Merge staging-next into staging

doc/release-notes/rl-2511.section.md

@@ -364,6 +364,8 @@
 
 ### Deprecations {#sec-nixpkgs-release-25.11-lib-deprecations}
 
+- `lib.options.mkAliasOptionModuleMD` is now obsolete; use the identical [`lib.options.mkAliasOptionModule`] instead.
+
 - `types.either` silently accepted mismatching types when used in `freeformType`. Module maintainers should fix the used type
   In most cases wrapping `either` with `attrsOf` should be sufficient.
 

lib/modules.nix

@@ -1787,11 +1787,10 @@ let
     };
 
   /**
-    Transitional version of mkAliasOptionModule that uses MD docs.
+    Deprecated alias of mkAliasOptionModule that uses MD docs.
-
+    This function is no longer necessary will be removed in 26.05`.
-    This function is no longer necessary and merely an alias of `mkAliasOptionModule`.
   */
-  mkAliasOptionModuleMD = mkAliasOptionModule;
+  mkAliasOptionModuleMD = lib.warn "mkAliasOptionModuleMD is deprecated and will be removed in 26.05; please use mkAliasOptionModule." mkAliasOptionModule;
 
   /**
     mkDerivedConfig : Option a -> (a -> Definition b) -> Definition b

lib/types.nix

@@ -1464,7 +1464,7 @@ let
                         One or more definitions did not pass the type-check of the 'either' type.
                         ${headError.message}
                         If `either`, `oneOf` or similar is used in freeformType, ensure that it is preceded by an 'attrsOf' such as: `freeformType = types.attrsOf (types.either t1 t2)`.
-                        Otherwise consider using the correct type for the option `${showOption loc}`.  This will be an error in Nixpkgs 26.06.
+                        Otherwise consider using the correct type for the option `${showOption loc}`.  This will be an error in Nixpkgs 26.05.
                       '' (mergeOneOption loc defs);
                     };
               in

nixos/modules/config/users-groups.nix

@@ -30,7 +30,7 @@ let
     mapAttrs'
     mapAttrsToList
     match
-    mkAliasOptionModuleMD
+    mkAliasOptionModule
     mkDefault
     mkIf
     mkMerge
@@ -666,8 +666,8 @@ let
 in
 {
   imports = [
-    (mkAliasOptionModuleMD [ "users" "extraUsers" ] [ "users" "users" ])
+    (mkAliasOptionModule [ "users" "extraUsers" ] [ "users" "users" ])
-    (mkAliasOptionModuleMD [ "users" "extraGroups" ] [ "users" "groups" ])
+    (mkAliasOptionModule [ "users" "extraGroups" ] [ "users" "groups" ])
     (mkRenamedOptionModule
       [ "security" "initialRootPassword" ]
       [ "users" "users" "root" "initialHashedPassword" ]

nixos/modules/module-list.nix

@@ -397,7 +397,6 @@
   ./security/pam_mount.nix
   ./security/please.nix
   ./security/polkit.nix
-  ./security/rngd.nix
   ./security/rtkit.nix
   ./security/soteria.nix
   ./security/sudo-rs.nix

nixos/modules/rename.nix

@@ -2,7 +2,7 @@
 
 let
   inherit (lib)
-    mkAliasOptionModuleMD
+    mkAliasOptionModule
     mkRemovedOptionModule
     ;
 in
@@ -18,7 +18,7 @@ in
 
     # This alias module can't be where _module.check is defined because it would
     # be added to submodules as well there
-    (mkAliasOptionModuleMD [ "environment" "checkConfigurationOptions" ] [ "_module" "check" ])
+    (mkAliasOptionModule [ "environment" "checkConfigurationOptions" ] [ "_module" "check" ])
 
     # Completely removed modules
     (mkRemovedOptionModule [ "boot" "loader" "raspberryPi" ]
@@ -411,6 +411,12 @@ in
     (mkRemovedOptionModule [ "services" "simplesamlphp" ] ''
       services.simplesamlphp has been vulnerable and unmaintained in nixpkgs.
     '')
+    (mkRemovedOptionModule [ "security" "rngd" ] ''
+      rngd is not necessary for any device that the kernel recognises
+      as an hardware RNG, as it will automatically run the krngd task
+      to periodically collect random data from the device and mix it
+      into the kernel's RNG.
+    '')
     # Do NOT add any option renames here, see top of the file
   ];
 }

nixos/modules/security/rngd.nix

@@ -1,21 +0,0 @@
-{ lib, ... }:
-let
-  removed =
-    k:
-    lib.mkRemovedOptionModule [
-      "security"
-      "rngd"
-      k
-    ];
-in
-{
-  imports = [
-    (removed "enable" ''
-      rngd is not necessary for any device that the kernel recognises
-      as an hardware RNG, as it will automatically run the krngd task
-      to periodically collect random data from the device and mix it
-      into the kernel's RNG.
-    '')
-    (removed "debug" "The rngd module was removed, so its debug option does nothing.")
-  ];
-}

nixos/modules/services/networking/ssh/sshd.nix

@@ -177,8 +177,8 @@ in
 
 {
   imports = [
-    (lib.mkAliasOptionModuleMD [ "services" "sshd" "enable" ] [ "services" "openssh" "enable" ])
+    (lib.mkAliasOptionModule [ "services" "sshd" "enable" ] [ "services" "openssh" "enable" ])
-    (lib.mkAliasOptionModuleMD [ "services" "openssh" "knownHosts" ] [ "programs" "ssh" "knownHosts" ])
+    (lib.mkAliasOptionModule [ "services" "openssh" "knownHosts" ] [ "programs" "ssh" "knownHosts" ])
     (lib.mkRenamedOptionModule
       [ "services" "openssh" "challengeResponseAuthentication" ]
       [ "services" "openssh" "kbdInteractiveAuthentication" ]

nixos/modules/services/torrent/transmission.nix

@@ -9,7 +9,7 @@
 let
   inherit (lib)
     mkRenamedOptionModule
-    mkAliasOptionModuleMD
+    mkAliasOptionModule
     mkEnableOption
     mkOption
     types
@@ -26,7 +26,6 @@ let
 
   cfg = config.services.transmission;
   opt = options.services.transmission;
-  inherit (config.environment) etc;
   apparmor = config.security.apparmor;
   rootDir = "/run/transmission";
   settingsDir = ".config/transmission-daemon";
@@ -51,7 +50,7 @@ in
         "rpc-port"
       ]
     )
-    (mkAliasOptionModuleMD
+    (mkAliasOptionModule
       [
         "services"
         "transmission"

nixos/modules/services/x11/picom.nix

@@ -62,7 +62,7 @@ in
 {
 
   imports = [
-    (mkAliasOptionModuleMD [ "services" "compton" ] [ "services" "picom" ])
+    (mkAliasOptionModule [ "services" "compton" ] [ "services" "picom" ])
     (mkRemovedOptionModule [ "services" "picom" "refreshRate" ] ''
       This option corresponds to `refresh-rate`, which has been unused
       since picom v6 and was subsequently removed by upstream.

pkgs/applications/emulators/libretro/cores/nestopia.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "nestopia";
-  version = "0-unstable-2025-10-15";
+  version = "0-unstable-2025-10-16";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "nestopia";
-    rev = "3ac52e67c4a7fa696ee37e48bbcec93611277288";
+    rev = "e9429844f2e16a284a8cdf663589634fd4c6345f";
-    hash = "sha256-TDv+HTOtNEmel1lZlnlAGMVM8nEYdHLH7Rw6WBviGGw=";
+    hash = "sha256-Ss4AuIuwEbaQOUcnGfXbJbEw/1HkyGZSRD2ody+wSSU=";
   };
 
   makefile = "Makefile";

pkgs/applications/science/math/lp_solve/default.nix

@@ -19,7 +19,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-bUq/9cxqqpM66ObBeiJt8PwLZxxDj2lxXUHQn+gfkC8=";
   };
 
-  nativeBuildInputs = [
+  nativeBuildInputs =
+    lib.optionals (!stdenv.hostPlatform.isDarwin) [
       binutils
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [

pkgs/by-name/ai/air-formatter/package.nix

@@ -7,16 +7,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "air-formatter";
-  version = "0.7.1";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "posit-dev";
     repo = "air";
     tag = finalAttrs.version;
-    hash = "sha256-FGucu5emmBtxVloun7Kh+MWKZDYdKw+75L7g3GqQ7Tw=";
+    hash = "sha256-LNU//dQico54GhZdehynEuukfGuU8rQvfFO4zvRsZL0=";
   };
 
-  cargoHash = "sha256-+cksQnHNXGyqbu+CoGhCEmQux7zfLIt5K5rWABfppDo=";
+  cargoHash = "sha256-9HRDUTYzKLYuh9KCcnvPXB6gDKcht79TOZZ3ze9+gbg=";
 
   useNextest = true;
 

pkgs/by-name/al/all-the-package-names/package.nix

@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "all-the-package-names";
-  version = "2.0.2235";
+  version = "2.0.2241";
 
   src = fetchFromGitHub {
     owner = "nice-registry";
     repo = "all-the-package-names";
     tag = "v${version}";
-    hash = "sha256-I2E1V296tljsvtpfU5xlUkKNEeEZb4qtM1WDLXQZHbg=";
+    hash = "sha256-jiHYGxESaEKQ6g4Bz7fZNz24PFmF/PWKc3ySqZzFDa8=";
   };
 
-  npmDepsHash = "sha256-p1IBNK6dRBnEUEZ4bIMoGcVSPoecnKWgRtuUJTYW7q8=";
+  npmDepsHash = "sha256-KtfzWr8I0fmZfIgkVAohgd0UlJY1DeP6Q0n8e7YENrs=";
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/bl/blint/package.nix

@@ -8,14 +8,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "blint";
-  version = "3.0.1";
+  version = "3.0.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "owasp-dep-scan";
     repo = "blint";
     tag = "v${version}";
-    hash = "sha256-E4hOTDYJzavWM0/YGclhddS0eZE9eJLQmeS4Fpbysic=";
+    hash = "sha256-ell0/opQso7/qD6d6i18vU55TfTgdcZwVFXD+yZg9/g=";
   };
 
   build-system = [

pkgs/by-name/ca/cargo-mobile2/package.nix

@@ -10,7 +10,7 @@
 
 let
   pname = "cargo-mobile2";
-  version = "0.21.1";
+  version = "0.22.1";
 in
 rustPlatform.buildRustPackage {
   inherit pname version;
@@ -18,14 +18,14 @@ rustPlatform.buildRustPackage {
     owner = "tauri-apps";
     repo = "cargo-mobile2";
     rev = "cargo-mobile2-v${version}";
-    hash = "sha256-w95UAtAP11jaW4EqprGv+duBf81rLv8y7+Ej5SFeRAs=";
+    hash = "sha256-+U/uTbTGa3NPK5WpyvR5C5L1ozl+fa15pNNWYZJXgnk=";
   };
 
   # Manually specify the sourceRoot since this crate depends on other crates in the workspace. Relevant info at
   # https://discourse.nixos.org/t/difficulty-using-buildrustpackage-with-a-src-containing-multiple-cargo-workspaces/10202
   # sourceRoot = "${src.name}/tooling/cli";
 
-  cargoHash = "sha256-Aa4Iubl8l+tss0ClF93RqVUsB4Jg4/MQCeKSr/iY5tA=";
+  cargoHash = "sha256-fMtFvPrWMLHE4N9WJv6J4pqHbHPnNKhQWz5qEvB8jKQ=";
 
   preBuild = ''
     mkdir -p $out/share/

pkgs/by-name/ch/chezmoi/package.nix

@@ -7,16 +7,16 @@
 
 buildGo125Module (finalAttrs: {
   pname = "chezmoi";
-  version = "2.66.0";
+  version = "2.66.1";
 
   src = fetchFromGitHub {
     owner = "twpayne";
     repo = "chezmoi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-r49KRq6PIB6gRnudY9HMm0UBjd07J6tUpA3oTOyJzGI=";
+    hash = "sha256-DwMkfS+D9o10Dk3jEzgkDcSoblbpoimN6RPV2iZTLcg=";
   };
 
-  vendorHash = "sha256-ioRFzkp4aSUdPq3NSKDj05DbTp6PwAjVkf7VtdpaI2w=";
+  vendorHash = "sha256-g9bzsmLKJ7pCmTnO8N9Um1FDBvQA0mqw14fwGYMb/K0=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/ch/chrome-pak-customizer/package.nix

@@ -34,6 +34,11 @@ stdenv.mkDerivation {
     runHook postInstall
   '';
 
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.8)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
   meta = {
     description = "Simple batch tool to customize pak files in chrome or chromium-based browser";
     homepage = "https://github.com/myfreeer/chrome-pak-customizer";

pkgs/by-name/cm/cmdstan/package.nix

@@ -12,14 +12,14 @@
 
 stdenv.mkDerivation rec {
   pname = "cmdstan";
-  version = "2.36.0";
+  version = "2.37.0";
 
   src = fetchFromGitHub {
     owner = "stan-dev";
     repo = "cmdstan";
     tag = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-9Dan86C0nxxxkIXaOSKExY0hngAgWTpL4RlI3rTnBZo=";
+    hash = "sha256-bKkzzFkMF8+Ufz/EdKLJdB290Fvc2t8b47xB8oPz/sk=";
   };
 
   postPatch = ''

pkgs/by-name/co/coroot-node-agent/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "coroot-node-agent";
-  version = "1.26.3";
+  version = "1.26.4";
 
   src = fetchFromGitHub {
     owner = "coroot";
     repo = "coroot-node-agent";
     rev = "v${version}";
-    hash = "sha256-IdDH+jFVRbquM+9VkPw/Sb2dc6eajLpNsLlYkUEUNAo=";
+    hash = "sha256-bm3zMk44FNZ3vb9fP1Szbmi+0I1kOas0es8Cqu3yWeA=";
   };
 
   vendorHash = "sha256-LJq45IGXgYNx0Hky2w+O5Enwc5EvD79/cJRQ/iCythk=";

pkgs/by-name/do/do-agent/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "do-agent";
-  version = "3.18.4";
+  version = "3.18.5";
 
   src = fetchFromGitHub {
     owner = "digitalocean";
     repo = "do-agent";
     rev = version;
-    sha256 = "sha256-Pn53zNp3D0NcEQqfiv4ZceLT2Pgvz7oZYZAhk2D1SCc=";
+    sha256 = "sha256-Wc0VqBiIAQGtORdm0paAm9vnbThc+5seHXmpnYcyNh8=";
   };
 
   ldflags = [

pkgs/by-name/dr/draupnir/hashes.json

@@ -1,3 +1,3 @@
 {
-  "yarn_offline_cache_hash": "sha256-jzBjZAqvEVGlk+5ii5s8aWvoYJKVBsh+RGcp63oim5Y="
+  "yarn_offline_cache_hash": "sha256-EZ8dVRfzAFr8wepLuS90YHvAi9BA+4etVz+Vji+bQVA="
 }

pkgs/by-name/dr/draupnir/package.json

@@ -1,6 +1,6 @@
 {
   "name": "draupnir",
-  "version": "2.7.0",
+  "version": "2.7.1",
   "description": "A moderation tool for Matrix",
   "main": "lib/index.js",
   "repository": "https://github.com/the-draupnir-project/Draupnir.git",
@@ -54,7 +54,7 @@
     "@sinclair/typebox": "0.34.13",
     "@the-draupnir-project/interface-manager": "4.2.5",
     "@the-draupnir-project/matrix-basic-types": "1.4.1",
-    "@the-draupnir-project/mps-interface-adaptor": "0.5.1",
+    "@the-draupnir-project/mps-interface-adaptor": "0.5.2",
     "better-sqlite3": "^9.4.3",
     "body-parser": "^1.20.2",
     "config": "^3.3.9",
@@ -65,7 +65,7 @@
     "matrix-appservice-bridge": "^10.3.1",
     "matrix-bot-sdk": "npm:@vector-im/matrix-bot-sdk@^0.7.1-element.6",
     "matrix-protection-suite": "npm:@gnuxie/matrix-protection-suite@4.1.0",
-    "matrix-protection-suite-for-matrix-bot-sdk": "npm:@gnuxie/matrix-protection-suite-for-matrix-bot-sdk@4.0.0",
+    "matrix-protection-suite-for-matrix-bot-sdk": "npm:@gnuxie/matrix-protection-suite-for-matrix-bot-sdk@4.0.2",
     "pg": "^8.8.0",
     "yaml": "^2.3.2"
   },

pkgs/by-name/dr/draupnir/package.nix

@@ -22,13 +22,13 @@ let
 in
 mkYarnPackage rec {
   pname = "draupnir";
-  version = "2.7.0";
+  version = "2.7.1";
 
   src = fetchFromGitHub {
     owner = "the-draupnir-project";
     repo = "Draupnir";
     tag = "v${version}";
-    hash = "sha256-ZzwZg7sevX0qKnlZ4snCcwSejWqA6JHCx3e6vWucO8U=";
+    hash = "sha256-PJg+ybWe7mtLgqrBZP0xKeKWc2FPv7koyjsHyK5uRKs=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/dr/drawterm/package.nix

@@ -22,13 +22,13 @@ let
 in
 stdenv.mkDerivation {
   pname = "drawterm";
-  version = "0-unstable-2025-09-11";
+  version = "0-unstable-2025-10-11";
 
   src = fetchFrom9Front {
     owner = "plan9front";
     repo = "drawterm";
-    rev = "7523180ec9e5210e28eb0191268066188cdf91ab";
+    rev = "48d53278a8273bb39ca295e8f163563ab04b3530";
-    hash = "sha256-IOZCpNXJcTpqCRsNp8aaP2vORvusLktLtyoQ7gykJB8=";
+    hash = "sha256-SReZ6A5xEpi0vL2bchVszRl3Dvm4Rw8e/5TQa+8TPto=";
   };
 
   enableParallelBuilding = true;

pkgs/by-name/en/ensemble-chorus/package.nix

@@ -47,6 +47,18 @@ stdenv.mkDerivation {
     libjack2
   ];
 
+  postPatch = ''
+    substituteInPlace CMakeLists.txt --replace-fail \
+      'cmake_minimum_required(VERSION "3.3")' \
+      'cmake_minimum_required(VERSION 4.0)'
+    substituteInPlace thirdparty/gsl-lite/CMakeLists.txt --replace-fail \
+      'cmake_minimum_required( VERSION 3.0 FATAL_ERROR )' \
+      'cmake_minimum_required(VERSION 4.0)'
+    substituteInPlace thirdparty/jsl/CMakeLists.txt --replace-fail \
+      'cmake_minimum_required(VERSION 3.3)' \
+      'cmake_minimum_required(VERSION 4.0)'
+  '';
+
   meta = with lib; {
     homepage = "https://github.com/jpcima/ensemble-chorus";
     description = "Digital model of electronic string ensemble chorus";

pkgs/by-name/ex/exoscale-cli/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "exoscale-cli";
-  version = "1.85.4";
+  version = "1.86.0";
 
   src = fetchFromGitHub {
     owner = "exoscale";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-rulleAbiwnUABnHLpfHFjGXK3/DxFJLmse3NIClSpMQ=";
+    sha256 = "sha256-AlpCTeopNfaN4IeumaEFTZNrBfIJH2RbfVoZaFRCy2Y=";
   };
 
   vendorHash = null;

pkgs/by-name/fl/flopoco/package.nix

@@ -74,6 +74,10 @@ stdenv.mkDerivation {
     ./flopoco BuildAutocomplete
   '';
 
+  cmakeFlags = [
+    (lib.cmakeFeature "CMAKE_POLICY_VERSION_MINIMUM" "3.5")
+  ];
+
   installPhase = ''
     runHook preInstall
 

pkgs/by-name/gc/gcsfuse/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "gcsfuse";
-  version = "3.4.0";
+  version = "3.4.1";
 
   src = fetchFromGitHub {
     owner = "googlecloudplatform";
     repo = "gcsfuse";
     rev = "v${version}";
-    hash = "sha256-PdYHsHIlq77QnsjD1z3KliW3JHLZ0M26I4Z7v0SuvlU=";
+    hash = "sha256-KB7iq92U5NIchC3Lj2q2eesYLlKa1zee0rUPU81xb5k=";
   };
 
-  vendorHash = "sha256-w5EOHPOJLfINILrP3ipZwYUAcAJIlGw1HlVAUAzW3x4=";
+  vendorHash = "sha256-BirzhmYwFSs2poA5tNOlK2bDO71mCkgSck7fE9la2wA=";
 
   subPackages = [
     "."

pkgs/by-name/hc/hcloud/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "hcloud";
-  version = "1.54.0";
+  version = "1.55.0";
 
   src = fetchFromGitHub {
     owner = "hetznercloud";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-PpCEdhEjfd7d8DdU2ABAjL8O98cLR20xWwhcESJK4uI=";
+    hash = "sha256-4UPZ3SCKTjmSt6mm0zHwecVq3UtR+cSkQmNdbkq/dMY=";
   };
 
-  vendorHash = "sha256-tJwd/qLs0QvnjKi0B2NBTosGt7qCzJCHxZ5LYJB4vjA=";
+  vendorHash = "sha256-heCGRW8yT/aTrh4PKj62P8EPT7mXVDMo9Z8pIypOT6o=";
 
   ldflags = [
     "-s"

pkgs/by-name/hd/hdrmerge/package.nix

@@ -15,14 +15,20 @@
 
 stdenv.mkDerivation rec {
   pname = "hdrmerge";
-  version = "0.5.0-unstable-2024-08-02";
+  version = "0.5.0-unstable-2025-04-26";
   src = fetchFromGitHub {
     owner = "jcelaya";
     repo = "hdrmerge";
-    rev = "e2a46f97498b321b232cc7f145461212677200f1";
+    rev = "3bbe43771ba15b899151721bc14aa57e86b60f2f";
-    hash = "sha256-471gJtF9M36pAId9POG8ZIpNk9H/157EdHqXSAPlhN0=";
+    hash = "sha256-4FIGchwROXe8qLRBaYih2k9zDll2YoYGDj06SrIqK9Q=";
   };
 
+  # Disable find_package(ALGLIB REQUIRED) in the CMake file by providing a empty
+  # FindALGLIB.cmake, and provide ALGLIB_INCLUDES and ALGLIB_LIBRARIES ourselves
+  preConfigure = ''
+    touch cmake/FindALGLIB.cmake
+  '';
+
   nativeBuildInputs = [
     cmake
     pkg-config
@@ -39,12 +45,8 @@ stdenv.mkDerivation rec {
   ];
 
   cmakeFlags = [
-    "-DALGLIB_DIR:PATH=${alglib}"
+    (lib.cmakeFeature "ALGLIB_INCLUDES" "${alglib}/include/alglib")
-  ];
+    (lib.cmakeFeature "ALGLIB_LIBRARIES" "alglib3")
-
-  CXXFLAGS = [
-    # GCC 13: error: 'uint32_t' does not name a type
-    "-include cstdint"
   ];
 
   desktopItems = [

pkgs/by-name/hy/hyprland-qtutils/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   pkg-config,
   hyprutils,
@@ -23,6 +24,15 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-bTYedtQFqqVBAh42scgX7+S3O6XKLnT6FTC6rpmyCCc=";
   };
 
+  patches = [
+    # this should be removed in the next release
+    (fetchpatch {
+      name = "Fix build with Qt 6.10";
+      url = "https://github.com/hyprwm/hyprland-qtutils/commit/5ffdfc13ed03df1dae5084468d935f0a3f2c9a4c.patch";
+      hash = "sha256-5nVj4AFJpmazX9o9tQD6mzBW9KtRYov4yRbGpUwFcgc=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
     pkg-config

pkgs/by-name/in/infrastructure-agent/package.nix

@@ -6,13 +6,13 @@
 }:
 buildGoModule rec {
   pname = "infrastructure-agent";
-  version = "1.69.0";
+  version = "1.70.0";
 
   src = fetchFromGitHub {
     owner = "newrelic";
     repo = "infrastructure-agent";
     rev = version;
-    hash = "sha256-6yoHx1fVDaJZsQKFSfOCau/BrB6zcT52yrLbPp8ZiKQ=";
+    hash = "sha256-VdBcVFDtPajmAAQe2aZONf0/pCMf98gtR9zoeqL1aKQ=";
   };
 
   vendorHash = "sha256-KBzckYxiQ4/nhm7ZfGQDGi5uN652oZgdc9i0UexMr24=";

pkgs/by-name/ja/jami/package.nix

@@ -3,8 +3,10 @@
   lib,
   pkg-config,
   fetchFromGitLab,
+  fetchpatch,
   gitUpdater,
   ffmpeg_6,
+  ninja,
 
   # for daemon
   autoreconfHook,
@@ -12,7 +14,7 @@
   alsa-lib,
   asio,
   dbus,
-  sdbus-cpp,
+  sdbus-cpp_2,
   fmt,
   gmp,
   gnutls,
@@ -62,25 +64,32 @@
 
 stdenv.mkDerivation rec {
   pname = "jami";
-  version = "20250718.0";
+  version = "20251003.0";
 
   src = fetchFromGitLab {
     domain = "git.jami.net";
     owner = "savoirfairelinux";
     repo = "jami-client-qt";
     rev = "stable/${version}";
-    hash = "sha256-EEiuymfu28bJ6pfBKwlsCGDq7XlKGZYK+2WjPJ+tcxw=";
+    hash = "sha256-CYKrIWGTmGvHIhNdyEhDKE1Rm84O7X3yPVLkF6qakwU=";
     fetchSubmodules = true;
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/jami-qt/-/raw/0ecbaf3b101bbdd0d4a06b06f3ce1ff654abf0b5/fix-link.patch";
+      hash = "sha256-VsQbOPHyNFcRhpae+9UCaUJdHH8bMGf3ZIAW3RKiu6k=";
+    })
+  ];
+
   pjsip-jami = pjsip.overrideAttrs (old: {
-    version = "sfl-2.15-unstable-2025-02-24";
+    version = "sfl-2.15-unstable-2025-09-18";
 
     src = fetchFromGitHub {
       owner = "savoirfairelinux";
       repo = "pjproject";
-      rev = "37130c943d59f25a71935803ea2d84515074a237";
+      rev = "93dc96918bb6ba74e1e1d00c40c80402e856f2ac";
-      hash = "sha256-7gAiriuooqqF38oajAuD/Lj5trn/9VMkCGOumcV45NA=";
+      hash = "sha256-wsbKa3TXqj+nQMtAaEAD0Zh248QdNMhKnIOnq08MPI0=";
     };
 
     configureFlags = [
@@ -118,14 +127,14 @@ stdenv.mkDerivation rec {
 
   dhtnet = stdenv.mkDerivation {
     pname = "dhtnet";
-    version = "unstable-2025-05-26";
+    version = "unstable-2025-09-15";
 
     src = fetchFromGitLab {
       domain = "git.jami.net";
       owner = "savoirfairelinux";
       repo = "dhtnet";
-      rev = "6c5ee3a21556d668d047cdedb5c4b746c3c6bdb2";
+      rev = "7861b4620b4cec5fa34c5d1bb2b304912730f638";
-      hash = "sha256-uweYSEysVMUC7DhI9BhS1TDZ6ZY7WQ9JS3ZF9lKA4Fo=";
+      hash = "sha256-nhGB4u12Ubmc7lLVOAwycRsP+cWzn4A9bYH0+sSBQTg=";
     };
 
     postPatch = ''
@@ -177,12 +186,6 @@ stdenv.mkDerivation rec {
     inherit src version meta;
     sourceRoot = "${src.name}/daemon";
 
-    # Fix for libgit2 breaking changes
-    postPatch = ''
-      substituteInPlace src/jamidht/conversationrepository.cpp \
-        --replace-fail "git_commit* const" "const git_commit*"
-    '';
-
     nativeBuildInputs = [
       autoreconfHook
       pkg-config
@@ -194,7 +197,7 @@ stdenv.mkDerivation rec {
       asio
       dbus
       dhtnet
-      sdbus-cpp
+      sdbus-cpp_2
       fmt
       ffmpeg_6
       gmp
@@ -233,7 +236,6 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     sed -i -e '/GIT_REPOSITORY/,+1c SOURCE_DIR ''${CMAKE_CURRENT_SOURCE_DIR}/qwindowkit' extras/build/cmake/contrib_tools.cmake
-    sed -i -e 's/if(DISTRO_NEEDS_QMSETUP_PATCH)/if(TRUE)/' CMakeLists.txt
     cp -R --no-preserve=mode,ownership ${qwindowkit-src} qwindowkit
     substituteInPlace CMakeLists.txt \
       --replace-fail 'add_subdirectory(3rdparty/zxing-cpp EXCLUDE_FROM_ALL)' 'find_package(ZXing)'
@@ -257,6 +259,7 @@ stdenv.mkDerivation rec {
     git
     python3
     qt6Packages.qttools # for translations
+    ninja
   ];
 
   buildInputs = [
@@ -284,7 +287,11 @@ stdenv.mkDerivation rec {
     ++ lib.optionals withWebengine [ qtwebengine ]
   );
 
-  cmakeFlags = lib.optionals (!withWebengine) [ "-DWITH_WEBENGINE=false" ];
+  cmakeFlags = [
+    (lib.cmakeBool "JAMICORE_AS_SUBDIR" false)
+    (lib.cmakeBool "DWITH_WEBENGINE" withWebengine)
+    "-DLIBJAMI_INCLUDE_DIRS=${daemon}/include/jami"
+  ];
 
   qtWrapperArgs = [
     # With wayland the titlebar is not themed and the wmclass is wrong.
@@ -295,7 +302,10 @@ stdenv.mkDerivation rec {
     qtWrapperArgs+=("''${gappsWrapperArgs[@]}")
   '';
 
-  passthru.updateScript = gitUpdater { rev-prefix = "stable/"; };
+  passthru = {
+    updateScript = gitUpdater { rev-prefix = "stable/"; };
+    inherit daemon pjsip dhtnet;
+  };
 
   meta = with lib; {
     homepage = "https://jami.net/";

pkgs/by-name/je/jenkins/package.nix

@@ -18,11 +18,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "jenkins";
-  version = "2.516.3";
+  version = "2.528.1";
 
   src = fetchurl {
     url = "https://get.jenkins.io/war-stable/${finalAttrs.version}/jenkins.war";
-    hash = "sha256-gbOrzA8kzqSOdO/+FS9p3F8NiA7cDCc3xhRGs8WZLAA=";
+    hash = "sha256-1jDcomX3Wo1YHxJ6kjTxZ51LCACo83DQOtShVM63KVs=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/by-name/jf/jfbview/package.nix

@@ -53,6 +53,11 @@ stdenv.mkDerivation (finalAttrs: {
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
 
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 3.2)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
   passthru.updateScript = nix-update-script { };
 
   meta = {

pkgs/by-name/ju/juju/package.nix

@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "juju";
-  version = "3.6.10";
+  version = "3.6.11";
 
   src = fetchFromGitHub {
     owner = "juju";
     repo = "juju";
     rev = "v${version}";
-    hash = "sha256-J3AFH6kg+M6/8posiUaVP4biQpKPQ07Qp5BU3prAG/A=";
+    hash = "sha256-jeRA2HwXJt1FLQrUsE/OrpeRib5VRbNk84FTHCBeHiM=";
   };
 
-  vendorHash = "sha256-zTavqjEH4maEMj+AuYMcjT289peVNIc0rysBnnMxFNU=";
+  vendorHash = "sha256-pa6NOoC4OakJdKB2cWtQVoEt2UX/xv8mDOHmlDSk8Z8=";
 
   subPackages = [
     "cmd/juju"

pkgs/by-name/ka/kafkactl/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "kafkactl";
-  version = "5.13.0";
+  version = "5.14.0";
 
   src = fetchFromGitHub {
     owner = "deviceinsight";
     repo = "kafkactl";
     tag = "v${version}";
-    hash = "sha256-YJpRXCTI0Mwi4Zxeex8oxgzElk7l8Qus75lR42/wSww=";
+    hash = "sha256-WBycrpte3LSwAAjeD+gHXLEz9Y7075Ryip58fIGdJ8Q=";
   };
 
   vendorHash = "sha256-sVvEHMXpjas+l93IZfAChDX5eDm0lkUNCr5r1JaVQ9I=";

pkgs/by-name/ke/keyoxide-cli/package.nix

@@ -0,0 +1,48 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitea,
+  fetchYarnDeps,
+  yarnConfigHook,
+  yarnBuildHook,
+  yarnInstallHook,
+  nodejs,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "keyoxide-cli";
+  version = "0.4.4";
+
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "keyoxide";
+    repo = "keyoxide-cli";
+    tag = finalAttrs.version;
+    hash = "sha256-lQEvtqFq3OBlXdYdrhMsAns4kimR2RfRx3VFNy4nEu8=";
+  };
+
+  yarnOfflineCache = fetchYarnDeps {
+    inherit (finalAttrs) src;
+    hash = "sha256-UxP5NkmA3MsrXhoa+JviDdW19HKE6Xpj1dkN7h0ggck=";
+  };
+
+  yarnBuildScript = "prettier";
+  yarnBuildFlags = "src/commands.js";
+
+  nativeBuildInputs = [
+    yarnConfigHook
+    yarnBuildHook
+    yarnInstallHook
+    # Needed for executing package.json scripts
+    nodejs
+  ];
+
+  meta = {
+    changelog = "https://codeberg.org/keyoxide/keyoxide-cli/releases/tag/${finalAttrs.version}";
+    description = "Command-line interface to locally verify decentralized identities";
+    homepage = "https://codeberg.org/keyoxide/keyoxide-cli";
+    license = lib.licenses.agpl3Plus;
+    maintainers = [ lib.maintainers.pyrox0 ];
+    mainProgram = "keyoxide";
+  };
+})

pkgs/by-name/kn/knightos-genkfs/package.nix

@@ -28,6 +28,11 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.8.5)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
   meta = with lib; {
     homepage = "https://knightos.org/";
     description = "Utility to write a KFS filesystem into a ROM file";

pkgs/by-name/kn/knightos-kcc/package.nix

@@ -30,6 +30,11 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ boost ];
 
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.8.5)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
   meta = with lib; {
     homepage = "https://github.com/KnightOS/kcc";
     description = "KnightOS C compiler";

pkgs/by-name/kn/knightos-kimg/package.nix

@@ -28,6 +28,11 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.8.5)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
   meta = with lib; {
     homepage = "https://knightos.org/";
     description = "Converts image formats supported by stb_image to the KnightOS image format";

pkgs/by-name/kn/knightos-kpack/package.nix

@@ -29,6 +29,11 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "fortify" ];
 
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.8.5)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
   meta = with lib; {
     homepage = "https://knightos.org/";
     description = "Tool to create or extract KnightOS packages";

pkgs/by-name/kn/knightos-mktiupgrade/package.nix

@@ -28,6 +28,11 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.8.5)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
   meta = with lib; {
     homepage = "https://knightos.org/";
     description = "Makes TI calculator upgrade files from ROM dumps";

pkgs/by-name/kn/knightos-patchrom/package.nix

@@ -29,6 +29,11 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.8.5)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
   meta = with lib; {
     homepage = "https://knightos.org/";
     description = "Patches jumptables into TI calculator ROM files and generates an include file";

pkgs/by-name/kn/knightos-scas/package.nix

@@ -26,7 +26,8 @@ stdenv.mkDerivation rec {
   cmakeFlags = [ "-DSCAS_LIBRARY=1" ];
   postPatch = ''
     substituteInPlace CMakeLists.txt \
-      --replace "TARGETS scas scdump scwrap" "TARGETS scas scdump scwrap generate_tables"
+      --replace-fail "TARGETS scas scdump scwrap" "TARGETS scas scdump scwrap generate_tables" \
+      --replace-fail "cmake_minimum_required(VERSION 2.8.5)" "cmake_minimum_required(VERSION 3.10)"
   '';
   strictDeps = true;
 

pkgs/by-name/kn/knightos-z80e/package.nix

@@ -29,6 +29,15 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [ "-Denable-sdl=YES" ];
 
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.8.5)" "cmake_minimum_required(VERSION 3.10)"
+    substituteInPlace libz80e/CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.8)" "cmake_minimum_required(VERSION 3.10)"
+    substituteInPlace frontends/libz80e/CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.8)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
   meta = with lib; {
     homepage = "https://knightos.org/";
     description = "Z80 calculator emulator and debugger";

pkgs/by-name/li/libcmatrix/package.nix

@@ -17,14 +17,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libcmatrix";
-  version = "0.0.3";
+  version = "0.0.4";
 
   src = fetchFromGitLab {
     domain = "source.puri.sm";
     owner = "Librem5";
     repo = "libcmatrix";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Usaqkb6zClVtYCL1VUv4iNeKs2GZECO9sOdPk3N8iLM=";
+    hash = "sha256-MyjgxOJmaDylPA2AENZPR+dfh2UN1H93ZOLMlycEmTw=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/li/litmusctl/package.nix

@@ -9,7 +9,7 @@
 
 buildGoModule rec {
   pname = "litmusctl";
-  version = "1.18.0";
+  version = "1.19.0";
 
   nativeBuildInputs = [
     installShellFiles
@@ -23,7 +23,7 @@ buildGoModule rec {
     owner = "litmuschaos";
     repo = "litmusctl";
     rev = "${version}";
-    hash = "sha256-lfR4Nk9n6mpfQVrVoI2iaCYkJelgGi5QLdZN9n0qPVQ=";
+    hash = "sha256-0fHkUKU1MwvPuM+20dH7W/GFdhzY+avgCufpKEDnPZQ=";
   };
 
   vendorHash = "sha256-7FYOQ89aUFPX+5NCPYKg+YGCXstQ6j9DK4V2mCgklu0=";

pkgs/by-name/lo/loco/package.nix

@@ -6,14 +6,14 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "loco";
-  version = "0.16.2";
+  version = "0.16.3";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-yctOGUfKd1zaIArtHESYEr1q79ZrJqL7H6bvpAFrE+8=";
+    hash = "sha256-DdrLABMiTutIhUHvUw29DYZIT+YHLNJjoTT5kWMeAkU=";
   };
 
-  cargoHash = "sha256-IdYicJ7ZIoVOQU91S8yIPYGeY+DaeAMztGOmriTGW38=";
+  cargoHash = "sha256-01IQxfeOzxOHqRovmNV3q/ZSdESWi7Gb6F7o51Rbkw4=";
 
   #Skip trycmd integration tests
   checkFlags = [ "--skip=cli_tests" ];

pkgs/by-name/mt/mtail/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "mtail";
-  version = "3.2.20";
+  version = "3.2.21";
 
   src = fetchFromGitHub {
     owner = "jaqx0r";
     repo = "mtail";
     rev = "v${version}";
-    hash = "sha256-w895q6J0o4a4y3YwGWyu5tpv7ow9RNWEFQVIMDJo43Y=";
+    hash = "sha256-i5c9e7b7PmvFdNddngsCIx4GKYqPPwTZSUoNAIL8RZ4=";
   };
 
   vendorHash = "sha256-hVguLf/EkTz7Z8lTT9tCQ8iGO5asSkrsW+u8D1ND+dw=";

pkgs/by-name/ol/ollama/package.nix

@@ -118,13 +118,13 @@ in
 goBuild (finalAttrs: {
   pname = "ollama";
   # don't forget to invalidate all hashes each update
-  version = "0.12.5";
+  version = "0.12.6";
 
   src = fetchFromGitHub {
     owner = "ollama";
     repo = "ollama";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-X5xxM53DfN8EW29hfJiAeADKLvKdmdNYE2NBa05T82k=";
+    hash = "sha256-Ttwcpg2bgz7D8IqPRTNeZUQFA/HsGc8gCOiXRs7onBg=";
   };
 
   vendorHash = "sha256-SlaDsu001TUW+t9WRp7LqxUSQSGDF1Lqu9M1bgILoX4=";

pkgs/by-name/op/opendht/package.nix

@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation rec {
   pname = "opendht";
-  version = "3.4.0";
+  version = "3.5.4";
 
   src = fetchFromGitHub {
     owner = "savoirfairelinux";
     repo = "opendht";
     tag = "v${version}";
-    hash = "sha256-WNN4aCZiJuz9CgEKIzFmy50HBj0ZL/d1uU7L518lPhk=";
+    hash = "sha256-mnnd6yATIk/TEuFG/M98d+pfeh42IKWBBYjkTP52xeM=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/pa/pagsuite/package.nix

@@ -1,38 +1,26 @@
 {
   lib,
   stdenv,
-  fetchurl,
+  fetchFromGitLab,
-  fetchpatch,
   cmake,
-  unzip,
   gmp,
   scalp,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "pagsuite";
-  version = "1.80";
+  version = "1.80-unstable-2025-05-03";
 
-  src = fetchurl {
+  src = fetchFromGitLab {
-    url = "https://gitlab.com/kumm/pagsuite/-/raw/master/releases/pagsuite_${
+    domain = "gitlab.com";
-      lib.replaceStrings [ "." ] [ "_" ] version
+    owner = "kumm";
-    }.zip";
+    repo = "pagsuite";
-    hash = "sha256-TYd+dleVPWEWU9Cb3XExd7ixJZyiUAp9QLtorYJSIbQ=";
+    rev = "1cc657765658cb2eb622d4a9c656ab9854150e7d";
+    hash = "sha256-jyp3h5n6SkyTpLzqMezvu2nri6rDkX3ACcCO9r4/bBA=";
   };
 
-  patches = [
-    # Fix issue with latest ScaLP update
-    (fetchpatch {
-      url = "https://gitlab.com/kumm/pagsuite/-/commit/cae9f78bec93a7f197461358f2f796f6b5778781.patch";
-      hash = "sha256-12IisS6oGYLRicORTemHB7bw9EB9cuQjxG8f6X0WMrU=";
-    })
-  ];
-
-  sourceRoot = "pagsuite_${lib.replaceStrings [ "." ] [ "_" ] version}";
-
   nativeBuildInputs = [
     cmake
-    unzip
   ];
 
   buildInputs = [
@@ -40,6 +28,9 @@ stdenv.mkDerivation rec {
     scalp
   ];
 
+  # make[2]: ***  No rule to make target 'lib/libpag.dylib', needed by 'bin/osr'.  Stop.
+  enableParallelBuilding = false;
+
   meta = with lib; {
     description = "Optimization tools for the (P)MCM problem";
     homepage = "https://gitlab.com/kumm/pagsuite";

pkgs/by-name/po/pocketbase/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "pocketbase";
-  version = "0.30.2";
+  version = "0.30.4";
 
   src = fetchFromGitHub {
     owner = "pocketbase";
     repo = "pocketbase";
     rev = "v${version}";
-    hash = "sha256-7XpusTwdocLsJBHWU71nHMmY0T05d4fKHe5XKvHSPR0=";
+    hash = "sha256-n2xBwonQOEk2LVQePxdO/PraM75FFDmOqZ9fIL2xd+I=";
   };
 
-  vendorHash = "sha256-ft+hs1VfCZrWceVDqO7ThRE1tiyozMFsYMclsKKdEBo=";
+  vendorHash = "sha256-Zo0b0MTIRpLGPIg288ROFPIdHfMzZdFLbFZPAffWPxU=";
 
   # This is the released subpackage from upstream repo
   subPackages = [ "examples/base" ];

pkgs/by-name/pr/projectm-sdl-cpp/package.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation {
   pname = "projectm-sdl-cpp";
-  version = "0-unstable-2025-10-08";
+  version = "0-unstable-2025-10-17";
 
   src = fetchFromGitHub {
     owner = "projectM-visualizer";
     repo = "frontend-sdl-cpp";
-    rev = "7131af0618e4d7f4b64c623ad92795fef5a2d87a";
+    rev = "72e5632897c9d9bef452c679d3cbe8c7b4bb4157";
-    hash = "sha256-pXQGMwjOh7LjDuUPbXp5l9O4aSWqnTxdZSMtDzZ8118=";
+    hash = "sha256-uO2+CX2DqVn6NdcZhBlKFIPuUQpz6N8LazG3ALJTSx0=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/re/reaper-go/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "reaper-go";
-  version = "0.2.3";
+  version = "0.2.5";
 
   src = fetchFromGitHub {
     owner = "ghostsecurity";
     repo = "reaper";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-NXRqKO76RoxEvR7slMmUDdesRFMxDJpX/IGxoTDwJVU=";
+    hash = "sha256-3kTGlGvuTSB3KOeQvhF/pNaWVU153qGqqskJd+G6FF4=";
   };
 
-  vendorHash = "sha256-PxZ+fx5wkYuggMfpTfkc8quSssCzXdIcwjdR4qhDbqE=";
+  vendorHash = "sha256-T9qTfGRLhlYrezraRRztZC2Kw4L6Fap1YQgQdnlxKhE=";
 
   ldflags = [
     "-s"

pkgs/by-name/re/reindeer/package.nix

@@ -9,13 +9,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "reindeer";
-  version = "2025.10.13.00";
+  version = "2025.10.20.00";
 
   src = fetchFromGitHub {
     owner = "facebookincubator";
     repo = "reindeer";
     tag = "v${version}";
-    hash = "sha256-jbxTHu8IoUsQMkH2u82T6XsRKto7Z3ehEOAL9v0WGxE=";
+    hash = "sha256-SHJIDFhK5y+XxOS76pbSXW8Hr1Y5g0uhSw4km5usIsM=";
   };
 
   cargoHash = "sha256-XTp0GaqJhNf6auZzdv0+aGgIJ6hh3027EqPr90nWB3I=";

pkgs/by-name/rq/rqlite/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "rqlite";
-  version = "9.1.2";
+  version = "9.1.3";
 
   src = fetchFromGitHub {
     owner = "rqlite";
     repo = "rqlite";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7QAJofhssL2N5szD4j9rcv830sEnMyrS2Mg4s4G33HI=";
+    hash = "sha256-BybfZio4SSlpTbNHWfiA/2lVcNXhKWaBNTEoCSDxMSE=";
   };
 
-  vendorHash = "sha256-zGAC7yDccfhZ+2WeiN9DAsOFTa3j4ymPxeFNwam7+Ts=";
+  vendorHash = "sha256-bkAlZT0bntSdVwioEaqBK7XObGwJuIG7tfF7XOr3lKQ=";
 
   subPackages = [
     "cmd/rqlite"

pkgs/by-name/sc/scalp/package.nix

@@ -25,6 +25,7 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required (VERSION 3.3.2)" "cmake_minimum_required (VERSION 3.5)" \
       --replace-fail "\''$ORIGIN" "\''${CMAKE_INSTALL_PREFIX}/lib" \
       --replace-fail "-m64" ""
     substituteInPlace src/tests/CMakeLists.txt \

pkgs/by-name/sh/sharpsat-td/package.nix

@@ -48,6 +48,9 @@ stdenv.mkDerivation {
     # replace bundled version of mpreal/mpfrc++
     rm -r src/mpfr
     cp -r ${mpreal} src/mpfr
+
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required (VERSION 2.8)" "cmake_minimum_required(VERSION 3.10)"
   '';
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/si/sigsum/package.nix

@@ -0,0 +1,51 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitLab,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "sigsum";
+  version = "0.11.2";
+
+  src = fetchFromGitLab {
+    domain = "git.glasklar.is";
+    group = "sigsum";
+    owner = "core";
+    repo = "sigsum-go";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-oaYquy0N8yHfKLoNEv8Vte3dpp/UQFZ74mZHin8dDzw=";
+  };
+
+  postPatch = ''
+    substituteInPlace internal/version/version.go \
+      --replace-fail "info.Main.Version" '"${finalAttrs.version}"'
+  '';
+
+  vendorHash = "sha256-8Tyhd13PRTO2dGOdhkgYmwsVzWfqwOpZ9XSsAtiCcyM=";
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  excludedPackages = [ "./test" ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgram = "${placeholder "out"}/bin/sigsum-key";
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "System for public and transparent logging of signed checksums";
+    homepage = "https://www.sigsum.org/";
+    downloadPage = "https://git.glasklar.is/sigsum/core/sigsum-go";
+    changelog = "https://git.glasklar.is/sigsum/core/sigsum-go/-/blob/v${finalAttrs.version}/NEWS";
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ defelo ];
+  };
+})

pkgs/by-name/so/sofia_sip/2001-sofia-sip-Disable-some-tests.patch

@@ -0,0 +1,109 @@
+diff --git a/libsofia-sip-ua-glib/su-glib/Makefile.am b/libsofia-sip-ua-glib/su-glib/Makefile.am
+index 6f54d34..c5bfd82 100644
+--- a/libsofia-sip-ua-glib/su-glib/Makefile.am
++++ b/libsofia-sip-ua-glib/su-glib/Makefile.am
+@@ -20,12 +20,12 @@ AM_CPPFLAGS =		-I$(S_BASE)/su -I$(B_BASE)/su $(GLIB_CFLAGS) \
+ 
+ noinst_LTLIBRARIES = 	libsu-glib.la
+ 
+-check_PROGRAMS = 	su_source_test torture_su_glib_timer
++check_PROGRAMS =
+ 
+ # ----------------------------------------------------------------------
+ # Tests
+ 
+-TESTS = 		su_source_test torture_su_glib_timer
++TESTS =
+ 
+ # ----------------------------------------------------------------------
+ # Rules for building the targets
+diff --git a/libsofia-sip-ua/nta/Makefile.am b/libsofia-sip-ua/nta/Makefile.am
+index c450fd1..4f322c3 100644
+--- a/libsofia-sip-ua/nta/Makefile.am
++++ b/libsofia-sip-ua/nta/Makefile.am
+@@ -26,9 +26,9 @@ AM_CPPFLAGS = 		-I$(srcdir)/../ipt -I../ipt \
+ noinst_LTLIBRARIES = 	libnta.la
+ 
+ check_PROGRAMS = 	check_nta test_nta_api test_nta portbind
+-dist_noinst_SCRIPTS =	run_test_nta_api run_test_nta
++dist_noinst_SCRIPTS =	run_test_nta_api
+ 
+-TESTS =			run_check_nta run_test_nta_api run_test_nta
++TESTS =			run_test_nta_api
+ 
+ TESTS_ENVIRONMENT =	$(SHELL)
+ 
+diff --git a/libsofia-sip-ua/nua/Makefile.am b/libsofia-sip-ua/nua/Makefile.am
+index 6b6dfaa..73ffd70 100644
+--- a/libsofia-sip-ua/nua/Makefile.am
++++ b/libsofia-sip-ua/nua/Makefile.am
+@@ -17,8 +17,8 @@ check_PROGRAMS =
+ TESTS =
+ 
+ if HAVE_CHECK
+-check_PROGRAMS +=	check_nua
+-TESTS += 		check_nua
++check_PROGRAMS +=
++TESTS +=
+ endif
+ 
+ # ----------------------------------------------------------------------
+diff --git a/libsofia-sip-ua/su/Makefile.am b/libsofia-sip-ua/su/Makefile.am
+index db3a331..0a31c72 100644
+--- a/libsofia-sip-ua/su/Makefile.am
++++ b/libsofia-sip-ua/su/Makefile.am
+@@ -20,7 +20,7 @@ check_PROGRAMS = 	torture_su torture_su_port \
+ 			torture_su_alloc torture_su_time torture_su_tag \
+ 			test_htable test_htable2 torture_rbtree torture_heap \
+ 			test_memmem torture_su_bm \
+-			torture_su_root torture_su_timer \
++			torture_su_timer \
+ 			test_su su_proxy test_poll $(OSXPROGS)
+ 
+ # ----------------------------------------------------------------------
+@@ -30,8 +30,8 @@ TESTS = 		torture_su torture_su_port \
+ 			torture_su_alloc torture_su_time torture_su_tag \
+ 			test_htable test_htable2 torture_rbtree torture_heap \
+ 			test_memmem torture_su_bm \
+-			torture_su_root torture_su_timer \
+-			run_addrinfo run_localinfo run_test_su \
++			torture_su_timer \
++			run_localinfo run_test_su \
+ 			$(OSXTESTS)
+ 
+ # ----------------------------------------------------------------------
+@@ -98,7 +98,7 @@ LDADD = 		libsu.la
+ # Install and distribution rules
+ 
+ EXTRA_DIST += 		su.docs \
+-			run_addrinfo run_localinfo run_test_su
++			run_localinfo run_test_su
+ 
+ dist_pkgdata_SCRIPTS = 	tag_dll.awk
+ 
+diff --git a/tests/Makefile.am b/tests/Makefile.am
+index cabc2b5..0184017 100644
+--- a/tests/Makefile.am
++++ b/tests/Makefile.am
+@@ -5,8 +5,8 @@
+ # Contact: Pekka Pessi <pekka.pessi@nokia.com>
+ # Licensed under LGPL. See file COPYING.
+ 
+-TESTS = test_nua
+-check_PROGRAMS = test_nua
++TESTS =
++check_PROGRAMS =
+ 
+ EXTRA_DIST = check_sofia.h check_sofia.c suite_for_nua.c
+ 
+@@ -33,8 +33,8 @@ libtestproxy_a_SOURCES = test_proxy.h test_proxy.c
+ libtestnat_a_SOURCES =	test_nat.h test_nat.c test_nat_tags.c
+ 
+ if HAVE_CHECK
+-TESTS += check_dlopen_sofia check_sofia
+-check_PROGRAMS += check_dlopen_sofia check_sofia
++TESTS += check_dlopen_sofia
++check_PROGRAMS += check_dlopen_sofia
+ endif
+ 
+ check_sofia_CFLAGS = @CHECK_CFLAGS@

pkgs/by-name/so/sofia_sip/package.nix

@@ -3,45 +3,109 @@
   stdenv,
   fetchFromGitHub,
   fetchpatch2,
+  gitUpdater,
+  testers,
+  autoconf,
+  automake,
+  check,
   glib,
+  libtool,
   openssl,
   pkg-config,
-  autoreconfHook,
+  valgrind,
+  zlib,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "sofia-sip";
   version = "1.13.17";
 
   src = fetchFromGitHub {
     owner = "freeswitch";
     repo = "sofia-sip";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-7QmK2UxEO5lC0KBDWB3bwKTy0Nc7WrdTLjoQYzezoaY=";
+    hash = "sha256-7QmK2UxEO5lC0KBDWB3bwKTy0Nc7WrdTLjoQYzezoaY=";
   };
 
   patches = [
     # Fix build with gcc 14 from https://github.com/freeswitch/sofia-sip/pull/249
     (fetchpatch2 {
       name = "sofia-sip-fix-incompatible-pointer-type.patch";
-      url = "https://github.com/freeswitch/sofia-sip/commit/46b02f0655af0a9594e805f09a8ee99278f84777.diff";
+      url = "https://github.com/freeswitch/sofia-sip/commit/46b02f0655af0a9594e805f09a8ee99278f84777.patch?full_index=1";
-      hash = "sha256-4uZVtKnXG+BPW8byjd7tu4uEZo9SYq9EzTEvMwG0Bak=";
+      hash = "sha256-bZzjg7GBxR2wSlPH81krZRCK43OirGLWH/lrLRZ0L0k=";
     })
+
+    # Disable some failing tests
+    # https://github.com/freeswitch/sofia-sip/issues/234
+    # run_addrinfo: Fails due to limited networking during build
+    # torture_su_root: Aborts with: bit out of range 0 - FD_SETSIZE on fd_set
+    # run_check_nta: Times out in client_2_1_1 test, which seems to test some connection protocol fallback thing
+    # run_test_nta: "no valid IPv6 addresses available", likely due to no networking in sandbox
+    # check_nua, check_sofia, test_nua: Times out no matter how much time is given to it
+    ./2001-sofia-sip-Disable-some-tests.patch
+  ];
+
+  # This actually breaks these tests, leading to bash trying to execute itself
+  # https://github.com/freeswitch/sofia-sip/issues/234
+  postPatch = ''
+    substituteInPlace libsofia-sip-ua/nta/Makefile.am \
+      --replace-fail 'TESTS_ENVIRONMENT =' '#TESTS_ENVIRONMENT ='
+  '';
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    autoconf
+    automake
+    libtool
+    pkg-config
   ];
 
   buildInputs = [
     glib
     openssl
   ];
-  nativeBuildInputs = [
+
-    autoreconfHook
+  nativeCheckInputs = [
-    pkg-config
+    valgrind
   ];
 
-  meta = with lib; {
+  checkInputs = [
+    check
+    zlib
+  ];
+
+  preConfigure = ''
+    ./bootstrap.sh
+  '';
+
+  configureFlags = [
+    (lib.strings.enableFeature true "expensive-checks")
+  ];
+
+  enableParallelBuilding = true;
+
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+
+  passthru = {
+    tests.pkg-config = testers.hasPkgConfigModules {
+      package = finalAttrs.finalPackage;
+      versionCheck = true;
+    };
+    updateScript = gitUpdater {
+      rev-prefix = "v";
+    };
+  };
+
+  meta = {
     description = "Open-source SIP User-Agent library, compliant with the IETF RFC3261 specification";
     homepage = "https://github.com/freeswitch/sofia-sip";
-    platforms = platforms.unix;
+    platforms = lib.platforms.unix;
-    license = licenses.lgpl2;
+    license = lib.licenses.lgpl2Plus;
+    teams = [ lib.teams.ngi ];
+    pkgConfigModules = [
+      "sofia-sip-ua"
+      "sofia-sip-ua-glib"
+    ];
   };
-}
+})

pkgs/by-name/st/stanc/package.nix

@@ -6,7 +6,7 @@
 
 ocamlPackages.buildDunePackage rec {
   pname = "stanc";
-  version = "2.36.0";
+  version = "2.37.0";
 
   minimalOCamlVersion = "4.12";
   duneVersion = "3";
@@ -14,8 +14,8 @@ ocamlPackages.buildDunePackage rec {
   src = fetchFromGitHub {
     owner = "stan-dev";
     repo = "stanc3";
-    rev = "v${version}";
+    tag = "v${version}";
-    hash = "sha256-IrpHV00Fn3Nxail4Xgv/8ezclKpyVuQa1F34kF07wwA=";
+    hash = "sha256-d+sInQfnlT1gLbtIRPD+LUZgIdl519OrfvgSNYdYeII=";
   };
 
   nativeBuildInputs = with ocamlPackages; [ menhir ];
@@ -26,6 +26,7 @@ ocamlPackages.buildDunePackage rec {
     ppx_deriving
     fmt
     yojson
+    cmdliner
   ];
 
   meta = with lib; {

pkgs/by-name/sy/syft/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "syft";
-  version = "1.34.0";
+  version = "1.34.2";
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = "syft";
     tag = "v${version}";
-    hash = "sha256-J9ia5VjEItwDS2YjKAGAuQTTig5IIQA70yBYM/2r4B4=";
+    hash = "sha256-1RdJpjUVenmfx6dIme97f1N4zAWFt5Z25IfIjZLIAPI=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;

pkgs/by-name/te/teamspeak6-client/package.nix

@@ -22,6 +22,7 @@
   libxkbcommon,
   libgbm,
   nss,
+  pipewire,
   udev,
   libGL,
   xorg,
@@ -29,11 +30,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "teamspeak6-client";
-  version = "6.0.0-beta2";
+  version = "6.0.0-beta3.1";
 
   src = fetchurl {
     url = "https://files.teamspeak-services.com/pre_releases/client/${finalAttrs.version}/teamspeak-client.tar.gz";
-    hash = "sha256-3jNPv3uQ2RztR1p4XQNLUg5IVrvW/dcdtqXdiGJKVSs=";
+    hash = "sha256-CWKyn49DSWgrkJyYcPwKUz2PBykvFQc1f7G/yvrHbWU=";
   };
 
   sourceRoot = ".";
@@ -55,6 +56,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     libxkbcommon
     libgbm
     nss
+    pipewire
     xorg.libX11
     xorg.libXScrnSaver
     xorg.libXdamage
@@ -102,6 +104,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
           udev
           libGL
           libpulseaudio
+          pipewire
         ]
       }"
 

pkgs/by-name/te/telegraf/package.nix

@@ -10,7 +10,7 @@
 
 buildGoModule rec {
   pname = "telegraf";
-  version = "1.36.2";
+  version = "1.36.3";
 
   subPackages = [ "cmd/telegraf" ];
 
@@ -18,10 +18,10 @@ buildGoModule rec {
     owner = "influxdata";
     repo = "telegraf";
     rev = "v${version}";
-    hash = "sha256-nIYAGsGYZUK5o1KqcH4bI3wPRRXCynN6N5T6f2oy2bo=";
+    hash = "sha256-aEMvBKDE+fbjXyvi3MkbV1/Bu0q4F7W7DPwTRUcWY8M=";
   };
 
-  vendorHash = "sha256-k4hI/qIQgV1qChOWDCqWcMboaVoDe3k/DP/wNa0Aqg4=";
+  vendorHash = "sha256-BofW6hvcpQb1OWTbfoS+o2RJg4N0zMqid1ergeVh/wM=";
   proxyVendor = true;
 
   ldflags = [

pkgs/by-name/tx/txtpbfmt/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule {
   pname = "txtpbfmt";
-  version = "0-unstable-2025-10-15";
+  version = "0-unstable-2025-10-16";
 
   src = fetchFromGitHub {
     owner = "protocolbuffers";
     repo = "txtpbfmt";
-    rev = "0b0c2708cf8453209ac9864099a502d5d1723ee4";
+    rev = "16587c79cd916daf09ade0a7d72e6a5de7c81f81";
-    hash = "sha256-d6fT98Po7c+ZIwn3UG4JlsLRVjurnE0htrCUzM9sxGk=";
+    hash = "sha256-3rzsw6CvN8mzjRM8OCDNvVquQNx+82NPeHizNOF+g54=";
   };
 
   vendorHash = "sha256-aeYa7a/oKH2dxXHRkkqyh7f04citRDGQxAaKQTJst4o=";

pkgs/by-name/un/unciv/package.nix

@@ -12,7 +12,7 @@
   nix-update-script,
 }:
 let
-  version = "4.18.6";
+  version = "4.18.7";
 
   desktopItem = makeDesktopItem {
     name = "unciv";
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://github.com/yairm210/Unciv/releases/download/${version}/Unciv.jar";
-    hash = "sha256-UKm5lJ378AZ016To5eC6EpFFNfbINCeHZdUyv+MN0X4=";
+    hash = "sha256-bZzF8WUDw2rrF8Qi6PKBA9F5EUDZGwgXegcHDFgQxJY=";
   };
 
   dontUnpack = true;

pkgs/by-name/wa/wait4x/package.nix

@@ -5,7 +5,7 @@
 }:
 let
   pname = "wait4x";
-  version = "3.5.1";
+  version = "3.6.0";
 in
 buildGoModule {
   inherit pname version;
@@ -14,10 +14,10 @@ buildGoModule {
     owner = "wait4x";
     repo = "wait4x";
     rev = "v${version}";
-    hash = "sha256-VAt61k2eHQwyLSsvbWxe7jJ/Wyj4U4O2+LzCsoP/Yq4=";
+    hash = "sha256-RiF5tcnzMteXaYmw4mfQdamwV1PAyNC8pUownJzfACs=";
   };
 
-  vendorHash = "sha256-KJOKLTjwwgu2MFNIRDk8eeSVnZyjO9dfVyWrF5vqj9g=";
+  vendorHash = "sha256-fa3XEqLkzriMFYea3bv4FzaKgK2FsGwn5IQG48vh7+M=";
 
   # Tests make network access
   doCheck = false;

pkgs/by-name/wa/wasmtime/package.nix

@@ -13,20 +13,20 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "wasmtime";
-  version = "37.0.2";
+  version = "38.0.1";
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = "wasmtime";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-OQyGcxWMOxxzBHyOg2LUVsFuBEow6NIJCfrnsYWZtzk=";
+    hash = "sha256-Arb4wUIJx3OyE8wbshotpy5Br7ZHHA7zXP98uGm/gyo=";
     fetchSubmodules = true;
   };
 
   # Disable cargo-auditable until https://github.com/rust-secure-code/cargo-auditable/issues/124 is solved.
   auditable = false;
 
-  cargoHash = "sha256-PXvhwnfGvGF4D6U+2dKp3wg6cbk/i+0bWRAMSkyd6i8=";
+  cargoHash = "sha256-ZF+uaMjhBMdLPp8TP4DnPB23igOE92YuhQ1US65NNRk=";
   cargoBuildFlags = [
     "--package"
     "wasmtime-cli"

pkgs/by-name/x2/x265/package.nix

@@ -120,6 +120,13 @@ stdenv.mkDerivation rec {
     (mkFlag vtuneSupport "ENABLE_VTUNE")
     (mkFlag werrorSupport "WARNINGS_AS_ERRORS")
   ]
+  ++ lib.optionals stdenv.hostPlatform.isPower [
+    # baseline for everything but ppc64le doesn't have AltiVec
+    # ppc64le: https://bitbucket.org/multicoreware/x265_git/issues/320/fail-to-build-on-power8-le
+    (lib.cmakeBool "ENABLE_ALTIVEC" false)
+    # baseline for everything but ppc64le is pre-POWER8
+    (lib.cmakeBool "CPU_POWER8" (stdenv.hostPlatform.isPower64 && stdenv.hostPlatform.isLittleEndian))
+  ]
   # Clang does not support the endfunc directive so use GCC.
   ++ lib.optional (
     stdenv.cc.isClang && !stdenv.targetPlatform.isDarwin && !stdenv.targetPlatform.isFreeBSD
@@ -137,9 +144,6 @@ stdenv.mkDerivation rec {
     "-DENABLE_SHARED=OFF"
     "-DEXPORT_C_API=OFF"
   ]
-  ++ lib.optionals stdenv.hostPlatform.isPower [
-    "-DENABLE_ALTIVEC=OFF" # https://bitbucket.org/multicoreware/x265_git/issues/320/fail-to-build-on-power8-le
-  ]
   ++ lib.optionals isCross [
     (mkFlag stdenv.hostPlatform.isAarch32 "CROSS_COMPILE_ARM")
     (mkFlag stdenv.hostPlatform.isAarch64 "CROSS_COMPILE_ARM64")

pkgs/by-name/xv/xv/package.nix

@@ -7,7 +7,9 @@
   libpng,
   libwebp,
   libtiff,
+  libjpeg,
   jasper,
+  libxrandr,
 }:
 
 stdenv.mkDerivation rec {
@@ -28,7 +30,9 @@ stdenv.mkDerivation rec {
     libpng
     libwebp
     libtiff
+    libjpeg
     jasper
+    libxrandr
   ];
 
   meta = {

pkgs/by-name/ya/yamlfmt/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "yamlfmt";
-  version = "0.18.0";
+  version = "0.19.0";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "yamlfmt";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ifrRqa6GRwzwr9ORsmvDaLmznDp3KVtFyEzaG3EqEhY=";
+    hash = "sha256-SIjWBXhi5uy34KySxMCTrTDdXXvtVCWWj4LhYcXq5MU=";
     leaveDotGit = true;
     postFetch = ''
       git -C "$out" rev-parse --short HEAD > "$out/.git_head"

pkgs/development/libraries/ffmpeg/generic.nix

@@ -78,6 +78,7 @@
       && !isAarch32
       && !hostPlatform.isLoongArch64
       && !hostPlatform.isRiscV
+      && !(hostPlatform.isPower && hostPlatform.isBigEndian)
       && hostPlatform == buildPlatform
     ), # dynamically linked Nvidia code
   withFlite ? withFullDeps, # Voice Synthesis
@@ -798,6 +799,25 @@ stdenv.mkDerivation (
       (enableFeature withExtraWarnings "extra-warnings")
       (enableFeature withStripping "stripping")
     ]
+    ++ optionals (stdenv.hostPlatform.isPower) [
+      # FFmpeg expects us to pass `--cpu=` to pick a specific feature set to compile for. If unset, it defaults to `generic`.
+      # For POWER, the default doesn't produce baseline-compliant settings. Passing a baseline-like CPU as a target doesn't
+      # produce entirely correct settings either - POWER4 leaves AltiVec enabled, but that's only guaranteed with POWER6.
+      # Just configure together everything on our own.
+
+      # Easy: Only ppc64le's baseline is recent enough to guarantee all of these.
+      (enableFeature (stdenv.hostPlatform.isPower64 && stdenv.hostPlatform.isLittleEndian) "altivec")
+      (enableFeature (stdenv.hostPlatform.isPower64 && stdenv.hostPlatform.isLittleEndian) "vsx")
+      (enableFeature (stdenv.hostPlatform.isPower64 && stdenv.hostPlatform.isLittleEndian) "power8")
+      (enableFeature (stdenv.hostPlatform.isPower64 && stdenv.hostPlatform.isLittleEndian) "ldbrx")
+
+      # Instructions that are highly specific to that series of 32-bit embedded CPUs. Never try to enable them.
+      (enableFeature false "ppc4xx")
+
+      # I *think* enabling this on 64-bit POWER is correct? Struggling to find much info on when/where this was introduced.
+      # Definitely present on the Apple G5, and likely Freescale e5500/e6500 as well.
+      (enableFeature (stdenv.hostPlatform.isPower64) "dcbzl")
+    ]
     ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
       "--cross-prefix=${stdenv.cc.targetPrefix}"
       "--enable-cross-compile"

pkgs/development/node-packages/aliases.nix

@@ -146,6 +146,7 @@ mapAliases {
   inherit (pkgs) javascript-typescript-langserver; # added 2023-08-19
   inherit (pkgs) kaput-cli; # added 2024-12-03
   karma = pkgs.karma-runner; # added 2023-07-29
+  keyoxide = pkgs.keyoxide-cli; # Added 2025-10-20
   leetcode-cli = self.vsc-leetcode-cli; # added 2023-08-31
   inherit (pkgs) lerna; # added 2025-02-12
   less = pkgs.lessc; # added 2024-06-15

pkgs/development/node-packages/node-packages.json

@@ -96,7 +96,6 @@
 , "jsonlint"
 , "jsonplaceholder"
 , "katex"
-, "keyoxide"
 , "lcov-result-merger"
 , "live-server"
 , "livedown"

pkgs/development/node-packages/overrides.nix

@@ -111,15 +111,6 @@ final: prev: {
     '';
   };
 
-  keyoxide = prev.keyoxide.override {
-    nativeBuildInputs = [ pkgs.pkg-config ];
-    buildInputs = with pkgs; [
-      pixman
-      cairo
-      pango
-    ];
-  };
-
   makam = prev.makam.override {
     nativeBuildInputs = [ pkgs.buildPackages.makeWrapper ];
     postFixup = ''

pkgs/development/python-modules/bring-api/default.nix

@@ -9,7 +9,6 @@
   pytest-asyncio,
   pytestCheckHook,
   python-dotenv,
-  pythonOlder,
   setuptools,
   syrupy,
   yarl,
@@ -17,16 +16,14 @@
 
 buildPythonPackage rec {
   pname = "bring-api";
-  version = "1.1.0";
+  version = "1.1.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.11";
-
   src = fetchFromGitHub {
     owner = "miaucl";
     repo = "bring-api";
     tag = version;
-    hash = "sha256-OxY9G7zy5VSpTOARoManJNvMg6ghIK0KJunanSgXKm0=";
+    hash = "sha256-BslU1ekbQIZh1f1zRYXbZdbOepB2+NWIuWZI4L/oxSg=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/chromadb/default.nix

@@ -67,20 +67,19 @@
 
 buildPythonPackage rec {
   pname = "chromadb";
-  version = "1.1.1";
+  version = "1.2.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "chroma-core";
     repo = "chroma";
     tag = version;
-    hash = "sha256-WFN4z+LQwqy6bd59yWlglpXFqNZPEd3jcgeWhdphxYM=";
+    hash = "sha256-xEXW88iV9lqDOGrnoH0ZsoGMajATShA9HC+G79EdS9s=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit src;
+    inherit pname version src;
-    name = "${pname}-${version}-vendor";
+    hash = "sha256-GlF8Fp42ra5d55PIGOS4zOHXPSaIZGI/l8sHz/wyDgo=";
-    hash = "sha256-LZXtAt4rP0rKaleMht1eFPdqgE8nu5NdLzhWBW69WW8=";
   };
 
   # Can't use fetchFromGitHub as the build expects a zipfile

pkgs/development/python-modules/clarifai/default.nix

@@ -32,7 +32,7 @@
 
 buildPythonPackage rec {
   pname = "clarifai";
-  version = "11.8.3";
+  version = "11.8.5";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -41,7 +41,7 @@ buildPythonPackage rec {
     owner = "Clarifai";
     repo = "clarifai-python";
     tag = version;
-    hash = "sha256-sl9x8VqGGgUfPSRZiMP6edLeUUTpASp8kdRLl0Kxclc=";
+    hash = "sha256-c0lCbkHOIbzgaVLyGfJ8mbgtePTpv+PbsmErI4ZuLq4=";
   };
 
   pythonRelaxDeps = [

pkgs/development/python-modules/cmdstanpy/default.nix

@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "cmdstanpy";
-  version = "1.2.5";
+  version = "1.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "stan-dev";
     repo = "cmdstanpy";
     tag = "v${version}";
-    hash = "sha256-/MiWawB1Y4/eMBHXQLjd+P+Pe8EtsLbGFrzQa1RNf6g=";
+    hash = "sha256-XVviGdJ41mcjCscL3jvcpHi6zMREHsuShGHpnMQX6V8=";
   };
 
   patches = [

pkgs/development/python-modules/fast-array-utils/default.nix

@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "fast-array-utils";
-  version = "1.2.4";
+  version = "1.2.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "scverse";
     repo = "fast-array-utils";
     tag = "v${version}";
-    hash = "sha256-R8pOID9Lws29OCMWb7RZNDsWakEYDf7bya6iSXp8Ips=";
+    hash = "sha256-iJcnmCh0AssbUEJg62cKURu1afHQiS/cZhYmGsZQM9I=";
   };
 
   # hatch-min-requirements tries to talk to PyPI by default. See https://github.com/tlambert03/hatch-min-requirements?tab=readme-ov-file#environment-variables.

pkgs/development/python-modules/grpclib/default.nix

@@ -1,10 +1,10 @@
 {
   lib,
-  async-timeout,
   buildPythonPackage,
   certifi,
   faker,
   fetchFromGitHub,
+  fetchpatch,
   googleapis-common-protos,
   h2,
   multidict,
@@ -28,6 +28,15 @@ buildPythonPackage rec {
     hash = "sha256-Z+DMwGMUxNTQ7ABd4q/FgMHEZ/NCOtst+6QfQJm3jVU=";
   };
 
+  patches = [
+    # https://github.com/vmagamedov/grpclib/pull/209
+    (fetchpatch {
+      name = "replace-async-timeout-with-asyncio-timeout-patch";
+      url = "https://github.com/vmagamedov/grpclib/commit/36b23ce3ca3f1742e39b50f939d13cd08b4f28ac.patch";
+      hash = "sha256-3ztLBOFpTK8CFIp8a6suhWXY5kIBCBRWBX/oAyYU4yI=";
+    })
+  ];
+
   build-system = [ setuptools ];
 
   dependencies = [
@@ -38,7 +47,6 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     pytestCheckHook
     pytest-asyncio_0
-    async-timeout
     faker
     googleapis-common-protos
     certifi

pkgs/development/python-modules/json-repair/default.nix

@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "json-repair";
-  version = "0.52.0";
+  version = "0.52.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mangiucugna";
     repo = "json_repair";
     tag = "v${version}";
-    hash = "sha256-RK5VycwcI6EhFkejbSwr96iF12O22nIGQzbOIlo/Mhk=";
+    hash = "sha256-NYW2PJ329c8EYfQrRl1mi+leUR7Afz2J0N9HVD1xyT0=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/jupyter-server/default.nix

@@ -111,6 +111,8 @@ buildPythonPackage rec {
     "test_delete"
     # Insufficient access privileges for operation
     "test_regression_is_hidden"
+    # Fails under load (which causes failure on Hydra)
+    "test_execution_state"
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     # Failed: DID NOT RAISE <class 'tornado.web.HTTPError'>
@@ -120,7 +122,6 @@ buildPythonPackage rec {
     # TypeError: the JSON object must be str, bytes or bytearray, not NoneType
     "test_terminal_create_with_cwd"
     # Fails under load (which causes failure on Hydra)
-    "test_execution_state"
     "test_cull_connected"
   ];
 

pkgs/development/python-modules/llm/default.nix

@@ -228,6 +228,17 @@ let
       "tests/"
     ];
 
+    disabledTests = [
+      # AssertionError: The following responses are mocked but not requested:
+      # - Match POST request on https://api.openai.com/v1/chat/completions
+      # https://github.com/simonw/llm/issues/1292
+      "test_gpt4o_mini_sync_and_async"
+
+      # TypeError: CliRunner.__init__() got an unexpected keyword argument 'mix_stderr
+      # https://github.com/simonw/llm/issues/1293
+      "test_embed_multi_files_encoding"
+    ];
+
     pythonImportsCheck = [ "llm" ];
 
     passthru = {

pkgs/development/python-modules/mindsdb-evaluator/default.nix

@@ -1,34 +1,34 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
-  pythonOlder,
   poetry-core,
   dataprep-ml,
   numpy,
   pandas,
   scikit-learn,
   type-infer,
+  pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "mindsdb-evaluator";
-  version = "0.0.18";
+  version = "0.0.20";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
+  src = fetchFromGitHub {
-
+    owner = "mindsdb";
-  # using PyPI as git repository does not have release tags or branches
+    repo = "mindsdb_evaluator";
-  src = fetchPypi {
+    tag = "v${version}";
-    pname = "mindsdb_evaluator";
+    hash = "sha256-ZeJABMbyRdGrZGkWWXcjleOeDQBSicGR06hZAPUKvgI=";
-    inherit version;
-    hash = "sha256-UGg7P/OKmRi70z2roRBsA95FAXm7CG+TdPzTRy7+p4w=";
   };
 
   build-system = [ poetry-core ];
 
   pythonRelaxDeps = [
+    "dataprep-ml"
     "numpy"
+    "scikit-learn"
   ];
 
   dependencies = [
@@ -41,10 +41,15 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "mindsdb_evaluator" ];
 
-  meta = with lib; {
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  meta = {
+    changelog = "https://github.com/mindsdb/mindsdb_evaluator/releases/tag/${src.tag}";
     description = "Model evaluation for Machine Learning pipelines";
-    homepage = "https://pypi.org/project/mindsdb-evaluator/";
+    homepage = "https://github.com/mindsdb/mindsdb_evaluator";
-    license = licenses.gpl3Only;
+    license = lib.licenses.gpl3Only;
-    maintainers = with maintainers; [ mbalatsko ];
+    maintainers = with lib.maintainers; [ mbalatsko ];
   };
 }

pkgs/development/python-modules/niworkflows/default.nix

@@ -40,14 +40,14 @@
 
 buildPythonPackage rec {
   pname = "niworkflows";
-  version = "1.14.2";
+  version = "1.14.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "nipreps";
     repo = "niworkflows";
     tag = version;
-    hash = "sha256-LzzbletoZdI9HuaBWhFB6IGs1nX6ZItNP6cWlw5m5EE=";
+    hash = "sha256-wdPHXVgMvd+Od3M2j7S43gBRSh4yiPeu+HM6EyiakwU=";
   };
 
   pythonRelaxDeps = [ "traits" ];

pkgs/development/python-modules/pglast/default.nix

@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "pglast";
-  version = "7.7";
+  version = "7.8";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Xfv8H6OYGWQ6O5FaE2aOQ7vWwLAUqt9dC0MJ6GC6y7A=";
+    hash = "sha256-2tSZKS3dXK6236Q1sox4wpCAgkQ91eqr0RZWMmY/Fz8=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/pip-system-certs/default.nix

@@ -9,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "pip-system-certs";
-  version = "5.2";
+  version = "5.3";
   pyproject = true;
 
   src = fetchPypi {
     inherit version;
     pname = "pip_system_certs";
-    hash = "sha256-gLd2tc8XGRv5nTE2mbf84v24Tre7siX9E0EJqCcGQG8=";
+    hash = "sha256-Gci/mVe8zn1pxNvC0LLvE94ZhNU/UKWQEubbutCvZ8Y=";
   };
 
   build-system = [

pkgs/development/python-modules/prophet/default.nix

@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "prophet";
-  version = "1.1.7";
+  version = "1.2.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = "facebook";
     repo = "prophet";
     tag = "v${version}";
-    hash = "sha256-94hxpfpZN3yvDUu+kM7Oc2Yu8+z0Gv6zqYRAwKXgHk4=";
+    hash = "sha256-SCd/PhchLbkb63HEEmRlfX2VruLo2jpweRkidgqNzE8=";
   };
 
   sourceRoot = "${src.name}/python";

pkgs/development/python-modules/pylitterbot/default.nix

@@ -12,21 +12,18 @@
   pytest-aiohttp,
   pytest-freezegun,
   pytestCheckHook,
-  pythonOlder,
 }:
 
 buildPythonPackage rec {
   pname = "pylitterbot";
-  version = "2024.2.4";
+  version = "2024.2.6";
   pyproject = true;
 
-  disabled = pythonOlder "3.10";
-
   src = fetchFromGitHub {
     owner = "natekspencer";
     repo = "pylitterbot";
     tag = "v${version}";
-    hash = "sha256-/GN2b4rlE6j60O5ZxH8I58qwcZewAYJu0EHwQ7mrdBY=";
+    hash = "sha256-oQuEo0np+e+HfsQoWbv84BNpxNJQO3ZjocaCfllqkts=";
   };
 
   pythonRelaxDeps = [ "deepdiff" ];
@@ -52,11 +49,11 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "pylitterbot" ];
 
-  meta = with lib; {
+  meta = {
     description = "Modulefor controlling a Litter-Robot";
     homepage = "https://github.com/natekspencer/pylitterbot";
     changelog = "https://github.com/natekspencer/pylitterbot/releases/tag/${src.tag}";
-    license = with licenses; [ mit ];
+    license = lib.licenses.mit;
-    maintainers = with maintainers; [ fab ];
+    maintainers = with lib.maintainers; [ fab ];
   };
 }

pkgs/development/python-modules/pyportainer/default.nix

@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "pyportainer";
-  version = "1.0.3";
+  version = "1.0.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "erwindouna";
     repo = "pyportainer";
     tag = "v${version}";
-    hash = "sha256-Y/O2lhsjkSEKQL7HhdmlzMjY1597uuUOFfI05aLiBXg=";
+    hash = "sha256-jEUVAbNwBil5k6eNtuzspMvXDhFXktopwl/YCvnK2ko=";
   };
 
   build-system = [ poetry-core ];

pkgs/development/python-modules/pytensor/default.nix

@@ -33,7 +33,7 @@
 
 buildPythonPackage rec {
   pname = "pytensor";
-  version = "2.35.0";
+  version = "2.35.1";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -43,7 +43,7 @@ buildPythonPackage rec {
     postFetch = ''
       sed -i 's/git_refnames = "[^"]*"/git_refnames = " (tag: ${src.tag})"/' $out/pytensor/_version.py
     '';
-    hash = "sha256-xQ9qFQhVSxdCB+jsfcxy04HySl7Mq0lGd4cg9bTxU5E=";
+    hash = "sha256-5+yMZysK69g+3uYrP12WK3ngpAYn8XrHoVjLqjvbobg=";
   };
 
   build-system = [
@@ -173,7 +173,7 @@ buildPythonPackage rec {
     description = "Python library to define, optimize, and efficiently evaluate mathematical expressions involving multi-dimensional arrays";
     mainProgram = "pytensor-cache";
     homepage = "https://github.com/pymc-devs/pytensor";
-    changelog = "https://github.com/pymc-devs/pytensor/releases/tag/rel-${src.tag}";
+    changelog = "https://github.com/pymc-devs/pytensor/releases/tag/${src.tag}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [
       bcdarwin

pkgs/development/python-modules/python-bring-api/default.nix

@@ -1,40 +0,0 @@
-{
-  lib,
-  aiohttp,
-  buildPythonPackage,
-  fetchFromGitHub,
-  pythonOlder,
-  setuptools,
-}:
-
-buildPythonPackage {
-  pname = "python-bring-api";
-  version = "3.0.0-unstable-2024-02-03";
-  pyproject = true;
-
-  disabled = pythonOlder "3.8";
-
-  src = fetchFromGitHub {
-    owner = "eliasball";
-    repo = "python-bring-api";
-    # https://github.com/eliasball/python-bring-api/issues/16
-    rev = "8043562b22be1f6421a8771774868b105b6ca375";
-    hash = "sha256-VCGCm9N6pMhEYT9WuWh7qKacZEf6bcIpEsILfCC6his=";
-  };
-
-  nativeBuildInputs = [ setuptools ];
-
-  propagatedBuildInputs = [ aiohttp ];
-
-  # Module has no tests
-  doCheck = false;
-
-  pythonImportsCheck = [ "python_bring_api" ];
-
-  meta = with lib; {
-    description = "Module to access the Bring! shopping lists API";
-    homepage = "https://github.com/eliasball/python-bring-api";
-    license = licenses.mit;
-    maintainers = with maintainers; [ fab ];
-  };
-}

pkgs/development/python-modules/restrictedpython/default.nix

@@ -1,29 +1,27 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   pytest-mock,
   pytestCheckHook,
-  pythonAtLeast,
-  pythonOlder,
   setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "restrictedpython";
-  version = "8.0";
+  version = "8.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  src = fetchFromGitHub {
-
+    owner = "zopefoundation";
-  src = fetchPypi {
+    repo = "RestrictedPython";
-    inherit pname version;
+    tag = version;
-    hash = "sha256-OvIxK8Z+X87Yh/uFsAbImGHackiBKLFVvuqB62oKmyQ=";
+    hash = "sha256-UcmH1I2p+XmQm4Y5M+Ms/LMSchor6GD6V9dxippa4HI=";
   };
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace-fail "setuptools <= 75.6.0" setuptools
+      --replace-fail "setuptools >= 78.1.1,< 81" setuptools
   '';
 
   build-system = [ setuptools ];
@@ -33,15 +31,13 @@ buildPythonPackage rec {
     pytest-mock
   ];
 
-  disabledTests = lib.optionals (pythonAtLeast "3.11") [ "test_compile__compile_restricted_exec__5" ];
-
   pythonImportsCheck = [ "RestrictedPython" ];
 
-  meta = with lib; {
+  meta = {
     description = "Restricted execution environment for Python to run untrusted code";
     homepage = "https://github.com/zopefoundation/RestrictedPython";
-    changelog = "https://github.com/zopefoundation/RestrictedPython/blob/${version}/CHANGES.rst";
+    changelog = "https://github.com/zopefoundation/RestrictedPython/blob/${src.tag}/CHANGES.rst";
-    license = licenses.zpl21;
+    license = lib.licenses.zpl21;
-    maintainers = with maintainers; [ juaningan ];
+    maintainers = with lib.maintainers; [ juaningan ];
   };
 }

pkgs/development/python-modules/rigour/default.nix

@@ -21,14 +21,14 @@
 
 buildPythonPackage rec {
   pname = "rigour";
-  version = "1.3.11";
+  version = "1.3.13";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "opensanctions";
     repo = "rigour";
     tag = "v${version}";
-    hash = "sha256-ahHrNky8dGcH8UmpnZ8avfzyrz5RIvsL9YOe4V8EeE4=";
+    hash = "sha256-mcQ1GqmNWv4/ul9oRw/+MnTEcIcn3OP0C5eXi4HWKMU=";
   };
 
   build-system = [