Merge staging-next into staging

2025-10-22 00:17:44 +00:00
parent ea83f98bdd f05221f262
commit c17f995873
109 changed files with 755 additions and 2351 deletions
--- a/doc/release-notes/rl-2511.section.md
+++ b/doc/release-notes/rl-2511.section.md
@@ -364,6 +364,8 @@

 ### Deprecations {#sec-nixpkgs-release-25.11-lib-deprecations}

+- `lib.options.mkAliasOptionModuleMD` is now obsolete; use the identical [`lib.options.mkAliasOptionModule`] instead.
+
 - `types.either` silently accepted mismatching types when used in `freeformType`. Module maintainers should fix the used type
  In most cases wrapping `either` with `attrsOf` should be sufficient.

--- a/lib/modules.nix
+++ b/lib/modules.nix
@@ -1787,11 +1787,10 @@ let
    };

  /**
-    Transitional version of mkAliasOptionModule that uses MD docs.
-
-    This function is no longer necessary and merely an alias of `mkAliasOptionModule`.
+    Deprecated alias of mkAliasOptionModule that uses MD docs.
+    This function is no longer necessary will be removed in 26.05`.
  */
-  mkAliasOptionModuleMD = mkAliasOptionModule;
+  mkAliasOptionModuleMD = lib.warn "mkAliasOptionModuleMD is deprecated and will be removed in 26.05; please use mkAliasOptionModule." mkAliasOptionModule;

  /**
    mkDerivedConfig : Option a -> (a -> Definition b) -> Definition b
--- a/lib/types.nix
+++ b/lib/types.nix
@@ -1464,7 +1464,7 @@ let
                        One or more definitions did not pass the type-check of the 'either' type.
                        ${headError.message}
                        If `either`, `oneOf` or similar is used in freeformType, ensure that it is preceded by an 'attrsOf' such as: `freeformType = types.attrsOf (types.either t1 t2)`.
-                        Otherwise consider using the correct type for the option `${showOption loc}`.  This will be an error in Nixpkgs 26.06.
+                        Otherwise consider using the correct type for the option `${showOption loc}`.  This will be an error in Nixpkgs 26.05.
                      '' (mergeOneOption loc defs);
                    };
              in
--- a/nixos/modules/config/users-groups.nix
+++ b/nixos/modules/config/users-groups.nix
@@ -30,7 +30,7 @@ let
    mapAttrs'
    mapAttrsToList
    match
-    mkAliasOptionModuleMD
+    mkAliasOptionModule
    mkDefault
    mkIf
    mkMerge
@@ -666,8 +666,8 @@ let
 in
 {
  imports = [
-    (mkAliasOptionModuleMD [ "users" "extraUsers" ] [ "users" "users" ])
-    (mkAliasOptionModuleMD [ "users" "extraGroups" ] [ "users" "groups" ])
+    (mkAliasOptionModule [ "users" "extraUsers" ] [ "users" "users" ])
+    (mkAliasOptionModule [ "users" "extraGroups" ] [ "users" "groups" ])
    (mkRenamedOptionModule
      [ "security" "initialRootPassword" ]
      [ "users" "users" "root" "initialHashedPassword" ]
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -397,7 +397,6 @@
  ./security/pam_mount.nix
  ./security/please.nix
  ./security/polkit.nix
-  ./security/rngd.nix
  ./security/rtkit.nix
  ./security/soteria.nix
  ./security/sudo-rs.nix
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@@ -2,7 +2,7 @@

 let
  inherit (lib)
-    mkAliasOptionModuleMD
+    mkAliasOptionModule
    mkRemovedOptionModule
    ;
 in
@@ -18,7 +18,7 @@ in

    # This alias module can't be where _module.check is defined because it would
    # be added to submodules as well there
-    (mkAliasOptionModuleMD [ "environment" "checkConfigurationOptions" ] [ "_module" "check" ])
+    (mkAliasOptionModule [ "environment" "checkConfigurationOptions" ] [ "_module" "check" ])

    # Completely removed modules
    (mkRemovedOptionModule [ "boot" "loader" "raspberryPi" ]
@@ -411,6 +411,12 @@ in
    (mkRemovedOptionModule [ "services" "simplesamlphp" ] ''
      services.simplesamlphp has been vulnerable and unmaintained in nixpkgs.
    '')
+    (mkRemovedOptionModule [ "security" "rngd" ] ''
+      rngd is not necessary for any device that the kernel recognises
+      as an hardware RNG, as it will automatically run the krngd task
+      to periodically collect random data from the device and mix it
+      into the kernel's RNG.
+    '')
    # Do NOT add any option renames here, see top of the file
  ];
 }
--- a/nixos/modules/security/rngd.nix
+++ b/nixos/modules/security/rngd.nix
@@ -1,21 +0,0 @@
-{ lib, ... }:
-let
-  removed =
-    k:
-    lib.mkRemovedOptionModule [
-      "security"
-      "rngd"
-      k
-    ];
-in
-{
-  imports = [
-    (removed "enable" ''
-      rngd is not necessary for any device that the kernel recognises
-      as an hardware RNG, as it will automatically run the krngd task
-      to periodically collect random data from the device and mix it
-      into the kernel's RNG.
-    '')
-    (removed "debug" "The rngd module was removed, so its debug option does nothing.")
-  ];
-}
--- a/nixos/modules/services/networking/ssh/sshd.nix
+++ b/nixos/modules/services/networking/ssh/sshd.nix
@@ -177,8 +177,8 @@ in

 {
  imports = [
-    (lib.mkAliasOptionModuleMD [ "services" "sshd" "enable" ] [ "services" "openssh" "enable" ])
-    (lib.mkAliasOptionModuleMD [ "services" "openssh" "knownHosts" ] [ "programs" "ssh" "knownHosts" ])
+    (lib.mkAliasOptionModule [ "services" "sshd" "enable" ] [ "services" "openssh" "enable" ])
+    (lib.mkAliasOptionModule [ "services" "openssh" "knownHosts" ] [ "programs" "ssh" "knownHosts" ])
    (lib.mkRenamedOptionModule
      [ "services" "openssh" "challengeResponseAuthentication" ]
      [ "services" "openssh" "kbdInteractiveAuthentication" ]
--- a/nixos/modules/services/torrent/transmission.nix
+++ b/nixos/modules/services/torrent/transmission.nix
@@ -9,7 +9,7 @@
 let
  inherit (lib)
    mkRenamedOptionModule
-    mkAliasOptionModuleMD
+    mkAliasOptionModule
    mkEnableOption
    mkOption
    types
@@ -26,7 +26,6 @@ let

  cfg = config.services.transmission;
  opt = options.services.transmission;
-  inherit (config.environment) etc;
  apparmor = config.security.apparmor;
  rootDir = "/run/transmission";
  settingsDir = ".config/transmission-daemon";
@@ -51,7 +50,7 @@ in
        "rpc-port"
      ]
    )
-    (mkAliasOptionModuleMD
+    (mkAliasOptionModule
      [
        "services"
        "transmission"
--- a/nixos/modules/services/x11/picom.nix
+++ b/nixos/modules/services/x11/picom.nix
@@ -62,7 +62,7 @@ in
 {

  imports = [
-    (mkAliasOptionModuleMD [ "services" "compton" ] [ "services" "picom" ])
+    (mkAliasOptionModule [ "services" "compton" ] [ "services" "picom" ])
    (mkRemovedOptionModule [ "services" "picom" "refreshRate" ] ''
      This option corresponds to `refresh-rate`, which has been unused
      since picom v6 and was subsequently removed by upstream.
--- a/pkgs/applications/emulators/libretro/cores/nestopia.nix
+++ b/pkgs/applications/emulators/libretro/cores/nestopia.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "nestopia";
-  version = "0-unstable-2025-10-15";
+  version = "0-unstable-2025-10-16";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "nestopia";
-    rev = "3ac52e67c4a7fa696ee37e48bbcec93611277288";
-    hash = "sha256-TDv+HTOtNEmel1lZlnlAGMVM8nEYdHLH7Rw6WBviGGw=";
+    rev = "e9429844f2e16a284a8cdf663589634fd4c6345f";
+    hash = "sha256-Ss4AuIuwEbaQOUcnGfXbJbEw/1HkyGZSRD2ody+wSSU=";
  };

  makefile = "Makefile";
--- a/pkgs/applications/science/math/lp_solve/default.nix
+++ b/pkgs/applications/science/math/lp_solve/default.nix
@@ -19,7 +19,8 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-bUq/9cxqqpM66ObBeiJt8PwLZxxDj2lxXUHQn+gfkC8=";
  };

-  nativeBuildInputs = [
+  nativeBuildInputs =
+    lib.optionals (!stdenv.hostPlatform.isDarwin) [
      binutils
    ]
    ++ lib.optionals stdenv.hostPlatform.isDarwin [
--- a/pkgs/by-name/ai/air-formatter/package.nix
+++ b/pkgs/by-name/ai/air-formatter/package.nix
@@ -7,16 +7,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "air-formatter";
-  version = "0.7.1";
+  version = "0.8.0";

  src = fetchFromGitHub {
    owner = "posit-dev";
    repo = "air";
    tag = finalAttrs.version;
-    hash = "sha256-FGucu5emmBtxVloun7Kh+MWKZDYdKw+75L7g3GqQ7Tw=";
+    hash = "sha256-LNU//dQico54GhZdehynEuukfGuU8rQvfFO4zvRsZL0=";
  };

-  cargoHash = "sha256-+cksQnHNXGyqbu+CoGhCEmQux7zfLIt5K5rWABfppDo=";
+  cargoHash = "sha256-9HRDUTYzKLYuh9KCcnvPXB6gDKcht79TOZZ3ze9+gbg=";

  useNextest = true;

--- a/pkgs/by-name/al/all-the-package-names/package.nix
+++ b/pkgs/by-name/al/all-the-package-names/package.nix
@@ -7,16 +7,16 @@

 buildNpmPackage rec {
  pname = "all-the-package-names";
-  version = "2.0.2235";
+  version = "2.0.2241";

  src = fetchFromGitHub {
    owner = "nice-registry";
    repo = "all-the-package-names";
    tag = "v${version}";
-    hash = "sha256-I2E1V296tljsvtpfU5xlUkKNEeEZb4qtM1WDLXQZHbg=";
+    hash = "sha256-jiHYGxESaEKQ6g4Bz7fZNz24PFmF/PWKc3ySqZzFDa8=";
  };

-  npmDepsHash = "sha256-p1IBNK6dRBnEUEZ4bIMoGcVSPoecnKWgRtuUJTYW7q8=";
+  npmDepsHash = "sha256-KtfzWr8I0fmZfIgkVAohgd0UlJY1DeP6Q0n8e7YENrs=";

  passthru.updateScript = nix-update-script { };

--- a/pkgs/by-name/bl/blint/package.nix
+++ b/pkgs/by-name/bl/blint/package.nix
@@ -8,14 +8,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "blint";
-  version = "3.0.1";
+  version = "3.0.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "owasp-dep-scan";
    repo = "blint";
    tag = "v${version}";
-    hash = "sha256-E4hOTDYJzavWM0/YGclhddS0eZE9eJLQmeS4Fpbysic=";
+    hash = "sha256-ell0/opQso7/qD6d6i18vU55TfTgdcZwVFXD+yZg9/g=";
  };

  build-system = [
--- a/pkgs/by-name/ca/cargo-mobile2/package.nix
+++ b/pkgs/by-name/ca/cargo-mobile2/package.nix
@@ -10,7 +10,7 @@

 let
  pname = "cargo-mobile2";
-  version = "0.21.1";
+  version = "0.22.1";
 in
 rustPlatform.buildRustPackage {
  inherit pname version;
@@ -18,14 +18,14 @@ rustPlatform.buildRustPackage {
    owner = "tauri-apps";
    repo = "cargo-mobile2";
    rev = "cargo-mobile2-v${version}";
-    hash = "sha256-w95UAtAP11jaW4EqprGv+duBf81rLv8y7+Ej5SFeRAs=";
+    hash = "sha256-+U/uTbTGa3NPK5WpyvR5C5L1ozl+fa15pNNWYZJXgnk=";
  };

  # Manually specify the sourceRoot since this crate depends on other crates in the workspace. Relevant info at
  # https://discourse.nixos.org/t/difficulty-using-buildrustpackage-with-a-src-containing-multiple-cargo-workspaces/10202
  # sourceRoot = "${src.name}/tooling/cli";

-  cargoHash = "sha256-Aa4Iubl8l+tss0ClF93RqVUsB4Jg4/MQCeKSr/iY5tA=";
+  cargoHash = "sha256-fMtFvPrWMLHE4N9WJv6J4pqHbHPnNKhQWz5qEvB8jKQ=";

  preBuild = ''
    mkdir -p $out/share/
--- a/pkgs/by-name/ch/chezmoi/package.nix
+++ b/pkgs/by-name/ch/chezmoi/package.nix
@@ -7,16 +7,16 @@

 buildGo125Module (finalAttrs: {
  pname = "chezmoi";
-  version = "2.66.0";
+  version = "2.66.1";

  src = fetchFromGitHub {
    owner = "twpayne";
    repo = "chezmoi";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-r49KRq6PIB6gRnudY9HMm0UBjd07J6tUpA3oTOyJzGI=";
+    hash = "sha256-DwMkfS+D9o10Dk3jEzgkDcSoblbpoimN6RPV2iZTLcg=";
  };

-  vendorHash = "sha256-ioRFzkp4aSUdPq3NSKDj05DbTp6PwAjVkf7VtdpaI2w=";
+  vendorHash = "sha256-g9bzsmLKJ7pCmTnO8N9Um1FDBvQA0mqw14fwGYMb/K0=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/by-name/ch/chrome-pak-customizer/package.nix
+++ b/pkgs/by-name/ch/chrome-pak-customizer/package.nix
@@ -34,6 +34,11 @@ stdenv.mkDerivation {
    runHook postInstall
  '';

+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.8)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
  meta = {
    description = "Simple batch tool to customize pak files in chrome or chromium-based browser";
    homepage = "https://github.com/myfreeer/chrome-pak-customizer";
--- a/pkgs/by-name/cm/cmdstan/package.nix
+++ b/pkgs/by-name/cm/cmdstan/package.nix
@@ -12,14 +12,14 @@

 stdenv.mkDerivation rec {
  pname = "cmdstan";
-  version = "2.36.0";
+  version = "2.37.0";

  src = fetchFromGitHub {
    owner = "stan-dev";
    repo = "cmdstan";
    tag = "v${version}";
    fetchSubmodules = true;
-    hash = "sha256-9Dan86C0nxxxkIXaOSKExY0hngAgWTpL4RlI3rTnBZo=";
+    hash = "sha256-bKkzzFkMF8+Ufz/EdKLJdB290Fvc2t8b47xB8oPz/sk=";
  };

  postPatch = ''
--- a/pkgs/by-name/co/coroot-node-agent/package.nix
+++ b/pkgs/by-name/co/coroot-node-agent/package.nix
@@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "coroot-node-agent";
-  version = "1.26.3";
+  version = "1.26.4";

  src = fetchFromGitHub {
    owner = "coroot";
    repo = "coroot-node-agent";
    rev = "v${version}";
-    hash = "sha256-IdDH+jFVRbquM+9VkPw/Sb2dc6eajLpNsLlYkUEUNAo=";
+    hash = "sha256-bm3zMk44FNZ3vb9fP1Szbmi+0I1kOas0es8Cqu3yWeA=";
  };

  vendorHash = "sha256-LJq45IGXgYNx0Hky2w+O5Enwc5EvD79/cJRQ/iCythk=";
--- a/pkgs/by-name/do/do-agent/package.nix
+++ b/pkgs/by-name/do/do-agent/package.nix
@@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "do-agent";
-  version = "3.18.4";
+  version = "3.18.5";

  src = fetchFromGitHub {
    owner = "digitalocean";
    repo = "do-agent";
    rev = version;
-    sha256 = "sha256-Pn53zNp3D0NcEQqfiv4ZceLT2Pgvz7oZYZAhk2D1SCc=";
+    sha256 = "sha256-Wc0VqBiIAQGtORdm0paAm9vnbThc+5seHXmpnYcyNh8=";
  };

  ldflags = [
--- a/pkgs/by-name/dr/draupnir/hashes.json
+++ b/pkgs/by-name/dr/draupnir/hashes.json
@@ -1,3 +1,3 @@
 {
-  "yarn_offline_cache_hash": "sha256-jzBjZAqvEVGlk+5ii5s8aWvoYJKVBsh+RGcp63oim5Y="
+  "yarn_offline_cache_hash": "sha256-EZ8dVRfzAFr8wepLuS90YHvAi9BA+4etVz+Vji+bQVA="
 }
--- a/pkgs/by-name/dr/draupnir/package.json
+++ b/pkgs/by-name/dr/draupnir/package.json
@@ -1,6 +1,6 @@
 {
  "name": "draupnir",
-  "version": "2.7.0",
+  "version": "2.7.1",
  "description": "A moderation tool for Matrix",
  "main": "lib/index.js",
  "repository": "https://github.com/the-draupnir-project/Draupnir.git",
@@ -54,7 +54,7 @@
    "@sinclair/typebox": "0.34.13",
    "@the-draupnir-project/interface-manager": "4.2.5",
    "@the-draupnir-project/matrix-basic-types": "1.4.1",
-    "@the-draupnir-project/mps-interface-adaptor": "0.5.1",
+    "@the-draupnir-project/mps-interface-adaptor": "0.5.2",
    "better-sqlite3": "^9.4.3",
    "body-parser": "^1.20.2",
    "config": "^3.3.9",
@@ -65,7 +65,7 @@
    "matrix-appservice-bridge": "^10.3.1",
    "matrix-bot-sdk": "npm:@vector-im/matrix-bot-sdk@^0.7.1-element.6",
    "matrix-protection-suite": "npm:@gnuxie/matrix-protection-suite@4.1.0",
-    "matrix-protection-suite-for-matrix-bot-sdk": "npm:@gnuxie/matrix-protection-suite-for-matrix-bot-sdk@4.0.0",
+    "matrix-protection-suite-for-matrix-bot-sdk": "npm:@gnuxie/matrix-protection-suite-for-matrix-bot-sdk@4.0.2",
    "pg": "^8.8.0",
    "yaml": "^2.3.2"
  },
--- a/pkgs/by-name/dr/draupnir/package.nix
+++ b/pkgs/by-name/dr/draupnir/package.nix
@@ -22,13 +22,13 @@ let
 in
 mkYarnPackage rec {
  pname = "draupnir";
-  version = "2.7.0";
+  version = "2.7.1";

  src = fetchFromGitHub {
    owner = "the-draupnir-project";
    repo = "Draupnir";
    tag = "v${version}";
-    hash = "sha256-ZzwZg7sevX0qKnlZ4snCcwSejWqA6JHCx3e6vWucO8U=";
+    hash = "sha256-PJg+ybWe7mtLgqrBZP0xKeKWc2FPv7koyjsHyK5uRKs=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/dr/drawterm/package.nix
+++ b/pkgs/by-name/dr/drawterm/package.nix
@@ -22,13 +22,13 @@ let
 in
 stdenv.mkDerivation {
  pname = "drawterm";
-  version = "0-unstable-2025-09-11";
+  version = "0-unstable-2025-10-11";

  src = fetchFrom9Front {
    owner = "plan9front";
    repo = "drawterm";
-    rev = "7523180ec9e5210e28eb0191268066188cdf91ab";
-    hash = "sha256-IOZCpNXJcTpqCRsNp8aaP2vORvusLktLtyoQ7gykJB8=";
+    rev = "48d53278a8273bb39ca295e8f163563ab04b3530";
+    hash = "sha256-SReZ6A5xEpi0vL2bchVszRl3Dvm4Rw8e/5TQa+8TPto=";
  };

  enableParallelBuilding = true;
--- a/pkgs/by-name/en/ensemble-chorus/package.nix
+++ b/pkgs/by-name/en/ensemble-chorus/package.nix
@@ -47,6 +47,18 @@ stdenv.mkDerivation {
    libjack2
  ];

+  postPatch = ''
+    substituteInPlace CMakeLists.txt --replace-fail \
+      'cmake_minimum_required(VERSION "3.3")' \
+      'cmake_minimum_required(VERSION 4.0)'
+    substituteInPlace thirdparty/gsl-lite/CMakeLists.txt --replace-fail \
+      'cmake_minimum_required( VERSION 3.0 FATAL_ERROR )' \
+      'cmake_minimum_required(VERSION 4.0)'
+    substituteInPlace thirdparty/jsl/CMakeLists.txt --replace-fail \
+      'cmake_minimum_required(VERSION 3.3)' \
+      'cmake_minimum_required(VERSION 4.0)'
+  '';
+
  meta = with lib; {
    homepage = "https://github.com/jpcima/ensemble-chorus";
    description = "Digital model of electronic string ensemble chorus";
--- a/pkgs/by-name/ex/exoscale-cli/package.nix
+++ b/pkgs/by-name/ex/exoscale-cli/package.nix
@@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "exoscale-cli";
-  version = "1.85.4";
+  version = "1.86.0";

  src = fetchFromGitHub {
    owner = "exoscale";
    repo = "cli";
    rev = "v${version}";
-    sha256 = "sha256-rulleAbiwnUABnHLpfHFjGXK3/DxFJLmse3NIClSpMQ=";
+    sha256 = "sha256-AlpCTeopNfaN4IeumaEFTZNrBfIJH2RbfVoZaFRCy2Y=";
  };

  vendorHash = null;
--- a/pkgs/by-name/fl/flopoco/package.nix
+++ b/pkgs/by-name/fl/flopoco/package.nix
@@ -74,6 +74,10 @@ stdenv.mkDerivation {
    ./flopoco BuildAutocomplete
  '';

+  cmakeFlags = [
+    (lib.cmakeFeature "CMAKE_POLICY_VERSION_MINIMUM" "3.5")
+  ];
+
  installPhase = ''
    runHook preInstall

--- a/pkgs/by-name/gc/gcsfuse/package.nix
+++ b/pkgs/by-name/gc/gcsfuse/package.nix
@@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "gcsfuse";
-  version = "3.4.0";
+  version = "3.4.1";

  src = fetchFromGitHub {
    owner = "googlecloudplatform";
    repo = "gcsfuse";
    rev = "v${version}";
-    hash = "sha256-PdYHsHIlq77QnsjD1z3KliW3JHLZ0M26I4Z7v0SuvlU=";
+    hash = "sha256-KB7iq92U5NIchC3Lj2q2eesYLlKa1zee0rUPU81xb5k=";
  };

-  vendorHash = "sha256-w5EOHPOJLfINILrP3ipZwYUAcAJIlGw1HlVAUAzW3x4=";
+  vendorHash = "sha256-BirzhmYwFSs2poA5tNOlK2bDO71mCkgSck7fE9la2wA=";

  subPackages = [
    "."
--- a/pkgs/by-name/hc/hcloud/package.nix
+++ b/pkgs/by-name/hc/hcloud/package.nix
@@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "hcloud";
-  version = "1.54.0";
+  version = "1.55.0";

  src = fetchFromGitHub {
    owner = "hetznercloud";
    repo = "cli";
    tag = "v${version}";
-    hash = "sha256-PpCEdhEjfd7d8DdU2ABAjL8O98cLR20xWwhcESJK4uI=";
+    hash = "sha256-4UPZ3SCKTjmSt6mm0zHwecVq3UtR+cSkQmNdbkq/dMY=";
  };

-  vendorHash = "sha256-tJwd/qLs0QvnjKi0B2NBTosGt7qCzJCHxZ5LYJB4vjA=";
+  vendorHash = "sha256-heCGRW8yT/aTrh4PKj62P8EPT7mXVDMo9Z8pIypOT6o=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/hd/hdrmerge/package.nix
+++ b/pkgs/by-name/hd/hdrmerge/package.nix
@@ -15,14 +15,20 @@

 stdenv.mkDerivation rec {
  pname = "hdrmerge";
-  version = "0.5.0-unstable-2024-08-02";
+  version = "0.5.0-unstable-2025-04-26";
  src = fetchFromGitHub {
    owner = "jcelaya";
    repo = "hdrmerge";
-    rev = "e2a46f97498b321b232cc7f145461212677200f1";
-    hash = "sha256-471gJtF9M36pAId9POG8ZIpNk9H/157EdHqXSAPlhN0=";
+    rev = "3bbe43771ba15b899151721bc14aa57e86b60f2f";
+    hash = "sha256-4FIGchwROXe8qLRBaYih2k9zDll2YoYGDj06SrIqK9Q=";
  };

+  # Disable find_package(ALGLIB REQUIRED) in the CMake file by providing a empty
+  # FindALGLIB.cmake, and provide ALGLIB_INCLUDES and ALGLIB_LIBRARIES ourselves
+  preConfigure = ''
+    touch cmake/FindALGLIB.cmake
+  '';
+
  nativeBuildInputs = [
    cmake
    pkg-config
@@ -39,12 +45,8 @@ stdenv.mkDerivation rec {
  ];

  cmakeFlags = [
-    "-DALGLIB_DIR:PATH=${alglib}"
-  ];
-
-  CXXFLAGS = [
-    # GCC 13: error: 'uint32_t' does not name a type
-    "-include cstdint"
+    (lib.cmakeFeature "ALGLIB_INCLUDES" "${alglib}/include/alglib")
+    (lib.cmakeFeature "ALGLIB_LIBRARIES" "alglib3")
  ];

  desktopItems = [
--- a/pkgs/by-name/hy/hyprland-qtutils/package.nix
+++ b/pkgs/by-name/hy/hyprland-qtutils/package.nix
@@ -2,6 +2,7 @@
  lib,
  stdenv,
  fetchFromGitHub,
+  fetchpatch,
  cmake,
  pkg-config,
  hyprutils,
@@ -23,6 +24,15 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-bTYedtQFqqVBAh42scgX7+S3O6XKLnT6FTC6rpmyCCc=";
  };

+  patches = [
+    # this should be removed in the next release
+    (fetchpatch {
+      name = "Fix build with Qt 6.10";
+      url = "https://github.com/hyprwm/hyprland-qtutils/commit/5ffdfc13ed03df1dae5084468d935f0a3f2c9a4c.patch";
+      hash = "sha256-5nVj4AFJpmazX9o9tQD6mzBW9KtRYov4yRbGpUwFcgc=";
+    })
+  ];
+
  nativeBuildInputs = [
    cmake
    pkg-config
--- a/pkgs/by-name/in/infrastructure-agent/package.nix
+++ b/pkgs/by-name/in/infrastructure-agent/package.nix
@@ -6,13 +6,13 @@
 }:
 buildGoModule rec {
  pname = "infrastructure-agent";
-  version = "1.69.0";
+  version = "1.70.0";

  src = fetchFromGitHub {
    owner = "newrelic";
    repo = "infrastructure-agent";
    rev = version;
-    hash = "sha256-6yoHx1fVDaJZsQKFSfOCau/BrB6zcT52yrLbPp8ZiKQ=";
+    hash = "sha256-VdBcVFDtPajmAAQe2aZONf0/pCMf98gtR9zoeqL1aKQ=";
  };

  vendorHash = "sha256-KBzckYxiQ4/nhm7ZfGQDGi5uN652oZgdc9i0UexMr24=";
--- a/pkgs/by-name/ja/jami/package.nix
+++ b/pkgs/by-name/ja/jami/package.nix
@@ -3,8 +3,10 @@
  lib,
  pkg-config,
  fetchFromGitLab,
+  fetchpatch,
  gitUpdater,
  ffmpeg_6,
+  ninja,

  # for daemon
  autoreconfHook,
@@ -12,7 +14,7 @@
  alsa-lib,
  asio,
  dbus,
-  sdbus-cpp,
+  sdbus-cpp_2,
  fmt,
  gmp,
  gnutls,
@@ -62,25 +64,32 @@

 stdenv.mkDerivation rec {
  pname = "jami";
-  version = "20250718.0";
+  version = "20251003.0";

  src = fetchFromGitLab {
    domain = "git.jami.net";
    owner = "savoirfairelinux";
    repo = "jami-client-qt";
    rev = "stable/${version}";
-    hash = "sha256-EEiuymfu28bJ6pfBKwlsCGDq7XlKGZYK+2WjPJ+tcxw=";
+    hash = "sha256-CYKrIWGTmGvHIhNdyEhDKE1Rm84O7X3yPVLkF6qakwU=";
    fetchSubmodules = true;
  };

+  patches = [
+    (fetchpatch {
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/jami-qt/-/raw/0ecbaf3b101bbdd0d4a06b06f3ce1ff654abf0b5/fix-link.patch";
+      hash = "sha256-VsQbOPHyNFcRhpae+9UCaUJdHH8bMGf3ZIAW3RKiu6k=";
+    })
+  ];
+
  pjsip-jami = pjsip.overrideAttrs (old: {
-    version = "sfl-2.15-unstable-2025-02-24";
+    version = "sfl-2.15-unstable-2025-09-18";

    src = fetchFromGitHub {
      owner = "savoirfairelinux";
      repo = "pjproject";
-      rev = "37130c943d59f25a71935803ea2d84515074a237";
-      hash = "sha256-7gAiriuooqqF38oajAuD/Lj5trn/9VMkCGOumcV45NA=";
+      rev = "93dc96918bb6ba74e1e1d00c40c80402e856f2ac";
+      hash = "sha256-wsbKa3TXqj+nQMtAaEAD0Zh248QdNMhKnIOnq08MPI0=";
    };

    configureFlags = [
@@ -118,14 +127,14 @@ stdenv.mkDerivation rec {

  dhtnet = stdenv.mkDerivation {
    pname = "dhtnet";
-    version = "unstable-2025-05-26";
+    version = "unstable-2025-09-15";

    src = fetchFromGitLab {
      domain = "git.jami.net";
      owner = "savoirfairelinux";
      repo = "dhtnet";
-      rev = "6c5ee3a21556d668d047cdedb5c4b746c3c6bdb2";
-      hash = "sha256-uweYSEysVMUC7DhI9BhS1TDZ6ZY7WQ9JS3ZF9lKA4Fo=";
+      rev = "7861b4620b4cec5fa34c5d1bb2b304912730f638";
+      hash = "sha256-nhGB4u12Ubmc7lLVOAwycRsP+cWzn4A9bYH0+sSBQTg=";
    };

    postPatch = ''
@@ -177,12 +186,6 @@ stdenv.mkDerivation rec {
    inherit src version meta;
    sourceRoot = "${src.name}/daemon";

-    # Fix for libgit2 breaking changes
-    postPatch = ''
-      substituteInPlace src/jamidht/conversationrepository.cpp \
-        --replace-fail "git_commit* const" "const git_commit*"
-    '';
-
    nativeBuildInputs = [
      autoreconfHook
      pkg-config
@@ -194,7 +197,7 @@ stdenv.mkDerivation rec {
      asio
      dbus
      dhtnet
-      sdbus-cpp
+      sdbus-cpp_2
      fmt
      ffmpeg_6
      gmp
@@ -233,7 +236,6 @@ stdenv.mkDerivation rec {

  postPatch = ''
    sed -i -e '/GIT_REPOSITORY/,+1c SOURCE_DIR ''${CMAKE_CURRENT_SOURCE_DIR}/qwindowkit' extras/build/cmake/contrib_tools.cmake
-    sed -i -e 's/if(DISTRO_NEEDS_QMSETUP_PATCH)/if(TRUE)/' CMakeLists.txt
    cp -R --no-preserve=mode,ownership ${qwindowkit-src} qwindowkit
    substituteInPlace CMakeLists.txt \
      --replace-fail 'add_subdirectory(3rdparty/zxing-cpp EXCLUDE_FROM_ALL)' 'find_package(ZXing)'
@@ -257,6 +259,7 @@ stdenv.mkDerivation rec {
    git
    python3
    qt6Packages.qttools # for translations
+    ninja
  ];

  buildInputs = [
@@ -284,7 +287,11 @@ stdenv.mkDerivation rec {
    ++ lib.optionals withWebengine [ qtwebengine ]
  );

-  cmakeFlags = lib.optionals (!withWebengine) [ "-DWITH_WEBENGINE=false" ];
+  cmakeFlags = [
+    (lib.cmakeBool "JAMICORE_AS_SUBDIR" false)
+    (lib.cmakeBool "DWITH_WEBENGINE" withWebengine)
+    "-DLIBJAMI_INCLUDE_DIRS=${daemon}/include/jami"
+  ];

  qtWrapperArgs = [
    # With wayland the titlebar is not themed and the wmclass is wrong.
@@ -295,7 +302,10 @@ stdenv.mkDerivation rec {
    qtWrapperArgs+=("''${gappsWrapperArgs[@]}")
  '';

-  passthru.updateScript = gitUpdater { rev-prefix = "stable/"; };
+  passthru = {
+    updateScript = gitUpdater { rev-prefix = "stable/"; };
+    inherit daemon pjsip dhtnet;
+  };

  meta = with lib; {
    homepage = "https://jami.net/";
--- a/pkgs/by-name/je/jenkins/package.nix
+++ b/pkgs/by-name/je/jenkins/package.nix
@@ -18,11 +18,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "jenkins";
-  version = "2.516.3";
+  version = "2.528.1";

  src = fetchurl {
    url = "https://get.jenkins.io/war-stable/${finalAttrs.version}/jenkins.war";
-    hash = "sha256-gbOrzA8kzqSOdO/+FS9p3F8NiA7cDCc3xhRGs8WZLAA=";
+    hash = "sha256-1jDcomX3Wo1YHxJ6kjTxZ51LCACo83DQOtShVM63KVs=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/by-name/jf/jfbview/package.nix
+++ b/pkgs/by-name/jf/jfbview/package.nix
@@ -53,6 +53,11 @@ stdenv.mkDerivation (finalAttrs: {
  nativeInstallCheckInputs = [ versionCheckHook ];
  doInstallCheck = true;

+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 3.2)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
  passthru.updateScript = nix-update-script { };

  meta = {
--- a/pkgs/by-name/ju/juju/package.nix
+++ b/pkgs/by-name/ju/juju/package.nix
@@ -9,16 +9,16 @@

 buildGoModule rec {
  pname = "juju";
-  version = "3.6.10";
+  version = "3.6.11";

  src = fetchFromGitHub {
    owner = "juju";
    repo = "juju";
    rev = "v${version}";
-    hash = "sha256-J3AFH6kg+M6/8posiUaVP4biQpKPQ07Qp5BU3prAG/A=";
+    hash = "sha256-jeRA2HwXJt1FLQrUsE/OrpeRib5VRbNk84FTHCBeHiM=";
  };

-  vendorHash = "sha256-zTavqjEH4maEMj+AuYMcjT289peVNIc0rysBnnMxFNU=";
+  vendorHash = "sha256-pa6NOoC4OakJdKB2cWtQVoEt2UX/xv8mDOHmlDSk8Z8=";

  subPackages = [
    "cmd/juju"
--- a/pkgs/by-name/ka/kafkactl/package.nix
+++ b/pkgs/by-name/ka/kafkactl/package.nix
@@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "kafkactl";
-  version = "5.13.0";
+  version = "5.14.0";

  src = fetchFromGitHub {
    owner = "deviceinsight";
    repo = "kafkactl";
    tag = "v${version}";
-    hash = "sha256-YJpRXCTI0Mwi4Zxeex8oxgzElk7l8Qus75lR42/wSww=";
+    hash = "sha256-WBycrpte3LSwAAjeD+gHXLEz9Y7075Ryip58fIGdJ8Q=";
  };

  vendorHash = "sha256-sVvEHMXpjas+l93IZfAChDX5eDm0lkUNCr5r1JaVQ9I=";
--- a/pkgs/by-name/ke/keyoxide-cli/package.nix
+++ b/pkgs/by-name/ke/keyoxide-cli/package.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitea,
+  fetchYarnDeps,
+  yarnConfigHook,
+  yarnBuildHook,
+  yarnInstallHook,
+  nodejs,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "keyoxide-cli";
+  version = "0.4.4";
+
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "keyoxide";
+    repo = "keyoxide-cli";
+    tag = finalAttrs.version;
+    hash = "sha256-lQEvtqFq3OBlXdYdrhMsAns4kimR2RfRx3VFNy4nEu8=";
+  };
+
+  yarnOfflineCache = fetchYarnDeps {
+    inherit (finalAttrs) src;
+    hash = "sha256-UxP5NkmA3MsrXhoa+JviDdW19HKE6Xpj1dkN7h0ggck=";
+  };
+
+  yarnBuildScript = "prettier";
+  yarnBuildFlags = "src/commands.js";
+
+  nativeBuildInputs = [
+    yarnConfigHook
+    yarnBuildHook
+    yarnInstallHook
+    # Needed for executing package.json scripts
+    nodejs
+  ];
+
+  meta = {
+    changelog = "https://codeberg.org/keyoxide/keyoxide-cli/releases/tag/${finalAttrs.version}";
+    description = "Command-line interface to locally verify decentralized identities";
+    homepage = "https://codeberg.org/keyoxide/keyoxide-cli";
+    license = lib.licenses.agpl3Plus;
+    maintainers = [ lib.maintainers.pyrox0 ];
+    mainProgram = "keyoxide";
+  };
+})
--- a/pkgs/by-name/kn/knightos-genkfs/package.nix
+++ b/pkgs/by-name/kn/knightos-genkfs/package.nix
@@ -28,6 +28,11 @@ stdenv.mkDerivation rec {

  hardeningDisable = [ "format" ];

+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.8.5)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
  meta = with lib; {
    homepage = "https://knightos.org/";
    description = "Utility to write a KFS filesystem into a ROM file";
--- a/pkgs/by-name/kn/knightos-kcc/package.nix
+++ b/pkgs/by-name/kn/knightos-kcc/package.nix
@@ -30,6 +30,11 @@ stdenv.mkDerivation rec {

  buildInputs = [ boost ];

+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.8.5)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
  meta = with lib; {
    homepage = "https://github.com/KnightOS/kcc";
    description = "KnightOS C compiler";
--- a/pkgs/by-name/kn/knightos-kimg/package.nix
+++ b/pkgs/by-name/kn/knightos-kimg/package.nix
@@ -28,6 +28,11 @@ stdenv.mkDerivation rec {

  hardeningDisable = [ "format" ];

+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.8.5)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
  meta = with lib; {
    homepage = "https://knightos.org/";
    description = "Converts image formats supported by stb_image to the KnightOS image format";
--- a/pkgs/by-name/kn/knightos-kpack/package.nix
+++ b/pkgs/by-name/kn/knightos-kpack/package.nix
@@ -29,6 +29,11 @@ stdenv.mkDerivation rec {

  hardeningDisable = [ "fortify" ];

+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.8.5)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
  meta = with lib; {
    homepage = "https://knightos.org/";
    description = "Tool to create or extract KnightOS packages";
--- a/pkgs/by-name/kn/knightos-mktiupgrade/package.nix
+++ b/pkgs/by-name/kn/knightos-mktiupgrade/package.nix
@@ -28,6 +28,11 @@ stdenv.mkDerivation rec {

  hardeningDisable = [ "format" ];

+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.8.5)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
  meta = with lib; {
    homepage = "https://knightos.org/";
    description = "Makes TI calculator upgrade files from ROM dumps";
--- a/pkgs/by-name/kn/knightos-patchrom/package.nix
+++ b/pkgs/by-name/kn/knightos-patchrom/package.nix
@@ -29,6 +29,11 @@ stdenv.mkDerivation rec {

  hardeningDisable = [ "format" ];

+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.8.5)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
  meta = with lib; {
    homepage = "https://knightos.org/";
    description = "Patches jumptables into TI calculator ROM files and generates an include file";
--- a/pkgs/by-name/kn/knightos-scas/package.nix
+++ b/pkgs/by-name/kn/knightos-scas/package.nix
@@ -26,7 +26,8 @@ stdenv.mkDerivation rec {
  cmakeFlags = [ "-DSCAS_LIBRARY=1" ];
  postPatch = ''
    substituteInPlace CMakeLists.txt \
-      --replace "TARGETS scas scdump scwrap" "TARGETS scas scdump scwrap generate_tables"
+      --replace-fail "TARGETS scas scdump scwrap" "TARGETS scas scdump scwrap generate_tables" \
+      --replace-fail "cmake_minimum_required(VERSION 2.8.5)" "cmake_minimum_required(VERSION 3.10)"
  '';
  strictDeps = true;

--- a/pkgs/by-name/kn/knightos-z80e/package.nix
+++ b/pkgs/by-name/kn/knightos-z80e/package.nix
@@ -29,6 +29,15 @@ stdenv.mkDerivation rec {

  cmakeFlags = [ "-Denable-sdl=YES" ];

+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.8.5)" "cmake_minimum_required(VERSION 3.10)"
+    substituteInPlace libz80e/CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.8)" "cmake_minimum_required(VERSION 3.10)"
+    substituteInPlace frontends/libz80e/CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.8)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
  meta = with lib; {
    homepage = "https://knightos.org/";
    description = "Z80 calculator emulator and debugger";
--- a/pkgs/by-name/li/libcmatrix/package.nix
+++ b/pkgs/by-name/li/libcmatrix/package.nix
@@ -17,14 +17,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libcmatrix";
-  version = "0.0.3";
+  version = "0.0.4";

  src = fetchFromGitLab {
    domain = "source.puri.sm";
    owner = "Librem5";
    repo = "libcmatrix";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Usaqkb6zClVtYCL1VUv4iNeKs2GZECO9sOdPk3N8iLM=";
+    hash = "sha256-MyjgxOJmaDylPA2AENZPR+dfh2UN1H93ZOLMlycEmTw=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/li/litmusctl/package.nix
+++ b/pkgs/by-name/li/litmusctl/package.nix
@@ -9,7 +9,7 @@

 buildGoModule rec {
  pname = "litmusctl";
-  version = "1.18.0";
+  version = "1.19.0";

  nativeBuildInputs = [
    installShellFiles
@@ -23,7 +23,7 @@ buildGoModule rec {
    owner = "litmuschaos";
    repo = "litmusctl";
    rev = "${version}";
-    hash = "sha256-lfR4Nk9n6mpfQVrVoI2iaCYkJelgGi5QLdZN9n0qPVQ=";
+    hash = "sha256-0fHkUKU1MwvPuM+20dH7W/GFdhzY+avgCufpKEDnPZQ=";
  };

  vendorHash = "sha256-7FYOQ89aUFPX+5NCPYKg+YGCXstQ6j9DK4V2mCgklu0=";
--- a/pkgs/by-name/lo/loco/package.nix
+++ b/pkgs/by-name/lo/loco/package.nix
@@ -6,14 +6,14 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "loco";
-  version = "0.16.2";
+  version = "0.16.3";

  src = fetchCrate {
    inherit pname version;
-    hash = "sha256-yctOGUfKd1zaIArtHESYEr1q79ZrJqL7H6bvpAFrE+8=";
+    hash = "sha256-DdrLABMiTutIhUHvUw29DYZIT+YHLNJjoTT5kWMeAkU=";
  };

-  cargoHash = "sha256-IdYicJ7ZIoVOQU91S8yIPYGeY+DaeAMztGOmriTGW38=";
+  cargoHash = "sha256-01IQxfeOzxOHqRovmNV3q/ZSdESWi7Gb6F7o51Rbkw4=";

  #Skip trycmd integration tests
  checkFlags = [ "--skip=cli_tests" ];
--- a/pkgs/by-name/mt/mtail/package.nix
+++ b/pkgs/by-name/mt/mtail/package.nix
@@ -8,13 +8,13 @@

 buildGoModule rec {
  pname = "mtail";
-  version = "3.2.20";
+  version = "3.2.21";

  src = fetchFromGitHub {
    owner = "jaqx0r";
    repo = "mtail";
    rev = "v${version}";
-    hash = "sha256-w895q6J0o4a4y3YwGWyu5tpv7ow9RNWEFQVIMDJo43Y=";
+    hash = "sha256-i5c9e7b7PmvFdNddngsCIx4GKYqPPwTZSUoNAIL8RZ4=";
  };

  vendorHash = "sha256-hVguLf/EkTz7Z8lTT9tCQ8iGO5asSkrsW+u8D1ND+dw=";
--- a/pkgs/by-name/ol/ollama/package.nix
+++ b/pkgs/by-name/ol/ollama/package.nix
@@ -118,13 +118,13 @@ in
 goBuild (finalAttrs: {
  pname = "ollama";
  # don't forget to invalidate all hashes each update
-  version = "0.12.5";
+  version = "0.12.6";

  src = fetchFromGitHub {
    owner = "ollama";
    repo = "ollama";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-X5xxM53DfN8EW29hfJiAeADKLvKdmdNYE2NBa05T82k=";
+    hash = "sha256-Ttwcpg2bgz7D8IqPRTNeZUQFA/HsGc8gCOiXRs7onBg=";
  };

  vendorHash = "sha256-SlaDsu001TUW+t9WRp7LqxUSQSGDF1Lqu9M1bgILoX4=";
--- a/pkgs/by-name/op/opendht/package.nix
+++ b/pkgs/by-name/op/opendht/package.nix
@@ -22,13 +22,13 @@

 stdenv.mkDerivation rec {
  pname = "opendht";
-  version = "3.4.0";
+  version = "3.5.4";

  src = fetchFromGitHub {
    owner = "savoirfairelinux";
    repo = "opendht";
    tag = "v${version}";
-    hash = "sha256-WNN4aCZiJuz9CgEKIzFmy50HBj0ZL/d1uU7L518lPhk=";
+    hash = "sha256-mnnd6yATIk/TEuFG/M98d+pfeh42IKWBBYjkTP52xeM=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/pa/pagsuite/package.nix
+++ b/pkgs/by-name/pa/pagsuite/package.nix
@@ -1,38 +1,26 @@
 {
  lib,
  stdenv,
-  fetchurl,
-  fetchpatch,
+  fetchFromGitLab,
  cmake,
-  unzip,
  gmp,
  scalp,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
  pname = "pagsuite";
-  version = "1.80";
+  version = "1.80-unstable-2025-05-03";

-  src = fetchurl {
-    url = "https://gitlab.com/kumm/pagsuite/-/raw/master/releases/pagsuite_${
-      lib.replaceStrings [ "." ] [ "_" ] version
-    }.zip";
-    hash = "sha256-TYd+dleVPWEWU9Cb3XExd7ixJZyiUAp9QLtorYJSIbQ=";
+  src = fetchFromGitLab {
+    domain = "gitlab.com";
+    owner = "kumm";
+    repo = "pagsuite";
+    rev = "1cc657765658cb2eb622d4a9c656ab9854150e7d";
+    hash = "sha256-jyp3h5n6SkyTpLzqMezvu2nri6rDkX3ACcCO9r4/bBA=";
  };

-  patches = [
-    # Fix issue with latest ScaLP update
-    (fetchpatch {
-      url = "https://gitlab.com/kumm/pagsuite/-/commit/cae9f78bec93a7f197461358f2f796f6b5778781.patch";
-      hash = "sha256-12IisS6oGYLRicORTemHB7bw9EB9cuQjxG8f6X0WMrU=";
-    })
-  ];
-
-  sourceRoot = "pagsuite_${lib.replaceStrings [ "." ] [ "_" ] version}";
-
  nativeBuildInputs = [
    cmake
-    unzip
  ];

  buildInputs = [
@@ -40,6 +28,9 @@ stdenv.mkDerivation rec {
    scalp
  ];

+  # make[2]: ***  No rule to make target 'lib/libpag.dylib', needed by 'bin/osr'.  Stop.
+  enableParallelBuilding = false;
+
  meta = with lib; {
    description = "Optimization tools for the (P)MCM problem";
    homepage = "https://gitlab.com/kumm/pagsuite";
--- a/pkgs/by-name/po/pocketbase/package.nix
+++ b/pkgs/by-name/po/pocketbase/package.nix
@@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "pocketbase";
-  version = "0.30.2";
+  version = "0.30.4";

  src = fetchFromGitHub {
    owner = "pocketbase";
    repo = "pocketbase";
    rev = "v${version}";
-    hash = "sha256-7XpusTwdocLsJBHWU71nHMmY0T05d4fKHe5XKvHSPR0=";
+    hash = "sha256-n2xBwonQOEk2LVQePxdO/PraM75FFDmOqZ9fIL2xd+I=";
  };

-  vendorHash = "sha256-ft+hs1VfCZrWceVDqO7ThRE1tiyozMFsYMclsKKdEBo=";
+  vendorHash = "sha256-Zo0b0MTIRpLGPIg288ROFPIdHfMzZdFLbFZPAffWPxU=";

  # This is the released subpackage from upstream repo
  subPackages = [ "examples/base" ];
--- a/pkgs/by-name/pr/projectm-sdl-cpp/package.nix
+++ b/pkgs/by-name/pr/projectm-sdl-cpp/package.nix
@@ -14,13 +14,13 @@

 stdenv.mkDerivation {
  pname = "projectm-sdl-cpp";
-  version = "0-unstable-2025-10-08";
+  version = "0-unstable-2025-10-17";

  src = fetchFromGitHub {
    owner = "projectM-visualizer";
    repo = "frontend-sdl-cpp";
-    rev = "7131af0618e4d7f4b64c623ad92795fef5a2d87a";
-    hash = "sha256-pXQGMwjOh7LjDuUPbXp5l9O4aSWqnTxdZSMtDzZ8118=";
+    rev = "72e5632897c9d9bef452c679d3cbe8c7b4bb4157";
+    hash = "sha256-uO2+CX2DqVn6NdcZhBlKFIPuUQpz6N8LazG3ALJTSx0=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/re/reaper-go/package.nix
+++ b/pkgs/by-name/re/reaper-go/package.nix
@@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "reaper-go";
-  version = "0.2.3";
+  version = "0.2.5";

  src = fetchFromGitHub {
    owner = "ghostsecurity";
    repo = "reaper";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-NXRqKO76RoxEvR7slMmUDdesRFMxDJpX/IGxoTDwJVU=";
+    hash = "sha256-3kTGlGvuTSB3KOeQvhF/pNaWVU153qGqqskJd+G6FF4=";
  };

-  vendorHash = "sha256-PxZ+fx5wkYuggMfpTfkc8quSssCzXdIcwjdR4qhDbqE=";
+  vendorHash = "sha256-T9qTfGRLhlYrezraRRztZC2Kw4L6Fap1YQgQdnlxKhE=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/re/reindeer/package.nix
+++ b/pkgs/by-name/re/reindeer/package.nix
@@ -9,13 +9,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "reindeer";
-  version = "2025.10.13.00";
+  version = "2025.10.20.00";

  src = fetchFromGitHub {
    owner = "facebookincubator";
    repo = "reindeer";
    tag = "v${version}";
-    hash = "sha256-jbxTHu8IoUsQMkH2u82T6XsRKto7Z3ehEOAL9v0WGxE=";
+    hash = "sha256-SHJIDFhK5y+XxOS76pbSXW8Hr1Y5g0uhSw4km5usIsM=";
  };

  cargoHash = "sha256-XTp0GaqJhNf6auZzdv0+aGgIJ6hh3027EqPr90nWB3I=";
--- a/pkgs/by-name/rq/rqlite/package.nix
+++ b/pkgs/by-name/rq/rqlite/package.nix
@@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "rqlite";
-  version = "9.1.2";
+  version = "9.1.3";

  src = fetchFromGitHub {
    owner = "rqlite";
    repo = "rqlite";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-7QAJofhssL2N5szD4j9rcv830sEnMyrS2Mg4s4G33HI=";
+    hash = "sha256-BybfZio4SSlpTbNHWfiA/2lVcNXhKWaBNTEoCSDxMSE=";
  };

-  vendorHash = "sha256-zGAC7yDccfhZ+2WeiN9DAsOFTa3j4ymPxeFNwam7+Ts=";
+  vendorHash = "sha256-bkAlZT0bntSdVwioEaqBK7XObGwJuIG7tfF7XOr3lKQ=";

  subPackages = [
    "cmd/rqlite"
--- a/pkgs/by-name/sc/scalp/package.nix
+++ b/pkgs/by-name/sc/scalp/package.nix
@@ -25,6 +25,7 @@ stdenv.mkDerivation rec {

  postPatch = ''
    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required (VERSION 3.3.2)" "cmake_minimum_required (VERSION 3.5)" \
      --replace-fail "\''$ORIGIN" "\''${CMAKE_INSTALL_PREFIX}/lib" \
      --replace-fail "-m64" ""
    substituteInPlace src/tests/CMakeLists.txt \
--- a/pkgs/by-name/sh/sharpsat-td/package.nix
+++ b/pkgs/by-name/sh/sharpsat-td/package.nix
@@ -48,6 +48,9 @@ stdenv.mkDerivation {
    # replace bundled version of mpreal/mpfrc++
    rm -r src/mpfr
    cp -r ${mpreal} src/mpfr
+
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required (VERSION 2.8)" "cmake_minimum_required(VERSION 3.10)"
  '';

  nativeBuildInputs = [ cmake ];
--- a/pkgs/by-name/si/sigsum/package.nix
+++ b/pkgs/by-name/si/sigsum/package.nix
@@ -0,0 +1,51 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitLab,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "sigsum";
+  version = "0.11.2";
+
+  src = fetchFromGitLab {
+    domain = "git.glasklar.is";
+    group = "sigsum";
+    owner = "core";
+    repo = "sigsum-go";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-oaYquy0N8yHfKLoNEv8Vte3dpp/UQFZ74mZHin8dDzw=";
+  };
+
+  postPatch = ''
+    substituteInPlace internal/version/version.go \
+      --replace-fail "info.Main.Version" '"${finalAttrs.version}"'
+  '';
+
+  vendorHash = "sha256-8Tyhd13PRTO2dGOdhkgYmwsVzWfqwOpZ9XSsAtiCcyM=";
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  excludedPackages = [ "./test" ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgram = "${placeholder "out"}/bin/sigsum-key";
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "System for public and transparent logging of signed checksums";
+    homepage = "https://www.sigsum.org/";
+    downloadPage = "https://git.glasklar.is/sigsum/core/sigsum-go";
+    changelog = "https://git.glasklar.is/sigsum/core/sigsum-go/-/blob/v${finalAttrs.version}/NEWS";
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ defelo ];
+  };
+})
--- a/pkgs/by-name/so/sofia_sip/2001-sofia-sip-Disable-some-tests.patch
+++ b/pkgs/by-name/so/sofia_sip/2001-sofia-sip-Disable-some-tests.patch
@@ -0,0 +1,109 @@
+diff --git a/libsofia-sip-ua-glib/su-glib/Makefile.am b/libsofia-sip-ua-glib/su-glib/Makefile.am
+index 6f54d34..c5bfd82 100644
+--- a/libsofia-sip-ua-glib/su-glib/Makefile.am
+++ b/libsofia-sip-ua-glib/su-glib/Makefile.am
+@@ -20,12 +20,12 @@ AM_CPPFLAGS =		-I$(S_BASE)/su -I$(B_BASE)/su $(GLIB_CFLAGS) \
+ 
+ noinst_LTLIBRARIES = 	libsu-glib.la
+ 
+-check_PROGRAMS = 	su_source_test torture_su_glib_timer
+check_PROGRAMS =
+ 
+ # ----------------------------------------------------------------------
+ # Tests
+ 
+-TESTS = 		su_source_test torture_su_glib_timer
+TESTS =
+ 
+ # ----------------------------------------------------------------------
+ # Rules for building the targets
+diff --git a/libsofia-sip-ua/nta/Makefile.am b/libsofia-sip-ua/nta/Makefile.am
+index c450fd1..4f322c3 100644
+--- a/libsofia-sip-ua/nta/Makefile.am
+++ b/libsofia-sip-ua/nta/Makefile.am
+@@ -26,9 +26,9 @@ AM_CPPFLAGS = 		-I$(srcdir)/../ipt -I../ipt \
+ noinst_LTLIBRARIES = 	libnta.la
+ 
+ check_PROGRAMS = 	check_nta test_nta_api test_nta portbind
+-dist_noinst_SCRIPTS =	run_test_nta_api run_test_nta
+dist_noinst_SCRIPTS =	run_test_nta_api
+ 
+-TESTS =			run_check_nta run_test_nta_api run_test_nta
+TESTS =			run_test_nta_api
+ 
+ TESTS_ENVIRONMENT =	$(SHELL)
+ 
+diff --git a/libsofia-sip-ua/nua/Makefile.am b/libsofia-sip-ua/nua/Makefile.am
+index 6b6dfaa..73ffd70 100644
+--- a/libsofia-sip-ua/nua/Makefile.am
+++ b/libsofia-sip-ua/nua/Makefile.am
+@@ -17,8 +17,8 @@ check_PROGRAMS =
+ TESTS =
+ 
+ if HAVE_CHECK
+-check_PROGRAMS +=	check_nua
+-TESTS += 		check_nua
+check_PROGRAMS +=
+TESTS +=
+ endif
+ 
+ # ----------------------------------------------------------------------
+diff --git a/libsofia-sip-ua/su/Makefile.am b/libsofia-sip-ua/su/Makefile.am
+index db3a331..0a31c72 100644
+--- a/libsofia-sip-ua/su/Makefile.am
+++ b/libsofia-sip-ua/su/Makefile.am
+@@ -20,7 +20,7 @@ check_PROGRAMS = 	torture_su torture_su_port \
+ 			torture_su_alloc torture_su_time torture_su_tag \
+ 			test_htable test_htable2 torture_rbtree torture_heap \
+ 			test_memmem torture_su_bm \
+-			torture_su_root torture_su_timer \
+			torture_su_timer \
+ 			test_su su_proxy test_poll $(OSXPROGS)
+ 
+ # ----------------------------------------------------------------------
+@@ -30,8 +30,8 @@ TESTS = 		torture_su torture_su_port \
+ 			torture_su_alloc torture_su_time torture_su_tag \
+ 			test_htable test_htable2 torture_rbtree torture_heap \
+ 			test_memmem torture_su_bm \
+-			torture_su_root torture_su_timer \
+-			run_addrinfo run_localinfo run_test_su \
+			torture_su_timer \
+			run_localinfo run_test_su \
+ 			$(OSXTESTS)
+ 
+ # ----------------------------------------------------------------------
+@@ -98,7 +98,7 @@ LDADD = 		libsu.la
+ # Install and distribution rules
+ 
+ EXTRA_DIST += 		su.docs \
+-			run_addrinfo run_localinfo run_test_su
+			run_localinfo run_test_su
+ 
+ dist_pkgdata_SCRIPTS = 	tag_dll.awk
+ 
+diff --git a/tests/Makefile.am b/tests/Makefile.am
+index cabc2b5..0184017 100644
+--- a/tests/Makefile.am
+++ b/tests/Makefile.am
+@@ -5,8 +5,8 @@
+ # Contact: Pekka Pessi <pekka.pessi@nokia.com>
+ # Licensed under LGPL. See file COPYING.
+ 
+-TESTS = test_nua
+-check_PROGRAMS = test_nua
+TESTS =
+check_PROGRAMS =
+ 
+ EXTRA_DIST = check_sofia.h check_sofia.c suite_for_nua.c
+ 
+@@ -33,8 +33,8 @@ libtestproxy_a_SOURCES = test_proxy.h test_proxy.c
+ libtestnat_a_SOURCES =	test_nat.h test_nat.c test_nat_tags.c
+ 
+ if HAVE_CHECK
+-TESTS += check_dlopen_sofia check_sofia
+-check_PROGRAMS += check_dlopen_sofia check_sofia
+TESTS += check_dlopen_sofia
+check_PROGRAMS += check_dlopen_sofia
+ endif
+ 
+ check_sofia_CFLAGS = @CHECK_CFLAGS@
--- a/pkgs/by-name/so/sofia_sip/package.nix
+++ b/pkgs/by-name/so/sofia_sip/package.nix
@@ -3,45 +3,109 @@
  stdenv,
  fetchFromGitHub,
  fetchpatch2,
+  gitUpdater,
+  testers,
+  autoconf,
+  automake,
+  check,
  glib,
+  libtool,
  openssl,
  pkg-config,
-  autoreconfHook,
+  valgrind,
+  zlib,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "sofia-sip";
  version = "1.13.17";

  src = fetchFromGitHub {
    owner = "freeswitch";
    repo = "sofia-sip";
-    rev = "v${version}";
-    sha256 = "sha256-7QmK2UxEO5lC0KBDWB3bwKTy0Nc7WrdTLjoQYzezoaY=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-7QmK2UxEO5lC0KBDWB3bwKTy0Nc7WrdTLjoQYzezoaY=";
  };

  patches = [
    # Fix build with gcc 14 from https://github.com/freeswitch/sofia-sip/pull/249
    (fetchpatch2 {
      name = "sofia-sip-fix-incompatible-pointer-type.patch";
-      url = "https://github.com/freeswitch/sofia-sip/commit/46b02f0655af0a9594e805f09a8ee99278f84777.diff";
-      hash = "sha256-4uZVtKnXG+BPW8byjd7tu4uEZo9SYq9EzTEvMwG0Bak=";
+      url = "https://github.com/freeswitch/sofia-sip/commit/46b02f0655af0a9594e805f09a8ee99278f84777.patch?full_index=1";
+      hash = "sha256-bZzjg7GBxR2wSlPH81krZRCK43OirGLWH/lrLRZ0L0k=";
    })
+
+    # Disable some failing tests
+    # https://github.com/freeswitch/sofia-sip/issues/234
+    # run_addrinfo: Fails due to limited networking during build
+    # torture_su_root: Aborts with: bit out of range 0 - FD_SETSIZE on fd_set
+    # run_check_nta: Times out in client_2_1_1 test, which seems to test some connection protocol fallback thing
+    # run_test_nta: "no valid IPv6 addresses available", likely due to no networking in sandbox
+    # check_nua, check_sofia, test_nua: Times out no matter how much time is given to it
+    ./2001-sofia-sip-Disable-some-tests.patch
+  ];
+
+  # This actually breaks these tests, leading to bash trying to execute itself
+  # https://github.com/freeswitch/sofia-sip/issues/234
+  postPatch = ''
+    substituteInPlace libsofia-sip-ua/nta/Makefile.am \
+      --replace-fail 'TESTS_ENVIRONMENT =' '#TESTS_ENVIRONMENT ='
+  '';
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    autoconf
+    automake
+    libtool
+    pkg-config
  ];

  buildInputs = [
    glib
    openssl
  ];
-  nativeBuildInputs = [
-    autoreconfHook
-    pkg-config
+
+  nativeCheckInputs = [
+    valgrind
  ];

-  meta = with lib; {
+  checkInputs = [
+    check
+    zlib
+  ];
+
+  preConfigure = ''
+    ./bootstrap.sh
+  '';
+
+  configureFlags = [
+    (lib.strings.enableFeature true "expensive-checks")
+  ];
+
+  enableParallelBuilding = true;
+
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+
+  passthru = {
+    tests.pkg-config = testers.hasPkgConfigModules {
+      package = finalAttrs.finalPackage;
+      versionCheck = true;
+    };
+    updateScript = gitUpdater {
+      rev-prefix = "v";
+    };
+  };
+
+  meta = {
    description = "Open-source SIP User-Agent library, compliant with the IETF RFC3261 specification";
    homepage = "https://github.com/freeswitch/sofia-sip";
-    platforms = platforms.unix;
-    license = licenses.lgpl2;
+    platforms = lib.platforms.unix;
+    license = lib.licenses.lgpl2Plus;
+    teams = [ lib.teams.ngi ];
+    pkgConfigModules = [
+      "sofia-sip-ua"
+      "sofia-sip-ua-glib"
+    ];
  };
-}
+})
--- a/pkgs/by-name/st/stanc/package.nix
+++ b/pkgs/by-name/st/stanc/package.nix
@@ -6,7 +6,7 @@

 ocamlPackages.buildDunePackage rec {
  pname = "stanc";
-  version = "2.36.0";
+  version = "2.37.0";

  minimalOCamlVersion = "4.12";
  duneVersion = "3";
@@ -14,8 +14,8 @@ ocamlPackages.buildDunePackage rec {
  src = fetchFromGitHub {
    owner = "stan-dev";
    repo = "stanc3";
-    rev = "v${version}";
-    hash = "sha256-IrpHV00Fn3Nxail4Xgv/8ezclKpyVuQa1F34kF07wwA=";
+    tag = "v${version}";
+    hash = "sha256-d+sInQfnlT1gLbtIRPD+LUZgIdl519OrfvgSNYdYeII=";
  };

  nativeBuildInputs = with ocamlPackages; [ menhir ];
@@ -26,6 +26,7 @@ ocamlPackages.buildDunePackage rec {
    ppx_deriving
    fmt
    yojson
+    cmdliner
  ];

  meta = with lib; {
--- a/pkgs/by-name/sy/syft/package.nix
+++ b/pkgs/by-name/sy/syft/package.nix
@@ -8,13 +8,13 @@

 buildGoModule rec {
  pname = "syft";
-  version = "1.34.0";
+  version = "1.34.2";

  src = fetchFromGitHub {
    owner = "anchore";
    repo = "syft";
    tag = "v${version}";
-    hash = "sha256-J9ia5VjEItwDS2YjKAGAuQTTig5IIQA70yBYM/2r4B4=";
+    hash = "sha256-1RdJpjUVenmfx6dIme97f1N4zAWFt5Z25IfIjZLIAPI=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
--- a/pkgs/by-name/te/teamspeak6-client/package.nix
+++ b/pkgs/by-name/te/teamspeak6-client/package.nix
@@ -22,6 +22,7 @@
  libxkbcommon,
  libgbm,
  nss,
+  pipewire,
  udev,
  libGL,
  xorg,
@@ -29,11 +30,11 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "teamspeak6-client";
-  version = "6.0.0-beta2";
+  version = "6.0.0-beta3.1";

  src = fetchurl {
    url = "https://files.teamspeak-services.com/pre_releases/client/${finalAttrs.version}/teamspeak-client.tar.gz";
-    hash = "sha256-3jNPv3uQ2RztR1p4XQNLUg5IVrvW/dcdtqXdiGJKVSs=";
+    hash = "sha256-CWKyn49DSWgrkJyYcPwKUz2PBykvFQc1f7G/yvrHbWU=";
  };

  sourceRoot = ".";
@@ -55,6 +56,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    libxkbcommon
    libgbm
    nss
+    pipewire
    xorg.libX11
    xorg.libXScrnSaver
    xorg.libXdamage
@@ -102,6 +104,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
          udev
          libGL
          libpulseaudio
+          pipewire
        ]
      }"

--- a/pkgs/by-name/te/telegraf/package.nix
+++ b/pkgs/by-name/te/telegraf/package.nix
@@ -10,7 +10,7 @@

 buildGoModule rec {
  pname = "telegraf";
-  version = "1.36.2";
+  version = "1.36.3";

  subPackages = [ "cmd/telegraf" ];

@@ -18,10 +18,10 @@ buildGoModule rec {
    owner = "influxdata";
    repo = "telegraf";
    rev = "v${version}";
-    hash = "sha256-nIYAGsGYZUK5o1KqcH4bI3wPRRXCynN6N5T6f2oy2bo=";
+    hash = "sha256-aEMvBKDE+fbjXyvi3MkbV1/Bu0q4F7W7DPwTRUcWY8M=";
  };

-  vendorHash = "sha256-k4hI/qIQgV1qChOWDCqWcMboaVoDe3k/DP/wNa0Aqg4=";
+  vendorHash = "sha256-BofW6hvcpQb1OWTbfoS+o2RJg4N0zMqid1ergeVh/wM=";
  proxyVendor = true;

  ldflags = [
--- a/pkgs/by-name/tx/txtpbfmt/package.nix
+++ b/pkgs/by-name/tx/txtpbfmt/package.nix
@@ -7,13 +7,13 @@

 buildGoModule {
  pname = "txtpbfmt";
-  version = "0-unstable-2025-10-15";
+  version = "0-unstable-2025-10-16";

  src = fetchFromGitHub {
    owner = "protocolbuffers";
    repo = "txtpbfmt";
-    rev = "0b0c2708cf8453209ac9864099a502d5d1723ee4";
-    hash = "sha256-d6fT98Po7c+ZIwn3UG4JlsLRVjurnE0htrCUzM9sxGk=";
+    rev = "16587c79cd916daf09ade0a7d72e6a5de7c81f81";
+    hash = "sha256-3rzsw6CvN8mzjRM8OCDNvVquQNx+82NPeHizNOF+g54=";
  };

  vendorHash = "sha256-aeYa7a/oKH2dxXHRkkqyh7f04citRDGQxAaKQTJst4o=";
--- a/pkgs/by-name/un/unciv/package.nix
+++ b/pkgs/by-name/un/unciv/package.nix
@@ -12,7 +12,7 @@
  nix-update-script,
 }:
 let
-  version = "4.18.6";
+  version = "4.18.7";

  desktopItem = makeDesktopItem {
    name = "unciv";
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "https://github.com/yairm210/Unciv/releases/download/${version}/Unciv.jar";
-    hash = "sha256-UKm5lJ378AZ016To5eC6EpFFNfbINCeHZdUyv+MN0X4=";
+    hash = "sha256-bZzF8WUDw2rrF8Qi6PKBA9F5EUDZGwgXegcHDFgQxJY=";
  };

  dontUnpack = true;
--- a/pkgs/by-name/wa/wait4x/package.nix
+++ b/pkgs/by-name/wa/wait4x/package.nix
@@ -5,7 +5,7 @@
 }:
 let
  pname = "wait4x";
-  version = "3.5.1";
+  version = "3.6.0";
 in
 buildGoModule {
  inherit pname version;
@@ -14,10 +14,10 @@ buildGoModule {
    owner = "wait4x";
    repo = "wait4x";
    rev = "v${version}";
-    hash = "sha256-VAt61k2eHQwyLSsvbWxe7jJ/Wyj4U4O2+LzCsoP/Yq4=";
+    hash = "sha256-RiF5tcnzMteXaYmw4mfQdamwV1PAyNC8pUownJzfACs=";
  };

-  vendorHash = "sha256-KJOKLTjwwgu2MFNIRDk8eeSVnZyjO9dfVyWrF5vqj9g=";
+  vendorHash = "sha256-fa3XEqLkzriMFYea3bv4FzaKgK2FsGwn5IQG48vh7+M=";

  # Tests make network access
  doCheck = false;
--- a/pkgs/by-name/wa/wasmtime/package.nix
+++ b/pkgs/by-name/wa/wasmtime/package.nix
@@ -13,20 +13,20 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "wasmtime";
-  version = "37.0.2";
+  version = "38.0.1";

  src = fetchFromGitHub {
    owner = "bytecodealliance";
    repo = "wasmtime";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-OQyGcxWMOxxzBHyOg2LUVsFuBEow6NIJCfrnsYWZtzk=";
+    hash = "sha256-Arb4wUIJx3OyE8wbshotpy5Br7ZHHA7zXP98uGm/gyo=";
    fetchSubmodules = true;
  };

  # Disable cargo-auditable until https://github.com/rust-secure-code/cargo-auditable/issues/124 is solved.
  auditable = false;

-  cargoHash = "sha256-PXvhwnfGvGF4D6U+2dKp3wg6cbk/i+0bWRAMSkyd6i8=";
+  cargoHash = "sha256-ZF+uaMjhBMdLPp8TP4DnPB23igOE92YuhQ1US65NNRk=";
  cargoBuildFlags = [
    "--package"
    "wasmtime-cli"
--- a/pkgs/by-name/x2/x265/package.nix
+++ b/pkgs/by-name/x2/x265/package.nix
@@ -120,6 +120,13 @@ stdenv.mkDerivation rec {
    (mkFlag vtuneSupport "ENABLE_VTUNE")
    (mkFlag werrorSupport "WARNINGS_AS_ERRORS")
  ]
+  ++ lib.optionals stdenv.hostPlatform.isPower [
+    # baseline for everything but ppc64le doesn't have AltiVec
+    # ppc64le: https://bitbucket.org/multicoreware/x265_git/issues/320/fail-to-build-on-power8-le
+    (lib.cmakeBool "ENABLE_ALTIVEC" false)
+    # baseline for everything but ppc64le is pre-POWER8
+    (lib.cmakeBool "CPU_POWER8" (stdenv.hostPlatform.isPower64 && stdenv.hostPlatform.isLittleEndian))
+  ]
  # Clang does not support the endfunc directive so use GCC.
  ++ lib.optional (
    stdenv.cc.isClang && !stdenv.targetPlatform.isDarwin && !stdenv.targetPlatform.isFreeBSD
@@ -137,9 +144,6 @@ stdenv.mkDerivation rec {
    "-DENABLE_SHARED=OFF"
    "-DEXPORT_C_API=OFF"
  ]
-  ++ lib.optionals stdenv.hostPlatform.isPower [
-    "-DENABLE_ALTIVEC=OFF" # https://bitbucket.org/multicoreware/x265_git/issues/320/fail-to-build-on-power8-le
-  ]
  ++ lib.optionals isCross [
    (mkFlag stdenv.hostPlatform.isAarch32 "CROSS_COMPILE_ARM")
    (mkFlag stdenv.hostPlatform.isAarch64 "CROSS_COMPILE_ARM64")
--- a/pkgs/by-name/xv/xv/package.nix
+++ b/pkgs/by-name/xv/xv/package.nix
@@ -7,7 +7,9 @@
  libpng,
  libwebp,
  libtiff,
+  libjpeg,
  jasper,
+  libxrandr,
 }:

 stdenv.mkDerivation rec {
@@ -28,7 +30,9 @@ stdenv.mkDerivation rec {
    libpng
    libwebp
    libtiff
+    libjpeg
    jasper
+    libxrandr
  ];

  meta = {
--- a/pkgs/by-name/ya/yamlfmt/package.nix
+++ b/pkgs/by-name/ya/yamlfmt/package.nix
@@ -7,13 +7,13 @@

 buildGoModule (finalAttrs: {
  pname = "yamlfmt";
-  version = "0.18.0";
+  version = "0.19.0";

  src = fetchFromGitHub {
    owner = "google";
    repo = "yamlfmt";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-ifrRqa6GRwzwr9ORsmvDaLmznDp3KVtFyEzaG3EqEhY=";
+    hash = "sha256-SIjWBXhi5uy34KySxMCTrTDdXXvtVCWWj4LhYcXq5MU=";
    leaveDotGit = true;
    postFetch = ''
      git -C "$out" rev-parse --short HEAD > "$out/.git_head"
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -78,6 +78,7 @@
      && !isAarch32
      && !hostPlatform.isLoongArch64
      && !hostPlatform.isRiscV
+      && !(hostPlatform.isPower && hostPlatform.isBigEndian)
      && hostPlatform == buildPlatform
    ), # dynamically linked Nvidia code
  withFlite ? withFullDeps, # Voice Synthesis
@@ -798,6 +799,25 @@ stdenv.mkDerivation (
      (enableFeature withExtraWarnings "extra-warnings")
      (enableFeature withStripping "stripping")
    ]
+    ++ optionals (stdenv.hostPlatform.isPower) [
+      # FFmpeg expects us to pass `--cpu=` to pick a specific feature set to compile for. If unset, it defaults to `generic`.
+      # For POWER, the default doesn't produce baseline-compliant settings. Passing a baseline-like CPU as a target doesn't
+      # produce entirely correct settings either - POWER4 leaves AltiVec enabled, but that's only guaranteed with POWER6.
+      # Just configure together everything on our own.
+
+      # Easy: Only ppc64le's baseline is recent enough to guarantee all of these.
+      (enableFeature (stdenv.hostPlatform.isPower64 && stdenv.hostPlatform.isLittleEndian) "altivec")
+      (enableFeature (stdenv.hostPlatform.isPower64 && stdenv.hostPlatform.isLittleEndian) "vsx")
+      (enableFeature (stdenv.hostPlatform.isPower64 && stdenv.hostPlatform.isLittleEndian) "power8")
+      (enableFeature (stdenv.hostPlatform.isPower64 && stdenv.hostPlatform.isLittleEndian) "ldbrx")
+
+      # Instructions that are highly specific to that series of 32-bit embedded CPUs. Never try to enable them.
+      (enableFeature false "ppc4xx")
+
+      # I *think* enabling this on 64-bit POWER is correct? Struggling to find much info on when/where this was introduced.
+      # Definitely present on the Apple G5, and likely Freescale e5500/e6500 as well.
+      (enableFeature (stdenv.hostPlatform.isPower64) "dcbzl")
+    ]
    ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
      "--cross-prefix=${stdenv.cc.targetPrefix}"
      "--enable-cross-compile"
--- a/pkgs/development/node-packages/aliases.nix
+++ b/pkgs/development/node-packages/aliases.nix
@@ -146,6 +146,7 @@ mapAliases {
  inherit (pkgs) javascript-typescript-langserver; # added 2023-08-19
  inherit (pkgs) kaput-cli; # added 2024-12-03
  karma = pkgs.karma-runner; # added 2023-07-29
+  keyoxide = pkgs.keyoxide-cli; # Added 2025-10-20
  leetcode-cli = self.vsc-leetcode-cli; # added 2023-08-31
  inherit (pkgs) lerna; # added 2025-02-12
  less = pkgs.lessc; # added 2024-06-15
--- a/pkgs/development/node-packages/node-packages.json
+++ b/pkgs/development/node-packages/node-packages.json
@@ -96,7 +96,6 @@
 , "jsonlint"
 , "jsonplaceholder"
 , "katex"
-, "keyoxide"
 , "lcov-result-merger"
 , "live-server"
 , "livedown"
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
--- a/pkgs/development/node-packages/overrides.nix
+++ b/pkgs/development/node-packages/overrides.nix
@@ -111,15 +111,6 @@ final: prev: {
    '';
  };

-  keyoxide = prev.keyoxide.override {
-    nativeBuildInputs = [ pkgs.pkg-config ];
-    buildInputs = with pkgs; [
-      pixman
-      cairo
-      pango
-    ];
-  };
-
  makam = prev.makam.override {
    nativeBuildInputs = [ pkgs.buildPackages.makeWrapper ];
    postFixup = ''
--- a/pkgs/development/python-modules/bring-api/default.nix
+++ b/pkgs/development/python-modules/bring-api/default.nix
@@ -9,7 +9,6 @@
  pytest-asyncio,
  pytestCheckHook,
  python-dotenv,
-  pythonOlder,
  setuptools,
  syrupy,
  yarl,
@@ -17,16 +16,14 @@

 buildPythonPackage rec {
  pname = "bring-api";
-  version = "1.1.0";
+  version = "1.1.1";
  pyproject = true;

-  disabled = pythonOlder "3.11";
-
  src = fetchFromGitHub {
    owner = "miaucl";
    repo = "bring-api";
    tag = version;
-    hash = "sha256-OxY9G7zy5VSpTOARoManJNvMg6ghIK0KJunanSgXKm0=";
+    hash = "sha256-BslU1ekbQIZh1f1zRYXbZdbOepB2+NWIuWZI4L/oxSg=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/chromadb/default.nix
+++ b/pkgs/development/python-modules/chromadb/default.nix
@@ -67,20 +67,19 @@

 buildPythonPackage rec {
  pname = "chromadb";
-  version = "1.1.1";
+  version = "1.2.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "chroma-core";
    repo = "chroma";
    tag = version;
-    hash = "sha256-WFN4z+LQwqy6bd59yWlglpXFqNZPEd3jcgeWhdphxYM=";
+    hash = "sha256-xEXW88iV9lqDOGrnoH0ZsoGMajATShA9HC+G79EdS9s=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit src;
-    name = "${pname}-${version}-vendor";
-    hash = "sha256-LZXtAt4rP0rKaleMht1eFPdqgE8nu5NdLzhWBW69WW8=";
+    inherit pname version src;
+    hash = "sha256-GlF8Fp42ra5d55PIGOS4zOHXPSaIZGI/l8sHz/wyDgo=";
  };

  # Can't use fetchFromGitHub as the build expects a zipfile
--- a/pkgs/development/python-modules/clarifai/default.nix
+++ b/pkgs/development/python-modules/clarifai/default.nix
@@ -32,7 +32,7 @@

 buildPythonPackage rec {
  pname = "clarifai";
-  version = "11.8.3";
+  version = "11.8.5";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -41,7 +41,7 @@ buildPythonPackage rec {
    owner = "Clarifai";
    repo = "clarifai-python";
    tag = version;
-    hash = "sha256-sl9x8VqGGgUfPSRZiMP6edLeUUTpASp8kdRLl0Kxclc=";
+    hash = "sha256-c0lCbkHOIbzgaVLyGfJ8mbgtePTpv+PbsmErI4ZuLq4=";
  };

  pythonRelaxDeps = [
--- a/pkgs/development/python-modules/cmdstanpy/default.nix
+++ b/pkgs/development/python-modules/cmdstanpy/default.nix
@@ -16,14 +16,14 @@

 buildPythonPackage rec {
  pname = "cmdstanpy";
-  version = "1.2.5";
+  version = "1.3.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "stan-dev";
    repo = "cmdstanpy";
    tag = "v${version}";
-    hash = "sha256-/MiWawB1Y4/eMBHXQLjd+P+Pe8EtsLbGFrzQa1RNf6g=";
+    hash = "sha256-XVviGdJ41mcjCscL3jvcpHi6zMREHsuShGHpnMQX6V8=";
  };

  patches = [
--- a/pkgs/development/python-modules/fast-array-utils/default.nix
+++ b/pkgs/development/python-modules/fast-array-utils/default.nix
@@ -18,14 +18,14 @@

 buildPythonPackage rec {
  pname = "fast-array-utils";
-  version = "1.2.4";
+  version = "1.2.5";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "scverse";
    repo = "fast-array-utils";
    tag = "v${version}";
-    hash = "sha256-R8pOID9Lws29OCMWb7RZNDsWakEYDf7bya6iSXp8Ips=";
+    hash = "sha256-iJcnmCh0AssbUEJg62cKURu1afHQiS/cZhYmGsZQM9I=";
  };

  # hatch-min-requirements tries to talk to PyPI by default. See https://github.com/tlambert03/hatch-min-requirements?tab=readme-ov-file#environment-variables.
--- a/pkgs/development/python-modules/grpclib/default.nix
+++ b/pkgs/development/python-modules/grpclib/default.nix
@@ -1,10 +1,10 @@
 {
  lib,
-  async-timeout,
  buildPythonPackage,
  certifi,
  faker,
  fetchFromGitHub,
+  fetchpatch,
  googleapis-common-protos,
  h2,
  multidict,
@@ -28,6 +28,15 @@ buildPythonPackage rec {
    hash = "sha256-Z+DMwGMUxNTQ7ABd4q/FgMHEZ/NCOtst+6QfQJm3jVU=";
  };

+  patches = [
+    # https://github.com/vmagamedov/grpclib/pull/209
+    (fetchpatch {
+      name = "replace-async-timeout-with-asyncio-timeout-patch";
+      url = "https://github.com/vmagamedov/grpclib/commit/36b23ce3ca3f1742e39b50f939d13cd08b4f28ac.patch";
+      hash = "sha256-3ztLBOFpTK8CFIp8a6suhWXY5kIBCBRWBX/oAyYU4yI=";
+    })
+  ];
+
  build-system = [ setuptools ];

  dependencies = [
@@ -38,7 +47,6 @@ buildPythonPackage rec {
  nativeCheckInputs = [
    pytestCheckHook
    pytest-asyncio_0
-    async-timeout
    faker
    googleapis-common-protos
    certifi
--- a/pkgs/development/python-modules/json-repair/default.nix
+++ b/pkgs/development/python-modules/json-repair/default.nix
@@ -8,14 +8,14 @@

 buildPythonPackage rec {
  pname = "json-repair";
-  version = "0.52.0";
+  version = "0.52.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "mangiucugna";
    repo = "json_repair";
    tag = "v${version}";
-    hash = "sha256-RK5VycwcI6EhFkejbSwr96iF12O22nIGQzbOIlo/Mhk=";
+    hash = "sha256-NYW2PJ329c8EYfQrRl1mi+leUR7Afz2J0N9HVD1xyT0=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/jupyter-server/default.nix
+++ b/pkgs/development/python-modules/jupyter-server/default.nix
@@ -111,6 +111,8 @@ buildPythonPackage rec {
    "test_delete"
    # Insufficient access privileges for operation
    "test_regression_is_hidden"
+    # Fails under load (which causes failure on Hydra)
+    "test_execution_state"
  ]
  ++ lib.optionals stdenv.hostPlatform.isLinux [
    # Failed: DID NOT RAISE <class 'tornado.web.HTTPError'>
@@ -120,7 +122,6 @@ buildPythonPackage rec {
    # TypeError: the JSON object must be str, bytes or bytearray, not NoneType
    "test_terminal_create_with_cwd"
    # Fails under load (which causes failure on Hydra)
-    "test_execution_state"
    "test_cull_connected"
  ];

--- a/pkgs/development/python-modules/llm/default.nix
+++ b/pkgs/development/python-modules/llm/default.nix
@@ -228,6 +228,17 @@ let
      "tests/"
    ];

+    disabledTests = [
+      # AssertionError: The following responses are mocked but not requested:
+      # - Match POST request on https://api.openai.com/v1/chat/completions
+      # https://github.com/simonw/llm/issues/1292
+      "test_gpt4o_mini_sync_and_async"
+
+      # TypeError: CliRunner.__init__() got an unexpected keyword argument 'mix_stderr
+      # https://github.com/simonw/llm/issues/1293
+      "test_embed_multi_files_encoding"
+    ];
+
    pythonImportsCheck = [ "llm" ];

    passthru = {
--- a/pkgs/development/python-modules/mindsdb-evaluator/default.nix
+++ b/pkgs/development/python-modules/mindsdb-evaluator/default.nix
@@ -1,34 +1,34 @@
 {
  lib,
  buildPythonPackage,
-  fetchPypi,
-  pythonOlder,
+  fetchFromGitHub,
  poetry-core,
  dataprep-ml,
  numpy,
  pandas,
  scikit-learn,
  type-infer,
+  pytestCheckHook,
 }:

 buildPythonPackage rec {
  pname = "mindsdb-evaluator";
-  version = "0.0.18";
+  version = "0.0.20";
  pyproject = true;

-  disabled = pythonOlder "3.8";
-
-  # using PyPI as git repository does not have release tags or branches
-  src = fetchPypi {
-    pname = "mindsdb_evaluator";
-    inherit version;
-    hash = "sha256-UGg7P/OKmRi70z2roRBsA95FAXm7CG+TdPzTRy7+p4w=";
+  src = fetchFromGitHub {
+    owner = "mindsdb";
+    repo = "mindsdb_evaluator";
+    tag = "v${version}";
+    hash = "sha256-ZeJABMbyRdGrZGkWWXcjleOeDQBSicGR06hZAPUKvgI=";
  };

  build-system = [ poetry-core ];

  pythonRelaxDeps = [
+    "dataprep-ml"
    "numpy"
+    "scikit-learn"
  ];

  dependencies = [
@@ -41,10 +41,15 @@ buildPythonPackage rec {

  pythonImportsCheck = [ "mindsdb_evaluator" ];

-  meta = with lib; {
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  meta = {
+    changelog = "https://github.com/mindsdb/mindsdb_evaluator/releases/tag/${src.tag}";
    description = "Model evaluation for Machine Learning pipelines";
-    homepage = "https://pypi.org/project/mindsdb-evaluator/";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ mbalatsko ];
+    homepage = "https://github.com/mindsdb/mindsdb_evaluator";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ mbalatsko ];
  };
 }
--- a/pkgs/development/python-modules/niworkflows/default.nix
+++ b/pkgs/development/python-modules/niworkflows/default.nix
@@ -40,14 +40,14 @@

 buildPythonPackage rec {
  pname = "niworkflows";
-  version = "1.14.2";
+  version = "1.14.3";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "nipreps";
    repo = "niworkflows";
    tag = version;
-    hash = "sha256-LzzbletoZdI9HuaBWhFB6IGs1nX6ZItNP6cWlw5m5EE=";
+    hash = "sha256-wdPHXVgMvd+Od3M2j7S43gBRSh4yiPeu+HM6EyiakwU=";
  };

  pythonRelaxDeps = [ "traits" ];
--- a/pkgs/development/python-modules/pglast/default.nix
+++ b/pkgs/development/python-modules/pglast/default.nix
@@ -10,14 +10,14 @@

 buildPythonPackage rec {
  pname = "pglast";
-  version = "7.7";
+  version = "7.8";
  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-Xfv8H6OYGWQ6O5FaE2aOQ7vWwLAUqt9dC0MJ6GC6y7A=";
+    hash = "sha256-2tSZKS3dXK6236Q1sox4wpCAgkQ91eqr0RZWMmY/Fz8=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/pip-system-certs/default.nix
+++ b/pkgs/development/python-modules/pip-system-certs/default.nix
@@ -9,13 +9,13 @@

 buildPythonPackage rec {
  pname = "pip-system-certs";
-  version = "5.2";
+  version = "5.3";
  pyproject = true;

  src = fetchPypi {
    inherit version;
    pname = "pip_system_certs";
-    hash = "sha256-gLd2tc8XGRv5nTE2mbf84v24Tre7siX9E0EJqCcGQG8=";
+    hash = "sha256-Gci/mVe8zn1pxNvC0LLvE94ZhNU/UKWQEubbutCvZ8Y=";
  };

  build-system = [
--- a/pkgs/development/python-modules/prophet/default.nix
+++ b/pkgs/development/python-modules/prophet/default.nix
@@ -21,7 +21,7 @@

 buildPythonPackage rec {
  pname = "prophet";
-  version = "1.1.7";
+  version = "1.2.0";
  pyproject = true;

  disabled = pythonOlder "3.7";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
    owner = "facebook";
    repo = "prophet";
    tag = "v${version}";
-    hash = "sha256-94hxpfpZN3yvDUu+kM7Oc2Yu8+z0Gv6zqYRAwKXgHk4=";
+    hash = "sha256-SCd/PhchLbkb63HEEmRlfX2VruLo2jpweRkidgqNzE8=";
  };

  sourceRoot = "${src.name}/python";
--- a/pkgs/development/python-modules/pylitterbot/default.nix
+++ b/pkgs/development/python-modules/pylitterbot/default.nix
@@ -12,21 +12,18 @@
  pytest-aiohttp,
  pytest-freezegun,
  pytestCheckHook,
-  pythonOlder,
 }:

 buildPythonPackage rec {
  pname = "pylitterbot";
-  version = "2024.2.4";
+  version = "2024.2.6";
  pyproject = true;

-  disabled = pythonOlder "3.10";
-
  src = fetchFromGitHub {
    owner = "natekspencer";
    repo = "pylitterbot";
    tag = "v${version}";
-    hash = "sha256-/GN2b4rlE6j60O5ZxH8I58qwcZewAYJu0EHwQ7mrdBY=";
+    hash = "sha256-oQuEo0np+e+HfsQoWbv84BNpxNJQO3ZjocaCfllqkts=";
  };

  pythonRelaxDeps = [ "deepdiff" ];
@@ -52,11 +49,11 @@ buildPythonPackage rec {

  pythonImportsCheck = [ "pylitterbot" ];

-  meta = with lib; {
+  meta = {
    description = "Modulefor controlling a Litter-Robot";
    homepage = "https://github.com/natekspencer/pylitterbot";
    changelog = "https://github.com/natekspencer/pylitterbot/releases/tag/${src.tag}";
-    license = with licenses; [ mit ];
-    maintainers = with maintainers; [ fab ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
  };
 }
--- a/pkgs/development/python-modules/pyportainer/default.nix
+++ b/pkgs/development/python-modules/pyportainer/default.nix
@@ -15,14 +15,14 @@

 buildPythonPackage rec {
  pname = "pyportainer";
-  version = "1.0.3";
+  version = "1.0.4";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "erwindouna";
    repo = "pyportainer";
    tag = "v${version}";
-    hash = "sha256-Y/O2lhsjkSEKQL7HhdmlzMjY1597uuUOFfI05aLiBXg=";
+    hash = "sha256-jEUVAbNwBil5k6eNtuzspMvXDhFXktopwl/YCvnK2ko=";
  };

  build-system = [ poetry-core ];
--- a/pkgs/development/python-modules/pytensor/default.nix
+++ b/pkgs/development/python-modules/pytensor/default.nix
@@ -33,7 +33,7 @@

 buildPythonPackage rec {
  pname = "pytensor";
-  version = "2.35.0";
+  version = "2.35.1";
  pyproject = true;

  src = fetchFromGitHub {
@@ -43,7 +43,7 @@ buildPythonPackage rec {
    postFetch = ''
      sed -i 's/git_refnames = "[^"]*"/git_refnames = " (tag: ${src.tag})"/' $out/pytensor/_version.py
    '';
-    hash = "sha256-xQ9qFQhVSxdCB+jsfcxy04HySl7Mq0lGd4cg9bTxU5E=";
+    hash = "sha256-5+yMZysK69g+3uYrP12WK3ngpAYn8XrHoVjLqjvbobg=";
  };

  build-system = [
@@ -173,7 +173,7 @@ buildPythonPackage rec {
    description = "Python library to define, optimize, and efficiently evaluate mathematical expressions involving multi-dimensional arrays";
    mainProgram = "pytensor-cache";
    homepage = "https://github.com/pymc-devs/pytensor";
-    changelog = "https://github.com/pymc-devs/pytensor/releases/tag/rel-${src.tag}";
+    changelog = "https://github.com/pymc-devs/pytensor/releases/tag/${src.tag}";
    license = lib.licenses.bsd3;
    maintainers = with lib.maintainers; [
      bcdarwin
--- a/pkgs/development/python-modules/python-bring-api/default.nix
+++ b/pkgs/development/python-modules/python-bring-api/default.nix
@@ -1,40 +0,0 @@
-{
-  lib,
-  aiohttp,
-  buildPythonPackage,
-  fetchFromGitHub,
-  pythonOlder,
-  setuptools,
-}:
-
-buildPythonPackage {
-  pname = "python-bring-api";
-  version = "3.0.0-unstable-2024-02-03";
-  pyproject = true;
-
-  disabled = pythonOlder "3.8";
-
-  src = fetchFromGitHub {
-    owner = "eliasball";
-    repo = "python-bring-api";
-    # https://github.com/eliasball/python-bring-api/issues/16
-    rev = "8043562b22be1f6421a8771774868b105b6ca375";
-    hash = "sha256-VCGCm9N6pMhEYT9WuWh7qKacZEf6bcIpEsILfCC6his=";
-  };
-
-  nativeBuildInputs = [ setuptools ];
-
-  propagatedBuildInputs = [ aiohttp ];
-
-  # Module has no tests
-  doCheck = false;
-
-  pythonImportsCheck = [ "python_bring_api" ];
-
-  meta = with lib; {
-    description = "Module to access the Bring! shopping lists API";
-    homepage = "https://github.com/eliasball/python-bring-api";
-    license = licenses.mit;
-    maintainers = with maintainers; [ fab ];
-  };
-}
--- a/pkgs/development/python-modules/restrictedpython/default.nix
+++ b/pkgs/development/python-modules/restrictedpython/default.nix
@@ -1,29 +1,27 @@
 {
  lib,
  buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
  pytest-mock,
  pytestCheckHook,
-  pythonAtLeast,
-  pythonOlder,
  setuptools,
 }:

 buildPythonPackage rec {
  pname = "restrictedpython";
-  version = "8.0";
+  version = "8.1";
  pyproject = true;

-  disabled = pythonOlder "3.7";
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-OvIxK8Z+X87Yh/uFsAbImGHackiBKLFVvuqB62oKmyQ=";
+  src = fetchFromGitHub {
+    owner = "zopefoundation";
+    repo = "RestrictedPython";
+    tag = version;
+    hash = "sha256-UcmH1I2p+XmQm4Y5M+Ms/LMSchor6GD6V9dxippa4HI=";
  };

  postPatch = ''
    substituteInPlace pyproject.toml \
-      --replace-fail "setuptools <= 75.6.0" setuptools
+      --replace-fail "setuptools >= 78.1.1,< 81" setuptools
  '';

  build-system = [ setuptools ];
@@ -33,15 +31,13 @@ buildPythonPackage rec {
    pytest-mock
  ];

-  disabledTests = lib.optionals (pythonAtLeast "3.11") [ "test_compile__compile_restricted_exec__5" ];
-
  pythonImportsCheck = [ "RestrictedPython" ];

-  meta = with lib; {
+  meta = {
    description = "Restricted execution environment for Python to run untrusted code";
    homepage = "https://github.com/zopefoundation/RestrictedPython";
-    changelog = "https://github.com/zopefoundation/RestrictedPython/blob/${version}/CHANGES.rst";
-    license = licenses.zpl21;
-    maintainers = with maintainers; [ juaningan ];
+    changelog = "https://github.com/zopefoundation/RestrictedPython/blob/${src.tag}/CHANGES.rst";
+    license = lib.licenses.zpl21;
+    maintainers = with lib.maintainers; [ juaningan ];
  };
 }
--- a/pkgs/development/python-modules/rigour/default.nix
+++ b/pkgs/development/python-modules/rigour/default.nix
@@ -21,14 +21,14 @@

 buildPythonPackage rec {
  pname = "rigour";
-  version = "1.3.11";
+  version = "1.3.13";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "opensanctions";
    repo = "rigour";
    tag = "v${version}";
-    hash = "sha256-ahHrNky8dGcH8UmpnZ8avfzyrz5RIvsL9YOe4V8EeE4=";
+    hash = "sha256-mcQ1GqmNWv4/ul9oRw/+MnTEcIcn3OP0C5eXi4HWKMU=";
  };

  build-system = [
--- a/Show More
+++ b/Show More