Merge master into staging-next

.github/workflows/merge-group.yml

@@ -29,7 +29,7 @@ jobs:
   # This job's only purpose is to create the target for the "Required Status Checks" branch ruleset.
   # It "needs" all the jobs that should block the Merge Queue.
   unlock:
-    if: github.event_name != 'pull_request'
+    if: github.event_name != 'pull_request' && always()
     # Modify this list to add or remove jobs from required status checks.
     needs:
       - lint
@@ -38,6 +38,8 @@ jobs:
       statuses: write
     steps:
       - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        env:
+          RESULTS: ${{ toJSON(needs.*.result) }}
         with:
           script: |
             const { serverUrl, repo, runId, payload } = context
@@ -50,6 +52,6 @@ jobs:
               // Do NOT change the name of this, otherwise the rule will not catch it anymore.
               // This would prevent all PRs from merging.
               context: 'no PR failures',
-              state: 'success',
+              state: JSON.parse(process.env.RESULTS).every(result => result == 'success') ? 'success' : 'error',
               target_url,
             })

.github/workflows/pr.yml

@@ -127,7 +127,7 @@ jobs:
   # This job's only purpose is to create the target for the "Required Status Checks" branch ruleset.
   # It "needs" all the jobs that should block merging a PR.
   unlock:
-    if: github.event_name != 'pull_request'
+    if: github.event_name != 'pull_request' && always()
     # Modify this list to add or remove jobs from required status checks.
     needs:
       - check
@@ -139,6 +139,8 @@ jobs:
       statuses: write
     steps:
       - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        env:
+          RESULTS: ${{ toJSON(needs.*.result) }}
         with:
           script: |
             const { serverUrl, repo, runId, payload } = context
@@ -151,6 +153,6 @@ jobs:
               // Do NOT change the name of this, otherwise the rule will not catch it anymore.
               // This would prevent all PRs from merging.
               context: 'no PR failures',
-              state: 'success',
+              state: JSON.parse(process.env.RESULTS).every(status => status == 'success') ? 'success' : 'error',
               target_url,
             })

ci/eval/compare/default.nix

@@ -13,7 +13,12 @@
   byName ? false,
 }:
 let
-  combined = builtins.storePath combinedDir;
+  # Usually we expect a derivation, but when evaluating in multiple separate steps, we pass
+  # nix store paths around. These need to be turned into (fake) derivations again to track
+  # dependencies properly.
+  # We use two steps for evaluation, because we compare results from two different checkouts.
+  # CI additionalls spreads evaluation across multiple workers.
+  combined = if lib.isDerivation combinedDir then combinedDir else lib.toDerivation combinedDir;
 
   /*
     Derivation that computes which packages are affected (added, changed or removed) between two revisions of nixpkgs.

ci/eval/diff.nix

@@ -11,8 +11,13 @@
 }:
 
 let
-  before = builtins.storePath beforeDir;
-  after = builtins.storePath afterDir;
+  # Usually we expect a derivation, but when evaluating in multiple separate steps, we pass
+  # nix store paths around. These need to be turned into (fake) derivations again to track
+  # dependencies properly.
+  # We use two steps for evaluation, because we compare results from two different checkouts.
+  # CI additionalls spreads evaluation across multiple workers.
+  before = if lib.isDerivation beforeDir then beforeDir else lib.toDerivation beforeDir;
+  after = if lib.isDerivation afterDir then afterDir else lib.toDerivation afterDir;
 
   /*
     Computes the key difference between two attrs

lib/options.nix

@@ -113,7 +113,11 @@ rec {
       : Optional boolean indicating whether the option is for NixOS developers only.
 
       `visible`
-      : Optional boolean indicating whether the option shows up in the manual. Default: true. Use false to hide the option and any sub-options from submodules. Use "shallow" to hide only sub-options.
+      : Optional, whether the option and/or sub-options show up in the manual.
+        Use false to hide the option and any sub-options from submodules.
+        Use "shallow" to hide only sub-options.
+        Use "transparent" to hide this option, but not its sub-options.
+        Default: true.
 
       `readOnly`
       : Optional boolean indicating whether the option can be set only once.
@@ -572,13 +576,14 @@ rec {
       opt:
       let
         name = showOption opt.loc;
+        visible = opt.visible or true;
         docOption = {
           loc = opt.loc;
           inherit name;
           description = opt.description or null;
           declarations = filter (x: x != unknownModule) opt.declarations;
           internal = opt.internal or false;
-          visible = if (opt ? visible && opt.visible == "shallow") then true else opt.visible or true;
+          visible = if isBool visible then visible else visible == "shallow";
           readOnly = opt.readOnly or false;
           type = opt.type.description or "unspecified";
         }
@@ -601,7 +606,7 @@ rec {
             ss = opt.type.getSubOptions opt.loc;
           in
           if ss != { } then optionAttrSetToDocList' opt.loc ss else [ ];
-        subOptionsVisible = docOption.visible && opt.visible or null != "shallow";
+        subOptionsVisible = if isBool visible then visible else visible == "transparent";
       in
       # To find infinite recursion in NixOS option docs:
       # builtins.trace opt.loc

lib/tests/misc.nix

@@ -3210,6 +3210,111 @@ runTests {
     ];
   };
 
+  testDocOptionVisiblity = {
+    expr =
+      let
+        submodule =
+          { lib, ... }:
+          {
+            freeformType = lib.types.attrsOf (
+              lib.types.submodule {
+                options.bar = lib.mkOption { };
+              }
+            );
+            options.foo = lib.mkOption { };
+          };
+
+        module =
+          { lib, ... }:
+          {
+            options = {
+              shallow = lib.mkOption {
+                type = lib.types.submodule submodule;
+                visible = "shallow";
+              };
+              transparent = lib.mkOption {
+                type = lib.types.submodule submodule;
+                visible = "transparent";
+              };
+              "true" = lib.mkOption {
+                type = lib.types.submodule submodule;
+                visible = true;
+              };
+              "false" = lib.mkOption {
+                type = lib.types.submodule submodule;
+                visible = false;
+              };
+              "internal" = lib.mkOption {
+                type = lib.types.submodule submodule;
+                internal = true;
+              };
+            };
+          };
+
+        options =
+          (evalModules {
+            modules = [ module ];
+          }).options;
+      in
+      pipe options [
+        optionAttrSetToDocList
+        (filter (opt: !(builtins.elem "_module" opt.loc)))
+        (map (
+          opt:
+          nameValuePair opt.name {
+            inherit (opt) visible internal;
+          }
+        ))
+        listToAttrs
+      ];
+    expected = {
+      shallow = {
+        visible = true;
+        internal = false;
+      };
+      transparent = {
+        visible = false;
+        internal = false;
+      };
+      "transparent.foo" = {
+        visible = true;
+        internal = false;
+      };
+      "transparent.<name>.bar" = {
+        visible = true;
+        internal = false;
+      };
+      "true" = {
+        visible = true;
+        internal = false;
+      };
+      "true.foo" = {
+        visible = true;
+        internal = false;
+      };
+      "true.<name>.bar" = {
+        visible = true;
+        internal = false;
+      };
+      "false" = {
+        visible = false;
+        internal = false;
+      };
+      "internal" = {
+        visible = true;
+        internal = true;
+      };
+      "internal.foo" = {
+        visible = true;
+        internal = false;
+      };
+      "internal.<name>.bar" = {
+        visible = true;
+        internal = false;
+      };
+    };
+  };
+
   testAttrsWithName = {
     expr =
       let

maintainers/maintainer-list.nix

@@ -1347,6 +1347,13 @@
     githubId = 373;
     name = "Alexandre Girard Davila";
   };
+  amaanq = {
+    email = "contact@amaanq.com";
+    github = "amaanq";
+    githubId = 29718261;
+    matrix = "@amaan:amaanq.com";
+    name = "Amaan Qureshi";
+  };
   amadaluzia = {
     email = "amad@atl.tools";
     github = "amadaluzia";

nixos/doc/manual/release-notes/rl-2511.section.md

@@ -296,6 +296,8 @@
 - Potential race conditions in the network setup when using `networking.interfaces` have been fixed by disabling duplicate address detection (DAD)
   for statically configured IPv6 addresses.
 
+- `strongSwan` has been updated to 6.0. See [strongSwan 6.0.0 release notes](https://github.com/strongswan/strongswan/releases/tag/6.0.0) for a complete list of changes.
+
 - `amdgpu` kernel driver overdrive mode can now be enabled by setting [hardware.amdgpu.overdrive.enable](#opt-hardware.amdgpu.overdrive.enable) and customized through [hardware.amdgpu.overdrive.ppfeaturemask](#opt-hardware.amdgpu.overdrive.ppfeaturemask).
   This allows for fine-grained control over the GPU's performance and maybe required by overclocking softwares like Corectrl and Lact. These new options replace old options such as {option}`programs.corectrl.gpuOverclock.enable` and {option}`programs.tuxclocker.enableAMD`.
 

nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix

@@ -131,21 +131,24 @@ in
         '';
 
         proposals = mkCommaSepListParam [ "default" ] ''
-          A proposal is a set of algorithms. For non-AEAD algorithms, this includes
-          for IKE an encryption algorithm, an integrity algorithm, a pseudo random
-          function and a Diffie-Hellman group. For AEAD algorithms, instead of
-          encryption and integrity algorithms, a combined algorithm is used.
+          A proposal is a set of algorithms. For non-AEAD IKE proposals, this includes
+          an encryption algorithm, an integrity algorithm, a pseudo-random function
+          and a key exchange method. For AEAD proposals, instead of encryption and
+          integrity algorithms, a combined mode algorithm is used.
 
-          In IKEv2, multiple algorithms of the same kind can be specified in a
-          single proposal, from which one gets selected. In IKEv1, only one
-          algorithm per kind is allowed per proposal, more algorithms get implicitly
-          stripped. Use multiple proposals to offer different algorithms
-          combinations in IKEv1.
+          With peers that support multiple IKEv2 key exchanges (RFC 9370), up to seven
+          additional key exchanges may be negotiated. They can be configured by
+          prefixing the algorithm keyword with **keX_** (where X is a number between
+          1 and 7).
 
-          Algorithm keywords get separated using dashes. Multiple proposals may be
-          specified in a list. The special value `default` forms a
-          default proposal of supported algorithms considered safe, and is usually a
-          good choice for interoperability.
+          For IKEv2, multiple algorithms of the same kind can be specified in a single
+          proposal, from which one gets selected. For IKEv1, only one algorithm per
+          kind is allowed per proposal, more algorithms get implicitly stripped. Use
+          multiple proposals to offer different algorithm combinations with IKEv1.
+
+          Algorithm keywords get separated using dashes. The special value _default_
+          forms a default proposal of supported algorithms considered safe, and is
+          usually a good choice for interoperability.
         '';
 
         vips = mkCommaSepListParam [ ] ''
@@ -240,16 +243,16 @@ in
 
           Use childless IKE_SA initiation (RFC 6023) for IKEv2, with the first
           CHILD_SA created with a separate CREATE_CHILD_SA exchange (e.g. to use an
-          independent DH exchange for all CHILD_SAs).  Acceptable values are `allow`
-          (the default), `prefer`, `force` and `never`. If set to `allow`, responders
+          independent key exchange for all CHILD_SAs).  Acceptable values are _allow_
+          (the default), _prefer_, _force_ and _never_. If set to _allow_, responders
           will accept childless IKE_SAs (as indicated via notify in the IKE_SA_INIT
           response) while initiators continue to create regular IKE_SAs with the first
           CHILD_SA created during IKE_AUTH, unless the IKE_SA is initiated explicitly
           without any children (which will fail if the responder does not support or
-          has disabled this extension). The effect of `prefer` is the same as `allow`
+          has disabled this extension). The effect of _prefer_ is the same as _allow_
           on responders, but as initiator a childless IKE_SA is initiated if the
-          responder supports it. If set to `force`, only childless initiation is
-          accepted in either role.  Finally, setting the option to `never` disables
+          responder supports it. If set to _force_, only childless initiation is
+          accepted in either role.  Finally, setting the option to _never_ disables
           support for childless IKE_SAs as responder.
         '';
 
@@ -321,9 +324,10 @@ in
           reauthentication lifetime negotiation can instruct the client to perform
           reauthentication.
 
-          Reauthentication is disabled by default. Enabling it usually may lead to
-          small connection interruptions, as strongSwan uses a break-before-make
-          policy with IKEv2 to avoid any conflicts with associated tunnel resources.
+          Reauthentication is disabled by default. Enabling it can usually result in
+          short connection interruptions, even when using make-before-break
+          reauthentication, which is now the default. However, they are significantly
+          shorter than when using the legacy break-before-make approach.
         '';
 
         rekey_time = mkDurationParam "4h" ''
@@ -657,59 +661,63 @@ in
           mkAttrsOfParams
             {
               ah_proposals = mkCommaSepListParam [ ] ''
-                AH proposals to offer for the CHILD_SA. A proposal is a set of
-                algorithms. For AH, this includes an integrity algorithm and an optional
-                Diffie-Hellman group. If a DH group is specified, CHILD_SA/Quick Mode
-                rekeying and initial negotiation uses a separate Diffie-Hellman exchange
-                using the specified group (refer to esp_proposals for details).
+                AH proposals to offer for the CHILD_SA. A proposal is a set of algorithms.
+                For AH, this includes an integrity algorithm and an optional key exchange
+                method. If a KE method is specified, CHILD_SA/Quick Mode rekeying and
+                initial negotiation uses a separate key exchange using the negotiated method
+                (refer to _esp_proposals_ for details).
 
-                In IKEv2, multiple algorithms of the same kind can be specified in a
-                single proposal, from which one gets selected. In IKEv1, only one
-                algorithm per kind is allowed per proposal, more algorithms get
-                implicitly stripped. Use multiple proposals to offer different algorithms
-                combinations in IKEv1.
+                With peers that support multiple IKEv2 key exchanges (RFC 9370), up to seven
+                additional key exchanges may be negotiated. They can be configured by
+                prefixing the algorithm keyword with **keX_** (where X is a number between
+                1 and 7).
 
-                Algorithm keywords get separated using dashes. Multiple proposals may be
-                specified in a list. The special value `default` forms
-                a default proposal of supported algorithms considered safe, and is
+                For IKEv2, multiple algorithms of the same kind can be specified in a single
+                proposal, from which one gets selected. For IKEv1, only one algorithm per
+                kind is allowed per proposal, more algorithms get implicitly stripped. Use
+                multiple proposals to offer different algorithm combinations with IKEv1.
+
+                Algorithm keywords get separated using dashes. The special value _default_
+                forms a default proposal of supported algorithms considered safe, and is
                 usually a good choice for interoperability. By default no AH proposals
                 are included, instead ESP is proposed.
               '';
 
               esp_proposals = mkCommaSepListParam [ "default" ] ''
-                ESP proposals to offer for the CHILD_SA. A proposal is a set of
-                algorithms. For ESP non-AEAD proposals, this includes an integrity
-                algorithm, an encryption algorithm, an optional Diffie-Hellman group and
-                an optional Extended Sequence Number Mode indicator. For AEAD proposals,
-                a combined mode algorithm is used instead of the separate
-                encryption/integrity algorithms.
+                ESP proposals to offer for the CHILD_SA. A proposal is a set of algorithms.
+                For non-AEAD ESP proposals, this includes an integrity algorithm, an
+                encryption algorithm, an optional key exchange method and an optional
+                Extended Sequence Number Mode indicator. For AEAD proposals, a combined
+                mode algorithm is used instead of the separate encryption/integrity
+                algorithms.
 
-                If a DH group is specified, CHILD_SA/Quick Mode rekeying and initial
-                negotiation use a separate Diffie-Hellman exchange using the specified
-                group. However, for IKEv2, the keys of the CHILD_SA created implicitly
-                with the IKE_SA will always be derived from the IKE_SA's key material. So
-                any DH group specified here will only apply when the CHILD_SA is later
-                rekeyed or is created with a separate CREATE_CHILD_SA exchange. A
-                proposal mismatch might, therefore, not immediately be noticed when the
-                SA is established, but may later cause rekeying to fail.
+                If a key exchange method is specified, CHILD_SA/Quick Mode rekeying and
+                initial negotiation use a separate key exchange using the specified method.
+                However, for IKEv2, the keys of the CHILD_SA created implicitly with the
+                IKE_SA will always be derived from the IKE_SA's key material. So any key
+                exchange method specified here will only apply when the CHILD_SA is later
+                rekeyed or is created with a separate CREATE_CHILD_SA exchange. A proposal
+                mismatch might, therefore, not immediately be noticed when the SA is
+                established, but may later cause rekeying to fail.
 
-                Extended Sequence Number support may be indicated with the
-                `esn` and `noesn` values, both may be
-                included to indicate support for both modes. If omitted,
-                `noesn` is assumed.
+                With peers that support multiple IKEv2 key exchanges (RFC 9370), up to seven
+                additional key exchanges may be negotiated. They can be configured by
+                prefixing the algorithm keyword with **keX_** (where X is a number between
+                1 and 7).
 
-                In IKEv2, multiple algorithms of the same kind can be specified in a
-                single proposal, from which one gets selected. In IKEv1, only one
-                algorithm per kind is allowed per proposal, more algorithms get
-                implicitly stripped. Use multiple proposals to offer different algorithms
-                combinations in IKEv1.
+                Extended Sequence Number support may be indicated with the _esn_ and _noesn_
+                values, both may be included to indicate support for both modes. If omitted,
+                _noesn_ is assumed.
 
-                Algorithm keywords get separated using dashes. Multiple proposals may be
-                specified as a list. The special value `default` forms
-                a default proposal of supported algorithms considered safe, and is
-                usually a good choice for interoperability. If no algorithms are
-                specified for AH nor ESP, the default set of algorithms for ESP is
-                included.
+                For IKEv2, multiple algorithms of the same kind can be specified in a single
+                proposal, from which one gets selected. For IKEv1, only one algorithm per
+                kind is allowed per proposal, more algorithms get implicitly stripped. Use
+                multiple proposals to offer different algorithm combinations with IKEv1.
+
+                Algorithm keywords get separated using dashes. The special value _default_
+                forms a default proposal of supported algorithms considered safe, and is
+                usually a good choice for interoperability. If no algorithms are specified
+                for AH nor ESP, the _default_ set of algorithms for ESP is included.
               '';
 
               sha256_96 = mkYesNoParam no ''
@@ -721,30 +729,34 @@ in
               '';
 
               local_ts = mkCommaSepListParam [ "dynamic" ] ''
-                List of local traffic selectors to include in CHILD_SA. Each selector is
-                a CIDR subnet definition, followed by an optional proto/port
-                selector. The special value `dynamic` may be used
-                instead of a subnet definition, which gets replaced by the tunnel outer
-                address or the virtual IP, if negotiated. This is the default.
+                List of local traffic selectors to include in CHILD_SA.
+                Each selector is a CIDR subnet definition, followed by an optional
+                proto/port selector. The special value _dynamic_ may be used instead of a
+                subnet definition, which gets replaced by the tunnel outer address or the
+                virtual IP, if negotiated. This is the default.
 
                 A protocol/port selector is surrounded by opening and closing square
-                brackets. Between these brackets, a numeric or getservent(3) protocol
-                name may be specified. After the optional protocol restriction, an
-                optional port restriction may be specified, separated by a slash. The
-                port restriction may be numeric, a getservent(3) service name, or the
-                special value `opaque` for RFC 4301 OPAQUE
-                selectors. Port ranges may be specified as well, none of the kernel
-                backends currently support port ranges, though.
+                brackets. Between these brackets, a numeric or **getservent**(3) protocol
+                name may be specified. After the optional protocol restriction, an optional
+                port restriction may be specified, separated by a slash. The port
+                restriction may be numeric, a **getservent**(3) service name, or the special
+                value _opaque_ for RFC 4301 OPAQUE selectors. Port ranges may be specified
+                as well, none of the kernel backends currently support port ranges, though.
+                If the protocol is _icmp_ or _ipv6-icmp_, the port is interpreted as ICMP
+                message type if it is less than 256 or as type and code if it is greater or
+                equal to 256, with the type in the most significant 8 bits and the code in
+                the least significant 8 bits.
 
-                When IKEv1 is used only the first selector is interpreted, except if the
-                Cisco Unity extension plugin is used. This is due to a limitation of the
-                IKEv1 protocol, which only allows a single pair of selectors per
-                CHILD_SA. So to tunnel traffic matched by several pairs of selectors when
-                using IKEv1 several children (CHILD_SAs) have to be defined that cover
-                the selectors.  The IKE daemon uses traffic selector narrowing for IKEv1,
-                the same way it is standardized and implemented for IKEv2. However, this
-                may lead to problems with other implementations. To avoid that, configure
-                identical selectors in such scenarios.
+                When IKEv1 is used only the first selector is interpreted, except if
+                the Cisco Unity extension plugin is used. This is due to a limitation of the
+                IKEv1 protocol, which only allows a single pair of selectors per CHILD_SA.
+                So to tunnel traffic matched by several pairs of selectors when using IKEv1
+                several children (CHILD_SAs) have to be defined that cover the selectors.
+
+                The IKE daemon uses traffic selector narrowing for IKEv1, the same way it is
+                standardized and implemented for IKEv2. However, this may lead to problems
+                with other implementations. To avoid that, configure identical selectors in
+                such scenarios.
               '';
 
               remote_ts = mkCommaSepListParam [ "dynamic" ] ''
@@ -752,14 +764,17 @@ in
                 {option}`local_ts` for a description of the selector syntax.
               '';
 
-              rekey_time = mkDurationParam "1h" ''
+              rekey_time = mkOptionalDurationParam ''
                 Time to schedule CHILD_SA rekeying. CHILD_SA rekeying refreshes key
                 material, optionally using a Diffie-Hellman exchange if a group is
-                specified in the proposal.  To avoid rekey collisions initiated by both
-                ends simultaneously, a value in the range of {option}`rand_time`
-                gets subtracted to form the effective soft lifetime.
+                specified in the proposal.
 
-                By default CHILD_SA rekeying is scheduled every hour, minus
+                To avoid rekey collisions initiated by both ends simultaneously, a value
+                in the range of {option}`rand_time` gets subtracted to form the effective soft
+                lifetime.
+
+                If {option}`life_time` is explicitly configured, {option}`rekey_time` defaults to 10%
+                less than that, otherwise, CHILD_SA rekeying is scheduled every hour, minus
                 {option}`rand_time`.
               '';
 
@@ -776,16 +791,19 @@ in
                 {option}`life_time` and {option}`rekey_time`.
               '';
 
-              rekey_bytes = mkIntParam 0 ''
+              rekey_bytes = mkOptionalIntParam ''
+                Number of bytes processed before initiating CHILD_SA rekeying.
+
                 Number of bytes processed before initiating CHILD_SA rekeying. CHILD_SA
-                rekeying refreshes key material, optionally using a Diffie-Hellman
-                exchange if a group is specified in the proposal.
+                rekeying refreshes key material, optionally using a Diffie-Hellman exchange
+                if a group is specified in the proposal.
 
                 To avoid rekey collisions initiated by both ends simultaneously, a value
-                in the range of {option}`rand_bytes` gets subtracted to form the
-                effective soft volume limit.
+                in the range of {option}`rand_bytes` gets subtracted to form the effective soft
+                volume limit.
 
-                Volume based CHILD_SA rekeying is disabled by default.
+                Volume based CHILD_SA rekeying is disabled by default. If {option}`life_bytes`
+                is explicitly configured, {option}`rekey_bytes` defaults to 10% less than that.
               '';
 
               life_bytes = mkOptionalIntParam ''
@@ -801,16 +819,20 @@ in
                 {option}`life_bytes` and {option}`rekey_bytes`.
               '';
 
-              rekey_packets = mkIntParam 0 ''
+              rekey_packets = mkOptionalIntParam ''
+                Number of packets processed before initiating CHILD_SA rekeying.
+
                 Number of packets processed before initiating CHILD_SA rekeying. CHILD_SA
-                rekeying refreshes key material, optionally using a Diffie-Hellman
-                exchange if a group is specified in the proposal.
+                rekeying refreshes key material, optionally using a Diffie-Hellman exchange
+                if a group is specified in the proposal.
 
                 To avoid rekey collisions initiated by both ends simultaneously, a value
-                in the range of {option}`rand_packets` gets subtracted to form
-                the effective soft packet count limit.
+                in the range of {option}`rand_packets` gets subtracted to form the effective soft
+                packet count limit.
 
-                Packet count based CHILD_SA rekeying is disabled by default.
+                Packet count based CHILD_SA rekeying is disabled by default. If
+                {option}`life_packets` is explicitly configured, {option}`rekey_packets` defaults to
+                10% less than that.
               '';
 
               life_packets = mkOptionalIntParam ''
@@ -1021,6 +1043,19 @@ in
                 protection.
               '';
 
+              per_cpu_sas = mkEnumParam [ "yes" "no" "encap" ] "no" ''
+                Enable per-CPU CHILD_SAs. Requires `trap` in `start_action`.
+                The value `encap` enables a special type of UDP encapsulation
+                (requires enabling `encap` for the connection if there is no NAT),
+                where a random source port is used for each outbound per-CPU SA
+                (the destination port for all of them remains 4500). This allows
+                using the port for RSS if the SPI can’t be used. Note that this type
+                of behavior is not standardized and not negotiated. So regardless
+                of whether the option is enabled, inbound per-CPU SAs
+                with UDP-encapsulation always have the source port set to 0
+                as the peer’s random port is unknown if it has this option enabled.
+              '';
+
               hw_offload = mkEnumParam [ "yes" "no" "auto" "crypto" "packet" ] "no" ''
                 Enable hardware offload for this CHILD_SA, if supported by the IPsec
                 implementation. The values `crypto` or `packet` enforce crypto or full
@@ -1302,9 +1337,14 @@ in
     mkAttrsOfParams
       {
         addrs = mkOptionalStrParam ''
-          Subnet or range defining addresses allocated in pool. Accepts a single
-          CIDR subnet defining the pool to allocate addresses from or an address
-          range (\<from\>-\<to\>). Pools must be unique and non-overlapping.
+          Addresses allocated in pool.
+
+          Subnet or range defining addresses allocated in pool. Accepts a single CIDR
+          subnet defining the pool to allocate addresses from or an address range
+          (<from>-<to>). If the address in CIDR notation is not the network ID of the
+          subnet (e.g. 10.1.0.5/24 instead of 10.1.0.0/24), addresses below it won't
+          be allocated to clients (they could e.g. be assigned manually to internal
+          hosts like the VPN server itself). Pools must be unique and non-overlapping
         '';
 
         dns = mkCommaSepListParam [ ] "Address or CIDR subnets";

nixos/tests/k3s/auto-deploy-charts.nix

@@ -135,7 +135,7 @@ import ../make-test-python.nix (
         machine.succeed("test -e /var/lib/rancher/k3s/server/manifests/advanced.yaml")
         # check that the timeout is set correctly, select only the first doc in advanced.yaml
         advancedManifest = json.loads(machine.succeed("yq -o json 'select(di == 0)' /var/lib/rancher/k3s/server/manifests/advanced.yaml"))
-        assert advancedManifest["spec"]["timeout"] == "69s", f"unexpected value for spec.timeout: {advancedManifest["spec"]["timeout"]}"
+        t.assertEqual(advancedManifest["spec"]["timeout"], "69s", "unexpected value for spec.timeout")
         # wait for test jobs to complete
         machine.wait_until_succeeds("kubectl wait --for=condition=complete job/hello", timeout=180)
         machine.wait_until_succeeds("kubectl wait --for=condition=complete job/values-file", timeout=180)
@@ -145,9 +145,9 @@ import ../make-test-python.nix (
         values_file_output = machine.succeed("kubectl logs -l batch.kubernetes.io/job-name=values-file")
         advanced_output = machine.succeed("kubectl -n test logs -l batch.kubernetes.io/job-name=advanced")
         # strip the output to remove trailing whitespaces
-        assert hello_output.rstrip() == "Hello, world!", f"unexpected output of hello job: {hello_output}"
-        assert values_file_output.rstrip() == "Hello, file!", f"unexpected output of values file job: {values_file_output}"
-        assert advanced_output.rstrip() == "advanced hello", f"unexpected output of advanced job: {advanced_output}"
+        t.assertEqual(hello_output.rstrip(), "Hello, world!", "unexpected output of hello job")
+        t.assertEqual(values_file_output.rstrip(), "Hello, file!", "unexpected output of values file job")
+        t.assertEqual(advanced_output.rstrip(), "advanced hello", "unexpected output of advanced job")
         # wait for bundled traefik deployment
         machine.wait_until_succeeds("kubectl -n kube-system rollout status deployment traefik", timeout=180)
       '';

nixos/tests/k3s/auto-deploy.nix

@@ -99,26 +99,25 @@ import ../make-test-python.nix (
         };
       };
 
-    testScript = ''
-      start_all()
+    testScript = # python
+      ''
+        start_all()
 
-      machine.wait_for_unit("k3s")
-      # check existence of the manifest files
-      machine.fail("ls /var/lib/rancher/k3s/server/manifests/absent.yaml")
-      machine.succeed("ls /var/lib/rancher/k3s/server/manifests/foo-namespace.yaml")
-      machine.succeed("ls /var/lib/rancher/k3s/server/manifests/hello.yaml")
+        machine.wait_for_unit("k3s")
+        # check existence of the manifest files
+        machine.fail("ls /var/lib/rancher/k3s/server/manifests/absent.yaml")
+        machine.succeed("ls /var/lib/rancher/k3s/server/manifests/foo-namespace.yaml")
+        machine.succeed("ls /var/lib/rancher/k3s/server/manifests/hello.yaml")
 
-      # check if container images got imported
-      machine.wait_until_succeeds("crictl img | grep 'test\.local/pause'")
-      machine.wait_until_succeeds("crictl img | grep 'test\.local/hello'")
+        # check if container images got imported
+        machine.wait_until_succeeds("crictl img | grep 'test\.local/pause'")
+        machine.wait_until_succeeds("crictl img | grep 'test\.local/hello'")
 
-      # check if resources of manifests got created
-      machine.wait_until_succeeds("kubectl get ns foo")
-      machine.wait_until_succeeds("kubectl wait --for=condition=complete job/hello")
-      machine.fail("kubectl get ns absent")
-
-      machine.shutdown()
-    '';
+        # check if resources of manifests got created
+        machine.wait_until_succeeds("kubectl get ns foo")
+        machine.wait_until_succeeds("kubectl wait --for=condition=complete job/hello")
+        machine.fail("kubectl get ns absent")
+      '';
 
     meta.maintainers = lib.teams.k3s.members;
   }

nixos/tests/k3s/containerd-config.nix

@@ -40,18 +40,19 @@ import ../make-test-python.nix (
         };
       };
 
-    testScript = ''
-      start_all()
-      machine.wait_for_unit("k3s")
-      # wait until the node is ready
-      machine.wait_until_succeeds(r"""kubectl get node ${nodeName} -ojson | jq -e '.status.conditions[] | select(.type == "Ready") | .status == "True"'""")
-      # test whether the config template file contains the magic comment
-      out=machine.succeed("cat /var/lib/rancher/k3s/agent/etc/containerd/config.toml.tmpl")
-      assert "MAGIC COMMENT" in out, "the containerd config template does not contain the magic comment"
-      # test whether the config file contains the magic comment
-      out=machine.succeed("cat /var/lib/rancher/k3s/agent/etc/containerd/config.toml")
-      assert "MAGIC COMMENT" in out, "the containerd config does not contain the magic comment"
-    '';
+    testScript = # python
+      ''
+        start_all()
+        machine.wait_for_unit("k3s")
+        # wait until the node is ready
+        machine.wait_until_succeeds(r"""kubectl get node ${nodeName} -ojson | jq -e '.status.conditions[] | select(.type == "Ready") | .status == "True"'""")
+        # test whether the config template file contains the magic comment
+        out=machine.succeed("cat /var/lib/rancher/k3s/agent/etc/containerd/config.toml.tmpl")
+        t.assertIn("MAGIC COMMENT", out, "the containerd config template does not contain the magic comment")
+        # test whether the config file contains the magic comment
+        out=machine.succeed("cat /var/lib/rancher/k3s/agent/etc/containerd/config.toml")
+        t.assertIn("MAGIC COMMENT", out, "the containerd config does not contain the magic comment")
+      '';
 
     meta.maintainers = lib.teams.k3s.members;
   }

nixos/tests/k3s/etcd.nix

@@ -82,46 +82,43 @@ import ../make-test-python.nix (
         };
     };
 
-    testScript = ''
-      with subtest("should start etcd"):
-          etcd.start()
-          etcd.wait_for_unit("etcd.service")
+    testScript = # python
+      ''
+        with subtest("should start etcd"):
+            etcd.start()
+            etcd.wait_for_unit("etcd.service")
 
-      with subtest("should wait for etcdctl endpoint status to succeed"):
-          etcd.wait_until_succeeds("etcdctl endpoint status")
+        with subtest("should wait for etcdctl endpoint status to succeed"):
+            etcd.wait_until_succeeds("etcdctl endpoint status")
 
-      with subtest("should wait for etcdctl endpoint health to succeed"):
-          etcd.wait_until_succeeds("etcdctl endpoint health")
+        with subtest("should wait for etcdctl endpoint health to succeed"):
+            etcd.wait_until_succeeds("etcdctl endpoint health")
 
-      with subtest("should start k3s"):
-          k3s.start()
-          k3s.wait_for_unit("k3s")
+        with subtest("should start k3s"):
+            k3s.start()
+            k3s.wait_for_unit("k3s")
 
-      with subtest("should test if kubectl works"):
-          k3s.wait_until_succeeds("k3s kubectl get node")
+        with subtest("should test if kubectl works"):
+            k3s.wait_until_succeeds("k3s kubectl get node")
 
-      with subtest("should wait for service account to show up; takes a sec"):
-          k3s.wait_until_succeeds("k3s kubectl get serviceaccount default")
+        with subtest("should wait for service account to show up; takes a sec"):
+            k3s.wait_until_succeeds("k3s kubectl get serviceaccount default")
 
-      with subtest("should create a sample secret object"):
-          k3s.succeed("k3s kubectl create secret generic nixossecret --from-literal thesecret=abacadabra")
+        with subtest("should create a sample secret object"):
+            k3s.succeed("k3s kubectl create secret generic nixossecret --from-literal thesecret=abacadabra")
 
-      with subtest("should check if secret is correct"):
-          k3s.wait_until_succeeds("[[ $(kubectl get secrets nixossecret -o json | jq -r .data.thesecret | base64 -d) == abacadabra ]]")
+        with subtest("should check if secret is correct"):
+            k3s.wait_until_succeeds("[[ $(kubectl get secrets nixossecret -o json | jq -r .data.thesecret | base64 -d) == abacadabra ]]")
 
-      with subtest("should have a secret in database"):
-          etcd.wait_until_succeeds("[[ $(etcdctl get /registry/secrets/default/nixossecret | head -c1 | wc -c) -ne 0 ]]")
+        with subtest("should have a secret in database"):
+            etcd.wait_until_succeeds("[[ $(etcdctl get /registry/secrets/default/nixossecret | head -c1 | wc -c) -ne 0 ]]")
 
-      with subtest("should delete the secret"):
-          k3s.succeed("k3s kubectl delete secret nixossecret")
+        with subtest("should delete the secret"):
+            k3s.succeed("k3s kubectl delete secret nixossecret")
 
-      with subtest("should not have a secret in database"):
-          etcd.wait_until_fails("[[ $(etcdctl get /registry/secrets/default/nixossecret | head -c1 | wc -c) -ne 0 ]]")
-
-      with subtest("should shutdown k3s and etcd"):
-          k3s.shutdown()
-          etcd.shutdown()
-    '';
+        with subtest("should not have a secret in database"):
+            etcd.wait_until_fails("[[ $(etcdctl get /registry/secrets/default/nixossecret | head -c1 | wc -c) -ne 0 ]]")
+      '';
 
     meta.maintainers = etcd.meta.maintainers ++ lib.teams.k3s.members;
   }

nixos/tests/k3s/kubelet-config.nix

@@ -47,33 +47,29 @@ import ../make-test-python.nix (
         };
       };
 
-    testScript = ''
-      import json
+    testScript = # python
+      ''
+        import json
 
-      start_all()
-      machine.wait_for_unit("k3s")
-      # wait until the node is ready
-      machine.wait_until_succeeds(r"""kubectl get node ${nodeName} -ojson | jq -e '.status.conditions[] | select(.type == "Ready") | .status == "True"'""")
-      # test whether the kubelet registered an inhibitor lock
-      machine.succeed("systemd-inhibit --list --no-legend | grep \"kubelet.*k3s-server.*shutdown\"")
-      # run kubectl proxy in the background, close stdout through redirection to not wait for the command to finish
-      machine.execute("kubectl proxy --address 127.0.0.1 --port=8001 >&2 &")
-      machine.wait_until_succeeds("nc -z 127.0.0.1 8001")
-      # get the kubeletconfig
-      kubelet_config=json.loads(machine.succeed("curl http://127.0.0.1:8001/api/v1/nodes/${nodeName}/proxy/configz | jq '.kubeletconfig'"))
+        start_all()
+        machine.wait_for_unit("k3s")
+        # wait until the node is ready
+        machine.wait_until_succeeds(r"""kubectl get node ${nodeName} -ojson | jq -e '.status.conditions[] | select(.type == "Ready") | .status == "True"'""")
+        # test whether the kubelet registered an inhibitor lock
+        machine.succeed("systemd-inhibit --list --no-legend | grep \"kubelet.*k3s-server.*shutdown\"")
+        # run kubectl proxy in the background, close stdout through redirection to not wait for the command to finish
+        machine.execute("kubectl proxy --address 127.0.0.1 --port=8001 >&2 &")
+        machine.wait_until_succeeds("nc -z 127.0.0.1 8001")
+        # get the kubeletconfig
+        kubelet_config=json.loads(machine.succeed("curl http://127.0.0.1:8001/api/v1/nodes/${nodeName}/proxy/configz | jq '.kubeletconfig'"))
 
-      with subtest("Kubelet config values are set correctly"):
-        assert kubelet_config["shutdownGracePeriod"] == "${shutdownGracePeriod}", \
-          f"unexpected value for shutdownGracePeriod: {kubelet_config["shutdownGracePeriod"]}"
-        assert kubelet_config["shutdownGracePeriodCriticalPods"] == "${shutdownGracePeriodCriticalPods}", \
-          f"unexpected value for shutdownGracePeriodCriticalPods: {kubelet_config["shutdownGracePeriodCriticalPods"]}"
-        assert kubelet_config["podsPerCore"] == ${toString podsPerCore}, \
-          f"unexpected value for podsPerCore: {kubelet_config["podsPerCore"]}"
-        assert kubelet_config["memoryThrottlingFactor"] == ${toString memoryThrottlingFactor}, \
-          f"unexpected value for memoryThrottlingFactor: {kubelet_config["memoryThrottlingFactor"]}"
-        assert kubelet_config["containerLogMaxSize"] == "${containerLogMaxSize}", \
-          f"unexpected value for containerLogMaxSize: {kubelet_config["containerLogMaxSize"]}"
-    '';
+        with subtest("Kubelet config values are set correctly"):
+          t.assertEqual(kubelet_config["shutdownGracePeriod"], "${shutdownGracePeriod}")
+          t.assertEqual(kubelet_config["shutdownGracePeriodCriticalPods"], "${shutdownGracePeriodCriticalPods}")
+          t.assertEqual(kubelet_config["podsPerCore"], ${toString podsPerCore})
+          t.assertEqual(kubelet_config["memoryThrottlingFactor"], ${toString memoryThrottlingFactor})
+          t.assertEqual(kubelet_config["containerLogMaxSize"],"${containerLogMaxSize}")
+      '';
 
     meta.maintainers = lib.teams.k3s.members;
   }

nixos/tests/k3s/multi-node.nix

@@ -192,7 +192,7 @@ import ../make-test-python.nix (
             # Verify the pods can talk to each other
             for pod in pods:
                 resp = server.succeed(f"k3s kubectl exec {pod} -- socat TCP:{pod_ip}:8000 -")
-                assert resp.strip() == "server"
+                t.assertEqual(resp.strip(), "server")
       '';
 
     meta.maintainers = lib.teams.k3s.members;

nixos/tests/k3s/single-node.nix

@@ -76,40 +76,39 @@ import ../make-test-python.nix (
         };
       };
 
-    testScript = ''
-      start_all()
+    testScript = # python
+      ''
+        start_all()
 
-      machine.wait_for_unit("k3s")
-      machine.succeed("kubectl cluster-info")
-      machine.fail("sudo -u noprivs kubectl cluster-info")
-      machine.succeed("k3s check-config")
-      machine.succeed(
-          "${pauseImage} | ctr image import -"
-      )
+        machine.wait_for_unit("k3s")
+        machine.succeed("kubectl cluster-info")
+        machine.fail("sudo -u noprivs kubectl cluster-info")
+        machine.succeed("k3s check-config")
+        machine.succeed(
+            "${pauseImage} | ctr image import -"
+        )
 
-      # Also wait for our service account to show up; it takes a sec
-      machine.wait_until_succeeds("kubectl get serviceaccount default")
-      machine.succeed("kubectl apply -f ${testPodYaml}")
-      machine.succeed("kubectl wait --for 'condition=Ready' pod/test")
-      machine.succeed("kubectl delete -f ${testPodYaml}")
+        # Also wait for our service account to show up; it takes a sec
+        machine.wait_until_succeeds("kubectl get serviceaccount default")
+        machine.succeed("kubectl apply -f ${testPodYaml}")
+        machine.succeed("kubectl wait --for 'condition=Ready' pod/test")
+        machine.succeed("kubectl delete -f ${testPodYaml}")
 
-      # regression test for #176445
-      machine.fail("journalctl -o cat -u k3s.service | grep 'ipset utility not found'")
+        # regression test for #176445
+        machine.fail("journalctl -o cat -u k3s.service | grep 'ipset utility not found'")
 
-      with subtest("Run k3s-killall"):
-          # Call the killall script with a clean path to assert that
-          # all required commands are wrapped
-          output = machine.succeed("PATH= ${k3s}/bin/k3s-killall.sh 2>&1 | tee /dev/stderr")
-          assert "command not found" not in output, "killall script contains unknown command"
+        with subtest("Run k3s-killall"):
+            # Call the killall script with a clean path to assert that
+            # all required commands are wrapped
+            output = machine.succeed("PATH= ${k3s}/bin/k3s-killall.sh 2>&1 | tee /dev/stderr")
+            t.assertNotIn("command not found", output, "killall script contains unknown command")
 
-          # Check that killall cleaned up properly
-          machine.fail("systemctl is-active k3s.service")
-          machine.fail("systemctl list-units | grep containerd")
-          machine.fail("ip link show | awk -F': ' '{print $2}' | grep -e flannel -e cni0")
-          machine.fail("ip netns show | grep cni-")
-
-      machine.shutdown()
-    '';
+            # Check that killall cleaned up properly
+            machine.fail("systemctl is-active k3s.service")
+            machine.fail("systemctl list-units | grep containerd")
+            machine.fail("ip link show | awk -F': ' '{print $2}' | grep -e flannel -e cni0")
+            machine.fail("ip netns show | grep cni-")
+      '';
 
     meta.maintainers = lib.teams.k3s.members;
   }

pkgs/applications/editors/vscode/extensions/default.nix

@@ -2372,8 +2372,8 @@ let
         mktplcRef = {
           name = "Ionide-fsharp";
           publisher = "Ionide";
-          version = "7.26.6";
-          hash = "sha256-oLzOkb0C93HlUcBKOKMa3u/jsRY6n8fnapRg5Jiyass=";
+          version = "7.27.0";
+          hash = "sha256-NGl5uiR4taamA8lhH/qJT1nCfUhxCQ/XQ/oEZ9N9Q5Y=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/Ionide.Ionide-fsharp/changelog";

pkgs/applications/editors/vscode/generic.nix

@@ -15,7 +15,7 @@
   nss,
   nspr,
   xorg,
-  systemd,
+  systemdLibs,
   fontconfig,
   libdbusmenu,
   glib,
@@ -230,12 +230,12 @@ stdenv.mkDerivation (
       libgbm
       nss
       nspr
-      systemd
+      systemdLibs
       xorg.libxkbfile
     ];
 
     runtimeDependencies = lib.optionals stdenv.hostPlatform.isLinux [
-      (lib.getLib systemd)
+      systemdLibs
       fontconfig.lib
       libdbusmenu
       wayland

pkgs/applications/misc/opencpn/default.nix

@@ -43,6 +43,7 @@
   util-linux,
   wxGTK32,
   xorg,
+  xz,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -104,6 +105,7 @@ stdenv.mkDerivation (finalAttrs: {
     sqlite
     tinyxml
     wxGTK32
+    xz
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     alsa-utils

pkgs/applications/networking/browsers/chromium/info.json

@@ -798,7 +798,7 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "140.0.7339.80",
+    "version": "140.0.7339.127",
     "deps": {
       "depot_tools": {
         "rev": "7d1e2bdb9168718566caba63a170a67cdab2356b",
@@ -810,16 +810,16 @@
         "hash": "sha256-Z7bTto8BHnJzjvmKmcVAZ0/BrXimcAETV6YGKNTorQw="
       },
       "ungoogled-patches": {
-        "rev": "140.0.7339.80-1",
-        "hash": "sha256-jBRBph+rhSK6tmrSpCDN39VbSmvHnTquy1HBUQ6QFFY="
+        "rev": "140.0.7339.127-1",
+        "hash": "sha256-mhMudxJU2arMcmECS9+3ne9X66zyKq5WGc8PSx9RfLc="
       },
       "npmHash": "sha256-R2gOpfPOUAmnsnUTIvzDPHuHNzL/b2fwlyyfTrywEcI="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "670b6f192f4668d2ac2c06bd77ec3e4eeda7d648",
-        "hash": "sha256-tAiE11g/zymsOOjb64ZIA0GCGDV+6X5qlXUiU9vED/c=",
+        "rev": "9412745860d8c3dfed9cf38f5daa943b163f8c69",
+        "hash": "sha256-rAyS5AhWHL9+6N4+2PFYKPJjzErj8LfIm5ptcsTTV8E=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -889,8 +889,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "cbc4153da8d5796b0fbb3cf288e97bee19436191",
-        "hash": "sha256-lexJRf3EZexLgSuk8ziA+OUW+jTYlkXUPKHU/E6aUcY="
+        "rev": "a8c8a6febe630c6239a5e207530e9fac651ae373",
+        "hash": "sha256-GxWTdzSf7/9WIqrECdAEkibXve/ZpKpxJcNS+KnfNc0="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -1049,8 +1049,8 @@
       },
       "src/third_party/devtools-frontend/src": {
         "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "ab96665ae2cfcc054e0243461cfcb56bb016f71a",
-        "hash": "sha256-8G9OCH5xapLf83bXrKwygCrzwF8C9H2NfnIrDbL+uCc="
+        "rev": "5dbb6f71a9bd613c0403242c7c021652fbf155fd",
+        "hash": "sha256-tA+6iKBfJVrlT+1UH55vqa5JCONweZeD/zWfNHHD+Kw="
       },
       "src/third_party/dom_distiller_js/dist": {
         "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
@@ -1559,8 +1559,8 @@
       },
       "src/third_party/webrtc": {
         "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "847fe7905954f3ae883de2936415ff567aa9039b",
-        "hash": "sha256-kcK1kJdPCkXbEFuS+b6wKUBaKLXmkAEwVKp4/YWDv8s="
+        "rev": "36ea4535a500ac137dbf1f577ce40dc1aaa774ef",
+        "hash": "sha256-/3V/V0IrhOKcMAgs/C1qraqq+1pfopW8HKvGRmqLE0Q="
       },
       "src/third_party/wuffs/src": {
         "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",

pkgs/applications/networking/cluster/k3s/builder.nix

@@ -201,13 +201,9 @@ let
     sed --quiet '/# --- run the install process --/q;p' ${k3sRepo}/install.sh > install.sh
 
     # Let killall expect "containerd-shim" in the Nix store
-    to_replace="/data/\[\^/\]\*/bin/containerd-shim"
-    replacement="/nix/store/.*k3s-containerd.*/bin/containerd-shim"
-    changes=$(sed -i "s|$to_replace|$replacement| w /dev/stdout" install.sh)
-    if [ -z "$changes" ]; then
-      echo "failed to replace \"$to_replace\" in k3s installer script (install.sh)"
-      exit 1
-    fi
+    substituteInPlace install.sh \
+      --replace-fail '/data/[^/]*/bin/containerd-shim' \
+        '/nix/store/.*k3s-containerd.*/bin/containerd-shim'
 
     remove_matching_line() {
       line_to_delete=$(grep -n "$1" install.sh | cut -d : -f 1 || true)
@@ -453,12 +449,15 @@ buildGoModule (finalAttrs: {
   versionCheckProgramArg = "--version";
 
   passthru = {
-    inherit airgap-images;
-    k3sCNIPlugins = k3sCNIPlugins;
-    k3sContainerd = k3sContainerd;
-    k3sRepo = k3sRepo;
-    k3sRoot = k3sRoot;
-    k3sBundle = k3sBundle;
+    inherit
+      airgap-images
+      k3sCNIPlugins
+      k3sContainerd
+      k3sRepo
+      k3sRoot
+      k3sBundle
+      updateScript
+      ;
     tests =
       let
         mkTests =
@@ -469,7 +468,6 @@ buildGoModule (finalAttrs: {
           lib.mapAttrs (name: value: nixosTests.k3s.${name}.${k3s_version}) nixosTests.k3s;
       in
       mkTests k3sVersion;
-    updateScript = updateScript;
     imagesList = throw "k3s.imagesList was removed";
     airgapImages = throw "k3s.airgapImages was renamed to k3s.airgap-images";
     airgapImagesAmd64 = throw "k3s.airgapImagesAmd64 was renamed to k3s.airgap-images-amd64-tar-zst";

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -99,13 +99,13 @@
     "vendorHash": "sha256-YIn8akPW+DCVF0eYZxsmJxmrJuYhK4QLG/uhmmrXd4c="
   },
   "auth0": {
-    "hash": "sha256-mKpsTSa1peLXvxKaMQPlYhD26wkmjyPBF9D5s1yZO+k=",
+    "hash": "sha256-RnQq6dIaFfcix8uAmC2VJ5CLpaPXZjFYVbyPDEzqFFo=",
     "homepage": "https://registry.terraform.io/providers/auth0/auth0",
     "owner": "auth0",
     "repo": "terraform-provider-auth0",
-    "rev": "v1.27.0",
+    "rev": "v1.29.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-ERuWKsHV7rxQOaq6cwr9/DN/94L+OvDdPKPIjdbzVyo="
+    "vendorHash": "sha256-tS+LKp4n1SjCmdrJ0kbxrcUYR53NCsODD9Yiq8B8hok="
   },
   "avi": {
     "hash": "sha256-e8yzc3nRP0ktcuuKyBXydS9NhoceYZKzJcqCWOfaPL0=",
@@ -1445,13 +1445,13 @@
     "vendorHash": "sha256-djz3kNV+13Sz9prRPhWaWi50hvYXq3I3cp4neLexeEs="
   },
   "vault": {
-    "hash": "sha256-nY8NOE3VJCHkDeisWgxIHG6T1fQ8Jt6Nom2ELexuld0=",
+    "hash": "sha256-5jx6a2BfnugD41D6iK7wvOzmMPImxNHCiIix4+puRp4=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/vault",
     "owner": "hashicorp",
     "repo": "terraform-provider-vault",
-    "rev": "v5.2.1",
+    "rev": "v5.3.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-mfageWMx8YM4eipnf7u3CMgMYcY7l2e69vECD3o91rg="
+    "vendorHash": "sha256-qrztgFJ/WDTxP5565rnx2sAELFKQGOxFuEYqWQQYVVY="
   },
   "vcd": {
     "hash": "sha256-W+ffIT70IaePg3xfOaQgCjPTWTN3iSAYwkf+s+zkB84=",

pkgs/applications/networking/seafile-client/default.nix

@@ -1,10 +1,12 @@
 {
   lib,
   stdenv,
+  fetchpatch,
   fetchFromGitHub,
   pkg-config,
   cmake,
   qttools,
+  qt5compat,
   libuuid,
   seafile-shared,
   jansson,
@@ -25,6 +27,15 @@ stdenv.mkDerivation rec {
     hash = "sha256-ZMhU0uXAC3tH1e3ktiHhC5YCDwFOnILretPgjYYa9DQ=";
   };
 
+  patches = [
+    # https://github.com/NixOS/nixpkgs/issues/442063
+    (fetchpatch {
+      name = "fix_build_with_QT6.patch";
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/fix_build_with_QT6.diff?h=seafile-client&id=8bbd6e5017f03dbb368603b4313738b0d783ca2a";
+      hash = "sha256-N1fepqjTm/M17+TgwNTUecP/wGVlBuZEtTezFgJEeVM=";
+    })
+  ];
+
   nativeBuildInputs = [
     libuuid
     pkg-config
@@ -34,6 +45,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
+    qt5compat
     seafile-shared
     jansson
     libsearpc

pkgs/applications/window-managers/i3/lock.nix

@@ -29,6 +29,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-OyV6GSLnNV3GUqrfs3OBnIaBvicH2PXgeY4acOk5dR4=";
   };
 
+  separateDebugInfo = true;
   nativeBuildInputs = [
     meson
     ninja

pkgs/applications/window-managers/i3/status.nix

@@ -26,6 +26,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-bGf1LK5PE533ZK0cxzZWK+D5d1B5G8IStT80wG6vIgU=";
   };
 
+  separateDebugInfo = true;
   nativeBuildInputs = [
     meson
     ninja

pkgs/build-support/fetchdarcs/builder.sh

@@ -12,8 +12,8 @@ elif test -n "$context"; then
     tagflags="--context=$context"
 fi
 
-echo "getting $url $partial ${tagtext} into $out"
+echo "Cloning $url $partial ${tagtext} into $out"
 
-darcs get --lazy $tagflags "$url" "$out"
+darcs clone --lazy $tagflags "$url" "$out"
 # remove metadata, because it can change
 rm -rf "$out/_darcs"

pkgs/build-support/fetchdarcs/nix-prefetch-darcs

@@ -0,0 +1,184 @@
+#!/bin/sh
+set -eu
+
+quiet=
+name="fetchdarcs"
+repository=
+tag=
+context=
+darcs_hash=
+exp_hash=
+
+usage() {
+	echo "Usage: nix-prefetch-darcs [options] [REPOSITORY] [FILENAME [EXPECTED-HASH]]"
+	echo
+	echo "Options:"
+	echo "	--quiet               Suppress most error messages."
+	echo "	--name <NAME>         Symbolic store path name to use for the result."
+	echo "	--repo <REPOSITORY>   URL for the Darcs repository."
+	echo "	--tag <REGEXP>        Clone specified by tag matching a regular expression."
+	echo "	--context <FILENAME>  Clone specified by context file."
+	echo "	--darcs-hash <HASH>   Clone specified by hash. WARN: hash order is fickle by design."
+	echo "	--hash <HASH>         Expected hash."
+	echo "	--help                Show this help message."
+}
+
+# Argument parsing
+while [ $# -gt 0 ]; do
+	case "$1" in
+		--quiet)
+		  quiet=1; shift 1 ;;
+		--name)
+			name="$2"; shift 2 ;;
+		--repository)
+			repository="$2"; shift 2 ;;
+		--tag)
+			tag="$2"; shift 2 ;;
+		--context)
+			context="$2"; shift 2 ;;
+		--darcs-hash)
+			darcs_hash="$2"; shift 2 ;;
+		--hash)
+			exp_hash="$2"; shift 2 ;;
+		--help)
+			usage; exit 0 ;;
+		*)
+			# Positional arguments
+			if [ -z "$repository" ]; then
+				repository="$1"
+				shift
+			elif [ -z "$context" ]; then
+				context="$1"
+				shift
+			elif [ -z "$exp_hash" ]; then
+				exp_hash="$1"
+				shift
+			else
+				echo "Error: Too many arguments" >&2
+				usage
+				exit 1
+			fi
+			;;
+	esac
+done
+
+if [ -z "$repository" ]; then
+	echo "Error: URL for repository is required." >&2
+	echo >&2
+	usage
+	exit 1
+fi
+
+state_flag_count=0
+[ -n "$tag" ] && state_flag_count=$(( state_flag_count + 1 ))
+[ -n "$context" ] && state_flag_count=$(( state_flag_count + 1 ))
+[ -n "$darcs_hash" ] && state_flag_count=$(( state_flag_count + 1 ))
+
+if [ "$state_flag_count" -gt 1 ]; then
+	echo "Error: no more than 1 of --tag, --context, --darcs-hash flags can be set. $state_flag_count were set." >&2
+	echo >&2
+	usage
+	exit 1
+elif [ -n "$context" ]; then
+	if [ ! -s "$context" ]; then
+		echo "Error: context file must be readable & non-empty @ “$context”" >&2
+		echo >&2
+		usage
+		exit 1
+	else
+		context="$(realpath "$context")"
+	fi
+fi
+
+weak_hash=
+hash=
+hash_algo="${NIX_HASH_ALGO:-"sha256"}"
+hash_format="${hashFormat:-"--base32"}"
+final_path=
+final_context=
+
+# If the hash was given, a file with that hash may already be in the
+# store.
+if [ -n "$exp_hash" ]; then
+	final_path=$(nix-store --print-fixed-path --recursive "$hash_algo" "$exp_hash" "$name")
+	if ! nix-store --check-validity "$final_path" 2> /dev/null; then
+		final_path=""
+	fi
+	hash="$exp_hash"
+fi
+
+# If we don’t know the hash or a path with that hash doesn’t exist,
+# download the file and add it to the store.
+if [ -z "$final_path" ]; then
+	tmp_clone="$(realpath ${quiet:+--quiet} "$(mktemp ${quiet:+--quiet} -d --tmpdir darcs-clone-tmp-XXXXXXXX)")"
+	trap "rm -rf \"$tmp_clone\"" EXIT
+
+	clone_args="--lazy"
+	if [ -n "$quiet" ]; then
+		clone_args="$clone_args --quiet"
+	fi
+	if [ -n "$tag" ]; then
+		clone_args="$clone_args --tag=$tag"
+	elif [ -n "$context" ]; then
+		clone_args="$clone_args --context=$context"
+	elif [ -n "$darcs_hash" ]; then
+		clone_args="$clone_args --to-hash=$darcs_hash"
+	fi
+
+	cd "$tmp_clone"
+	# Do not print Darcs progress to stdout (else stdout isn’t parsable JSON)
+	if [ -t 1 ]; then
+		darcs clone $clone_args "$repository" "$name" >/dev/tty
+	else
+		darcs clone $clone_args "$repository" "$name" >/dev/null
+	fi
+	cd "$tmp_clone/$name"
+	# Will put the current Darcs context into the store.
+	new_context="$tmp_clone/${name}-context.txt"
+	darcs log --context > "$new_context"
+	final_context="$(nix-store --add-fixed "$hash_algo" "$new_context")"
+	# Darcs has a weak hash using the XOR of the patch hashes which is useful
+	# for other scripts
+	# https://darcs.net/Internals/Hashes
+	weak_hash="$(darcs show repo | grep '^ *Weak Hash:' | cut -d: -f2- | tr -d "[:space:]")"
+	cd - >/dev/null
+	rm -rf "$tmp_clone/$name/_darcs"
+
+	hash="$(nix-hash --type "$hash_algo" "$hash_format" "$tmp_clone/$name")"
+	final_path=$(nix-store --add-fixed --recursive "$hash_algo" "$tmp_clone/$name")
+
+	if [ -n "$exp_hash" ] && [ "$exp_hash" != "$hash" ]; then
+		echo "Hash mismatch for “$repository”" >&2
+		echo "Expected: $exp_hash" >&2
+		echo "Got:      $hash" >&2
+		exit 1
+	fi
+fi
+
+json_escape() {
+	printf '%s' "$1" | jq -Rs .
+}
+
+cat <<EOF
+{
+	"repository": $(json_escape "$repository"),
+EOF
+if [ -n "$tag" ]; then cat <<EOF
+	"tag": "$(json_escape "$tag")",
+EOF
+elif [ -n "$darcs_hash" ]; then cat <<EOF
+	"darcs-hash": $(json_escape "$darcs_hash"),
+EOF
+fi; if [ -n "$weak_hash" ]; then cat <<EOF
+	"weak-hash": $(json_escape "$weak_hash"),
+EOF
+fi; if [ -s "$final_context" ]; then cat <<EOF
+	"context": $(json_escape "$final_context"),
+EOF
+fi; cat <<EOF
+	"path": "$final_path",
+	$(json_escape "$hash_algo"): $(json_escape "$hash"),
+	"hash": "$(nix-hash --to-sri --type "$hash_algo" "$hash")"
+}
+EOF
+# vim: noet ci pi sts=0

pkgs/by-name/ab/abduco/package.nix

@@ -9,10 +9,11 @@
 
 let
   rev = "8c32909a159aaa9484c82b71f05b7a73321eb491";
+  defaultUserConfig = writeText "config.def.h" conf;
 in
 stdenv.mkDerivation {
   pname = "abduco";
-  version = "unstable-2020-04-30";
+  version = "0.6.0-unstable-2020-04-30";
 
   src = fetchzip {
     urls = [
@@ -22,17 +23,18 @@ stdenv.mkDerivation {
     hash = "sha256-o7SPK/G31cW/rrLwV3UJOTq6EBHl6AEE/GdeKGlHdyg=";
   };
 
-  preBuild = lib.optionalString (conf != null) "cp ${writeText "config.def.h" conf} config.def.h";
+  configureFlags = lib.optionals stdenv.hostPlatform.isDarwin [ "-D_DARWIN_C_SOURCE" ];
+
+  preBuild = lib.optionalString (conf != null) "cp ${defaultUserConfig} config.def.h";
 
   installFlags = [ "install-completion" ];
-  CFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-D_DARWIN_C_SOURCE";
 
   patches = [
     # https://github.com/martanne/abduco/pull/22
     (fetchpatch {
       name = "use-XDG-directory-scheme-by-default";
       url = "https://github.com/martanne/abduco/commit/0e9a00312ac9777edcb169122144762e3611287b.patch";
-      sha256 = "sha256-4NkIflbRkUpS5XTM/fxBaELpvlZ4S5lecRa8jk0XC9g=";
+      hash = "sha256-4NkIflbRkUpS5XTM/fxBaELpvlZ4S5lecRa8jk0XC9g=";
     })
 
     # “fix bug where attaching to dead session won't give underlying exit code”
@@ -40,7 +42,7 @@ stdenv.mkDerivation {
     (fetchpatch {
       name = "exit-code-when-attaching-to-dead-session";
       url = "https://github.com/martanne/abduco/commit/972ca8ab949ee342569dbd66b47cc4a17b28247b.patch";
-      sha256 = "sha256-8hios0iKYDOmt6Bi5NNM9elTflGudnG2xgPF1pSkHI0=";
+      hash = "sha256-8hios0iKYDOmt6Bi5NNM9elTflGudnG2xgPF1pSkHI0=";
     })
 
     # “report pixel sizes to child processes that use ioctl(0, TIOCGWINSZ, ...)”
@@ -49,7 +51,7 @@ stdenv.mkDerivation {
     (fetchpatch {
       name = "report-pixel-sizes-to-child-processes";
       url = "https://github.com/martanne/abduco/commit/a1e222308119b3251f00b42e1ddff74a385d4249.patch";
-      sha256 = "sha256-eiF0A4IqJrrvXxjBYtltuVNpxQDv/iQPO+K7Y8hWBGg=";
+      hash = "sha256-eiF0A4IqJrrvXxjBYtltuVNpxQDv/iQPO+K7Y8hWBGg=";
     })
   ];
 

pkgs/by-name/al/algolia-cli/package.nix

@@ -5,7 +5,7 @@
   installShellFiles,
 }:
 let
-  version = "1.7.0";
+  version = "1.7.1";
 in
 buildGoModule {
   pname = "algolia-cli";
@@ -15,10 +15,10 @@ buildGoModule {
     owner = "algolia";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-j8OCN+iV5sMjgYTMGCc72JPImuFFvehKw4S99l+YWhs=";
+    hash = "sha256-XaPod/8MwucNXzTfMkF2Sr8i8U5RKJs/RfBxDjJK4vU=";
   };
 
-  vendorHash = "sha256-qzgkcmRuXHM9aMQGBObUHYH9qpWnDfTvwdx1A4it8aQ=";
+  vendorHash = "sha256-zDhsJ9iUKm0RzALVlvZDIPYaTqfIDIuUWAU+h5gp4Es=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/am/amneziawg-go/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "amneziawg-go";
-  version = "0.2.13";
+  version = "0.2.15";
 
   src = fetchFromGitHub {
     owner = "amnezia-vpn";
     repo = "amneziawg-go";
     tag = "v${version}";
-    hash = "sha256-vXSPUGBMP37kXJ4Zn5TDLAzG8N+yO/IIj9nSKrZ+sFA=";
+    hash = "sha256-xz807BLNoh1sMfyDXMAXPU9mHSxfxI3k5ayEVQM+HH0=";
   };
 
   postPatch = ''
@@ -21,7 +21,7 @@ buildGoModule rec {
     rm -f format_test.go
   '';
 
-  vendorHash = "sha256-9OtIb3UQXpAA0OzPhDIdb9lXZQHHiYCcmjHAU+vCtpk=";
+  vendorHash = "sha256-VYDc6oI0CqW1T3tVX0CWQLfLIOvqHCawVA8BWASWLLY=";
 
   subPackages = [ "." ];
 

pkgs/by-name/an/andcli/package.nix

@@ -8,7 +8,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "andcli";
-  version = "2.3.0";
+  version = "2.4.0";
 
   subPackages = [ "cmd/andcli" ];
 
@@ -16,10 +16,10 @@ buildGoModule (finalAttrs: {
     owner = "tjblackheart";
     repo = "andcli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-umV0oJ4sySnZzrIpRuTP/fT8a9nhkC1shVEfVVRpEyI=";
+    hash = "sha256-YGtBLx0Wt9Pn3V0+J9zFX9aBGWFJ8V8ordsSG4CSmxc=";
   };
 
-  vendorHash = "sha256-lzmkNxQUqktnl2Rpjgoa2yvAuGiMtVGNhiuF40how4o=";
+  vendorHash = "sha256-652JLCdxDDvhQIz3EbfoI7h+41Er3TiuJXi1cqbA4nI=";
 
   ldflags = [
     "-s"

pkgs/by-name/as/aseprite/package.nix

@@ -22,6 +22,7 @@
   libXext,
   libXi,
   libXxf86vm,
+  libxcb,
   ninja,
   pcre2,
   pixman,
@@ -87,6 +88,7 @@ clangStdenv.mkDerivation (finalAttrs: {
     libXext
     libXi
     libXxf86vm
+    libxcb
     pcre2
     pixman
     skia-aseprite

pkgs/by-name/ba/backlight-auto/package.nix

@@ -1,37 +0,0 @@
-{
-  lib,
-  stdenv,
-  zig,
-  libyuv,
-  fetchFromGitHub,
-}:
-stdenv.mkDerivation (finalAttrs: {
-  pname = "backlight-auto";
-  version = "0.0.1";
-
-  src = fetchFromGitHub {
-    owner = "lf94";
-    repo = "backlight-auto";
-    rev = finalAttrs.version;
-    hash = "sha256-QPymwlDrgKM/SXDzJdmfzWLSLU2D7egif1OIUE+SHoI=";
-  };
-
-  nativeBuildInputs = [
-    zig.hook
-  ];
-
-  buildInputs = [
-    libyuv
-  ];
-
-  meta = with lib; {
-    # Does not support zig 0.12 or newer, hasn't been updated in 2 years.
-    broken = lib.versionAtLeast zig.version "0.12";
-    description = "Automatically set screen brightness with a webcam";
-    mainProgram = "backlight-auto";
-    homepage = "https://len.falken.directory/backlight-auto.html";
-    license = licenses.mit;
-    maintainers = [ ];
-    platforms = platforms.linux;
-  };
-})

pkgs/by-name/ba/baresip/package.nix

@@ -31,14 +31,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "4.0.0";
+  version = "4.1.0";
   pname = "baresip";
 
   src = fetchFromGitHub {
     owner = "baresip";
     repo = "baresip";
     rev = "v${version}";
-    hash = "sha256-Kun6fcDy7JQU0zrHfNxv9cV77Bm/WNrgrrGqCzrgTJ4=";
+    hash = "sha256-KbjdwvXUiNvHb6AXt38M9gkhliiie+8frvuqYJEsnJE=";
   };
 
   patches = [

pkgs/by-name/ca/cargo-hack/package.nix

@@ -6,14 +6,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-hack";
-  version = "0.6.37";
+  version = "0.6.38";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-OlWSyp3et/48x5lRE14pIny8HHQcgOV2f9mI9hcj8K4=";
+    hash = "sha256-gKuc7FTBlWasRb59IvzFT54I7aY3MjNAkl2YCVZzl6Q=";
   };
 
-  cargoHash = "sha256-1FgFHnNCEGoBUbH+Uk67W9ufsGtr9uGdzJz0xZuPQ9U=";
+  cargoHash = "sha256-TRtz6OVYyt/sHVMoR5wDRbAPVvB33d8kSSTlO6JJkdM=";
 
   # some necessary files are absent in the crate version
   doCheck = false;

pkgs/by-name/cd/cdncheck/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "cdncheck";
-  version = "1.1.34";
+  version = "1.1.35";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "cdncheck";
     tag = "v${version}";
-    hash = "sha256-I/wmKKrXFjaha2sq9l/zFJkkDf6DNNeSAOBcKmnOZNg=";
+    hash = "sha256-/ZVR4cGqUIjtiESNYFdedlYuQvLpgs1M/yyBveTF6b4=";
   };
 
   vendorHash = "sha256-/1REkZ5+sz/H4T4lXhloz7fu5cLv1GoaD3dlttN+Qd4=";

pkgs/by-name/ce/certinfo/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "certinfo";
-  version = "1.0.24";
+  version = "1.0.37";
 
   src = fetchFromGitHub {
     owner = "pete911";
     repo = "certinfo";
     rev = "v${version}";
-    sha256 = "sha256-BI5gYWKGMU0wLvnArG41bLWj+9ipe/GARKRX0fwz4ag=";
+    sha256 = "sha256-0nJGIEqS3Dz0qmlX2k6POGK8cs05ENMDJsvoIhpPKpM=";
   };
 
   # clipboard functionality not working on Darwin

pkgs/by-name/ch/chkrootkit/package.nix

@@ -1,42 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  makeWrapper,
-  binutils-unwrapped,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "chkrootkit";
-  version = "0.58b";
-
-  src = fetchurl {
-    url = "ftp://ftp.chkrootkit.org/pub/seg/pac/${pname}-${version}.tar.gz";
-    sha256 = "sha256-de0qzoHw+j6cP7ZNqw6IV+1ZJH6nVfWJhBb+ssZoB7k=";
-  };
-
-  # TODO: a lazy work-around for linux build failure ...
-  makeFlags = [ "STATIC=" ];
-
-  nativeBuildInputs = [ makeWrapper ];
-
-  postPatch = ''
-    substituteInPlace chkrootkit \
-      --replace " ./" " $out/bin/"
-  '';
-
-  installPhase = ''
-    mkdir -p $out/sbin
-    cp check_wtmpx chkdirs chklastlog chkproc chkrootkit chkutmp chkwtmp ifpromisc strings-static $out/sbin
-
-    wrapProgram $out/sbin/chkrootkit \
-      --prefix PATH : "${lib.makeBinPath [ binutils-unwrapped ]}"
-  '';
-
-  meta = with lib; {
-    description = "Locally checks for signs of a rootkit";
-    homepage = "https://www.chkrootkit.org/";
-    license = licenses.bsd2;
-    platforms = with platforms; linux;
-  };
-}

pkgs/by-name/co/codecrafters-cli/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "codecrafters-cli";
-  version = "37";
+  version = "39";
 
   src = fetchFromGitHub {
     owner = "codecrafters-io";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-MxeWShst5QZPXImXnCEGYSVzqB4HNygewrQxpwmfafk=";
+    hash = "sha256-yvKPDuORHySSYnsjAW3SrZ9GcrFaGfJYoG7+9IfQEVc=";
     # A shortened git commit hash is part of the version output, and is
     # needed at build time. Use the `.git` directory to retrieve the
     # commit SHA, and remove the directory afterwards since it is not needed

pkgs/by-name/co/complgen/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "complgen";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "adaszko";
     repo = "complgen";
     rev = "v${version}";
-    hash = "sha256-RSNOpe2VCNw9TJGD7QuuZT9WOdA6AFFcF9AOg4/+94w=";
+    hash = "sha256-GgGFlrAJN9w+bsoXmVJaYUyx/ViH9m4E4EeJlmWRo6o=";
   };
 
-  cargoHash = "sha256-0e3PTetpWjagBuagfkdsNfn1k+rEbzOJJONMXv7G96o=";
+  cargoHash = "sha256-JexvR/djdRGq3BsOWfEhFCbTe3OaP/jqQgiO+RkK1Tg=";
 
   meta = with lib; {
     description = "Generate {bash,fish,zsh} completions from a single EBNF-like grammar";

pkgs/by-name/do/doctl/package.nix

@@ -9,7 +9,7 @@
 
 buildGoModule rec {
   pname = "doctl";
-  version = "1.141.0";
+  version = "1.142.0";
 
   vendorHash = null;
 
@@ -42,7 +42,7 @@ buildGoModule rec {
     owner = "digitalocean";
     repo = "doctl";
     tag = "v${version}";
-    hash = "sha256-IZ/CP9xdupwkiOihZuf/MXEP2cnoJ/lqYUEsFDf/ITk=";
+    hash = "sha256-wbOO9jdGfy39GeGEwLURLpxhXt17sk6gQRUbz6ysSXc=";
   };
 
   meta = {

pkgs/by-name/do/double-entry-generator/package.nix

@@ -6,15 +6,15 @@
 }:
 buildGoModule rec {
   pname = "double-entry-generator";
-  version = "2.10.1";
+  version = "2.11.0";
   src = fetchFromGitHub {
     owner = "deb-sig";
     repo = "double-entry-generator";
-    hash = "sha256-zAkiTUnuk6o2wFta1hG0RRD8/LIdgNFcSYvQ0Y2zeJY=";
+    hash = "sha256-tHJwn1G/2wySnKpF+P0tyOu3mYk8zD9D301kxrWaWws=";
     rev = "v${version}";
   };
 
-  vendorHash = "sha256-NoWUaawApdTSWGRul9mpOxgRZWTE7LTz3pJgwU2NWVU=";
+  vendorHash = "sha256-CJ+mfH9qJXYhicxrL9+i8H6CVKZua40D1/Sg3vWQs68=";
 
   excludedPackages = [ "hack" ];
 

pkgs/by-name/dy/dysk/package.nix

@@ -37,6 +37,6 @@ rustPlatform.buildRustPackage rec {
       koral
     ];
     mainProgram = "dysk";
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
   };
 }

pkgs/by-name/fa/fanbox-dl/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "fanbox-dl";
-  version = "0.27.4";
+  version = "0.28.0";
 
   src = fetchFromGitHub {
     owner = "hareku";
     repo = "fanbox-dl";
     rev = "v${version}";
-    hash = "sha256-zccTxLEbKAErgVVaL+CPYD9GCPCAjGYnOiyGBGDmSzg=";
+    hash = "sha256-yrSA9CavQgu89hl+x578geC35KvamfAPOSg33woVI8w=";
   };
 
-  vendorHash = "sha256-BZebo50HEKIk1z0LJg8kE1adovyAk67L6jsiaNcpeDY=";
+  vendorHash = "sha256-uhNitrJeFuFG2XyQrc1JBbExoU6Ln6AFRO2Bgb1+N5M=";
 
   # pings websites during testing
   doCheck = false;

pkgs/by-name/fa/fancy-cat/package.nix

@@ -12,7 +12,7 @@
   mupdf,
   openjpeg,
   stdenv,
-  zig,
+  zig_0_14,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "fancy-cat";
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
   patches = [ ./0001-changes.patch ];
 
   nativeBuildInputs = [
-    zig.hook
+    zig_0_14.hook
   ];
 
   zigBuildFlags = [ "--release=fast" ];
@@ -56,6 +56,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.agpl3Plus;
     maintainers = with lib.maintainers; [ ciflire ];
     mainProgram = "fancy-cat";
-    inherit (zig.meta) platforms;
+    inherit (zig_0_14.meta) platforms;
   };
 })

pkgs/by-name/gf/gftp/package.nix

@@ -2,12 +2,10 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  autoconf,
-  automake,
+  meson,
+  ninja,
   gettext,
   gtk2,
-  intltool,
-  libtool,
   ncurses,
   openssl,
   pkg-config,
@@ -18,21 +16,19 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gftp";
-  version = "2.9.1b";
+  version = "2.9.1b-unstable-2025-05-12";
 
   src = fetchFromGitHub {
     owner = "masneyb";
     repo = "gftp";
-    tag = finalAttrs.version;
-    hash = "sha256-0zdv2oYl24BXh61IGCWby/2CCkzNjLpDrAFc0J89Pw4=";
+    rev = "48114635f7b7b1f9a5eda985021ea53b10a7a030";
+    hash = "sha256-unTsd2xX8Y71ItE3gYHoxUPgViK/xhZdx0IQYvDPaEc=";
   };
 
   nativeBuildInputs = [
-    autoconf
-    automake
+    meson
+    ninja
     gettext
-    intltool
-    libtool
     pkg-config
   ];
 
@@ -43,28 +39,14 @@ stdenv.mkDerivation (finalAttrs: {
     readline
   ];
 
-  # https://github.com/masneyb/gftp/issues/178
-  postPatch = ''
-    substituteInPlace lib/gftp.h \
-      --replace-fail "size_t remote_addr_len" "socklen_t remote_addr_len"
-  '';
-
-  preConfigure = ''
-    ./autogen.sh
-  '';
-
   hardeningDisable = [ "format" ];
 
-  doInstallCheck = true;
-  nativeInstallCheckInputs = [ versionCheckHook ];
-
-  passthru.updateScript = nix-update-script { };
-
   meta = {
     homepage = "https://github.com/masneyb/gftp";
     description = "GTK-based multithreaded FTP client for *nix-based machines";
     license = lib.licenses.gpl2Plus;
     maintainers = [ lib.maintainers.haylin ];
     platforms = lib.platforms.unix;
+    mainProgram = "gftp";
   };
 })

pkgs/by-name/gi/git-statuses/package.nix

@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "git-statuses";
-  version = "0.5.1";
+  version = "0.6.1";
 
   src = fetchFromGitHub {
     owner = "bircni";
     repo = "git-statuses";
     tag = finalAttrs.version;
-    hash = "sha256-nuWtW1NEECBqQ5uZKRqnvbjMUeYBg04j51zrHi/SDm0=";
+    hash = "sha256-phGEp9wo46owe47H+XjfDD5OlcN8cGr1oaeYMpkWies=";
   };
 
-  cargoHash = "sha256-WAr5AkT4C14HupJHHZi209jtE8a9IUwOCw76cYu8Yjc=";
+  cargoHash = "sha256-yG5oSwnhoFVbwdTteRgW1ljVmTnxoh8l4gG/pGuRmic=";
 
   # Needed to get openssl-sys to use pkg-config.
   env.OPENSSL_NO_VENDOR = 1;

pkgs/by-name/gi/github-desktop/package.nix

@@ -15,7 +15,7 @@
   alsa-lib,
   cups,
   libgbm,
-  systemd,
+  systemdLibs,
   openssl,
   libglvnd,
 }:
@@ -92,7 +92,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   '';
 
   runtimeDependencies = [
-    (lib.getLib systemd)
+    systemdLibs
   ];
 
   meta = {

pkgs/by-name/go/google-chrome/package.nix

@@ -170,11 +170,11 @@ let
 
   linux = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "140.0.7339.80";
+    version = "140.0.7339.127";
 
     src = fetchurl {
       url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb";
-      hash = "sha256-9hNwMWUbtWsDvKc9hvfbI7PNVYm1L1mBLuXPlDzIG40=";
+      hash = "sha256-ZA23AsqHHznRoegQlDvPRvUfgA7bPQp2HMETFuAsqA8=";
     };
 
     # With strictDeps on, some shebangs were not being patched correctly
@@ -275,11 +275,11 @@ let
 
   darwin = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "140.0.7339.81";
+    version = "140.0.7339.133";
 
     src = fetchurl {
-      url = "http://dl.google.com/release2/chrome/ockuail56dwhuxixexwh6zhrhm_140.0.7339.81/GoogleChrome-140.0.7339.81.dmg";
-      hash = "sha256-81TTdxKGHzLgSXSY2TVxY8JEjFZ6FZOhq3UuGvC0XAE=";
+      url = "http://dl.google.com/release2/chrome/fzn7lmun4oavjxo5gnqutqwcny_140.0.7339.133/GoogleChrome-140.0.7339.133.dmg";
+      hash = "sha256-nnmQOzN0U8ZMl9/3iF6eTfC8LjkfCfYa8B5kQs36rmA=";
     };
 
     dontPatch = true;

pkgs/by-name/gr/gren/generated-backend-package.nix

@@ -29,11 +29,11 @@
 }:
 mkDerivation {
   pname = "gren";
-  version = "0.6.2";
+  version = "0.6.3";
   src = fetchgit {
     url = "https://github.com/gren-lang/compiler.git";
-    sha256 = "1c0fcdc87nmm26hk6c1k4djdk7ld9488fldx8mhwayqfsx0v2d3x";
-    rev = "0343e77040f97864e5eb9790dd9ba0bb5fe1d6ee";
+    sha256 = "0p93wamff539pb242lib2wyfr6alqz96rpyh9xb0a61ix0j3miiz";
+    rev = "54277a25d47b5c20816550ff6deab89026797526";
     fetchSubmodules = true;
   };
   isLibrary = false;

pkgs/by-name/gr/gren/package.nix

@@ -11,22 +11,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gren";
-  version = "0.6.2";
+  version = "0.6.3";
 
   src = fetchFromGitHub {
     owner = "gren-lang";
     repo = "compiler";
     tag = finalAttrs.version;
-    hash = "sha256-fTSxQdcOe8VhRb1RhxBJjZ7ZZCMzMDOhEbXag1hjDrA=";
+    hash = "sha256-P8Y6JOgxGAVWT9DfbNLHVJnsPBcrUkHEumkU56riI10=";
   };
 
-  buildInputs = [
-    nodejs
-  ];
+  buildInputs = [ nodejs ];
 
-  nativeBuildInputs = [
-    makeBinaryWrapper
-  ];
+  nativeBuildInputs = [ makeBinaryWrapper ];
 
   installPhase = ''
     runHook preInstall
@@ -55,6 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Programming language for simple and correct applications";
     homepage = "https://gren-lang.org";
     license = lib.licenses.bsd3;
+    platforms = lib.intersectLists haskellPackages.ghc.meta.platforms nodejs.meta.platforms;
     mainProgram = "gren";
     maintainers = with lib.maintainers; [
       robinheghan

pkgs/by-name/ke/kent/package.nix

@@ -1,6 +1,7 @@
 {
   lib,
   stdenv,
+  writableTmpDirAsHomeHook,
   libpng,
   libuuid,
   zlib,
@@ -12,18 +13,23 @@
   bash,
   fetchFromGitHub,
   which,
+  writeShellScript,
+  jq,
+  nix-update,
 }:
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "kent";
-  version = "468";
+  version = "486";
 
   src = fetchFromGitHub {
     owner = "ucscGenomeBrowser";
     repo = "kent";
-    rev = "v${version}_base";
-    hash = "sha256-OM/noraW2X8WV5wqWEFiI5/JPOBmsp0fTeDdcZoXxAA=";
+    tag = "v${finalAttrs.version}_base";
+    hash = "sha256-NffQ04+5rMtG/VI7YFK4Ff39DDhdh9Wlc0i1iVbg8Js=";
   };
 
+  nativeBuildInputs = [ writableTmpDirAsHomeHook ];
+
   buildInputs = [
     libpng
     libuuid
@@ -37,10 +43,10 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace ./src/checkUmask.sh \
-      --replace "/bin/bash" "${bash}/bin/bash"
+      --replace-fail "/bin/bash" "${bash}/bin/bash"
 
     substituteInPlace ./src/hg/sqlEnvTest.sh \
-      --replace "which mysql_config" "${which}/bin/which ${libmysqlclient}/bin/mysql_config"
+      --replace-fail "which mysql_config" "${which}/bin/which ${libmysqlclient}/bin/mysql_config"
   '';
 
   buildPhase = ''
@@ -50,7 +56,6 @@ stdenv.mkDerivation rec {
     export CFLAGS="-fPIC"
     export MYSQLINC=$(mysql_config --include | sed -e 's/^-I//g')
     export MYSQLLIBS=$(mysql_config --libs)
-    export HOME=$TMPDIR
     export DESTBINDIR=$HOME/bin
 
     mkdir -p $HOME/lib $HOME/bin/${stdenv.hostPlatform.parsed.cpu.name}
@@ -85,12 +90,17 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
+  passthru.updateScript = writeShellScript "update-kent" ''
+    latestVersion=$(curl ''${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} --fail --silent https://api.github.com/repos/ucscGenomeBrowser/kent/releases/latest | ${lib.getExe jq} --raw-output .tag_name | grep -oP '(?<=v)\d+')
+    ${lib.getExe nix-update} kent --version $latestVersion
+  '';
+
   meta = {
     description = "UCSC Genome Bioinformatics Group's suite of biological analysis tools, i.e. the kent utilities";
     homepage = "http://genome.ucsc.edu";
-    changelog = "https://github.com/ucscGenomeBrowser/kent/releases/tag/v${version}_base";
+    changelog = "https://github.com/ucscGenomeBrowser/kent/releases/tag/v${finalAttrs.version}_base";
     license = lib.licenses.unfree;
     maintainers = with lib.maintainers; [ scalavision ];
     platforms = lib.platforms.linux;
   };
-}
+})

pkgs/by-name/le/leocad/package.nix

@@ -19,20 +19,20 @@
 
 let
   parts = fetchurl {
-    url = "https://web.archive.org/web/20241230062818/https://library.ldraw.org/library/updates/complete.zip";
-    hash = "sha256-0RIJYEU+MpE4MSfxk2HK5hQd8IsiPn2xEGUFmItzlk8=";
+    url = "https://web.archive.org/web/20250709230715/https://library.ldraw.org/library/updates/complete.zip";
+    hash = "sha256-Uy7YYE7LdcmgEGbt6DlljS3QCQxjcviLApFuu1p9GZ8=";
   };
 
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "leocad";
-  version = "23.03";
+  version = "25.09";
 
   src = fetchFromGitHub {
     owner = "leozide";
     repo = "leocad";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-IY9mr2gSMZL9pxiVTKH/f7rjsOvBDNgwVKpXA57oMGo=";
+    hash = "sha256-Utiy9JBKaPddb2yNv1Ta61KIB1vCsayZlxagn3or5UE=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/li/libcomps/package.nix

@@ -14,7 +14,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libcomps";
-  version = "0.1.22";
+  version = "0.1.23";
 
   outputs = [
     "out"
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     owner = "rpm-software-management";
     repo = "libcomps";
     rev = version;
-    hash = "sha256-zaUQbMYL9wIzqs3cQwPY1B2UZ7DwkksTxeFugol0FRk=";
+    hash = "sha256-6nX6Oa2ACVALOtXDxjowIGKaziZkGZbtkgZzDfuP4PE=";
   };
 
   patches = [

pkgs/by-name/li/libcouchbase/package.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libcouchbase";
-  version = "3.3.17";
+  version = "3.3.18";
 
   src = fetchFromGitHub {
     owner = "couchbase";
     repo = "libcouchbase";
     rev = version;
-    sha256 = "sha256-YHPfdjt8ME9nkgv6wF9IyEQoT4PpanbAbvcqqWOU+GY=";
+    sha256 = "sha256-+6RrApyml/FPv8pRjmwY1yuZIX1YXNKqdeNjP1y4cbU=";
   };
 
   cmakeFlags = [ "-DLCB_NO_MOCK=ON" ];

pkgs/by-name/li/libei/package.nix

@@ -23,14 +23,14 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "libei";
-  version = "1.4.1";
+  version = "1.5.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "libinput";
     repo = "libei";
     rev = version;
-    hash = "sha256-DoPQaTry1uzu6sM/wWEl4xeGq3h3BuMDeVYusHge6AI=";
+    hash = "sha256-PqQpJz88tDzjwsBuwxpWcGAWz6Gp6A/oAOS87uxGOGs=";
   };
 
   buildInputs = [

pkgs/by-name/ll/llama-cpp/package.nix

@@ -30,7 +30,9 @@
   metalSupport ? stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64 && !openclSupport,
   vulkanSupport ? false,
   rpcSupport ? false,
+  apple-sdk_14,
   curl,
+  llama-cpp,
   shaderc,
   vulkan-headers,
   vulkan-loader,
@@ -119,6 +121,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
     ++ optionals rocmSupport rocmBuildInputs
     ++ optionals blasSupport [ blas ]
     ++ optionals vulkanSupport vulkanBuildInputs
+    ++ optionals metalSupport [ apple-sdk_14 ]
     ++ [ curl ];
 
   preConfigure = ''
@@ -173,25 +176,31 @@ effectiveStdenv.mkDerivation (finalAttrs: {
   # the tests are failing as of 2025-08
   doCheck = false;
 
-  passthru.updateScript = nix-update-script {
-    attrPath = "llama-cpp";
-    extraArgs = [
-      "--version-regex"
-      "b(.*)"
-    ];
+  passthru = {
+    tests = {
+      metal = llama-cpp.override { metalSupport = true; };
+    };
+    updateScript = nix-update-script {
+      attrPath = "llama-cpp";
+      extraArgs = [
+        "--version-regex"
+        "b(.*)"
+      ];
+    };
   };
 
-  meta = with lib; {
+  meta = {
     description = "Inference of Meta's LLaMA model (and others) in pure C/C++";
     homepage = "https://github.com/ggml-org/llama.cpp";
-    license = licenses.mit;
+    license = lib.licenses.mit;
     mainProgram = "llama";
-    maintainers = with maintainers; [
+    maintainers = with lib.maintainers; [
+      booxter
       dit7ya
       philiptaron
       xddxdd
     ];
-    platforms = platforms.unix;
+    platforms = lib.platforms.unix;
     badPlatforms = optionals (cudaSupport || openclSupport) lib.platforms.darwin;
     broken = metalSupport && !effectiveStdenv.hostPlatform.isDarwin;
   };

pkgs/by-name/me/mesos-dns/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "mesos-dns";
-  version = "0.9.3";
+  version = "0.9.4";
 
   src = fetchFromGitHub {
     owner = "m3scluster";
     repo = "mesos-dns";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/zcjQ2AxZ17rAxrRmfztj5gH1pu2QswJgaCE022FieU=";
+    hash = "sha256-InUuEJjfZTRToCGiC3QYDK7UY8vje0T8RQ2YElIkb2w=";
   };
 
-  vendorHash = "sha256-TSw6ui5nGHRJiT/W+iszKA0rtgUIf73yDJaHkUgqowk=";
+  vendorHash = "sha256-l1y3CaGG1ykJnGit81D+E+jB4RUYneQzRMTvOPCH+jk=";
 
   subPackages = [ "." ];
 

pkgs/by-name/mi/miniaudio/package.nix

@@ -3,38 +3,66 @@
   stdenv,
   fetchFromGitHub,
   testers,
+
+  cmake,
+  ninja,
+
+  alsa-lib,
+  libjack2,
+  libpulseaudio,
+  libvorbis,
+  opusfile,
+  sndio,
+
+  alsaSupport ? true,
+  pulseSupport ? true,
+  jackSupport ? true,
+  sndioSupport ? true,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "miniaudio";
-  version = "0.11.22";
+  version = "0.11.23";
 
   src = fetchFromGitHub {
     owner = "mackron";
     repo = "miniaudio";
-    rev = finalAttrs.version;
-    hash = "sha256-o/7sfBcrhyXEakccOAogQqm8dO4Szj1QSpaIHg6OSt4=";
+    tag = finalAttrs.version;
+    hash = "sha256-ZrfKw5a3AtIER2btCKWhuvygasNaHNf9EURf1Kv96Vc=";
   };
 
-  postInstall = ''
-    mkdir -p $out/include
-    mkdir -p $out/lib/pkgconfig
+  outputs = [
+    "out"
+    "dev"
+  ];
 
-    cp $src/miniaudio.h $out/include
-    ln -s $out/include/miniaudio.h $out
+  nativeBuildInputs = [
+    cmake
+    ninja
+  ];
 
-    cp -r $src/extras $out/
+  buildInputs = [
+    libvorbis
+    opusfile
+  ]
+  ++ lib.optional pulseSupport libpulseaudio
+  ++ lib.optional jackSupport libjack2
+  ++ lib.optional alsaSupport alsa-lib
+  ++ lib.optional sndioSupport sndio;
 
-    cat <<EOF >$out/lib/pkgconfig/miniaudio.pc
-    prefix=$out
-    includedir=$out/include
+  cmakeFlags = [
+    (lib.cmakeBool "BUILD_SHARED_LIBS" (!stdenv.hostPlatform.isStatic))
+    (lib.cmakeBool "MINIAUDIO_NO_RUNTIME_LINKING" true)
+    (lib.cmakeBool "MINIAUDIO_BUILD_TESTS" true)
+    (lib.cmakeBool "MINIAUDIO_BUILD_EXAMPLES" true)
 
-    Name: miniaudio
-    Description: An audio playback and capture library in a single source file.
-    Version: $version
-    Cflags: -I$out/include
-    Libs: -lm -lpthread -latomic
-    EOF
-  '';
+    (lib.cmakeBool "MINIAUDIO_ENABLE_ONLY_SPECIFIC_BACKENDS" true)
+    (lib.cmakeBool "MINIAUDIO_ENABLE_PULSEAUDIO" pulseSupport)
+    (lib.cmakeBool "MINIAUDIO_ENABLE_JACK" jackSupport)
+    (lib.cmakeBool "MINIAUDIO_ENABLE_SNDIO" alsaSupport)
+    (lib.cmakeBool "MINIAUDIO_ENABLE_ALSA" sndioSupport)
+  ];
+
+  doCheck = true;
 
   passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
 
@@ -48,6 +76,6 @@ stdenv.mkDerivation (finalAttrs: {
     ];
     maintainers = [ maintainers.jansol ];
     pkgConfigModules = [ "miniaudio" ];
-    platforms = platforms.all;
+    platforms = platforms.linux;
   };
 })

pkgs/by-name/mo/moonlight/package.nix

@@ -8,13 +8,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "moonlight";
-  version = "1.3.27";
+  version = "1.3.28";
 
   src = fetchFromGitHub {
     owner = "moonlight-mod";
     repo = "moonlight";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-feWRxpNfnBj110DMlBqipe7wunqDZ8SvUvrtnnlePgk=";
+    hash = "sha256-aLjHKVWkb9XHyoMmDBxLG2Ycg4CJFeieLdEg3CWeIwk=";
   };
 
   nativeBuildInputs = [
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
     buildInputs = [ nodejs_22 ];
 
     fetcherVersion = 2;
-    hash = "sha256-Y+OusNJJUTVxa7D99Y/dJeJO4o0UDXFnY48Z2oGPF0Y=";
+    hash = "sha256-DvSBiUkIQbDkdgfHBw9h1odo3ApZq+emBDkbcQnx6NA=";
   };
 
   env = {

pkgs/by-name/ms/msmtp/package.nix

@@ -31,13 +31,13 @@
 let
   inherit (lib) getBin getExe optionals;
 
-  version = "1.8.30";
+  version = "1.8.31";
 
   src = fetchFromGitHub {
     owner = "marlam";
     repo = "msmtp";
     rev = "msmtp-${version}";
-    hash = "sha256-aM2qId08zvT9LbncCQYHsklbvHVtcZJgr91JTjwpQ/0=";
+    hash = "sha256-5PWwHyNEpF+eDMmvqJIHGdje70fCH5pLXGi5Jkjg2OA=";
   };
 
   meta = with lib; {

pkgs/by-name/nc/ncdu/package.nix

@@ -4,7 +4,7 @@
   fetchurl,
   ncurses,
   pkg-config,
-  zig_0_14,
+  zig_0_15,
   zstd,
   installShellFiles,
   versionCheckHook,
@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   nativeBuildInputs = [
-    zig_0_14.hook
+    zig_0_15.hook
     installShellFiles
     pkg-config
   ];
@@ -54,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
       defelo
       ryan4yin
     ];
-    inherit (zig_0_14.meta) platforms;
+    inherit (zig_0_15.meta) platforms;
     mainProgram = "ncdu";
   };
 })

pkgs/by-name/nr/nrsc5/package.nix

@@ -12,24 +12,22 @@
 }:
 let
   src_faad2 = fetchFromGitHub {
-    owner = "dsvensson";
+    owner = "knik0";
     repo = "faad2";
-    rev = "b7aa099fd3220b71180ed2b0bc19dc6209a1b418";
-    sha256 = "0pcw2x9rjgkf5g6irql1j4m5xjb4lxj6468z8v603921bnir71mf";
+    tag = "2.11.2";
+    hash = "sha256-JvmblrmE3doUMUwObBN2b+Ej+CDBWNemBsyYSCXGwo8=";
   };
 
-  version = "1.0";
-
 in
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "nrsc5";
-  inherit version;
+  version = "3.0.1";
 
   src = fetchFromGitHub {
     owner = "theori-io";
     repo = "nrsc5";
-    rev = "v${version}";
-    sha256 = "09zzh3h1zzf2lwrbz3i7rif2hw36d9ska8irvxaa9lz6xc1y68pg";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-chLoCXbEQaIrSHLQAm0++NGNYuQNCseSCR37qjXwW04=";
   };
 
   postUnpack = ''
@@ -44,10 +42,6 @@ stdenv.mkDerivation {
     sed -i '/GIT_REPOSITORY/d' CMakeLists.txt
     sed -i '/GIT_TAG/d' CMakeLists.txt
     sed -i "s:set (FAAD2_PREFIX .*):set (FAAD2_PREFIX \"$srcRoot/faad2-prefix\"):" CMakeLists.txt
-    # see https://github.com/dsvensson/faad2/pull/2
-    substituteInPlace $faadSrc/libfaad/pns.c \
-      --replace-fail 'r1_dep = __r1;' 'r1_dep = *__r1;' \
-      --replace-fail 'r2_dep = __r2;' 'r2_dep = *__r2;'
   '';
 
   nativeBuildInputs = [
@@ -75,4 +69,4 @@ stdenv.mkDerivation {
     maintainers = with maintainers; [ markuskowa ];
     mainProgram = "nrsc5";
   };
-}
+})

pkgs/by-name/ov/overpush/package.nix

@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "overpush";
-  version = "0.4.6";
+  version = "0.4.7";
 
   src = fetchFromGitHub {
     owner = "mrusme";
     repo = "overpush";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2EIOCeW/PuZFDmLShexnPomvx3PtGzZ6jWNvoJSxO7Q=";
+    hash = "sha256-I4i1HhqvliSFiL8rFhKF5qrfPsUuxDTE79V/Q7Js+xs=";
   };
 
-  vendorHash = "sha256-KUfGc4vFfw59mwqR840cbL4ubBH1i+sIniHU0CDCKTg=";
+  vendorHash = "sha256-2KUWWATRwwtA/1Nm2JQrDS8f0ZIca/f190DSNtjemZE=";
 
   env.CGO_ENABLED = "0";
 

pkgs/by-name/p2/p2pool/package.nix

@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "p2pool";
-  version = "4.9.1";
+  version = "4.10.1";
 
   src = fetchFromGitHub {
     owner = "SChernykh";
     repo = "p2pool";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-jjY/+ZS7UYecHTQT93WAUZYYc+CZpG4Vbotmsq65un0=";
+    hash = "sha256-oxUxgooIiesSyew8t/0asa/sEV4I8C+Firp5cLi0fnU=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/ri/river-bedload/package.nix

@@ -10,7 +10,7 @@
   wayland,
   wayland-protocols,
   wayland-scanner,
-  zig,
+  zig_0_14,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     pkg-config
-    zig.hook
+    zig_0_14.hook
   ];
 
   buildInputs = [

pkgs/by-name/rm/rmg/package.nix

@@ -29,13 +29,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rmg";
-  version = "0.7.9";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "Rosalie241";
     repo = "RMG";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-RPjt79kDBgA8hxhDAZUU+xMuDcAMoxDhWt6NpTFHeMI=";
+    hash = "sha256-XMYHzPE5h9gD1fpN8b5YwOpY5zYCsYYQnof2MHDHa3E=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix

@@ -12,7 +12,7 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rust-analyzer-unwrapped";
-  version = "2025-08-11";
+  version = "2025-08-25";
 
   cargoHash = "sha256-G1R3IiKbQg1Dl6OFJSto0w4c18OUIrAPRiM/YStfkl0=";
 
@@ -20,7 +20,7 @@ rustPlatform.buildRustPackage rec {
     owner = "rust-lang";
     repo = "rust-analyzer";
     rev = version;
-    hash = "sha256-fuHLsvM5z5/5ia3yL0/mr472wXnxSrtXECa+pspQchA=";
+    hash = "sha256-apbJj2tsJkL2l+7Or9tJm1Mt5QPB6w/zIyDkCx8pfvk=";
   };
 
   cargoBuildFlags = [

pkgs/by-name/se/semantic-release/package.nix

@@ -9,16 +9,16 @@
 
 buildNpmPackage rec {
   pname = "semantic-release";
-  version = "24.2.7";
+  version = "24.2.8";
 
   src = fetchFromGitHub {
     owner = "semantic-release";
     repo = "semantic-release";
     rev = "v${version}";
-    hash = "sha256-7BIEb4gQLppa+CXCR+oYPvb/l8UB6ihNh4veBdDG8ac=";
+    hash = "sha256-blPpIVL1bg8u7vnZo+XRvVPOv8UAmwtt7Rl1h3XC1L8=";
   };
 
-  npmDepsHash = "sha256-ODu8foiTtU7bsaVL/ri4eCwpcyg/7CdSGtyPsA/myxU=";
+  npmDepsHash = "sha256-XvZpyDEUMDj4TvjDsDhWiyJHiy+14mWgTghXeFP+vBM=";
 
   dontNpmBuild = true;
 

pkgs/by-name/sf/sfml/package.nix

@@ -6,6 +6,7 @@
 
   # nativeBuildInputs
   cmake,
+  pkg-config,
 
   # buildInputs
   flac,
@@ -13,6 +14,7 @@
   glew,
   libjpeg,
   libvorbis,
+  miniaudio,
   udev,
   libXi,
   libX11,
@@ -20,12 +22,6 @@
   libXrandr,
   libXrender,
   xcbutilimage,
-
-  # miniaudio
-  alsa-lib,
-  libjack2,
-  libpulseaudio,
-  sndio,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -45,15 +41,22 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://github.com/SFML/SFML/commit/a87763becbc4672b38f1021418ed94caa0f6540a.patch?full_index=1";
       hash = "sha256-tJmXTdhwtWq6XfUPBzw47yTrc6EzwmSiVj9n6jQwHig=";
     })
+
+    # Not upstreamble in the near future, see https://github.com/SFML/SFML/pull/3555
+    ./unvendor-miniaudio.patch
   ];
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
   buildInputs = [
     flac
     freetype
     glew
     libjpeg
     libvorbis
+    miniaudio
   ]
   ++ lib.optional stdenv.hostPlatform.isLinux udev
   ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
@@ -65,25 +68,12 @@ stdenv.mkDerivation (finalAttrs: {
     xcbutilimage
   ];
 
-  # We rely on RUNPATH
-  dontPatchELF = true;
-
   cmakeFlags = [
     (lib.cmakeBool "BUILD_SHARED_LIBS" (!stdenv.hostPlatform.isStatic))
     (lib.cmakeBool "SFML_INSTALL_PKGCONFIG_FILES" true)
     (lib.cmakeFeature "SFML_MISC_INSTALL_PREFIX" "share/SFML")
     (lib.cmakeBool "SFML_BUILD_FRAMEWORKS" false)
     (lib.cmakeBool "SFML_USE_SYSTEM_DEPS" true)
-
-    # FIXME: Unvendor miniaudio and move these deps there
-    (lib.cmakeFeature "CMAKE_INSTALL_RPATH" (
-      lib.makeLibraryPath [
-        alsa-lib
-        libjack2
-        libpulseaudio
-        sndio
-      ]
-    ))
   ];
 
   meta = {

pkgs/by-name/sf/sfml/unvendor-miniaudio.patch

@@ -0,0 +1,35 @@
+diff --git a/src/SFML/Audio/CMakeLists.txt b/src/SFML/Audio/CMakeLists.txt
+index 7567205c..ecbb4ea1 100644
+--- a/src/SFML/Audio/CMakeLists.txt
++++ b/src/SFML/Audio/CMakeLists.txt
+@@ -10,7 +10,6 @@ set(SRC
+     ${INCROOT}/Export.hpp
+     ${SRCROOT}/Listener.cpp
+     ${INCROOT}/Listener.hpp
+-    ${SRCROOT}/Miniaudio.cpp
+     ${SRCROOT}/MiniaudioUtils.hpp
+     ${SRCROOT}/MiniaudioUtils.cpp
+     ${SRCROOT}/Music.cpp
+@@ -169,8 +168,10 @@ sfml_add_library(Audio
+ # avoids warnings in vorbisfile.h
+ target_compile_definitions(sfml-audio PRIVATE OV_EXCLUDE_STATIC_CALLBACKS FLAC__NO_DLL)
+ 
+-# disable miniaudio features we do not use
+-target_compile_definitions(sfml-audio PRIVATE MA_NO_MP3 MA_NO_FLAC MA_NO_ENCODING MA_NO_RESOURCE_MANAGER MA_NO_GENERATION)
++find_package(PkgConfig REQUIRED)
++pkg_check_modules(miniaudio REQUIRED IMPORTED_TARGET miniaudio)
++target_link_libraries(sfml-audio PRIVATE PkgConfig::miniaudio)
++target_include_directories(sfml-audio SYSTEM PRIVATE "${miniaudio_INCLUDE_DIRS}/miniaudio")
+ 
+ # use standard fixed-width integer types
+ target_compile_definitions(sfml-audio PRIVATE MA_USE_STDINT)
+@@ -186,9 +187,6 @@ if(SFML_OS_IOS)
+     target_link_libraries(sfml-audio PRIVATE "-framework Foundation" "-framework CoreFoundation" "-framework CoreAudio" "-framework AudioToolbox" "-framework AVFoundation")
+ endif()
+ 
+-# miniaudio sources
+-target_include_directories(sfml-audio SYSTEM PRIVATE "${PROJECT_SOURCE_DIR}/extlibs/headers/miniaudio")
+-
+ # minimp3 sources
+ target_include_directories(sfml-audio SYSTEM PRIVATE "${PROJECT_SOURCE_DIR}/extlibs/headers/minimp3")
+ 

pkgs/by-name/si/signal-desktop-bin/generic.nix

@@ -45,7 +45,7 @@
   libgbm,
   libwebp,
   # Runtime dependencies:
-  systemd,
+  systemdLibs,
   libnotify,
   libdbusmenu,
   libpulseaudio,
@@ -186,13 +186,13 @@ stdenv.mkDerivation rec {
     nspr
     nss
     pango
-    systemd
+    systemdLibs
     xorg.libxcb
     xorg.libxshmfence
   ];
 
   runtimeDependencies = [
-    (lib.getLib systemd)
+    systemdLibs
     libappindicator-gtk3
     libnotify
     libdbusmenu

pkgs/by-name/si/sing-box/package.nix

@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "sing-box";
-  version = "1.12.4";
+  version = "1.12.5";
 
   src = fetchFromGitHub {
     owner = "SagerNet";
     repo = "sing-box";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Pc6aszIzu9GZha7I59yGasVVKHUeLPiW34zALFTM8Ec=";
+    hash = "sha256-LTORUt3/Q8eyfMkWjk/ixyRHB8NGvthbIJdcgOR3WaA=";
   };
 
-  vendorHash = "sha256-I/J1ht++GqxVlc83GxmLxzI7S980AbMwvrrVD867ll4=";
+  vendorHash = "sha256-XoHIxsJaFkC/Qz0+9AXWL+LBiTFUYKDtMqNseruAqZY=";
 
   tags = [
     "with_quic"

pkgs/by-name/st/strongswan/package.nix

@@ -2,209 +2,200 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch2,
-  pkg-config,
   autoreconfHook,
-  perl,
-  gperf,
+  pkg-config,
   bison,
   flex,
-  gmp,
-  python3,
-  iptables,
-  ldns,
-  unbound,
+  curl,
+  perl,
+  gperf,
   openssl,
   pcsclite,
-  glib,
+  networkmanager,
   openresolv,
+  glib,
   systemd,
+  tpm2-tss,
+  libxml2,
   pam,
-  curl,
-  enableTNC ? false,
+  iptables,
   trousers,
   sqlite,
-  libxml2,
-  enableTPM2 ? false,
-  tpm2-tss,
-  enableNetworkManager ? false,
-  networkmanager,
+  unbound,
+  ldns,
+  gmp,
   nixosTests,
+  enableNetworkManager ? false,
+  enableTNC ? false,
+  enableTPM2 ? false,
 }:
+let
+  features = rec {
+    nm = enableNetworkManager;
+    cmd = true;
+    stroke = true;
+    swanctl = true;
+    systemd = stdenv.hostPlatform.isLinux;
 
-# Note on curl support: If curl is built with gnutls as its backend, the
-# strongswan curl plugin may break.
-# See https://wiki.strongswan.org/projects/strongswan/wiki/Curl for more info.
+    openssl = true;
 
+    farp = stdenv.hostPlatform.isLinux;
+    dhcp = stdenv.hostPlatform.isLinux;
+    af-alg = stdenv.hostPlatform.isLinux;
+    resolve = stdenv.hostPlatform.isLinux;
+    scripts = stdenv.hostPlatform.isLinux;
+    connmark = stdenv.hostPlatform.isLinux;
+    forecast = stdenv.hostPlatform.isLinux;
+    kernel-netlink = stdenv.hostPlatform.isLinux;
+
+    aesni = stdenv.hostPlatform.isx86_64;
+    rdrand = stdenv.hostPlatform.isx86_64;
+    padlock = stdenv.hostPlatform.system == "i686-linux";
+
+    kernel-pfkey = stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isFreeBSD;
+    kernel-pfroute = stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isFreeBSD;
+    kernel-libipsec = stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isFreeBSD;
+
+    keychain = false; # breaks build
+    osx-attr = stdenv.hostPlatform.isDarwin;
+
+    ml = true;
+    # Note on curl support: If curl is built with gnutls as its backend, the
+    # strongswan curl plugin may break.
+    # See https://wiki.strongswan.org/projects/strongswan/wiki/Curl for more info.
+    curl = true;
+    acert = true;
+    pkcs11 = true;
+    dnscert = true;
+    unbound = true;
+    chapoly = true;
+    ext-auth = true;
+    socket-dynamic = stdenv.hostPlatform.isLinux;
+
+    eap-sim = true;
+    eap-sim-file = true;
+    eap-sim-pcsc = true;
+    eap-simaka-pseudonym = true;
+    eap-simaka-reauth = true;
+    eap-identity = true;
+    eap-md5 = true;
+    eap-gtc = true;
+    eap-aka = true;
+    eap-aka-3gpp = true;
+    eap-aka-3gpp2 = true;
+    eap-mschapv2 = true;
+    eap-tls = true;
+    eap-peap = true;
+    eap-radius = true;
+
+    xauth-eap = true;
+    xauth-pam = stdenv.hostPlatform.isLinux;
+    xauth-noauth = true;
+
+    gmp = eap-aka-3gpp2;
+  }
+  // lib.optionalAttrs enableTNC {
+    eap-tnc = true;
+    eap-ttls = true;
+    eap-dynamic = true;
+
+    tnccs-20 = true;
+
+    tnc-imc = true;
+    tnc-imv = true;
+    tnc-ifmap = true;
+
+    imc-os = true;
+    imv-os = true;
+    imc-attestation = true;
+    imv-attestation = true;
+
+    aikgen = true;
+    tss-trousers = true;
+
+    sqlite = true;
+  }
+  // lib.optionalAttrs enableTPM2 {
+    tpm = true;
+    tss-tss2 = true;
+  };
+in
 stdenv.mkDerivation rec {
   pname = "strongswan";
-  version = "5.9.14"; # Make sure to also update <nixpkgs/nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix> when upgrading!
+  version = "6.0.2"; # Make sure to also update <nixpkgs/nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix> when upgrading!
 
   src = fetchFromGitHub {
     owner = "strongswan";
     repo = "strongswan";
-    rev = version;
-    hash = "sha256-qFM7ErfqiDlUsZdGXJQVW3nJoh+I6tEdKRwzrKteRVY=";
+    tag = version;
+    hash = "sha256-wjz41gt+Xu4XJkEXRRVl3b3ryEoEtijeqmfVFoRjnA4=";
   };
 
-  dontPatchELF = true;
-
-  nativeBuildInputs = [
-    pkg-config
-    autoreconfHook
-    perl
-    gperf
-    bison
-    flex
-  ];
-  buildInputs = [
-    curl
-    gmp
-    python3
-    ldns
-    unbound
-    openssl
-    pcsclite
-  ]
-  ++ lib.optionals enableTNC [
-    trousers
-    sqlite
-    libxml2
-  ]
-  ++ lib.optional enableTPM2 tpm2-tss
-  ++ lib.optionals stdenv.hostPlatform.isLinux [
-    systemd.dev
-    pam
-    iptables
-  ]
-  ++ lib.optionals enableNetworkManager [
-    networkmanager
-    glib
-  ];
-
   patches = [
     ./ext_auth-path.patch
     ./firewall_defaults.patch
     ./updown-path.patch
-    # Fixes for gettext 0.25
-    (fetchpatch2 {
-      url = "https://github.com/strongswan/strongswan/commit/7ec0101250bf2ac3da7a576cbb4204fceb2ef10c.patch?full_index=1";
-      excludes = [ "scripts/test.sh" ];
-      hash = "sha256-ATd/oj6/1vrtZdwMs45rA2MGtH2viumyucVj0LZ8Nnc=";
-    })
-    (fetchpatch2 {
-      url = "https://github.com/strongswan/strongswan/commit/e8e5e2d4419a686c5a2c064648618ec281089b2e.patch?full_index=1";
-      hash = "sha256-p98LSX8jjsDK/GZTovj/salmQ8T+txEV3vKD+wTUvsM=";
-    })
-    (fetchpatch2 {
-      url = "https://github.com/strongswan/strongswan/commit/2b3a5172d89c513ed28d21bb406c1b4ef0ac787a.patch?full_index=1";
-      hash = "sha256-xqp2Lq4pp3Uu0nVC/fl4E5mpJqCNgyZXP2g/Y2wShhI=";
-    })
   ];
 
-  postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
-    # glibc-2.26 reorganized internal includes
-    sed '1i#include <stdint.h>' -i src/libstrongswan/utils/utils/memory.h
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    bison
+    flex
+    perl
+    gperf
+  ];
 
-    substituteInPlace src/libcharon/plugins/resolve/resolve_handler.c --replace "/sbin/resolvconf" "${openresolv}/sbin/resolvconf"
-  '';
+  buildInputs =
+    lib.optional (features.gmp or false) gmp
+    ++ lib.optional (features.eap-sim-pcsc or false) pcsclite
+    ++ lib.optional (features.openssl or false) openssl
+    ++ lib.optional (features.curl or false) curl
+    ++ lib.optional (features.systemd or false) systemd
+    ++ lib.optional (features.tnc-ifmap or false) libxml2
+    ++ lib.optional (features.xauth-pam or false) pam
+    ++ lib.optional (features.forecast or false || features.connmark or false) iptables
+    ++ lib.optional (features.tss-trousers or false) trousers
+    ++ lib.optional (features.tss-tss2 or false) tpm2-tss
+    ++ lib.optional (features.sqlite or false) sqlite
+    ++ lib.optionals (features.unbound or false) [
+      unbound
+      ldns
+    ]
+    ++ lib.optionals (features.nm or false) [
+      networkmanager
+      glib
+    ];
 
-  configureFlags = [
+  configureFlags = (lib.mapAttrsToList (lib.flip lib.enableFeature)) features ++ [
     "--sysconfdir=/etc"
-    "--enable-swanctl"
-    "--enable-cmd"
-    "--enable-openssl"
-    "--enable-eap-sim"
-    "--enable-eap-sim-file"
-    "--enable-eap-simaka-pseudonym"
-    "--enable-eap-simaka-reauth"
-    "--enable-eap-identity"
-    "--enable-eap-md5"
-    "--enable-eap-gtc"
-    "--enable-eap-aka"
-    "--enable-eap-aka-3gpp2"
-    "--enable-eap-mschapv2"
-    "--enable-eap-radius"
-    "--enable-xauth-eap"
-    "--enable-ext-auth"
-    "--enable-acert"
-    "--enable-pkcs11"
-    "--enable-eap-sim-pcsc"
-    "--enable-dnscert"
-    "--enable-unbound"
-    "--enable-chapoly"
-    "--enable-curl"
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isLinux [
-    "--enable-farp"
-    "--enable-dhcp"
-    "--enable-systemd"
-    "--with-systemdsystemunitdir=${placeholder "out"}/etc/systemd/system"
-    "--enable-xauth-pam"
-    "--enable-forecast"
-    "--enable-connmark"
-    "--enable-af-alg"
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isx86_64 [
-    "--enable-aesni"
-    "--enable-rdrand"
-  ]
-  ++ lib.optional (stdenv.hostPlatform.system == "i686-linux") "--enable-padlock"
-  ++ lib.optionals enableTNC [
-    "--disable-gmp"
-    "--disable-aes"
-    "--disable-md5"
-    "--disable-sha1"
-    "--disable-sha2"
-    "--disable-fips-prf"
-    "--enable-eap-tnc"
-    "--enable-eap-ttls"
-    "--enable-eap-dynamic"
-    "--enable-tnccs-20"
-    "--enable-tnc-imc"
-    "--enable-imc-os"
-    "--enable-imc-attestation"
-    "--enable-tnc-imv"
-    "--enable-imv-attestation"
-    "--enable-tnc-ifmap"
-    "--enable-tnc-imc"
-    "--enable-tnc-imv"
-    "--with-tss=trousers"
-    "--enable-aikgen"
-    "--enable-sqlite"
-  ]
-  ++ lib.optionals enableTPM2 [
-    "--enable-tpm"
-    "--enable-tss-tss2"
-  ]
-  ++ lib.optionals enableNetworkManager [
-    "--enable-nm"
-    "--with-nm-ca-dir=/etc/ssl/certs"
-  ]
-  # Taken from: https://wiki.strongswan.org/projects/strongswan/wiki/MacOSX
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    "--disable-systemd"
-    "--disable-xauth-pam"
-    "--disable-kernel-netlink"
-    "--enable-kernel-pfkey"
-    "--enable-kernel-pfroute"
-    "--enable-kernel-libipsec"
-    "--enable-osx-attr"
-    "--disable-scripts"
+    (lib.withFeatureAs (features.nm or false) "nm-ca-dir" "/etc/ssl/certs")
+    (lib.withFeatureAs (features.systemd or false
+    ) "systemdsystemunitdir" "${placeholder "out"}/etc/systemd/system")
   ];
 
   installFlags = [
     "sysconfdir=${placeholder "out"}/etc"
   ];
 
-  NIX_LDFLAGS = lib.optionalString stdenv.cc.isGNU "-lgcc_s";
+  enableParallelBuilding = true;
+
+  dontPatchELF = true;
 
   passthru.tests = { inherit (nixosTests) strongswan-swanctl; };
 
-  meta = with lib; {
-    description = "OpenSource IPsec-based VPN Solution";
-    homepage = "https://www.strongswan.org";
-    license = licenses.gpl2Plus;
-    platforms = platforms.all;
+  postPatch = lib.optionalString features.resolve ''
+    substituteInPlace src/libcharon/plugins/resolve/resolve_handler.c \
+      --replace-fail "/sbin/resolvconf" "${openresolv}/sbin/resolvconf"
+  '';
+
+  meta = {
+    description = "OpenSource IPsec-based VPN solution";
+    homepage = "https://www.strongswan.org/";
+    changelog = "https://github.com/strongswan/strongswan/blob/${src.rev}/ChangeLog";
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ nickcao ];
+    mainProgram = "swanctl";
+    platforms = lib.platforms.unix;
   };
 }

pkgs/by-name/sv/svix-server/package.nix

@@ -10,18 +10,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "svix-server";
-  version = "1.75.0";
+  version = "1.76.1";
 
   src = fetchFromGitHub {
     owner = "svix";
     repo = "svix-webhooks";
     rev = "v${version}";
-    hash = "sha256-rZQWExWPoSQLmL79QGPU6GJ/Z5JEHBRPSGH2A4TsA94=";
+    hash = "sha256-9ClWC/OHdijmQzKig/o6WhJ9mjlE6pLwvrRKzuO0l3g=";
   };
 
   sourceRoot = "${src.name}/server";
 
-  cargoHash = "sha256-aTc4MmwesI8B26lv/1hifSXvrvWeW+UheIl8FN1/mes=";
+  cargoHash = "sha256-fOUPaU/1+FvL9hSzWQVouAXmCjI6ppOjJqtgM4+cXf8=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/sv/svls/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "svls";
-  version = "0.2.12";
+  version = "0.2.13";
 
   src = fetchFromGitHub {
     owner = "dalance";
     repo = "svls";
     rev = "v${version}";
-    sha256 = "sha256-DuwH0qie8SctvOGntljOdTRMGKrNFPycdaFG3QZxihA=";
+    sha256 = "sha256-kxsB7il2KKjxSUoA+e6tSNQHwGGVO4UB/mAfnDPjb0c=";
   };
 
-  cargoHash = "sha256-L+MTU92SUohhQ5Oy2ziU/1f4IxFcrW2JGUSx7iPxl/I=";
+  cargoHash = "sha256-2SOCv8xeaRVlpJrBd9po5KgNY7ZSraw4UNsE0gRTbLs=";
 
   meta = with lib; {
     description = "SystemVerilog language server";

pkgs/by-name/tc/tcpreplay/package.nix

@@ -8,15 +8,22 @@
 
 stdenv.mkDerivation rec {
   pname = "tcpreplay";
-  version = "4.5.1";
+  version = "4.5.2";
 
   src = fetchurl {
     url = "https://github.com/appneta/tcpreplay/releases/download/v${version}/tcpreplay-${version}.tar.gz";
-    sha256 = "sha256-Leeb/Wfsksqa4v+1BFbdHVP/QPP6cbQixl6AYgE8noU=";
+    sha256 = "sha256-zP87spRpoEzMIO0LUY4+Q8Sntah2M52UNb/Z23/l0PE=";
   };
 
   buildInputs = [ libpcap ];
 
+  # Allow having different prefix for header files (default output
+  # "out") and libraries ("lib" output)
+  postPatch = ''
+    substituteInPlace configure \
+      --replace-fail 'ls ''${testdir}/$dir/libpcap' 'ls ${lib.getLib libpcap}/$dir/libpcap'
+  '';
+
   configureFlags = [
     "--disable-local-libopts"
     "--disable-libopts-install"

pkgs/by-name/te/terranix/package.nix

@@ -38,6 +38,9 @@ stdenv.mkDerivation rec {
     homepage = "https://terranix.org";
     license = licenses.gpl3;
     platforms = platforms.unix;
-    maintainers = with maintainers; [ mrVanDalo ];
+    maintainers = with maintainers; [
+      mrVanDalo
+      sshine
+    ];
   };
 }

pkgs/by-name/ug/ugm/package.nix

@@ -1,23 +1,23 @@
 {
   lib,
-  buildGoModule,
+  buildGo125Module,
   fetchFromGitHub,
   makeWrapper,
   nix-update-script,
 }:
 
-buildGoModule rec {
+buildGo125Module (finalAttrs: {
   pname = "ugm";
-  version = "1.7.0";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "ariasmn";
     repo = "ugm";
-    rev = "v${version}";
-    hash = "sha256-JgdOoMH8TAUc+23AhU3tZe4SH8GKFeyjSeKm8U7qvpo=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-AkiAF9zLgyzXRC6efjQ+eeAL3mOSQM94B8nr09pcY5M=";
   };
 
-  vendorHash = "sha256-Dgnh+4bUNyqD8/bj+iUITPB/SBtQPYrB5XC6/M6Zs6k=";
+  vendorHash = "sha256-W9v52cxhXdNyW5RGk+SoA1u7Yid+63YYdd9YaGKEWDs=";
 
   nativeBuildInputs = [ makeWrapper ];
 
@@ -29,13 +29,13 @@ buildGoModule rec {
 
   passthru.updateScript = nix-update-script { };
 
-  meta = with lib; {
+  meta = {
     description = "Terminal based UNIX user and group browser";
     homepage = "https://github.com/ariasmn/ugm";
-    changelog = "https://github.com/ariasmn/ugm/releases/tag/${src.rev}";
-    license = licenses.mit;
+    changelog = "https://github.com/ariasmn/ugm/releases/tag/${finalAttrs.src.rev}";
+    license = lib.licenses.mit;
     mainProgram = "ugm";
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ ];
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ ];
   };
-}
+})

pkgs/by-name/ul/ulogd/package.nix

@@ -2,7 +2,6 @@
   stdenv,
   lib,
   fetchurl,
-  gnumake,
   libnetfilter_acct,
   libnetfilter_conntrack,
   libnetfilter_log,
@@ -22,13 +21,13 @@
   nixosTests,
 }:
 
-stdenv.mkDerivation rec {
-  version = "2.0.8";
+stdenv.mkDerivation (finalAttrs: {
+  version = "2.0.9";
   pname = "ulogd";
 
   src = fetchurl {
-    url = "https://netfilter.org/projects/${pname}/files/${pname}-${version}.tar.bz2";
-    hash = "sha256-Tq1sOXDD9X+h6J/i18xIO6b+K9GwhwFSHgs6/WZ98pE=";
+    url = "https://www.netfilter.org/pub/ulogd/ulogd-${finalAttrs.version}.tar.xz";
+    hash = "sha256-UjplH+Cp8lsM2H1dNfw32Tgufuz89h5I1VBf88+A7aU=";
   };
 
   outputs = [
@@ -38,7 +37,7 @@ stdenv.mkDerivation rec {
   ];
 
   postPatch = ''
-    substituteInPlace ulogd.8 --replace "/usr/share/doc" "$doc/share/doc"
+    substituteInPlace ulogd.8 --replace-fail "/usr/share/doc" "$doc/share/doc"
   '';
 
   postBuild = ''
@@ -49,9 +48,9 @@ stdenv.mkDerivation rec {
   '';
 
   postInstall = ''
-    install -Dm444 -t $out/share/doc/${pname} ulogd.conf doc/ulogd.txt doc/ulogd.html README doc/*table
-    install -Dm444 -t $out/share/doc/${pname}-mysql doc/mysql*.sql
-    install -Dm444 -t $out/share/doc/${pname}-pgsql doc/pgsql*.sql
+    install -Dm444 -t $out/share/doc/ulogd ulogd.conf doc/ulogd.txt doc/ulogd.html README doc/*table
+    install -Dm444 -t $out/share/doc/ulogd-mysql doc/mysql*.sql
+    install -Dm444 -t $out/share/doc/ulogd-pgsql doc/pgsql*.sql
   '';
 
   buildInputs = [
@@ -78,7 +77,7 @@ stdenv.mkDerivation rec {
 
   passthru.tests = { inherit (nixosTests) ulogd; };
 
-  meta = with lib; {
+  meta = {
     description = "Userspace logging daemon for netfilter/iptables";
     mainProgram = "ulogd";
 
@@ -95,8 +94,8 @@ stdenv.mkDerivation rec {
     '';
 
     homepage = "https://www.netfilter.org/projects/ulogd/index.html";
-    license = licenses.gpl2Only;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ p-h ];
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ p-h ];
   };
-}
+})

pkgs/by-name/um/umurmur/package.nix

@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   autoreconfHook,
   openssl,
   protobufc,
@@ -10,15 +9,15 @@
   nixosTests,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "umurmur";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "umurmur";
     repo = "umurmur";
-    rev = version;
-    sha256 = "sha256-q5k1Lv+/Kz602QFcdb/FoWWaH9peAQIf7u1NTCWKTBM=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-pJRGyfG5y5wdB+zoWiJ1+2O1L3TThC6IairVDlE76tA=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
@@ -28,14 +27,6 @@ stdenv.mkDerivation rec {
     libconfig
   ];
 
-  patches = [
-    # https://github.com/umurmur/umurmur/issues/175
-    (fetchpatch {
-      url = "https://github.com/umurmur/umurmur/commit/2c7353eaabb88544affc0b0d32d2611994169159.patch";
-      hash = "sha256-Ws4Eqb6yI5Vnwfeu869hDtisi8NcobEK6dC7RWnWSJA=";
-    })
-  ];
-
   configureFlags = [
     "--with-ssl=openssl"
     "--enable-shmapi"
@@ -47,14 +38,14 @@ stdenv.mkDerivation rec {
     };
   };
 
-  meta = with lib; {
+  meta = {
     description = "Minimalistic Murmur (Mumble server)";
-    license = licenses.bsd3;
+    license = lib.licenses.bsd3;
     homepage = "https://github.com/umurmur/umurmur";
-    platforms = platforms.all;
+    platforms = lib.platforms.all;
     # never built on aarch64-darwin since first introduction in nixpkgs
     broken = stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64;
     maintainers = with lib.maintainers; [ _3JlOy-PYCCKUi ];
     mainProgram = "umurmurd";
   };
-}
+})

pkgs/by-name/un/unp/package.nix

@@ -1,7 +1,8 @@
 {
   stdenv,
   lib,
-  fetchurl,
+  fetchFromGitLab,
+  installShellFiles,
   makeWrapper,
   perl,
   unzip,
@@ -20,38 +21,47 @@ let
   ++ extraBackends;
 
 in
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "unp";
-  version = "2.0-pre9";
-  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ perl ];
+  version = "2.0";
 
-  src = fetchurl {
-    url = "mirror://debian/pool/main/u/unp/unp_2.0~pre9.tar.xz";
-    sha256 = "1lp5vi9x1qi3b21nzv0yqqacj6p74qkl5zryzwq30rjkyvahjya1";
-    name = "unp_2.0_pre9.tar.xz";
+  src = fetchFromGitLab {
+    domain = "salsa.debian.org";
+    owner = "blade";
+    repo = "unp";
+    tag = "debian/${finalAttrs.version}";
+    hash = "sha256-6lYyKnNUkz9PKdn++zHe2SMdFsgaajStIdSaenbXIRo=";
   };
 
-  dontConfigure = true;
-  dontBuild = true;
-  installPhase = ''
-    mkdir -p $out/bin
-    mkdir -p $out/share/man/man1
-    install ./unp $out/bin/unp
-    install ./ucat $out/bin/ucat
-    cp debian/unp.1 $out/share/man/man1
+  nativeBuildInputs = [
+    installShellFiles
+    makeWrapper
+  ];
 
+  buildInputs = [ perl ];
+
+  dontConfigure = true;
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    installBin unp ucat
+    installManPage debian/unp.1
     wrapProgram $out/bin/unp \
       --prefix PATH : ${lib.makeBinPath runtime_bins}
     wrapProgram $out/bin/ucat \
       --prefix PATH : ${lib.makeBinPath runtime_bins}
+
+    runHook postInstall
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Command line tool for unpacking archives easily";
     homepage = "https://packages.qa.debian.org/u/unp.html";
-    license = with licenses; [ gpl2Only ];
-    maintainers = [ maintainers.timor ];
-    platforms = platforms.all;
+    license = with lib.licenses; [ gpl2Only ];
+    maintainers = [ lib.maintainers.timor ];
+    platforms = lib.platforms.all;
   };
-}
+})

pkgs/by-name/va/vacuum-go/package.nix

@@ -7,14 +7,14 @@
 
 buildGoModule (finalAttrs: {
   pname = "vacuum-go";
-  version = "0.17.11";
+  version = "0.17.12";
 
   src = fetchFromGitHub {
     owner = "daveshanley";
     repo = "vacuum";
     # using refs/tags because simple version gives: 'the given path has multiple possibilities' error
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9cdix5HuhLOd/XnK1uU4pRXcfYi2nqTScP/+QV7Ps4k=";
+    hash = "sha256-1129ovv85oh2eFgGm2U2pQ8mglWzjyueScshwNlXe8s=";
   };
 
   vendorHash = "sha256-sdm3RKtHB9uWZy9N+bEz0gRKBU0EuYvX9J15Wj7GmAU=";

pkgs/by-name/vi/victorialogs/package.nix

@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "VictoriaLogs";
-  version = "1.32.0";
+  version = "1.33.1";
 
   src = fetchFromGitHub {
     owner = "VictoriaMetrics";
     repo = "VictoriaLogs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VcFgPxsxPjvo92/TiVec6sSPprRQ4sbQwe4teGC60/o=";
+    hash = "sha256-CLrXkyLHPA4t0srIME2Td9/6QQ5fsJyq+kuKfzawwFs=";
   };
 
   vendorHash = null;

pkgs/by-name/wt/wtfutil/package.nix

@@ -11,16 +11,16 @@
 
 buildGoModule rec {
   pname = "wtfutil";
-  version = "0.46.0";
+  version = "0.46.1";
 
   src = fetchFromGitHub {
     owner = "wtfutil";
     repo = "wtf";
     rev = "v${version}";
-    sha256 = "sha256-05w5OyXlywt4jN0S0kv1GvbxmqZpEGud8PhV5ODCFu8=";
+    sha256 = "sha256-GLLTI/hxlkt3OvtTWRNdzQ9jzO4xzJV9RruiJUyWD5g=";
   };
 
-  vendorHash = "sha256-Vanus0oD11GxuQwwM8EoOLPsjgkQvQMiaHp6fRQZTrQ=";
+  vendorHash = "sha256-OSoQkBAx0kJKiKq0pRGrkkSowTynw/MJvYSdhd1Jt/k=";
   proxyVendor = true;
 
   doCheck = false;

pkgs/by-name/yt/ytcc/package.nix

@@ -7,16 +7,19 @@
   versionCheckHook,
 }:
 
-python3Packages.buildPythonApplication rec {
+let
+  version = "2.8.0";
+in
+python3Packages.buildPythonApplication {
   pname = "ytcc";
-  version = "2.7.2";
+  inherit version;
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "woefe";
     repo = "ytcc";
     tag = "v${version}";
-    hash = "sha256-PNSkIp6CJvgirO3k2lB0nOVEC1+znhn3/OyRIJ1EANI=";
+    hash = "sha256-6Z5xoGbOtJnPlPj5GS9ElRkuuNd+ON9RsZyl5VLzLE0=";
   };
 
   build-system = with python3Packages; [ hatchling ];
@@ -33,6 +36,8 @@ python3Packages.buildPythonApplication rec {
     defusedxml
   ];
 
+  pythonRelaxDeps = [ "click" ];
+
   nativeCheckInputs =
     with python3Packages;
     [

pkgs/development/compilers/elm/packages/ghc9_6/default.nix

@@ -27,12 +27,6 @@ pkgs.haskell.packages.ghc96.override {
               --prefix PATH ':' ${lib.makeBinPath [ nodejs ]}
           '';
 
-          patches = [
-            # Fix TLS compatibility issues with package.elm-lang.org
-            # see: https://github.com/elm/compiler/pull/2325
-            ./tls-compatibility.patch
-          ];
-
           description = "Delightful language for reliable webapps";
           homepage = "https://elm-lang.org/";
           license = lib.licenses.bsd3;

pkgs/development/compilers/elm/packages/ghc9_6/tls-compatibility.patch

@@ -1,81 +0,0 @@
-From c8ca5e14650a77446a6577eb356ddd09c3928bac Mon Sep 17 00:00:00 2001
-From: Ben Millwood <thebenmachine+git@gmail.com>
-Date: Tue, 17 Jun 2025 16:39:07 +0100
-Subject: [PATCH] Fix TLS connection to package.elm-lang.org
-
-It seems like the server hosting https://package.elm-lang.org has an old
-enough SSL library that it doesn't support EMS. Reconfigure the https
-client so that it will still connect in this case.
----
- builder/src/Http.hs | 21 +++++++++++++++++++--
- elm.cabal           |  3 +++
- 2 files changed, 22 insertions(+), 2 deletions(-)
-
-diff --git a/builder/src/Http.hs b/builder/src/Http.hs
-index 6105263fa..fd8b87bba 100644
---- a/builder/src/Http.hs
-+++ b/builder/src/Http.hs
-@@ -29,15 +29,19 @@ import qualified Data.Binary as Binary
- import qualified Data.Binary.Get as Binary
- import qualified Data.ByteString.Builder as B
- import qualified Data.ByteString.Char8 as BS
-+import Data.Default (def)
- import qualified Data.Digest.Pure.SHA as SHA
- import qualified Data.String as String
-+import qualified Network.Connection as NC
- import Network.HTTP (urlEncodeVars)
- import Network.HTTP.Client
--import Network.HTTP.Client.TLS (tlsManagerSettings)
-+import Network.HTTP.Client.TLS (mkManagerSettings)
- import Network.HTTP.Types.Header (Header, hAccept, hAcceptEncoding, hUserAgent)
- import Network.HTTP.Types.Method (Method, methodGet, methodPost)
- import qualified Network.HTTP.Client as Multi (RequestBody(RequestBodyLBS))
- import qualified Network.HTTP.Client.MultipartFormData as Multi
-+import qualified Network.TLS as TLS
-+import Network.TLS.Extra.Cipher (ciphersuite_default)
- 
- import qualified Json.Encode as Encode
- import qualified Elm.Version as V
-@@ -49,7 +53,20 @@ import qualified Elm.Version as V
- 
- getManager :: IO Manager
- getManager =
--  newManager tlsManagerSettings
-+  newManager (mkManagerSettings dontRequireEMS Nothing)
-+  where
-+    -- See https://github.com/NixOS/nixpkgs/pull/414495
-+    dontRequireEMS =
-+      NC.TLSSettingsSimple
-+        { NC.settingDisableCertificateValidation = False
-+        , NC.settingDisableSession = False
-+        , NC.settingUseServerName = False
-+        , NC.settingClientSupported =
-+            def
-+              { TLS.supportedCiphers = ciphersuite_default
-+              , TLS.supportedExtendedMainSecret = TLS.AllowEMS
-+              }
-+        }
- 
- 
- 
-diff --git a/elm.cabal b/elm.cabal
-index 144fada90..0bd1eb5dc 100644
---- a/elm.cabal
-+++ b/elm.cabal
-@@ -206,6 +206,8 @@ Executable elm
-         binary,
-         bytestring,
-         containers,
-+        crypton-connection,
-+        data-default,
-         directory,
-         edit-distance,
-         file-embed,
-@@ -229,6 +231,7 @@ Executable elm
-         snap-server,
-         template-haskell,
-         time,
-+        tls,
-         unordered-containers,
-         utf8-string,
-         vector,

pkgs/development/compilers/zig/generic.nix

@@ -145,5 +145,9 @@ stdenv.mkDerivation (finalAttrs: {
     teams = [ lib.teams.zig ];
     mainProgram = "zig";
     platforms = lib.platforms.unix;
+    # Zig 0.15.1 fails some tests on x86_64-darwin thus we mark it broken
+    # see https://github.com/ziglang/zig/issues/24974
+    broken =
+      stdenv.hostPlatform.system == "x86_64-darwin" && lib.versionAtLeast finalAttrs.version "0.15";
   };
 })

pkgs/development/python-modules/aioshelly/default.nix

@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "aioshelly";
-  version = "13.8.0";
+  version = "13.9.0";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "home-assistant-libs";
     repo = "aioshelly";
     tag = version;
-    hash = "sha256-SzEoLOjHlXVEB8V1Qc2IcA46YVIQ3w+FGADB5EaIb4k=";
+    hash = "sha256-G8iZmgrTR+hqrRLoEdnJnqzU8GFQUrOrGenL6hkjtps=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/asusrouter/default.nix

@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "asusrouter";
-  version = "1.20.1";
+  version = "1.21.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Vaskivskyi";
     repo = "asusrouter";
     tag = version;
-    hash = "sha256-RZdSwLR/7uJICc56lLO0YyFs1ZDzpk/8Ebm3juG+gss=";
+    hash = "sha256-SMQ1jEEMRngl0idWXi7R7KinxR9NnH39vB/itVi7A4A=";
   };
 
   postPatch = ''

pkgs/development/python-modules/bentoml/default.nix

@@ -1,40 +1,42 @@
 {
   lib,
   stdenv,
-  buildPythonPackage,
-  fetchFromGitHub,
-  pythonOlder,
-  hatchling,
-  hatch-vcs,
+  a2wsgi,
   aiohttp,
   aiosqlite,
   attrs,
+  buildPythonPackage,
   cattrs,
   circus,
-  click,
   click-option-group,
+  click,
   cloudpickle,
   deepmerge,
-  fs,
+  fetchFromGitHub,
   fs-s3fs,
-  grpcio,
+  fs,
+  fsspec,
   grpcio-channelz,
   grpcio-health-checking,
   grpcio-reflection,
-  httpx,
+  grpcio,
+  hatch-vcs,
+  hatchling,
   httpx-ws,
+  httpx,
   inflection,
   inquirerpy,
   jinja2,
+  kantoku,
   numpy,
   nvidia-ml-py,
   opentelemetry-api,
-  opentelemetry-exporter-otlp,
   opentelemetry-exporter-otlp-proto-http,
-  opentelemetry-instrumentation,
+  opentelemetry-exporter-otlp,
   opentelemetry-instrumentation-aiohttp-client,
   opentelemetry-instrumentation-asgi,
   opentelemetry-instrumentation-grpc,
+  opentelemetry-instrumentation,
   opentelemetry-sdk,
   opentelemetry-semantic-conventions,
   opentelemetry-util-http,
@@ -51,13 +53,15 @@
   python-dateutil,
   python-json-logger,
   python-multipart,
+  pythonOlder,
   pyyaml,
+  questionary,
   rich,
   schema,
   simple-di,
   starlette,
-  tomli,
   tomli-w,
+  tomli,
   tritonclient,
   uv,
   uvicorn,
@@ -71,10 +75,11 @@
   orjson,
   pytest-asyncio,
   fastapi,
+  writableTmpDirAsHomeHook,
 }:
 
 let
-  version = "1.4.19";
+  version = "1.4.23";
   aws = [ fs-s3fs ];
   grpc = [
     grpcio
@@ -124,7 +129,7 @@ let
     owner = "bentoml";
     repo = "BentoML";
     tag = "v${version}";
-    hash = "sha256-sRQfjB3K5F6lYeW92O7BV2slQ+DRCuMTVqRG8vT+9wc=";
+    hash = "sha256-p9d8TyN09jJ2VotaAvbC9jxJ5kNC2S7VhkatzrDJ1TY=";
   };
 in
 buildPythonPackage {
@@ -134,6 +139,7 @@ buildPythonPackage {
 
   pythonRelaxDeps = [
     "cattrs"
+    "fsspec"
     "nvidia-ml-py"
     "opentelemetry-api"
     "opentelemetry-instrumentation-aiohttp-client"
@@ -150,6 +156,7 @@ buildPythonPackage {
   ];
 
   dependencies = [
+    a2wsgi
     aiohttp
     aiosqlite
     attrs
@@ -160,11 +167,13 @@ buildPythonPackage {
     cloudpickle
     deepmerge
     fs
+    fsspec
     httpx
     httpx-ws
     inflection
     inquirerpy
     jinja2
+    kantoku
     numpy
     nvidia-ml-py
     opentelemetry-api
@@ -184,6 +193,7 @@ buildPythonPackage {
     python-json-logger
     python-multipart
     pyyaml
+    questionary
     rich
     schema
     simple-di
@@ -208,11 +218,15 @@ buildPythonPackage {
   disabledTestPaths = [
     "tests/e2e"
     "tests/integration"
+    "tests/unit/grpc"
+    "tests/unit/_internal/"
   ];
 
   disabledTests = [
     # flaky test
     "test_store"
+    #
+    "test_log_collection"
   ];
 
   nativeCheckInputs = [
@@ -226,6 +240,7 @@ buildPythonPackage {
     pytest-xdist
     pytestCheckHook
     scikit-learn
+    writableTmpDirAsHomeHook
   ]
   ++ optional-dependencies.grpc;
 
@@ -238,8 +253,5 @@ buildPythonPackage {
       happysalada
       natsukium
     ];
-    # AttributeError: 'dict' object has no attribute 'schemas'
-    # https://github.com/bentoml/BentoML/issues/4290
-    broken = versionAtLeast cattrs.version "23.2";
   };
 }

pkgs/development/python-modules/cloudpathlib/default.nix

@@ -23,7 +23,7 @@
 
 buildPythonPackage rec {
   pname = "cloudpathlib";
-  version = "0.21.1";
+  version = "0.22.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -32,7 +32,7 @@ buildPythonPackage rec {
     owner = "drivendataorg";
     repo = "cloudpathlib";
     tag = "v${version}";
-    hash = "sha256-Bhr92xMK/WV3u0SG8q9SvO0kGnwSVXHzq6lK/RD2ssk=";
+    hash = "sha256-IeNYfYDvCALvK0CV4J6434E3lSz+/JvolQzQXZ8NizQ=";
   };
 
   postPatch = ''

pkgs/development/python-modules/coinmetrics-api-client/default.nix

@@ -10,6 +10,7 @@
   pytestCheckHook,
   python-dateutil,
   pythonOlder,
+  pyyaml,
   requests,
   tqdm,
   typer,
@@ -18,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "coinmetrics-api-client";
-  version = "2025.8.15.15";
+  version = "2025.9.9.13";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -28,7 +29,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit version;
     pname = "coinmetrics_api_client";
-    hash = "sha256-vk+L6PXygyI0UlO5l3xhw7Gcp5qi6sTH3TFdFAkQGZA=";
+    hash = "sha256-f5nMzx4oRHDkGAnexT6uamX2wGeEfrqCVBewq+2NxwA=";
   };
 
   pythonRelaxDeps = [ "typer" ];
@@ -38,6 +39,7 @@ buildPythonPackage rec {
   dependencies = [
     orjson
     python-dateutil
+    pyyaml
     requests
     typer
     tqdm

pkgs/development/python-modules/countryguess/default.nix

@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "countryguess";
-  version = "0.4.5";
+  version = "0.4.7";
   pyproject = true;
 
   src = fetchFromGitea {
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "plotski";
     repo = "countryguess";
     tag = "v${version}";
-    hash = "sha256-JzhkXHitleQ2UIxdem8PYR5QhKGmkyfHmxG6VDP7pB0=";
+    hash = "sha256-yZyEOFXwbaYAIDl6LoHkwoqlhVzqShY8ZXPasB6unQ8=";
   };
 
   build-system = [

pkgs/development/python-modules/cwl-utils/default.nix

@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "cwl-utils";
-  version = "0.39";
+  version = "0.40";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "common-workflow-language";
     repo = "cwl-utils";
     tag = "v${version}";
-    hash = "sha256-qmvFr+zUZxwFqC4mfdktcS4hrNhJnxvWmdSJSswJ874=";
+    hash = "sha256-A9+JvtSTPfXK/FGJ8pplT06kkuatZu1fgjjmg74oTvE=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/cyclopts/default.nix

@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "cyclopts";
-  version = "3.23.1";
+  version = "3.24.0";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "BrianPugh";
     repo = "cyclopts";
     tag = "v${version}";
-    hash = "sha256-qKQcx38b/GfFvJHXToLGkszBf5inRLfZTvcCX0MCaYk=";
+    hash = "sha256-gJflZBH3xCGKffKGt7y1xGXQR8C1wK19LnbunZ0kbAc=";
   };
 
   build-system = [

pkgs/development/python-modules/dash-bootstrap-components/default.nix

@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "dash-bootstrap-components";
-  version = "2.0.3";
+  version = "2.0.4";
   pyproject = true;
 
   src = fetchPypi {
     inherit version;
     pname = "dash_bootstrap_components";
-    hash = "sha256-XBYbBKbn7Rmn1U5C8HDCn9bDhdWneX56gpmaovwVsd4=";
+    hash = "sha256-wyBsCSN3S7xqbdqngiuNmqUyaw08HnzXlcyXUCX+JIQ=";
   };
 
   build-system = [ hatchling ];

pkgs/development/python-modules/databricks-sdk/default.nix

@@ -21,14 +21,14 @@
 
 buildPythonPackage rec {
   pname = "databricks-sdk";
-  version = "0.64.0";
+  version = "0.65.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "databricks";
     repo = "databricks-sdk-py";
     tag = "v${version}";
-    hash = "sha256-7P0j+yCWDwr6QZGeXE8coeaTg6kzTgxmwmZMDmx+3Zo=";
+    hash = "sha256-57qaTymMOkEJ+DzBDshhMoCJQk1UqJ796mv5uTOkUDw=";
   };
 
   build-system = [

pkgs/development/python-modules/dissect-qnxfs/default.nix

@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "dissect-qnxfs";
-  version = "1.0";
+  version = "1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "dissect.qnxfs";
     tag = version;
-    hash = "sha256-UnEwBcaBP64qIWVYWcsxxjWuiAM9yOCGWevnNonQn+8=";
+    hash = "sha256-XKiVfJWxrh4rAVXrQMd761cU8t9PhtCXkZOORd2euA8=";
   };
 
   build-system = [