Merge master into staging-nixos

nixos/modules/programs/regreet.nix

@@ -40,9 +40,12 @@ in
 
     cageArgs = lib.mkOption {
       type = lib.types.listOf lib.types.str;
-      default = [ "-s" ];
+      default = [
+        "-s"
+        "-d"
+      ];
       example = lib.literalExpression ''
-        [ "-s" "-m" "last" ]
+        [ "-s" "-d" "-m" "last" ]
       '';
       description = ''
         Additional arguments to be passed to

nixos/modules/services/networking/ncps.nix

@@ -17,6 +17,23 @@ let
     "panic"
   ];
 
+  ncpsWrapper = pkgs.writeShellScript "ncps-wrapper" ''
+    ${lib.optionalString (cfg.cache.storage.s3 != null) ''
+      export CACHE_STORAGE_S3_ACCESS_KEY_ID="$(cat "$CREDENTIALS_DIRECTORY/s3AccessKeyId")"
+      export CACHE_STORAGE_S3_SECRET_ACCESS_KEY="$(cat "$CREDENTIALS_DIRECTORY/s3SecretAccessKey")"
+    ''}
+
+    ${lib.optionalString (cfg.cache.redis != null && cfg.cache.redis.passwordFile != null) ''
+      export CACHE_REDIS_PASSWORD="$(cat "$CREDENTIALS_DIRECTORY/redisPassword")"
+    ''}
+
+    ${lib.optionalString (cfg.cache.databaseURLFile != null) ''
+      export CACHE_DATABASE_URL="$(cat "$CREDENTIALS_DIRECTORY/databaseURL")"
+    ''}
+
+    exec ${lib.getExe cfg.package} "$@"
+  '';
+
   globalFlags = lib.concatStringsSep " " (
     [ "--log-level='${cfg.logLevel}'" ]
     ++ (lib.optionals cfg.openTelemetry.enable (
@@ -27,19 +44,45 @@ let
         cfg.openTelemetry.grpcURL != null
       ) "--otel-grpc-url='${cfg.openTelemetry.grpcURL}'")
     ))
-    ++ (lib.optionals cfg.prometheus.enable [
-      "--prometheus-enabled"
-    ])
+    ++ (lib.optional cfg.prometheus.enable "--prometheus-enabled")
+    ++ (lib.optional (!cfg.analytics.reporting.enable) "--analytics-reporting-enabled=false")
   );
 
   serveFlags = lib.concatStringsSep " " (
     [
       "--cache-hostname='${cfg.cache.hostName}'"
-      "--cache-data-path='${cfg.cache.dataPath}'"
-      "--cache-database-url='${cfg.cache.databaseURL}'"
+      "--cache-lock-backend='${cfg.cache.lock.backend}'"
       "--cache-temp-path='${cfg.cache.tempPath}'"
       "--server-addr='${cfg.server.addr}'"
     ]
+    ++ (lib.optional (cfg.cache.databaseURL != null) "--cache-database-url='${cfg.cache.databaseURL}'")
+    ++ (lib.optionals (cfg.cache.redis != null) (
+      [
+        "--cache-redis-addrs='${builtins.concatStringsSep "," cfg.cache.redis.addresses}'"
+        "--cache-redis-db='${builtins.toString cfg.cache.redis.database}'"
+        "--cache-redis-pool-size='${builtins.toString cfg.cache.redis.poolSize}'"
+      ]
+      ++ (lib.optional (
+        cfg.cache.redis.username != null
+      ) "--cache-redis-username='${cfg.cache.redis.username}'")
+      ++ (lib.optional (
+        cfg.cache.redis.password != null
+      ) "--cache-redis-password='${cfg.cache.redis.password}'")
+      ++ (lib.optional cfg.cache.redis.useTLS "--cache-redis-use-tls")
+    ))
+    ++ (lib.optional (
+      cfg.cache.storage.s3 == null
+    ) "--cache-storage-local='${cfg.cache.storage.local}'")
+    ++ (lib.optionals (cfg.cache.storage.s3 != null) (
+      [
+        "--cache-storage-s3-bucket='${cfg.cache.storage.s3.bucket}'"
+        "--cache-storage-s3-endpoint='${cfg.cache.storage.s3.endpoint}'"
+      ]
+      ++ (lib.optional cfg.cache.storage.s3.forcePathStyle "--cache-storage-s3-force-path-style")
+      ++ (lib.optional (
+        cfg.cache.storage.s3.region != null
+      ) "--cache-storage-s3-region='${cfg.cache.storage.s3.region}'")
+    ))
     ++ (lib.optional cfg.cache.allowDeleteVerb "--cache-allow-delete-verb")
     ++ (lib.optional cfg.cache.allowPutVerb "--cache-allow-put-verb")
     ++ (lib.optional (cfg.cache.maxSize != null) "--cache-max-size='${cfg.cache.maxSize}'")
@@ -49,24 +92,59 @@ let
     ])
     ++ (lib.optional (cfg.cache.secretKeyPath != null) "--cache-secret-key-path='%d/secretKey'")
     ++ (lib.optional (!cfg.cache.signNarinfo) "--cache-sign-narinfo='false'")
-    ++ (lib.forEach cfg.upstream.caches (url: "--upstream-cache='${url}'"))
-    ++ (lib.forEach cfg.upstream.publicKeys (pk: "--upstream-public-key='${pk}'"))
+    ++ (lib.optional (
+      cfg.cache.upstream.dialerTimeout != null
+    ) "--cache-upstream-dialer-timeout='${cfg.cache.upstream.dialerTimeout}'")
+    ++ (lib.optional (
+      cfg.cache.upstream.responseHeaderTimeout != null
+    ) "--cache-upstream-response-header-timeout='${cfg.cache.upstream.responseHeaderTimeout}'")
+    ++ (lib.forEach cfg.cache.upstream.publicKeys (pk: "--cache-upstream-public-key='${pk}'"))
+    ++ (lib.forEach cfg.cache.upstream.urls (url: "--cache-upstream-url='${url}'"))
     ++ (lib.optional (cfg.netrcFile != null) "--netrc-file='${cfg.netrcFile}'")
   );
 
-  isSqlite = lib.strings.hasPrefix "sqlite:" cfg.cache.databaseURL;
+  isSqlite = cfg.cache.databaseURL != null && lib.strings.hasPrefix "sqlite:" cfg.cache.databaseURL;
 
-  dbPath = lib.removePrefix "sqlite:" cfg.cache.databaseURL;
-  dbDir = dirOf dbPath;
+  dbPath = if isSqlite then lib.removePrefix "sqlite:" cfg.cache.databaseURL else null;
+  dbDir = if isSqlite then dirOf dbPath else null;
 in
 {
+  imports = [
+    (lib.mkRenamedOptionModule
+      [ "services" "ncps" "cache" "dataPath" ]
+      [ "services" "ncps" "cache" "storage" "local" ]
+    )
+
+    (lib.mkRenamedOptionModule
+      [ "services" "ncps" "upstream" "caches" ]
+      [ "services" "ncps" "cache" "upstream" "urls" ]
+    )
+
+    (lib.mkRenamedOptionModule
+      [ "services" "ncps" "upstream" "publicKeys" ]
+      [ "services" "ncps" "cache" "upstream" "publicKeys" ]
+    )
+
+    (lib.mkRemovedOptionModule [
+      "services"
+      "ncps"
+      "dbmatePackage"
+    ] "dbmate is now wrapped within ncps package, you need to override ncps to change dbmate package")
+  ];
+
   options = {
     services.ncps = {
       enable = lib.mkEnableOption "ncps: Nix binary cache proxy service implemented in Go";
 
-      package = lib.mkPackageOption pkgs "ncps" { };
+      analytics.reporting.enable = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = ''
+          Enable reporting anonymous usage statistics (DB type, Lock type, Total Size) to the project maintainers.
+        '';
+      };
 
-      dbmatePackage = lib.mkPackageOption pkgs "dbmate" { };
+      package = lib.mkPackageOption pkgs "ncps" { };
 
       openTelemetry = {
         enable = lib.mkEnableOption "Enable OpenTelemetry logs, metrics, and tracing";
@@ -113,23 +191,23 @@ in
           '';
         };
 
-        dataPath = lib.mkOption {
-          type = lib.types.str;
-          default = "/var/lib/ncps";
-          description = ''
-            The local directory for storing configuration and cached store paths
-          '';
-        };
-
         databaseURL = lib.mkOption {
-          type = lib.types.str;
-          default = "sqlite:${cfg.cache.dataPath}/db/db.sqlite";
+          type = lib.types.nullOr lib.types.str;
+          default = "sqlite:${cfg.cache.storage.local}/db/db.sqlite";
           defaultText = "sqlite:/var/lib/ncps/db/db.sqlite";
           description = ''
             The URL of the database (currently only SQLite is supported)
           '';
         };
 
+        databaseURLFile = lib.mkOption {
+          type = lib.types.nullOr lib.types.path;
+          default = null;
+          description = ''
+            File containing the URL of the database.
+          '';
+        };
+
         lru = {
           schedule = lib.mkOption {
             type = lib.types.nullOr lib.types.str;
@@ -155,6 +233,17 @@ in
           };
         };
 
+        lock.backend = lib.mkOption {
+          type = lib.types.enum [
+            "local"
+            "redis"
+          ];
+          default = "local";
+          description = ''
+            Lock backend to use: 'local' (single instance), 'redis' (distributed).
+          '';
+        };
+
         maxSize = lib.mkOption {
           type = lib.types.nullOr lib.types.str;
           default = null;
@@ -165,8 +254,81 @@ in
           '';
         };
 
+        redis = lib.mkOption {
+          type = lib.types.nullOr (
+            lib.types.submodule {
+              options = {
+                addresses = lib.mkOption {
+                  type = lib.types.listOf lib.types.str;
+                  example = ''
+                    ["redis0:6379" "redis1:6379"]
+                  '';
+                  description = ''
+                    A list of host:port for the Redis servers that are part of a cluster.
+                    To use a single Redis instance, just set this to its single address.
+                  '';
+                };
+
+                database = lib.mkOption {
+                  type = lib.types.int;
+                  default = 0;
+                  description = ''
+                    Redis database number (0-15)
+                  '';
+                };
+
+                username = lib.mkOption {
+                  type = lib.types.nullOr lib.types.str;
+                  default = null;
+                  description = ''
+                    Redis username for authentication (for Redis ACL).
+                  '';
+                };
+
+                password = lib.mkOption {
+                  type = lib.types.nullOr lib.types.str;
+                  default = null;
+                  description = ''
+                    Redis password for authentication (for Redis ACL).
+                  '';
+                };
+
+                passwordFile = lib.mkOption {
+                  type = lib.types.nullOr lib.types.path;
+                  default = null;
+                  description = ''
+                    File containing the redis password for authentication (for Redis ACL).
+                  '';
+                };
+
+                poolSize = lib.mkOption {
+                  type = lib.types.int;
+                  default = 10;
+                  description = ''
+                    Redis connection pool size.
+                  '';
+                };
+
+                useTLS = lib.mkOption {
+                  type = lib.types.bool;
+                  default = false;
+                  description = ''
+                    Use TLS for Redis connection.
+                  '';
+                };
+              };
+            }
+          );
+
+          default = null;
+
+          description = ''
+            Configure Redis.
+          '';
+        };
+
         secretKeyPath = lib.mkOption {
-          type = lib.types.nullOr lib.types.str;
+          type = lib.types.nullOr lib.types.path;
           default = null;
           description = ''
             The path to load the secretKey for signing narinfos. Leave this
@@ -174,8 +336,77 @@ in
           '';
         };
 
+        storage = {
+          local = lib.mkOption {
+            type = lib.types.path;
+            default = "/var/lib/ncps";
+            description = ''
+              The local directory for storing configuration and cached store
+              paths. This is ignored if services.ncps.cache.storage.s3 is not
+              null.
+            '';
+          };
+
+          s3 = lib.mkOption {
+            type = lib.types.nullOr (
+              lib.types.submodule {
+                options = {
+                  bucket = lib.mkOption {
+                    type = lib.types.str;
+                    description = ''
+                      The name of the S3 bucket.
+                    '';
+                  };
+
+                  endpoint = lib.mkOption {
+                    type = lib.types.str;
+                    description = ''
+                      S3-compatible endpoint URL with scheme.
+                    '';
+                    example = "https://s3.amazonaws.com";
+                  };
+
+                  forcePathStyle = lib.mkOption {
+                    type = lib.types.bool;
+                    default = false;
+                    description = ''
+                      Force path-style S3 addressing (bucket/key vs key.bucket).
+                    '';
+                  };
+
+                  region = lib.mkOption {
+                    type = lib.types.nullOr lib.types.str;
+                    default = null;
+                    description = ''
+                      The S3 region.
+                    '';
+                  };
+
+                  accessKeyIdPath = lib.mkOption {
+                    type = lib.types.path;
+                    description = ''
+                      The path to a file containing only the access-key-id.
+                    '';
+                  };
+
+                  secretAccessKeyPath = lib.mkOption {
+                    type = lib.types.path;
+                    description = ''
+                      The path to a file containing only the secret-access-key.
+                    '';
+                  };
+                };
+              }
+            );
+            default = null;
+            description = ''
+              Use S3 for storage instead of local storage.
+            '';
+          };
+        };
+
         tempPath = lib.mkOption {
-          type = lib.types.str;
+          type = lib.types.path;
           default = "/tmp";
           description = ''
             The path to the temporary directory that is used by the cache to download NAR files
@@ -190,6 +421,45 @@ in
             Whether to sign narInfo files or passthru as-is from upstream
           '';
         };
+
+        upstream = {
+          dialerTimeout = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = ''
+              Timeout for establishing TCP connections to upstream caches (e.g., 3s, 5s, 10s).
+            '';
+          };
+
+          responseHeaderTimeout = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            example = "5s";
+            description = ''
+              Timeout for waiting for upstream server's response headers.
+            '';
+          };
+
+          publicKeys = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            default = [ ];
+            example = [ "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" ];
+            description = ''
+              A list of public keys of upstream caches in the format
+              `host[-[0-9]*]:public-key`. This flag is used to verify the
+              signatures of store paths downloaded from upstream caches.
+            '';
+          };
+
+          urls = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            example = [ "https://cache.nixos.org" ];
+            description = ''
+              A list of URLs of upstream binary caches.
+            '';
+          };
+        };
+
       };
 
       server = {
@@ -202,29 +472,8 @@ in
         };
       };
 
-      upstream = {
-        caches = lib.mkOption {
-          type = lib.types.listOf lib.types.str;
-          example = [ "https://cache.nixos.org" ];
-          description = ''
-            A list of URLs of upstream binary caches.
-          '';
-        };
-
-        publicKeys = lib.mkOption {
-          type = lib.types.listOf lib.types.str;
-          default = [ ];
-          example = [ "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" ];
-          description = ''
-            A list of public keys of upstream caches in the format
-            `host[-[0-9]*]:public-key`. This flag is used to verify the
-            signatures of store paths downloaded from upstream caches.
-          '';
-        };
-      };
-
       netrcFile = lib.mkOption {
-        type = lib.types.nullOr lib.types.str;
+        type = lib.types.nullOr lib.types.path;
         default = null;
         example = "/etc/nix/netrc";
         description = ''
@@ -237,10 +486,27 @@ in
 
   config = lib.mkIf cfg.enable {
     assertions = [
+      {
+        assertion = lib.xor (cfg.cache.databaseURL != null) (cfg.cache.databaseURLFile != null);
+        message = "You must specify exactly one of config.ncps.cache.databaseURL or config.ncps.cache.databaseURLFile";
+      }
       {
         assertion = cfg.cache.lru.schedule == null || cfg.cache.maxSize != null;
         message = "You must specify config.ncps.cache.lru.schedule when config.ncps.cache.maxSize is set";
       }
+      {
+        assertion =
+          cfg.cache.redis == null || cfg.cache.redis.password == null || cfg.cache.redis.passwordFile == null;
+        message = "You cannot specify both config.ncps.cache.redis.password and config.ncps.cache.redis.passwordFile";
+      }
+      {
+        assertion = cfg.cache.lock.backend == "redis" -> cfg.cache.redis != null;
+        message = "You must specify config.ncps.cache.redis when config.ncps.cache.lock.backend is set to 'redis'";
+      }
+      {
+        assertion = cfg.cache.redis != null -> cfg.cache.lock.backend == "redis";
+        message = "You must set config.ncps.cache.lock.backend to 'redis' when config.ncps.cache.redis is set";
+      }
     ];
 
     users.users.ncps = {
@@ -249,34 +515,23 @@ in
     };
     users.groups.ncps = { };
 
-    systemd.services.ncps-create-directories = {
-      description = "Created required directories by ncps";
-      serviceConfig = {
-        Type = "oneshot";
-        UMask = "0066";
-      };
-      script =
-        (lib.optionalString (cfg.cache.dataPath != "/var/lib/ncps") ''
-          if ! test -d ${cfg.cache.dataPath}; then
-            mkdir -p ${cfg.cache.dataPath}
-            chown ncps:ncps ${cfg.cache.dataPath}
-          fi
-        '')
-        + (lib.optionalString isSqlite ''
-          if ! test -d ${dbDir}; then
-            mkdir -p ${dbDir}
-            chown ncps:ncps ${dbDir}
-          fi
-        '')
-        + (lib.optionalString (cfg.cache.tempPath != "/tmp") ''
-          if ! test -d ${cfg.cache.tempPath}; then
-            mkdir -p ${cfg.cache.tempPath}
-            chown ncps:ncps ${cfg.cache.tempPath}
-          fi
-        '');
-      wantedBy = [ "ncps.service" ];
-      before = [ "ncps.service" ];
-    };
+    systemd.tmpfiles.settings.ncps =
+      let
+        perms = {
+          group = "ncps";
+          mode = "0700";
+          user = "ncps";
+        };
+      in
+      lib.mkMerge [
+        (lib.mkIf (cfg.cache.storage.s3 == null && cfg.cache.storage.local != "/var/lib/ncps") {
+          "${cfg.cache.storage.local}".d = perms;
+        })
+
+        (lib.mkIf isSqlite { "${dbDir}".d = perms; })
+
+        (lib.mkIf (cfg.cache.tempPath != "/tmp") { "${cfg.cache.tempPath}".d = perms; })
+      ];
 
     systemd.services.ncps = {
       description = "ncps binary cache proxy service";
@@ -286,31 +541,61 @@ in
       wantedBy = [ "multi-user.target" ];
 
       preStart = ''
-        ${lib.getExe cfg.dbmatePackage} --migrations-dir=${cfg.package}/share/ncps/db/migrations --url=${cfg.cache.databaseURL} up
+        ${lib.optionalString (cfg.cache.databaseURLFile != null) ''
+          export DATABASE_URL="$(cat "$CREDENTIALS_DIRECTORY/databaseURL")"
+        ''}
+        ${lib.optionalString (cfg.cache.databaseURL != null) ''
+          export DATABASE_URL="${cfg.cache.databaseURL}"
+        ''}
+        echo ${cfg.package}/bin/dbmate-ncps up
+        ${cfg.package}/bin/dbmate-ncps up
       '';
 
       serviceConfig = lib.mkMerge [
         {
-          ExecStart = "${lib.getExe cfg.package} ${globalFlags} serve ${serveFlags}";
+          ExecStart = "${ncpsWrapper} ${globalFlags} serve ${serveFlags}";
           User = "ncps";
           Group = "ncps";
           Restart = "on-failure";
           RuntimeDirectory = "ncps";
         }
 
-        # credentials
+        # credentials for cache.secretKeyPath
         (lib.mkIf (cfg.cache.secretKeyPath != null) {
-          LoadCredential = "secretKey:${cfg.cache.secretKeyPath}";
+          LoadCredential = lib.singleton "secretKey:${cfg.cache.secretKeyPath}";
+        })
+
+        # credentials for cache.storage.s3 accessKeyIdPath and secretAccessKeyPath
+        (lib.mkIf (cfg.cache.storage.s3 != null) {
+          LoadCredential = [
+            "s3AccessKeyId:${cfg.cache.storage.s3.accessKeyIdPath}"
+            "s3SecretAccessKey:${cfg.cache.storage.s3.secretAccessKeyPath}"
+          ];
+        })
+
+        # credentials for Redis
+        (lib.mkIf (cfg.cache.redis != null && cfg.cache.redis.passwordFile != null) {
+          LoadCredential = lib.singleton "redisPassword:${cfg.cache.redis.passwordFile}";
+        })
+
+        (lib.mkIf (cfg.cache.databaseURLFile != null) {
+          LoadCredential = lib.singleton "databaseURL:${cfg.cache.databaseURLFile}";
         })
 
         # ensure permissions on required directories
-        (lib.mkIf (cfg.cache.dataPath != "/var/lib/ncps") {
-          ReadWritePaths = [ cfg.cache.dataPath ];
+        (lib.mkIf (cfg.cache.storage.s3 == null && cfg.cache.storage.local != "/var/lib/ncps") {
+          ReadWritePaths = [ cfg.cache.storage.local ];
         })
-        (lib.mkIf (cfg.cache.dataPath == "/var/lib/ncps") {
+        (lib.mkIf (cfg.cache.storage.s3 == null && cfg.cache.storage.local == "/var/lib/ncps") {
           StateDirectory = "ncps";
           StateDirectoryMode = "0700";
         })
+        (lib.mkIf (cfg.cache.storage.s3 != null && isSqlite && lib.strings.hasPrefix "/var/lib/ncps" dbDir)
+          {
+            StateDirectory = "ncps";
+            StateDirectoryMode = "0700";
+          }
+        )
         (lib.mkIf (isSqlite && !lib.strings.hasPrefix "/var/lib/ncps" dbDir) {
           ReadWritePaths = [ dbDir ];
         })
@@ -357,7 +642,8 @@ in
       ];
 
       unitConfig.RequiresMountsFor = lib.concatStringsSep " " (
-        [ "${cfg.cache.dataPath}" ] ++ lib.optional isSqlite dbDir
+        (lib.optional (cfg.cache.storage.s3 == null) "${cfg.cache.storage.local}")
+        ++ (lib.optional isSqlite dbDir)
       );
     };
   };

nixos/tests/all-tests.nix

@@ -1029,10 +1029,15 @@ in
   nbd = runTest ./nbd.nix;
   ncdns = runTest ./ncdns.nix;
   ncps = runTest ./ncps.nix;
-  ncps-custom-cache-datapath = runTest {
+  ncps-custom-sqlite-directory = runTest {
     imports = [ ./ncps.nix ];
-    defaults.services.ncps.cache.dataPath = "/path/to/ncps";
+    defaults.services.ncps.cache.databaseURL = "sqlite:/path/to/ncps/db.sqlite";
   };
+  ncps-custom-storage-local = runTest {
+    imports = [ ./ncps.nix ];
+    defaults.services.ncps.cache.storage.local = "/path/to/ncps";
+  };
+  ncps-ha = runTest ./ncps-ha.nix;
   ndppd = runTest ./ndppd.nix;
   nebula-lighthouse-service = runTest ./nebula-lighthouse-service.nix;
   nebula.connectivity = runTest ./nebula/connectivity.nix;

nixos/tests/ncps-ha.nix

@@ -0,0 +1,218 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+let
+  # s3 creds
+  bucket = "ncps";
+  region = "us-west-1";
+  accessKey = builtins.toFile "minio-access-key" "easy-key";
+  secretKey = builtins.toFile "minio-secret-key" "easy-secret";
+
+  # pg creds
+  postgresPassword = "easypwd";
+
+  # redis creds
+  redisPassword = "easypwd";
+
+  initMinio = pkgs.writeShellScriptBin "init-minio.sh" ''
+    set -euo pipefail
+
+    mc alias set local "http://127.0.0.1:9000" minioadmin minioadmin
+    mc mb local/${bucket}
+    mc admin user svcacct add --access-key "$(cat ${accessKey})" --secret-key "$(cat ${secretKey})" local minioadmin
+  '';
+
+  ncpsAttrs = hostname: {
+    services.ncps = {
+      enable = true;
+
+      analytics.reporting.enable = false;
+
+      cache = {
+        hostName = hostname;
+
+        databaseURL = "postgres://ncps:${lib.escapeURL postgresPassword}@postgres:5432/ncps?sslmode=disable";
+
+        lock.backend = "redis";
+
+        secretKeyPath = builtins.toString (
+          pkgs.writeText "ncps-cache-key" "ncps:dcrGsrku0KvltFhrR5lVIMqyloAdo0y8vYZOeIFUSLJS2IToL7dPHSSCk/fi+PJf8EorpBn8PU7MNhfvZoI8mA=="
+        );
+
+        redis = {
+          addresses = [ "redis:6379" ];
+          passwordFile = builtins.toFile "redis-password" redisPassword;
+        };
+
+        storage.s3 = {
+          inherit bucket region;
+
+          endpoint = "http://minio:9000";
+
+          accessKeyIdPath = accessKey;
+          secretAccessKeyPath = secretKey;
+        };
+
+        upstream = {
+          urls = [ "http://harmonia:5000" ];
+          publicKeys = [
+            "cache.example.com-1:eIGQXcGQpc00x6/XFcyacLEUmC07u4RAEHt5Y8vdglo="
+          ];
+        };
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = [ 8501 ];
+  };
+in
+{
+  name = "ncps-storage-s3";
+  meta = with lib.maintainers; {
+    maintainers = [
+      aciceri
+      kalbasit
+    ];
+  };
+
+  nodes = {
+    client0 = {
+      nix.settings = {
+        substituters = lib.mkForce [ "http://ncps0:8501" ];
+        trusted-public-keys = lib.mkForce [
+          "ncps:UtiE6C+3Tx0kgpP34vjyX/BKK6QZ/D1OzDYX72aCPJg="
+        ];
+      };
+    };
+
+    client1 = {
+      nix.settings = {
+        substituters = lib.mkForce [ "http://ncps1:8501" ];
+        trusted-public-keys = lib.mkForce [
+          "ncps:UtiE6C+3Tx0kgpP34vjyX/BKK6QZ/D1OzDYX72aCPJg="
+        ];
+      };
+    };
+
+    harmonia = {
+      services.harmonia = {
+        enable = true;
+        signKeyPaths = [
+          (pkgs.writeText "cache-key" "cache.example.com-1:9FhO0w+7HjZrhvmzT1VlAZw4OSAlFGTgC24Seg3tmPl4gZBdwZClzTTHr9cVzJpwsRSYLTu7hEAQe3ljy92CWg==")
+        ];
+        settings.priority = 35;
+      };
+
+      networking.firewall.allowedTCPPorts = [ 5000 ];
+      system.extraDependencies = [ pkgs.emptyFile ];
+    };
+
+    minio = {
+      services.minio = {
+        inherit region;
+
+        enable = true;
+      };
+
+      networking.firewall.allowedTCPPorts = [ 9000 ];
+      environment.systemPackages = [
+        pkgs.minio-client
+        initMinio
+      ];
+    };
+
+    ncps0 = lib.mkMerge [
+      (ncpsAttrs "ncps0")
+      {
+        services.ncps.cache.databaseURL = lib.mkForce null;
+        services.ncps.cache.databaseURLFile = builtins.toFile "db-url" "postgres://ncps:${lib.escapeURL postgresPassword}@postgres:5432/ncps?sslmode=disable";
+      }
+    ];
+    ncps1 = ncpsAttrs "ncps1";
+
+    postgres = {
+      services.postgresql = {
+        enable = true;
+        enableTCPIP = true;
+        authentication = ''
+          host all all all scram-sha-256
+        '';
+        initialScript = pkgs.writeText "init-postgres.sql" ''
+          CREATE DATABASE "ncps" WITH ENCODING = 'UTF8';
+          CREATE ROLE "ncps" WITH LOGIN PASSWORD '${
+            builtins.replaceStrings [ "'" ] [ "''" ] postgresPassword
+          }';
+          ALTER DATABASE "ncps" OWNER TO "ncps";
+        '';
+      };
+
+      networking.firewall.allowedTCPPorts = [ 5432 ];
+    };
+
+    redis = {
+      services.redis.servers.ncps = {
+        enable = true;
+        openFirewall = true;
+        port = 6379;
+        requirePass = redisPassword;
+        bind = null;
+      };
+    };
+  };
+
+  testScript =
+    { nodes, ... }:
+    let
+      narinfoName =
+        (lib.strings.removePrefix "/nix/store/" (
+          lib.strings.removeSuffix "-empty-file" pkgs.emptyFile.outPath
+        ))
+        + ".narinfo";
+
+      narinfoNameChars = lib.strings.stringToCharacters narinfoName;
+
+      narinfoPath = lib.concatStringsSep "/" [
+        (builtins.head nodes.minio.services.minio.dataDir)
+        bucket
+        "store/narinfo"
+        (lib.lists.elemAt narinfoNameChars 0)
+        ((lib.lists.elemAt narinfoNameChars 0) + (lib.lists.elemAt narinfoNameChars 1))
+        narinfoName
+        "xl.meta"
+      ];
+    in
+    ''
+      harmonia.start()
+      minio.start()
+      postgres.start()
+      redis.start()
+
+      minio.wait_for_unit("minio.service")
+
+      minio.wait_until_succeeds("init-minio.sh")
+
+      postgres.wait_for_unit("postgresql.service")
+      redis.wait_for_unit("redis-ncps.service")
+
+      redis.wait_until_succeeds("redis-cli -h redis -p 6379 -a '${redisPassword}' ping")
+
+      start_all()
+
+      harmonia.wait_for_unit("harmonia.service")
+
+      ncps0.wait_for_unit("ncps.service")
+      ncps1.wait_for_unit("ncps.service")
+
+      client0.wait_until_succeeds("curl -f http://ncps0:8501/ | grep '\"hostname\":\"${toString nodes.ncps0.services.ncps.cache.hostName}\"' >&2")
+      client1.wait_until_succeeds("curl -f http://ncps1:8501/ | grep '\"hostname\":\"${toString nodes.ncps1.services.ncps.cache.hostName}\"' >&2")
+
+      client0.succeed("cat /etc/nix/nix.conf >&2")
+      client0.succeed("nix-store --realise ${pkgs.emptyFile}")
+
+      client1.succeed("cat /etc/nix/nix.conf >&2")
+      client1.succeed("nix-store --realise ${pkgs.emptyFile}")
+
+      minio.succeed("cat ${narinfoPath} >&2")
+    '';
+}

nixos/tests/ncps.nix

@@ -6,6 +6,12 @@
 
 {
   name = "ncps";
+  meta = with lib.maintainers; {
+    maintainers = [
+      aciceri
+      kalbasit
+    ];
+  };
 
   nodes = {
     harmonia = {
@@ -25,25 +31,27 @@
       services.ncps = {
         enable = true;
 
+        analytics.reporting.enable = false;
+
         cache = {
           hostName = "ncps";
           secretKeyPath = toString (
             pkgs.writeText "ncps-cache-key" "ncps:dcrGsrku0KvltFhrR5lVIMqyloAdo0y8vYZOeIFUSLJS2IToL7dPHSSCk/fi+PJf8EorpBn8PU7MNhfvZoI8mA=="
           );
-        };
 
-        upstream = {
-          caches = [ "http://harmonia:5000" ];
-          publicKeys = [
-            "cache.example.com-1:eIGQXcGQpc00x6/XFcyacLEUmC07u4RAEHt5Y8vdglo="
-          ];
+          upstream = {
+            urls = [ "http://harmonia:5000" ];
+            publicKeys = [
+              "cache.example.com-1:eIGQXcGQpc00x6/XFcyacLEUmC07u4RAEHt5Y8vdglo="
+            ];
+          };
         };
       };
 
       networking.firewall.allowedTCPPorts = [ 8501 ];
     };
 
-    client01 = {
+    client = {
       nix.settings = {
         substituters = lib.mkForce [ "http://ncps:8501" ];
         trusted-public-keys = lib.mkForce [
@@ -65,7 +73,7 @@
       narinfoNameChars = lib.strings.stringToCharacters narinfoName;
 
       narinfoPath = lib.concatStringsSep "/" [
-        nodes.ncps.services.ncps.cache.dataPath
+        nodes.ncps.services.ncps.cache.storage.local
         "store/narinfo"
         (lib.lists.elemAt narinfoNameChars 0)
         ((lib.lists.elemAt narinfoNameChars 0) + (lib.lists.elemAt narinfoNameChars 1))
@@ -79,10 +87,10 @@
 
       ncps.wait_for_unit("ncps.service")
 
-      client01.wait_until_succeeds("curl -f http://ncps:8501/ | grep '\"hostname\":\"${toString nodes.ncps.services.ncps.cache.hostName}\"' >&2")
+      client.wait_until_succeeds("curl -f http://ncps:8501/ | grep '\"hostname\":\"${toString nodes.ncps.services.ncps.cache.hostName}\"' >&2")
 
-      client01.succeed("cat /etc/nix/nix.conf >&2")
-      client01.succeed("nix-store --realise ${pkgs.emptyFile}")
+      client.succeed("cat /etc/nix/nix.conf >&2")
+      client.succeed("nix-store --realise ${pkgs.emptyFile}")
 
       ncps.succeed("cat ${narinfoPath} >&2")
     '';

pkgs/applications/editors/jetbrains/ides/goland.nix

@@ -12,20 +12,20 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/go/goland-2025.3.1.tar.gz";
-      hash = "sha256-FhhHHmKbil4YZ2TdHPQBor2arTui/3j92Jb1Gncn+Uo=";
+      url = "https://download.jetbrains.com/go/goland-2025.3.1.1.tar.gz";
+      hash = "sha256-+4A+rTMwiXjKuBI2dUf90F9KUFaGlB2xgO+BX09WnWw=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/go/goland-2025.3.1-aarch64.tar.gz";
-      hash = "sha256-5lsXviK9nwHogCCwVTkeqIBe1G/ZWDUzD3z7Hyx6y0Y=";
+      url = "https://download.jetbrains.com/go/goland-2025.3.1.1-aarch64.tar.gz";
+      hash = "sha256-zGPly+ELyQYGrq5eoOqeujDptL7aIOY0KK5FVaSFZ8k=";
     };
     x86_64-darwin = {
-      url = "https://download.jetbrains.com/go/goland-2025.3.1.dmg";
-      hash = "sha256-QBsP0ar6550uZpj1JEutHSRHMrgfDZI8fZ7sZ7uoulk=";
+      url = "https://download.jetbrains.com/go/goland-2025.3.1.1.dmg";
+      hash = "sha256-xZeuUIyqPUoOPWzuwuCS0nkasvuwLSc43tcSSGZrHS0=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/go/goland-2025.3.1-aarch64.dmg";
-      hash = "sha256-yVmu/WfRsERQkySjCWW3PB4p/XCOAHF8/g6Op1ibsFA=";
+      url = "https://download.jetbrains.com/go/goland-2025.3.1.1-aarch64.dmg";
+      hash = "sha256-vV8TxLG/KEUuAcN1lsCKT6v4tg6UmbUU7U5OCJ8rhXQ=";
     };
   };
   # update-script-end: urls
@@ -39,8 +39,8 @@ in
   product = "Goland";
 
   # update-script-start: version
-  version = "2025.3.1";
-  buildNumber = "253.29346.255";
+  version = "2025.3.1.1";
+  buildNumber = "253.29346.379";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

pkgs/applications/editors/jetbrains/ides/rust-rover.nix

@@ -18,20 +18,20 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/rustrover/RustRover-2025.3.1.tar.gz";
-      hash = "sha256-Whs04QocWe7jBpQja6qCM8d4dYB2k4G+AbTMsJYY7Ik=";
+      url = "https://download.jetbrains.com/rustrover/RustRover-2025.3.2.tar.gz";
+      hash = "sha256-c6Pou6a27cwCcvcpKnhQOt2Emf+iSHyOIQIyXTEB3hE=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/rustrover/RustRover-2025.3.1-aarch64.tar.gz";
-      hash = "sha256-+w+BydKipgRxhISVSyYaZCvp7W9R3pj83GztsysKTJ4=";
+      url = "https://download.jetbrains.com/rustrover/RustRover-2025.3.2-aarch64.tar.gz";
+      hash = "sha256-YUBymEX/fv71/cFrBUi0jvgTHn0eFh02tFT/HIE3+5k=";
     };
     x86_64-darwin = {
-      url = "https://download.jetbrains.com/rustrover/RustRover-2025.3.1.dmg";
-      hash = "sha256-OJmHVFKlGC25OxMsANvIQ5T/tjdDC5fyOQvoq7BBJTc=";
+      url = "https://download.jetbrains.com/rustrover/RustRover-2025.3.2.dmg";
+      hash = "sha256-UlcMaFh7o/X8RkfjUr1fsDrHvN/rFhH7X1rvwaMTSzY=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/rustrover/RustRover-2025.3.1-aarch64.dmg";
-      hash = "sha256-EDoS7Rw3trOM/11jfn3HuNzHj1xXa6OLj4Ysa6NkfVI=";
+      url = "https://download.jetbrains.com/rustrover/RustRover-2025.3.2-aarch64.dmg";
+      hash = "sha256-fOX2HBJA8CbLVMLGxMMCmw0CFbKtEiW+WgkiIgwIqLE=";
     };
   };
   # update-script-end: urls
@@ -45,8 +45,8 @@ in
   product = "RustRover";
 
   # update-script-start: version
-  version = "2025.3.1";
-  buildNumber = "253.29346.139";
+  version = "2025.3.2";
+  buildNumber = "253.29346.361";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

pkgs/applications/emulators/libretro/cores/snes9x.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "snes9x";
-  version = "0-unstable-2025-11-08";
+  version = "0-unstable-2026-01-10";
 
   src = fetchFromGitHub {
     owner = "snes9xgit";
     repo = "snes9x";
-    rev = "83ebd9d9d94521dde231beac0ad5ca253bd767f1";
-    hash = "sha256-ZH6UnwtvtaTQLyFG4FyK+I1rjDibuA4lL2EuR8zGL0E=";
+    rev = "4b51d103b909e0c1ac566b6865b9f6229a7b59e4";
+    hash = "sha256-ic8yR3mvql7QMGSp3QN+31MKkDvY0Tfsxx51dhUVs2c=";
   };
 
   makefile = "Makefile";

pkgs/applications/gis/qgis/spatialite-path.patch

@@ -0,0 +1,14 @@
+diff --git a/python/utils.py b/python/utils.py
+index 1234567890..abcdef1234 100644
+--- a/python/utils.py
++++ b/python/utils.py
+@@ -938,6 +938,7 @@ def spatialite_connect(*args, **kwargs):
+     con = sqlite3.dbapi2.connect(*args, **kwargs)
+     con.enable_load_extension(True)
+     cur = con.cursor()
+     libs = [
++        ("@spatialiteLib@", "sqlite3_modspatialite_init"),
+         # SpatiaLite >= 4.2 and Sqlite >= 3.7.17, should work on all platforms
+         ("mod_spatialite", "sqlite3_modspatialite_init"),
+         # SpatiaLite >= 4.2 and Sqlite < 3.7.17 (Travis)
+         ("mod_spatialite.so", "sqlite3_modspatialite_init"),

pkgs/applications/gis/qgis/unwrapped-ltr.nix

@@ -146,6 +146,9 @@ mkDerivation rec {
       pyQt5PackageDir = "${py.pkgs.pyqt5}/${py.pkgs.python.sitePackages}";
       qsciPackageDir = "${py.pkgs.qscintilla-qt5}/${py.pkgs.python.sitePackages}";
     })
+    (replaceVars ./spatialite-path.patch {
+      spatialiteLib = "${libspatialite}/lib/mod_spatialite.so";
+    })
   ];
 
   # Add path to Qt platform plugins

pkgs/applications/gis/qgis/unwrapped.nix

@@ -150,6 +150,9 @@ mkDerivation rec {
       pyQt5PackageDir = "${py.pkgs.pyqt5}/${py.pkgs.python.sitePackages}";
       qsciPackageDir = "${py.pkgs.qscintilla-qt5}/${py.pkgs.python.sitePackages}";
     })
+    (replaceVars ./spatialite-path.patch {
+      spatialiteLib = "${libspatialite}/lib/mod_spatialite.so";
+    })
   ];
 
   # Add path to Qt platform plugins

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -1274,11 +1274,11 @@
     "vendorHash": "sha256-IR6KjFW5GbsOIm3EEFyx3ctwhbifZlcNaZeGhbeK/Wo="
   },
   "sysdiglabs_sysdig": {
-    "hash": "sha256-04LRhKCh1AmhhKaDT8+Un9hziJ5l7qrCCKAyBEacEOI=",
+    "hash": "sha256-BovhCb+01LJUE62geNJmDwpzV0ucQLpVWjXwfxsClyI=",
     "homepage": "https://registry.terraform.io/providers/sysdiglabs/sysdig",
     "owner": "sysdiglabs",
     "repo": "terraform-provider-sysdig",
-    "rev": "v3.3.1",
+    "rev": "v3.4.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-rWiafaFE1RolO9JUN1WoW4EWJjR7kpfeVEOTLf21j50="
   },

pkgs/by-name/as/asciinema_3/package.nix

@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "asciinema";
-  version = "3.0.1";
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "asciinema";
     repo = "asciinema";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jWRq/LeDdCETiOMkWr9EIWztb14IYGCSo05QPw5HZZk=";
+    hash = "sha256-luIGJ4OvQSnNzyuTrjXliuMeIzPZwRnyKYdAo8mnvGg=";
   };
 
-  cargoHash = "sha256-bGhShwH4BxE3O4/B8KSK1o7IXNDBmGuVt4kx5s8W/go=";
+  cargoHash = "sha256-5hPk9rtpjK5dk1fgYXQ5KdHNvbuOTWYGpCQVLxlEvq4=";
 
   env.ASCIINEMA_GEN_DIR = "gendir";
 

pkgs/by-name/az/azurehound/package.nix

@@ -6,15 +6,15 @@
   versionCheckHook,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "azurehound";
-  version = "2.8.2";
+  version = "2.8.3";
 
   src = fetchFromGitHub {
     owner = "SpecterOps";
     repo = "AzureHound";
-    tag = "v${version}";
-    hash = "sha256-eXcHBwWjZhpKwUK+sSXEDFiiBlBD+b6E50cV3QX38fw=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ecLpNIYczim4dLbNwkOtwieJrjoSOXv4KHvSMuMjOw0=";
   };
 
   vendorHash = "sha256-+iNFWKFNON4HX2mf4O29zAdElEkIGIx55Wi9MRtg1dg=";
@@ -24,7 +24,7 @@ buildGoModule rec {
   ldflags = [
     "-s"
     "-w"
-    "-X=github.com/bloodhoundad/azurehound/v2/constants.Version=${version}"
+    "-X=github.com/bloodhoundad/azurehound/v2/constants.Version=${finalAttrs.version}"
   ];
 
   doInstallCheck = true;
@@ -32,10 +32,10 @@ buildGoModule rec {
   meta = {
     description = "Azure Data Exporter for BloodHound";
     homepage = "https://github.com/SpecterOps/AzureHound";
-    changelog = "https://github.com/SpecterOps/AzureHound/releases/tag/v${version}";
+    changelog = "https://github.com/SpecterOps/AzureHound/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "azurehound";
     broken = stdenv.hostPlatform.isDarwin;
   };
-}
+})

pkgs/by-name/ba/bacon/package.nix

@@ -27,16 +27,16 @@ in
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "bacon";
-  version = "3.21.0";
+  version = "3.22.0";
 
   src = fetchFromGitHub {
     owner = "Canop";
     repo = "bacon";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mgSFnSnghJvaOrgg1AICNRUGNSrNijL9caDyN8kj8Dw=";
+    hash = "sha256-eHMpzFKweKGI0REPudyy4veFTXDZc+AX626ylSN2yvU=";
   };
 
-  cargoHash = "sha256-aSLaPirkszoGnAyt9U0LsKXL2IuR6nSInb/KQBVQ69k=";
+  cargoHash = "sha256-nUO9xVQ51dNWB5fxDZBLlzOWNE5HDAh6xYa5OdBPr4M=";
 
   buildFeatures = lib.optionals withSound [
     "sound"
@@ -76,7 +76,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     description = "Background rust code checker";
     mainProgram = "bacon";
     homepage = "https://github.com/Canop/bacon";
-    changelog = "https://github.com/Canop/bacon/blob/v${finalAttrs.version}/CHANGELOG.md";
+    changelog = "https://github.com/Canop/bacon/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.agpl3Only;
     maintainers = with lib.maintainers; [
       FlorianFranzen

pkgs/by-name/br/brave/package.nix

@@ -3,24 +3,24 @@
 
 let
   pname = "brave";
-  version = "1.85.120";
+  version = "1.86.139";
 
   allArchives = {
     aarch64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_arm64.deb";
-      hash = "sha256-Q645SeKK2oBfzVOVwKi+VgjkcKA3hyBCK1uYkey29Zk=";
+      hash = "sha256-+KJzQZuCf2zpouF+hZ2hAmJ57yWt2qAemdYt6X4x+P0=";
     };
     x86_64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-      hash = "sha256-5Sa1dfX3uMUkTi/AKLRuf/lmdPXuyVHPD7eN7EUAiRo=";
+      hash = "sha256-l0KtiMU+L7k6i5sjiPC24CABUdn9ax1uKqkqWe/flPM=";
     };
     aarch64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-arm64.zip";
-      hash = "sha256-XNafmhhPIo1McFVHERpefQFDCLQZJFreoReySyUYAkY=";
+      hash = "sha256-Iv5UjfYzR+nmiW/LY22iOUvjGIbTRkjWC3fDigCmbFo=";
     };
     x86_64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-x64.zip";
-      hash = "sha256-BqNhfkNMsnbydr+fnHiXhQih2UjpzbjeD+VNrvA3CNU=";
+      hash = "sha256-X9McQDYPQ93zzTjR5Lq3+OFxjWGAR/JGa/u39GZL1Vs=";
     };
   };
 

pkgs/by-name/co/coulr/package.nix

@@ -17,7 +17,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "coulr";
-  version = "2.1.0";
+  version = "2.2.0";
 
   pyproject = false;
   dontWrapGApps = true;
@@ -26,7 +26,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "Huluti";
     repo = "Coulr";
     tag = version;
-    hash = "sha256-1xnL5AWl/rLQu3i9m6uxbS4QT+690hmEW8kYTwkg7Gw=";
+    hash = "sha256-ATKD2PmNz8QRIqGHEuNNe8ZGjcvAU8qpqQtXWR2JBSA=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/dn/dnsmonster/package.nix

@@ -6,34 +6,34 @@
   libpcap,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "dnsmonster";
-  version = "1.0.2";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "mosajjal";
     repo = "dnsmonster";
-    tag = "v${version}";
-    hash = "sha256-sg+88WbjlfcPgWQ9RnmLr6/VWwXEjsctfWt4TGx1oNc=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-+GFkGUR3XKDgrxVAZ3MuPxGyI0oGROdhHKMBwMSvoBI=";
   };
 
-  vendorHash = "sha256-PIiSpxfZmhxWkHUnoDYKppI7/gzGm0RKh7u9HK4zrEU=";
+  vendorHash = "sha256-7rIBbaYr1dgC0ArcuwZelHKG5TLIQDV9JSBoYOcz+C0=";
 
   buildInputs = [ libpcap ];
 
   ldflags = [
     "-s"
     "-w"
-    "-X=github.com/mosajjal/dnsmonster/util.releaseVersion=${version}"
+    "-X=github.com/mosajjal/dnsmonster/util.releaseVersion=${finalAttrs.version}"
   ];
 
   meta = {
     description = "Passive DNS Capture and Monitoring Toolkit";
     homepage = "https://github.com/mosajjal/dnsmonster";
-    changelog = "https://github.com/mosajjal/dnsmonster/releases/tag/${src.tag}";
+    changelog = "https://github.com/mosajjal/dnsmonster/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.gpl2Only;
     maintainers = with lib.maintainers; [ fab ];
     broken = stdenv.hostPlatform.isDarwin;
     mainProgram = "dnsmonster";
   };
-}
+})

pkgs/by-name/e1/e17gtk/package.nix

@@ -1,31 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "e17gtk";
-  version = "3.22.2";
-
-  src = fetchFromGitHub {
-    owner = "tsujan";
-    repo = "E17gtk";
-    rev = "V${version}";
-    sha256 = "1qwj1hmdlk8sdqhkrh60p2xg4av1rl0lmipdg5j0i40318pmiml1";
-  };
-
-  installPhase = ''
-    mkdir -p $out/share/{doc,themes}/E17gtk
-    cp -va index.theme gtk-2.0 gtk-3.0 metacity-1 $out/share/themes/E17gtk/
-    cp -va README.md WORKAROUNDS screenshot.jpg $out/share/doc/E17gtk/
-  '';
-
-  meta = {
-    description = "Enlightenment-like GTK theme with sharp corners";
-    homepage = "https://github.com/tsujan/E17gtk";
-    license = lib.licenses.gpl3;
-    platforms = lib.platforms.unix;
-    maintainers = [ lib.maintainers.romildo ];
-  };
-}

pkgs/by-name/fa/fabric-ai/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "fabric-ai";
-  version = "1.4.375";
+  version = "1.4.380";
 
   src = fetchFromGitHub {
     owner = "danielmiessler";
     repo = "fabric";
     tag = "v${version}";
-    hash = "sha256-Y8lTYzCQ4ZTTuwijdyY8XKk/4yQn67GzMQFyn34NVZo=";
+    hash = "sha256-d4WjshFCZtO7414It53yBEmKB+ERhA/Q9KUb8bX7tCk=";
   };
 
   vendorHash = "sha256-147i0ZnNtph5DhaxK330kyUkDA4MBcpzrtIJGBEJHHQ=";

pkgs/by-name/fa/famistudio/package.nix

@@ -14,6 +14,7 @@
   openal,
   portaudio,
   rtmidi,
+  wrapGAppsHook3,
   _experimental-update-script-combinators,
   gitUpdater,
 }:
@@ -133,11 +134,17 @@ buildDotnetModule (finalAttrs: {
   nugetDeps = ./deps.json;
   dotnet-sdk = dotnetCorePackages.sdk_8_0;
 
+  nativeBuildInputs = lib.optionals stdenvNoCC.hostPlatform.isLinux [
+    wrapGAppsHook3
+  ];
+
   runtimeDeps = lib.optionals stdenvNoCC.hostPlatform.isLinux [
     gtk3
     libglvnd
   ];
 
+  dontWrapGApps = true;
+
   executables = [ "FamiStudio" ];
 
   postInstall = ''
@@ -147,11 +154,19 @@ buildDotnetModule (finalAttrs: {
     done
   '';
 
-  postFixup = ''
+  postFixup =
+    # Need GSettings schemas
+    lib.optionalString stdenvNoCC.hostPlatform.isLinux ''
+      makeWrapperArgs+=(
+        "''${gappsWrapperArgs[@]}"
+      )
+    ''
     # FFMpeg looked up from PATH
-    wrapProgram $out/bin/FamiStudio \
-      --prefix PATH : ${lib.makeBinPath [ ffmpeg ]}
-  '';
+    + ''
+      wrapProgram $out/bin/FamiStudio \
+        --prefix PATH : ${lib.makeBinPath [ ffmpeg ]} \
+        ''${makeWrapperArgs[@]}
+    '';
 
   passthru.updateScript = _experimental-update-script-combinators.sequence [
     (gitUpdater { }).command

pkgs/by-name/ge/gemini-cli-bin/package.nix

@@ -3,6 +3,7 @@
   stdenvNoCC,
   fetchurl,
   nodejs,
+  sysctl,
   writableTmpDirAsHomeHook,
   nix-update-script,
 }:
@@ -42,6 +43,9 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   doInstallCheck = true;
   nativeInstallCheckInputs = [
     writableTmpDirAsHomeHook
+  ]
+  ++ lib.optionals (with stdenvNoCC.hostPlatform; isDarwin && isx86_64) [
+    sysctl
   ];
   # versionCheckHook cannot be used because the reported version might be incorrect (e.g., 0.6.1 returns 0.6.0).
   installCheckPhase = ''

pkgs/by-name/go/gosmee/package.nix

@@ -4,24 +4,27 @@
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
+  versionCheckHook,
+  nix-update-script,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "gosmee";
   version = "0.28.3";
 
   src = fetchFromGitHub {
     owner = "chmouel";
     repo = "gosmee";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-97Z/q0cOX4zPGYaeAKqxm3sb7WfJ1fpUcMhuqHsPG1c=";
   };
+
   vendorHash = null;
 
   nativeBuildInputs = [ installShellFiles ];
 
   postPatch = ''
-    printf ${version} > gosmee/templates/version
+    printf ${finalAttrs.version} > gosmee/templates/version
   '';
 
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
@@ -31,13 +34,20 @@ buildGoModule rec {
       --zsh <($out/bin/gosmee completion zsh)
   '';
 
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Command line server and client for webhooks deliveries (and https://smee.io)";
     homepage = "https://github.com/chmouel/gosmee";
+    changelog = "https://github.com/chmouel/gosmee/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [
       vdemeester
       chmouel
     ];
+    mainProgram = "gosmee";
   };
-}
+})

pkgs/by-name/gu/gurk-rs/package.nix

@@ -14,20 +14,20 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "gurk-rs";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "boxdot";
     repo = "gurk-rs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-m7oZM2uCGENrADh+qrNODvYWxgbh1ahthkWjFnAVXjw=";
+    hash = "sha256-HBqKcKPsNJQhLGGQ4X+xGPWwSABiaqubn11yyqiL0xU=";
   };
 
   postPatch = ''
     rm .cargo/config.toml
   '';
 
-  cargoHash = "sha256-15z4jKKGfSH1LXX1cXpwRjWI/ITaj3dzlscE7Vrh9Xw=";
+  cargoHash = "sha256-oasGeNlY3c0iSxgLqPCo081g7d0fA3I+LyDJdRSiNaE=";
 
   nativeBuildInputs = [
     protobuf
@@ -61,6 +61,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     maintainers = with lib.maintainers; [
       devhell
       mattkang
+      nicknb
     ];
   };
 })

pkgs/by-name/lu/luau-lsp/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "luau-lsp";
-  version = "1.60.0";
+  version = "1.60.1";
 
   src = fetchFromGitHub {
     owner = "JohnnyMorganz";
     repo = "luau-lsp";
     tag = finalAttrs.version;
-    hash = "sha256-36Nl9robV0RVhEwV3Cu75IDyexnWwf5ZBHOaEx2/kPM=";
+    hash = "sha256-UoitFmn+1bHhQ2oqt1z50iU0Hx7pS4nact+3C8V8WzE=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/mo/modrinth-app-unwrapped/package.nix

@@ -31,13 +31,13 @@ in
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "modrinth-app-unwrapped";
-  version = "0.10.25";
+  version = "0.10.26";
 
   src = fetchFromGitHub {
     owner = "modrinth";
     repo = "code";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-e+Oienb0jhz7XT9NZB5IAELi+YU3i60JIWBDG8LCEZw=";
+    hash = "sha256-1C0BCbDJ6/nYzWEL5UA9GQW4vSo4ZfP6BuA3i4JoiuY=";
   };
 
   patches = [
@@ -77,7 +77,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_9;
     fetcherVersion = 1;
-    hash = "sha256-4MRVk5k/HkCMA/OeRMZwwkCyqmSWkujqLe/8sPfYcwc=";
+    hash = "sha256-m5/7fD4OBJcY7stZhwDLw4asmXqUThUjTaRb3oVul78=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/mp/mpv/scripts/manga-reader.nix

@@ -8,12 +8,12 @@
 buildLua {
   pname = "manga-reader";
 
-  version = "0-unstable-2025-07-15";
+  version = "0-unstable-2026-01-16";
   src = fetchFromGitHub {
     owner = "Dudemanguy";
     repo = "mpv-manga-reader";
-    rev = "bb4ec1208feb440ce430f0963373ab2db5b7d743";
-    hash = "sha256-Zz2rPnnQHz2BqCM3jEJD/FuFLKtiNGWvAZpiH7jyLmo=";
+    rev = "a93e03bc837d501760dd38155c8e945d66a3a3ed";
+    hash = "sha256-UG1MRtwljoKi6kct8mDZSHxz9mzQ1qHnqohX7e5nj40=";
   };
   passthru.updateScript = unstableGitUpdater { };
 

pkgs/by-name/nc/ncps/package.nix

@@ -33,13 +33,13 @@ let
 
   finalAttrs = {
     pname = "ncps";
-    version = "0.6.2";
+    version = "0.6.3";
 
     src = fetchFromGitHub {
       owner = "kalbasit";
       repo = "ncps";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-KJzfvp4Q/h9dT9zt602QTfpxCtwUEW4FCvPIjX9E7aE=";
+      hash = "sha256-7fLtVloiTNOmPoVpESpiSUl7i+5SMLXRHbGPk9SilBc=";
     };
 
     ldflags = [

pkgs/by-name/no/node-red/package.nix

@@ -19,6 +19,8 @@ buildNpmPackage rec {
 
   npmDepsHash = "sha256-8nwIEu/p5kVYoG3+jXBss352MciCnk/aGV9nbDGHDdA=";
 
+  nativeBuildInputs = [ jq ];
+
   postPatch =
     let
       packageDir = "packages/node_modules/node-red";
@@ -26,7 +28,7 @@ buildNpmPackage rec {
     ''
       ln -s ${./package-lock.json} package-lock.json
 
-      ${lib.getExe jq} '. += {"bin": {"node-red": "${packageDir}/red.js", "node-red-pi": "${packageDir}/bin/node-red-pi"}}' package.json > package.json.tmp
+      jq '. += {"bin": {"node-red": "${packageDir}/red.js", "node-red-pi": "${packageDir}/bin/node-red-pi"}}' package.json > package.json.tmp
       mv package.json.tmp package.json
     '';
 

pkgs/by-name/on/oneanime/package.nix

@@ -2,7 +2,7 @@
   lib,
   stdenv,
   buildGoModule,
-  flutter335,
+  flutter338,
   fetchFromGitHub,
   autoPatchelfHook,
   desktop-file-utils,
@@ -65,7 +65,7 @@ let
     hash = "sha256-4EieR+Wys7vK+0/pWF5MkA71EeChThVGJ8J5x/8k8nA=";
   };
 in
-flutter335.buildFlutterApplication {
+flutter338.buildFlutterApplication {
   pname = "oneanime";
   inherit version src;
 

pkgs/by-name/op/openapi-python-client/package.nix

@@ -11,7 +11,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "openapi-python-client";
-  version = "0.28.0";
+  version = "0.28.1";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -19,7 +19,7 @@ python3Packages.buildPythonApplication rec {
     owner = "openapi-generators";
     repo = "openapi-python-client";
     tag = "v${version}";
-    hash = "sha256-CxFadu6HaGw78GNAQegjC0ZVtpqaZtUOKLVWoMKkPl8=";
+    hash = "sha256-ZzZLrxeJtT4rgxlcANKcrw7nRlTF8vRV/lItyH7x95o=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/pg/pgformatter/package.nix

@@ -2,6 +2,7 @@
   lib,
   perlPackages,
   fetchFromGitHub,
+  versionCheckHook,
 }:
 
 perlPackages.buildPerlPackage rec {
@@ -11,7 +12,7 @@ perlPackages.buildPerlPackage rec {
   src = fetchFromGitHub {
     owner = "darold";
     repo = "pgFormatter";
-    rev = "v${version}";
+    tag = "v${version}";
     hash = "sha256-G4Bbg8tNlwV8VCVKCamhlQ/pGf8hWCkABm6f8i5doos=";
   };
 
@@ -23,20 +24,29 @@ perlPackages.buildPerlPackage rec {
   installTargets = [ "pure_install" ];
 
   # Makefile.PL only accepts DESTDIR and INSTALLDIRS, but we need to set more to make this work for NixOS.
-  patchPhase = ''
+  postPatch = ''
     substituteInPlace pg_format \
-      --replace "#!/usr/bin/env perl" "#!/usr/bin/perl"
+      --replace-fail "#!/usr/bin/env perl" "#!/usr/bin/perl"
+
     substituteInPlace Makefile.PL \
-      --replace "'DESTDIR'      => \$DESTDIR," "'DESTDIR'      => '$out/'," \
-      --replace "'INSTALLDIRS'  => \$INSTALLDIRS," "'INSTALLDIRS'  => \$INSTALLDIRS, 'INSTALLVENDORLIB' => 'bin/lib', 'INSTALLVENDORBIN' => 'bin', 'INSTALLVENDORSCRIPT' => 'bin', 'INSTALLVENDORMAN1DIR' => 'share/man/man1', 'INSTALLVENDORMAN3DIR' => 'share/man/man3',"
+      --replace-fail \
+        "'DESTDIR'      => \$DESTDIR," \
+        "'DESTDIR'      => '$out/'," \
+      --replace-fail \
+        "'INSTALLDIRS'  => \$INSTALLDIRS," \
+        "'INSTALLDIRS'  => \$INSTALLDIRS, 'INSTALLVENDORLIB' => 'bin/lib', 'INSTALLVENDORBIN' => 'bin', 'INSTALLVENDORSCRIPT' => 'bin', 'INSTALLVENDORMAN1DIR' => 'share/man/man1', 'INSTALLVENDORMAN3DIR' => 'share/man/man3',"
+
+    patchShebangs .
   '';
 
-  doCheck = false;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
 
   meta = {
     description = "PostgreSQL SQL syntax beautifier that can work as a console program or as a CGI";
     homepage = "https://github.com/darold/pgFormatter";
-    changelog = "https://github.com/darold/pgFormatter/releases/tag/v${version}";
+    changelog = "https://github.com/darold/pgFormatter/releases/tag/${src.tag}";
     maintainers = with lib.maintainers; [
       thunze
       mfairley

pkgs/by-name/po/pocket-tts/package.nix

@@ -0,0 +1 @@
+{ python3Packages }: with python3Packages; toPythonApplication pocket-tts

pkgs/by-name/po/poetry/unwrapped.nix

@@ -57,6 +57,7 @@ buildPythonPackage rec {
   pythonRelaxDeps = [
     "dulwich"
     "keyring"
+    "pbs-installer"
   ];
 
   dependencies = [

pkgs/by-name/pr/proxychains-ng/package.nix

@@ -27,6 +27,11 @@ stdenv.mkDerivation rec {
       url = "https://github.com/rofl0r/proxychains-ng/commit/fffd2532ad34bdf7bf430b128e4c68d1164833c6.patch";
       hash = "sha256-l3qSFUDMUfVDW1Iw+R2aW/wRz4CxvpR4eOwx9KzuAAo=";
     })
+    (fetchpatch {
+      name = "CVE-2025-34451.patch";
+      url = "https://github.com/httpsgithu/proxychains-ng/commit/cc005b7132811c9149e77b5e33cff359fc95512e.patch";
+      hash = "sha256-taCNTm3qvBmLSSO0DEBu15tDZ35PDzHGtbZW7nLrRDw=";
+    })
   ];
 
   configureFlags = lib.optionals stdenv.hostPlatform.isDarwin [

pkgs/by-name/py/pyroscope/package.nix

@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "pyroscope";
-  version = "1.13.4";
+  version = "1.17.1";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "pyroscope";
-    rev = "v1.13.4";
-    hash = "sha256-nyb91BO4zzJl3AG/ojBO+q7WiicZYmOtztW6FTlQHMM=";
+    rev = "v1.17.1";
+    hash = "sha256-fwElc9UoFdsFuzDCEKlqIPQPDOnBJX3vO4tspr5URDo=";
   };
 
-  vendorHash = "sha256-GZMoXsoE3pL0T3tkWY7i1f9sGy5uVDqeurCvBteqV9A=";
+  vendorHash = "sha256-KqaOfyS5CJZOv+bwGSs483SztuRyQ+qYp1E9POw07T8=";
   proxyVendor = true;
 
   subPackages = [

pkgs/by-name/sa/sandhole/package.nix

@@ -24,8 +24,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
     echo "fn main() {}" > tests/integration/main.rs
   '';
 
-  buildInputs = [ cmake ];
-  nativeBuildInputs = [ perl ];
+  nativeBuildInputs = [
+    cmake
+    perl
+  ];
+  strictDeps = true;
 
   useNextest = true;
   checkFlags = [

pkgs/by-name/se/send/package.nix

@@ -4,6 +4,7 @@
   fetchFromGitHub,
   makeBinaryWrapper,
   nodejs_20,
+  nix-update-script,
   nixosTests,
 }:
 buildNpmPackage rec {
@@ -44,8 +45,11 @@ buildNpmPackage rec {
       --set "NODE_ENV" "production"
   '';
 
-  passthru.tests = {
-    inherit (nixosTests) send;
+  passthru = {
+    updateScript = nix-update-script { };
+    tests = {
+      inherit (nixosTests) send;
+    };
   };
 
   meta = {

pkgs/by-name/se/server-box/package.nix

@@ -1,6 +1,6 @@
 {
   lib,
-  flutter335,
+  flutter338,
   fetchFromGitHub,
   autoPatchelfHook,
   copyDesktopItems,
@@ -22,7 +22,7 @@ let
     hash = "sha256-fmL03BNVi1aKhb0jV7MnEtRKTOEaLBGl6uMJtLr6cFk=";
   };
 in
-flutter335.buildFlutterApplication {
+flutter338.buildFlutterApplication {
   pname = "server-box";
   inherit version src;
 

pkgs/by-name/si/siyuan/package.nix

@@ -36,20 +36,20 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "siyuan";
-  version = "3.5.2";
+  version = "3.5.3";
 
   src = fetchFromGitHub {
     owner = "siyuan-note";
     repo = "siyuan";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Rimb2OfohjTfaqVCZcoGDxpEfXvyp2CLqwqOjqAJjJg=";
+    hash = "sha256-YAd7XVJLs66CAhb5ro8o5GrT5AhVpp/RHOpl1XkBBHU=";
   };
 
   kernel = buildGoModule {
     name = "${finalAttrs.pname}-${finalAttrs.version}-kernel";
     inherit (finalAttrs) src;
     sourceRoot = "${finalAttrs.src.name}/kernel";
-    vendorHash = "sha256-PNFIWH6IL/Zj/eK/5M8ACICOeQi4WEBIh1aY4eyfkn4=";
+    vendorHash = "sha256-2O8gk6Y6odlMldUfanPf5MIiczfd5lH/yMX0IbIEVvc=";
 
     patches = [
       (replaceVars ./set-pandoc-path.patch {
@@ -100,7 +100,7 @@ stdenv.mkDerivation (finalAttrs: {
       ;
     pnpm = pnpm_9;
     fetcherVersion = 1;
-    hash = "sha256-JTfCU5kWR2tvVNFT+PAzqKe8tUk4+uwwVgo85VOntck=";
+    hash = "sha256-/h8tHSJGsqjFXp/qpxOqoHmsEiuRXvIWBLRalTdXVi4=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/app";

pkgs/by-name/su/surge-XT/package.nix

@@ -72,7 +72,7 @@ stdenv.mkDerivation (finalAttrs: {
   cmakeFlags = [
     (lib.cmakeBool "SURGE_SKIP_STANDALONE" (!buildStandalone))
     (lib.cmakeBool "SURGE_SKIP_VST3" (!buildVST3))
-    (lib.cmakeBool "SURGE_SKIP_LV2" buildLV2)
+    (lib.cmakeBool "SURGE_BUILD_LV2" buildLV2)
     (lib.cmakeBool "SURGE_BUILD_CLAP" buildCLAP)
   ];
 
@@ -95,7 +95,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   meta = {
-    description = "LV2 & VST3 synthesizer plug-in (previously released as Vember Audio Surge)";
+    description = "LV2, VST3 & CLAP synthesizer plug-in (previously released as Vember Audio Surge)";
     homepage = "https://surge-synthesizer.github.io";
     license = lib.licenses.gpl3;
     platforms = [ "x86_64-linux" ];

pkgs/by-name/ti/tideways-daemon/package.nix

@@ -10,7 +10,7 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "tideways-daemon";
-  version = "1.11.4";
+  version = "1.12.0";
 
   src =
     finalAttrs.passthru.sources.${stdenvNoCC.hostPlatform.system}
@@ -28,15 +28,15 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     sources = {
       "x86_64-linux" = fetchurl {
         url = "https://tideways.s3.amazonaws.com/daemon/${finalAttrs.version}/tideways-daemon_linux_amd64-${finalAttrs.version}.tar.gz";
-        hash = "sha256-wHiVNkoiaPF4HhE6dnBQXlGMOTqi6Mq0L7HCIFfybRk=";
+        hash = "sha256-aPG7+OEe8abub7vEfe4VOLBBvuAGS1EQ016TyTsuaWc=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://tideways.s3.amazonaws.com/daemon/${finalAttrs.version}/tideways-daemon_linux_aarch64-${finalAttrs.version}.tar.gz";
-        hash = "sha256-5ga73KByQ2g/L23t+TOLrd3tQa4O5ehN/C26I/mbVuM=";
+        hash = "sha256-zsk2ShAg6v6/K1GG07rw3fpcDz8jcFnEREcZz6Y9FZA=";
       };
       "aarch64-darwin" = fetchurl {
         url = "https://tideways.s3.amazonaws.com/daemon/${finalAttrs.version}/tideways-daemon_macos_arm64-${finalAttrs.version}.tar.gz";
-        hash = "sha256-5fSEqaTDR0u6vnQuIv8cRuIMlfFDfw2vh9uFzAf7nTs=";
+        hash = "sha256-OwKoOKiyeUNnw0iO+o9B33N2rlsw2FhqupAXu1VBgOA=";
       };
     };
     updateScript = "${

pkgs/by-name/to/tomat/package.nix

@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "tomat";
-  version = "2.6.0";
+  version = "2.8.0";
 
   src = fetchFromGitHub {
     owner = "jolars";
     repo = "tomat";
     tag = "v${version}";
-    hash = "sha256-EihzQT+JUO9PlXgYg3R1VbBxRfOnw4b94oRV/mKZ60U=";
+    hash = "sha256-Jj/ObyFRvsdwxEvTQCIbkFkR3Zrs7SsU11rOZxclA7E=";
   };
 
-  cargoHash = "sha256-xCdQAhK3/0meat2YvsWJHPz0IDYEvwcHi8pd0mckELQ=";
+  cargoHash = "sha256-zmQ7Dk6a0F7XpD3BcOFU87to48j6J5+xNI2XGRx1u/E=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/up/updatecli/package.nix

@@ -12,16 +12,16 @@
 
 buildGoModule rec {
   pname = "updatecli";
-  version = "0.112.0";
+  version = "0.113.0";
 
   src = fetchFromGitHub {
     owner = "updatecli";
     repo = "updatecli";
     rev = "v${version}";
-    hash = "sha256-goJH+B6gPNHSQmeUvXUVq5HBwMAKaGZiTlwiZK7rkbg=";
+    hash = "sha256-sol0adhlIoB+/lTGbIk8R2Rv8rw1GlzBcuXISzLYceE=";
   };
 
-  vendorHash = "sha256-8NrT1jzLd1/8IFm8lOlqwQcSiaYQMRato7Z0kZFuN1s=";
+  vendorHash = "sha256-CbtpjJDlqNYOZ/xkIJ3Ct0LLoK3NWOH2Ke3OIsbZMa4=";
 
   # tests require network access
   doCheck = false;

pkgs/by-name/ve/venera/package.nix

@@ -1,6 +1,6 @@
 {
   lib,
-  flutter335,
+  flutter338,
   fetchFromGitHub,
   webkitgtk_4_1,
   copyDesktopItems,
@@ -22,7 +22,7 @@ let
     hash = "sha256-hqpWkYXWM/kZU2kVAP2ak2TDZt3m4j4809rGhX68dek=";
   };
 in
-flutter335.buildFlutterApplication {
+flutter338.buildFlutterApplication {
   pname = "venera";
   inherit version src;
 

pkgs/by-name/ve/versatiles/package.nix

@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "versatiles";
-  version = "3.1.1";
+  version = "3.2.0";
 
   src = fetchFromGitHub {
     owner = "versatiles-org";
     repo = "versatiles-rs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DnCaq8qGuw5FzfWjGKNpD4IFnL927vOnYmHD9zHB1fA=";
+    hash = "sha256-cBqIwVlno8ZOUxMzJmTesqZVS34H9BJ9hpQnqKNPXFQ=";
   };
 
-  cargoHash = "sha256-nbbDVS6Oea29EzANwSkZ24swanibgsjqCKx5UolhgE0=";
+  cargoHash = "sha256-Vdo89hb3ZWhnyEGTr6yOinQWLvZ81AJGwU1D9kS1afo=";
 
   __darwinAllowLocalNetworking = true;
 

pkgs/by-name/zi/zizmor/package.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zizmor";
-  version = "1.20.0";
+  version = "1.21.0";
 
   src = fetchFromGitHub {
     owner = "zizmorcore";
     repo = "zizmor";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hLLse28YL0WU5mU2fYycALdS4X+pEBtumJjNEdIXRf0=";
+    hash = "sha256-cIwQSQcG8h4YtBPfl+meSpTkyNEwLsg3eG2SZs4PMDA=";
   };
 
-  cargoHash = "sha256-7MnsBSoh1So5+LBEt/0efr9Q/BbIvP8QzsB+JCobsck=";
+  cargoHash = "sha256-dKgURNjvxqN7xlvdQtsylxNwYenNUgqrsecGyTtGpNI=";
 
   buildInputs = [
     rust-jemalloc-sys

pkgs/development/octave-modules/fuzzy-logic-toolkit/default.nix

@@ -6,13 +6,13 @@
 
 buildOctavePackage rec {
   pname = "fuzzy-logic-toolkit";
-  version = "0.6.1";
+  version = "0.6.2";
 
   src = fetchFromGitHub {
     owner = "lmarkowsky";
     repo = "fuzzy-logic-toolkit";
     tag = version;
-    sha256 = "sha256-lnYzX4rq3j7rrbD8m0EnrWpbMJD6tqtMVCYu4mlLFCM=";
+    sha256 = "sha256-cNzUjhJgx6SVfy8QrKUr02HvNsAh5ItQN3+hapA5eq0=";
   };
 
   meta = {

pkgs/development/octave-modules/statistics/default.nix

@@ -7,13 +7,13 @@
 
 buildOctavePackage rec {
   pname = "statistics";
-  version = "1.7.0";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "gnu-octave";
     repo = "statistics";
     tag = "release-${version}";
-    hash = "sha256-k1YJtFrm71Th42IceX7roWaFCxU3284Abl8JAKLG9So=";
+    hash = "sha256-4nwkrnYaFdBkLLbIUJX0U4tytHrSIKltWu7Srx43K5g=";
   };
 
   requiredOctavePackages = [

pkgs/development/python-modules/betterproto/default.nix

@@ -1,25 +1,35 @@
 {
+  lib,
   buildPythonPackage,
   fetchFromGitHub,
-  lib,
+  pythonAtLeast,
+
+  # build-system
   poetry-core,
+
+  # dependencies
   grpclib,
   python-dateutil,
+  typing-extensions,
+
+  # optional-dependencies
   black,
   jinja2,
   isort,
-  python,
+
+  # tests
+  addBinToPathHook,
   cachelib,
+  grpcio-tools,
   pydantic,
-  pytestCheckHook,
   pytest-asyncio,
   pytest-mock,
-  typing-extensions,
+  pytestCheckHook,
   tomlkit,
-  grpcio-tools,
+  python,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "betterproto";
   version = "2.0.0b7";
   pyproject = true;
@@ -27,7 +37,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "danielgtaylor";
     repo = "python-betterproto";
-    tag = "v.${version}";
+    tag = "v.${finalAttrs.version}";
     hash = "sha256-T7QSPH8MFa1hxJOhXc3ZMM62/FxHWjCJJ59IpeM41rI=";
   };
 
@@ -51,6 +61,7 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
+    addBinToPathHook
     cachelib
     grpcio-tools
     pydantic
@@ -59,7 +70,7 @@ buildPythonPackage rec {
     pytestCheckHook
     tomlkit
   ]
-  ++ lib.concatAttrValues optional-dependencies;
+  ++ lib.concatAttrValues finalAttrs.passthru.optional-dependencies;
 
   pythonImportsCheck = [ "betterproto" ];
 
@@ -67,7 +78,6 @@ buildPythonPackage rec {
   # the protoc-gen-python_betterproto script from the package to be on PATH.
   preCheck = ''
     (($(ulimit -n) < 1024)) && ulimit -n 1024
-    export PATH=$PATH:$out/bin
     patchShebangs src/betterproto/plugin/main.py
     ${python.interpreter} -m tests.generate
   '';
@@ -81,6 +91,13 @@ buildPythonPackage rec {
     "test_binary_compatibility"
   ];
 
+  disabledTestPaths = lib.optionals (pythonAtLeast "3.14") [
+    # TypeError: issubclass() arg 1 must be a class
+    "tests/test_inputs.py::test_message_can_instantiated[namespace_builtin_types]"
+    "tests/test_inputs.py::test_message_equality[namespace_builtin_types]"
+    "tests/test_inputs.py::test_message_json[namespace_builtin_types]"
+  ];
+
   meta = {
     description = "Code generator & library for Protobuf 3 and async gRPC";
     mainProgram = "protoc-gen-python_betterproto";
@@ -90,8 +107,8 @@ buildPythonPackage rec {
       features and generating readable, understandable, idiomatic Python code.
     '';
     homepage = "https://github.com/danielgtaylor/python-betterproto";
-    changelog = "https://github.com/danielgtaylor/python-betterproto/blob/v.${version}/CHANGELOG.md";
+    changelog = "https://github.com/danielgtaylor/python-betterproto/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ nikstur ];
   };
-}
+})

pkgs/development/python-modules/drf-pydantic/default.nix

@@ -7,6 +7,7 @@
   hatchling,
   djangorestframework,
   pytestCheckHook,
+  pytest-cov-stub,
 }:
 
 buildPythonPackage rec {
@@ -31,8 +32,10 @@ buildPythonPackage rec {
     djangorestframework
   ];
 
-  nativeChecksInputs = [
+  nativeCheckInputs = [
     pytestCheckHook
+    pytest-cov-stub
+    pydantic.optional-dependencies.email
   ];
 
   meta = {

pkgs/development/python-modules/hyper-connections/default.nix

@@ -10,14 +10,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "hyper-connections";
-  version = "0.4.0";
+  version = "0.4.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lucidrains";
     repo = "hyper-connections";
     tag = finalAttrs.version;
-    hash = "sha256-nMNAuHOLOgrWNrMFko5ARBOyp9TyUhJfldPihV012K4=";
+    hash = "sha256-CAhLDBZvmdHwVTbKVgWnS0qs5TE4a05iorbR7Ejh2uM=";
   };
 
   build-system = [ hatchling ];

pkgs/development/python-modules/identify/default.nix

@@ -8,16 +8,16 @@
   ukkonen,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "identify";
-  version = "2.6.15";
+  version = "2.6.16";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pre-commit";
     repo = "identify";
-    tag = "v${version}";
-    hash = "sha256-YA9DwtAFjFYkycCJjBDXgIE4FKTt3En7fvw5xe37GZU=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-+iLIU2NfKogFAdbAXXER3G7cDyvcey9pR+0HifQZoh8=";
   };
 
   build-system = [ setuptools ];
@@ -37,4 +37,4 @@ buildPythonPackage rec {
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "identify-cli";
   };
-}
+})

pkgs/development/python-modules/limnoria/default.nix

@@ -11,20 +11,24 @@
   pytestCheckHook,
   python-dateutil,
   python-gnupg,
-  pythonOlder,
   pytz,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "limnoria";
-  version = "2025.11.2";
+  version = "2026.1.16";
   pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-cvlp1cfsdN8lv8hFvaHV6vtWEJ0CJUBmN1yCgxrhMi8=";
+    inherit (finalAttrs) pname version;
+    hash = "sha256-ZkEXZMjJsEgSwX2a8TwaQ/vtvskSOFwNBZg/Ru5q/bc=";
   };
 
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace-fail "version=version" 'version="${finalAttrs.version}"'
+  '';
+
   build-system = [ setuptools ];
 
   dependencies = [
@@ -35,16 +39,10 @@ buildPythonPackage rec {
     pysocks
     python-dateutil
     python-gnupg
-  ]
-  ++ lib.optionals (pythonOlder "3.9") [ pytz ];
+  ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace-fail "version=version" 'version="${version}"'
-  '';
-
   checkPhase = ''
     runHook preCheck
     export PATH="$PATH:$out/bin";
@@ -60,7 +58,8 @@ buildPythonPackage rec {
   meta = {
     description = "Modified version of Supybot, an IRC bot";
     homepage = "https://github.com/ProgVal/Limnoria";
+    changelog = "https://github.com/progval/Limnoria/releases/tag/master-${finalAttrs.version}";
     license = lib.licenses.bsd3;
     maintainers = [ ];
   };
-}
+})

pkgs/development/python-modules/oelint-parser/default.nix

@@ -1,6 +1,5 @@
 {
   lib,
-  nix-update-script,
   fetchFromGitHub,
   buildPythonPackage,
   setuptools,
@@ -12,16 +11,16 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "oelint-parser";
-  version = "8.7.0";
+  version = "8.7.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "priv-kweihmann";
     repo = "oelint-parser";
-    tag = version;
-    hash = "sha256-igDt5pUiAhAmsDlY/S/SMhPllKJ0aIry95rrHC2Iel4=";
+    tag = finalAttrs.version;
+    hash = "sha256-F17THZo8fXoFP4b2DJnDjbZfT5xUX9+MMSxBa9sIy5c=";
   };
 
   pythonRelaxDeps = [ "regex" ];
@@ -42,13 +41,11 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "oelint_parser" ];
 
-  passthru.updateScript = nix-update-script { };
-
   meta = {
     description = "Alternative parser for bitbake recipes";
     homepage = "https://github.com/priv-kweihmann/oelint-parser";
-    changelog = "https://github.com/priv-kweihmann/oelint-parser/releases/tag/${src.tag}";
+    changelog = "https://github.com/priv-kweihmann/oelint-parser/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.bsd2;
     maintainers = with lib.maintainers; [ otavio ];
   };
-}
+})

pkgs/development/python-modules/pocket-tts/default.nix

@@ -0,0 +1,78 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  hatchling,
+
+  # dependencies
+  beartype,
+  einops,
+  fastapi,
+  huggingface-hub,
+  numpy,
+  pydantic,
+  python-multipart,
+  requests,
+  safetensors,
+  scipy,
+  sentencepiece,
+  torch,
+  typer,
+  typing-extensions,
+  uvicorn,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "pocket-tts";
+  version = "1.0.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "kyutai-labs";
+    repo = "pocket-tts";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-VFLpUsHnQYSr5RgNKJOX1TD30o1A8rG4cs2VeZWriaU=";
+  };
+
+  build-system = [
+    hatchling
+  ];
+
+  pythonRelaxDeps = [
+    "beartype"
+    "python-multipart"
+  ];
+  dependencies = [
+    beartype
+    einops
+    fastapi
+    huggingface-hub
+    numpy
+    pydantic
+    python-multipart
+    requests
+    safetensors
+    scipy
+    sentencepiece
+    torch
+    typer
+    typing-extensions
+    uvicorn
+  ];
+
+  pythonImportsCheck = [ "pocket_tts" ];
+
+  # All tests are failing as the model cannot be downloaded from the sandbox
+  doCheck = false;
+
+  meta = {
+    description = "Lightweight text-to-speech (TTS) application designed to run efficiently on CPUs";
+    homepage = "https://github.com/kyutai-labs/pocket-tts";
+    changelog = "https://github.com/kyutai-labs/pocket-tts/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+    mainProgram = "pocket-tts";
+  };
+})

pkgs/development/python-modules/pytensor/default.nix

@@ -61,6 +61,7 @@ buildPythonPackage rec {
     numba
     numpy
     scipy
+    setuptools
   ];
 
   nativeCheckInputs = [

pkgs/development/python-modules/raylib-python-cffi/passthru-tests.nix

@@ -1,9 +1,9 @@
 {
-  src,
   raylib-python-cffi,
   writers,
 }:
 let
+  src = raylib-python-cffi.src;
   writeTest =
     name: path:
     writers.writePython3Bin name {

pkgs/servers/nextcloud/default.nix

@@ -59,14 +59,14 @@ let
 in
 {
   nextcloud31 = generic {
-    version = "31.0.12";
-    hash = "sha256-spCJ0KvDkY9z8r4tdWhbjXALj9i+9BYpfyVDQyXwnDY=";
+    version = "31.0.13";
+    hash = "sha256-kt8INpRn6Bwj1/2Zevt1bq5Ezkfv8MhcXU0nIS6+KD4=";
     packages = nextcloud31Packages;
   };
 
   nextcloud32 = generic {
-    version = "32.0.3";
-    hash = "sha256-m3GslskQtKNQ2Ya9OpLqBvAqFh+lhjNLVth9isr8YtQ=";
+    version = "32.0.5";
+    hash = "sha256-jdC8j44tJi7a0RGX1KB695m1H+hy7i2SWf+hm0PlQ60=";
     packages = nextcloud32Packages;
   };
 

pkgs/top-level/aliases.nix

@@ -569,6 +569,7 @@ mapAliases {
   dumb = throw "'dumb' has been archived by upstream. Upstream recommends libopenmpt as a replacement."; # Added 2025-09-14
   dump1090 = throw "'dump1090' has been renamed to/replaced by 'dump1090-fa'"; # Converted to throw 2025-10-27
   dune_1 = throw "'dune_1' has been removed"; # Added 2025-11-13
+  e17gtk = throw "'e17gtk' has been removed because it was archived upstream."; # Added 2026-01-15
   eask = throw "'eask' has been renamed to/replaced by 'eask-cli'"; # Converted to throw 2025-10-27
   easyloggingpp = throw "easyloggingpp has been removed, as it is deprecated upstream and does not build with CMake 4"; # Added 2025-09-17
   EBTKS = throw "'EBTKS' has been renamed to/replaced by 'ebtks'"; # Converted to throw 2025-10-27

pkgs/top-level/python-packages.nix

@@ -12402,6 +12402,8 @@ self: super: with self; {
 
   pocket = callPackage ../development/python-modules/pocket { };
 
+  pocket-tts = callPackage ../development/python-modules/pocket-tts { };
+
   pocketsphinx = callPackage ../development/python-modules/pocketsphinx {
     inherit (pkgs) pocketsphinx;
   };