Merge master into staging-nixos

nixos/modules/services/admin/pgadmin.nix

@@ -208,7 +208,9 @@ in
         User = "pgadmin";
         DynamicUser = true;
         LogsDirectory = "pgadmin";
+        LogsDirectoryMode = "750";
         StateDirectory = "pgadmin";
+        StateDirectoryMode = "750";
         ExecStart = "${cfg.package}/bin/pgadmin4";
         LoadCredential = [
           "initial_password:${cfg.initialPasswordFile}"
@@ -218,17 +220,20 @@ in
         CapabilityBoundingSet = "";
         LockPersonality = true;
         MemoryDenyWriteExecute = true;
+        MountAPIVFS = true;
         NoNewPrivileges = true;
         PrivateDevices = true;
         PrivateMounts = true;
         PrivateTmp = true;
+        PrivateUsers = true;
         ProtectClock = true;
-        ProtectControlGroups = true;
+        ProtectControlGroups = "strict";
         ProtectHome = true;
         ProtectHostname = true;
         ProtectKernelLogs = true;
         ProtectKernelModules = true;
         ProtectKernelTunables = true;
+        ProtectProc = "invisible";
         ProtectSystem = "full";
         RemoveIPC = true;
         RestrictAddressFamilies = [

nixos/modules/tasks/filesystems/btrfs.nix

@@ -65,6 +65,16 @@ in
         '';
       };
 
+      limit = mkOption {
+        default = null;
+        type = types.nullOr (types.strMatching "[0-9]+[KMGT]?");
+        example = "100M";
+        description = ''
+          The scrub throughput limit applied on all scrubbed filesystems.
+          The value is bytes per second, and accepts the usual KMGT prefixes.
+        '';
+      };
+
     };
   };
 
@@ -185,7 +195,9 @@ in
                 Type = "simple";
                 Nice = 19;
                 IOSchedulingClass = "idle";
-                ExecStart = "${pkgs.btrfs-progs}/bin/btrfs scrub start -B ${fs}";
+                ExecStart = "${pkgs.btrfs-progs}/bin/btrfs scrub start -B ${
+                  lib.optionalString (cfgScrub.limit != null) "--limit ${cfgScrub.limit}"
+                } ${fs}";
                 # if the service is stopped before scrub end, cancel it
                 ExecStop = pkgs.writeShellScript "btrfs-scrub-maybe-cancel" ''
                   (${pkgs.btrfs-progs}/bin/btrfs scrub status ${fs} | ${pkgs.gnugrep}/bin/grep finished) || ${pkgs.btrfs-progs}/bin/btrfs scrub cancel ${fs}

nixos/modules/virtualisation/nixos-containers.nix

@@ -53,23 +53,23 @@ let
       trap "exit 0" SIGRTMIN+3
 
       # Initialise the container side of the veth pair.
-      if [ -n "$HOST_ADDRESS" ]   || [ -n "$HOST_ADDRESS6" ]  ||
-         [ -n "$LOCAL_ADDRESS" ]  || [ -n "$LOCAL_ADDRESS6" ] ||
-         [ -n "$HOST_BRIDGE" ]; then
+      if [[ -n "''${HOST_ADDRESS-}" ]]   || [[ -n "''${HOST_ADDRESS6-}" ]]  ||
+         [[ -n "''${LOCAL_ADDRESS-}" ]]  || [[ -n "''${LOCAL_ADDRESS6-}" ]] ||
+         [[ -n "''${HOST_BRIDGE-}" ]]; then
         ip link set host0 name eth0
         ip link set dev eth0 up
 
-        if [ -n "$LOCAL_ADDRESS" ]; then
+        if [[ -n "''${LOCAL_ADDRESS-}" ]]; then
           ip addr add $LOCAL_ADDRESS dev eth0
         fi
-        if [ -n "$LOCAL_ADDRESS6" ]; then
+        if [[ -n "''${LOCAL_ADDRESS6-}" ]]; then
           ip -6 addr add $LOCAL_ADDRESS6 dev eth0
         fi
-        if [ -n "$HOST_ADDRESS" ]; then
+        if [[ -n "''${HOST_ADDRESS-}" ]]; then
           ip route add $HOST_ADDRESS dev eth0
           ip route add default via $HOST_ADDRESS
         fi
-        if [ -n "$HOST_ADDRESS6" ]; then
+        if [[ -n "''${HOST_ADDRESS6-}" ]]; then
           ip -6 route add $HOST_ADDRESS6 dev eth0
           ip -6 route add default via $HOST_ADDRESS6
         fi
@@ -96,11 +96,11 @@ let
     chmod 0755 "$root/etc" "$root/var/lib"
     mkdir -p "$root/var/lib/private" "$root/root" /run/nixos-containers
     chmod 0700 "$root/var/lib/private" "$root/root" /run/nixos-containers
-    if ! [ -e "$root/etc/os-release" ] && ! [ -h "$root/etc/os-release" ]; then
+    if ! [[ -e "$root/etc/os-release" ]] && ! [[ -h "$root/etc/os-release" ]]; then
       touch "$root/etc/os-release"
     fi
 
-    if ! [ -e "$root/etc/machine-id" ]; then
+    if ! [[ -e "$root/etc/machine-id" ]]; then
       touch "$root/etc/machine-id"
     fi
 
@@ -113,19 +113,19 @@ let
 
     cp --remove-destination /etc/resolv.conf "$root/etc/resolv.conf"
 
-    if [ -n "$FLAKE" ] && [ ! -e "/nix/var/nix/profiles/per-container/$INSTANCE/system" ]; then
+    if [ -n "''${FLAKE-}" ] && [ ! -e "/nix/var/nix/profiles/per-container/$INSTANCE/system" ]; then
       # we create the etc/nixos-container config file, then if we utilize the update function, we can then build all the necessary system files for the container
       ${lib.getExe nixos-container} update "$INSTANCE"
     fi
 
     declare -a extraFlags
 
-    if [ "$PRIVATE_NETWORK" = 1 ]; then
+    if [[ "''${PRIVATE_NETWORK-}" = 1 ]]; then
       extraFlags+=("--private-network")
     fi
 
     NIX_BIND_OPT=""
-    if [ -n "$PRIVATE_USERS" ]; then
+    if [[ -n "''${PRIVATE_USERS-}" ]]; then
       extraFlags+=("--private-users=$PRIVATE_USERS")
       if [[
         "$PRIVATE_USERS" = "pick"
@@ -137,12 +137,12 @@ let
       fi
     fi
 
-    if [ -n "$HOST_ADDRESS" ]  || [ -n "$LOCAL_ADDRESS" ] ||
-       [ -n "$HOST_ADDRESS6" ] || [ -n "$LOCAL_ADDRESS6" ]; then
+    if [[ -n "''${HOST_ADDRESS-}" ]]  || [[ -n "''${LOCAL_ADDRESS-}" ]] ||
+       [[ -n "''${HOST_ADDRESS6-}" ]] || [[ -n "''${LOCAL_ADDRESS6-}" ]]; then
       extraFlags+=("--network-veth")
     fi
 
-    if [ -n "$HOST_PORT" ]; then
+    if [[ -n "''${HOST_PORT-}" ]]; then
       OIFS=$IFS
       IFS=","
       for i in $HOST_PORT
@@ -152,28 +152,28 @@ let
       IFS=$OIFS
     fi
 
-    if [ -n "$HOST_BRIDGE" ]; then
+    if [[ -n "''${HOST_BRIDGE-}" ]]; then
       extraFlags+=("--network-bridge=$HOST_BRIDGE")
     fi
 
-    if [ -n "$NETWORK_NAMESPACE_PATH" ]; then
+    if [[ -n "''${NETWORK_NAMESPACE_PATH-}" ]]; then
       extraFlags+=("--network-namespace-path=$NETWORK_NAMESPACE_PATH")
     fi
 
     extraFlags+=(${lib.escapeShellArgs (mapAttrsToList nspawnExtraVethArgs cfg.extraVeths)})
 
-    for iface in $INTERFACES; do
+    for iface in ''${INTERFACES-}; do
       extraFlags+=("--network-interface=$iface")
     done
 
-    for iface in $MACVLANS; do
+    for iface in ''${MACVLANS-}; do
       extraFlags+=("--network-macvlan=$iface")
     done
 
     # If the host is 64-bit and the container is 32-bit, add a
     # --personality flag.
     ${optionalString (pkgs.stdenv.hostPlatform.system == "x86_64-linux") ''
-      if [ "$(< "''${SYSTEM_PATH:-/nix/var/nix/profiles/per-container/$INSTANCE/system}/system")" = i686-linux ]; then
+      if [[ "$(< "''${SYSTEM_PATH:-/nix/var/nix/profiles/per-container/$INSTANCE/system}/system")" = i686-linux ]]; then
         extraFlags+=("--personality=x86")
       fi
     ''}
@@ -198,14 +198,14 @@ let
       --bind="/nix/var/nix/profiles/per-container/$INSTANCE:/nix/var/nix/profiles$NIX_BIND_OPT" \
       --bind="/nix/var/nix/gcroots/per-container/$INSTANCE:/nix/var/nix/gcroots$NIX_BIND_OPT" \
       ${optionalString (!cfg.ephemeral) "--link-journal=try-guest"} \
-      --setenv PRIVATE_NETWORK="$PRIVATE_NETWORK" \
-      --setenv PRIVATE_USERS="$PRIVATE_USERS" \
-      --setenv HOST_BRIDGE="$HOST_BRIDGE" \
-      --setenv HOST_ADDRESS="$HOST_ADDRESS" \
-      --setenv LOCAL_ADDRESS="$LOCAL_ADDRESS" \
-      --setenv HOST_ADDRESS6="$HOST_ADDRESS6" \
-      --setenv LOCAL_ADDRESS6="$LOCAL_ADDRESS6" \
-      --setenv HOST_PORT="$HOST_PORT" \
+      --setenv PRIVATE_NETWORK="''${PRIVATE_NETWORK-}" \
+      --setenv PRIVATE_USERS="''${PRIVATE_USERS-}" \
+      --setenv HOST_BRIDGE="''${HOST_BRIDGE-}" \
+      --setenv HOST_ADDRESS="''${HOST_ADDRESS-}" \
+      --setenv LOCAL_ADDRESS="''${LOCAL_ADDRESS-}" \
+      --setenv HOST_ADDRESS6="''${HOST_ADDRESS6-}" \
+      --setenv LOCAL_ADDRESS6="''${LOCAL_ADDRESS6-}" \
+      --setenv HOST_PORT="''${HOST_PORT-}" \
       --setenv PATH="$PATH" \
       ${optionalString cfg.ephemeral "--ephemeral"} \
       ${
@@ -218,7 +218,7 @@ let
           cfg.tmpfs != null && cfg.tmpfs != [ ]
         ) ''--tmpfs=${concatStringsSep " --tmpfs=" cfg.tmpfs}''
       } \
-      $EXTRA_NSPAWN_FLAGS \
+      ''${EXTRA_NSPAWN_FLAGS-} \
       ${containerInit cfg} "''${SYSTEM_PATH:-/nix/var/nix/profiles/system}/init"
   '';
 
@@ -226,8 +226,8 @@ let
     # Clean up existing machined registration and interfaces.
     machinectl terminate "$INSTANCE" 2> /dev/null || true
 
-    if [ -n "$HOST_ADDRESS" ]  || [ -n "$LOCAL_ADDRESS" ] ||
-       [ -n "$HOST_ADDRESS6" ] || [ -n "$LOCAL_ADDRESS6" ]; then
+    if [[ -n "''${HOST_ADDRESS-}" ]]  || [[ -n "''${LOCAL_ADDRESS-}" ]] ||
+       [[ -n "''${HOST_ADDRESS6-}" ]] || [[ -n "''${LOCAL_ADDRESS6-}" ]]; then
       ip link del dev "ve-$INSTANCE" 2> /dev/null || true
       ip link del dev "vb-$INSTANCE" 2> /dev/null || true
     fi
@@ -244,8 +244,8 @@ let
         cfg: ipcmd: variable: attribute:
         if cfg.${attribute} == null then
           ''
-            if [ -n "${variable}" ]; then
-              ${ipcmd} add "${variable}" dev "$ifaceHost"
+            if [[ -n "''${${variable}-}" ]]; then
+              ${ipcmd} add "''${${variable}}" dev "$ifaceHost"
             fi
           ''
         else
@@ -277,16 +277,16 @@ let
           '';
     in
     ''
-      if [ -n "$HOST_ADDRESS" ]  || [ -n "$LOCAL_ADDRESS" ] ||
-         [ -n "$HOST_ADDRESS6" ] || [ -n "$LOCAL_ADDRESS6" ]; then
-        if [ -z "$HOST_BRIDGE" ]; then
+      if [[ -n "''${HOST_ADDRESS-}" ]]  || [[ -n "''${LOCAL_ADDRESS-}" ]] ||
+         [[ -n "''${HOST_ADDRESS6-}" ]] || [[ -n "''${LOCAL_ADDRESS6-}" ]]; then
+        if [[ -z "''${HOST_BRIDGE-}" ]]; then
           ifaceHost=ve-$INSTANCE
           ip link set dev "$ifaceHost" up
 
-          ${ipcall cfg "ip addr" "$HOST_ADDRESS" "hostAddress"}
-          ${ipcall cfg "ip -6 addr" "$HOST_ADDRESS6" "hostAddress6"}
-          ${ipcall cfg "ip route" "$LOCAL_ADDRESS" "localAddress"}
-          ${ipcall cfg "ip -6 route" "$LOCAL_ADDRESS6" "localAddress6"}
+          ${ipcall cfg "ip addr" "HOST_ADDRESS" "hostAddress"}
+          ${ipcall cfg "ip -6 addr" "HOST_ADDRESS6" "hostAddress6"}
+          ${ipcall cfg "ip route" "LOCAL_ADDRESS" "localAddress"}
+          ${ipcall cfg "ip -6 route" "LOCAL_ADDRESS6" "localAddress6"}
         fi
       fi
       ${concatStringsSep "\n" (mapAttrsToList renderExtraVeth cfg.extraVeths)}
@@ -967,6 +967,8 @@ in
             config.nix.package
           ];
 
+          enableStrictShellChecks = true;
+
           environment = {
             root = "${stateDirectory}/%i";
             INSTANCE = "%i";

nixos/tests/all-tests.nix

@@ -377,7 +377,7 @@ in
   consul = runTest ./consul.nix;
   consul-template = runTest ./consul-template.nix;
   containers-bridge = runTest ./containers-bridge.nix;
-  containers-custom-pkgs.nix = runTest ./containers-custom-pkgs.nix;
+  containers-custom-pkgs = runTest ./containers-custom-pkgs.nix;
   containers-ephemeral = runTest ./containers-ephemeral.nix;
   containers-extra_veth = runTest ./containers-extra_veth.nix;
   containers-hosts = runTest ./containers-hosts.nix;

pkgs/applications/networking/browsers/firefox/packages/firefox-esr-140.nix

@@ -9,11 +9,11 @@
 
 buildMozillaMach rec {
   pname = "firefox";
-  version = "140.3.1esr";
+  version = "140.4.0esr";
   applicationName = "Firefox ESR";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "a9302d99d7f07f4b250aa214635814964dd083204268e05fe877a3d8330b9c0caa6c29ed19da71bd88979b7cf39ed52f17698968b0da5b0d7430b6764b43b6cc";
+    sha512 = "cfce0bdcf6d4599c7b96bccd9fd1390bfb3645db9276a369a30760ce6819850aaa4251869e6bd3c5d8582ea3728b920762c5f16f7ce12ce151c3e74327b8c811";
   };
 
   meta = {

pkgs/applications/networking/browsers/firefox/packages/firefox.nix

@@ -9,10 +9,10 @@
 
 buildMozillaMach rec {
   pname = "firefox";
-  version = "143.0.4";
+  version = "144.0";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "2bcbde4e72ea41e9ccc98836901635350b5dc7b50c618e19ab6103a27adc0f017ca3fa7555378c8af6ee1f3a14d02935289fe2b0d35d840d610f5ac07a88e4b6";
+    sha512 = "e1f924ed006a31f5333ea6af219c1fb90d4866e5889ac634c324a3e80b042a7e0b2b9aeb798672ea1a434fbf817fc0b82a12ec0fb405a48e3a2ca21cc394445e";
   };
 
   meta = {

pkgs/applications/networking/cluster/terraform-providers/default.nix

@@ -82,8 +82,7 @@ let
       passthru = attrs // {
         inherit provider-source-address;
         updateScript = writeShellScript "update" ''
-          provider="$(basename ${provider-source-address})"
-          ./pkgs/applications/networking/cluster/terraform-providers/update-provider "$provider"
+          ./pkgs/applications/networking/cluster/terraform-providers/update-provider "${owner}_${lib.removePrefix "terraform-provider-" repo}"
         '';
       };
     }
@@ -97,16 +96,16 @@ let
   # These are the providers that don't fall in line with the default model
   special-providers = {
     # github api seems to be broken, doesn't just fail to recognize the license, it's ignored entirely.
-    checkly = automated-providers.checkly.override { spdx = "MIT"; };
-    gitlab = automated-providers.gitlab.override {
+    checkly_checkly = automated-providers.checkly_checkly.override { spdx = "MIT"; };
+    gitlabhq_gitlab = automated-providers.gitlabhq_gitlab.override {
       mkProviderFetcher = fetchFromGitLab;
       owner = "gitlab-org";
     };
     # mkisofs needed to create ISOs holding cloud-init data and wrapped to terraform via deecb4c1aab780047d79978c636eeb879dd68630
-    libvirt = automated-providers.libvirt.overrideAttrs (_: {
+    dmacvicar_libvirt = automated-providers.dmacvicar_libvirt.overrideAttrs (_: {
       propagatedBuildInputs = [ cdrtools ];
     });
-    minio = automated-providers.minio.override { spdx = "AGPL-3.0-only"; };
+    aminueza_minio = automated-providers.aminueza_minio.override { spdx = "AGPL-3.0-only"; };
   };
 
   # Put all the providers we not longer support in this list.
@@ -126,7 +125,178 @@ let
       vra7 = archived "vra7" "2025/10";
     };
 
+  # added 2025-10-12
+  renamed-providers = lib.optionalAttrs config.allowAliases {
+    onepassword =
+      lib.warnOnInstantiate
+        "terraform-providers.onepassword has been renamed to terraform-providers.1password_onepassword"
+        actualProviders."1password_onepassword";
+    thunder = lib.warnOnInstantiate "terraform-providers.thunder has been renamed to terraform-providers.a10networks_thunder" actualProviders.a10networks_thunder;
+    netlify = lib.warnOnInstantiate "terraform-providers.netlify has been renamed to terraform-providers.aegirhealth_netlify" actualProviders.aegirhealth_netlify;
+    aiven = lib.warnOnInstantiate "terraform-providers.aiven has been renamed to terraform-providers.aiven_aiven" actualProviders.aiven_aiven;
+    akamai = lib.warnOnInstantiate "terraform-providers.akamai has been renamed to terraform-providers.akamai_akamai" actualProviders.akamai_akamai;
+    alicloud = lib.warnOnInstantiate "terraform-providers.alicloud has been renamed to terraform-providers.aliyun_alicloud" actualProviders.aliyun_alicloud;
+    minio = lib.warnOnInstantiate "terraform-providers.minio has been renamed to terraform-providers.aminueza_minio" actualProviders.aminueza_minio;
+    auth0 = lib.warnOnInstantiate "terraform-providers.auth0 has been renamed to terraform-providers.auth0_auth0" actualProviders.auth0_auth0;
+    aviatrix = lib.warnOnInstantiate "terraform-providers.aviatrix has been renamed to terraform-providers.aviatrixsystems_aviatrix" actualProviders.aviatrixsystems_aviatrix;
+    dhall = lib.warnOnInstantiate "terraform-providers.dhall has been renamed to terraform-providers.awakesecurity_dhall" actualProviders.awakesecurity_dhall;
+    baiducloud = lib.warnOnInstantiate "terraform-providers.baiducloud has been renamed to terraform-providers.baidubce_baiducloud" actualProviders.baidubce_baiducloud;
+    brightbox = lib.warnOnInstantiate "terraform-providers.brightbox has been renamed to terraform-providers.brightbox_brightbox" actualProviders.brightbox_brightbox;
+    buildkite = lib.warnOnInstantiate "terraform-providers.buildkite has been renamed to terraform-providers.buildkite_buildkite" actualProviders.buildkite_buildkite;
+    pass = lib.warnOnInstantiate "terraform-providers.pass has been renamed to terraform-providers.camptocamp_pass" actualProviders.camptocamp_pass;
+    sops = lib.warnOnInstantiate "terraform-providers.sops has been renamed to terraform-providers.carlpett_sops" actualProviders.carlpett_sops;
+    checkly = lib.warnOnInstantiate "terraform-providers.checkly has been renamed to terraform-providers.checkly_checkly" actualProviders.checkly_checkly;
+    aci = lib.warnOnInstantiate "terraform-providers.aci has been renamed to terraform-providers.ciscodevnet_aci" actualProviders.ciscodevnet_aci;
+    ciscoasa = lib.warnOnInstantiate "terraform-providers.ciscoasa has been renamed to terraform-providers.ciscodevnet_ciscoasa" actualProviders.ciscodevnet_ciscoasa;
+    age = lib.warnOnInstantiate "terraform-providers.age has been renamed to terraform-providers.clementblaise_age" actualProviders.clementblaise_age;
+    cloudamqp = lib.warnOnInstantiate "terraform-providers.cloudamqp has been renamed to terraform-providers.cloudamqp_cloudamqp" actualProviders.cloudamqp_cloudamqp;
+    cloudflare = lib.warnOnInstantiate "terraform-providers.cloudflare has been renamed to terraform-providers.cloudflare_cloudflare" actualProviders.cloudflare_cloudflare;
+    cloudfoundry = lib.warnOnInstantiate "terraform-providers.cloudfoundry has been renamed to terraform-providers.cloudfoundry-community_cloudfoundry" actualProviders.cloudfoundry-community_cloudfoundry;
+    utils = lib.warnOnInstantiate "terraform-providers.utils has been renamed to terraform-providers.cloudposse_utils" actualProviders.cloudposse_utils;
+    cloudscale = lib.warnOnInstantiate "terraform-providers.cloudscale has been renamed to terraform-providers.cloudscale-ch_cloudscale" actualProviders.cloudscale-ch_cloudscale;
+    constellix = lib.warnOnInstantiate "terraform-providers.constellix has been renamed to terraform-providers.constellix_constellix" actualProviders.constellix_constellix;
+    porkbun = lib.warnOnInstantiate "terraform-providers.porkbun has been renamed to terraform-providers.cullenmcdermott_porkbun" actualProviders.cullenmcdermott_porkbun;
+    postgresql = lib.warnOnInstantiate "terraform-providers.postgresql has been renamed to terraform-providers.cyrilgdn_postgresql" actualProviders.cyrilgdn_postgresql;
+    rabbitmq = lib.warnOnInstantiate "terraform-providers.rabbitmq has been renamed to terraform-providers.cyrilgdn_rabbitmq" actualProviders.cyrilgdn_rabbitmq;
+    datadog = lib.warnOnInstantiate "terraform-providers.datadog has been renamed to terraform-providers.datadog_datadog" actualProviders.datadog_datadog;
+    nexus = lib.warnOnInstantiate "terraform-providers.nexus has been renamed to terraform-providers.datadrivers_nexus" actualProviders.datadrivers_nexus;
+    deno = lib.warnOnInstantiate "terraform-providers.deno has been renamed to terraform-providers.denoland_deno" actualProviders.denoland_deno;
+    hydra = lib.warnOnInstantiate "terraform-providers.hydra has been renamed to terraform-providers.determinatesystems_hydra" actualProviders.determinatesystems_hydra;
+    digitalocean = lib.warnOnInstantiate "terraform-providers.digitalocean has been renamed to terraform-providers.digitalocean_digitalocean" actualProviders.digitalocean_digitalocean;
+    libvirt = lib.warnOnInstantiate "terraform-providers.libvirt has been renamed to terraform-providers.dmacvicar_libvirt" actualProviders.dmacvicar_libvirt;
+    dnsimple = lib.warnOnInstantiate "terraform-providers.dnsimple has been renamed to terraform-providers.dnsimple_dnsimple" actualProviders.dnsimple_dnsimple;
+    dme = lib.warnOnInstantiate "terraform-providers.dme has been renamed to terraform-providers.dnsmadeeasy_dme" actualProviders.dnsmadeeasy_dme;
+    doppler = lib.warnOnInstantiate "terraform-providers.doppler has been renamed to terraform-providers.dopplerhq_doppler" actualProviders.dopplerhq_doppler;
+    bitbucket = lib.warnOnInstantiate "terraform-providers.bitbucket has been renamed to terraform-providers.drfaust92_bitbucket" actualProviders.drfaust92_bitbucket;
+    equinix = lib.warnOnInstantiate "terraform-providers.equinix has been renamed to terraform-providers.equinix_equinix" actualProviders.equinix_equinix;
+    exoscale = lib.warnOnInstantiate "terraform-providers.exoscale has been renamed to terraform-providers.exoscale_exoscale" actualProviders.exoscale_exoscale;
+    bigip = lib.warnOnInstantiate "terraform-providers.bigip has been renamed to terraform-providers.f5networks_bigip" actualProviders.f5networks_bigip;
+    fastly = lib.warnOnInstantiate "terraform-providers.fastly has been renamed to terraform-providers.fastly_fastly" actualProviders.fastly_fastly;
+    flexibleengine = lib.warnOnInstantiate "terraform-providers.flexibleengine has been renamed to terraform-providers.flexibleenginecloud_flexibleengine" actualProviders.flexibleenginecloud_flexibleengine;
+    fortios = lib.warnOnInstantiate "terraform-providers.fortios has been renamed to terraform-providers.fortinetdev_fortios" actualProviders.fortinetdev_fortios;
+    kubectl = lib.warnOnInstantiate "terraform-providers.kubectl has been renamed to terraform-providers.gavinbunney_kubectl" actualProviders.gavinbunney_kubectl;
+    gitlab = lib.warnOnInstantiate "terraform-providers.gitlab has been renamed to terraform-providers.gitlabhq_gitlab" actualProviders.gitlabhq_gitlab;
+    gandi = lib.warnOnInstantiate "terraform-providers.gandi has been renamed to terraform-providers.go-gandi_gandi" actualProviders.go-gandi_gandi;
+    gitea = lib.warnOnInstantiate "terraform-providers.gitea has been renamed to terraform-providers.go-gitea_gitea" actualProviders.go-gitea_gitea;
+    harbor = lib.warnOnInstantiate "terraform-providers.harbor has been renamed to terraform-providers.goharbor_harbor" actualProviders.goharbor_harbor;
+    grafana = lib.warnOnInstantiate "terraform-providers.grafana has been renamed to terraform-providers.grafana_grafana" actualProviders.grafana_grafana;
+    gridscale = lib.warnOnInstantiate "terraform-providers.gridscale has been renamed to terraform-providers.gridscale_gridscale" actualProviders.gridscale_gridscale;
+    archive = lib.warnOnInstantiate "terraform-providers.archive has been renamed to terraform-providers.hashicorp_archive" actualProviders.hashicorp_archive;
+    aws = lib.warnOnInstantiate "terraform-providers.aws has been renamed to terraform-providers.hashicorp_aws" actualProviders.hashicorp_aws;
+    awscc = lib.warnOnInstantiate "terraform-providers.awscc has been renamed to terraform-providers.hashicorp_awscc" actualProviders.hashicorp_awscc;
+    azuread = lib.warnOnInstantiate "terraform-providers.azuread has been renamed to terraform-providers.hashicorp_azuread" actualProviders.hashicorp_azuread;
+    azurerm = lib.warnOnInstantiate "terraform-providers.azurerm has been renamed to terraform-providers.hashicorp_azurerm" actualProviders.hashicorp_azurerm;
+    cloudinit = lib.warnOnInstantiate "terraform-providers.cloudinit has been renamed to terraform-providers.hashicorp_cloudinit" actualProviders.hashicorp_cloudinit;
+    consul = lib.warnOnInstantiate "terraform-providers.consul has been renamed to terraform-providers.hashicorp_consul" actualProviders.hashicorp_consul;
+    dns = lib.warnOnInstantiate "terraform-providers.dns has been renamed to terraform-providers.hashicorp_dns" actualProviders.hashicorp_dns;
+    external = lib.warnOnInstantiate "terraform-providers.external has been renamed to terraform-providers.hashicorp_external" actualProviders.hashicorp_external;
+    google = lib.warnOnInstantiate "terraform-providers.google has been renamed to terraform-providers.hashicorp_google" actualProviders.hashicorp_google;
+    google-beta = lib.warnOnInstantiate "terraform-providers.google-beta has been renamed to terraform-providers.hashicorp_google-beta" actualProviders.hashicorp_google-beta;
+    helm = lib.warnOnInstantiate "terraform-providers.helm has been renamed to terraform-providers.hashicorp_helm" actualProviders.hashicorp_helm;
+    http = lib.warnOnInstantiate "terraform-providers.http has been renamed to terraform-providers.hashicorp_http" actualProviders.hashicorp_http;
+    kubernetes = lib.warnOnInstantiate "terraform-providers.kubernetes has been renamed to terraform-providers.hashicorp_kubernetes" actualProviders.hashicorp_kubernetes;
+    local = lib.warnOnInstantiate "terraform-providers.local has been renamed to terraform-providers.hashicorp_local" actualProviders.hashicorp_local;
+    nomad = lib.warnOnInstantiate "terraform-providers.nomad has been renamed to terraform-providers.hashicorp_nomad" actualProviders.hashicorp_nomad;
+    null = lib.warnOnInstantiate "terraform-providers.null has been renamed to terraform-providers.hashicorp_null" actualProviders.hashicorp_null;
+    random = lib.warnOnInstantiate "terraform-providers.random has been renamed to terraform-providers.hashicorp_random" actualProviders.hashicorp_random;
+    tfe = lib.warnOnInstantiate "terraform-providers.tfe has been renamed to terraform-providers.hashicorp_tfe" actualProviders.hashicorp_tfe;
+    time = lib.warnOnInstantiate "terraform-providers.time has been renamed to terraform-providers.hashicorp_time" actualProviders.hashicorp_time;
+    tls = lib.warnOnInstantiate "terraform-providers.tls has been renamed to terraform-providers.hashicorp_tls" actualProviders.hashicorp_tls;
+    vault = lib.warnOnInstantiate "terraform-providers.vault has been renamed to terraform-providers.hashicorp_vault" actualProviders.hashicorp_vault;
+    vsphere = lib.warnOnInstantiate "terraform-providers.vsphere has been renamed to terraform-providers.hashicorp_vsphere" actualProviders.hashicorp_vsphere;
+    heroku = lib.warnOnInstantiate "terraform-providers.heroku has been renamed to terraform-providers.heroku_heroku" actualProviders.heroku_heroku;
+    hcloud = lib.warnOnInstantiate "terraform-providers.hcloud has been renamed to terraform-providers.hetznercloud_hcloud" actualProviders.hetznercloud_hcloud;
+    huaweicloud = lib.warnOnInstantiate "terraform-providers.huaweicloud has been renamed to terraform-providers.huaweicloud_huaweicloud" actualProviders.huaweicloud_huaweicloud;
+    ibm = lib.warnOnInstantiate "terraform-providers.ibm has been renamed to terraform-providers.ibm-cloud_ibm" actualProviders.ibm-cloud_ibm;
+    icinga2 = lib.warnOnInstantiate "terraform-providers.icinga2 has been renamed to terraform-providers.icinga_icinga2" actualProviders.icinga_icinga2;
+    infoblox = lib.warnOnInstantiate "terraform-providers.infoblox has been renamed to terraform-providers.infobloxopen_infoblox" actualProviders.infobloxopen_infoblox;
+    github = lib.warnOnInstantiate "terraform-providers.github has been renamed to terraform-providers.integrations_github" actualProviders.integrations_github;
+    artifactory = lib.warnOnInstantiate "terraform-providers.artifactory has been renamed to terraform-providers.jfrog_artifactory" actualProviders.jfrog_artifactory;
+    project = lib.warnOnInstantiate "terraform-providers.project has been renamed to terraform-providers.jfrog_project" actualProviders.jfrog_project;
+    sentry = lib.warnOnInstantiate "terraform-providers.sentry has been renamed to terraform-providers.jianyuan_sentry" actualProviders.jianyuan_sentry;
+    openwrt = lib.warnOnInstantiate "terraform-providers.openwrt has been renamed to terraform-providers.joneshf_openwrt" actualProviders.joneshf_openwrt;
+    triton = lib.warnOnInstantiate "terraform-providers.triton has been renamed to terraform-providers.joyent_triton" actualProviders.joyent_triton;
+    keycloak = lib.warnOnInstantiate "terraform-providers.keycloak has been renamed to terraform-providers.keycloak_keycloak" actualProviders.keycloak_keycloak;
+    neon = lib.warnOnInstantiate "terraform-providers.neon has been renamed to terraform-providers.kislerdm_neon" actualProviders.kislerdm_neon;
+    docker = lib.warnOnInstantiate "terraform-providers.docker has been renamed to terraform-providers.kreuzwerker_docker" actualProviders.kreuzwerker_docker;
+    launchdarkly = lib.warnOnInstantiate "terraform-providers.launchdarkly has been renamed to terraform-providers.launchdarkly_launchdarkly" actualProviders.launchdarkly_launchdarkly;
+    linode = lib.warnOnInstantiate "terraform-providers.linode has been renamed to terraform-providers.linode_linode" actualProviders.linode_linode;
+    htpasswd = lib.warnOnInstantiate "terraform-providers.htpasswd has been renamed to terraform-providers.loafoe_htpasswd" actualProviders.loafoe_htpasswd;
+    ssh = lib.warnOnInstantiate "terraform-providers.ssh has been renamed to terraform-providers.loafoe_ssh" actualProviders.loafoe_ssh;
+    incus = lib.warnOnInstantiate "terraform-providers.incus has been renamed to terraform-providers.lxc_incus" actualProviders.lxc_incus;
+    dexidp = lib.warnOnInstantiate "terraform-providers.dexidp has been renamed to terraform-providers.marcofranssen_dexidp" actualProviders.marcofranssen_dexidp;
+    bitwarden = lib.warnOnInstantiate "terraform-providers.bitwarden has been renamed to terraform-providers.maxlaverse_bitwarden" actualProviders.maxlaverse_bitwarden;
+    migadu = lib.warnOnInstantiate "terraform-providers.migadu has been renamed to terraform-providers.metio_migadu" actualProviders.metio_migadu;
+    kafka = lib.warnOnInstantiate "terraform-providers.kafka has been renamed to terraform-providers.mongey_kafka" actualProviders.mongey_kafka;
+    kafka-connect = lib.warnOnInstantiate "terraform-providers.kafka-connect has been renamed to terraform-providers.mongey_kafka-connect" actualProviders.mongey_kafka-connect;
+    mongodbatlas = lib.warnOnInstantiate "terraform-providers.mongodbatlas has been renamed to terraform-providers.mongodb_mongodbatlas" actualProviders.mongodb_mongodbatlas;
+    namecheap = lib.warnOnInstantiate "terraform-providers.namecheap has been renamed to terraform-providers.namecheap_namecheap" actualProviders.namecheap_namecheap;
+    jetstream = lib.warnOnInstantiate "terraform-providers.jetstream has been renamed to terraform-providers.nats-io_jetstream" actualProviders.nats-io_jetstream;
+    ansible = lib.warnOnInstantiate "terraform-providers.ansible has been renamed to terraform-providers.nbering_ansible" actualProviders.nbering_ansible;
+    newrelic = lib.warnOnInstantiate "terraform-providers.newrelic has been renamed to terraform-providers.newrelic_newrelic" actualProviders.newrelic_newrelic;
+    ns1 = lib.warnOnInstantiate "terraform-providers.ns1 has been renamed to terraform-providers.ns1-terraform_ns1" actualProviders.ns1-terraform_ns1;
+    linuxbox = lib.warnOnInstantiate "terraform-providers.linuxbox has been renamed to terraform-providers.numtide_linuxbox" actualProviders.numtide_linuxbox;
+    secret = lib.warnOnInstantiate "terraform-providers.secret has been renamed to terraform-providers.numtide_secret" actualProviders.numtide_secret;
+    nutanix = lib.warnOnInstantiate "terraform-providers.nutanix has been renamed to terraform-providers.nutanix_nutanix" actualProviders.nutanix_nutanix;
+    argocd = lib.warnOnInstantiate "terraform-providers.argocd has been renamed to terraform-providers.oboukili_argocd" actualProviders.oboukili_argocd;
+    okta = lib.warnOnInstantiate "terraform-providers.okta has been renamed to terraform-providers.okta_okta" actualProviders.okta_okta;
+    oktaasa = lib.warnOnInstantiate "terraform-providers.oktaasa has been renamed to terraform-providers.oktadeveloper_oktaasa" actualProviders.oktadeveloper_oktaasa;
+    opennebula = lib.warnOnInstantiate "terraform-providers.opennebula has been renamed to terraform-providers.opennebula_opennebula" actualProviders.opennebula_opennebula;
+    openstack = lib.warnOnInstantiate "terraform-providers.openstack has been renamed to terraform-providers.openstack_openstack" actualProviders.openstack_openstack;
+    opentelekomcloud = lib.warnOnInstantiate "terraform-providers.opentelekomcloud has been renamed to terraform-providers.opentelekomcloud_opentelekomcloud" actualProviders.opentelekomcloud_opentelekomcloud;
+    opsgenie = lib.warnOnInstantiate "terraform-providers.opsgenie has been renamed to terraform-providers.opsgenie_opsgenie" actualProviders.opsgenie_opsgenie;
+    oci = lib.warnOnInstantiate "terraform-providers.oci has been renamed to terraform-providers.oracle_oci" actualProviders.oracle_oci;
+    ovh = lib.warnOnInstantiate "terraform-providers.ovh has been renamed to terraform-providers.ovh_ovh" actualProviders.ovh_ovh;
+    slack = lib.warnOnInstantiate "terraform-providers.slack has been renamed to terraform-providers.pablovarela_slack" actualProviders.pablovarela_slack;
+    pagerduty = lib.warnOnInstantiate "terraform-providers.pagerduty has been renamed to terraform-providers.pagerduty_pagerduty" actualProviders.pagerduty_pagerduty;
+    powerdns = lib.warnOnInstantiate "terraform-providers.powerdns has been renamed to terraform-providers.pan-net_powerdns" actualProviders.pan-net_powerdns;
+    elasticsearch = lib.warnOnInstantiate "terraform-providers.elasticsearch has been renamed to terraform-providers.phillbaker_elasticsearch" actualProviders.phillbaker_elasticsearch;
+    ct = lib.warnOnInstantiate "terraform-providers.ct has been renamed to terraform-providers.poseidon_ct" actualProviders.poseidon_ct;
+    matchbox = lib.warnOnInstantiate "terraform-providers.matchbox has been renamed to terraform-providers.poseidon_matchbox" actualProviders.poseidon_matchbox;
+    rancher2 = lib.warnOnInstantiate "terraform-providers.rancher2 has been renamed to terraform-providers.rancher_rancher2" actualProviders.rancher_rancher2;
+    rootly = lib.warnOnInstantiate "terraform-providers.rootly has been renamed to terraform-providers.rootlyhq_rootly" actualProviders.rootlyhq_rootly;
+    rundeck = lib.warnOnInstantiate "terraform-providers.rundeck has been renamed to terraform-providers.rundeck_rundeck" actualProviders.rundeck_rundeck;
+    sakuracloud = lib.warnOnInstantiate "terraform-providers.sakuracloud has been renamed to terraform-providers.sacloud_sakuracloud" actualProviders.sacloud_sakuracloud;
+    btp = lib.warnOnInstantiate "terraform-providers.btp has been renamed to terraform-providers.sap_btp" actualProviders.sap_btp;
+    ccloud = lib.warnOnInstantiate "terraform-providers.ccloud has been renamed to terraform-providers.sapcc_ccloud" actualProviders.sapcc_ccloud;
+    scaleway = lib.warnOnInstantiate "terraform-providers.scaleway has been renamed to terraform-providers.scaleway_scaleway" actualProviders.scaleway_scaleway;
+    shell = lib.warnOnInstantiate "terraform-providers.shell has been renamed to terraform-providers.scottwinkler_shell" actualProviders.scottwinkler_shell;
+    selectel = lib.warnOnInstantiate "terraform-providers.selectel has been renamed to terraform-providers.selectel_selectel" actualProviders.selectel_selectel;
+    talos = lib.warnOnInstantiate "terraform-providers.talos has been renamed to terraform-providers.siderolabs_talos" actualProviders.siderolabs_talos;
+    skytap = lib.warnOnInstantiate "terraform-providers.skytap has been renamed to terraform-providers.skytap_skytap" actualProviders.skytap_skytap;
+    snowflake = lib.warnOnInstantiate "terraform-providers.snowflake has been renamed to terraform-providers.snowflake-labs_snowflake" actualProviders.snowflake-labs_snowflake;
+    spacelift = lib.warnOnInstantiate "terraform-providers.spacelift has been renamed to terraform-providers.spacelift-io_spacelift" actualProviders.spacelift-io_spacelift;
+    signalfx = lib.warnOnInstantiate "terraform-providers.signalfx has been renamed to terraform-providers.splunk-terraform_signalfx" actualProviders.splunk-terraform_signalfx;
+    spotinst = lib.warnOnInstantiate "terraform-providers.spotinst has been renamed to terraform-providers.spotinst_spotinst" actualProviders.spotinst_spotinst;
+    statuscake = lib.warnOnInstantiate "terraform-providers.statuscake has been renamed to terraform-providers.statuscakedev_statuscake" actualProviders.statuscakedev_statuscake;
+    sumologic = lib.warnOnInstantiate "terraform-providers.sumologic has been renamed to terraform-providers.sumologic_sumologic" actualProviders.sumologic_sumologic;
+    sysdig = lib.warnOnInstantiate "terraform-providers.sysdig has been renamed to terraform-providers.sysdiglabs_sysdig" actualProviders.sysdiglabs_sysdig;
+    tailscale = lib.warnOnInstantiate "terraform-providers.tailscale has been renamed to terraform-providers.tailscale_tailscale" actualProviders.tailscale_tailscale;
+    proxmox = lib.warnOnInstantiate "terraform-providers.proxmox has been renamed to terraform-providers.telmate_proxmox" actualProviders.telmate_proxmox;
+    temporalcloud = lib.warnOnInstantiate "terraform-providers.temporalcloud has been renamed to terraform-providers.temporalio_temporalcloud" actualProviders.temporalio_temporalcloud;
+    tencentcloud = lib.warnOnInstantiate "terraform-providers.tencentcloud has been renamed to terraform-providers.tencentcloudstack_tencentcloud" actualProviders.tencentcloudstack_tencentcloud;
+    remote = lib.warnOnInstantiate "terraform-providers.remote has been renamed to terraform-providers.tenstad_remote" actualProviders.tenstad_remote;
+    virtualbox = lib.warnOnInstantiate "terraform-providers.virtualbox has been renamed to terraform-providers.terra-farm_virtualbox" actualProviders.terra-farm_virtualbox;
+    lxd = lib.warnOnInstantiate "terraform-providers.lxd has been renamed to terraform-providers.terraform-lxd_lxd" actualProviders.terraform-lxd_lxd;
+    routeros = lib.warnOnInstantiate "terraform-providers.routeros has been renamed to terraform-providers.terraform-routeros_routeros" actualProviders.terraform-routeros_routeros;
+    hetznerdns = lib.warnOnInstantiate "terraform-providers.hetznerdns has been renamed to terraform-providers.timohirt_hetznerdns" actualProviders.timohirt_hetznerdns;
+    pocketid = lib.warnOnInstantiate "terraform-providers.pocketid has been renamed to terraform-providers.trozz_pocketid" actualProviders.trozz_pocketid;
+    turbot = lib.warnOnInstantiate "terraform-providers.turbot has been renamed to terraform-providers.turbot_turbot" actualProviders.turbot_turbot;
+    unifi = lib.warnOnInstantiate "terraform-providers.unifi has been renamed to terraform-providers.ubiquiti-community_unifi" actualProviders.ubiquiti-community_unifi;
+    ucloud = lib.warnOnInstantiate "terraform-providers.ucloud has been renamed to terraform-providers.ucloud_ucloud" actualProviders.ucloud_ucloud;
+    acme = lib.warnOnInstantiate "terraform-providers.acme has been renamed to terraform-providers.vancluever_acme" actualProviders.vancluever_acme;
+    venafi = lib.warnOnInstantiate "terraform-providers.venafi has been renamed to terraform-providers.venafi_venafi" actualProviders.venafi_venafi;
+    vinyldns = lib.warnOnInstantiate "terraform-providers.vinyldns has been renamed to terraform-providers.vinyldns_vinyldns" actualProviders.vinyldns_vinyldns;
+    avi = lib.warnOnInstantiate "terraform-providers.avi has been renamed to terraform-providers.vmware_avi" actualProviders.vmware_avi;
+    vcd = lib.warnOnInstantiate "terraform-providers.vcd has been renamed to terraform-providers.vmware_vcd" actualProviders.vmware_vcd;
+    wavefront = lib.warnOnInstantiate "terraform-providers.wavefront has been renamed to terraform-providers.vmware_wavefront" actualProviders.vmware_wavefront;
+    vpsadmin = lib.warnOnInstantiate "terraform-providers.vpsadmin has been renamed to terraform-providers.vpsfreecz_vpsadmin" actualProviders.vpsfreecz_vpsadmin;
+    vultr = lib.warnOnInstantiate "terraform-providers.vultr has been renamed to terraform-providers.vultr_vultr" actualProviders.vultr_vultr;
+    mailgun = lib.warnOnInstantiate "terraform-providers.mailgun has been renamed to terraform-providers.wgebis_mailgun" actualProviders.wgebis_mailgun;
+    yandex = lib.warnOnInstantiate "terraform-providers.yandex has been renamed to terraform-providers.yandex-cloud_yandex" actualProviders.yandex-cloud_yandex;
+  };
+
   # excluding aliases, used by terraform-full
   actualProviders = automated-providers // special-providers;
 in
-actualProviders // removed-providers // { inherit actualProviders mkProvider; }
+actualProviders // removed-providers // renamed-providers // { inherit actualProviders mkProvider; }

pkgs/applications/networking/cluster/terraform-providers/update-provider

@@ -12,18 +12,13 @@ set -x
 
 show_usage() {
   cat <<DOC
-Usage: ./update-provider [--force] [--no-build] [<owner>/]<provider>
+Usage: ./update-provider [--force] [--no-build] <owner>_<provider>
 
-Update a single provider in the providers.json inventory file.
+Add or update a single provider in the providers.json inventory file.
 
-For example to update 'terraform-providers.aws' run:
+For example to update 'terraform-providers.hashicorp_aws' run:
 
-    ./update-provider aws
-
-If the provider is not in the list already, use the form '<owner>/<provider>'
-to add the provider to the list:
-
-    ./update-provider hetznercloud/hcloud
+    ./update-provider hashicorp_aws
 
 Options:
 
@@ -104,9 +99,11 @@ is_stable_version() {
 
 pushd "$(dirname "$0")" >/dev/null
 
-if [[ ${provider} =~ ^[^/]+/[^/]+$ ]]; then
-  homepage="https://registry.terraform.io/providers/${provider}"
-  provider=$(basename "${provider}")
+provider="$(echo "$provider" | tr '[:upper:]' '[:lower:]')"
+homepage="$(read_attr homepage)"
+
+if [[ $homepage == "null" ]]; then
+  homepage="https://registry.terraform.io/providers/${provider//_//}"
   echo_provider "init"
   update_attr homepage "${homepage}"
   # create empty stings so nix-prefetch works
@@ -115,18 +112,16 @@ if [[ ${provider} =~ ^[^/]+/[^/]+$ ]]; then
   update_attr spdx ""
 fi
 
-homepage="$(read_attr homepage)"
-
 old_rev="$(read_attr rev)"
 registry_response_unstable=$(curl -s "${homepage//providers/v1/providers}")
 
 if is_stable_version "${old_rev}"; then
-  version_stable=$(jq -r '.versions | map(select(test("^[0-9]+\\.[0-9]+\\.[0-9]+$"))) | last' <<<${registry_response_unstable})
+  version_stable=$(jq -r '.versions | map(select(test("^[0-9]+\\.[0-9]+\\.[0-9]+$"))) | last' <<<"${registry_response_unstable}")
   registry_response_stable=$(curl -s "${homepage//providers/v1/providers}/${version_stable}")
-  rev="$(jq -r '.tag' <<<${registry_response_stable})"
+  rev="$(jq -r '.tag' <<<"${registry_response_stable}")"
   registry_response=$registry_response_stable
 else
-  rev="$(jq -r '.tag' <<<${registry_response_unstable})"
+  rev="$(jq -r '.tag' <<<"${registry_response_unstable}")"
   registry_response=$registry_response_unstable
 fi
 

pkgs/applications/networking/cluster/terraform/default.nix

@@ -213,7 +213,7 @@ rec {
       mainTf = writeText "main.tf" ''
         resource "random_id" "test" {}
       '';
-      terraform = terraform_1.withPlugins (p: [ p.random ]);
+      terraform = terraform_1.withPlugins (p: [ p.hashicorp_random ]);
       test = runCommand "terraform-plugin-test" { buildInputs = [ terraform ]; } ''
         set -e
         # make it fail outside of sandbox

pkgs/build-support/build-mozilla-mach/default.nix

@@ -89,7 +89,6 @@ in
   nasm,
   nspr,
   nss_esr,
-  nss_3_114,
   nss_3_115,
   nss_latest,
   onnxruntime,
@@ -578,8 +577,6 @@ buildStdenv.mkDerivation {
           nss_latest
         else if (lib.versionAtLeast version "143") then
           nss_3_115
-        else if (lib.versionAtLeast version "141") then
-          nss_3_114
         else
           nss_esr
       )

pkgs/by-name/do/docfd/nottui-unix.patch

@@ -12,8 +12,8 @@ index e0ddc1f..a4e8523 100644
              eio
 diff --git a/bin/ui_base.ml b/bin/ui_base.ml
 index f56ee8d..8d8ed70 100644
---- a/bin/ui_base.ml
-+++ b/bin/ui_base.ml
+--- a/bin/UI_base.ml
++++ b/bin/UI_base.ml
 @@ -587,7 +587,7 @@ let ui_loop ~quit ~term root =
        if term_width <> prev_term_width || term_height <> prev_term_height then (
          Lwd.set Vars.term_width_height (term_width, term_height)

pkgs/by-name/do/docfd/package.nix

@@ -14,7 +14,7 @@
 
 ocamlPackages.buildDunePackage rec {
   pname = "docfd";
-  version = "11.0.1";
+  version = "12.0.0";
 
   minimalOCamlVersion = "5.1";
 
@@ -22,7 +22,7 @@ ocamlPackages.buildDunePackage rec {
     owner = "darrenldl";
     repo = "docfd";
     rev = version;
-    hash = "sha256-uRC2QBn4gAfS9u85YaNH2Mm2C0reP8FnDHbyloY+OC8=";
+    hash = "sha256-Tb5J9FgI2JBpl5oejWRT3ixzt7kufnM+Xy6DdiB9s98=";
   };
 
   # Compatibility with nottui ≥ 0.4

pkgs/by-name/gp/gpxsee/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gpxsee";
-  version = "14.0";
+  version = "14.1";
 
   src = fetchFromGitHub {
     owner = "tumic0";
     repo = "GPXSee";
     tag = finalAttrs.version;
-    hash = "sha256-oLwkryR2C1rGAUM7Gvn0uUy1aQGtFaAkFy8RQAAnNHU=";
+    hash = "sha256-wXlmly2KtjyY5hdBAroP3H93+1tg5rtFPpDKFn3jnhA=";
   };
 
   buildInputs = [

pkgs/by-name/iv/ivan/cmake.patch

@@ -0,0 +1,19 @@
+From bbfcbd7c039ddcfc3f419a4a45eee0076696fd39 Mon Sep 17 00:00:00 2001
+From: ryfactor <6005108+ryfactor@users.noreply.github.com>
+Date: Fri, 13 Jun 2025 11:00:58 +1200
+Subject: [PATCH] Update CMake min version to 3.5
+
+---
+ CMakeLists.txt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index e2358bad4..95db47bc7 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -1,4 +1,4 @@
+-cmake_minimum_required(VERSION 2.8.12.2)
++cmake_minimum_required(VERSION 3.5)
+ project(ivan CXX C)
+ 
+ set(CMAKE_MODULE_PATH "${CMAKE_SOURCE_DIR}/cmake")

pkgs/by-name/iv/ivan/package.nix

@@ -23,6 +23,10 @@ stdenv.mkDerivation rec {
     hash = "sha256-vqrQozsNrqW4oqoJ4V5E15AsMEuHq+pyZz7EtiA5euE=";
   };
 
+  patches = [
+    ./cmake.patch
+  ];
+
   nativeBuildInputs = [
     cmake
     pkg-config

pkgs/by-name/ki/kitget/package.nix

@@ -0,0 +1,36 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  openssl,
+  pkg-config,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "kitget";
+  version = "0.0.2";
+
+  src = fetchFromGitHub {
+    owner = "adamperkowski";
+    repo = "kitget";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-i26nu5SkcPhqwh+/bw1rz7h8K2u+hhSsOGiLj3sF1RQ=";
+  };
+
+  cargoHash = "sha256-KARJV8SdbNa4tUuwyyfrLKdsj9fPF10MpL9hDGOQLm4=";
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ openssl ];
+
+  # the project doesn't implement any tests
+  doCheck = false;
+
+  meta = {
+    description = "Display and customize cat images in your terminal";
+    homepage = "https://github.com/adamperkowski/kitget";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ adamperkowski ];
+    mainProgram = "kitget";
+    platforms = lib.platforms.linux;
+  };
+})

pkgs/by-name/lo/lockbook-desktop/package.nix

@@ -18,16 +18,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "lockbook-desktop";
-  version = "25.10.7";
+  version = "25.10.13";
 
   src = fetchFromGitHub {
     owner = "lockbook";
     repo = "lockbook";
     tag = version;
-    hash = "sha256-EzVMTJaxPeIOJUdwmaShMLEe1XQcJx+0i1Rl0ILi5+c=";
+    hash = "sha256-TxNJpHQc18VVEnETNGpDSOn5yh+vHRyha8wXfipyyII=";
   };
 
-  cargoHash = "sha256-ze82Iu2lH0n3ucKibLu3/VWMaaDWhs0oFFe/na2GbmY=";
+  cargoHash = "sha256-UBzngkgfTObhoh9MSq80gZqpJtmB6hFDtW2dYuGgQB4=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/lo/lockbook/package.nix

@@ -7,16 +7,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "lockbook";
-  version = "25.10.7";
+  version = "25.10.13";
 
   src = fetchFromGitHub {
     owner = "lockbook";
     repo = "lockbook";
     tag = version;
-    hash = "sha256-EzVMTJaxPeIOJUdwmaShMLEe1XQcJx+0i1Rl0ILi5+c=";
+    hash = "sha256-TxNJpHQc18VVEnETNGpDSOn5yh+vHRyha8wXfipyyII=";
   };
 
-  cargoHash = "sha256-ze82Iu2lH0n3ucKibLu3/VWMaaDWhs0oFFe/na2GbmY=";
+  cargoHash = "sha256-UBzngkgfTObhoh9MSq80gZqpJtmB6hFDtW2dYuGgQB4=";
 
   doCheck = false; # there are no cli tests
   cargoBuildFlags = [

pkgs/by-name/op/opentofu/package.nix

@@ -86,7 +86,7 @@ let
 
         resource "random_id" "test" {}
       '';
-      opentofu = (pluggable package).withPlugins (p: [ p.random ]);
+      opentofu = (pluggable package).withPlugins (p: [ p.hashicorp_random ]);
       test = runCommand "opentofu-plugin-test" { buildInputs = [ opentofu ]; } ''
         # make it fail outside of sandbox
         export HTTP_PROXY=http://127.0.0.1:0 HTTPS_PROXY=https://127.0.0.1:0

pkgs/by-name/vc/vcpkg-tool/package.nix

@@ -24,13 +24,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "vcpkg-tool";
-  version = "2025-09-03";
+  version = "2025-10-10";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "vcpkg-tool";
     rev = finalAttrs.version;
-    hash = "sha256-mQY5K0dBRWkZooeqRm5X0JXTuD4Xfzs9Vi5j+tbd1aw=";
+    hash = "sha256-u88yjYhBKo8uX/jVQypYzOqWeE6PSM+GJD5v5qZyjC4=";
   };
 
   nativeBuildInputs = [

pkgs/development/compilers/ocaml/5.4.nix

@@ -0,0 +1,6 @@
+import ./generic.nix {
+  major_version = "5";
+  minor_version = "4";
+  patch_version = "0";
+  sha256 = "sha256-36qKLhHHmbwXZdi+9EkRQG7l9IAwJxkDgqk5+IyRImY=";
+}

pkgs/development/libraries/nss/3_114.nix

@@ -1,6 +0,0 @@
-import ./generic.nix {
-  version = "3.114.1";
-  hash = "sha256-xs7G5MHOd6mPVpBfDd2fFG2qw+5KypBTPqErbl0zfrk=";
-  filename = "3_114.nix";
-  versionRegex = "NSS_(3)_(114)(?:_(\\d+))?_RTM";
-}

pkgs/development/ocaml-modules/bistro/default.nix

@@ -48,6 +48,6 @@ buildDunePackage rec {
     description = "Build and execute typed scientific workflows";
     maintainers = [ lib.maintainers.vbgl ];
     license = lib.licenses.gpl2;
-    meta.broken = lib.versionAtLeast ppxlib.version "0.36";
+    broken = lib.versionAtLeast ppxlib.version "0.36";
   };
 }

pkgs/development/ocaml-modules/kcas/default.nix

@@ -2,6 +2,7 @@
   lib,
   buildDunePackage,
   fetchurl,
+  ocaml,
   domain-local-await,
   domain-local-timeout,
   alcotest,
@@ -29,7 +30,7 @@ buildDunePackage rec {
     backoff
   ];
 
-  doCheck = true;
+  doCheck = !lib.versionAtLeast ocaml.version "5.4";
   nativeCheckInputs = [ mdx.bin ];
   checkInputs = [
     alcotest

pkgs/development/ocaml-modules/morbig/default.nix

@@ -1,5 +1,6 @@
 {
   lib,
+  ocaml,
   buildDunePackage,
   fetchFromGitHub,
   menhir,
@@ -9,34 +10,36 @@
   yojson,
 }:
 
-buildDunePackage rec {
-  pname = "morbig";
-  version = "0.11.0";
+lib.throwIf (lib.versionAtLeast ocaml.version "5.4")
+  "morbig is not available for OCaml ${ocaml.version}"
 
-  src = fetchFromGitHub {
-    owner = "colis-anr";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-fOBaJHHP/Imi9UDLflI52OdKDcmMxpl+NH3pfofmv/o=";
-  };
+  buildDunePackage
+  rec {
+    pname = "morbig";
+    version = "0.11.0";
 
-  duneVersion = "3";
+    src = fetchFromGitHub {
+      owner = "colis-anr";
+      repo = pname;
+      rev = "v${version}";
+      hash = "sha256-fOBaJHHP/Imi9UDLflI52OdKDcmMxpl+NH3pfofmv/o=";
+    };
 
-  nativeBuildInputs = [
-    menhir
-  ];
+    nativeBuildInputs = [
+      menhir
+    ];
 
-  propagatedBuildInputs = [
-    menhirLib
-    ppx_deriving_yojson
-    visitors
-    yojson
-  ];
+    propagatedBuildInputs = [
+      menhirLib
+      ppx_deriving_yojson
+      visitors
+      yojson
+    ];
 
-  meta = with lib; {
-    homepage = "https://github.com/colis-anr/${pname}";
-    description = "Static parser for POSIX Shell";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ niols ];
-  };
-}
+    meta = with lib; {
+      homepage = "https://github.com/colis-anr/${pname}";
+      description = "Static parser for POSIX Shell";
+      license = licenses.gpl3Plus;
+      maintainers = with maintainers; [ niols ];
+    };
+  }

pkgs/development/ocaml-modules/notty/default.nix

@@ -2,6 +2,7 @@
   lib,
   buildDunePackage,
   fetchurl,
+  fetchpatch,
   cppo,
   uutf,
   lwt,
@@ -18,6 +19,12 @@ buildDunePackage rec {
     sha256 = "sha256-dGWfsUBz20Q4mJiRqyTyS++Bqkl9rBbZpn+aHJwgCCQ=";
   };
 
+  # Compatibility with OCaml 5.4
+  patches = fetchpatch {
+    url = "https://github.com/pqwy/notty/commit/a4d62f467e257196a5192da2184bd021dfd948b7.patch";
+    hash = "sha256-p1eUuCvQKLj8uBeGyT2+i9WOYy4rk84pf9L3QioJDNY=";
+  };
+
   nativeBuildInputs = [ cppo ];
 
   propagatedBuildInputs = [

pkgs/development/ocaml-modules/ocaml-lsp/jsonrpc.nix

@@ -9,7 +9,9 @@
   lib,
   ocaml,
   version ?
-    if lib.versionAtLeast ocaml.version "5.3" then
+    if lib.versionAtLeast ocaml.version "5.4" then
+      "1.24.0"
+    else if lib.versionAtLeast ocaml.version "5.3" then
       "1.23.1"
     else if lib.versionAtLeast ocaml.version "5.2" then
       "1.21.0"
@@ -26,6 +28,11 @@
 let
   params =
     {
+      "1.24.0" = {
+        name = "lsp";
+        minimalOCamlVersion = "5.3";
+        sha256 = "sha256-TVoaIVf2EvbALY+DjZferKX4GyOt08XOpcts7Ot7N1c=";
+      };
       "1.23.1" = {
         name = "lsp";
         minimalOCamlVersion = "5.3";

pkgs/development/ocaml-modules/ocaml-lsp/lsp.nix

@@ -23,7 +23,9 @@
   ocamlformat-rpc-lib,
   ocaml,
   version ?
-    if lib.versionAtLeast ocaml.version "5.3" then
+    if lib.versionAtLeast ocaml.version "5.4" then
+      "1.24.0"
+    else if lib.versionAtLeast ocaml.version "5.3" then
       "1.23.1"
     else if lib.versionAtLeast ocaml.version "5.2" then
       "1.21.0"

pkgs/development/ocaml-modules/ocf/ppx.nix

@@ -1,4 +1,5 @@
 {
+  fetchpatch,
   buildDunePackage,
   ocf,
   ppxlib,
@@ -10,7 +11,14 @@ buildDunePackage {
 
   inherit (ocf) src version;
 
-  duneVersion = "3";
+  patches = [
+    # Support for ppxlib ≥ 0.37
+    (fetchpatch {
+      url = "https://framagit.org/zoggy/ocf/-/commit/38b1f6420e5c01b3ea6b2fed99b6b62e4c848dc0.patch";
+      hash = "sha256-GymTdK/dOYGianvNIKkl9OhBGW+4dX5TqAkQuEF5FmA=";
+      includes = [ "*.ml" ];
+    })
+  ];
 
   buildInputs = [
     ppxlib

pkgs/development/ocaml-modules/ppxlib/default.nix

@@ -1,13 +1,17 @@
 {
   lib,
   fetchurl,
+  fetchFromGitHub,
   buildDunePackage,
   ocaml,
   version ?
     if lib.versionAtLeast ocaml.version "4.07" then
       if lib.versionAtLeast ocaml.version "4.08" then
         if lib.versionAtLeast ocaml.version "4.11" then
-          if lib.versionAtLeast ocaml.version "5.03" then "0.36.2" else "0.33.0"
+          if lib.versionAtLeast ocaml.version "5.03" then
+            if lib.versionAtLeast ocaml.version "5.04" then "0.37.0" else "0.36.2"
+          else
+            "0.33.0"
         else
           "0.24.0"
       else
@@ -91,6 +95,10 @@ let
         sha256 = "sha256-yHVgB9jKwTeahGEUYQDB1hHH327MGpoKqb3ewNbk5xs=";
         min_version = "4.08";
       };
+      "0.37.0" = {
+        sha256 = "sha256-LiI4N+fOzDvISkMkMsCnL04dW+kWXJwzdy8VbbhdsLM=";
+        min_version = "4.08";
+      };
     }
     ."${version}";
 in
@@ -106,10 +114,11 @@ else
     pname = "ppxlib";
     inherit version;
 
-    src = fetchurl {
-      url = "https://github.com/ocaml-ppx/ppxlib/releases/download/${version}/ppxlib-${version}.tbz";
-      inherit (param) sha256;
-    };
+    src =
+      param.src or (fetchurl {
+        url = "https://github.com/ocaml-ppx/ppxlib/releases/download/${version}/ppxlib-${version}.tbz";
+        inherit (param) sha256;
+      });
 
     propagatedBuildInputs = [
       ocaml-compiler-libs

pkgs/development/ocaml-modules/xtmpl/ppx.nix

@@ -9,6 +9,12 @@ buildDunePackage {
 
   inherit (xtmpl) src version;
 
+  # Fix for ppxlib ≥ 0.37
+  postPatch = ''
+    substituteInPlace ppx/ppx_xtmpl.ml --replace-fail 'Parse.longident b' \
+      'Astlib.Longident.parse s'
+  '';
+
   buildInputs = [
     ppxlib
     xtmpl

pkgs/development/python-modules/async-upnp-client/default.nix

@@ -9,7 +9,6 @@
 
   # dependencies
   aiohttp,
-  async-timeout,
   defusedxml,
   python-didl-lite,
   voluptuous,
@@ -33,15 +32,18 @@ buildPythonPackage rec {
   };
 
   pythonRelaxDeps = [
-    "async-timeout"
     "defusedxml"
   ];
 
+  pythonRemoveDeps = [
+    # https://github.com/StevenLooman/async_upnp_client/pull/278
+    "async-timeout"
+  ];
+
   build-system = [ setuptools ];
 
   dependencies = [
     aiohttp
-    async-timeout
     defusedxml
     python-didl-lite
     voluptuous

pkgs/development/python-modules/mayavi/default.nix

@@ -10,7 +10,6 @@
   pygments,
   pyqt5,
   pythonOlder,
-  pythonAtLeast,
   traitsui,
   vtk,
   wrapQtAppsHook,
@@ -62,7 +61,5 @@ buildPythonPackage rec {
     license = licenses.bsdOriginal;
     maintainers = [ ];
     mainProgram = "mayavi2";
-    # segfault
-    broken = pythonAtLeast "3.13";
   };
 }

pkgs/development/python-modules/mkdocs-gen-files/default.nix

@@ -0,0 +1,47 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  hatchling,
+  mkdocs,
+  pytestCheckHook,
+  pytest-golden,
+}:
+
+buildPythonPackage rec {
+  pname = "mkdocs-gen-files";
+  version = "0.5.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "oprypin";
+    repo = "mkdocs-gen-files";
+    tag = "v${version}";
+    hash = "sha256-nRRdY7/en42s4PmHH+9vccRIl4pIp1F/Ka1bYvSHpBw=";
+  };
+
+  build-system = [
+    hatchling
+  ];
+
+  dependencies = [
+    mkdocs
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-golden
+  ];
+
+  pythonImportsCheck = [
+    "mkdocs_gen_files"
+  ];
+
+  meta = {
+    description = "MkDocs plugin to programmatically generate documentation pages during the build";
+    homepage = "https://oprypin.github.io/mkdocs-gen-files/";
+    changelog = "https://github.com/oprypin/mkdocs-gen-files/releases/tag/${src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ erooke ];
+  };
+}

pkgs/development/python-modules/pytask/default.nix

@@ -16,6 +16,7 @@
   sqlalchemy,
   universal-pathlib,
   pytestCheckHook,
+  cloudpickle,
   nbmake,
   pexpect,
   pytest-xdist,
@@ -27,7 +28,6 @@ buildPythonPackage rec {
   pname = "pytask";
   version = "0.5.5";
   pyproject = true;
-  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "pytask-dev";
@@ -36,6 +36,10 @@ buildPythonPackage rec {
     hash = "sha256-0e1pJzoszTW8n+uFJlEeYstvHf4v+I2Is7oEHJ1qV7o=";
   };
 
+  patches = [
+    ./dont-use-uv-in-tests.patch
+  ];
+
   build-system = [
     hatchling
     hatch-vcs
@@ -57,6 +61,7 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytestCheckHook
+    cloudpickle
     git
     nbmake
     pexpect
@@ -74,6 +79,11 @@ buildPythonPackage rec {
     "test_download_file"
     # Racy
     "test_more_nested_pytree_and_python_node_as_return_with_names"
+    # Without uv, subprocess unexpectedly doesn't fail
+    "test_pytask_on_a_module_that_uses_the_functional_api"
+    # Timeout
+    "test_pdb_interaction_capturing_twice"
+    "test_pdb_interaction_capturing_simple"
   ];
 
   meta = with lib; {

pkgs/development/python-modules/pytask/dont-use-uv-in-tests.patch

@@ -0,0 +1,155 @@
+diff --git a/tests/test_capture.py b/tests/test_capture.py
+index ba37be8..8f70c9e 100644
+--- a/tests/test_capture.py
++++ b/tests/test_capture.py
+@@ -87,7 +87,7 @@ def test_show_capture_with_build(tmp_path, show_capture):
+     """
+     tmp_path.joinpath("workflow.py").write_text(textwrap.dedent(source))
+ 
+-    result = run_in_subprocess(("uv", "run", "python", "workflow.py"), cwd=tmp_path)
++    result = run_in_subprocess(("python", "workflow.py"), cwd=tmp_path)
+ 
+     assert result.exit_code == ExitCode.FAILED
+ 
+@@ -128,7 +128,7 @@ def test_wrong_capture_method(tmp_path):
+     """
+     tmp_path.joinpath("workflow.py").write_text(textwrap.dedent(source))
+ 
+-    result = run_in_subprocess(("uv", "run", "python", "workflow.py"), cwd=tmp_path)
++    result = run_in_subprocess(("python", "workflow.py"), cwd=tmp_path)
+     assert result.exit_code == ExitCode.CONFIGURATION_FAILED
+     assert "Value 'a' is not a valid" in result.stdout
+     assert "Traceback" not in result.stdout
+@@ -255,7 +255,7 @@ def test_capturing_unicode_with_build(tmp_path, method):
+     tmp_path.joinpath("workflow.py").write_text(
+         textwrap.dedent(source), encoding="utf-8"
+     )
+-    result = run_in_subprocess(("uv", "run", "python", "workflow.py"), cwd=tmp_path)
++    result = run_in_subprocess(("python", "workflow.py"), cwd=tmp_path)
+     assert result.exit_code == ExitCode.OK
+     assert "1  Succeeded" in result.stdout
+ 
+diff --git a/tests/test_config.py b/tests/test_config.py
+index c46f5ed..eaa0934 100644
+--- a/tests/test_config.py
++++ b/tests/test_config.py
+@@ -114,7 +114,7 @@ def test_paths_are_relative_to_configuration_file(tmp_path):
+     session = build(paths=[Path("src")])
+     """
+     tmp_path.joinpath("script.py").write_text(textwrap.dedent(source))
+-    result = run_in_subprocess(("uv", "run", "python", "script.py"), cwd=tmp_path)
++    result = run_in_subprocess(("python", "script.py"), cwd=tmp_path)
+     assert result.exit_code == ExitCode.OK
+     assert "1  Succeeded" in result.stdout
+ 
+diff --git a/tests/test_dag_command.py b/tests/test_dag_command.py
+index 3ca41ba..7c0c4fc 100644
+--- a/tests/test_dag_command.py
++++ b/tests/test_dag_command.py
+@@ -92,7 +92,7 @@ def test_create_graph_via_task(tmp_path, format_, layout, rankdir):
+     tmp_path.joinpath("input.txt").touch()
+ 
+     result = subprocess.run(
+-        ("uv", "run", "python", "task_example.py"),
++        ("python", "task_example.py"),
+         cwd=tmp_path,
+         check=True,
+         capture_output=True,
+diff --git a/tests/test_execute.py b/tests/test_execute.py
+index 1a23316..6532b48 100644
+--- a/tests/test_execute.py
++++ b/tests/test_execute.py
+@@ -26,7 +26,7 @@ from tests.conftest import run_in_subprocess
+ def test_python_m_pytask(tmp_path):
+     tmp_path.joinpath("task_module.py").write_text("def task_example(): pass")
+     result = run_in_subprocess(
+-        ("uv", "run", "python", "-m", "pytask", tmp_path.as_posix())
++        ("python", "-m", "pytask", tmp_path.as_posix())
+     )
+     assert result.exit_code == ExitCode.OK
+ 
+@@ -602,7 +602,7 @@ def test_execute_tasks_via_functional_api(tmp_path):
+     """
+     tmp_path.joinpath("task_module.py").write_text(textwrap.dedent(source))
+     result = subprocess.run(
+-        ("uv", "run", "python", tmp_path.joinpath("task_module.py").as_posix()),
++        ("python", tmp_path.joinpath("task_module.py").as_posix()),
+         check=False,
+     )
+     assert result.returncode == ExitCode.OK
+@@ -632,7 +632,7 @@ def test_execute_tasks_multiple_times_via_api(tmp_path):
+     """
+     tmp_path.joinpath("task_module.py").write_text(textwrap.dedent(source))
+     result = run_in_subprocess(
+-        ("uv", "run", "python", tmp_path.joinpath("task_module.py").as_posix())
++        ("python", tmp_path.joinpath("task_module.py").as_posix())
+     )
+     assert result.exit_code == ExitCode.OK
+ 
+diff --git a/tests/test_hook_module.py b/tests/test_hook_module.py
+index eba4868..e26288a 100644
+--- a/tests/test_hook_module.py
++++ b/tests/test_hook_module.py
+@@ -25,8 +25,6 @@ def test_add_new_hook_via_cli(tmp_path, module_name):
+ 
+     if module_name:
+         args = (
+-            "uv",
+-            "run",
+             "python",
+             "-m",
+             "pytask",
+@@ -37,8 +35,6 @@ def test_add_new_hook_via_cli(tmp_path, module_name):
+         )
+     else:
+         args = (
+-            "uv",
+-            "run",
+             "pytask",
+             "build",
+             "--hook-module",
+@@ -70,9 +66,6 @@ def test_add_new_hook_via_config(tmp_path, module_name):
+ 
+     if module_name:
+         args = (
+-            "uv",
+-            "run",
+-            "--no-project",
+             "python",
+             "-m",
+             "pytask",
+@@ -80,7 +73,7 @@ def test_add_new_hook_via_config(tmp_path, module_name):
+             "--help",
+         )
+     else:
+-        args = ("uv", "run", "--no-project", "pytask", "build", "--help")
++        args = ("pytask", "build", "--help")
+ 
+     result = run_in_subprocess(args, cwd=tmp_path)
+     assert result.exit_code == ExitCode.OK
+diff --git a/tests/test_task.py b/tests/test_task.py
+index a2f70ad..510619e 100644
+--- a/tests/test_task.py
++++ b/tests/test_task.py
+@@ -667,7 +667,7 @@ def test_task_will_be_executed_after_another_one_with_function_session(
+     tmp_path.joinpath("task_example.py").write_text(textwrap.dedent(source))
+ 
+     result = subprocess.run(
+-        ("uv", "run", "python", "task_example.py"),
++        ("python", "task_example.py"),
+         cwd=tmp_path,
+         capture_output=True,
+         check=False,
+diff --git a/tests/test_warnings.py b/tests/test_warnings.py
+index 8811018..5aae724 100644
+--- a/tests/test_warnings.py
++++ b/tests/test_warnings.py
+@@ -148,7 +148,7 @@ def test_deprecation_warnings_are_not_captured(tmp_path, warning):
+     path_to_warn_module.write_text(textwrap.dedent(warn_module))
+ 
+     # Cannot use runner since then warnings are not ignored by default.
+-    result = run_in_subprocess(("uv", "run", "pytask"), cwd=tmp_path)
++    result = run_in_subprocess(("pytask"), cwd=tmp_path)
+     assert result.exit_code == ExitCode.OK
+     assert "Warnings" not in result.stdout
+     assert "warning!!!" not in result.stdout

pkgs/development/tools/ocaml/merlin/4.x.nix

@@ -29,6 +29,7 @@
       "5.2.0" = "5.3-502";
       "5.2.1" = "5.3-502";
       "5.3.0" = "5.6-503";
+      "5.4.0" = "5.6-504";
     }
     ."${ocaml.version}",
 }:
@@ -47,6 +48,7 @@ let
     "5.3-502" = "sha256-LOpG8SOX+m4x7wwNT14Rwc/ZFu5JQgaUAFyV67OqJLw=";
     "5.4.1-503" = "sha256-SbO0x3jBISX8dAXnN5CwsxLV15dJ3XPUg4tlYqJTMCI=";
     "5.6-503" = "sha256-sNytCSqq96I/ZauaCJ6HYb1mXMcjV5CeCsbCGC9PwtQ=";
+    "5.6-504" = "sha256-gtZIpBgNbVqjoIMhjii/GX9OnxR4hN6TArtoEa2Yt38=";
   };
 
 in

pkgs/top-level/all-packages.nix

@@ -8228,7 +8228,6 @@ with pkgs;
 
   nss_latest = callPackage ../development/libraries/nss/latest.nix { };
   nss_3_115 = callPackage ../development/libraries/nss/3_115.nix { };
-  nss_3_114 = callPackage ../development/libraries/nss/3_114.nix { };
   nss_esr = callPackage ../development/libraries/nss/esr.nix { };
   nss = nss_esr;
   nssTools = nss.tools;

pkgs/top-level/ocaml-packages.nix

@@ -2317,6 +2317,8 @@ rec {
 
   ocamlPackages_5_3 = mkOcamlPackages (callPackage ../development/compilers/ocaml/5.3.nix { });
 
+  ocamlPackages_5_4 = mkOcamlPackages (callPackage ../development/compilers/ocaml/5.4.nix { });
+
   ocamlPackages_latest = ocamlPackages_5_3;
 
   ocamlPackages = ocamlPackages_5_3;

pkgs/top-level/python-packages.nix

@@ -9113,7 +9113,7 @@ self: super: with self; {
   maya = callPackage ../development/python-modules/maya { };
 
   mayavi = pkgs.libsForQt5.callPackage ../development/python-modules/mayavi {
-    inherit buildPythonPackage pythonOlder pythonAtLeast;
+    inherit buildPythonPackage pythonOlder;
     inherit (self)
       pyface
       pygments
@@ -9471,6 +9471,8 @@ self: super: with self; {
 
   mkdocs-exclude = callPackage ../development/python-modules/mkdocs-exclude { };
 
+  mkdocs-gen-files = callPackage ../development/python-modules/mkdocs-gen-files { };
+
   mkdocs-get-deps = callPackage ../development/python-modules/mkdocs-get-deps { };
 
   mkdocs-git-authors-plugin = callPackage ../development/python-modules/mkdocs-git-authors-plugin { };