Merge branch 'staging-next' into staging

doc/release-notes/rl-2605.section.md

@@ -131,6 +131,8 @@
 
 - `pocket-id` has been updated to version 2 that contains [breaking changes](https://pocket-id.org/docs/setup/major-releases/migrate-v2).
 
+- `services.xserver` will now throw an error if an X11 driver specified in  `videoDriver(s)` cannot be found. Previously, unknown drivers would be silently ignored.
+
 - `asio` (standalone version of `boost::asio`) has been updated from 1.24.0 to 1.36.0. Some breaking changes were introduced between these
   two versions, and the one affected most was the removal of `asio::io_service` in favor of `asio::io_context` in 1.33.0. `asio_1_32_0` is
   retained for packages that have not completed migration. `asio_1_10` has been removed as no packages depend on it anymore.

maintainers/maintainer-list.nix

@@ -12593,6 +12593,12 @@
     githubId = 43830312;
     name = "Joël Miramon";
   };
+  jmmv = {
+    email = "julio@meroh.net";
+    github = "jmmv";
+    githubId = 879272;
+    name = "Julio Merino";
+  };
   jn-sena = {
     email = "jn-sena@proton.me";
     github = "jn-sena";
@@ -19282,6 +19288,12 @@
     githubId = 810877;
     name = "Tom Doggett";
   };
+  noderyos = {
+    email = "vincent.bsod@gmail.com";
+    github = "Noderyos";
+    githubId = 56077132;
+    name = "Noderyos";
+  };
   noiioiu = {
     github = "noiioiu";
     githubId = 151288161;
@@ -27831,10 +27843,11 @@
     githubId = 68829907;
   };
   v3rm1n0 = {
-    name = "Niklas Choinowski";
-    email = "niklas.choinowski@proton.me";
+    name = "V3RM1N";
+    email = "mail@v3rm1n.dev";
     github = "v3rm1n0";
     githubId = 57269010;
+    keys = [ { fingerprint = "58E4 2840 D274 49A5 5948  78AA 85F3 7D09 1304 5718"; } ];
   };
   vaavaav = {
     name = "Pedro Peixoto";

nixos/modules/module-list.nix

@@ -1515,6 +1515,7 @@
   ./services/security/reaction.nix
   ./services/security/shibboleth-sp.nix
   ./services/security/sks.nix
+  ./services/security/ssh-agent-switcher.nix
   ./services/security/sshguard.nix
   ./services/security/sslmate-agent.nix
   ./services/security/step-ca.nix

nixos/modules/services/misc/autosuspend.nix

@@ -37,6 +37,7 @@ let
 
   # Dependencies needed by specific checks
   dependenciesForChecks = {
+    "Ping" = [ pkgs.iputils ];
     "Smb" = pkgs.samba;
     "XIdleTime" = [
       pkgs.xprintidle
@@ -225,6 +226,13 @@ in
   };
 
   config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.checks != { };
+        message = "`services.autosuspend.checks` must contain at least one activity check.";
+      }
+    ];
+
     systemd.services.autosuspend = {
       description = "A daemon to suspend your server in case of inactivity";
       documentation = [ "https://autosuspend.readthedocs.io/en/latest/systemd_integration.html" ];
@@ -235,16 +243,6 @@ in
         ExecStart = "${autosuspend}/bin/autosuspend -l ${autosuspend}/etc/autosuspend-logging.conf -c ${autosuspend-conf} daemon";
       };
     };
-
-    systemd.services.autosuspend-detect-suspend = {
-      description = "Notifies autosuspend about suspension";
-      documentation = [ "https://autosuspend.readthedocs.io/en/latest/systemd_integration.html" ];
-      wantedBy = [ "sleep.target" ];
-      after = [ "sleep.target" ];
-      serviceConfig = {
-        ExecStart = "${autosuspend}/bin/autosuspend -l ${autosuspend}/etc/autosuspend-logging.conf -c ${autosuspend-conf} presuspend";
-      };
-    };
   };
 
   meta = {

nixos/modules/services/misc/servarr/radarr.nix

@@ -64,6 +64,40 @@ in
         EnvironmentFile = cfg.environmentFiles;
         ExecStart = "${cfg.package}/bin/Radarr -nobrowser -data='${cfg.dataDir}'";
         Restart = "on-failure";
+
+        # Hardening
+        CapabilityBoundingSet = "";
+        NoNewPrivileges = true;
+        ProtectHome = true;
+        ProtectClock = true;
+        ProtectKernelLogs = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        PrivateUsers = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectControlGroups = true;
+        RestrictSUIDSGID = true;
+        RemoveIPC = true;
+        UMask = "0022";
+        ProtectHostname = true;
+        ProtectProc = "invisible";
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        LockPersonality = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@debug"
+          "~@mount"
+          "@chown"
+        ];
       };
     };
 

nixos/modules/services/misc/servarr/sonarr.nix

@@ -86,6 +86,40 @@ in
           "-data=${cfg.dataDir}"
         ];
         Restart = "on-failure";
+
+        # Hardening
+        CapabilityBoundingSet = "";
+        NoNewPrivileges = true;
+        ProtectHome = true;
+        ProtectClock = true;
+        ProtectKernelLogs = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        PrivateUsers = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectControlGroups = true;
+        RestrictSUIDSGID = true;
+        RemoveIPC = true;
+        UMask = "0022";
+        ProtectHostname = true;
+        ProtectProc = "invisible";
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        LockPersonality = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@debug"
+          "~@mount"
+          "@chown"
+        ];
       }
       // lib.optionalAttrs (cfg.dataDir == "/var/lib/sonarr/.config/NzbDrone") {
         StateDirectory = "sonarr";

nixos/modules/services/monitoring/prometheus/default.nix

@@ -97,7 +97,7 @@ let
     ++ (
       if (cfg.enableAgentMode) then
         [
-          "--enable-feature=agent"
+          "--agent"
         ]
       else
         [

nixos/modules/services/security/ssh-agent-switcher.nix

@@ -0,0 +1,43 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.ssh-agent-switcher;
+in
+{
+  meta.maintainers = [ lib.maintainers.jmmv ];
+
+  options = {
+    services.ssh-agent-switcher = {
+      enable = lib.mkEnableOption "ssh-agent-switcher daemon" // {
+        description = ''
+          Whether to enable ssh-agent-switcher, a daemon that proxies SSH agent
+          connections to forwarded agents. This allows tmux/screen sessions to
+          access SSH agents across reconnections.
+
+          This is a per-user service that automatically starts when you log in
+          via SSH and sets SSH_AUTH_SOCK to point to a stable socket location.
+
+          Note: This only activates for SSH sessions, not graphical or console logins.
+        '';
+      };
+
+      package = lib.mkPackageOption pkgs "ssh-agent-switcher" { };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+
+    environment.loginShellInit = ''
+      if [ -n "$SSH_CONNECTION" ]; then
+        mkdir -p "''${XDG_RUNTIME_DIR:-/run/user/$(id -u)}"
+        export SSH_AUTH_SOCK="''${XDG_RUNTIME_DIR:-/run/user/$(id -u)}/ssh-agent-switcher.sock"
+        ${lib.getExe cfg.package} --daemon --socket-path="$SSH_AUTH_SOCK" 2>/dev/null || true
+      fi
+    '';
+  };
+}

nixos/modules/services/web-apps/firefly-iii-data-importer.nix

@@ -267,6 +267,7 @@ in
           "${cfg.dataDir}/storage/framework/sessions"
           "${cfg.dataDir}/storage/framework/testing"
           "${cfg.dataDir}/storage/framework/views"
+          "${cfg.dataDir}/storage/import-jobs"
           "${cfg.dataDir}/storage/jobs"
           "${cfg.dataDir}/storage/logs"
           "${cfg.dataDir}/storage/submission-routines"

nixos/modules/services/x11/xserver.nix

@@ -830,7 +830,8 @@ in
 
     services.xserver.videoDrivers = mkIf (cfg.videoDriver != null) [ cfg.videoDriver ];
 
-    # FIXME: somehow check for unknown driver names.
+    # We ignore unknown drivers here because they may be resolved by other modules (e.g., the Nvidia
+    # module). We assert that all specified drivers were eventually found in the assertions below.
     services.xserver.drivers = flip concatMap cfg.videoDrivers (
       name:
       lib.optional (videoDrivers ? ${name}) (
@@ -862,7 +863,11 @@ in
         assertion = cfg.upscaleDefaultCursor -> cfg.dpi != null;
         message = "Specify `config.services.xserver.dpi` to upscale the default cursor.";
       }
-    ];
+    ]
+    ++ map (driver: {
+      assertion = builtins.elem driver (builtins.catAttrs "name" cfg.drivers);
+      message = "Unknown X11 driver ‘${driver}’ specified in `services.xserver.videoDrivers`.";
+    }) cfg.videoDrivers;
 
     environment.etc =
       (optionalAttrs cfg.exportConfiguration {

nixos/tests/all-tests.nix

@@ -257,6 +257,7 @@ in
   authelia = runTest ./authelia.nix;
   auto-cpufreq = runTest ./auto-cpufreq.nix;
   autobrr = runTest ./autobrr.nix;
+  autosuspend = runTest ./autosuspend.nix;
   avahi = runTest {
     imports = [ ./avahi.nix ];
     _module.args.networkd = false;

nixos/tests/autosuspend.nix

@@ -0,0 +1,30 @@
+{ lib, pkgs, ... }:
+
+{
+  name = "autosuspend";
+  meta.maintainers = [ lib.maintainers.anthonyroussel ];
+
+  nodes = {
+    machine = {
+      services.autosuspend = {
+        enable = true;
+
+        settings = {
+          interval = 5;
+          idle_time = 5;
+          suspend_cmd = "${pkgs.coreutils}/bin/touch /tmp/suspended";
+        };
+
+        # Return exit code 1 to trigger suspend
+        checks.ExternalCommand.command = "exit 1";
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    machine.wait_for_unit("autosuspend.service")
+    machine.wait_for_file("/tmp/suspended")
+  '';
+}

nixos/tests/hibernate.nix

@@ -25,7 +25,7 @@ makeTest {
           ./common/auto-format-root-device.nix
         ];
 
-        systemd.services.backdoor.conflicts = [ "sleep.target" ];
+        powerManagement.powerDownCommands = "systemctl --no-block stop backdoor.service";
         powerManagement.resumeCommands = "systemctl --no-block restart backdoor.service";
 
         virtualisation.emptyDiskImages = [ (2 * config.virtualisation.memorySize) ];

pkgs/applications/audio/snapcast/default.nix

@@ -59,7 +59,9 @@ stdenv.mkDerivation rec {
   ++ lib.optional pipewireSupport pipewire
   ++ lib.optional stdenv.hostPlatform.isLinux alsa-lib;
 
-  TARGET = lib.optionalString stdenv.hostPlatform.isDarwin "MACOS";
+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    TARGET = "MACOS";
+  };
 
   cmakeFlags = [
     (lib.cmakeBool "BUILD_WITH_PULSE" pulseaudioSupport)

pkgs/applications/blockchains/elements/default.nix

@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation rec {
   pname = if withGui then "elements" else "elementsd";
-  version = "23.3.1";
+  version = "23.3.2";
 
   src = fetchFromGitHub {
     owner = "ElementsProject";
     repo = "elements";
     rev = "elements-${version}";
-    sha256 = "sha256-hqHKH9B6EITwZ4F+YdPJI4n3Z3EeXdPYbzRoNODlThY=";
+    sha256 = "sha256-NLLM+stYOXcnAjEfXRerjvgMXM8jFSOyZhu/A0ZTnRw=";
   };
 
   nativeBuildInputs = [

pkgs/applications/emulators/libretro/cores/flycast.nix

@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
   core = "flycast";
-  version = "0-unstable-2026-02-06";
+  version = "0-unstable-2026-02-16";
 
   src = fetchFromGitHub {
     owner = "flyinghead";
     repo = "flycast";
-    rev = "c577e29f43edc5a86c6ed4edca46706000d214b2";
-    hash = "sha256-nHMtXwtrgxoN/tuY1d+DqZAJFag8vmHAP/9tS2j3ErU=";
+    rev = "ba5b3c71ecc966e52f698f41443e7cc9b81bf824";
+    hash = "sha256-tbq+NgbZDKMg0K0cWF1+7h80QTaAaO5BD9nf94z5fc0=";
     fetchSubmodules = true;
   };
 

pkgs/applications/networking/mailreaders/notmuch/muchsync.nix

@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     xapian
     zlib
   ];
-  XAPIAN_CONFIG = "${xapian}/bin/xapian-config";
+  env.XAPIAN_CONFIG = "${xapian}/bin/xapian-config";
   meta = {
     description = "Synchronize maildirs and notmuch databases";
     mainProgram = "muchsync";

pkgs/by-name/ad/adoptopenjdk-icedtea-web/package.nix

@@ -62,8 +62,10 @@ stdenv.mkDerivation (finalAttrs: {
     touch $XDG_CONFIG_HOME/icedtea-web/deployment.properties
   '';
 
-  HOME = "/build";
-  XDG_CONFIG_HOME = "/build";
+  env = {
+    HOME = "/build";
+    XDG_CONFIG_HOME = "/build";
+  };
 
   configureFlags = [
     "--with-itw-libs=DISTRIBUTION"

pkgs/by-name/an/anki/addons/anki-quizlet-importer-extended/default.nix

@@ -6,12 +6,12 @@
 }:
 anki-utils.buildAnkiAddon (finalAttrs: {
   pname = "anki-quizlet-importer-extended";
-  version = "2025.09.28";
+  version = "2026.01.17";
   src = fetchFromGitHub {
     owner = "sviatoslav-lebediev";
     repo = "anki-quizlet-importer-extended";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-j/ow/HCc70dD/BpMDqGx7rib7G0FfxazzjuPmEQbYTk=";
+    hash = "sha256-BTddZColXM193x8xFa1axHeiWukjxXvwkXGpHxsLtR0=";
   };
   passthru.updateScript = nix-update-script { };
   meta = {

pkgs/by-name/an/ansel/package.nix

@@ -82,13 +82,13 @@ let
 in
 stdenv.mkDerivation {
   pname = "ansel";
-  version = "0-unstable-2026-02-08";
+  version = "0-unstable-2026-02-16";
 
   src = fetchFromGitHub {
     owner = "aurelienpierreeng";
     repo = "ansel";
-    rev = "e9988402c5007c886f5256bd189009d3abd842a7";
-    hash = "sha256-qjai8UeqSkoDmc0YAmIxxaMJiLwTDcZteqChHGf3CPg=";
+    rev = "e6cc53c5631060f50f3af6525dfc9d0336dd4275";
+    hash = "sha256-uSEttpEosEUXKeG7abAl4VSa8erp8d+A7QwFG2Tmz+U=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/ar/argocd/package.nix

@@ -29,7 +29,7 @@ buildGoModule (finalAttrs: {
 
     offlineCache = fetchYarnDeps {
       yarnLock = "${finalAttrs.src}/ui/yarn.lock";
-      hash = "sha256-ekhSPWzIgFhwSw0bIlBqu8LTYk3vuJ9VM8eHc3mnHGM=";
+      hash = "sha256-kqBolkQiwZUBic0f+Ek5HwYsOmro1+FStkDLXAre79o=";
     };
 
     nativeBuildInputs = [

pkgs/by-name/au/audit/package.nix

@@ -175,5 +175,10 @@ stdenv.mkDerivation (finalAttrs: {
       "auparse"
     ];
     platforms = lib.platforms.linux;
+    identifiers.cpeParts =
+      lib.meta.cpeFullVersionWithVendor "linux_audit_project" finalAttrs.version
+      // {
+        product = "linux_audit";
+      };
   };
 })

pkgs/by-name/au/autosuspend/package.nix

@@ -2,21 +2,46 @@
   lib,
   dbus,
   fetchFromGitHub,
+  nixosTests,
   python3,
+  sphinxHook,
+  withDocs ? true,
+  withMan ? true,
 }:
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "autosuspend";
-  version = "9.0.1";
+  version = "10.0.0";
   pyproject = true;
 
+  outputs = [
+    "out"
+  ]
+  ++ lib.optionals withDocs [ "doc" ]
+  ++ lib.optionals withMan [ "man" ];
+
   src = fetchFromGitHub {
     owner = "languitar";
     repo = "autosuspend";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-PVxsdCPGu+bhjfAF5Hu4Xa3lETARitbBUKuy7ursAUE=";
+    hash = "sha256-o9Jpb4i2/SJ3s3h5sclNjpaN/UFk1YbpPf7b3rGXLRg=";
   };
 
+  postPatch = ''
+    # This mapping triggers network access on docs generation
+    substituteInPlace doc/source/conf.py \
+      --replace-fail 'intersphinx_mapping' '# intersphinx_mapping'
+  '';
+
+  nativeBuildInputs = lib.optionals (withDocs || withMan) (
+    [
+      sphinxHook
+    ]
+    ++ finalAttrs.passthru.optional-dependencies.docs
+  );
+
+  sphinxBuilders = lib.optionals withDocs [ "html" ] ++ lib.optionals withMan [ "man" ];
+
   build-system = with python3.pkgs; [
     setuptools
   ];
@@ -27,8 +52,8 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     jsonpath-ng
     lxml
     mpd2
-    portalocker
     psutil
+    pygobject3
     python-dateutil
     requests
     requests-file
@@ -36,6 +61,16 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     tzlocal
   ];
 
+  optional-dependencies = {
+    docs = with python3.pkgs; [
+      furo
+      recommonmark
+      sphinx-autodoc-typehints
+      sphinx-issues
+      sphinxcontrib-plantuml
+    ];
+  };
+
   nativeCheckInputs = with python3.pkgs; [
     dbus
     freezegun
@@ -53,6 +88,10 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     "test_multiple_sessions"
   ];
 
+  passthru.tests = {
+    inherit (nixosTests) autosuspend;
+  };
+
   meta = {
     description = "Daemon to automatically suspend and wake up a system";
     homepage = "https://autosuspend.readthedocs.io";

pkgs/by-name/av/avalonia/package.nix

@@ -70,11 +70,21 @@ stdenvNoCC.mkDerivation (
         ./0004-disable-windows-desktop.patch
       ];
 
-      # this needs to be match the version being patched above
-      UNICODE_CHARACTER_DATABASE = fetchzip {
-        url = "https://www.unicode.org/Public/15.0.0/ucd/UCD.zip";
-        hash = "sha256-jj6bX46VcnH7vpc9GwM9gArG+hSPbOGL6E4SaVd0s60=";
-        stripRoot = false;
+      env = {
+        # this needs to be match the version being patched above
+        UNICODE_CHARACTER_DATABASE = fetchzip {
+          url = "https://www.unicode.org/Public/15.0.0/ucd/UCD.zip";
+          hash = "sha256-jj6bX46VcnH7vpc9GwM9gArG+hSPbOGL6E4SaVd0s60=";
+          stripRoot = false;
+        };
+        FONTCONFIG_FILE =
+          let
+            fc = makeFontsConf { fontDirectories = [ liberation_ttf ]; };
+          in
+          runCommand "fonts.conf" { } ''
+            substitute ${fc} $out \
+            --replace-fail "/etc/" "${fontconfig.out}/etc/"
+          '';
       };
 
       postPatch = ''
@@ -142,15 +152,6 @@ stdenvNoCC.mkDerivation (
       #  - NuGet packages config '/build/source/nukebuild/_build.csproj'
       linkNuGetPackagesAndSources = true;
 
-      FONTCONFIG_FILE =
-        let
-          fc = makeFontsConf { fontDirectories = [ liberation_ttf ]; };
-        in
-        runCommand "fonts.conf" { } ''
-          substitute ${fc} $out \
-            --replace-fail "/etc/" "${fontconfig.out}/etc/"
-        '';
-
       preConfigure = ''
         # closed source (telemetry?) https://github.com/AvaloniaUI/Avalonia/discussions/16878
         dotnet remove packages/Avalonia/Avalonia.csproj package Avalonia.BuildServices

pkgs/by-name/ba/badlion-client/package.nix

@@ -23,7 +23,7 @@ appimageTools.wrapAppImage rec {
 
   extraInstallCommands = ''
     install -Dm444 ${src}/BadlionClient.desktop $out/share/applications/BadlionClient.desktop
-    install -Dm444 ${src}/BadlionClient.png $out/share/pixmaps/BadlionClient.png
+    install -Dm444 ${src}/BadlionClient.png -t $out/share/icons/hicolor/1024x1024/apps
     substituteInPlace $out/share/applications/BadlionClient.desktop \
       --replace-fail "Exec=AppRun --no-sandbox %U" "Exec=badlion-client"
     wrapProgram $out/bin/badlion-client \

pkgs/by-name/bo/boehmgc/package.nix

@@ -120,5 +120,10 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.boehmGC;
     maintainers = [ ];
     platforms = lib.platforms.all;
+    identifiers.cpeParts =
+      lib.meta.cpeFullVersionWithVendor "boehm-demers-weiser" finalAttrs.version
+      // {
+        product = "garbage_collector";
+      };
   };
 })

pkgs/by-name/br/brogue-ce/package.nix

@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "brogue-ce";
-  version = "1.15";
+  version = "1.15.1";
 
   src = fetchFromGitHub {
     owner = "tmewett";
     repo = "BrogueCE";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-NZp40tPNyO85J6pduV/X79cfUYAAUH7wySlg1IgT4f4=";
+    hash = "sha256-a+gzaBhQq9xgEVM20X+pbu7xzUcKzylxYk9qu9GQOAw=";
   };
 
   postPatch = ''

pkgs/by-name/bu/bulloak/package.nix

@@ -46,7 +46,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   doCheck = false;
 
   # provide the list of solc versions to the `svm-rs-builds` dependency
-  SVM_RELEASES_LIST_JSON =
+  env.SVM_RELEASES_LIST_JSON =
     solc-versions.${stdenv.hostPlatform.system}
       or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 

pkgs/by-name/ca/cacert/package.nix

@@ -30,6 +30,9 @@ let
       lukegb
     ];
     license = lib.licenses.mpl20;
+    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "mozilla" version // {
+      product = "nss";
+    };
   };
 in
 stdenv.mkDerivation {

pkgs/by-name/cf/cfspeedtest/package.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cfspeedtest";
-  version = "2.0.3";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "code-inflation";
     repo = "cfspeedtest";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-KeJ/p9kXfI3OuAyNUx2C6DKpmtL3239uHpWAf4mDr4Q=";
+    hash = "sha256-EVZFmTjv2j7kax4MC5HTkVa7/IiDNZcIOgsntSGfzG4=";
   };
 
-  cargoHash = "sha256-mXSbbY3nuhEw+QUk6gt71HIh2gKNBO6C0trZbyzbpnM=";
+  cargoHash = "sha256-cA+eRVZiZL+bbPc+Vr7nkwMLbQBKOO3uU0XzrxVajqg=";
 
   nativeBuildInputs = [ installShellFiles ];
 
@@ -28,6 +28,18 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --zsh <($out/bin/cfspeedtest --generate-completion zsh)
   '';
 
+  # require internet access
+  checkFlags = map (t: "--skip=${t}") [
+    "speedtest::tests::test_fetch_metadata_integration"
+    "speedtest::tests::test_run_tests_does_not_retry_non_retryable_4xx"
+    "speedtest::tests::test_run_tests_retries_429_and_records_success"
+    "speedtest::tests::test_run_tests_retry_delay_resets_after_success"
+    "speedtest::tests::test_run_tests_retry_delay_uses_retry_streak_not_total_attempts"
+    "speedtest::tests::test_run_tests_stops_after_max_attempts_on_retryable_failures"
+    "speedtest::tests::test_upload_duration_excludes_delayed_response_body"
+    "speedtest::tests::test_upload_retryable_failure_parses_retry_after_without_drain_skew"
+  ];
+
   meta = {
     description = "Unofficial CLI for speed.cloudflare.com";
     homepage = "https://github.com/code-inflation/cfspeedtest";

pkgs/by-name/ch/chess-clock/package.nix

@@ -17,14 +17,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "chess-clock";
-  version = "0.6.1";
+  version = "0.6.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = "chess-clock";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-XDOCHFZC3s3b/4kD1ZkhWar3kozW3vXc0pk7O6oQfiE=";
+    hash = "sha256-jqWZI37ewkPmY+37dwJUJnBZcsBO1sn04r2qp8PIWTs=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ci/cirrus-cli/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "cirrus-cli";
-  version = "0.163.2";
+  version = "0.164.2";
 
   src = fetchFromGitHub {
     owner = "cirruslabs";
     repo = "cirrus-cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-x/SwCCgW3wZnQ0VwVUinfPXiBexKdfvFGMFiBdmApFI=";
+    hash = "sha256-/xOiqa26Zfv1AugH3w9euQHmEwLm5S+sSu7DVZDHOzc=";
   };
 
-  vendorHash = "sha256-7xjt1TP+Wei+iEiCJMn7XyzW4RV2GNf+xX5O3tnXFvc=";
+  vendorHash = "sha256-G/UlmNDzYuF9gkAaGO6O/SziNZ9obs01sD2Cmu+r8Dc=";
 
   ldflags = [
     "-X github.com/cirruslabs/cirrus-cli/internal/version.Version=v${finalAttrs.version}"

pkgs/by-name/cl/clightd/package.nix

@@ -39,10 +39,12 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-LOhBBd7QL5kH4TzMFgrh70C37WsFdsiKArP+tIEiPWo=";
   };
 
-  # dbus-1.pc has datadir=/etc
-  SYSTEM_BUS_DIR = "${placeholder "out"}/share/dbus-1/system-services";
-  # polkit-gobject-1.pc has prefix=${polkit.out}
-  POLKIT_ACTION_DIR = "${placeholder "out"}/share/polkit-1/actions";
+  env = {
+    # dbus-1.pc has datadir=/etc
+    SYSTEM_BUS_DIR = "${placeholder "out"}/share/dbus-1/system-services";
+    # polkit-gobject-1.pc has prefix=${polkit.out}
+    POLKIT_ACTION_DIR = "${placeholder "out"}/share/polkit-1/actions";
+  };
 
   postPatch = ''
     sed -i "s@pkg_get_variable(SYSTEM_BUS_DIR.*@set(SYSTEM_BUS_DIR $SYSTEM_BUS_DIR)@" CMakeLists.txt

pkgs/by-name/co/codespelunker/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "codespelunker";
-  version = "1.4.0";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "boyter";
     repo = "cs";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-FZf3aRozpXWTRDrNDRxb1dGBXiLVEYOUd8a/hqzThps=";
+    hash = "sha256-knsEEpmBuFO5UkUenjVilSg8h+MMGnmbDX0DrAlg98s=";
   };
 
   vendorHash = null;

pkgs/by-name/co/cog/package.nix

@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "cog";
-  version = "0.0.52";
+  version = "0.0.56";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "cog";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BebTJZo9bL6xQY0njfLzyeElTgnnJsizGY2G7D9ClXI=";
+    hash = "sha256-puD0Xlap4yBoAXyhmK+AUSkqiungQsYqkW28BapscEU=";
   };
 
-  vendorHash = "sha256-S0P65rjIMcDWcJxGyk9aR46bsVXdvVWSt+MLJ4tLdqc=";
+  vendorHash = "sha256-WIYV1kqV5Cr49FDIa1GuR9Cnav/x09v3SwHhUAwqdhM=";
 
   subPackages = [ "cmd/cli" ];
 

pkgs/by-name/da/dawarich/package.nix

@@ -64,10 +64,12 @@ stdenv.mkDerivation (finalAttrs: {
     hash = sources.npmHash;
   };
 
-  RAILS_ENV = "production";
-  NODE_ENV = "production";
-  REDIS_URL = ""; # build error if not defined
-  TAILWINDCSS_INSTALL_DIR = "${tailwindcss_3}/bin";
+  env = {
+    RAILS_ENV = "production";
+    NODE_ENV = "production";
+    REDIS_URL = ""; # build error if not defined
+    TAILWINDCSS_INSTALL_DIR = "${tailwindcss_3}/bin";
+  };
 
   nativeBuildInputs = [
     nodejs

pkgs/by-name/de/deadlock-mod-manager/package.nix

@@ -86,7 +86,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     ./no-updater-artifacts.patch
   ];
 
-  VITE_API_URL = "https://api.deadlockmods.app";
+  env.VITE_API_URL = "https://api.deadlockmods.app";
 
   # Skip tests that require network access
   checkFlags = [

pkgs/by-name/de/descent3-unwrapped/package.nix

@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "DescentDevelopers";
     repo = "Descent3";
-    rev = "937e649ea616b7b732211443c5c7378d144cd39c";
+    rev = "156cba8aafd997d27deb0902ba6026bcdcc1cfaf";
     leaveDotGit = true;
     # Descent 3 is supposed to display its Git commit hash in the bottom right
     # corner of the main menu. That feature only works if either the .git
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
       git rev-parse --verify HEAD | tr --delete '\n' > git-hash.txt
       rm -r .git
     '';
-    hash = "sha256-WGjIHBGpV0j7K3LHRNv4qkZkSrZTEQGryixl6i0BK8U=";
+    hash = "sha256-NsZPGgIzI2mE3mJ7eoczaNDkGZUpMUMBRLK2qt2WPgk=";
   };
 
   hardeningDisable = [ "format" ];

pkgs/by-name/di/digitalbitbox/package.nix

@@ -84,12 +84,14 @@ stdenv.mkDerivation (finalAttrs: {
     libsForQt5.qtmultimedia
   ];
 
-  LUPDATE = "${libsForQt5.qttools.dev}/bin/lupdate";
-  LRELEASE = "${libsForQt5.qttools.dev}/bin/lrelease";
-  MOC = "${libsForQt5.qtbase.dev}/bin/moc";
-  QTDIR = libsForQt5.qtbase.dev;
-  RCC = "${libsForQt5.qtbase.dev}/bin/rcc";
-  UIC = "${libsForQt5.qtbase.dev}/bin/uic";
+  env = {
+    LUPDATE = "${libsForQt5.qttools.dev}/bin/lupdate";
+    LRELEASE = "${libsForQt5.qttools.dev}/bin/lrelease";
+    MOC = "${libsForQt5.qtbase.dev}/bin/moc";
+    QTDIR = libsForQt5.qtbase.dev;
+    RCC = "${libsForQt5.qtbase.dev}/bin/rcc";
+    UIC = "${libsForQt5.qtbase.dev}/bin/uic";
+  };
 
   configureFlags = [
     "--enable-libusb"

pkgs/by-name/dm/dms-shell/package.nix

@@ -19,6 +19,8 @@ buildGoModule (
       kirigami.unwrapped
       sonnet
       qtmultimedia
+      qtimageformats
+      kimageformats
     ];
 
     qmlImportPath = lib.concatStringsSep ":" (map (o: "${o}/${qt6.qtbase.qtQmlPrefix}") qmlPkgs);
@@ -26,18 +28,18 @@ buildGoModule (
   in
   {
     pname = "dms-shell";
-    version = "1.2.3";
+    version = "1.4.0";
 
     src = fetchFromGitHub {
       owner = "AvengeMedia";
       repo = "DankMaterialShell";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-P//moH3z9r4PXirTzXVsccQINsK5AIlF9RWOBwK3vLc=";
+      hash = "sha256-O9NIJqfuSjwY//7OyFH3FqxRHe5M0vmmsXcryOi/bAE=";
     };
 
     sourceRoot = "${finalAttrs.src.name}/core";
 
-    vendorHash = "sha256-9CnZFtjXXWYELRiBX2UbZvWopnl9Y1ILuK+xP6YQZ9U=";
+    vendorHash = "sha256-cVUJXgzYMRSM0od1xzDVkMTdxHu3OIQX2bQ8AJbGQ1Q=";
 
     ldflags = [
       "-s"

pkgs/by-name/dr/dracula-theme/package.nix

@@ -8,7 +8,7 @@
 
 let
   themeName = "Dracula";
-  version = "4.0.0-unstable-2026-01-31";
+  version = "4.0.0-unstable-2026-02-09";
 in
 stdenvNoCC.mkDerivation {
   pname = "dracula-theme";
@@ -17,8 +17,8 @@ stdenvNoCC.mkDerivation {
   src = fetchFromGitHub {
     owner = "dracula";
     repo = "gtk";
-    rev = "1282a6806d568b736fddf783263fc96ccd34a8ce";
-    hash = "sha256-6fYbe3CVfCw/CZaFX5Mc1DPb4+uiQLIZlirx+2/jUzw=";
+    rev = "f590e017d366466323a26c5cb8360ffca026aac0";
+    hash = "sha256-eP+GTmDNPeXc3SE8MrQC4jzwz2a0yDA89msIkPalp1w=";
   };
 
   propagatedUserEnvPkgs = [

pkgs/by-name/dy/dyff/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "dyff";
-  version = "1.10.3";
+  version = "1.10.4";
 
   src = fetchFromGitHub {
     owner = "homeport";
     repo = "dyff";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-tMb/SjrD1Sruvb/qeKu75EwTg4MyX9rCT0T4cJzIyko=";
+    sha256 = "sha256-3BW6uvxnwmvbzqoYnXKO85hMEFXPp+QsrAoGj/ksn/g=";
   };
 
-  vendorHash = "sha256-NPCC8cVpJ07k5H4z2/fiPkxiWgW852pWqyW4gIQfIpw=";
+  vendorHash = "sha256-vZI56PKtwmCqqWwPGuWApAZ2lBv17vin1aD36Ym3HOg=";
 
   subPackages = [
     "cmd/dyff"

pkgs/by-name/en/entire/package.nix

@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "entire";
-  version = "0.4.4";
+  version = "0.4.5";
 
   src = fetchFromGitHub {
     owner = "entireio";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6/TsSmJ0z72Ta5ZihO06uV4Mik+fFpm8eCa7d5zlq24=";
+    hash = "sha256-BDke84xQ6t7W+BONQn7r8ZBENNr8oGv8mtJ5unyv0lA=";
   };
 
-  vendorHash = "sha256-rh2VhdwNT5XJYCVjj8tnoY7cacEhc/kcxi0NHYFPYO8=";
+  vendorHash = "sha256-zgVdh80aNnvC1oMp/CS0nx4b1y9b0jwVKFotil6kQZ0=";
 
   postPatch = ''
     substituteInPlace go.mod --replace-fail "go 1.25.6" "go 1.25.5"

pkgs/by-name/en/entr/package.nix

@@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
   checkTarget = "test";
   installFlags = [ "PREFIX=$(out)" ];
 
-  TARGET_OS = stdenv.hostPlatform.uname.system;
+  env.TARGET_OS = stdenv.hostPlatform.uname.system;
 
   meta = {
     homepage = "https://eradman.com/entrproject/";

pkgs/by-name/ev/evdev-proto/package.nix

@@ -19,28 +19,30 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ freebsd.makeMinimal ];
 
-  ARCH = freebsd.makeMinimal.MACHINE_ARCH;
-  OPSYS = "FreeBSD";
-  _OSRELEASE = "${lib.versions.majorMinor freebsd.makeMinimal.version}-RELEASE";
+  env = {
+    ARCH = freebsd.makeMinimal.MACHINE_ARCH;
+    OPSYS = "FreeBSD";
+    _OSRELEASE = "${lib.versions.majorMinor freebsd.makeMinimal.version}-RELEASE";
 
-  AWK = "awk";
-  CHMOD = "chmod";
-  FIND = "find";
-  MKDIR = "mkdir -p";
-  PKG_BIN = "${buildPackages.pkg}/bin/pkg";
-  RM = "rm -f";
-  SED = "${buildPackages.freebsd.sed}/bin/sed";
-  SETENV = "env";
-  SH = "sh";
-  TOUCH = "touch";
-  XARGS = "xargs";
+    AWK = "awk";
+    CHMOD = "chmod";
+    FIND = "find";
+    MKDIR = "mkdir -p";
+    PKG_BIN = "${buildPackages.pkg}/bin/pkg";
+    RM = "rm -f";
+    SED = "${buildPackages.freebsd.sed}/bin/sed";
+    SETENV = "env";
+    SH = "sh";
+    TOUCH = "touch";
+    XARGS = "xargs";
 
-  ABI_FILE = runCommandCC "abifile" { } "$CC -shared -o $out";
-  CLEAN_FETCH_ENV = true;
-  INSTALL_AS_USER = true;
-  NO_CHECKSUM = true;
-  NO_MTREE = true;
-  SRC_BASE = freebsd.source;
+    ABI_FILE = runCommandCC "abifile" { } "$CC -shared -o $out";
+    CLEAN_FETCH_ENV = true;
+    INSTALL_AS_USER = true;
+    NO_CHECKSUM = true;
+    NO_MTREE = true;
+    SRC_BASE = freebsd.source;
+  };
 
   preUnpack = ''
     export MAKE_JOBS_NUMBER="$NIX_BUILD_CORES"

pkgs/by-name/ev/evil-helix/package.nix

@@ -25,15 +25,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
   env = {
     # disable fetching and building of tree-sitter grammars in the helix-term build.rs
     HELIX_DISABLE_AUTO_GRAMMAR_BUILD = "1";
-    HELIX_DEFAULT_RUNTIME = "${placeholder "out"}/lib/runtime";
+    HELIX_DEFAULT_RUNTIME = helix.runtime;
   };
 
   postInstall = ''
     mkdir -p $out/lib
-    cp -r runtime $out/lib
-    # copy tree-sitter grammars from helix package
-    # TODO: build it from source instead
-    cp -r ${helix}/lib/runtime/grammars/* $out/lib/runtime/grammars/
     installShellCompletion contrib/completion/hx.{bash,fish,zsh}
     mkdir -p $out/share/{applications,icons/hicolor/256x256/apps}
     cp contrib/Helix.desktop $out/share/applications

pkgs/by-name/ex/exploitdb/package.nix

@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "exploitdb";
-  version = "2026-02-05";
+  version = "2026-02-12";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = "exploitdb";
     tag = finalAttrs.version;
-    hash = "sha256-ec5XB+L/4qRErK/0VOsidkor52aBjuR87ja3V7C3YSw=";
+    hash = "sha256-K7C4NZmeKRpKT5yJH5rvq678sd4xSWnb5nUSZFqO+9I=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/by-name/ex/extism-js/package.nix

@@ -12,14 +12,14 @@
 }:
 
 let
-  version = "1.5.1";
+  version = "1.6.0";
   tag = "v${version}";
   system = lib.replaceStrings [ "darwin" ] [ "macos" ] stdenvNoCC.hostPlatform.system;
   hashes = {
-    aarch64-darwin = "sha256-BHld8Dwwd6fexc05oHOIawa5PtGZAI61wQGWE8T+iMs=";
-    aarch64-linux = "sha256-KM3/y31OdLmEAcc48TSLmXei2GD6FhOHYlD7W/ErP+I=";
-    x86_64-darwin = "sha256-cE0JJK92pTJyGnHEZ7wA6+dpMvVOTMzFM2Mkwfy5kbQ=";
-    x86_64-linux = "sha256-9qSjqPFmUaUnpGQ/ldIpyFSgTWbUYozcckpYxpm5PJU=";
+    aarch64-darwin = "sha256-VI4lvaOXGgfDLXiiSRNc+Mt7Pu3hAeh44G5T4BrC4M4=";
+    aarch64-linux = "sha256-FaGGJQ5o1r/07IOf/yddRakOODppIJ3MEjnrnjrubhs=";
+    x86_64-darwin = "sha256-2FqHXCoHHwwp/lcnZMUsOkmfFXq3+e+siTmkNkOQ4ps=";
+    x86_64-linux = "sha256-Te0nHM9GUDHM0Nw156FA4TTX8wchZxzEqOH/gF1KrWg=";
   };
 in
 stdenvNoCC.mkDerivation {
@@ -61,6 +61,11 @@ stdenvNoCC.mkDerivation {
     versionCheckHook
   ];
 
+  # https://github.com/extism/js-pdk/pull/154
+  preInstallCheck = ''
+    version=1.5.1
+  '';
+
   meta = {
     changelog = "https://github.com/extism/js-pdk/releases/tag/${tag}";
     description = "Write Extism plugins in JavaScript & TypeScript";

pkgs/by-name/fs/fsautocomplete/deps.json

@@ -76,8 +76,8 @@
   },
   {
     "pname": "fsharp-analyzers",
-    "version": "0.33.0",
-    "hash": "sha256-inPKPeLTaImrj4uiEy/vpru1cestNr/s/qgyRsgvwPc="
+    "version": "0.35.0",
+    "hash": "sha256-GxQR3Fq28cb+akNbzRTav9nhMtayN/0g2d1G6Ml+ck4="
   },
   {
     "pname": "FSharp.Analyzers.Build",
@@ -86,13 +86,13 @@
   },
   {
     "pname": "FSharp.Analyzers.SDK",
-    "version": "0.34.1",
-    "hash": "sha256-irU+Cx4ke47nSzOSozj7qPWa8a0RlMBb0mfIXzoxPiY="
+    "version": "0.35.0",
+    "hash": "sha256-JlwkutVgOUDZJ7PfzgXn6Pepr30Qd7M9FpcZwVXNGhc="
   },
   {
     "pname": "FSharp.Compiler.Service",
-    "version": "43.10.100",
-    "hash": "sha256-80hXILU4oYRtTOl3CeFt1MiquS2B/vbEI7YWcL4+8cQ="
+    "version": "43.10.101",
+    "hash": "sha256-5r9ulr3IVW74Z/RRZ24RhI6wSPdv4jUZHNBKRhRIWco="
   },
   {
     "pname": "FSharp.Control.AsyncSeq",
@@ -106,8 +106,8 @@
   },
   {
     "pname": "FSharp.Core",
-    "version": "10.0.100",
-    "hash": "sha256-stXiDuNoO0xYs82vm6CNWbTsxUErbWc1iSirUyiUdXA="
+    "version": "10.0.101",
+    "hash": "sha256-i7crdE0/u+/mFCD1rNFc/iT5TFr8Dae9dNpVRmbpSbY="
   },
   {
     "pname": "FSharp.Data.Adaptive",
@@ -206,8 +206,8 @@
   },
   {
     "pname": "Ionide.Analyzers",
-    "version": "0.14.10",
-    "hash": "sha256-aUo+WiX33PGJbyg+vbsMfjRYee3LQZNKEzie2OKrhcw="
+    "version": "0.14.11",
+    "hash": "sha256-aF2cKl5FcRNu0uV5WBq4IzzrJZfAfMb0jD8G3kMKAX8="
   },
   {
     "pname": "Ionide.KeepAChangelog.Tasks",

pkgs/by-name/fs/fsautocomplete/package.nix

@@ -9,13 +9,13 @@
 
 buildDotnetModule (finalAttrs: {
   pname = "fsautocomplete";
-  version = "0.82.0";
+  version = "0.83.0";
 
   src = fetchFromGitHub {
     owner = "fsharp";
     repo = "FsAutoComplete";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-P/RPyYVyKK+s2AwQZzlSW8obQbhOoNSCd/ibahJ9BLg=";
+    hash = "sha256-1WK6vb/UfqnF5KlwrjmGTPeAnEgwPswcYweeotB6j00=";
   };
 
   nugetDeps = ./deps.json;

pkgs/by-name/fs/fstl/package.nix

@@ -4,15 +4,23 @@
   fetchFromGitHub,
   cmake,
   libsForQt5,
+  xdg-utils,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fstl";
   version = "0.11.1";
 
+  postPatch = ''
+    patchShebangs --build xdg/xdg_install.sh
+    substituteInPlace xdg/fstlapp-fstl.desktop \
+      --replace-fail 'Exec=fstl' 'Exec=${placeholder "out"}/bin/fstl'
+  '';
+
   nativeBuildInputs = [
     cmake
     libsForQt5.wrapQtAppsHook
+    xdg-utils
   ];
 
   installPhase = lib.optionalString stdenv.hostPlatform.isDarwin ''
@@ -24,6 +32,10 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  postInstall = ''
+    env --chdir ../xdg XDG_DATA_HOME=$out/share ./xdg_install.sh fstl
+  '';
+
   src = fetchFromGitHub {
     owner = "fstl-app";
     repo = "fstl";

pkgs/by-name/ga/gallia/package.nix

@@ -38,7 +38,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     zstandard
   ];
 
-  SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+  env.SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
 
   nativeCheckInputs =
     with python3.pkgs;

pkgs/by-name/ge/genefer/package.nix

@@ -0,0 +1,84 @@
+{
+  fetchFromGitHub,
+  gmp,
+  lib,
+  ocl-icd,
+  opencl-headers,
+  stdenv,
+  boinc,
+  versionCheckHook,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "genefer";
+  version = "25.12.0";
+
+  src = fetchFromGitHub {
+    owner = "galloty";
+    repo = "genefer22";
+    rev = "37ea9f8f531ee625d10408e1d2a4ec4dcf270438";
+    hash = "sha256-dyrg9Yf1Ko8vfV4oH7yVTFfLkCHWeJlm2xjEqjiwHBg=";
+  };
+
+  enableParallelBuilding = true;
+  buildInputs = [
+    gmp
+    ocl-icd
+    opencl-headers
+    boinc
+  ];
+
+  # remove the static flags
+  # fix BOINC path
+  postPatch = ''
+    sed -i 's/-static-libgcc//g' genefer/Makefile_linux*
+    sed -i 's/-static-libstdc++//g' genefer/Makefile_linux*
+    sed -i 's/-static//g' genefer/Makefile_linux*
+
+    substituteInPlace genefer/Makefile_linux* \
+        --replace-fail '$(BOINC_DIR)/api' '${boinc}/include/boinc' \
+        --replace-fail '$(BOINC_DIR)/lib' '${boinc}/include/boinc'
+  '';
+
+  makefile = if stdenv.hostPlatform.isAarch64 then "Makefile_linuxARM64" else "Makefile_linux64";
+
+  makeFlags = [
+    "-C genefer"
+    "-f ${finalAttrs.makefile}"
+  ];
+
+  installPhase =
+    let
+      platformSuffix = if stdenv.hostPlatform.isAarch64 then "_arm64" else "";
+    in
+    ''
+      runHook preInstall
+
+      install -Dm755 bin/genefer${platformSuffix} $out/bin/genefer22
+      install -Dm755 bin/geneferg${platformSuffix} $out/bin/genefer22-gpu
+
+      mkdir -p $out/share/genefer22
+      cp -r $src/ocl $out/share/genefer22/
+
+      runHook postInstall
+    '';
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  meta = {
+    description = "Generalized Fermat Prime search program";
+    longDescription = ''
+      genefer is an OpenMP® application on CPU and an OpenCL™ application on GPU.
+      It performs a fast probable primality test for numbers of the form b^2n + 1 with the Fermat test.
+    '';
+    homepage = "https://github.com/galloty/genefer22";
+    maintainers = with lib.maintainers; [ dstremur ];
+    license = lib.licenses.mit;
+    platforms = [
+      "aarch64-linux"
+      "x86_64-linux"
+    ];
+    mainProgram = "genefer22";
+  };
+})

pkgs/by-name/gh/ghostfolio/package.nix

@@ -11,13 +11,13 @@
 
 buildNpmPackage rec {
   pname = "ghostfolio";
-  version = "2.237.0";
+  version = "2.239.0";
 
   src = fetchFromGitHub {
     owner = "ghostfolio";
     repo = "ghostfolio";
     tag = version;
-    hash = "sha256-udko0oiO5tLEDBKxkGiTRU0Qd/Yd0bvPB6iPM5wJ7Ls=";
+    hash = "sha256-1CJM395lApSIo5/7WVaLaBV1MwNJ7ehWukln59Ew6fg=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -27,7 +27,7 @@ buildNpmPackage rec {
     '';
   };
 
-  npmDepsHash = "sha256-2j/u++63qaOzvsgdhWeDsH+TUVmOLvgQQRNY14LZI2k=";
+  npmDepsHash = "sha256-rX/RkM2wjDFoL/BtnNa3WuUlHIIlviGGsfoobDzeD0M=";
 
   nativeBuildInputs = [
     prisma_6

pkgs/by-name/gh/ghw/package.nix

@@ -6,13 +6,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "ghw";
-  version = "0.22.0";
+  version = "0.23.0";
 
   src = fetchFromGitHub {
     owner = "jaypipes";
     repo = "ghw";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-W3a6hKX8vsWe02uLUx9zIOmJiivIOa4Ja++iXVd8J3E=";
+    hash = "sha256-olMKS+Bb+YK43I23zvxCp9XFkknwvqXorrYVlVomL+o=";
   };
   vendorHash = "sha256-REgtByhTlYQ3XyYleWAcrCymIWtWmltjx21tr2mtF7k=";
 

pkgs/by-name/gi/git-cinnabar/package.nix

@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-IVizzc2dKZ83dz3KBMDDiaFNdnS40cS++k8AywyvakQ=";
   };
 
-  ZSTD_SYS_USE_PKG_CONFIG = true;
+  env.ZSTD_SYS_USE_PKG_CONFIG = true;
 
   enableParallelBuilding = true;
 

pkgs/by-name/gi/git-gr/package.nix

@@ -14,7 +14,7 @@ let
   canRunGitGr = stdenv.hostPlatform.emulatorAvailable buildPackages;
   gitGr = "${stdenv.hostPlatform.emulator buildPackages} $out/bin/git-gr";
   pname = "git-gr";
-  version = "1.4.3";
+  version = "1.4.5";
 in
 rustPlatform.buildRustPackage {
   inherit pname version;
@@ -23,12 +23,12 @@ rustPlatform.buildRustPackage {
     owner = "9999years";
     repo = "git-gr";
     tag = "v${version}";
-    hash = "sha256-t308Ep27iRvRHSdvVMOrRGVoajBtnTutHAkKbZkO7Wg=";
+    hash = "sha256-8eZCJdGWuUk5l/OSmMVozL7SKyibtaZK3YlVzw/ZYsU=";
   };
 
   buildFeatures = [ "clap_mangen" ];
 
-  cargoHash = "sha256-5YHE1NVUcZ5NeOl3Z87l3PVsmlkswhnT83Oi9loJjdM=";
+  cargoHash = "sha256-OyNdp9uskLXZEsMx9NcKwmkWgepUIAyi+woFYEK66OY=";
 
   env.OPENSSL_NO_VENDOR = true;
 

pkgs/by-name/gi/gitlab-timelogs/package.nix

@@ -10,11 +10,11 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gitlab-timelogs";
-  version = "0.7.0";
+  version = "0.7.1";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-WmdN3w0t7omA2F+Fpv+PkT/hymgTzxlTSBytKep+6Lo=";
+    hash = "sha256-DNMJczR4yaglIOcNmb2E1g+UP0VeJaIb5TvdKUcWzc0=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage rec {
     iconv
   ];
 
-  cargoHash = "sha256-Ap/R/Sa60LUAKByzKGYzj/IZeq/UDiZzBxYY0Ell6Kw=";
+  cargoHash = "sha256-aCt534oDG9u37xLQjG7Ye+EKpTgW4q/LqaVkxw5iEJ0=";
 
   meta = {
     description = "CLI utility to support you with your time logs in GitLab";

pkgs/by-name/gi/gitweb/package.nix

@@ -10,18 +10,19 @@ let
   gitwebThemeSrc = fetchFromGitHub {
     owner = "kogakure";
     repo = "gitweb-theme";
-    rev = "049b88e664a359f8ec25dc6f531b7e2aa60dd1a2";
+    rev = "d4cc1792f10dac16dbeee06d7e0902715e4fa51a";
     postFetch = ''
       mkdir -p "$TMPDIR/gitwebTheme"
       mv "$out"/* "$TMPDIR/gitwebTheme/"
       mkdir "$out/static"
       mv "$TMPDIR/gitwebTheme"/* "$out/static/"
     '';
-    sha256 = "17hypq6jvhy6zhh26lp3nyi52npfd5wy5752k6sq0shk4na2acqi";
+    hash = "sha256-+e8ZP8hVGWQsXgyWUd/rF9+GRHNHJLFpOr5nsNIieyo";
   };
 in
 buildEnv {
-  name = "gitweb-${lib.getVersion git}";
+  inherit (git) version;
+  pname = "gitweb";
 
   ignoreCollisions = true;
   paths = lib.optional gitwebTheme gitwebThemeSrc ++ [ "${git}/share/gitweb" ];

pkgs/by-name/go/goconvey/package.nix

@@ -1,26 +1,36 @@
 {
   lib,
   fetchFromGitHub,
-  # Build fails with Go 1.25, with the following error:
-  # 'vendor/golang.org/x/tools/internal/tokeninternal/tokeninternal.go:64:9: invalid array length -delta * delta (constant -256 of type int64)'
-  # Wait for upstream to update their vendored dependencies before unpinning.
-  buildGo124Module,
+  fetchpatch,
+  applyPatches,
+  buildGoModule,
 }:
 
-buildGo124Module {
+buildGoModule {
   pname = "goconvey";
   version = "1.8.1-unstable-2024-03-06";
 
   excludedPackages = "web/server/watch/integration_testing";
 
-  src = fetchFromGitHub {
-    owner = "smartystreets";
-    repo = "goconvey";
-    rev = "a50310f1e3e53e63e2d23eb904f853aa388a5988";
-    hash = "sha256-w5eX/n6Wu2gYgCIhgtjqH3lNckWIDaN4r80cJW3JqFo=";
+  src = applyPatches {
+    src = fetchFromGitHub {
+      owner = "smartystreets";
+      repo = "goconvey";
+      rev = "a50310f1e3e53e63e2d23eb904f853aa388a5988";
+      hash = "sha256-w5eX/n6Wu2gYgCIhgtjqH3lNckWIDaN4r80cJW3JqFo=";
+    };
+    patches = [
+      # Update golang.org/x/tools to v0.42.0 for Go 1.25+ compatibility
+      # https://github.com/smartystreets/goconvey/pull/703
+      (fetchpatch {
+        url = "https://github.com/smartystreets/goconvey/commit/a8d73b2e5380902ab6caa6716ad69c324f390a2d.patch";
+        hash = "sha256-4JZs4/kxt3KP21q4U8mpBJkueVmRsCsKqST1Cn6ySN8=";
+      })
+    ];
   };
 
-  vendorHash = "sha256-P4J/CZY95ks08DC+gSqG+eanL3zoiaoz1d9/ZvBoc9Q=";
+  proxyVendor = true;
+  vendorHash = "sha256-0LQ5yxqy+WGc9TzmXiiHYyUNIIImoLsItkv5KcHjVGc=";
 
   ldflags = [
     "-s"

pkgs/by-name/go/golangci-lint/package.nix

@@ -14,16 +14,16 @@
 
 buildGo126Module (finalAttrs: {
   pname = "golangci-lint";
-  version = "2.9.0";
+  version = "2.10.1";
 
   src = fetchFromGitHub {
     owner = "golangci";
     repo = "golangci-lint";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8LEtm1v0slKwdLBtS41OilKJLXytSxcI9fUlZbj5Gfw=";
+    hash = "sha256-rHttQ+QJ9JrFvgfoX68Y0lD6BUv/aoOpRRFvZ1BIGIs=";
   };
 
-  vendorHash = "sha256-w8JfF6n1ylrU652HEv/cYdsOdDZz9J2uRQDqxObyhkY=";
+  vendorHash = "sha256-yREpROQJ300+mii7R2oiyDjOGcYXBpv3o/park0TJYE=";
 
   subPackages = [ "cmd/golangci-lint" ];
 

pkgs/by-name/gt/gtree/package.nix

@@ -1,23 +1,26 @@
 {
   lib,
-  buildGoModule,
+  buildGo126Module,
   fetchFromGitHub,
-  testers,
   gtree,
+  nix-update-script,
+  testers,
 }:
-
-buildGoModule (finalAttrs: {
+# buildGoModule currently builds with go 1.25.0. This package requires
+# version 1.26.0 theirfor needing to be pinned to buildGo126Module until
+# it's updated.
+buildGo126Module (finalAttrs: {
   pname = "gtree";
-  version = "1.13.3";
+  version = "1.13.5";
 
   src = fetchFromGitHub {
     owner = "ddddddO";
     repo = "gtree";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-K7LFnMCx28Abj4U9glFtQWJDHPHPRrGPsP0TiCr5NKc=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-2OhXb6ivje7Li/sUO+YHfZPRBKoQnUhNbhbFtqlyjyM=";
   };
 
-  vendorHash = "sha256-A/O8w56RsiS8VHzq4NpIn8dAt12sNpfl/Jf9KziZ12I=";
+  vendorHash = "sha256-UTJQvoiqdF1q4VRUfAx7a7V5UyH+zjwDM5YU7cqVDKE=";
 
   subPackages = [
     "cmd/gtree"
@@ -27,21 +30,24 @@ buildGoModule (finalAttrs: {
     "-s"
     "-w"
     "-X=main.Version=${finalAttrs.version}"
-    "-X=main.Revision=${finalAttrs.src.rev}"
+    "-X=main.Revision=${finalAttrs.src.tag}"
   ];
 
-  passthru.tests = {
-    version = testers.testVersion {
-      package = gtree;
+  passthru = {
+    tests = {
+      version = testers.testVersion {
+        package = gtree;
+      };
     };
+    updateScript = nix-update-script { };
   };
 
   meta = {
     description = "Generate directory trees and directories using Markdown or programmatically";
     mainProgram = "gtree";
     homepage = "https://github.com/ddddddO/gtree";
-    changelog = "https://github.com/ddddddO/gtree/releases/tag/${finalAttrs.src.rev}";
+    changelog = "https://github.com/ddddddO/gtree/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.bsd2;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ hythera ];
   };
 })

pkgs/by-name/he/helix/generate_grammars.py

@@ -0,0 +1,155 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i python3 -p python3 nurl
+"""
+Generate grammar information for Helix editor by parsing languages.toml
+and fetching source information using nurl in parallel.
+"""
+
+import argparse
+import asyncio
+import json
+import os
+import sys
+import tomllib
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+
+
+@dataclass
+class Grammar:
+    name: str
+    git_url: str
+    rev: str
+    subpath: str | None = None
+
+
+async def run_nurl(url: str, rev: str, semaphore: asyncio.Semaphore) -> dict[str, Any]:
+    """Run nurl command for a single grammar and return parsed JSON output."""
+    async with semaphore:
+        proc = await asyncio.create_subprocess_exec(
+            "nurl",
+            url,
+            rev,
+            "--json",
+            stdout=asyncio.subprocess.PIPE,
+            stderr=asyncio.subprocess.PIPE,
+        )
+        stdout, stderr = await proc.communicate()
+
+        if proc.returncode != 0:
+            raise RuntimeError(f"nurl failed for {url}@{rev}: {stderr.decode()}")
+
+        return json.loads(stdout.decode())
+
+
+def parse_languages_toml(toml_path: Path) -> list[Grammar]:
+    """Parse languages.toml and extract grammar information."""
+    with open(toml_path, "rb") as f:
+        config = tomllib.load(f)
+
+    grammars = []
+    for grammar in config.get("grammar", []):
+        if "source" not in grammar:
+            continue
+
+        source = grammar["source"]
+        if "git" not in source or "rev" not in source:
+            continue
+
+        grammars.append(
+            Grammar(
+                name=grammar["name"].replace("_", "-"),
+                git_url=source["git"],
+                rev=source["rev"],
+                subpath=source.get("subpath"),
+            )
+        )
+
+    return grammars
+
+
+async def fetch_all_grammars(
+    grammars: list[Grammar], max_parallel: int
+) -> dict[str, Any]:
+    """Fetch nurl information for all grammars in parallel."""
+    semaphore = asyncio.Semaphore(max_parallel)
+    results = {}
+    total = len(grammars)
+    completed = 0
+
+    tasks = []
+    for grammar in grammars:
+        task = run_nurl(grammar.git_url, grammar.rev, semaphore)
+        tasks.append((grammar, task))
+
+    for grammar, task in tasks:
+        try:
+            result = await task
+            results[grammar.name] = {
+                "nurl": result,
+                "subpath": grammar.subpath,
+            }
+            completed += 1
+            print(f"[{completed}/{total}] ✓ {grammar.name}", file=sys.stderr)
+        except Exception as e:
+            completed += 1
+            print(f"[{completed}/{total}] ✗ {grammar.name}: {e}", file=sys.stderr)
+            results[grammar.name] = {"error": str(e)}
+
+    return results
+
+
+async def main():
+    parser = argparse.ArgumentParser(
+        description="Generate grammar information for Helix editor"
+    )
+    parser.add_argument(
+        "languages_toml",
+        type=Path,
+        help="path to languages.toml from Helix repository",
+    )
+    parser.add_argument(
+        "-o",
+        "--output",
+        type=Path,
+        default=Path("grammars.json"),
+        help="output JSON file (default: grammars.json)",
+    )
+    parser.add_argument(
+        "-j",
+        "--jobs",
+        type=int,
+        default=os.cpu_count(),
+        help=f"number of parallel nurl instances (default: {os.cpu_count()})",
+    )
+
+    args = parser.parse_args()
+
+    if not args.languages_toml.exists():
+        print(f"Error: {args.languages_toml} not found", file=sys.stderr)
+        sys.exit(1)
+
+    print(f"Parsing {args.languages_toml}...", file=sys.stderr)
+    grammars = parse_languages_toml(args.languages_toml)
+    print(f"Found {len(grammars)} grammars", file=sys.stderr)
+
+    print(f"Fetching grammar information ({args.jobs} parallel jobs)...", file=sys.stderr)
+    results = await fetch_all_grammars(grammars, args.jobs)
+
+    errors = [name for name, data in results.items() if "error" in data]
+    if errors:
+        print(f"\nFailed grammars ({len(errors)}):", file=sys.stderr)
+        for name in errors:
+            print(f"  - {name}: {results[name]['error']}", file=sys.stderr)
+        sys.exit(1)
+
+    with open(args.output, "w") as f:
+        json.dump(results, f, indent=2)
+        f.write('\n')
+
+    print(f"\nResults written to {args.output}", file=sys.stderr)
+
+
+if __name__ == "__main__":
+    asyncio.run(main())

pkgs/by-name/he/helix/package.nix

@@ -1,88 +1,154 @@
 {
-  fetchzip,
-  fetchpatch,
+  fetchFromGitHub,
   lib,
   rustPlatform,
   mdbook,
-  git,
+  gitMinimal,
   installShellFiles,
   versionCheckHook,
-  nix-update-script,
+  runCommand,
+  removeReferencesTo,
+  pkgs,
+  tree-sitter,
+  lockedGrammars ? lib.importJSON ./grammars.json,
+  grammarsOverlay ? (
+    final: prev: {
+      tree-sitter-sql = prev.tree-sitter-sql.override {
+        generate = false;
+      };
+      tree-sitter-qmljs = prev.tree-sitter-qmljs.overrideAttrs {
+        dontCheckForBrokenSymlinks = true;
+      };
+    }
+  ),
 }:
 
-rustPlatform.buildRustPackage (finalAttrs: {
-  pname = "helix";
-  version = "25.07.1";
-  outputs = [
-    "out"
-    "doc"
-  ];
+rustPlatform.buildRustPackage (
+  finalAttrs:
+  let
+    lockedVersionsOverlay =
+      final: prev:
+      lib.mapAttrs (
+        drvName: grammar:
+        let
+          lockedGrammar = lockedGrammars.${lib.removePrefix "tree-sitter-" drvName};
+        in
+        (prev.${drvName}.override {
+          location = lockedGrammar.subpath;
+        }).overrideAttrs
+          {
+            version = lib.sources.shortRev lockedGrammar.nurl.args.rev;
+            src = (pkgs.${lockedGrammar.nurl.fetcher} lockedGrammar.nurl.args);
+          }
+      ) prev;
 
-  # This release tarball includes source code for the tree-sitter grammars,
-  # which is not ordinarily part of the repository.
-  src = fetchzip {
-    url = "https://github.com/helix-editor/helix/releases/download/${finalAttrs.version}/helix-${finalAttrs.version}-source.tar.xz";
-    hash = "sha256-Pj/lfcQXRWqBOTTWt6+Gk61F9F1UmeCYr+26hGdG974=";
-    stripRoot = false;
-  };
+    tree-sitter-grammars =
+      lib.filterAttrs (drvName: _: lib.hasAttr (lib.removePrefix "tree-sitter-" drvName) lockedGrammars)
+        (
+          tree-sitter.grammarsScope.overrideScope (
+            lib.composeExtensions lockedVersionsOverlay grammarsOverlay
+          )
+        );
 
-  patches = [
-    # Support mdbook 0.5.x: escape HTML tags in command descriptions
-    ./mdbook-0.5-support.patch
-  ];
+    # Dynamic libraries for the grammars always use the `.so` extension, also on Darwin (should use `.dylib`)
+    # See here: https://github.com/helix-editor/helix/pull/14982
+    # Switch to `stdenv.hostPlatform.extensions.sharedLibrary` once the fix above reaches the next release
 
-  postPatch = ''
-    # mdbook 0.5 uses asset hashing for CSS/JS files
-    # Remove custom theme to use default mdbook theme with correct asset references
-    rm -f book/theme/index.hbs
-  '';
+    grammarsFarm = runCommand "helix-grammars" { } (
+      lib.concatMapAttrsStringSep "\n" (_: grammar: ''
+        install -D ${grammar}/parser $out/${grammar.language}.so
+        ${lib.getExe removeReferencesTo} -t ${grammar} $out/${grammar.language}.so
+      '') (lib.filterAttrs (_: lib.isDerivation) tree-sitter-grammars)
+    );
 
-  cargoHash = "sha256-Mf0nrgMk1MlZkSyUN6mlM5lmTcrOHn3xBNzmVGtApEU=";
+    lockedGrammarsCount = lib.length (lib.attrNames lockedGrammars);
 
-  nativeBuildInputs = [
-    git
-    installShellFiles
-    mdbook
-  ];
-
-  env.HELIX_DEFAULT_RUNTIME = "${placeholder "out"}/lib/runtime";
-
-  postBuild = ''
-    mdbook build book -d ../book-html
-  '';
-
-  postInstall = ''
-    # not needed at runtime
-    rm -r runtime/grammars/sources
-
-    mkdir -p $out/lib $doc/share/doc
-    cp -r runtime $out/lib
-    installShellCompletion contrib/completion/hx.{bash,fish,zsh}
-    mkdir -p $out/share/{applications,icons/hicolor/256x256/apps}
-    cp contrib/Helix.desktop $out/share/applications
-    cp contrib/helix.png $out/share/icons/hicolor/256x256/apps
-    cp -r ../book-html $doc/share/doc/$name
-  '';
-
-  nativeInstallCheckInputs = [
-    versionCheckHook
-  ];
-  versionCheckProgram = "${placeholder "out"}/bin/hx";
-  doInstallCheck = true;
-
-  passthru = {
-    updateScript = nix-update-script { };
-  };
-
-  meta = {
-    description = "Post-modern modal text editor";
-    homepage = "https://helix-editor.com";
-    changelog = "https://github.com/helix-editor/helix/blob/${finalAttrs.version}/CHANGELOG.md";
-    license = lib.licenses.mpl20;
-    mainProgram = "hx";
-    maintainers = with lib.maintainers; [
-      danth
-      yusdacra
+    runtimeDir = runCommand "helix-runtime" { } ''
+      cp -r --no-preserve=mode ${finalAttrs.src}/runtime $out
+      rm -r $out/grammars
+      ln -s ${grammarsFarm} $out/grammars
+      count=$(ls -1 "$out/grammars/" | wc -l)
+      if [ "$count" -ne ${toString lockedGrammarsCount} ]; then
+        echo "Expected ${toString lockedGrammarsCount} grammars, found $count"
+        exit 1
+      fi
+    '';
+  in
+  {
+    pname = "helix";
+    version = "25.07.1";
+    outputs = [
+      "out"
+      "doc"
     ];
-  };
-})
+
+    src = fetchFromGitHub {
+      owner = "helix-editor";
+      repo = "helix";
+      tag = "${finalAttrs.version}";
+      hash = "sha256-RFSzGAcB0mMg/02ykYfTWXzQjLFu2CJ4BkS5HZ/6pBo=";
+    };
+
+    patches = [
+      # Support mdbook 0.5.x: escape HTML tags in command descriptions
+      ./mdbook-0.5-support.patch
+    ];
+
+    postPatch = ''
+      # mdbook 0.5 uses asset hashing for CSS/JS files
+      # Remove custom theme to use default mdbook theme with correct asset references
+      rm -f book/theme/index.hbs
+    '';
+
+    cargoHash = "sha256-Mf0nrgMk1MlZkSyUN6mlM5lmTcrOHn3xBNzmVGtApEU=";
+
+    nativeBuildInputs = [
+      gitMinimal
+      installShellFiles
+      mdbook
+    ];
+
+    env = {
+      HELIX_DEFAULT_RUNTIME = runtimeDir;
+      HELIX_DISABLE_AUTO_GRAMMAR_BUILD = "1";
+    };
+
+    postBuild = ''
+      mdbook build book -d ../book-html
+    '';
+
+    postInstall = ''
+      mkdir -p $out/lib $doc/share/doc
+      installShellCompletion contrib/completion/hx.{bash,fish,zsh}
+      mkdir -p $out/share/{applications,icons/hicolor/256x256/apps}
+      cp contrib/Helix.desktop $out/share/applications/Helix.desktop
+      cp contrib/helix.png $out/share/icons/hicolor/256x256/apps/helix.png
+      cp -r ../book-html $doc/share/doc/$name
+    '';
+
+    nativeInstallCheckInputs = [
+      versionCheckHook
+    ];
+    versionCheckProgram = "${placeholder "out"}/bin/hx";
+    doInstallCheck = true;
+
+    passthru = {
+      updateScript = ./update.sh;
+      runtime = runtimeDir;
+      inherit tree-sitter-grammars;
+    };
+
+    meta = {
+      description = "Post-modern modal text editor";
+      homepage = "https://helix-editor.com";
+      changelog = "https://github.com/helix-editor/helix/blob/${finalAttrs.version}/CHANGELOG.md";
+      license = lib.licenses.mpl20;
+      mainProgram = "hx";
+      maintainers = with lib.maintainers; [
+        aciceri
+        danth
+        yusdacra
+      ];
+    };
+  }
+)

pkgs/by-name/he/helix/update.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nurl nix-update python3
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+echo "Updating helix source to the latest stable..."
+nix-update helix
+
+echo "Fetching updated helixSource..."
+HELIX_SRC=$(nix-instantiate --eval -A "helix.src.outPath" --raw)
+
+echo "Generating grammars.json..."
+"$SCRIPT_DIR/generate_grammars.py" \
+  "$HELIX_SRC/languages.toml" \
+  -o "$SCRIPT_DIR/grammars.json"
+
+if [ $? -ne 0 ]; then
+  echo "Error: Failed to generate grammars.json" >&2
+  exit 1
+fi
+
+echo "Done! Updated grammars.json"

pkgs/by-name/hi/hiredis/package.nix

@@ -20,8 +20,10 @@ stdenv.mkDerivation (finalAttrs: {
     openssl
   ];
 
-  PREFIX = "\${out}";
-  USE_SSL = 1;
+  env = {
+    PREFIX = "\${out}";
+    USE_SSL = 1;
+  };
 
   meta = {
     homepage = "https://github.com/redis/hiredis";

pkgs/by-name/ht/httplib/package.nix

@@ -9,13 +9,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "httplib";
-  version = "0.19.0";
+  version = "0.30.2";
 
   src = fetchFromGitHub {
     owner = "yhirose";
     repo = "cpp-httplib";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-OLwD7mpwqG7BUugUca+CJpPMaabJzUMC0zYzJK9PBCg=";
+    hash = "sha256-psVyn14QHMXG/x9SOOiR7ZBt8dHqa2A/w92WQQDukKM=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/hu/hubble/package.nix

@@ -9,13 +9,13 @@
 
 buildGo124Module rec {
   pname = "hubble";
-  version = "1.18.5";
+  version = "1.18.6";
 
   src = fetchFromGitHub {
     owner = "cilium";
     repo = "hubble";
     tag = "v${version}";
-    hash = "sha256-0R9Bm+8eiCOfsCs2oCBjZQR/N8z0DmkGBC/6Fy4JNyM=";
+    hash = "sha256-I/+QE+HY+dU4ZIj/8vP7Ij/eInSn1pxuTNDghIsVXt0=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/if/ifupdown-ng/package.nix

@@ -0,0 +1,75 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  libbsd,
+  pkg-config,
+  coreutils,
+  iproute2,
+}:
+
+stdenv.mkDerivation {
+  pname = "ifupdown-ng";
+  version = "unstable-2025-09-12";
+
+  src = fetchFromGitHub {
+    owner = "ifupdown-ng";
+    repo = "ifupdown-ng";
+    rev = "fb07d0824b20d178e7acca9e85296822ac2539ac";
+    hash = "sha256-c06NbF0LpyK3hTMxCeWyQcUP9dL17hOm3993wjW/OzQ=";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ libbsd ];
+
+  postPatch = ''
+    # The Makefile hardcodes -static; remove it to build dynamically.
+    substituteInPlace Makefile \
+      --replace-fail ' -static ' ' '
+
+    # replace _PATH_STDPATH with a path that includes nix store locations.
+    # ifupdown-ng sets PATH to this value before running executor scripts.
+    substituteInPlace libifupdown/lifecycle.c \
+      --replace-fail '_PATH_STDPATH' '"${
+        lib.makeBinPath [
+          iproute2
+          coreutils
+        ]
+      }:/usr/bin:/bin"'
+
+    # remove hardcoded FHS paths from executor scripts so they use PATH lookup.
+    substituteInPlace executors/linux/dhcp \
+      --replace-fail '/sbin/dhcpcd' 'dhcpcd' \
+      --replace-fail '/usr/sbin/dhclient' 'dhclient' \
+      --replace-fail '/sbin/udhcpc' 'udhcpc'
+    substituteInPlace executors/linux/vrf \
+      --replace-fail '/sbin/ip' 'ip'
+    substituteInPlace executors/linux/wifi \
+      --replace-fail '/sbin/wpa_passphrase' 'wpa_passphrase' \
+      --replace-fail '/sbin/wpa_supplicant' 'wpa_supplicant' \
+      --replace-fail '/usr/sbin/iwconfig' 'iwconfig'
+  '';
+
+  makeFlags = [
+    "SBINDIR=/bin"
+    "EXECUTOR_PATH=/libexec/ifupdown-ng"
+  ];
+
+  installFlags = [
+    "DESTDIR=${placeholder "out"}"
+  ];
+
+  meta = {
+    description = "Next-generation network interface configuration tool";
+    longDescription = ''
+      ifupdown-ng is a network device manager that is largely compatible
+      with Debian ifupdown, BusyBox ifupdown, and other implementations.
+      It is used by Alpine Linux as its network management solution.
+    '';
+    homepage = "https://github.com/ifupdown-ng/ifupdown-ng";
+    license = lib.licenses.isc;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ aanderse ];
+  };
+}

pkgs/by-name/ip/ipmiutil/package.nix

@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ipmiutil";
-  version = "3.2.1";
+  version = "3.2.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/project/ipmiutil/ipmiutil-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-BIEbLmV/+YzTHkS5GnAMnzPEyd2To2yPyYfeH0fCQCQ=";
+    sha256 = "sha256-N/m8jmsYwRVeTV6jjIe4OQi3rMekT7xeOvST8m74t2c=";
   };
 
   buildInputs = [ openssl ];

pkgs/by-name/ja/jaero/package.nix

@@ -0,0 +1,79 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  libsForQt5,
+  libacars,
+  libcorrect,
+  libvorbis,
+  zeromq,
+  qmqtt,
+  makeWrapper,
+}:
+
+let
+  jfft-src = fetchFromGitHub {
+    owner = "jontio";
+    repo = "JFFT";
+    rev = "4b74486e58e1d266f1cc3c570f3d073d40c353d6";
+    hash = "sha256-GDagnbbYT6Xn8IQ7YH7giBiNqSYYkyyTqInlvT5TZZA=";
+  };
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "jaero";
+  version = "1.0.4.14-unstable-2023-11-21";
+
+  src = fetchFromGitHub {
+    owner = "jontio";
+    repo = "JAERO";
+    rev = "1d4e515921244aec1d85a03f5f38b4e7818fdbe6";
+    hash = "sha256-/miAV87IyeOid4srLL25Ec+3Up47Aox2TsI3E3UQanw=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/JAERO";
+
+  preConfigure = ''
+    substituteInPlace JAERO.pro \
+      --replace-fail "QT       += multimedia core network gui svg sql qmqtt" \
+                     "QT       += multimedia core network gui svg sql" \
+      --replace-fail "JFFT_PATH = ../../JFFT/" "JFFT_PATH = ${jfft-src}" \
+      --replace-fail "INSTALL_PATH = /opt/jaero" "INSTALL_PATH = ${placeholder "out"}" \
+      --replace-fail "/usr" "${placeholder "out"}"
+      cat >> JAERO.pro <<"EOF"
+        LIBS += -L${qmqtt}/lib -lqmqtt
+      EOF
+  '';
+
+  buildInputs = [
+    qmqtt
+    libacars
+    libcorrect
+    libvorbis
+    zeromq
+  ]
+  ++ (with libsForQt5; [
+    qtbase
+    qcustomplot
+    qtmultimedia
+    qtsvg
+  ]);
+
+  nativeBuildInputs = with libsForQt5; [
+    qmake
+    wrapQtAppsHook
+    makeWrapper
+  ];
+
+  postInstall = ''
+    mkdir -p $out/bin
+    mv $out/JAERO $out/bin/JAERO
+  '';
+
+  meta = {
+    description = "SatCom ACARS demodulator and decoder for the Aero standard";
+    homepage = "https://github.com/jontio/JAERO";
+    platforms = lib.platforms.linux;
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ noderyos ];
+  };
+})

pkgs/by-name/ja/jay/package.nix

@@ -28,7 +28,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoHash = "sha256-T7053eAH3IqkAxNZpYHdC6Z7JZtArrOqGMjoIccjemI=";
 
-  SHADERC_LIB_DIR = "${lib.getLib shaderc}/lib";
+  env.SHADERC_LIB_DIR = "${lib.getLib shaderc}/lib";
 
   nativeBuildInputs = [
     autoPatchelfHook

pkgs/by-name/jx/jx/package.nix

@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "jx";
-  version = "3.16.43";
+  version = "3.16.45";
 
   src = fetchFromGitHub {
     owner = "jenkins-x";
     repo = "jx";
     rev = "v${version}";
-    sha256 = "sha256-K5NDyhO41PrawSIhLyfoW33IMFOTAiMOyslHPRb5ttg=";
+    sha256 = "sha256-xPbGRi4Z4M1mnvCyriG6h2n6IILq131JYNug2rESGhQ=";
   };
 
   vendorHash = "sha256-1ErjD+1MdbKN4EPaQX0jxNzoN9dB8beH1csdx1IPKl8=";

pkgs/by-name/ke/keyscope/package.nix

@@ -29,7 +29,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     echo "fn main() {}" > build.rs
   '';
 
-  VERGEN_GIT_SEMVER = "v${finalAttrs.version}";
+  env.VERGEN_GIT_SEMVER = "v${finalAttrs.version}";
 
   # Test require network access
   doCheck = false;

pkgs/by-name/ku/kubectl-oidc-login/package.nix

@@ -0,0 +1,46 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "kubectl-oidc-login";
+  version = "1.35.2";
+
+  src = fetchFromGitHub {
+    owner = "int128";
+    repo = "kubelogin";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-jSPNvr+spZvilTooK7s6l8CyvP5tzSWxqJzaoJCA5AM=";
+  };
+
+  vendorHash = "sha256-otzcOmW3mkiJrIv69wme5cHp5/iO2YSH+ecZgeX2aV0=";
+
+  ldflags = [
+    "-X main.version=${finalAttrs.version}"
+  ];
+
+  # Rename output binary to kubectl-<plugin-name> so kubectl recognizes it on $PATH.
+  postInstall = ''
+    mv $out/bin/{kubelogin,${finalAttrs.meta.mainProgram}}
+  '';
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Kubernetes kubelogin plugin to add OpenID Connect authentication to kubectl. Run \"kubectl oidc-login ...\"";
+    # Quirk: we have to write "oidc_login" instead of "oidc-login"
+    # (at least on Mac "aarch64-darwin" and "x86_64_linux"), otherwise calling
+    # "kubectl oidc-login <subcommand>" fails that it can't find the underlying plugin in $PATH.
+    mainProgram = "kubectl-oidc_login";
+    homepage = "https://github.com/int128/kubelogin";
+    changelog = "https://github.com/int128/kubelogin/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.malteneuss ];
+  };
+})

pkgs/by-name/ku/kubectl/package.nix

@@ -9,7 +9,7 @@ kubernetes.overrideAttrs (_: {
     "convert"
   ];
 
-  WHAT = lib.concatStringsSep " " [
+  env.WHAT = toString [
     "cmd/kubectl"
     "cmd/kubectl-convert"
   ];

pkgs/by-name/ku/kubernetes/package.nix

@@ -51,7 +51,7 @@ buildGoModule (finalAttrs: {
 
   patches = [ ./fixup-addonmanager-lib-path.patch ];
 
-  WHAT = lib.concatStringsSep " " components;
+  env.WHAT = toString components;
 
   buildPhase = ''
     runHook preBuild

pkgs/by-name/la/lazysql/package.nix

@@ -11,13 +11,13 @@
 
 buildGoModule rec {
   pname = "lazysql";
-  version = "0.4.7";
+  version = "0.4.8";
 
   src = fetchFromGitHub {
     owner = "jorgerojas26";
     repo = "lazysql";
     rev = "v${version}";
-    hash = "sha256-TJ09n/j0othys0ygbjqbbTp74j/lxoee6DWQjDL5f6M=";
+    hash = "sha256-/qNtrR316hOlSRfbBS4V2gRnYLgQlZsou9WqTQPtiIM=";
   };
 
   vendorHash = "sha256-FbAt/HsjoxqAKWQqqWN2xuyyTG2Ic4DcyEU4O0rjpQE=";

pkgs/by-name/le/lean4/package.nix

@@ -15,7 +15,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lean4";
-  version = "4.27.0";
+  version = "4.28.0";
 
   # Using a vendored version rather than nixpkgs' version to match the exact version required by
   # Lean.  Apparently, even a slight version change can impact greatly the final performance.
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "leanprover";
     repo = "lean4";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-nxAznaWQEilzn93SZTKLKL7TZEPD5LRcJLFmgoCWsXA=";
+    hash = "sha256-K6lWXZ8XVEv91skjCal+hML2Tzr9G804j9Roq+4HXQQ=";
   };
 
   postPatch =

pkgs/by-name/li/libcap_ng/package.nix

@@ -63,5 +63,6 @@ stdenv.mkDerivation (finalAttrs: {
     platforms = lib.platforms.linux;
     license = lib.licenses.lgpl21;
     maintainers = with lib.maintainers; [ grimmauld ];
+    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "libcap-ng_project" finalAttrs.version;
   };
 })

pkgs/by-name/li/libcorrect/package.nix

@@ -0,0 +1,32 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libcorrect";
+  version = "0-unstable-2018-10-10";
+
+  src = fetchFromGitHub {
+    owner = "quiet";
+    repo = "libcorrect";
+    rev = "f5a28c74fba7a99736fe49d3a5243eca29517ae9";
+    hash = "sha256-78OgoQFVcBWAqOSfYnygzryxfGwbdWbudl3MUDqaiWE=";
+  };
+
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.8)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
+  nativeBuildInputs = [ cmake ];
+
+  meta = {
+    description = "C library for Convolutional codes and Reed-Solomon";
+    homepage = "https://github.com/quiet/libcorrect";
+    license = lib.licenses.bsd3;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ noderyos ];
+  };
+})

pkgs/by-name/li/libedgetpu/package.nix

@@ -14,7 +14,9 @@ let
   flatbuffers_23_5_26 = flatbuffers.overrideAttrs (oldAttrs: rec {
     version = "23.5.26";
     cmakeFlags = (oldAttrs.cmakeFlags or [ ]) ++ [ "-DFLATBUFFERS_BUILD_SHAREDLIB=ON" ];
-    NIX_CXXSTDLIB_COMPILE = "-std=c++17";
+    env = (oldAttrs.env or { }) // {
+      NIX_CXXSTDLIB_COMPILE = "-std=c++17";
+    };
     configureFlags = (oldAttrs.configureFlags or [ ]) ++ [ "--enable-shared" ];
     src = fetchFromGitHub {
       owner = "google";
@@ -67,13 +69,15 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ xxd ];
 
-  NIX_CXXSTDLIB_COMPILE = "-std=c++17";
+  env = {
+    NIX_CXXSTDLIB_COMPILE = "-std=c++17";
 
-  TFROOT = fetchFromGitHub {
-    owner = "tensorflow";
-    repo = "tensorflow";
-    rev = "v2.16.1";
-    hash = "sha256-UPvK5Kc/FNVJq3FchN5IIBBObvcHtAPVv0ARzWzA35M=";
+    TFROOT = fetchFromGitHub {
+      owner = "tensorflow";
+      repo = "tensorflow";
+      rev = "v2.16.1";
+      hash = "sha256-UPvK5Kc/FNVJq3FchN5IIBBObvcHtAPVv0ARzWzA35M=";
+    };
   };
 
   enableParallelBuilding = true;

pkgs/by-name/li/libgeneral/package.nix

@@ -10,13 +10,13 @@
 }:
 clangStdenv.mkDerivation (finalAttrs: {
   pname = "libgeneral";
-  version = "89";
+  version = "90";
 
   src = fetchFromGitHub {
     owner = "tihmstar";
     repo = "libgeneral";
     tag = finalAttrs.version;
-    hash = "sha256-BADbLFE6DmkpKGMOeaaWybnjz+7QDv2iaYYXJcfFGM8=";
+    hash = "sha256-/IVh+XwUAok3RnTuQ6HuOR+GeBOAXX27xpdXWp3ISRI=";
   };
 
   # Do not depend on git to calculate version, instead

pkgs/by-name/li/libsignal-ffi/package.nix

@@ -21,14 +21,14 @@ rustPlatform.buildRustPackage (finalAttrs: {
   pname = "libsignal-ffi";
   # must match the version used in mautrix-signal
   # see https://github.com/mautrix/signal/issues/401
-  version = "0.86.12";
+  version = "0.87.1";
 
   src = fetchFromGitHub {
     fetchSubmodules = true;
     owner = "signalapp";
     repo = "libsignal";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-XVq1fvhUF0WqSs1lJRCBRuhOW4idY6Nm21UdX4/6TE8=";
+    hash = "sha256-yr2+yM7RmUQ7mNDMCcaM5cCpudof14JuO5J6D944k0U=";
   };
 
   nativeBuildInputs = [
@@ -40,7 +40,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   env.BORING_BSSL_PATH = "${boringssl-wrapper}";
   env.NIX_LDFLAGS = if stdenv.hostPlatform.isDarwin then "-lc++" else "-lstdc++";
 
-  cargoHash = "sha256-vat7vjL9HDY/m7CLUJNpU3NZ79nCVHxLO5tEtaEDBnE=";
+  cargoHash = "sha256-rqxp+RZuuT+nFudNeCgA8g04C9KT1Qi59K4b2avL5u4=";
 
   cargoBuildFlags = [
     "-p"

pkgs/by-name/li/libucl/package.nix

@@ -27,13 +27,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "libucl";
-  version = "0.9.3";
+  version = "0.9.4";
 
   src = fetchFromGitHub {
     owner = "vstakhov";
     repo = "libucl";
     rev = finalAttrs.version;
-    sha256 = "sha256-dub829xZ10sJ5qwegYUiGoyAVLiwg44GKSzz+BMLJis=";
+    sha256 = "sha256-m6VRtFNKm6+T7pPP2u3avMkVTmye4CM6Z7wjhddVMZE=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/li/lingua-franca/package.nix

@@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [ jdk17_headless ];
 
-  _JAVA_HOME = "${jdk17_headless}/";
+  env._JAVA_HOME = "${jdk17_headless}/";
 
   postPatch = ''
     substituteInPlace bin/lfc \

pkgs/by-name/lo/logrotate/package.nix

@@ -59,5 +59,6 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = [ lib.maintainers.tobim ];
     platforms = lib.platforms.all;
     mainProgram = "logrotate";
+    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "logrotate_project" finalAttrs.version;
   };
 })

pkgs/by-name/ls/lsh/package.nix

@@ -5,12 +5,12 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "lsh";
-  version = "1.5.6";
+  version = "1.5.7";
   src = fetchFromGitHub {
     owner = "latitudesh";
     repo = "lsh";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-FS0Bv645gmkt5J5mtHtQjee57Qj05NefGFYrRCaqDJw=";
+    sha256 = "sha256-OG1JjQ33BtsALG1CVO+N4N1Q7+6SW99U43lh1+cekDA=";
   };
   vendorHash = "sha256-SvbrrunOkJhIB5AlsCY7WrtE+Na/ExEJmVWqfjHNvx4=";
   subPackages = [ "." ];

pkgs/by-name/lv/lv/package.nix

@@ -23,6 +23,10 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [ ncurses ];
 
+  # Upstream needs quite a bit of porting to c23:
+  #   https://github.com/ttdoda/lv/issues/3
+  NIX_CFLAGS_COMPILE = "-std=gnu17";
+
   preAutoreconf = "cd src";
   postAutoreconf = "cd ..";
 

pkgs/by-name/ma/mautrix-discord/package.nix

@@ -43,7 +43,6 @@ buildGoModule rec {
     changelog = "https://github.com/mautrix/discord/blob/${src.rev}/CHANGELOG.md";
     license = lib.licenses.agpl3Only;
     maintainers = with lib.maintainers; [
-      MoritzBoehme
       sumnerevans
     ];
     mainProgram = "mautrix-discord";

pkgs/by-name/ma/mautrix-signal/package.nix

@@ -20,14 +20,14 @@ let
 in
 buildGoModule rec {
   pname = "mautrix-signal";
-  version = "26.01";
-  tag = "v0.2601.0";
+  version = "26.02";
+  tag = "v0.2602.0";
 
   src = fetchFromGitHub {
     owner = "mautrix";
     repo = "signal";
     inherit tag;
-    hash = "sha256-zvB0CbSzrLcUJiEIj3vtDq2C0XEYUNRbaUAn+636+uk=";
+    hash = "sha256-FWFAH+jtPdLG9vJS4QXpFjsGWUzILW17WRFyfdnFlAE=";
   };
 
   buildInputs =
@@ -44,7 +44,7 @@ buildGoModule rec {
 
   CGO_LDFLAGS = lib.optional withGoolm [ cppStdLib ];
 
-  vendorHash = "sha256-Eo7T/63ywNnn/t0RzjwkSYRmrL0IMdIsv4wqrQFv+5U=";
+  vendorHash = "sha256-TFz5P8czj8J9+QTFHjffCldw8Je2+DiM49W7jv5rY/I=";
 
   ldflags = [
     "-X"

pkgs/by-name/mc/mcumgr-client/package.nix

@@ -10,13 +10,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mcumgr-client";
-  version = "0.0.7";
+  version = "0.0.8";
 
   src = fetchFromGitHub {
     owner = "vouch-opensource";
     repo = "mcumgr-client";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-P5ykIVdWAxuCblMe7kzjswEca/+MsqpizCGUHIpR4qc=";
+    hash = "sha256-adUAoFNNVsKoVFb9BJrjZiQj7ZdsqzbY4rTURS185zU=";
   };
 
   cargoHash = "sha256-+n+Z/o+DvP2ltos8DP8nTyKbn/Zr3ln6cLyKJ+yWm1M=";

pkgs/by-name/me/meilisearch/package.nix

@@ -8,18 +8,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "meilisearch";
-  version = "1.35.0";
+  version = "1.35.1";
 
   src = fetchFromGitHub {
     owner = "meilisearch";
     repo = "meilisearch";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-OMvJBauvL5El/OANN8ACf2MLwclcHnFQVVwul8kKijM=";
+    hash = "sha256-CySE4nMCzyfNBCxOmn6wcZH6kyaiU+fPMwKp5KyWJxo=";
   };
 
   cargoBuildFlags = [ "--package=meilisearch" ];
 
-  cargoHash = "sha256-XHL9bfWRiZxzLCd0eLUWWn7KeH3h5bfuXPNQEO11+1c=";
+  cargoHash = "sha256-8s4rJlFtOPr7izz8ioAnmxBIou5ru+thttG6QwyhFqc=";
 
   # Default features include mini dashboard which downloads something from the internet.
   buildNoDefaultFeatures = true;

pkgs/by-name/mi/mistral-vibe/package.nix

@@ -12,14 +12,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "mistral-vibe";
-  version = "2.1.0";
+  version = "2.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mistralai";
     repo = "mistral-vibe";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Xeb16Ravk60DXAjRs1OcCl8axCRwTf9yqXWnva9VQro=";
+    hash = "sha256-q79/xP+kaovkch5wXzXumQb9l4wSspXg2cl7mD0Q2f8=";
   };
 
   build-system = with python3Packages; [
@@ -32,9 +32,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     "agent-client-protocol"
     "gitpython"
     "mistralai"
-    "pydantic"
     "pydantic-settings"
-    "watchfiles"
     "zstandard"
   ];
   dependencies = with python3Packages; [
@@ -43,6 +41,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     cryptography
     gitpython
     giturlparse
+    google-auth
     httpx
     keyring
     mcp
@@ -54,12 +53,13 @@ python3Packages.buildPythonApplication (finalAttrs: {
     pyperclip
     python-dotenv
     pyyaml
+    requests
     rich
     textual
     textual-speedups
     tomli-w
     tree-sitter
-    tree-sitter-grammars.tree-sitter-bash
+    tree-sitter-bash
     watchfiles
     zstandard
   ];

pkgs/by-name/mo/monocle/package.nix

@@ -8,27 +8,36 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "monocle";
-  version = "0.9.1";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "bgpkit";
     repo = "monocle";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-64oa3rmPR1PFmtGti1LVubO+2lY4VIkdMBKP6/IeyFk=";
+    hash = "sha256-F7z8WZAj00dYfawUiCTLnipkut9QAnXiO8DgIhJ/78U=";
   };
 
-  cargoHash = "sha256-rSvq+aHI5u0W1RG3JQooljeDmxTHE9ywdPguHdV3T+c=";
+  cargoHash = "sha256-+XdOvjQJkeDBH/3XtMX0SCGyji10UgnSme4oZuhwiq8=";
 
   # require internet access
-  checkFlags = [
-    "--skip=datasets::as2org::tests::test_crawling"
-    "--skip=datasets::ip::tests::test_fetch_ip_info"
-    "--skip=datasets::rpki::validator::tests::test_bgp"
-    "--skip=datasets::rpki::validator::tests::test_list_asn"
-    "--skip=datasets::rpki::validator::tests::test_list_prefix"
-    "--skip=datasets::rpki::validator::tests::test_validation"
-    "--skip=filters::search::tests::test_build_broker_with_filters"
-    "--skip=filters::search::tests::test_pagination_logic"
+  checkFlags = map (t: "--skip=${t}") [
+    "datasets::as2org::tests::test_crawling"
+    "datasets::ip::tests::test_fetch_ip_info"
+    "datasets::rpki::validator::tests::test_bgp"
+    "datasets::rpki::validator::tests::test_list_asn"
+    "datasets::rpki::validator::tests::test_list_prefix"
+    "datasets::rpki::validator::tests::test_validation"
+    "filters::search::tests::test_build_broker_with_filters"
+    "filters::search::tests::test_pagination_logic"
+    "lens::country::tests::test_all"
+    "lens::country::tests::test_lookup_by_code"
+    "lens::country::tests::test_lookup_by_name"
+    "lens::country::tests::test_lookup_code"
+    "lens::country::tests::test_search_with_args"
+    "lens::ip::tests::test_fetch_ip_info"
+    "lens::search::tests::test_build_broker_with_filters"
+    "lens::search::tests::test_pagination_logic"
+    "server::handlers::country::tests::test_country_lens_lookup"
   ];
 
   doInstallCheck = true;

pkgs/by-name/mo/monosat/package.nix

@@ -14,18 +14,14 @@
 }:
 
 let
-  boolToCmake = x: if x then "ON" else "OFF";
-
-  rev = "1.8.0";
-  sha256 = "0q3a8x3iih25xkp2bm842sm2hxlb8hxlls4qmvj7vzwrh4lvsl7b";
-
   pname = "monosat";
-  version = rev;
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "sambayless";
     repo = "monosat";
-    inherit rev sha256;
+    tag = version;
+    sha256 = "0q3a8x3iih25xkp2bm842sm2hxlb8hxlls4qmvj7vzwrh4lvsl7b";
   };
 
   patches = [
@@ -41,7 +37,7 @@ let
   # https://github.com/sambayless/monosat/issues/33
   commonPostPatch = lib.optionalString (!stdenv.hostPlatform.isx86) ''
     substituteInPlace src/monosat/Main.cc \
-      --replace 'defined(__linux__)' '0'
+      --replace-fail 'defined(__linux__)' '0'
   '';
 
   core = stdenv.mkDerivation {
@@ -63,12 +59,11 @@ let
     ];
 
     cmakeFlags = [
-      "-DBUILD_STATIC=OFF"
-      "-DJAVA=${boolToCmake includeJava}"
-      "-DGPL=${boolToCmake includeGplCode}"
-
+      (lib.cmakeBool "BUILD_STATIC" false)
+      (lib.cmakeBool "JAVA" includeJava)
+      (lib.cmakeBool "GPL" includeGplCode)
       # file RPATH_CHANGE could not write new RPATH
-      "-DCMAKE_SKIP_BUILD_RPATH=ON"
+      (lib.cmakeBool "CMAKE_SKIP_BUILD_RPATH" true)
     ];
 
     postInstall = lib.optionalString includeJava ''
@@ -91,11 +86,13 @@ let
   python =
     {
       buildPythonPackage,
+      setuptools,
       cython,
       pytestCheckHook,
     }:
     buildPythonPackage {
-      format = "setuptools";
+      pyproject = true;
+
       inherit
         pname
         version
@@ -103,13 +100,15 @@ let
         patches
         ;
 
-      propagatedBuildInputs = [
-        core
+      build-system = [
+        setuptools
         cython
       ];
 
+      buildInputs = [ core ];
+
       # This tells setup.py to use cython, which should produce faster bindings
-      MONOSAT_CYTHON = true;
+      env.MONOSAT_CYTHON = true;
 
       # After patching src, move to where the actually relevant source is. This could just be made
       # the sourceRoot if it weren't for the patch.
@@ -124,7 +123,7 @@ let
           # shared lib? The current setup.py copies the .dylib/.so...
           ''
             substituteInPlace setup.py \
-              --replace 'library_dir = "../../../../"' 'library_dir = "${core}/lib/"'
+              --replace-fail 'library_dir = "../../../../"' 'library_dir = "${core}/lib/"'
           '';
 
       nativeCheckInputs = [ pytestCheckHook ];
@@ -133,6 +132,11 @@ let
         "test_assertAtMostOne"
         "test_assertEqual"
       ];
+
+      pythonImportsCheck = [
+        "monosat"
+        "monosat.monosat_p"
+      ];
     };
 in
 core

pkgs/by-name/mu/mudlet/package.nix

@@ -103,8 +103,10 @@ stdenv.mkDerivation (finalAttrs: {
     "-DCMAKE_SKIP_BUILD_RPATH=ON"
   ];
 
-  WITH_FONTS = "NO";
-  WITH_UPDATER = "NO";
+  env = {
+    WITH_FONTS = "NO";
+    WITH_UPDATER = "NO";
+  };
 
   installPhase = ''
     runHook preInstall

pkgs/by-name/na/namespace-cli/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "namespace-cli";
-  version = "0.0.479";
+  version = "0.0.486";
 
   src = fetchFromGitHub {
     owner = "namespacelabs";
     repo = "foundation";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-EznGetJAjUMgQjTHgWA4nv3c6RobrSU28lEjN0PgsiE=";
+    hash = "sha256-FBk4PVIKpy6MvquqtQyfgw1/Twgef/CHE7/+mpsJjTw=";
   };
 
-  vendorHash = "sha256-dk32fNNO5nN/RuYOu+vx8Gjxdcs1vt6K9CrV1iXn++E=";
+  vendorHash = "sha256-GPO3vdk26K54VmjHmg1PL/nQd6GTz/ZQk8ZpNQHoqSQ=";
 
   subPackages = [
     "cmd/nsc"

pkgs/by-name/ne/neovide/package.nix

@@ -41,31 +41,33 @@ rustPlatform.buildRustPackage.override { stdenv = clangStdenv; } (finalAttrs: {
 
   cargoHash = "sha256-DD2c63JHMdzwD1OmC7c9dMB59qjvdAYZ9drQf3f8xCs=";
 
-  SKIA_SOURCE_DIR =
-    let
-      repo = fetchFromGitHub {
-        owner = "rust-skia";
-        repo = "skia";
-        # see rust-skia:skia-bindings/Cargo.toml#package.metadata skia
-        tag = "m140-0.87.4";
-        hash = "sha256-pHxqTrqguZcPmuZgv0ASbJ3dgn8JAyHI7+PdBX5gAZQ=";
-      };
-      # The externals for skia are taken from skia/DEPS
-      externals = linkFarm "skia-externals" (
-        lib.mapAttrsToList (name: value: {
-          inherit name;
-          path = fetchgit value;
-        }) (lib.importJSON ./skia-externals.json)
-      );
-    in
-    runCommand "source" { } ''
-      cp -R ${repo} $out
-      chmod -R +w $out
-      ln -s ${externals} $out/third_party/externals
-    '';
+  env = {
+    SKIA_SOURCE_DIR =
+      let
+        repo = fetchFromGitHub {
+          owner = "rust-skia";
+          repo = "skia";
+          # see rust-skia:skia-bindings/Cargo.toml#package.metadata skia
+          tag = "m140-0.87.4";
+          hash = "sha256-pHxqTrqguZcPmuZgv0ASbJ3dgn8JAyHI7+PdBX5gAZQ=";
+        };
+        # The externals for skia are taken from skia/DEPS
+        externals = linkFarm "skia-externals" (
+          lib.mapAttrsToList (name: value: {
+            inherit name;
+            path = fetchgit value;
+          }) (lib.importJSON ./skia-externals.json)
+        );
+      in
+      runCommand "source" { } ''
+        cp -R ${repo} $out
+        chmod -R +w $out
+        ln -s ${externals} $out/third_party/externals
+      '';
 
-  SKIA_GN_COMMAND = "${gn}/bin/gn";
-  SKIA_NINJA_COMMAND = "${ninja}/bin/ninja";
+    SKIA_GN_COMMAND = "${gn}/bin/gn";
+    SKIA_NINJA_COMMAND = "${ninja}/bin/ninja";
+  };
 
   nativeBuildInputs = [
     makeWrapper
@@ -124,7 +126,7 @@ rustPlatform.buildRustPackage.override { stdenv = clangStdenv; } (finalAttrs: {
       install -m444 -Dt $out/share/applications assets/neovide.desktop
     '';
 
-  disallowedReferences = [ finalAttrs.SKIA_SOURCE_DIR ];
+  disallowedReferences = [ finalAttrs.env.SKIA_SOURCE_DIR ];
 
   meta = {
     description = "Simple, no-nonsense, cross-platform graphical user interface for Neovim";