by creating "client" sockets; by default this is owned by the user running the client, so it may be inaccessible by the daemon. - 3. Move the "control" sockets under a subdirectory of /run/wpa_supplicant. + 2. Move the "control" sockets under a subdirectory of /run/wpa_supplicant. Motivation: wpa_supplicant will try to adjust the ownership of the sockets directory, even if they are fine, and fail. - 4. Move the "client" under a subdirectory of /run/wpa_supplicant instead - of tmp. Motivation: this allows to unshare /tmp + 3. Move the "client" under a subdirectory of /run/wpa_supplicant instead + of tmp. Motivation: this allows to unshare /tmp. + + 4. Extend the dbus policy to allow the wpa_supplicant user/group. diff --git a/src/common/wpa_ctrl.c b/src/common/wpa_ctrl.c index 7e197f094..6bfb09111 100644 @@ -47,38 +47,23 @@ index 7e197f094..6bfb09111 100644 /* Set group even if we do not have privileges to change owner */ lchown(ctrl->local.sun_path, -1, AID_WIFI); diff --git a/wpa_supplicant/dbus/dbus-wpa_supplicant.conf b/wpa_supplicant/dbus/dbus-wpa_supplicant.conf -index e81b495f4..1ee5bc19a 100644 +index e81b495f4..c371dd11f 100644 --- a/wpa_supplicant/dbus/dbus-wpa_supplicant.conf +++ b/wpa_supplicant/dbus/dbus-wpa_supplicant.conf -@@ -2,9 +2,15 @@ - "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN" - "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd"> +@@ -4,7 +4,12 @@ -- -+ + - -+ -+ + + + + + ++ -diff --git a/wpa_supplicant/dbus/fi.w1.wpa_supplicant1.service.in b/wpa_supplicant/dbus/fi.w1.wpa_supplicant1.service.in -index d97ff3921..367a7c670 100644 ---- a/wpa_supplicant/dbus/fi.w1.wpa_supplicant1.service.in -+++ b/wpa_supplicant/dbus/fi.w1.wpa_supplicant1.service.in -@@ -1,5 +1,5 @@ - [D-BUS Service] - Name=fi.w1.wpa_supplicant1 - Exec=@BINDIR@/wpa_supplicant -u --User=root -+User=wpa_supplicant - SystemdService=wpa_supplicant.service diff --git a/wpa_supplicant/wpa_cli.c b/wpa_supplicant/wpa_cli.c index 03180a316..f5e22dee1 100644 --- a/wpa_supplicant/wpa_cli.c From 8bc1ca8720ec759cfc56fc991c7d955419131780 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 2 Feb 2026 16:42:17 +0000 Subject: [PATCH 11/67] uwsm: 0.26.0 -> 0.26.1 --- pkgs/by-name/uw/uwsm/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/uw/uwsm/package.nix b/pkgs/by-name/uw/uwsm/package.nix index 1a56818da207..216ea9e87055 100644 --- a/pkgs/by-name/uw/uwsm/package.nix +++ b/pkgs/by-name/uw/uwsm/package.nix @@ -29,13 +29,13 @@ let in stdenv.mkDerivation (finalAttrs: { pname = "uwsm"; - version = "0.26.0"; + version = "0.26.1"; src = fetchFromGitHub { owner = "Vladimir-csp"; repo = "uwsm"; tag = "v${finalAttrs.version}"; - hash = "sha256-Com3Q6/xPM6fDW0rNP8QQpn8A/bUSC7cLs3xwRiTGDs="; + hash = "sha256-HyclcItaSsBhzyYM9sgloSG6TBWvsUkRs+oIPezvO0E="; }; nativeBuildInputs = [ From ca43c97bd97738e82c7fea43529e19c3bec4b50f Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 12 Nov 2025 00:31:25 +0000 Subject: [PATCH 12/67] ocamlPackages.tsdl: 1.1.0 -> 1.2.0 --- pkgs/development/ocaml-modules/tsdl/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/ocaml-modules/tsdl/default.nix b/pkgs/development/ocaml-modules/tsdl/default.nix index b1de7d37ea6f..fcef54a3e94f 100644 --- a/pkgs/development/ocaml-modules/tsdl/default.nix +++ b/pkgs/development/ocaml-modules/tsdl/default.nix @@ -15,7 +15,7 @@ let pname = "tsdl"; - version = "1.1.0"; + version = "1.2.0"; webpage = "https://erratique.ch/software/${pname}"; in @@ -25,7 +25,7 @@ stdenv.mkDerivation { src = fetchurl { url = "${webpage}/releases/${pname}-${version}.tbz"; - hash = "sha256-ZN4+trqesU1IREKcwm1Ro37jszKG8XcVigoE4BdGhzs="; + hash = "sha256-IhB/qCh6KVfTQNFoTdxmSRRd6uMq/9OpdGvx6uqliAY="; }; strictDeps = true; From 1e37efce361b837b7c58889dd15ad5cd283b34ca Mon Sep 17 00:00:00 2001 From: Chris Moultrie <821688+tebriel@users.noreply.github.com> Date: Tue, 3 Feb 2026 21:15:19 -0500 Subject: [PATCH 13/67] navidrome: 0.59 -> 0.60 changelog: https://github.com/navidrome/navidrome/releases/tag/v0.60.0 --- nixos/modules/services/audio/navidrome.nix | 3 ++- pkgs/by-name/na/navidrome/package.nix | 12 ++++++++---- 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/nixos/modules/services/audio/navidrome.nix b/nixos/modules/services/audio/navidrome.nix index 28f9dcdb365b..8fa7e6dc3db5 100644 --- a/nixos/modules/services/audio/navidrome.nix +++ b/nixos/modules/services/audio/navidrome.nix @@ -161,7 +161,8 @@ in ]; RestrictRealtime = true; LockPersonality = true; - MemoryDenyWriteExecute = true; + # 0.60.0 Taglib introduces WASM JIT that requires this + MemoryDenyWriteExecute = false; UMask = "0066"; ProtectHostname = true; }; diff --git a/pkgs/by-name/na/navidrome/package.nix b/pkgs/by-name/na/navidrome/package.nix index d1529a52d775..3e6e2d8c1592 100644 --- a/pkgs/by-name/na/navidrome/package.nix +++ b/pkgs/by-name/na/navidrome/package.nix @@ -19,23 +19,23 @@ buildGoModule (finalAttrs: { pname = "navidrome"; - version = "0.59.0"; + version = "0.60.0"; src = fetchFromGitHub { owner = "navidrome"; repo = "navidrome"; rev = "v${finalAttrs.version}"; - hash = "sha256-YXyNnjaLgu4FXvgsbbzCOZRIuN96h+KDrXmJe1607JI="; + hash = "sha256-K7Cen0gADYQc0jxd2keBpTJlyQyuYL02j7/yiNtjZvQ="; }; - vendorHash = "sha256-FFtTQuXb5GYxZmUiNjZNO6K8QYF0TLH4JU2JmAzZhqQ="; + vendorHash = "sha256-DCz/WKZXnZy109WgStCK7NJg8VpR3IJEaQZLMDXdegk="; npmRoot = "ui"; npmDeps = fetchNpmDeps { inherit (finalAttrs) src; sourceRoot = "${finalAttrs.src.name}/ui"; - hash = "sha256-RTye1ZbxLqfkZUvV0NLN7wcRnri3sC5Lfi8RXVG1bLM="; + hash = "sha256-Z1kSRNSG1zeLA6rtbcTdLJnNWclsVTS5Xfc4D9M0dl4="; }; nativeBuildInputs = [ @@ -55,6 +55,10 @@ buildGoModule (finalAttrs: { zlib ]; + excludedPackages = [ + "plugins" + ]; + ldflags = [ "-X github.com/navidrome/navidrome/consts.gitSha=${finalAttrs.src.rev}" "-X github.com/navidrome/navidrome/consts.gitTag=v${finalAttrs.version}" From e745a4ec20f56beec6f89b2a24aed8e49b25f126 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 4 Feb 2026 10:52:42 +0000 Subject: [PATCH 14/67] luau: 0.705 -> 0.707 --- pkgs/by-name/lu/luau/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/lu/luau/package.nix b/pkgs/by-name/lu/luau/package.nix index a50a2930e7e4..82d17474e4b0 100644 --- a/pkgs/by-name/lu/luau/package.nix +++ b/pkgs/by-name/lu/luau/package.nix @@ -9,13 +9,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "luau"; - version = "0.705"; + version = "0.707"; src = fetchFromGitHub { owner = "luau-lang"; repo = "luau"; tag = finalAttrs.version; - hash = "sha256-M0niHRtx/Xu3H5CJXbqB2VCXFsthvPDNcr29egY3ncI="; + hash = "sha256-YUv40STZs5J+xFo5apbyqOpDB+PO+mYsC93pXmxhW+o="; }; nativeBuildInputs = [ cmake ]; From 3cc9e67c46c19a704e26b9822299a114c3abf35d Mon Sep 17 00:00:00 2001 From: BatteredBunny Date: Mon, 2 Feb 2026 13:06:16 +0200 Subject: [PATCH 15/67] tabbyapi: init at unstable-2026-01-20 --- pkgs/by-name/ta/tabbyapi/package.nix | 115 +++++++++++++++++++++++++++ 1 file changed, 115 insertions(+) create mode 100644 pkgs/by-name/ta/tabbyapi/package.nix diff --git a/pkgs/by-name/ta/tabbyapi/package.nix b/pkgs/by-name/ta/tabbyapi/package.nix new file mode 100644 index 000000000000..8c3a41d32181 --- /dev/null +++ b/pkgs/by-name/ta/tabbyapi/package.nix @@ -0,0 +1,115 @@ +{ + lib, + fetchFromGitHub, + stdenv, + nix-update-script, + python3Packages, +}: +python3Packages.buildPythonApplication { + pname = "tabbyapi"; + version = "0-unstable-2026-01-20"; + pyproject = true; + + src = fetchFromGitHub { + owner = "theroyallab"; + repo = "tabbyAPI"; + rev = "54e3ea1fb30c48217f82dcb4ab1359f4784da4c8"; + hash = "sha256-cwxpW4s8LKxS+2A2Grfhx8XaxbfT8U1LG59yhbu1lD8="; + }; + + build-system = with python3Packages; [ + packaging + setuptools + wheel + ]; + + nativeBuildInputs = with python3Packages; [ + pythonRelaxDepsHook + ]; + + pythonRelaxDeps = [ + "pydantic" + ]; + + dependencies = + with python3Packages; + [ + fastapi # fastapi-slim + pydantic + ruamel-yaml + rich + uvicorn + jinja2 + loguru + sse-starlette + packaging + tokenizers + formatron + kbnf + aiofiles + aiohttp + async-lru + huggingface-hub + psutil + httptools + pillow + numpy + setuptools + + exllamav2 + exllamav3 + ] + ++ lib.optionals stdenv.hostPlatform.isLinux [ + uvloop + ]; + + postPatch = '' + substituteInPlace pyproject.toml --replace-fail 'fastapi-slim' 'fastapi' + ''; + + optional-dependencies = with python3Packages; { + amd = [ + pytorch-triton-rocm + torch + ]; + cu118 = [ + torch + ]; + cu121 = [ + flash-attn + torch + ]; + dev = [ + ruff + ]; + extras = [ + infinity-emb + sentence-transformers + ]; + }; + + postInstall = '' + cp *.py $out/${python3Packages.python.sitePackages}/ + cp -r {common,endpoints,backends,templates} $out/${python3Packages.python.sitePackages}/ + ''; + + postFixup = '' + makeWrapper ${python3Packages.python.interpreter} $out/bin/tabbyapi \ + --prefix PYTHONPATH : "$PYTHONPATH" \ + --add-flags "$out/${python3Packages.python.sitePackages}/main.py" + ''; + + passthru.updateScript = nix-update-script { }; + + meta = { + description = "Official API server for Exllama"; + homepage = "https://github.com/theroyallab/tabbyAPI"; + license = lib.licenses.agpl3Only; + platforms = [ + "x86_64-windows" + "x86_64-linux" + ]; + mainProgram = "tabbyapi"; + maintainers = with lib.maintainers; [ BatteredBunny ]; + }; +} From c1d5f03906ac0d31b5b34fe61c2c1c2218d47e7b Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Thu, 5 Feb 2026 01:09:23 +0000 Subject: [PATCH 16/67] vgmplay-libvgm: 0.51.1-unstable-2025-12-31 -> 0.52.0-unstable-2026-01-31 --- pkgs/by-name/vg/vgmplay-libvgm/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/vg/vgmplay-libvgm/package.nix b/pkgs/by-name/vg/vgmplay-libvgm/package.nix index 56579aeb4b6f..af26a0038758 100644 --- a/pkgs/by-name/vg/vgmplay-libvgm/package.nix +++ b/pkgs/by-name/vg/vgmplay-libvgm/package.nix @@ -12,13 +12,13 @@ stdenv.mkDerivation { pname = "vgmplay-libvgm"; - version = "0.51.1-unstable-2025-12-31"; + version = "0.52.0-unstable-2026-01-31"; src = fetchFromGitHub { owner = "ValleyBell"; repo = "vgmplay-libvgm"; - rev = "e8f07455854053cb676967112c3ddf414bb8c1ea"; - hash = "sha256-YNaswHUFcTXncj+TKXQq5AhCLrM0SZ/EaO7hXb0OQLM="; + rev = "2a8f3909bcfca4c595ca71c0f762ff495a29e130"; + hash = "sha256-TJUhE4te/nZOsckgMksWcqawsWR8r3OInJoVrv+NVAQ="; }; nativeBuildInputs = [ From 89a40f7ce4a286a569d2afb7bd0143193947bfa4 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Thu, 5 Feb 2026 16:13:59 +0000 Subject: [PATCH 17/67] steel: 0-unstable-2026-01-28 -> 0-unstable-2026-02-05 --- pkgs/by-name/st/steel/package.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/by-name/st/steel/package.nix b/pkgs/by-name/st/steel/package.nix index 2184c58b3210..9d9a4172dc69 100644 --- a/pkgs/by-name/st/steel/package.nix +++ b/pkgs/by-name/st/steel/package.nix @@ -19,16 +19,16 @@ }: rustPlatform.buildRustPackage { pname = "steel"; - version = "0-unstable-2026-01-28"; + version = "0-unstable-2026-02-05"; src = fetchFromGitHub { owner = "mattwparas"; repo = "steel"; - rev = "b77360e462bd43992a497ab93ee081455cd61fd9"; - hash = "sha256-6d9bWAGECaYZz+idOzsDxq1DsPnKQ/UwlQS72sfXgpY="; + rev = "6a4300bdd7b4001358606a3638b7bc0759fe6b00"; + hash = "sha256-eHKb/0rJ8yRnSeOJcmhJp+x02tOM94duJlRBLvn+p0c="; }; - cargoHash = "sha256-1YUbAHefisaCOD1y0qITzAyk0PmEwb3ad+ZJUSmzcUs="; + cargoHash = "sha256-wt+Zy5j/zDuYxuLpsTTajclYs12RJTvjFA0csjaMeds="; nativeBuildInputs = [ curl From 18e88d07b06b245df54816de825a5f241ed75960 Mon Sep 17 00:00:00 2001 From: Moraxyc Date: Fri, 6 Feb 2026 12:33:08 +0800 Subject: [PATCH 18/67] alist: 3.55.0 -> 3.57.0 --- pkgs/by-name/al/alist/package.nix | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/pkgs/by-name/al/alist/package.nix b/pkgs/by-name/al/alist/package.nix index fa227de7d5e2..69011adfadfe 100644 --- a/pkgs/by-name/al/alist/package.nix +++ b/pkgs/by-name/al/alist/package.nix @@ -11,13 +11,13 @@ }: buildGoModule (finalAttrs: { pname = "alist"; - version = "3.55.0"; + version = "3.57.0"; src = fetchFromGitHub { owner = "AlistGo"; repo = "alist"; tag = "v${finalAttrs.version}"; - hash = "sha256-/psFL/dCG82y1uWEcg45JG6S7+MD0avqU/HjrR+vklA="; + hash = "sha256-wwV65vxNSrGzP7TQ+nnjWS+dcCj/+67WcMPRbNqOVbQ="; # populate values that require us to use git. By doing this in postFetch we # can delete .git afterwards and maintain better reproducibility of the src. leaveDotGit = true; @@ -30,6 +30,13 @@ buildGoModule (finalAttrs: { ''; }; + # --- FAIL: TestSecureJoin/drive (0.00s) + # securepath_test.go:29: expected error for "C:\\evil.txt", got nil + postPatch = lib.optionalString stdenv.hostPlatform.isUnix '' + substituteInPlace internal/archive/tool/securepath_test.go \ + --replace-fail '{name: "drive", entry: "C:\\evil.txt", wantErr: true},' "" + ''; + proxyVendor = true; vendorHash = "sha256-aRnS3LLG25FK1ELKd7K1e5aGLmKnQ7w/3QVe4P9RRLI="; @@ -87,10 +94,10 @@ buildGoModule (finalAttrs: { passthru = { updateScript = lib.getExe (callPackage ./update.nix { }); - webVersion = "3.55.0"; + webVersion = "3.57.0"; web = fetchzip { url = "https://github.com/AlistGo/alist-web/releases/download/${finalAttrs.passthru.webVersion}/dist.tar.gz"; - hash = "sha256-v0o4G2mzd63sShJZRjijIFAUB+ocvF4jspxf841lZ8U="; + hash = "sha256-QP1eWlSr7XBX8jUyvXhpmEGIwWaY6wy4M2l/35AiuUg="; }; }; From 7b4e2f240e48ebbf183aab4192efc83c25e5c5f0 Mon Sep 17 00:00:00 2001 From: JohnnyJayJay Date: Fri, 6 Feb 2026 17:31:54 +0100 Subject: [PATCH 19/67] nixos-container: add --refresh option --- pkgs/by-name/ni/nixos-container/nixos-container.pl | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/ni/nixos-container/nixos-container.pl b/pkgs/by-name/ni/nixos-container/nixos-container.pl index 3e4d50c903db..c23a90e4f870 100755 --- a/pkgs/by-name/ni/nixos-container/nixos-container.pl +++ b/pkgs/by-name/ni/nixos-container/nixos-container.pl @@ -55,6 +55,7 @@ Usage: nixos-container list [--config-file ] [--flake ] [--nixos-path ] + [--refresh] nixos-container login nixos-container root-login nixos-container run -- args... @@ -122,6 +123,7 @@ GetOptions( "no-write-lock-file" => \©NixFlags0, "no-allow-dirty" => \©NixFlags0, "recreate-lock-file" => \©NixFlags0, + "refresh" => \©NixFlags0, ) or exit 1; push @nixFlags, @nixFlags2; From 4bdefbce25aff78204688e52e33ba97a95594c15 Mon Sep 17 00:00:00 2001 From: Malik Date: Fri, 6 Feb 2026 17:36:07 +0100 Subject: [PATCH 20/67] ollama: 0.15.4 -> 0.15.5 --- pkgs/by-name/ol/ollama/package.nix | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/pkgs/by-name/ol/ollama/package.nix b/pkgs/by-name/ol/ollama/package.nix index 9373549cb020..79dc42eca7a1 100644 --- a/pkgs/by-name/ol/ollama/package.nix +++ b/pkgs/by-name/ol/ollama/package.nix @@ -137,17 +137,16 @@ let in goBuild (finalAttrs: { pname = "ollama"; - # don't forget to invalidate all hashes each update - version = "0.15.4"; + version = "0.15.5"; src = fetchFromGitHub { owner = "ollama"; repo = "ollama"; tag = "v${finalAttrs.version}"; - hash = "sha256-5dkikrp7jVGnfFwiGkbsGsRnrsS0zcZzWQ7shOn3alw="; + hash = "sha256-VJrAUHX+BVQXsH34BDI4YqVXEqD14ERnKhSpMByAdrQ="; }; - vendorHash = "sha256-WdHAjCD20eLj0d9v1K6VYP8vJ+IZ8BEZ3CciYLLMtxc="; + vendorHash = "sha256-r7bSHOYAB5f3fRz7lKLejx6thPx0dR4UXoXu0XD7kVM="; env = lib.optionalAttrs enableRocm { From 63d093ac241c01a9d3f3e8e7c4dacaaf3cd50d83 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Fri, 19 Dec 2025 13:28:26 +0000 Subject: [PATCH 21/67] ocamlPackages.github: 4.5.0 -> 4.5.1 --- pkgs/development/ocaml-modules/github/default.nix | 4 ++-- pkgs/development/ocaml-modules/github/unix.nix | 10 +--------- 2 files changed, 3 insertions(+), 11 deletions(-) diff --git a/pkgs/development/ocaml-modules/github/default.nix b/pkgs/development/ocaml-modules/github/default.nix index 7c91f5a9dbcf..28a5de55978c 100644 --- a/pkgs/development/ocaml-modules/github/default.nix +++ b/pkgs/development/ocaml-modules/github/default.nix @@ -13,13 +13,13 @@ buildDunePackage rec { pname = "github"; - version = "4.5.0"; + version = "4.5.1"; src = fetchFromGitHub { owner = "mirage"; repo = "ocaml-github"; rev = version; - sha256 = "sha256-/IRoaGh4nYcdv4ir3LOS1d9UHLfWJ6DdPyFoFVCS+p4="; + sha256 = "sha256-nxHXOdZAvFe5/lKNw7tTJmY86xzfdFT+fW+lnKioyPM="; }; duneVersion = "3"; diff --git a/pkgs/development/ocaml-modules/github/unix.nix b/pkgs/development/ocaml-modules/github/unix.nix index 54e5dc5daa98..ae6bdb7967a8 100644 --- a/pkgs/development/ocaml-modules/github/unix.nix +++ b/pkgs/development/ocaml-modules/github/unix.nix @@ -13,16 +13,8 @@ buildDunePackage { pname = "github-unix"; inherit (github) version src; - patches = [ - # Compatibility with yojson 3.0 - (fetchpatch { - url = "https://github.com/mirage/ocaml-github/commit/487d7d413363921a8ffbb941610c2f71c811add8.patch"; - hash = "sha256-ThCsWRQKmlRg7rk8tlorsO87v8RWnBvocHDvgg/WWMA="; - }) - ]; - postPatch = '' - substituteInPlace unix/dune --replace 'github bytes' 'github' + substituteInPlace unix/dune --replace-fail 'github bytes' 'github' ''; propagatedBuildInputs = [ From 469ee146c8c6f71049228cb087b7c50f91e67850 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Fri, 6 Feb 2026 17:07:31 +0000 Subject: [PATCH 22/67] phpPackages.grumphp: 2.18.0 -> 2.19.0 --- pkgs/development/php-packages/grumphp/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/development/php-packages/grumphp/default.nix b/pkgs/development/php-packages/grumphp/default.nix index 9413e46f1f1b..558c064d2f1b 100644 --- a/pkgs/development/php-packages/grumphp/default.nix +++ b/pkgs/development/php-packages/grumphp/default.nix @@ -7,16 +7,16 @@ php.buildComposerProject2 (finalAttrs: { pname = "grumphp"; - version = "2.18.0"; + version = "2.19.0"; src = fetchFromGitHub { owner = "phpro"; repo = "grumphp"; tag = "v${finalAttrs.version}"; - hash = "sha256-JNpgIba+Y3qURegZFNeBKwigynSVzSfaAxM2RwcILMc="; + hash = "sha256-UkIIOr+FgOxBn7lK4VbEUG3AdvIG2Ij3YWr0mLzc+SM="; }; - vendorHash = "sha256-Abi+NIXqD8HVTI1OVimeYmzybKXGGNA+l2MHUkx7CpQ="; + vendorHash = "sha256-DJJ3y1Rm9wFmrVz7H1M5fTxrMGiU12SXJydTqXcSZQA="; doInstallCheck = true; nativeInstallCheckInputs = [ versionCheckHook ]; From 7d64d8994425c5a1d7f3cb5c78353f6934d7c495 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Fri, 6 Feb 2026 18:52:35 +0000 Subject: [PATCH 23/67] yara-x: 1.12.0 -> 1.13.0 --- pkgs/by-name/ya/yara-x/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ya/yara-x/package.nix b/pkgs/by-name/ya/yara-x/package.nix index 8d7057b212e2..2e9dac81f8c2 100644 --- a/pkgs/by-name/ya/yara-x/package.nix +++ b/pkgs/by-name/ya/yara-x/package.nix @@ -11,16 +11,16 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "yara-x"; - version = "1.12.0"; + version = "1.13.0"; src = fetchFromGitHub { owner = "VirusTotal"; repo = "yara-x"; tag = "v${finalAttrs.version}"; - hash = "sha256-od7RWHhyFQ7l3HZaqpOkUVtiWKDQj/tUsd5lGi6m34I="; + hash = "sha256-EEvy0UtmBlgC3b57SOwr7dI49R7PYeFqsZKyzo0zx9w="; }; - cargoHash = "sha256-YW4Yi1gvMjTNAgsAlyX1KMlyQPHCXh/jAoO/Nkrn2Sc="; + cargoHash = "sha256-ihNFGlPhPLCIDvFnMqKA+flD/mv9wcKgQ1txO71xOp4="; CARGO_PROFILE_RELEASE_LTO = "fat"; CARGO_PROFILE_RELEASE_CODEGEN_UNITS = "1"; From 87b0c53ad95b87946f868eeebf255c6161d86047 Mon Sep 17 00:00:00 2001 From: Tom Herbers Date: Fri, 6 Feb 2026 20:56:51 +0100 Subject: [PATCH 24/67] nebula: 1.10.2 -> 1.10.3 Changelog: https://github.com/slackhq/nebula/blob/v1.10.3/CHANGELOG.md --- pkgs/by-name/ne/nebula/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ne/nebula/package.nix b/pkgs/by-name/ne/nebula/package.nix index b474a32fa89d..87fdd53b89bd 100644 --- a/pkgs/by-name/ne/nebula/package.nix +++ b/pkgs/by-name/ne/nebula/package.nix @@ -8,16 +8,16 @@ buildGoModule (finalAttrs: { pname = "nebula"; - version = "1.10.2"; + version = "1.10.3"; src = fetchFromGitHub { owner = "slackhq"; repo = "nebula"; tag = "v${finalAttrs.version}"; - hash = "sha256-hDszl6//hFVK79dadz6mBuYMRvwDUerUkPvzD5AcvfA="; + hash = "sha256-sF/NZpBxbJWHTjx6Nuv7WHgUqhYbBq2/g7nB3wxNDHg="; }; - vendorHash = "sha256-CNYBqslUXJf3Nls3Lu6PbABhT9wTbIfBZxFkiUW59Kk="; + vendorHash = "sha256-zzYywNbeccW4Ujig20oBUZsJBQFvCIkCNOuBMxGxaqE="; subPackages = [ "cmd/nebula" From f4a70e52a711d62f5a73b5ed1ec7f4d1e7968bc0 Mon Sep 17 00:00:00 2001 From: Tom Herbers Date: Fri, 6 Feb 2026 20:58:34 +0100 Subject: [PATCH 25/67] nebula: add herbetom as maintainer --- pkgs/by-name/ne/nebula/package.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/by-name/ne/nebula/package.nix b/pkgs/by-name/ne/nebula/package.nix index 87fdd53b89bd..024c280c7a72 100644 --- a/pkgs/by-name/ne/nebula/package.nix +++ b/pkgs/by-name/ne/nebula/package.nix @@ -78,6 +78,7 @@ buildGoModule (finalAttrs: { changelog = "https://github.com/slackhq/nebula/blob/v${finalAttrs.version}/CHANGELOG.md"; license = lib.licenses.mit; maintainers = with lib.maintainers; [ + herbetom numinit ]; }; From 37b3dc5808d35f93721ba440b7817886d8b1853d Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Fri, 6 Feb 2026 20:34:24 +0000 Subject: [PATCH 26/67] plasma-panel-colorizer: 6.5.0 -> 6.7.0 --- pkgs/by-name/pl/plasma-panel-colorizer/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/pl/plasma-panel-colorizer/package.nix b/pkgs/by-name/pl/plasma-panel-colorizer/package.nix index b703deb83965..12f629a82d42 100644 --- a/pkgs/by-name/pl/plasma-panel-colorizer/package.nix +++ b/pkgs/by-name/pl/plasma-panel-colorizer/package.nix @@ -9,13 +9,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "plasma-panel-colorizer"; - version = "6.5.0"; + version = "6.7.0"; src = fetchFromGitHub { owner = "luisbocanegra"; repo = "plasma-panel-colorizer"; tag = "v${finalAttrs.version}"; - hash = "sha256-okqp0jgrAIUAkVmlWd3O1lnvSOTIXp+RJ9GJAAe5mIs="; + hash = "sha256-YAWSVH5cpllNz50pYbq3ceGaLOYOkwMsE5s/MfzP18A="; }; nativeBuildInputs = [ From eb65b00f1e017203a345766f6af890966bbc7021 Mon Sep 17 00:00:00 2001 From: Steven Allen Date: Thu, 5 Feb 2026 11:45:57 -0800 Subject: [PATCH 27/67] nixos/captive-browser: remove the udhcpc setcap wrapper fallback Remove the udhcpc setcap wrapper fallback as it allows any user to execute arbitrary commands with the `cap_net_raw` capability. Fixes CVE-2026-25740 https://github.com/NixOS/nixpkgs/security/advisories/GHSA-wc3r-c66x-8xmc --- doc/release-notes/rl-2605.section.md | 2 ++ nixos/modules/programs/captive-browser.nix | 13 +------------ 2 files changed, 3 insertions(+), 12 deletions(-) diff --git a/doc/release-notes/rl-2605.section.md b/doc/release-notes/rl-2605.section.md index b0d55f8f5022..044ab6eefcdf 100644 --- a/doc/release-notes/rl-2605.section.md +++ b/doc/release-notes/rl-2605.section.md @@ -101,6 +101,8 @@ - `jetbrains.plugins.addPlugins` no longer supports plugin names or ID strings. You can still use `addPlugins` with plugin derivations, such as plugins packaged outside of Nixpkgs. +- The `programs.captive-browser` module no longer falls back on a setcap wrapper around udhcpc to discover your network's DNS server due to [GHSA-wc3r-c66x-8xmc](https://github.com/NixOS/nixpkgs/security/advisories/GHSA-wc3r-c66x-8xmc) (CVE-2026-25740). If you're using this module, you must either configure `programs.captive-browser.dhcp-dns` manually or enable one of NetworkManager, dhcpcd, or systemd-networkd. + - The `services.yggdrasil` module has been refactored with the following breaking changes: - The `services.yggdrasil.configFile` option has been removed. Configuration should now be specified directly via `services.yggdrasil.settings`. - The `services.yggdrasil.persistentKeys` option has been removed. To maintain persistent keys and IPv6 addresses across reboots, use `services.yggdrasil.settings.PrivateKeyPath` to securely load your private key from a file via systemd credentials. The private key must be in PEM format (PKCS #8). diff --git a/nixos/modules/programs/captive-browser.nix b/nixos/modules/programs/captive-browser.nix index 15c4d6237c01..368994e8829f 100644 --- a/nixos/modules/programs/captive-browser.nix +++ b/nixos/modules/programs/captive-browser.nix @@ -142,20 +142,9 @@ in else if config.networking.useNetworkd then "${cfg.package}/bin/systemd-networkd-dns ${iface [ ]}" else - "${config.security.wrapperDir}/udhcpc --quit --now -f ${iface [ "-i" ]} -O dns --script ${pkgs.writeShellScript "udhcp-script" '' - if [ "$1" = bound ]; then - echo "$dns" - fi - ''}" + throw "programs.captive-browser.dhcp-dns must be set" ); - security.wrappers.udhcpc = { - owner = "root"; - group = "root"; - capabilities = "cap_net_raw+p"; - source = "${pkgs.busybox}/bin/udhcpc"; - }; - security.wrappers.captive-browser = mkIf requiresSetcapWrapper { owner = "root"; group = "root"; From 0fedeccd893f9fe3d10ee1259157a61b9dad7f7f Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 7 Feb 2026 02:19:38 +0000 Subject: [PATCH 28/67] libretro.np2kai: 0-unstable-2026-01-31 -> 0-unstable-2026-02-01 --- pkgs/applications/emulators/libretro/cores/np2kai.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/applications/emulators/libretro/cores/np2kai.nix b/pkgs/applications/emulators/libretro/cores/np2kai.nix index a13fe9275eed..6fbd92989010 100644 --- a/pkgs/applications/emulators/libretro/cores/np2kai.nix +++ b/pkgs/applications/emulators/libretro/cores/np2kai.nix @@ -5,13 +5,13 @@ }: mkLibretroCore rec { core = "np2kai"; - version = "0-unstable-2026-01-31"; + version = "0-unstable-2026-02-01"; src = fetchFromGitHub { owner = "AZO234"; repo = "NP2kai"; - rev = "696c03b5d2cc6d67450b62276fb945d791fa6be1"; - hash = "sha256-usaQl1q9U+Qwe/ZxOyrDxTUr1ifbPljQrxRc7uoQWLA="; + rev = "15676585b9a370e874ea9309252bd8236df3f642"; + hash = "sha256-Zaay3JYCjv1eohNTC/9AYD0ZrvNaz9X4A4D6CkB/n+4="; fetchSubmodules = true; }; From 9c60e9cb17755925ff1b05e9a2f2ed572d93492a Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 7 Feb 2026 02:23:48 +0000 Subject: [PATCH 29/67] kanban: 0.1.16 -> 0.2.0 --- pkgs/by-name/ka/kanban/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ka/kanban/package.nix b/pkgs/by-name/ka/kanban/package.nix index b531fa012254..f63dfdfe46c5 100644 --- a/pkgs/by-name/ka/kanban/package.nix +++ b/pkgs/by-name/ka/kanban/package.nix @@ -7,18 +7,18 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "kanban"; - version = "0.1.16"; + version = "0.2.0"; src = fetchFromGitHub { owner = "fulsomenko"; repo = "kanban"; tag = "v${finalAttrs.version}"; - hash = "sha256-WksL0AhooBTV+W1knU+tns/qvHDd0z6mE2HkC57BAcU="; + hash = "sha256-w1NoWgaUBny//3t1S5z/juPOYFomwJKtTq/M4qKoNv0="; }; GIT_COMMIT_HASH = finalAttrs.src.rev; - cargoHash = "sha256-Q/o5MHjVRrJpfhkzNNJ6j4oASV5wDg/0Zi43zPlp5p8="; + cargoHash = "sha256-N+c2jnJ7a+Nh2UibkaOByh4tKDX52VovYIpeHTpawXo="; passthru.updateScript = nix-update-script { }; From b466beafbc3d92119f4ab6b189c64e8880732d5b Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 7 Feb 2026 03:24:31 +0000 Subject: [PATCH 30/67] python3Packages.posthog: 7.8.0 -> 7.8.3 --- pkgs/development/python-modules/posthog/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/posthog/default.nix b/pkgs/development/python-modules/posthog/default.nix index 70bfb566f7ff..bc5acea0f5c4 100644 --- a/pkgs/development/python-modules/posthog/default.nix +++ b/pkgs/development/python-modules/posthog/default.nix @@ -22,14 +22,14 @@ buildPythonPackage (finalAttrs: { pname = "posthog"; - version = "7.8.0"; + version = "7.8.3"; pyproject = true; src = fetchFromGitHub { owner = "PostHog"; repo = "posthog-python"; tag = "v${finalAttrs.version}"; - hash = "sha256-7ZM+vmI/9I1eaexVffl76BO5ctxKN51xoaOmP6lFYCU="; + hash = "sha256-JDt4lLocX+i1WAuY1SUqzmGX5Mt0CcktAsyuGSsTs6Y="; }; build-system = [ setuptools ]; From ce586d068e50ab26ca2aea31c27d28e15807d1cd Mon Sep 17 00:00:00 2001 From: kashw2 Date: Sat, 7 Feb 2026 14:48:03 +1000 Subject: [PATCH 31/67] seaweedfs: 4.08 -> 4.09 --- pkgs/by-name/se/seaweedfs/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/se/seaweedfs/package.nix b/pkgs/by-name/se/seaweedfs/package.nix index 8a4c2d073d3d..d6c9e7cf691e 100644 --- a/pkgs/by-name/se/seaweedfs/package.nix +++ b/pkgs/by-name/se/seaweedfs/package.nix @@ -11,16 +11,16 @@ buildGoModule (finalAttrs: { pname = "seaweedfs"; - version = "4.08"; + version = "4.09"; src = fetchFromGitHub { owner = "seaweedfs"; repo = "seaweedfs"; tag = finalAttrs.version; - hash = "sha256-i+CBU1aKx6ZTgtSSDZHefQ96sgqSNtqCglhj7hHH6fI="; + hash = "sha256-8J1eMQYATKCVwH3MCz/Hp76iRi5w+C8NsZ3eKivtYe0="; }; - vendorHash = "sha256-77KoE0gbybWpRLiaiqD+ZC0zH3BcYuZ1TkC7aPFkAv8="; + vendorHash = "sha256-a8rDXJfqZwUw4yH02xj2M0+kNLa/tnFJZxZwfWzTq4c="; nativeBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ libredirect.hook ]; From 5670313dd34e541df4d34f47d07022d1c55de032 Mon Sep 17 00:00:00 2001 From: Yiyu Zhou Date: Sat, 7 Feb 2026 00:16:00 -0600 Subject: [PATCH 32/67] bcachefs-tools: 1.36.0 -> 1.36.1 --- pkgs/by-name/bc/bcachefs-tools/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/bc/bcachefs-tools/package.nix b/pkgs/by-name/bc/bcachefs-tools/package.nix index 61b15b96fdeb..1ce6bd467a7a 100644 --- a/pkgs/by-name/bc/bcachefs-tools/package.nix +++ b/pkgs/by-name/bc/bcachefs-tools/package.nix @@ -28,18 +28,18 @@ stdenv.mkDerivation (finalAttrs: { pname = "bcachefs-tools"; - version = "1.36.0"; + version = "1.36.1"; src = fetchFromGitHub { owner = "koverstreet"; repo = "bcachefs-tools"; tag = "v${finalAttrs.version}"; - hash = "sha256-VSx8M8W3j47xC0tPdKtEHeMcFJMpBBMHjf7ZiDiE79I="; + hash = "sha256-15Z1lHNeXTToDpdVc/YB5ojhoiB5qdgWs47O1aKoyFM="; }; cargoDeps = rustPlatform.fetchCargoVendor { inherit (finalAttrs) src; - hash = "sha256-o0UofdKgEe/R683TmZJlsd1QD1Iy1oMBVBSN6u2uvDM="; + hash = "sha256-YWsJUSgKNkK9W4Yuolix21bRRFSF01+sivoj7SJo7DY="; }; postPatch = '' From a23eb2568bcca41001b4674b14a4c9a5bc1927f1 Mon Sep 17 00:00:00 2001 From: Saad Nadeem Date: Sat, 7 Feb 2026 01:31:49 -0500 Subject: [PATCH 33/67] elephant: init at 2.19.2 Co-authored-by: Adam C. Stephens --- pkgs/by-name/el/elephant/package.nix | 131 +++++++++++++++++++++++++++ 1 file changed, 131 insertions(+) create mode 100644 pkgs/by-name/el/elephant/package.nix diff --git a/pkgs/by-name/el/elephant/package.nix b/pkgs/by-name/el/elephant/package.nix new file mode 100644 index 000000000000..2d589e3d171b --- /dev/null +++ b/pkgs/by-name/el/elephant/package.nix @@ -0,0 +1,131 @@ +{ + enableArchLinuxPkgs ? false, + enableDnfPackages ? false, + enable1password ? false, + enableBitwarden ? true, + enableBluetooth ? true, + enableBookmarks ? true, + enableCalc ? true, + enableClipboard ? true, + enableDesktopApplications ? true, + enableFiles ? true, + enableMenus ? true, + enableNiriActions ? true, + enableNiriSessions ? true, + enableProviderList ? true, + enableRunner ? true, + enableSnippets ? true, + enableSymbols ? true, + enableTodo ? true, + enableUnicode ? true, + enableWebsearch ? true, + enableWindows ? true, + + bluez, + buildGoModule, + fd, + fetchFromGitHub, + imagemagick, + lib, + libqalculate, + makeWrapper, + nix-update-script, + protobuf, + protoc-gen-go, + wl-clipboard, +}: +let + providerMap = { + "1password" = enable1password; + "archlinuxpkgs" = enableArchLinuxPkgs; + "bitwarden" = enableBitwarden; + "bluetooth" = enableBluetooth; + "bookmarks" = enableBookmarks; + "calc" = enableCalc; + "clipboard" = enableClipboard; + "desktopapplications" = enableDesktopApplications; + "dnfpackages" = enableDnfPackages; + "files" = enableFiles; + "menus" = enableMenus; + "niriactions" = enableNiriActions; + "nirisessions" = enableNiriSessions; + "providerlist" = enableProviderList; + "runner" = enableRunner; + "snippets" = enableSnippets; + "symbols" = enableSymbols; + "todo" = enableTodo; + "unicode" = enableUnicode; + "websearch" = enableWebsearch; + "windows" = enableWindows; + }; + + enabledProviders = lib.filterAttrs (_: enabled: enabled) providerMap; + enabledProvidersList = lib.concatStringsSep " " (lib.attrNames enabledProviders); + + runtimeDeps = + lib.optionals enableFiles [ fd ] + ++ lib.optionals enableBluetooth [ bluez ] + ++ lib.optionals enableCalc [ libqalculate ] + ++ lib.optionals enableClipboard [ + wl-clipboard + imagemagick + ]; + +in +buildGoModule (finalAttrs: { + pname = "elephant"; + version = "2.19.2"; + + src = fetchFromGitHub { + owner = "abenz1267"; + repo = "elephant"; + rev = "v${finalAttrs.version}"; + hash = "sha256-hs1Re7ltWYFBsiwDsK3Qb3/KgZ4E2HY7cFB/M8JWSu4="; + }; + + vendorHash = "sha256-tO+5x2FIY1UBvWl9x3ZSpHwTWUlw1VNDTi9+2uY7xdU="; + + buildInputs = [ protobuf ]; + nativeBuildInputs = [ + makeWrapper + protoc-gen-go + ]; + + subPackages = [ "cmd/elephant" ]; + + postBuild = '' + echo "Building providers: ${enabledProvidersList}" + + mkdir -p $out/lib/elephant/providers + for provider in ${enabledProvidersList}; do + [ -z "$provider" ] && continue + if [ -d "internal/providers/$provider" ]; then + echo "Building provider: $provider" + go build -buildmode=plugin -o "$out/lib/elephant/providers/$provider.so" ./internal/providers/"$provider" || exit 1 + fi + done + ''; + + postInstall = '' + wrapProgram $out/bin/elephant \ + --prefix PATH : ${lib.makeBinPath runtimeDeps} \ + --set ELEPHANT_PROVIDER_DIR "$out/lib/elephant/providers" + ''; + + passthru = { + updateScript = nix-update-script { }; + }; + + meta = { + description = "Data provider service and backend for building custom application launchers"; + changelog = "https://github.com/abenz1267/elephant/releases/tag/v${finalAttrs.version}"; + homepage = "https://github.com/abenz1267/elephant"; + license = lib.licenses.gpl3Only; + platforms = lib.platforms.linux; + maintainers = with lib.maintainers; [ + adamcstephens + saadndm + ]; + mainProgram = "elephant"; + }; +}) From 0e23c1af2212feee2380f8b84e72efdbea899a62 Mon Sep 17 00:00:00 2001 From: Saad Nadeem Date: Sat, 7 Feb 2026 01:32:29 -0500 Subject: [PATCH 34/67] nixos/elephant: init service --- .../manual/release-notes/rl-2605.section.md | 2 + nixos/modules/module-list.nix | 1 + nixos/modules/services/misc/elephant.nix | 37 +++++++++++++++++++ 3 files changed, 40 insertions(+) create mode 100644 nixos/modules/services/misc/elephant.nix diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md index 6cf6e5f1c1d1..b7f3406bc32e 100644 --- a/nixos/doc/manual/release-notes/rl-2605.section.md +++ b/nixos/doc/manual/release-notes/rl-2605.section.md @@ -36,6 +36,8 @@ - [dsearch](https://github.com/AvengeMedia/danksearch), a fast filesystem search service with fuzzy matching. Available as [programs.dsearch](#opt-programs.dsearch.enable). +- [Elephant](https://github.com/abenz1267/elephant), a data provider service and backend for building custom application launchers. Available as [services.elephant](#opt-services.elephant.enable). + - [Dunst](https://github.com/dunst-project/dunst), a lightweight and customizable notification daemon. Available as [services.dunst](#opt-services.dunst.enable). - [Ente Auth](https://ente.io/auth/), an open source 2FA authenticator, with end-to-end encrypted backups. Available as [programs.ente-auth](#opt-programs.ente-auth.enable). diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index cdd258e5b176..d6725e526a32 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -843,6 +843,7 @@ ./services/misc/dump1090-fa.nix ./services/misc/dwm-status.nix ./services/misc/dysnomia.nix + ./services/misc/elephant.nix ./services/misc/errbot.nix ./services/misc/ersatztv.nix ./services/misc/etebase-server.nix diff --git a/nixos/modules/services/misc/elephant.nix b/nixos/modules/services/misc/elephant.nix new file mode 100644 index 000000000000..bcd6a3831478 --- /dev/null +++ b/nixos/modules/services/misc/elephant.nix @@ -0,0 +1,37 @@ +{ + config, + lib, + pkgs, + ... +}: + +let + cfg = config.services.elephant; +in +{ + options.services.elephant = { + enable = lib.mkEnableOption "Elephant application launcher backend"; + + package = lib.mkPackageOption pkgs "elephant" { }; + }; + + config = lib.mkIf cfg.enable { + systemd.user.services.elephant = { + description = "Elephant application launcher backend"; + wantedBy = [ "graphical-session.target" ]; + partOf = [ "graphical-session.target" ]; + after = [ "graphical-session.target" ]; + serviceConfig = { + Restart = "always"; + RestartSec = 10; + ExecStart = "${cfg.package}/bin/elephant"; + }; + }; + + environment.systemPackages = [ cfg.package ]; + }; + + meta.maintainers = with lib.maintainers; [ + saadndm + ]; +} From 33511cde3ec63495068032d3eedb0d274986ae30 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 7 Feb 2026 07:05:47 +0000 Subject: [PATCH 35/67] sing-box: 1.12.17 -> 1.12.20 --- pkgs/by-name/si/sing-box/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/si/sing-box/package.nix b/pkgs/by-name/si/sing-box/package.nix index 9c92099562af..adae60a5104b 100644 --- a/pkgs/by-name/si/sing-box/package.nix +++ b/pkgs/by-name/si/sing-box/package.nix @@ -10,16 +10,16 @@ buildGoModule (finalAttrs: { pname = "sing-box"; - version = "1.12.17"; + version = "1.12.20"; src = fetchFromGitHub { owner = "SagerNet"; repo = "sing-box"; tag = "v${finalAttrs.version}"; - hash = "sha256-3dxkoSfXSMID8GVhjyPC2n8UNqOx8IkSkGuFmWZ3TbI="; + hash = "sha256-HYm4DMrCCQi+OInZPfezL0imy9jOLPa45sSpSWn2xgs="; }; - vendorHash = "sha256-p5E3tJiqhgTeE35vVt03Yo9oF3DZPO9hXuKKR6r0V+g="; + vendorHash = "sha256-Fw03Lf8F7fFpoHwG+/3dkFUIrY9eyd7rgvgXflaMLKw="; tags = [ "with_quic" From caf00baec17f2e4af92c87e4a1addf3effc98e42 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 7 Feb 2026 08:50:40 +0000 Subject: [PATCH 36/67] cosmic-ext-applet-sysinfo: 0-unstable-2025-09-22 -> 0-unstable-2026-01-29 --- pkgs/by-name/co/cosmic-ext-applet-sysinfo/package.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/by-name/co/cosmic-ext-applet-sysinfo/package.nix b/pkgs/by-name/co/cosmic-ext-applet-sysinfo/package.nix index c417093bb664..ceb1c594508f 100644 --- a/pkgs/by-name/co/cosmic-ext-applet-sysinfo/package.nix +++ b/pkgs/by-name/co/cosmic-ext-applet-sysinfo/package.nix @@ -9,16 +9,16 @@ }: rustPlatform.buildRustPackage { pname = "cosmic-ext-applet-sysinfo"; - version = "0-unstable-2025-09-22"; + version = "0-unstable-2026-01-29"; src = fetchFromGitHub { owner = "cosmic-utils"; repo = "cosmic-ext-applet-sysinfo"; - rev = "ed75123192c7f45f435797bfecae9eb615298728"; - hash = "sha256-eAhOVp1suZpGCKpvKWA0xqvVf+FOsj7dqtlnYO/FHUI="; + rev = "f92912ee466fbb1b9b7e59f0cc49fb14dfddbc58"; + hash = "sha256-3p1xPOciNFlROR02hnaVwCaHPQI3mhXamy0WBD9ndWk="; }; - cargoHash = "sha256-ehytOcMIocyHBnrPg1A73FUo3s1aOuYpI5FvrqjGpi4="; + cargoHash = "sha256-sLoT/p7Au5s16J08RlxK+o4ayUzKO30GfcUwr8kGFl8="; nativeBuildInputs = [ libcosmicAppHook From 4940073aabb77b90a577d895b9f360f0f9d85129 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 7 Feb 2026 08:53:35 +0000 Subject: [PATCH 37/67] cosmic-ext-applet-weather: 0-unstable-2026-01-17 -> 0-unstable-2026-02-03 --- pkgs/by-name/co/cosmic-ext-applet-weather/package.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/by-name/co/cosmic-ext-applet-weather/package.nix b/pkgs/by-name/co/cosmic-ext-applet-weather/package.nix index 5ad79d16caf4..767a0834eae9 100644 --- a/pkgs/by-name/co/cosmic-ext-applet-weather/package.nix +++ b/pkgs/by-name/co/cosmic-ext-applet-weather/package.nix @@ -9,16 +9,16 @@ }: rustPlatform.buildRustPackage { pname = "cosmic-ext-applet-weather"; - version = "0-unstable-2026-01-17"; + version = "0-unstable-2026-02-03"; src = fetchFromGitHub { owner = "cosmic-utils"; repo = "cosmic-ext-applet-weather"; - rev = "142666f73c702036438408758ea86ec22d63611b"; - hash = "sha256-K4flguR6pknhFCpwHQ+4OtSAtPBjUag1g/uUnCNM3Pw="; + rev = "ea8a506a6ca56b6ac6c4952012880bf1d6227631"; + hash = "sha256-DnYOOeCcf/fuNuPJ8MeolfAyGJdNWONawaF1HV8mr4k="; }; - cargoHash = "sha256-LcTUIhAWitLFz23TasfSJt6tOAAAJDiHxfTcxBX2/Bg="; + cargoHash = "sha256-tj0skQNt0p6UMUnU6HXw6ZAjEkCuuF4vg1aoWytqCos="; nativeBuildInputs = [ libcosmicAppHook From 78bee42eee2cc22c1941528c6614f0641b8d8690 Mon Sep 17 00:00:00 2001 From: Gaetan Lepage Date: Fri, 6 Feb 2026 20:16:58 +0000 Subject: [PATCH 38/67] waybar: 0.14.0 -> 0.15.0 Diff: https://github.com/Alexays/Waybar/compare/0.14.0...0.15.0 Changelog: https://github.com/alexays/waybar/releases/tag/0.15.0 --- pkgs/by-name/wa/waybar/package.nix | 29 +++++++++++++++++++---------- 1 file changed, 19 insertions(+), 10 deletions(-) diff --git a/pkgs/by-name/wa/waybar/package.nix b/pkgs/by-name/wa/waybar/package.nix index 1d166b8de1f0..26088e2653c8 100644 --- a/pkgs/by-name/wa/waybar/package.nix +++ b/pkgs/by-name/wa/waybar/package.nix @@ -69,27 +69,36 @@ nix-update-script, }: +let + libcava = + let + version = "0.10.7-beta"; + in + { + inherit version; + + src = fetchFromGitHub { + owner = "LukashonakV"; + repo = "cava"; + tag = "v${version}"; + hash = "sha256-IX1B375gTwVDRjpRfwKGuzTAZOV2pgDWzUd4bW2cTDU="; + }; + }; +in stdenv.mkDerivation (finalAttrs: { pname = "waybar"; - version = "0.14.0"; + version = "0.15.0"; src = fetchFromGitHub { owner = "Alexays"; repo = "Waybar"; tag = finalAttrs.version; - hash = "sha256-mGiBZjfvtZZkSHrha4UF2l1Ogbij8J//r2h4gcZAJ6w="; - }; - - libcavaSrc = fetchFromGitHub { - owner = "LukashonakV"; - repo = "cava"; - tag = "0.10.4"; - hash = "sha256-9eTDqM+O1tA/3bEfd1apm8LbEcR9CVgELTIspSVPMKM="; + hash = "sha256-49ZKgK96a9uFip+svOdnw397xcEjiftXzd9gyv1H3sU="; }; postUnpack = lib.optional cavaSupport '' pushd "$sourceRoot" - cp -R --no-preserve=mode,ownership ${finalAttrs.libcavaSrc} subprojects/cava-0.10.4 + cp -R --no-preserve=mode,ownership ${libcava.src} subprojects/cava-${libcava.version} patchShebangs . popd ''; From eba10a6bd85bc92736f82f2e94ebddc4b1e13ecd Mon Sep 17 00:00:00 2001 From: Gaetan Lepage Date: Sat, 7 Feb 2026 10:32:07 +0000 Subject: [PATCH 39/67] md-tui: 0.9.3 -> 0.9.4 Diff: https://github.com/henriklovhaug/md-tui/compare/v0.9.3...v0.9.4 Changelog: https://github.com/henriklovhaug/md-tui/blob/v0.9.4/CHANGELOG.md --- pkgs/by-name/md/md-tui/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/md/md-tui/package.nix b/pkgs/by-name/md/md-tui/package.nix index bc4a683c9c65..40150a5efb02 100644 --- a/pkgs/by-name/md/md-tui/package.nix +++ b/pkgs/by-name/md/md-tui/package.nix @@ -8,16 +8,16 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "md-tui"; - version = "0.9.3"; + version = "0.9.4"; src = fetchFromGitHub { owner = "henriklovhaug"; repo = "md-tui"; tag = "v${finalAttrs.version}"; - hash = "sha256-LBt15MCv+QbjutwRfYI9zX5UAiYF2Y70EQ3DATRLaY8="; + hash = "sha256-9TQmCYo0ktZydRgRkNkqhFFvS+BMx+IIfvXQeKLucVk="; }; - cargoHash = "sha256-2Qr+6y/DOQJYP5EMMI/OdqIMrHBX4tNH29fK+QCsrnQ="; + cargoHash = "sha256-PTJgsRaEJHu6JmPKX71sBeaSaCsS/Ws82NBsD3fjFzc="; nativeBuildInputs = [ pkg-config ]; From d254c4a2922f5f0005d678e59a0b209ffe603601 Mon Sep 17 00:00:00 2001 From: Matthias Beyer Date: Fri, 30 Jan 2026 16:56:35 +0100 Subject: [PATCH 40/67] diffnav: 0.6.0 -> 0.7.0 Signed-off-by: Matthias Beyer --- pkgs/by-name/di/diffnav/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/di/diffnav/package.nix b/pkgs/by-name/di/diffnav/package.nix index 83e366326926..13db5f01d1a3 100644 --- a/pkgs/by-name/di/diffnav/package.nix +++ b/pkgs/by-name/di/diffnav/package.nix @@ -8,16 +8,16 @@ buildGoModule (finalAttrs: { pname = "diffnav"; - version = "0.6.0"; + version = "0.7.0"; src = fetchFromGitHub { owner = "dlvhdr"; repo = "diffnav"; tag = "v${finalAttrs.version}"; - hash = "sha256-pak1R2BmL3A8YADwFw7QZk7JsGQzBBS/xHzRhYlMKGo="; + hash = "sha256-D+jUw6Y8378SmdgCgsIMSLTsGr/oN3As1JWRWMH77PI="; }; - vendorHash = "sha256-cDA5qstTRApt4DXcakNLR5nsyh9i7z2Qrvp6q/OoYhY="; + vendorHash = "sha256-FA58Rd+tEiyArDCeKsekpxkM+i8z/KlO3GLzkonSKVM="; ldflags = [ "-s" From 0ff4c4fa881f454289760e7ceaadcc500d9759d9 Mon Sep 17 00:00:00 2001 From: Matthias Beyer Date: Sun, 1 Feb 2026 13:13:27 +0100 Subject: [PATCH 41/67] diffnav: 0.7.0 -> 0.8.1 Signed-off-by: Matthias Beyer --- pkgs/by-name/di/diffnav/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/di/diffnav/package.nix b/pkgs/by-name/di/diffnav/package.nix index 13db5f01d1a3..91f41731b90f 100644 --- a/pkgs/by-name/di/diffnav/package.nix +++ b/pkgs/by-name/di/diffnav/package.nix @@ -8,13 +8,13 @@ buildGoModule (finalAttrs: { pname = "diffnav"; - version = "0.7.0"; + version = "0.8.1"; src = fetchFromGitHub { owner = "dlvhdr"; repo = "diffnav"; tag = "v${finalAttrs.version}"; - hash = "sha256-D+jUw6Y8378SmdgCgsIMSLTsGr/oN3As1JWRWMH77PI="; + hash = "sha256-bWkAx2+3M0tYUJfAXgZtpNED6qf0h50VaMCZrVa3mGw="; }; vendorHash = "sha256-FA58Rd+tEiyArDCeKsekpxkM+i8z/KlO3GLzkonSKVM="; From 7a687ff4e28e1fc757bc8239e001d6a11258658d Mon Sep 17 00:00:00 2001 From: Matthias Beyer Date: Sat, 7 Feb 2026 08:49:35 +0100 Subject: [PATCH 42/67] diffnav: 0.8.1 -> 0.8.2 Signed-off-by: Matthias Beyer --- pkgs/by-name/di/diffnav/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/di/diffnav/package.nix b/pkgs/by-name/di/diffnav/package.nix index 91f41731b90f..0c7c86647715 100644 --- a/pkgs/by-name/di/diffnav/package.nix +++ b/pkgs/by-name/di/diffnav/package.nix @@ -8,13 +8,13 @@ buildGoModule (finalAttrs: { pname = "diffnav"; - version = "0.8.1"; + version = "0.8.2"; src = fetchFromGitHub { owner = "dlvhdr"; repo = "diffnav"; tag = "v${finalAttrs.version}"; - hash = "sha256-bWkAx2+3M0tYUJfAXgZtpNED6qf0h50VaMCZrVa3mGw="; + hash = "sha256-2CAvZyBcWlaTHcDqKlGYjFiZJm9UcwGS3YQpeaphKTE="; }; vendorHash = "sha256-FA58Rd+tEiyArDCeKsekpxkM+i8z/KlO3GLzkonSKVM="; From 08040e2705badf689c7b7e3b4aac6f7eba6c590e Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 7 Feb 2026 11:40:51 +0000 Subject: [PATCH 43/67] python3Packages.django-axes: 8.1.0 -> 8.2.0 --- pkgs/development/python-modules/django-axes/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/django-axes/default.nix b/pkgs/development/python-modules/django-axes/default.nix index 05e498df22e6..c3684c35b08b 100644 --- a/pkgs/development/python-modules/django-axes/default.nix +++ b/pkgs/development/python-modules/django-axes/default.nix @@ -12,14 +12,14 @@ buildPythonPackage rec { pname = "django-axes"; - version = "8.1.0"; + version = "8.2.0"; pyproject = true; src = fetchFromGitHub { owner = "jazzband"; repo = "django-axes"; tag = version; - hash = "sha256-yiXj0Wmn9AVKDilmGVTIE+MICmKeO76j2P6jtlt5CFY="; + hash = "sha256-obh137DbFkkSodR67hWRzQg8wHXsFdT3NDnxDg/jmR0="; }; build-system = [ setuptools-scm ]; From 4ef2d1ec74307e893c3380ff3751e34e1b629e1f Mon Sep 17 00:00:00 2001 From: "nixpkgs-ci[bot]" <190413589+nixpkgs-ci[bot]@users.noreply.github.com> Date: Sat, 7 Feb 2026 12:30:39 +0000 Subject: [PATCH 44/67] maintainers/github-teams.json: Automated sync --- maintainers/github-teams.json | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/maintainers/github-teams.json b/maintainers/github-teams.json index b074ca4207c0..4b8c7efb8566 100644 --- a/maintainers/github-teams.json +++ b/maintainers/github-teams.json @@ -209,9 +209,11 @@ "domenkozar": 126339, "donn": 12652988, "dwt": 57199, + "eclairevoyant": 848000, "emilazy": 18535642, "ethancedwards8": 60861925, "fiddlerwoaroof": 808745, + "fulsomenko": 14945057, "gador": 1883533, "griff": 4368, "groodt": 343415, @@ -240,7 +242,6 @@ "mstone": 412508, "n8henrie": 1234956, "ofalvai": 1694986, - "pasqui23": 6931743, "prusnak": 42201, "reckenrode": 7413633, "ryand56": 22267679, @@ -422,8 +423,7 @@ "maintainers": { "Mic92": 96200, "kalbasit": 87115, - "katexochen": 49727155, - "zowoq": 59103226 + "katexochen": 49727155 }, "members": { "mfrw": 4929861, @@ -524,7 +524,7 @@ "members": { "K900": 386765, "Ma27": 6025220, - "TredwellGit": 61860346 + "zowoq": 59103226 }, "name": "Linux kernel" }, @@ -550,8 +550,7 @@ "members": { "9999years": 15312184, "Qyriad": 1542224, - "RaitoBezarius": 314564, - "alois31": 36605164 + "RaitoBezarius": 314564 }, "name": "Lix maintainers" }, @@ -691,7 +690,6 @@ "0x4A6F": 9675338, "MattSturgeon": 5046562, "Sereja313": 112060595, - "dasJ": 4971975, "dyegoaurelio": 42411160 }, "name": "nix-formatting" @@ -707,6 +705,7 @@ "Mic92": 96200, "Radvendii": 1239929, "edolstra": 1148549, + "lovesegfault": 7243783, "xokdvium": 145775305 }, "name": "Nix team" @@ -740,8 +739,7 @@ "id": 14317027, "maintainers": { "alyssais": 2768870, - "emilazy": 18535642, - "wolfgangwalther": 9132420 + "emilazy": 18535642 }, "members": {}, "name": "Nixpkgs core" From 70430db71fd49fbc70c7cd0bcf56aa8b1a690f35 Mon Sep 17 00:00:00 2001 From: Piotr Kwiecinski <2151333+piotrkwiecinski@users.noreply.github.com> Date: Sat, 7 Feb 2026 13:50:56 +0100 Subject: [PATCH 45/67] frankenphp: migrate to finalAttrs --- pkgs/by-name/fr/frankenphp/package.nix | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/pkgs/by-name/fr/frankenphp/package.nix b/pkgs/by-name/fr/frankenphp/package.nix index 6d2578e3cf39..e6e2cecfe19e 100644 --- a/pkgs/by-name/fr/frankenphp/package.nix +++ b/pkgs/by-name/fr/frankenphp/package.nix @@ -6,7 +6,6 @@ php, brotli, watcher, - frankenphp, cctools, darwin, libiconv, @@ -29,18 +28,18 @@ let phpConfig = "${phpUnwrapped.dev}/bin/php-config"; pieBuild = stdenv.hostPlatform.isMusl; in -buildGoModule rec { +buildGoModule (finalAttrs: { pname = "frankenphp"; version = "1.11.1"; src = fetchFromGitHub { owner = "php"; repo = "frankenphp"; - tag = "v${version}"; + tag = "v${finalAttrs.version}"; hash = "sha256-JzZXg/tkSZqLZn56RyLb8Q8SaeG/tHA8Sqxu99s5ks0="; }; - sourceRoot = "${src.name}/caddy"; + sourceRoot = "${finalAttrs.src.name}/caddy"; # frankenphp requires C code that would be removed with `go mod tidy` # https://github.com/golang/go/issues/26366 @@ -78,14 +77,14 @@ buildGoModule rec { ldflags = [ "-s" "-w" - "-X 'github.com/caddyserver/caddy/v2.CustomVersion=FrankenPHP ${version} PHP ${phpUnwrapped.version} Caddy'" + "-X 'github.com/caddyserver/caddy/v2.CustomVersion=FrankenPHP ${finalAttrs.version} PHP ${phpUnwrapped.version} Caddy'" # pie mode is only available with pkgsMusl, it also automatically add -buildmode=pie to $GOFLAGS ] ++ (lib.optional pieBuild [ "-static-pie" ]); preBuild = '' export CGO_CFLAGS="$(${phpConfig} --includes)" - export CGO_LDFLAGS="-DFRANKENPHP_VERSION=${version} \ + export CGO_LDFLAGS="-DFRANKENPHP_VERSION=${finalAttrs.version} \ $(${phpConfig} --ldflags) \ $(${phpConfig} --libs)" ''; @@ -115,13 +114,13 @@ buildGoModule rec { ''; } '' - ${lib.getExe frankenphp} php-cli $phpScript > $out + ${lib.getExe finalAttrs.finalPackage} php-cli $phpScript > $out ''; }; }; meta = { - changelog = "https://github.com/php/frankenphp/releases/tag/v${version}"; + changelog = "https://github.com/php/frankenphp/releases/tag/v${finalAttrs.version}"; description = "Modern PHP app server"; homepage = "https://github.com/php/frankenphp"; license = lib.licenses.mit; @@ -129,4 +128,4 @@ buildGoModule rec { maintainers = [ lib.maintainers.piotrkwiecinski ]; platforms = lib.platforms.linux ++ lib.platforms.darwin; }; -} +}) From b0b2c24be93e10a6e3bcf3746e59d507aafdfd0b Mon Sep 17 00:00:00 2001 From: Silvan Mosberger Date: Fri, 31 Oct 2025 23:40:20 +0100 Subject: [PATCH 46/67] ci: First-class team package maintainer review requests Co-Authored-By: Alexander Bantyev --- ci/eval/compare/default.nix | 14 ++- ci/eval/compare/maintainers.nix | 53 +++++--- ci/github-script/bot.js | 88 +++++++++++-- ci/github-script/merge.js | 2 +- ci/github-script/reviewers.js | 190 +++++++++++++++++------------ pkgs/stdenv/generic/check-meta.nix | 5 + 6 files changed, 243 insertions(+), 109 deletions(-) diff --git a/ci/eval/compare/default.nix b/ci/eval/compare/default.nix index 9791d26e9550..f1473367a7d9 100644 --- a/ci/eval/compare/default.nix +++ b/ci/eval/compare/default.nix @@ -161,12 +161,13 @@ let ); inherit - (callPackage ./maintainers.nix { } { + (callPackage ./maintainers.nix { changedattrs = lib.attrNames (lib.groupBy (a: a.name) changedPackagePlatformAttrs); changedpathsjson = touchedFilesJson; removedattrs = lib.attrNames (lib.groupBy (a: a.name) removedPackagePlatformAttrs); }) - maintainers + users + teams packages ; in @@ -178,10 +179,12 @@ runCommand "compare" cmp-stats codeowners ]; - maintainers = builtins.toJSON maintainers; + users = builtins.toJSON users; + teams = builtins.toJSON teams; packages = builtins.toJSON packages; passAsFile = [ - "maintainers" + "users" + "teams" "packages" ]; } @@ -262,6 +265,7 @@ runCommand "compare" done - cp "$maintainersPath" "$out/maintainers.json" + cp "$usersPath" "$out/maintainers.json" + cp "$teamsPath" "$out/teams.json" cp "$packagesPath" "$out/packages.json" '' diff --git a/ci/eval/compare/maintainers.nix b/ci/eval/compare/maintainers.nix index 6eb983c9c5f6..a0180e10f193 100644 --- a/ci/eval/compare/maintainers.nix +++ b/ci/eval/compare/maintainers.nix @@ -1,7 +1,5 @@ { lib, -}: -{ changedattrs, changedpathsjson, removedattrs, @@ -51,15 +49,16 @@ let # updates to .json files. # TODO: Support by-name package sets. filenames = lib.optional (lib.length path == 1) "pkgs/by-name/${sharded (lib.head path)}/"; - # TODO: Refactor this so we can ping entire teams instead of the individual members. - # Note that this will require keeping track of GH team IDs in "maintainers/teams.nix". - maintainers = package.meta.maintainers or [ ]; + # meta.maintainers also contains all individual team members. + # We only want to ping individuals if they're added individually as maintainers, not via teams. + users = package.meta.nonTeamMaintainers or [ ]; + teams = package.meta.teams or [ ]; } )) # No need to match up packages without maintainers with their files. # This also filters out attributes where `packge = null`, which is the # case for libintl, for example. - (lib.filter (pkg: pkg.maintainers != [ ])) + (lib.filter (pkg: pkg.users != [ ] || pkg.teams != [ ])) ]; relevantFilenames = @@ -94,20 +93,44 @@ let attrsWithModifiedFiles = lib.filter (pkg: anyMatchingFiles pkg.filenames) attrsWithFilenames; - listToPing = lib.concatMap ( + userPings = pkg: map (maintainer: { - id = maintainer.githubId; - inherit (maintainer) github; + type = "user"; + userId = maintainer.githubId; packageName = pkg.name; - dueToFiles = pkg.filenames; - }) pkg.maintainers + }); + + teamPings = + pkg: team: + if team ? github then + [ + { + type = "team"; + teamId = team.githubId; + packageName = pkg.name; + } + ] + else + userPings pkg team.members; + + maintainersToPing = lib.concatMap ( + pkg: userPings pkg pkg.users ++ lib.concatMap (teamPings pkg) pkg.teams ) attrsWithModifiedFiles; - byMaintainer = lib.groupBy (ping: toString ping.id) listToPing; + byType = lib.groupBy (ping: ping.type) maintainersToPing; + + byUser = lib.pipe (byType.user or [ ]) [ + (lib.groupBy (ping: toString ping.userId)) + (lib.mapAttrs (_user: lib.map (pkg: pkg.packageName))) + ]; + byTeam = lib.pipe (byType.team or [ ]) [ + (lib.groupBy (ping: toString ping.teamId)) + (lib.mapAttrs (_team: lib.map (pkg: pkg.packageName))) + ]; in { - maintainers = lib.mapAttrs (_: lib.catAttrs "packageName") byMaintainer; - - packages = lib.catAttrs "packageName" listToPing; + users = byUser; + teams = byTeam; + packages = lib.catAttrs "name" attrsWithModifiedFiles; } diff --git a/ci/github-script/bot.js b/ci/github-script/bot.js index efb0b1e0a11c..76055a3c2d4c 100644 --- a/ci/github-script/bot.js +++ b/ci/github-script/bot.js @@ -160,6 +160,29 @@ module.exports = async ({ github, context, core, dry }) => { return users[id] } + // Same for teams + const teams = {} + function getTeam(id) { + if (!teams[id]) { + teams[id] = github + .request({ + method: 'GET', + url: '/organizations/{orgId}/team/{id}', + // TODO: Make this work without pull_requests payloads + orgId: context.payload.pull_request.base.user.id, + id, + }) + .then((resp) => resp.data) + .catch((e) => { + // Team may have been deleted + if (e.status === 404) return null + throw e + }) + } + + return teams[id] + } + async function handlePullRequest({ item, stats, events }) { const log = (k, v) => core.info(`PR #${item.number} - ${k}: ${v}`) @@ -192,17 +215,49 @@ module.exports = async ({ github, context, core, dry }) => { }) // Check for any human reviews other than the PR author, GitHub actions and other GitHub apps. - // Accounts could be deleted as well, so don't count them. const reviews = ( - await github.paginate(github.rest.pulls.listReviews, { - ...context.repo, - pull_number, - }) - ).filter( + await github.graphql( + `query($owner: String!, $repo: String!, $pr: Int!) { + repository(owner: $owner, name: $repo) { + pullRequest(number: $pr) { + # Unlikely that there's ever more than 100 reviews, so let's not bother, + # but once https://github.com/actions/github-script/issues/309 is resolved, + # it would be easy to enable pagination. + reviews(first: 100) { + nodes { + state + user: author { + # Only get users, no bots + ... on User { + login + # Set the id field in the resulting JSON to GraphQL's databaseId + # databaseId in GraphQL-land is the same as id in REST-land + id: databaseId + } + } + onBehalfOf(first: 100) { + nodes { + slug + } + } + } + } + } + } + }`, + { + owner: context.repo.owner, + repo: context.repo.repo, + pr: pull_number, + }, + ) + ).repository.pullRequest.reviews.nodes.filter( (r) => - r.user && - !r.user.login.endsWith('[bot]') && - r.user.type !== 'Bot' && + // The `... on User` makes it such that .login only exists for users, + // but we still need to filter the others out. + // Accounts could be deleted as well, so don't count them. + r.user?.login && + // Also exclude author reviews, can't request their review in any case r.user.id !== pull_request.user?.id, ) @@ -402,6 +457,16 @@ module.exports = async ({ github, context, core, dry }) => { if (e.code !== 'ENOENT') throw e } + let team_maintainers = [] + try { + team_maintainers = Object.keys( + JSON.parse(await readFile(`${pull_number}/teams.json`, 'utf-8')), + ).map((id) => parseInt(id)) + } catch (e) { + // Older artifacts don't have the teams.json, yet. + if (e.code !== 'ENOENT') throw e + } + // We set this label earlier already, but the current PR state can be very different // after handleReviewers has requested reviews, so update it in this case to prevent // this label from flip-flopping. @@ -414,14 +479,15 @@ module.exports = async ({ github, context, core, dry }) => { pull_request, reviews, // TODO: Use maintainer map instead of the artifact. - maintainers: Object.keys( + user_maintainers: Object.keys( JSON.parse( await readFile(`${pull_number}/maintainers.json`, 'utf-8'), ), ).map((id) => parseInt(id)), + team_maintainers, owners, - getTeamMembers, getUser, + getTeam, }) } } diff --git a/ci/github-script/merge.js b/ci/github-script/merge.js index 14d6fd3762ab..d4b5e4a0b826 100644 --- a/ci/github-script/merge.js +++ b/ci/github-script/merge.js @@ -171,7 +171,7 @@ async function handleMerge({ async function merge() { if (dry) { core.info(`Merging #${pull_number}... (dry)`) - return 'Merge completed (dry)' + return ['Merge completed (dry)'] } // Using GraphQL mutations instead of the REST /merge endpoint, because the latter diff --git a/ci/github-script/reviewers.js b/ci/github-script/reviewers.js index d10b9f6a98e2..fbbcc996eba9 100644 --- a/ci/github-script/reviewers.js +++ b/ci/github-script/reviewers.js @@ -6,28 +6,29 @@ async function handleReviewers({ dry, pull_request, reviews, - maintainers, + user_maintainers, + team_maintainers, owners, - getTeamMembers, getUser, + getTeam, }) { const pull_number = pull_request.number - const requested_reviewers = new Set( - pull_request.requested_reviewers.map(({ login }) => login.toLowerCase()), - ) - log( - 'reviewers - requested_reviewers', - Array.from(requested_reviewers).join(', '), - ) + // Users that the PR has already reached, e.g. they've left a review or have been requested for one + const users_reached = new Set([ + ...pull_request.requested_reviewers.map(({ login }) => login.toLowerCase()), + ...reviews.map(({ user }) => user.login.toLowerCase()), + ]) + log('reviewers - users_reached', Array.from(users_reached).join(', ')) - const existing_reviewers = new Set( - reviews.map(({ user }) => user?.login.toLowerCase()).filter(Boolean), - ) - log( - 'reviewers - existing_reviewers', - Array.from(existing_reviewers).join(', '), - ) + // Same for teams + const teams_reached = new Set([ + ...pull_request.requested_teams.map(({ slug }) => slug.toLowerCase()), + ...reviews.flatMap(({ onBehalfOf }) => + onBehalfOf.nodes.map(({ slug }) => slug.toLowerCase()), + ), + ]) + log('reviewers - teams_reached', Array.from(teams_reached).join(', ')) // Early sanity check, before we start making any API requests. The list of maintainers // does not have duplicates so the only user to filter out from this list would be the @@ -35,16 +36,17 @@ async function handleReviewers({ // further down again. // This is to protect against huge treewides consuming all our API requests for no // reason. - if (maintainers.length > 16) { + if (user_maintainers.length + team_maintainers.length > 16) { core.warning('Too many potential reviewers, skipping review requests.') // Return a boolean on whether the "needs: reviewers" label should be set. - return existing_reviewers.size === 0 && requested_reviewers.size === 0 + return users_reached.size === 0 && teams_reached.size === 0 } - const users = new Set([ + // Users that should be reached + var users_to_reach = new Set([ ...( await Promise.all( - maintainers.map(async (id) => { + user_maintainers.map(async (id) => { const user = await getUser(id) // User may have deleted their account return user?.login?.toLowerCase() @@ -55,76 +57,108 @@ async function handleReviewers({ .filter((handle) => handle && !handle.includes('/')) .map((handle) => handle.toLowerCase()), ]) - log('reviewers - users', Array.from(users).join(', ')) - - const teams = new Set( - owners - .map((handle) => handle.split('/')) - .filter(([org, slug]) => org === context.repo.owner && slug) - .map(([, slug]) => slug), - ) - log('reviewers - teams', Array.from(teams).join(', ')) - - const team_members = new Set( - (await Promise.all(Array.from(teams, getTeamMembers))) - .flat(1) - .map(({ login }) => login.toLowerCase()), - ) - log('reviewers - team_members', Array.from(team_members).join(', ')) - - const new_reviewers = users - .union(team_members) // We can't request a review from the author. .difference(new Set([pull_request.user?.login.toLowerCase()])) - log('reviewers - new_reviewers', Array.from(new_reviewers).join(', ')) // Filter users to repository collaborators. If they're not, they can't be requested // for review. In that case, they probably missed their invite to the maintainers team. - const reviewers = ( - await Promise.all( - Array.from(new_reviewers, async (username) => { - // TODO: Restructure this file to only do the collaborator check for those users - // who were not already part of a team. Being a member of a team makes them - // collaborators by definition. - try { - await github.rest.repos.checkCollaborator({ - ...context.repo, - username, - }) - return username - } catch (e) { - if (e.status !== 404) throw e - core.warning( - `PR #${pull_number}: User ${username} cannot be requested for review because they don't exist or are not a repository collaborator, ignoring. They probably missed the automated invite to the maintainers team (see ).`, - ) - } - }), - ) - ).filter(Boolean) - log('reviewers - reviewers', reviewers.join(', ')) + users_to_reach = new Set( + ( + await Promise.all( + Array.from(users_to_reach, async (username) => { + // TODO: Restructure this file to only do the collaborator check for those users + // who were not already part of a team. Being a member of a team makes them + // collaborators by definition. + try { + await github.rest.repos.checkCollaborator({ + ...context.repo, + username, + }) + return username + } catch (e) { + if (e.status !== 404) throw e + core.warning( + `PR #${pull_number}: User ${username} cannot be requested for review because they don't exist or are not a repository collaborator, ignoring. They probably missed the automated invite to the maintainers team (see ).`, + ) + } + }), + ) + ).filter(Boolean), + ) + log('reviewers - users_to_reach', Array.from(users_to_reach).join(', ')) - if (reviewers.length > 15) { + // Similar for teams + var teams_to_reach = new Set([ + ...( + await Promise.all( + team_maintainers.map(async (id) => { + const team = await getTeam(id) + // Team may have been deleted + return team?.slug?.toLowerCase() + }), + ) + ).filter(Boolean), + ...owners + .map((handle) => handle.split('/')) + .filter( + ([org, slug]) => + org.toLowerCase() === context.repo.owner.toLowerCase() && slug, + ) + .map(([, slug]) => slug.toLowerCase()), + ]) + teams_to_reach = new Set( + ( + await Promise.all( + Array.from(teams_to_reach, async (slug) => { + try { + await github.rest.teams.checkPermissionsForRepoInOrg({ + org: context.repo.owner, + team_slug: slug, + owner: context.repo.owner, + repo: context.repo.repo, + }) + return slug + } catch (e) { + if (e.status !== 404) throw e + core.warning( + `PR #${pull_number}: Team ${slug} cannot be requested for review because it doesn't exist or has no repository permissions, ignoring. Probably wasn't added to the nixpkgs-maintainers team (see https://github.com/NixOS/nixpkgs/tree/master/maintainers#maintainer-teams)`, + ) + } + }), + ) + ).filter(Boolean), + ) + log('reviewers - teams_to_reach', Array.from(teams_to_reach).join(', ')) + + if (users_to_reach.size + teams_to_reach.size > 15) { core.warning( - `Too many reviewers (${reviewers.join(', ')}), skipping review requests.`, + `Too many reviewers (users: ${Array.from(users_to_reach).join(', ')}, teams: ${Array.from(teams_to_reach).join(', ')}), skipping review requests.`, ) // Return a boolean on whether the "needs: reviewers" label should be set. - return existing_reviewers.size === 0 && requested_reviewers.size === 0 + return users_reached.size === 0 && teams_reached.size === 0 } - const non_requested_reviewers = new Set(reviewers) - .difference(requested_reviewers) - // We don't want to rerequest reviews from people who already reviewed. - .difference(existing_reviewers) + // We don't want to rerequest reviews from people who already reviewed or were requested + const users_not_yet_reached = users_to_reach.difference(users_reached) log( - 'reviewers - non_requested_reviewers', - Array.from(non_requested_reviewers).join(', '), + 'reviewers - users_not_yet_reached', + Array.from(users_not_yet_reached).join(', '), + ) + // We don't want to rerequest reviews from teams who already reviewed or were requested + const teams_not_yet_reached = teams_to_reach.difference(teams_reached) + log( + 'reviewers - teams_not_yet_reached', + Array.from(teams_not_yet_reached).join(', '), ) - if (non_requested_reviewers.size === 0) { + if (users_not_yet_reached.size === 0 && teams_not_yet_reached.size === 0) { log('Has reviewer changes', 'false (skipped)') } else if (dry) { core.info( - `Requesting reviewers for #${pull_number}: ${Array.from(non_requested_reviewers).join(', ')} (dry)`, + `Requesting user reviewers for #${pull_number}: ${Array.from(users_not_yet_reached).join(', ')} (dry)`, + ) + core.info( + `Requesting team reviewers for #${pull_number}: ${Array.from(teams_not_yet_reached).join(', ')} (dry)`, ) } else { // We had tried the "request all reviewers at once" thing in the past, but it didn't work out: @@ -134,15 +168,17 @@ async function handleReviewers({ await github.rest.pulls.requestReviewers({ ...context.repo, pull_number, - reviewers, + reviewers: users_not_yet_reached, + team_reviewers: teams_not_yet_reached, }) } // Return a boolean on whether the "needs: reviewers" label should be set. return ( - non_requested_reviewers.size === 0 && - existing_reviewers.size === 0 && - requested_reviewers.size === 0 + users_not_yet_reached.size === 0 && + teams_not_yet_reached.size === 0 && + users_reached.size === 0 && + teams_reached.size === 0 ) } diff --git a/pkgs/stdenv/generic/check-meta.nix b/pkgs/stdenv/generic/check-meta.nix index 4f314801a749..cfc08ba9847f 100644 --- a/pkgs/stdenv/generic/check-meta.nix +++ b/pkgs/stdenv/generic/check-meta.nix @@ -364,6 +364,7 @@ let ]; sourceProvenance = listOf attrs; maintainers = listOf (attrsOf any); # TODO use the maintainer type from lib/tests/maintainer-module.nix + nonTeamMaintainers = listOf (attrsOf any); # TODO use the maintainer type from lib/tests/maintainer-module.nix teams = listOf (attrsOf any); # TODO similar to maintainers, use a teams type priority = int; pkgConfigModules = listOf str; @@ -629,6 +630,10 @@ let attrs.meta.maintainers or [ ] ++ concatMap (team: team.members or [ ]) attrs.meta.teams or [ ] ); + # Needed for CI to be able to avoid requesting reviews from individual + # team members + nonTeamMaintainers = attrs.meta.maintainers or [ ]; + identifiers = let # nix-env writes a warning for each derivation that has null in its meta values, so From f551f657498f8d10e0bdad35a9b5b82c11b40425 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 7 Feb 2026 13:07:42 +0000 Subject: [PATCH 47/67] ytdl-sub: 2026.01.30 -> 2026.02.04 --- pkgs/by-name/yt/ytdl-sub/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/yt/ytdl-sub/package.nix b/pkgs/by-name/yt/ytdl-sub/package.nix index 5f4d907a5d8f..000182307ced 100644 --- a/pkgs/by-name/yt/ytdl-sub/package.nix +++ b/pkgs/by-name/yt/ytdl-sub/package.nix @@ -9,14 +9,14 @@ python3Packages.buildPythonApplication (finalAttrs: { pname = "ytdl-sub"; - version = "2026.01.30"; + version = "2026.02.04"; pyproject = true; src = fetchFromGitHub { owner = "jmbannon"; repo = "ytdl-sub"; tag = finalAttrs.version; - hash = "sha256-NKK5GD5OsdSo3m//rkMtvrtiVCkCo0VOf1xWNBjFOh4="; + hash = "sha256-c6TQMWp7vlC5T5ZjS+uLVS2vfoSk1+g/4LS+bRYilSc="; }; postPatch = '' From 79730099ef07b92c71d03372dddcd7cbbee3383d Mon Sep 17 00:00:00 2001 From: Tom van Dijk <18gatenmaker6@gmail.com> Date: Thu, 29 Jan 2026 22:45:48 +0100 Subject: [PATCH 48/67] jj-pre-push: add pre-commit to $PATH by default --- pkgs/by-name/jj/jj-pre-push/package.nix | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/jj/jj-pre-push/package.nix b/pkgs/by-name/jj/jj-pre-push/package.nix index 628a905620b3..9b5d9c11c3a7 100644 --- a/pkgs/by-name/jj/jj-pre-push/package.nix +++ b/pkgs/by-name/jj/jj-pre-push/package.nix @@ -4,6 +4,9 @@ python3Packages, fetchFromGitHub, installShellFiles, + + withPrecommit ? true, + pre-commit, }: python3Packages.buildPythonApplication rec { @@ -22,9 +25,12 @@ python3Packages.buildPythonApplication rec { python3Packages.uv-build ]; - dependencies = with python3Packages; [ - typer-slim - ]; + dependencies = + with python3Packages; + [ + typer-slim + ] + ++ lib.optionals withPrecommit [ pre-commit ]; nativeBuildInputs = [ installShellFiles ]; postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) '' From df0f80bcead51eaabb4b25a8d53b7d6f2493c8e4 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Wed, 4 Feb 2026 13:37:56 +0100 Subject: [PATCH 49/67] buildMozillaMach: move env variables into env --- pkgs/build-support/build-mozilla-mach/default.nix | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/pkgs/build-support/build-mozilla-mach/default.nix b/pkgs/build-support/build-mozilla-mach/default.nix index 1236f7b79369..efaff0805e95 100644 --- a/pkgs/build-support/build-mozilla-mach/default.nix +++ b/pkgs/build-support/build-mozilla-mach/default.nix @@ -367,10 +367,6 @@ buildStdenv.mkDerivation { "-l" ]; - # if not explicitly set, wrong cc from buildStdenv would be used - HOST_CC = "${llvmPackagesBuildBuild.stdenv.cc}/bin/cc"; - HOST_CXX = "${llvmPackagesBuildBuild.stdenv.cc}/bin/c++"; - nativeBuildInputs = [ autoconf cargo @@ -643,7 +639,12 @@ buildStdenv.mkDerivation { makeFlags = extraMakeFlags; separateDebugInfo = enableDebugSymbols; enableParallelBuilding = true; - env = lib.optionalAttrs stdenv.hostPlatform.isMusl { + env = { + # if not explicitly set, wrong cc from buildStdenv would be used + HOST_CC = "${llvmPackagesBuildBuild.stdenv.cc}/bin/cc"; + HOST_CXX = "${llvmPackagesBuildBuild.stdenv.cc}/bin/c++"; + } + // lib.optionalAttrs stdenv.hostPlatform.isMusl { # Firefox relies on nonstandard behavior of the glibc dynamic linker. It re-uses # previously loaded libraries even though they are not in the rpath of the newly loaded binary. # On musl we have to explicitly set the rpath to include these libraries. From fb74f88fd3a6219444a9f1a68bd79df22d60140f Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 7 Feb 2026 13:53:19 +0000 Subject: [PATCH 50/67] phpExtensions.xdebug: 3.5.0 -> 3.5.1 --- pkgs/development/php-packages/xdebug/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/php-packages/xdebug/default.nix b/pkgs/development/php-packages/xdebug/default.nix index 096746005ca5..2fbcfdb340c6 100644 --- a/pkgs/development/php-packages/xdebug/default.nix +++ b/pkgs/development/php-packages/xdebug/default.nix @@ -5,7 +5,7 @@ }: let - version = "3.5.0"; + version = "3.5.1"; in buildPecl { inherit version; @@ -16,7 +16,7 @@ buildPecl { owner = "xdebug"; repo = "xdebug"; rev = version; - hash = "sha256-RrT79o0eFKwGFq3gIfBWCUy5gFy6odj2AWfsfcGN2R4="; + hash = "sha256-GOlWCKDLwptsHV9SvOOlR4uScvcw8V/DjwXIpfWjSkM="; }; doCheck = true; From ab9abccefa4a7839635121f91d6be72dcafad086 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 7 Feb 2026 13:54:53 +0000 Subject: [PATCH 51/67] hydralauncher: 3.8.1 -> 3.8.3 --- pkgs/by-name/hy/hydralauncher/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/hy/hydralauncher/package.nix b/pkgs/by-name/hy/hydralauncher/package.nix index e57161c3d9f6..89578079812b 100644 --- a/pkgs/by-name/hy/hydralauncher/package.nix +++ b/pkgs/by-name/hy/hydralauncher/package.nix @@ -6,10 +6,10 @@ }: let pname = "hydralauncher"; - version = "3.8.1"; + version = "3.8.3"; src = fetchurl { url = "https://github.com/hydralauncher/hydra/releases/download/v${version}/hydralauncher-${version}.AppImage"; - hash = "sha256-GLoGdZ/UWtkWt4WjjhmupQzPQTMuQI+7jb7IjSCcvo0="; + hash = "sha256-1oePQ33Bpt2GKEQgCIVAVjnF04rLY9fraUuodoLlx8o="; }; appimageContents = appimageTools.extractType2 { inherit pname src version; }; From a35624e0b35616e66ad675cb2af7ba7ff37a4e00 Mon Sep 17 00:00:00 2001 From: Gliczy <129636582+Gliczy@users.noreply.github.com> Date: Sat, 7 Feb 2026 15:03:57 +0100 Subject: [PATCH 52/67] scx.full: 1.0.19 -> 1.0.20 --- pkgs/os-specific/linux/scx/scx_rustscheds.nix | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-) diff --git a/pkgs/os-specific/linux/scx/scx_rustscheds.nix b/pkgs/os-specific/linux/scx/scx_rustscheds.nix index 0aef6baf61ae..565a760563b6 100644 --- a/pkgs/os-specific/linux/scx/scx_rustscheds.nix +++ b/pkgs/os-specific/linux/scx/scx_rustscheds.nix @@ -11,27 +11,19 @@ libseccomp, nix-update-script, nixosTests, - fetchpatch, }: rustPlatform.buildRustPackage (finalAttrs: { pname = "scx_rustscheds"; - version = "1.0.19"; + version = "1.0.20"; src = fetchFromGitHub { owner = "sched-ext"; repo = "scx"; tag = "v${finalAttrs.version}"; - hash = "sha256-bOldw2Sob5aANmVzw6VwCgJ4+VzEsohKUxOxntow7VY="; + hash = "sha256-MUWbNsxmbCRCOWB2dHpi5dEY2rNRrINxJSyl5SNSO9Y="; }; - cargoHash = "sha256-ik05X+5jIdxtXYhN6fb1URW8TKKzgFuevi5+Wm2j15Y="; - - patches = [ - (fetchpatch { - url = "https://patch-diff.githubusercontent.com/raw/sched-ext/scx/pull/3127.patch"; - hash = "sha256-HpGJR3eBZKE+VsqGivjJp1n7JIORhZUxG87AsP1WWi0="; - }) - ]; + cargoHash = "sha256-H58wschck+l41fQh9W5SNVb5g9lAnw90SOSd/RtGXyw="; nativeBuildInputs = [ pkg-config From 57cd1b2c88d441ffa0c0d72e8a60f79e862916e6 Mon Sep 17 00:00:00 2001 From: Harinn Date: Sat, 7 Feb 2026 16:21:55 +0700 Subject: [PATCH 53/67] nvtop: 3.2.0 -> 3.3.1 --- pkgs/tools/system/nvtop/build-nvtop.nix | 10 ++++++++-- pkgs/tools/system/nvtop/default.nix | 3 +++ 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/pkgs/tools/system/nvtop/build-nvtop.nix b/pkgs/tools/system/nvtop/build-nvtop.nix index cde5f844929e..9a0673e4a71d 100644 --- a/pkgs/tools/system/nvtop/build-nvtop.nix +++ b/pkgs/tools/system/nvtop/build-nvtop.nix @@ -20,6 +20,9 @@ ascend ? false, v3d ? false, tpu ? false, + rockchip ? false, + metax ? false, + enflame ? false, }: let @@ -39,7 +42,7 @@ let in stdenv.mkDerivation (finalAttrs: { pname = "nvtop"; - version = "3.2.0"; + version = "3.3.1"; # between generation of multiple update PRs for each package flavor and manual updates I choose manual updates # nixpkgs-update: no auto update @@ -47,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: { owner = "Syllo"; repo = "nvtop"; rev = finalAttrs.version; - hash = "sha256-8iChT55L2NSnHg8tLIry0rgi/4966MffShE0ib+2ywc="; + hash = "sha256-+SvEp8pbauSLbDuPZqGMTyL2EZecz1VKCJgC+xjV/vQ="; }; cmakeFlags = with lib.strings; [ @@ -63,6 +66,9 @@ stdenv.mkDerivation (finalAttrs: { (cmakeBool "ASCEND_SUPPORT" ascend) (cmakeBool "V3D_SUPPORT" v3d) (cmakeBool "TPU_SUPPORT" tpu) # requires libtpuinfo which is not packaged yet + (cmakeBool "ROCKCHIP_SUPPORT" rockchip) + (cmakeBool "METAX_SUPPORT" metax) + (cmakeBool "ENFLAME_SUPPORT" enflame) ]; nativeBuildInputs = [ cmake diff --git a/pkgs/tools/system/nvtop/default.nix b/pkgs/tools/system/nvtop/default.nix index 767ae8206452..439c25c9d95e 100644 --- a/pkgs/tools/system/nvtop/default.nix +++ b/pkgs/tools/system/nvtop/default.nix @@ -11,6 +11,9 @@ let "panfrost" "panthor" "v3d" + "rockchip" + "metax" + "enflame" ]; # these GPU families are partially supported upstream, they are also tricky to build in nixpkgs # volunteers with specific hardware needed to build and test these package variants From 81d14fe8b37fbed94ec5309fa0d33d9b1a3bef8c Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 7 Feb 2026 14:43:19 +0000 Subject: [PATCH 54/67] qownnotes: 26.1.15 -> 26.2.0 --- pkgs/by-name/qo/qownnotes/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/qo/qownnotes/package.nix b/pkgs/by-name/qo/qownnotes/package.nix index bf62e39f7225..36850b4d4ca1 100644 --- a/pkgs/by-name/qo/qownnotes/package.nix +++ b/pkgs/by-name/qo/qownnotes/package.nix @@ -19,11 +19,11 @@ stdenv.mkDerivation (finalAttrs: { pname = "qownnotes"; appname = "QOwnNotes"; - version = "26.1.15"; + version = "26.2.0"; src = fetchurl { url = "https://github.com/pbek/QOwnNotes/releases/download/v${finalAttrs.version}/qownnotes-${finalAttrs.version}.tar.xz"; - hash = "sha256-Pdv55cybpUOKI4COAg7GqJTrBrMCn1GPGT+m+TGcruo="; + hash = "sha256-vPrHadER77TzwFb3etVSVsnqu7cVitIsnKVDChjAbwE="; }; nativeBuildInputs = [ From 0b831f69892ddda7bc565543b823069adf815ab7 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 7 Feb 2026 14:43:58 +0000 Subject: [PATCH 55/67] flood: 4.11.0 -> 4.12.2 --- pkgs/by-name/fl/flood/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/fl/flood/package.nix b/pkgs/by-name/fl/flood/package.nix index 09e188b689ea..c2f5b2792275 100644 --- a/pkgs/by-name/fl/flood/package.nix +++ b/pkgs/by-name/fl/flood/package.nix @@ -10,13 +10,13 @@ }: buildNpmPackage rec { pname = "flood"; - version = "4.11.0"; + version = "4.12.2"; src = fetchFromGitHub { owner = "jesec"; repo = "flood"; rev = "v${version}"; - hash = "sha256-RBWDEFhLEZdC7luGFGx3qY0Hk7nM44RZgRyCWXFPh1k="; + hash = "sha256-N+6MFxFDfrrp8MLUMjtzdUMDsJGvRPE7SdTedOlrRX4="; }; nativeBuildInputs = [ pnpm_9 ]; @@ -31,7 +31,7 @@ buildNpmPackage rec { ; pnpm = pnpm_9; fetcherVersion = 1; - hash = "sha256-MnsUTXcLMT0Q2bQ/rRD4FfJx8XP9TLiv1oTHIgnMZCQ="; + hash = "sha256-m7YNBHEz5g1AjDVECrGL+xJfSXaTnUPPY679ENjR+l8="; }; passthru = { From 71e704768dc14dfd9dece3e2f4ee9cdb7caebda6 Mon Sep 17 00:00:00 2001 From: Silvan Mosberger Date: Sat, 7 Feb 2026 13:50:46 +0100 Subject: [PATCH 56/67] ci/github-script/reviewers.js: Fix reviewer API request It takes arrays, not sets, see https://github.com/NixOS/nixpkgs/actions/runs/21735690914/job/62700395870?pr=487491 --- ci/github-script/reviewers.js | 27 ++++++++++++++------------- 1 file changed, 14 insertions(+), 13 deletions(-) diff --git a/ci/github-script/reviewers.js b/ci/github-script/reviewers.js index fbbcc996eba9..be458ba4eb32 100644 --- a/ci/github-script/reviewers.js +++ b/ci/github-script/reviewers.js @@ -139,26 +139,27 @@ async function handleReviewers({ } // We don't want to rerequest reviews from people who already reviewed or were requested - const users_not_yet_reached = users_to_reach.difference(users_reached) - log( - 'reviewers - users_not_yet_reached', - Array.from(users_not_yet_reached).join(', '), + const users_not_yet_reached = Array.from( + users_to_reach.difference(users_reached), ) + log('reviewers - users_not_yet_reached', users_not_yet_reached.join(', ')) // We don't want to rerequest reviews from teams who already reviewed or were requested - const teams_not_yet_reached = teams_to_reach.difference(teams_reached) - log( - 'reviewers - teams_not_yet_reached', - Array.from(teams_not_yet_reached).join(', '), + const teams_not_yet_reached = Array.from( + teams_to_reach.difference(teams_reached), ) + log('reviewers - teams_not_yet_reached', teams_not_yet_reached.join(', ')) - if (users_not_yet_reached.size === 0 && teams_not_yet_reached.size === 0) { + if ( + users_not_yet_reached.length === 0 && + teams_not_yet_reached.length === 0 + ) { log('Has reviewer changes', 'false (skipped)') } else if (dry) { core.info( - `Requesting user reviewers for #${pull_number}: ${Array.from(users_not_yet_reached).join(', ')} (dry)`, + `Requesting user reviewers for #${pull_number}: ${users_not_yet_reached.join(', ')} (dry)`, ) core.info( - `Requesting team reviewers for #${pull_number}: ${Array.from(teams_not_yet_reached).join(', ')} (dry)`, + `Requesting team reviewers for #${pull_number}: ${teams_not_yet_reached.join(', ')} (dry)`, ) } else { // We had tried the "request all reviewers at once" thing in the past, but it didn't work out: @@ -175,8 +176,8 @@ async function handleReviewers({ // Return a boolean on whether the "needs: reviewers" label should be set. return ( - users_not_yet_reached.size === 0 && - teams_not_yet_reached.size === 0 && + users_not_yet_reached.length === 0 && + teams_not_yet_reached.length === 0 && users_reached.size === 0 && teams_reached.size === 0 ) From 52e12427d92c87b2e94be8c257091d825b585828 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Fri, 6 Feb 2026 04:15:20 +0000 Subject: [PATCH 57/67] circt: 1.139.0 -> 1.140.0 --- pkgs/by-name/ci/circt/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ci/circt/package.nix b/pkgs/by-name/ci/circt/package.nix index 4597e7b1b291..d28a4de75e5f 100644 --- a/pkgs/by-name/ci/circt/package.nix +++ b/pkgs/by-name/ci/circt/package.nix @@ -27,12 +27,12 @@ let in stdenv.mkDerivation (finalAttrs: { pname = "circt"; - version = "1.139.0"; + version = "1.140.0"; src = fetchFromGitHub { owner = "llvm"; repo = "circt"; - rev = "firtool-${finalAttrs.version}"; - hash = "sha256-Yj9BqmmotIaTUHIUslaOmRXYC4ujQ9GNjEmaAfLgLgU="; + tag = "firtool-${finalAttrs.version}"; + hash = "sha256-oitdYNGsEyraQqouOt9srfbDgVGFOAGZMdcf/rjnx5Q="; fetchSubmodules = true; }; From 55faf59a25df1209b5dfd56dc0076bd275918784 Mon Sep 17 00:00:00 2001 From: Silvan Mosberger Date: Sat, 7 Feb 2026 17:32:39 +0100 Subject: [PATCH 58/67] ci: Fix team review requests from the bot https://github.com/NixOS/nixpkgs/actions/runs/21782693200/job/62849125010 --- ci/github-script/bot.js | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/ci/github-script/bot.js b/ci/github-script/bot.js index 76055a3c2d4c..b360d54347f0 100644 --- a/ci/github-script/bot.js +++ b/ci/github-script/bot.js @@ -12,6 +12,12 @@ module.exports = async ({ github, context, core, dry }) => { // Detect if running in a fork (not NixOS/nixpkgs) const isFork = context.repo.owner !== 'NixOS' + const orgId = ( + await github.rest.orgs.get({ + org: context.repo.owner, + }) + ).data.id + async function downloadMaintainerMap(branch) { let run @@ -168,8 +174,7 @@ module.exports = async ({ github, context, core, dry }) => { .request({ method: 'GET', url: '/organizations/{orgId}/team/{id}', - // TODO: Make this work without pull_requests payloads - orgId: context.payload.pull_request.base.user.id, + orgId, id, }) .then((resp) => resp.data) From 672c73e75ff2828097ae028aa8685b5beee7a309 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 7 Feb 2026 11:35:19 +0000 Subject: [PATCH 59/67] smug: 0.3.13 -> 0.3.14 --- pkgs/by-name/sm/smug/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/sm/smug/package.nix b/pkgs/by-name/sm/smug/package.nix index 0471a6ce3fd6..be076f6bfef1 100644 --- a/pkgs/by-name/sm/smug/package.nix +++ b/pkgs/by-name/sm/smug/package.nix @@ -7,15 +7,15 @@ buildGoModule (finalAttrs: { pname = "smug"; - version = "0.3.13"; + version = "0.3.14"; subPackages = [ "." ]; src = fetchFromGitHub { owner = "ivaaaan"; repo = "smug"; - rev = "v${finalAttrs.version}"; - sha256 = "sha256-dvgbE1iKPDp8KuOuKJt5ITNDctt5Ej759qdcAIJcBkA="; + tag = "v${finalAttrs.version}"; + hash = "sha256-5MvDhG7cTbapF1mwEpuvEFvSpduwFnvv7seTh7Va5Yw="; }; vendorHash = "sha256-N6btfKjhJ0MkXAL4enyNfnJk8vUeUDCRus5Fb7hNtug="; From dc2edec04e54fd20872cf1e439c705b103e97fc3 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 7 Feb 2026 07:49:56 +0000 Subject: [PATCH 60/67] squawk: 2.37.0 -> 2.39.0 --- pkgs/by-name/sq/squawk/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/sq/squawk/package.nix b/pkgs/by-name/sq/squawk/package.nix index a82cf9dbe2d4..9d7faf42d3f6 100644 --- a/pkgs/by-name/sq/squawk/package.nix +++ b/pkgs/by-name/sq/squawk/package.nix @@ -10,16 +10,16 @@ }: rustPlatform.buildRustPackage (finalAttrs: { pname = "squawk"; - version = "2.37.0"; + version = "2.39.0"; src = fetchFromGitHub { owner = "sbdchd"; repo = "squawk"; tag = "v${finalAttrs.version}"; - hash = "sha256-+7cIymENIjF2fVD+qAblY4+dkENYiaTnDhCc/VuuAIk="; + hash = "sha256-Rox7WJG2vYL9xteZpzJvWuJNgDe6BLGaGOPvu4yavBo="; }; - cargoHash = "sha256-2CJkwkC8/BgaYi994WoLtsykdTH5ZAyH0CpbvDTZ1GA="; + cargoHash = "sha256-Eqy1yQ1NU3fdyRr9qDFbE87cX0s3ijMF0ZbXKHAEEM8="; nativeBuildInputs = [ pkg-config From 73a7bcfe688618bab386a374cd54d6dce9f72f31 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Fri, 6 Feb 2026 22:07:06 +0000 Subject: [PATCH 61/67] wgo: 0.6.2 -> 0.6.3 --- pkgs/by-name/wg/wgo/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/wg/wgo/package.nix b/pkgs/by-name/wg/wgo/package.nix index f691b9cc4ee0..b0bc37aaf6b1 100644 --- a/pkgs/by-name/wg/wgo/package.nix +++ b/pkgs/by-name/wg/wgo/package.nix @@ -6,13 +6,13 @@ buildGoModule (finalAttrs: { pname = "wgo"; - version = "0.6.2"; + version = "0.6.3"; src = fetchFromGitHub { owner = "bokwoon95"; repo = "wgo"; - rev = "v${finalAttrs.version}"; - hash = "sha256-Z3adi1PQ5v0BxcjkOJZWeUxwLlLXpNuJxrQztV2pCiA="; + tag = "v${finalAttrs.version}"; + hash = "sha256-J2mS2GIGlNHQVCIVpOMxZIZiqOFW0fu0M+qAbEuOuRo="; }; vendorHash = "sha256-6ZJNXw/ahaIziQGVNgjbTbm53JiO3dYCqJtdB///cmo="; From e4d624657d8a0f67e9c5de31a7897f3cde3e94d7 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Fri, 28 Nov 2025 19:20:09 +0000 Subject: [PATCH 62/67] ocamlPackages.coin: 0.1.4 -> 0.1.5 --- pkgs/development/ocaml-modules/coin/default.nix | 17 +++-------------- 1 file changed, 3 insertions(+), 14 deletions(-) diff --git a/pkgs/development/ocaml-modules/coin/default.nix b/pkgs/development/ocaml-modules/coin/default.nix index 50b309d26f0e..a952f45c5c10 100644 --- a/pkgs/development/ocaml-modules/coin/default.nix +++ b/pkgs/development/ocaml-modules/coin/default.nix @@ -1,30 +1,19 @@ { buildDunePackage, fetchurl, - findlib, lib, - ocaml, - re, }: buildDunePackage (finalAttrs: { pname = "coin"; - version = "0.1.4"; - minimalOCamlVersion = "4.03"; + version = "0.1.5"; + minimalOCamlVersion = "4.06"; src = fetchurl { url = "https://github.com/mirage/coin/releases/download/v${finalAttrs.version}/coin-${finalAttrs.version}.tbz"; - sha256 = "sha256:0069qqswd1ik5ay3d5q1v1pz0ql31kblfsnv0ax0z8jwvacp3ack"; + hash = "sha256-z2WzQ7zUFmZJTUqygTHguud6+NAcp36WubHbILXGR9g="; }; - postPatch = '' - substituteInPlace src/dune --replace 'ocaml} ' \ - 'ocaml} -I ${findlib}/lib/ocaml/${ocaml.version}/site-lib ' - ''; - - nativeBuildInputs = [ findlib ]; - buildInputs = [ re ]; - doCheck = true; meta = { From 55ff879009875eadaaea6576dbda6bcc4433ac00 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Fri, 28 Nov 2025 13:34:50 +0000 Subject: [PATCH 63/67] ocamlPackages.uuuu: 0.3.0 -> 0.4.0 --- .../development/ocaml-modules/uuuu/default.nix | 18 ++---------------- 1 file changed, 2 insertions(+), 16 deletions(-) diff --git a/pkgs/development/ocaml-modules/uuuu/default.nix b/pkgs/development/ocaml-modules/uuuu/default.nix index 8965114543e7..5311e5731705 100644 --- a/pkgs/development/ocaml-modules/uuuu/default.nix +++ b/pkgs/development/ocaml-modules/uuuu/default.nix @@ -1,32 +1,18 @@ { - angstrom, buildDunePackage, fetchurl, - findlib, lib, - ocaml, - re, }: buildDunePackage rec { pname = "uuuu"; - version = "0.3.0"; + version = "0.4.0"; src = fetchurl { url = "https://github.com/mirage/uuuu/releases/download/v${version}/uuuu-${version}.tbz"; - sha256 = "sha256:19n39yc7spgzpk9i70r0nhkwsb0bfbvbgpf8d863p0a3wgryhzkb"; + hash = "sha256-5+GNk9s36ZocrAjuvlDIiQTq6WF9q0M8j3h/TakrGSg="; }; - postPatch = '' - substituteInPlace src/dune --replace 'ocaml} ' \ - 'ocaml} -I ${findlib}/lib/ocaml/${ocaml.version}/site-lib ' - ''; - - nativeBuildInputs = [ findlib ]; - - buildInputs = [ angstrom ]; - - checkInputs = [ re ]; doCheck = true; duneVersion = "3"; From e94a20f277f289fb40d18e0de169f63f5ba77876 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 19 Nov 2025 20:13:20 +0000 Subject: [PATCH 64/67] ocamlPackages.lun: 0.0.1 -> 0.0.2 --- pkgs/development/ocaml-modules/lun/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/ocaml-modules/lun/default.nix b/pkgs/development/ocaml-modules/lun/default.nix index 5e1e32178f5e..22c8fc3d864c 100644 --- a/pkgs/development/ocaml-modules/lun/default.nix +++ b/pkgs/development/ocaml-modules/lun/default.nix @@ -6,13 +6,13 @@ buildDunePackage rec { pname = "lun"; - version = "0.0.1"; + version = "0.0.2"; minimalOCamlVersion = "4.12.0"; src = fetchurl { url = "https://github.com/robur-coop/lun/releases/download/v${version}/lun-${version}.tbz"; - hash = "sha256-zKi63/g7Rw/c+xhAEW+Oim8suGzeL0TtKM8my/aSp5M="; + hash = "sha256-1oqjTXY+/jJT1uQOV6iiK9qV9DAmERYsL2BtentmB8I="; }; meta = { From f53b4bd9ff1a4057675533eca35c29c4bdde18e8 Mon Sep 17 00:00:00 2001 From: Weijia Wang <9713184+wegank@users.noreply.github.com> Date: Sat, 7 Feb 2026 18:12:27 +0100 Subject: [PATCH 65/67] ocamlPackages.lun: update homepage --- pkgs/development/ocaml-modules/lun/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/development/ocaml-modules/lun/default.nix b/pkgs/development/ocaml-modules/lun/default.nix index 22c8fc3d864c..4bf1820920b4 100644 --- a/pkgs/development/ocaml-modules/lun/default.nix +++ b/pkgs/development/ocaml-modules/lun/default.nix @@ -17,7 +17,7 @@ buildDunePackage rec { meta = { description = "Optics in OCaml"; - homepage = "https://git.robur.coop/robur/lun"; + homepage = "https://github.com/robur-coop/lun"; license = lib.licenses.isc; maintainers = [ ]; }; From cff58264ea8d61f4c2c3438fff256fb431246ea8 Mon Sep 17 00:00:00 2001 From: Weijia Wang <9713184+wegank@users.noreply.github.com> Date: Sat, 7 Feb 2026 18:27:20 +0100 Subject: [PATCH 66/67] ocamlPackages.ppx_lun: unbreak --- pkgs/development/ocaml-modules/lun/ppx.nix | 1 - 1 file changed, 1 deletion(-) diff --git a/pkgs/development/ocaml-modules/lun/ppx.nix b/pkgs/development/ocaml-modules/lun/ppx.nix index c54c07d8a63b..8c701e7042b9 100644 --- a/pkgs/development/ocaml-modules/lun/ppx.nix +++ b/pkgs/development/ocaml-modules/lun/ppx.nix @@ -22,6 +22,5 @@ buildDunePackage { meta = lun.meta // { description = "Optics with lun package and PPX"; license = lib.licenses.mit; - broken = lib.versionAtLeast ppxlib.version "0.36"; }; } From 35eac8d7d1d34fbcdcc699af6d2d2ec301f95e98 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 4 Nov 2025 03:32:01 +0000 Subject: [PATCH 67/67] ocamlPackages.tezt: 4.2.0 -> 4.3.0 --- pkgs/development/ocaml-modules/tezt/default.nix | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/development/ocaml-modules/tezt/default.nix b/pkgs/development/ocaml-modules/tezt/default.nix index db18468d2b81..665373b769c0 100644 --- a/pkgs/development/ocaml-modules/tezt/default.nix +++ b/pkgs/development/ocaml-modules/tezt/default.nix @@ -10,15 +10,15 @@ buildDunePackage rec { pname = "tezt"; - version = "4.2.0"; + version = "4.3.0"; - minimalOCamlVersion = "4.12"; + minimalOCamlVersion = "4.13"; src = fetchFromGitLab { owner = "nomadic-labs"; - repo = pname; - rev = version; - hash = "sha256-8+q/A1JccH3CfWxfNhgJU5X+KEp+Uw7nvS72ZcPRsd8="; + repo = "tezt"; + tag = version; + hash = "sha256-BF+hNqTm9r2S3jGjmjrw+/SHrr87WSe4YUjkc9WRgNo="; }; propagatedBuildInputs = [