Merge branch 'master' into staging

doc/languages-frameworks/idris2.section.md

@@ -1,5 +1,57 @@
 # Idris2 {#sec-idris2}
 
+When developing using Idris2, by default the Idris compiler only has the minimal support libraries in its environment. This means that it will not attempt to read any libraries installed
+globally, for example in the `$HOME` directory. The recommended way to use Idris2 is to wrap the compiler in an environment that provides these packages per-project, for example in a
+devShell.
+
+```nix
+{
+  pkgs ? import <nixpkgs> { },
+}:
+pkgs.mkShell {
+  packages = [ (idris2.withPackages (p: [ p.idris2Api ])) ];
+}
+```
+or, alternatively if Nix is used to build the Idris2 project:
+
+```nix
+{
+  pkgs ? import <nixpkgs> { },
+}:
+pkgs.mkShell {
+  inputsFrom = [ (pkgs.callPackage ./package.nix { }) ];
+}
+```
+
+By default, the Idris2 compiler provided by Nixpkgs does not read globally installed packages, nor can install them. Running `idris2 --install` will fail because the Nix store is
+a read-only file-system. If globally-installed packages are desired rather than the above strategy, one can set `IDRIS2_PREFIX`, or additional `IDRIS2_PACKAGE_PATH` entries
+for the compiler to read from. The following snippet will append `$HOME/.idris2` to `$IDRIS2_PACKAGE_PATH`, and if such a variable does not exist, create it. The Nixpkg's Idris2
+compiler append a few required libraries to this path variable, but any paths in the user's environment will be prefixed to those libraries.
+
+```nix
+{
+  pkgs ? import <nixpkgs> { },
+}:
+pkgs.mkShell {
+  packages = [ (idris2.withPackages (p: [ p.idris2Api ])) ];
+  shellHook = ''
+    IDRIS2_PACKAGE_PATH="''${IDRIS2_PACKAGE_PATH:+$IDRIS2_PACKAGE_PATH}$HOME/.idris2"
+  '';
+}
+```
+The following snippet will allow the Idris2 to run `idris2 --install` successfully:
+```nix
+{
+  pkgs ? import <nixpkgs> { },
+}:
+pkgs.mkShell {
+  packages = [ (idris2.withPackages (p: [ p.idris2Api ])) ];
+  shellHook = ''
+    IDRIS2_PREFIX="$HOME/.idris2"
+  '';
+}
+```
+
 In addition to exposing the Idris2 compiler itself, Nixpkgs exposes an `idris2Packages.buildIdris` helper to make it a bit more ergonomic to build Idris2 executables or libraries.
 
 The `buildIdris` function takes an attribute set that defines at a minimum the `src` and `ipkgName` of the package to be built and any `idrisLibraries` required to build it. The `src` is the same source you're familiar with and the `ipkgName` must be the name of the `ipkg` file for the project (omitting the `.ipkg` extension). The `idrisLibraries` is a list of other library derivations created with `buildIdris`. You can optionally specify other derivation properties as needed but sensible defaults for `configurePhase`, `buildPhase`, and `installPhase` are provided.
@@ -56,3 +108,20 @@ lspPkg.executable
 ```
 
 The above uses the default value of `withSource = false` for the `idris2Api` but could be modified to include that library's source by passing `(idris2Api { withSource = true; })` to `idrisLibraries` instead. `idris2Api` in the above derivation comes built in with `idris2Packages`. This library exposes many of the otherwise internal APIs of the Idris2 compiler.
+
+The compiler package can be instantiated with packages on its `IDRIS2_PACKAGES` path from the `idris2Packages` set.
+
+```nix
+{
+  idris2,
+  devShell,
+}:
+let
+  myIdris = idris2.withPackages (p: [ p.idris2Api ]);
+in
+devShell {
+  packages = [ myIdris ];
+}
+```
+
+This search path is extended from the path already in the user's environment.

doc/release-notes/rl-2511.section.md

@@ -216,6 +216,8 @@
 
 - `sail-riscv` 0.8 follows [upstream](https://github.com/riscv/sail-riscv/blob/7cc4620eb1a57bfe04832baccdcf5727e9459bd4/doc/ChangeLog.md) and provides only a single binary, `sail_riscv_sim`.
 
+- `moar` has been updated from `1.33.0` to `2.0.0`, and renamed to `moor` following an upstream decision. See the [release notes](https://github.com/walles/moor/releases/tag/v2.0.0) for more.
+
 - `podofo` has been updated from `0.9.8` to `1.0.0`. These releases are by nature very incompatible due to major API changes. The legacy versions can be found under `podofo_0_10` and `podofo_0_9`.
   Changelog: https://github.com/podofo/podofo/blob/1.0.0/CHANGELOG.md, API-Migration-Guide: https://github.com/podofo/podofo/blob/1.0.0/API-MIGRATION.md.
 
@@ -286,6 +288,8 @@
 
 - `installShellCompletion`: now supports Nushell completion files
 
+- `idris2` supports being instantiated with a package environment with `idris.withPackages (p: [ ])`
+
 - New hardening flags `strictflexarrays1`, `strictflexarrays3`, `glibcxxassertions`, `libcxxhardeningfast` and `libcxxhardeningextensive` were made available.
 
 - `gramps` has been updated to 6.0.0

lib/customisation.nix

@@ -305,9 +305,10 @@ rec {
         arg:
         let
           loc = unsafeGetAttrPos arg fargs;
+          loc' = if loc != null then loc.file + ":" + toString loc.line else "<unknown location>";
         in
         "Function called without required argument \"${arg}\" at "
-        + "${loc.file}:${toString loc.line}${prettySuggestions (getSuggestions arg)}";
+        + "${loc'}${prettySuggestions (getSuggestions arg)}";
 
       # Only show the error for the first missing argument
       error = errorForArg (head (attrNames missingArgs));

nixos/doc/manual/release-notes/rl-2511.section.md

@@ -33,6 +33,8 @@
 - [gtklock](https://github.com/jovanlanik/gtklock), a GTK-based lockscreen for Wayland. Available as [programs.gtklock](#opt-programs.gtklock.enable).
 - [Chrysalis](https://github.com/keyboardio/Chrysalis), a graphical configurator for Kaleidoscope-powered keyboards. Available as [programs.chrysalis](#opt-programs.chrysalis.enable).
 
+- [wayvnc](https://github.com/any1/wayvnc), VNC server for wlroots based Wayland compositors. Available as [programs.wayvnc](#opt-programs.wayvnc.enable).
+
 - [Pi-hole](https://pi-hole.net/), a DNS sinkhole for advertisements based on Dnsmasq. Available as [services.pihole-ftl](#opt-services.pihole-ftl.enable), and [services.pihole-web](#opt-services.pihole-web.enable) for the web GUI and API.
 
 - [Fediwall](https://fediwall.social), a web application for live displaying toots from mastodon, inspired by mastowall. Available as [services.fediwall](#opt-services.fediwall.enable).
@@ -146,6 +148,8 @@
 
 - [KMinion](https://github.com/redpanda-data/kminion), feature-rich Prometheus exporter for Apache Kafka. Available as [services.prometheus.exporters.kafka](options.html#opt-services.prometheus.exporters.kafka).
 
+- [Beszel](https://beszel.dev), a lightweight server monitoring hub with historical data, docker stats, and alerts. Available as [`services.beszel.agent`](options.html#opt-services.beszel.agent.enable) and [`services.beszel.hub`](options.html#opt-services.beszel.hub.enable).
+
 - [Spoolman](https://github.com/Donkie/Spoolman), a inventory management system for Filament spools. Available as [services.spoolman](#opt-services.spoolman.enable).
 
 - [Temporal](https://temporal.io/), a durable execution platform that enables

nixos/modules/module-list.nix

@@ -352,6 +352,7 @@
   ./programs/wayland/uwsm.nix
   ./programs/wayland/waybar.nix
   ./programs/wayland/wayfire.nix
+  ./programs/wayland/wayvnc.nix
   ./programs/weylus.nix
   ./programs/winbox.nix
   ./programs/wireshark.nix
@@ -972,6 +973,8 @@
   ./services/monitoring/apcupsd.nix
   ./services/monitoring/arbtt.nix
   ./services/monitoring/below.nix
+  ./services/monitoring/beszel-agent.nix
+  ./services/monitoring/beszel-hub.nix
   ./services/monitoring/bosun.nix
   ./services/monitoring/cadvisor.nix
   ./services/monitoring/certspotter.nix

nixos/modules/programs/wayland/wayvnc.nix

@@ -0,0 +1,25 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+
+let
+  cfg = config.programs.wayvnc;
+in
+{
+  options.programs.wayvnc = {
+    enable = lib.mkEnableOption "wayvnc, VNC server for wlroots based Wayland compositors";
+    package = lib.mkPackageOption pkgs "wayvnc" { };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+
+    # https://github.com/any1/wayvnc/blob/master/src/pam_auth.c
+    security.pam.services.wayvnc = { };
+  };
+
+  meta.maintainers = with lib.maintainers; [ qusic ];
+}

nixos/modules/security/rtkit.nix

@@ -57,10 +57,45 @@ in
     systemd.packages = [ package ];
 
     systemd.services.rtkit-daemon = {
-      serviceConfig.ExecStart = [
+      serviceConfig = {
-        "" # Resets command from upstream unit.
+        ExecStart = [
-        "${package}/libexec/rtkit-daemon ${utils.escapeSystemdExecArgs cfg.args}"
+          "" # Resets command from upstream unit.
-      ];
+          "${package}/libexec/rtkit-daemon ${utils.escapeSystemdExecArgs cfg.args}"
+        ];
+
+        # Needs to verify the user of the processes.
+        PrivateUsers = "full";
+        # Needs to access other processes to modify their scheduling modes.
+        ProcSubset = "all";
+        ProtectProc = "default";
+        # Canary needs to be realtime.
+        RestrictRealtime = false;
+
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = "disconnected";
+        ProtectClock = true;
+        ProtectControlGroups = "strict";
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [ "AF_UNIX" ];
+        IPAddressDeny = "any";
+        RestrictNamespaces = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "@mount" # Needs chroot(1)
+        ];
+        UMask = "0777";
+      };
     };
 
     users.users.rtkit = {

nixos/modules/services/databases/lldap.nix

@@ -224,7 +224,7 @@ in
           fi
         ''
         + ''
-          ${lib.getExe cfg.package} run --config-file ${format.generate "lldap_config.toml" cfg.settings}
+          exec ${lib.getExe cfg.package} run --config-file ${format.generate "lldap_config.toml" cfg.settings}
         '';
       serviceConfig = {
         StateDirectory = "lldap";

nixos/modules/services/monitoring/beszel-agent.nix

@@ -0,0 +1,119 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.beszel.agent;
+in
+{
+  meta.maintainers = with lib.maintainers; [
+    BonusPlay
+    arunoruto
+  ];
+
+  options.services.beszel.agent = {
+    enable = lib.mkEnableOption "beszel agent";
+    package = lib.mkPackageOption pkgs "beszel" { };
+    openFirewall = (lib.mkEnableOption "") // {
+      description = "Whether to open the firewall port (default 45876).";
+    };
+
+    environment = lib.mkOption {
+      type = lib.types.attrsOf lib.types.str;
+      default = { };
+      description = ''
+        Environment variables for configuring the beszel-agent service.
+        This field will end up public in /nix/store, for secret values (such as `KEY`) use `environmentFile`.
+
+        See <https://www.beszel.dev/guide/environment-variables#agent> for available options.
+      '';
+    };
+    environmentFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      description = ''
+        File path containing environment variables for configuring the beszel-agent service in the format of an EnvironmentFile. See {manpage}`systemd.exec(5)`.
+      '';
+    };
+    extraPath = lib.mkOption {
+      type = lib.types.listOf lib.types.package;
+      default = [ ];
+      description = ''
+        Extra packages to add to beszel path (such as nvidia-smi or rocm-smi).
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.beszel-agent = {
+      description = "Beszel Server Monitoring Agent";
+
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
+      after = [ "network-online.target" ];
+
+      environment = cfg.environment;
+      path =
+        cfg.extraPath
+        ++ lib.optionals (builtins.elem "nvidia" config.services.xserver.videoDrivers) [
+          (lib.getBin config.hardware.nvidia.package)
+        ]
+        ++ lib.optionals (builtins.elem "amdgpu" config.services.xserver.videoDrivers) [
+          (lib.getBin pkgs.rocmPackages.rocm-smi)
+        ]
+        ++ lib.optionals (builtins.elem "intel" config.services.xserver.videoDrivers) [
+          (lib.getBin pkgs.intel-gpu-tools)
+        ];
+
+      serviceConfig = {
+        ExecStart = ''
+          ${cfg.package}/bin/beszel-agent
+        '';
+
+        EnvironmentFile = cfg.environmentFile;
+
+        # adds ability to monitor docker/podman containers
+        SupplementaryGroups =
+          lib.optionals config.virtualisation.docker.enable [ "docker" ]
+          ++ lib.optionals (
+            config.virtualisation.podman.enable && config.virtualisation.podman.dockerSocket.enable
+          ) [ "podman" ];
+
+        DynamicUser = true;
+        User = "beszel-agent";
+        LockPersonality = true;
+        NoNewPrivileges = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProtectClock = true;
+        ProtectControlGroups = "strict";
+        ProtectHome = "read-only";
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectSystem = "strict";
+        Restart = "on-failure";
+        RestartSec = "30s";
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallErrorNumber = "EPERM";
+        SystemCallFilter = [ "@system-service" ];
+        Type = "simple";
+        UMask = 27;
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [
+      (
+        if (builtins.hasAttr "PORT" cfg.environment) then
+          (lib.strings.toInt cfg.environment.PORT)
+        else
+          45876
+      )
+    ];
+  };
+}

nixos/modules/services/monitoring/beszel-hub.nix

@@ -0,0 +1,114 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.beszel.hub;
+in
+{
+  meta.maintainers = with lib.maintainers; [
+    BonusPlay
+    arunoruto
+  ];
+
+  options.services.beszel.hub = {
+    enable = lib.mkEnableOption "beszel hub";
+
+    package = lib.mkPackageOption pkgs "beszel" { };
+
+    host = lib.mkOption {
+      default = "127.0.0.1";
+      type = lib.types.str;
+      example = "0.0.0.0";
+      description = "Host or address this beszel hub listens on.";
+    };
+    port = lib.mkOption {
+      default = 8090;
+      type = lib.types.port;
+      example = 3002;
+      description = "Port for this beszel hub to listen on.";
+    };
+
+    dataDir = lib.mkOption {
+      type = lib.types.path;
+      default = "/var/lib/beszel-hub";
+      description = "Data directory of beszel-hub.";
+    };
+
+    environment = lib.mkOption {
+      type = with lib.types; attrsOf str;
+      default = { };
+      example = {
+        DISABLE_PASSWORD_AUTH = "true";
+      };
+      description = ''
+        Environment variables passed to the systemd service.
+        See <https://www.beszel.dev/guide/environment-variables#hub> for available options.
+      '';
+    };
+    environmentFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      description = ''
+        Environment file to be passed to the systemd service.
+        Useful for passing secrets to the service to prevent them from being
+        world-readable in the Nix store. See {manpage}`systemd.exec(5)`.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.beszel-hub = {
+      description = "Beszel Server Monitoring Web App";
+
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
+      after = [ "network-online.target" ];
+      environment = cfg.environment;
+
+      serviceConfig = {
+        ExecStartPre = [
+          "${cfg.package}/bin/beszel-hub migrate up"
+          "${cfg.package}/bin/beszel-hub history-sync"
+        ];
+        ExecStart = ''
+          ${cfg.package}/bin/beszel-hub serve --http='${cfg.host}:${toString cfg.port}'
+        '';
+
+        EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
+        WorkingDirectory = cfg.dataDir;
+        StateDirectory = baseNameOf cfg.dataDir;
+        RuntimeDirectory = baseNameOf cfg.dataDir;
+        ReadWritePaths = cfg.dataDir;
+
+        DynamicUser = true;
+        User = "beszel-hub";
+        LockPersonality = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProtectClock = true;
+        ProtectControlGroups = "strict";
+        ProtectHome = "read-only";
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectSystem = "strict";
+        DevicePolicy = "closed";
+        Restart = "on-failure";
+        RestartSec = "30s";
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        RestrictNamespaces = true;
+        SystemCallArchitectures = "native";
+        SystemCallErrorNumber = "EPERM";
+        SystemCallFilter = [ "@system-service" ];
+        UMask = 27;
+      };
+    };
+  };
+}

nixos/tests/all-tests.nix

@@ -266,6 +266,7 @@ in
   beanstalkd = runTest ./beanstalkd.nix;
   bees = runTest ./bees.nix;
   benchexec = runTest ./benchexec.nix;
+  beszel = runTest ./beszel.nix;
   binary-cache = runTest {
     imports = [ ./binary-cache.nix ];
     _module.args.compression = "zstd";

nixos/tests/beszel.nix

@@ -0,0 +1,119 @@
+{ pkgs, lib, ... }:
+{
+  name = "beszel";
+  meta.maintainers = with lib.maintainers; [ h7x4 ];
+
+  nodes = {
+    hubHost =
+      { config, pkgs, ... }:
+      {
+        virtualisation.vlans = [ 1 ];
+
+        systemd.network.networks."01-eth1" = {
+          name = "eth1";
+          networkConfig.Address = "10.0.0.1/24";
+        };
+
+        networking = {
+          useNetworkd = true;
+          useDHCP = false;
+        };
+
+        services.beszel.hub = {
+          enable = true;
+          host = "10.0.0.1";
+        };
+
+        networking.firewall.allowedTCPPorts = [
+          config.services.beszel.hub.port
+        ];
+
+        environment.systemPackages = [
+          config.services.beszel.hub.package
+        ];
+      };
+
+    agentHost =
+      { config, pkgs, ... }:
+      {
+        virtualisation.vlans = [ 1 ];
+
+        systemd.network.networks."01-eth1" = {
+          name = "eth1";
+          networkConfig.Address = "10.0.0.2/24";
+        };
+
+        networking = {
+          useNetworkd = true;
+          useDHCP = false;
+        };
+
+        environment.systemPackages = with pkgs; [ jq ];
+
+        specialisation."agent".configuration = {
+          services.beszel.agent = {
+            enable = true;
+            environment.HUB_URL = "http://10.0.0.1:8090";
+            environment.KEY_FILE = "/var/lib/beszel-agent/id_ed25519.pub";
+            environment.TOKEN_FILE = "/var/lib/beszel-agent/token";
+            openFirewall = true;
+          };
+        };
+      };
+  };
+
+  testScript =
+    { nodes, ... }:
+    let
+      hubCfg = nodes.hubHost.services.beszel.hub;
+      agentCfg = nodes.agentHost.specialisation."agent".configuration.services.beszel.agent;
+    in
+    ''
+      import json
+
+      start_all()
+
+      with subtest("Start hub"):
+        hubHost.wait_for_unit("beszel-hub.service")
+        hubHost.wait_for_open_port(${toString hubCfg.port}, "${toString hubCfg.host}")
+
+      with subtest("Register user"):
+        agentHost.succeed('curl -f --json \'${
+          builtins.toJSON {
+            email = "admin@example.com";
+            password = "password";
+          }
+        }\' "${agentCfg.environment.HUB_URL}/api/beszel/create-user"')
+        user = json.loads(agentHost.succeed('curl -f --json \'${
+          builtins.toJSON {
+            identity = "admin@example.com";
+            password = "password";
+          }
+        }\' ${agentCfg.environment.HUB_URL}/api/collections/users/auth-with-password').strip())
+
+      with subtest("Install agent credentials"):
+        agentHost.succeed("mkdir -p \"$(dirname '${agentCfg.environment.KEY_FILE}')\" \"$(dirname '${agentCfg.environment.TOKEN_FILE}')\"")
+        sshkey = agentHost.succeed(f"curl -H 'Authorization: {user["token"]}' -f ${agentCfg.environment.HUB_URL}/api/beszel/getkey | jq -r .key").strip()
+        utoken = agentHost.succeed(f"curl -H 'Authorization: {user["token"]}' -f ${agentCfg.environment.HUB_URL}/api/beszel/universal-token | jq -r .token").strip()
+        agentHost.succeed(f"echo '{sshkey}' > '${agentCfg.environment.KEY_FILE}'")
+        agentHost.succeed(f"echo '{utoken}' > '${agentCfg.environment.TOKEN_FILE}'")
+
+      with subtest("Register agent in hub"):
+        agentHost.succeed(f'curl -H \'Authorization: {user["token"]}\' -f --json \'{${
+          builtins.toJSON {
+            "host" = "10.0.0.2";
+            "name" = "agent";
+            "pkey" = "{sshkey}";
+            "port" = "45876";
+            "tkn" = "{utoken}";
+            "users" = ''{user['record']['id']}'';
+          }
+        }}\' "${agentCfg.environment.HUB_URL}/api/collections/systems/records"')
+
+      with subtest("Start agent"):
+        agentHost.succeed("/run/current-system/specialisation/agent/bin/switch-to-configuration switch")
+        agentHost.wait_for_unit("beszel-agent.service")
+        agentHost.wait_until_succeeds("journalctl -eu beszel-agent --grep 'SSH connection established'")
+        agentHost.wait_until_succeeds(f'curl -H \'Authorization: {user["token"]}\' -f ${agentCfg.environment.HUB_URL}/api/collections/systems/records | grep agentHost')
+    '';
+}

nixos/tests/budgie.nix

@@ -54,7 +54,8 @@
           machine.succeed("xauth merge ${user.home}/.Xauthority")
 
       with subtest("Check that logging in has given the user ownership of devices"):
-          machine.succeed("getfacl -p /dev/snd/timer | grep -q ${user.name}")
+          # Change back to /dev/snd/timer after systemd-258.1
+          machine.succeed("getfacl -p /dev/dri/card0 | grep -q ${user.name}")
 
       with subtest("Check if Budgie session components actually start"):
           for i in ["budgie-daemon", "budgie-panel", "budgie-wm", "budgie-desktop-view", "gsd-media-keys"]:

nixos/tests/cinnamon-wayland.nix

@@ -42,7 +42,8 @@
           machine.wait_for_file("/run/user/${toString user.uid}/wayland-0")
 
       with subtest("Check that logging in has given the user ownership of devices"):
-          machine.succeed("getfacl -p /dev/snd/timer | grep -q ${user.name}")
+          # Change back to /dev/snd/timer after systemd-258.1
+          machine.succeed("getfacl -p /dev/dri/card0 | grep -q ${user.name}")
 
       with subtest("Wait for the Cinnamon shell"):
           # Correct output should be (true, '2')

nixos/tests/cinnamon.nix

@@ -53,7 +53,8 @@
           machine.succeed("xauth merge ${user.home}/.Xauthority")
 
       with subtest("Check that logging in has given the user ownership of devices"):
-          machine.succeed("getfacl -p /dev/snd/timer | grep -q ${user.name}")
+          # Change back to /dev/snd/timer after systemd-258.1
+          machine.succeed("getfacl -p /dev/dri/card0 | grep -q ${user.name}")
 
       with subtest("Wait for the Cinnamon shell"):
           # Correct output should be (true, '2')

nixos/tests/enlightenment.nix

@@ -42,7 +42,8 @@
           machine.succeed("xauth merge ${user.home}/.Xauthority")
 
       with subtest("Check that logging in has given the user ownership of devices"):
-          machine.succeed("getfacl -p /dev/snd/timer | grep -q ${user.name}")
+          # Change back to /dev/snd/timer after systemd-258.1
+          machine.succeed("getfacl -p /dev/dri/card0 | grep -q ${user.name}")
 
       with subtest("First time wizard"):
           machine.wait_for_text("Default")  # Language

nixos/tests/gnome-extensions.nix

@@ -105,7 +105,8 @@
           # wait for alice to be logged in
           machine.wait_for_unit("default.target", "${user.name}")
           # check that logging in has given the user ownership of devices
-          assert "alice" in machine.succeed("getfacl -p /dev/snd/timer")
+          # Change back to /dev/snd/timer after systemd-258.1
+          assert "alice" in machine.succeed("getfacl -p /dev/dri/card0")
 
       with subtest("Wait for GNOME Shell"):
           # correct output should be (true, 'false')

nixos/tests/gnome-flashback.nix

@@ -46,7 +46,8 @@
           machine.wait_for_file("${xauthority}")
           machine.succeed("xauth merge ${xauthority}")
           # Check that logging in has given the user ownership of devices
-          assert "alice" in machine.succeed("getfacl -p /dev/snd/timer")
+          # Change back to /dev/snd/timer after systemd-258.1
+          assert "alice" in machine.succeed("getfacl -p /dev/dri/card0")
 
       with subtest("Wait for Metacity"):
           machine.wait_until_succeeds("pgrep metacity")

nixos/tests/gnome-xorg.nix

@@ -83,7 +83,8 @@
           machine.wait_for_file("${xauthority}")
           machine.succeed("xauth merge ${xauthority}")
           # Check that logging in has given the user ownership of devices
-          assert "alice" in machine.succeed("getfacl -p /dev/snd/timer")
+          # Change back to /dev/snd/timer after systemd-258.1
+          assert "alice" in machine.succeed("getfacl -p /dev/dri/card0")
 
       with subtest("Wait for GNOME Shell"):
           # correct output should be (true, 'false')

nixos/tests/gnome.nix

@@ -76,7 +76,8 @@
           # wait for alice to be logged in
           machine.wait_for_unit("default.target", "${user.name}")
           # check that logging in has given the user ownership of devices
-          assert "alice" in machine.succeed("getfacl -p /dev/snd/timer")
+          # Change back to /dev/snd/timer after systemd-258.1
+          assert "alice" in machine.succeed("getfacl -p /dev/dri/card0")
 
       with subtest("Wait for GNOME Shell"):
           # correct output should be (true, 'false')

nixos/tests/lxqt.nix

@@ -42,7 +42,8 @@
           machine.succeed("su - ${user.name} -c 'xauth merge /tmp/xauth_*'")
 
       with subtest("Check that logging in has given the user ownership of devices"):
-          machine.succeed("getfacl -p /dev/snd/timer | grep -q ${user.name}")
+          # Change back to /dev/snd/timer after systemd-258.1
+          machine.succeed("getfacl -p /dev/dri/card0 | grep -q ${user.name}")
 
       with subtest("Check if LXQt components actually start"):
           for i in ["openbox", "lxqt-session", "pcmanfm-qt", "lxqt-panel", "lxqt-runner"]:

nixos/tests/mate.nix

@@ -41,7 +41,8 @@
           machine.succeed("xauth merge ${user.home}/.Xauthority")
 
       with subtest("Check that logging in has given the user ownership of devices"):
-          machine.succeed("getfacl -p /dev/snd/timer | grep -q ${user.name}")
+          # Change back to /dev/snd/timer after systemd-258.1
+          machine.succeed("getfacl -p /dev/dri/card0 | grep -q ${user.name}")
 
       with subtest("Check if MATE session components actually start"):
           machine.wait_until_succeeds("pgrep marco")

nixos/tests/pantheon.nix

@@ -72,7 +72,8 @@
           machine.wait_for_file("/run/user/${toString user.uid}/wayland-0")
 
       with subtest("Check that logging in has given the user ownership of devices"):
-          machine.succeed("getfacl -p /dev/snd/timer | grep -q ${user.name}")
+          # Change back to /dev/snd/timer after systemd-258.1
+          machine.succeed("getfacl -p /dev/dri/card0 | grep -q ${user.name}")
 
       with subtest("Check if Pantheon components actually start"):
           pgrep_list = [

nixos/tests/xfce-wayland.nix

@@ -39,7 +39,8 @@
         machine.wait_for_file("/run/user/${toString user.uid}/wayland-0")
 
       with subtest("Check that logging in has given the user ownership of devices"):
-        machine.succeed("getfacl -p /dev/snd/timer | grep -q ${user.name}")
+        # Change back to /dev/snd/timer after systemd-258.1
+        machine.succeed("getfacl -p /dev/dri/card0 | grep -q ${user.name}")
 
       with subtest("Check if Xfce components actually start"):
         for p in ["labwc", "xfdesktop", "xfce4-notifyd", "xfconfd", "xfce4-panel"]:

nixos/tests/xfce.nix

@@ -38,7 +38,8 @@
         machine.succeed("xauth merge ${user.home}/.Xauthority")
 
       with subtest("Check that logging in has given the user ownership of devices"):
-        machine.succeed("getfacl -p /dev/snd/timer | grep -q ${user.name}")
+        # Change back to /dev/snd/timer after systemd-258.1
+        machine.succeed("getfacl -p /dev/dri/card0 | grep -q ${user.name}")
 
       with subtest("Check if Xfce components actually start"):
         machine.wait_for_window("xfce4-panel")

pkgs/applications/audio/linvstmanager/default.nix

@@ -27,6 +27,11 @@ stdenv.mkDerivation rec {
     qtbase
   ];
 
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 3.0.0)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
   meta = with lib; {
     description = "Graphical companion application for various bridges like LinVst, etc";
     mainProgram = "linvstmanager";

pkgs/applications/emulators/libretro/cores/snes9x.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "snes9x";
-  version = "0-unstable-2025-10-11";
+  version = "0-unstable-2025-10-16";
 
   src = fetchFromGitHub {
     owner = "snes9xgit";
     repo = "snes9x";
-    rev = "cdffce2e32bfc0305fd5489831d09b5e730bed9b";
+    rev = "abfc018c90799eb55b773fc46d486167d8b3c762";
-    hash = "sha256-uTUhE6yvzgGxik1TMxcOI4K55xKTZNl7PmwYVxBsQZY=";
+    hash = "sha256-7PXUGUfhieYz8rLDhfLq09AcJbEcTLC/peYYN/B07c4=";
   };
 
   makefile = "Makefile";

pkgs/applications/networking/browsers/chromium/info.json

@@ -1,10 +1,10 @@
 {
   "chromium": {
-    "version": "141.0.7390.107",
+    "version": "141.0.7390.122",
     "chromedriver": {
-      "version": "141.0.7390.108",
+      "version": "141.0.7390.123",
-      "hash_darwin": "sha256-TvfBtM4vEYmBiUiZmdALHouufc95l9lcptGUafhT/a4=",
+      "hash_darwin": "sha256-grFBdZXToIZiHOrKs3EkVcl3+Bpj4tbui63oUstkpT4=",
-      "hash_darwin_aarch64": "sha256-xe9/tivLgzkUHRo/39ytgGl32Q/Gml8Vg7Jptf1jtGw="
+      "hash_darwin_aarch64": "sha256-Da3LogG0JRRI9iuTw4vWUh9CGCnicMzIDea641teQII="
     },
     "deps": {
       "depot_tools": {
@@ -21,8 +21,8 @@
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "1c008349f76ff3a317bf28316fc5008c0120deb4",
+        "rev": "b477534e7e10d193e916cd4e2967c589383625b2",
-        "hash": "sha256-NRqWOkGrg/Y4wZi4WQDJ6CvsDpeseVgTc/iAnuPRy/U=",
+        "hash": "sha256-3sVHRzERwlLzXl2qSn2Lil4U4d6N63MUOomSUrjy2YY=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {

pkgs/applications/office/libreoffice/skip-broken-tests-still.patch

@@ -176,6 +176,16 @@
      createSwDoc("tdf166152.fodt");
  
      auto* pWrtShell = getSwDocShell()->GetWrtShell();
+--- a/unoxml/qa/unit/rdftest.cxx
++++ b/unoxml/qa/unit/rdftest.cxx
+@@ -962,6 +962,7 @@ CPPUNIT_TEST_FIXTURE(RDFStreamTest, testTdf123293)
+
+ CPPUNIT_TEST_FIXTURE(RDFStreamTest, testDocumentMetadataAccess)
+ {
++    return; // fails on aarch64
+     loadFromURL(u"private:factory/swriter"_ustr);
+
+     uno::Reference<rdf::XDocumentMetadataAccess> xDocumentMetadataAccess(mxComponent,
 --- a/vcl/qa/cppunit/pdfexport/pdfexport2.cxx
 +++ b/vcl/qa/cppunit/pdfexport/pdfexport2.cxx
 @@ -6077,6 +6077,7 @@ CPPUNIT_TEST_FIXTURE(PdfExportTest2, testTdf162750SmallCapsLigature)

pkgs/by-name/as/asm-lsp/package.nix

@@ -8,7 +8,7 @@
 }:
 let
   pname = "asm-lsp";
-  version = "0.10.0";
+  version = "0.10.1";
 in
 rustPlatform.buildRustPackage {
   inherit pname version;
@@ -17,14 +17,14 @@ rustPlatform.buildRustPackage {
     owner = "bergercookie";
     repo = "asm-lsp";
     rev = "v${version}";
-    hash = "sha256-RAyiE+Msmr/Qt5v7rWuUTAji383XLKxeMQJove2b1NE=";
+    hash = "sha256-vEilIoIK6fxZBhmyDueP2zvbh1/t2wd4cnq/0y6p+TI=";
   };
 
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = lib.optionals (!stdenv.hostPlatform.isDarwin) [ openssl ];
 
-  cargoHash = "sha256-41iWqgywfFdqf3TzZT5peh39jiSZw8FRTI1AeL5CroY=";
+  cargoHash = "sha256-D91n+sx8qwkn/rEWP5ftS/mhmRru43TmKZUyvAc47H0=";
 
   # tests expect ~/.cache/asm-lsp to be writable
   preCheck = ''

pkgs/by-name/ba/baresip/package.nix

@@ -31,14 +31,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "4.1.0";
+  version = "4.2.0";
   pname = "baresip";
 
   src = fetchFromGitHub {
     owner = "baresip";
     repo = "baresip";
     rev = "v${version}";
-    hash = "sha256-KbjdwvXUiNvHb6AXt38M9gkhliiie+8frvuqYJEsnJE=";
+    hash = "sha256-kC1pqquIddjqIvGSIE9Rzlvr6qzTXF+mFsZlIzFBExI=";
   };
 
   patches = [

pkgs/by-name/be/beszel/package.nix

@@ -4,6 +4,7 @@
   fetchFromGitHub,
   nix-update-script,
   buildNpmPackage,
+  nixosTests,
 }:
 buildGoModule rec {
   pname = "beszel";
@@ -62,11 +63,14 @@ buildGoModule rec {
     mv $out/bin/hub $out/bin/beszel-hub
   '';
 
-  passthru.updateScript = nix-update-script {
+  passthru = {
-    extraArgs = [
+    updateScript = nix-update-script {
-      "--subpackage"
+      extraArgs = [
-      "webui"
+        "--subpackage"
-    ];
+        "webui"
+      ];
+    };
+    tests.nixos = nixosTests.beszel;
   };
 
   meta = {

pkgs/by-name/de/debian-devscripts/package.nix

@@ -30,14 +30,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "debian-devscripts";
-  version = "2.25.19";
+  version = "2.25.20";
 
   src = fetchFromGitLab {
     domain = "salsa.debian.org";
     owner = "debian";
     repo = "devscripts";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xRWWdM2l1F1Z7U+ThxWvH5wL2ZY+sR8+Jx6h/7mo9dQ=";
+    hash = "sha256-TpS4Gb6HZfCO42PSMyQ6qC1uUYAGkC9r4DHz4tofYKw=";
   };
 
   patches = [

pkgs/by-name/go/google-chrome/package.nix

@@ -170,11 +170,11 @@ let
 
   linux = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "141.0.7390.107";
+    version = "141.0.7390.122";
 
     src = fetchurl {
       url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb";
-      hash = "sha256-dNc4pUaqghgMxibOpHn3p2H/85ByqpPDRYpUWXX7ZzU=";
+      hash = "sha256-svzUxJiw5ldHwl413QV+9Egixes8D7tEmqFU+k94mlA=";
     };
 
     # With strictDeps on, some shebangs were not being patched correctly
@@ -272,11 +272,11 @@ let
 
   darwin = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "141.0.7390.108";
+    version = "141.0.7390.123";
 
     src = fetchurl {
-      url = "http://dl.google.com/release2/chrome/mevrk534jr6le7rbu7gatnuxym_141.0.7390.108/GoogleChrome-141.0.7390.108.dmg";
+      url = "http://dl.google.com/release2/chrome/adavkzngpjaayzmntr45fwn25nyq_141.0.7390.123/GoogleChrome-141.0.7390.123.dmg";
-      hash = "sha256-gMWPUPyHV0HvNkMuk10Kii7IrNMaA0etTPhcddDSDGE=";
+      hash = "sha256-06sXHnSG2x8+OSbgXcPsErgdmjypIlbylrb61Du6j7U=";
     };
 
     dontPatch = true;

pkgs/by-name/id/idris2/base.nix

@@ -0,0 +1,5 @@
+{ mkPrelude, prelude }:
+mkPrelude {
+  name = "base";
+  dependencies = [ prelude ];
+}

pkgs/by-name/id/idris2/contrib.nix

@@ -0,0 +1,12 @@
+{
+  mkPrelude,
+  prelude,
+  base,
+}:
+mkPrelude {
+  name = "contrib";
+  dependencies = [
+    prelude
+    base
+  ];
+}

pkgs/by-name/id/idris2/libidris2_support.nix

@@ -0,0 +1,33 @@
+{
+  stdenv,
+  lib,
+  gmp,
+  idris2-src,
+  idris2-version,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libidris2_support";
+  version = idris2-version;
+  src = idris2-src;
+
+  strictDeps = true;
+  buildInputs = [ gmp ];
+
+  enableParallelBuilding = true;
+  makeFlags = [
+    "PREFIX=${placeholder "out"}"
+  ]
+  ++ lib.optional stdenv.isDarwin "OS=";
+
+  buildFlags = [ "support" ];
+
+  installTargets = "install-support";
+
+  postInstall = ''
+    mv "$out/idris2-${finalAttrs.version}/lib" "$out/lib"
+    mv "$out/idris2-${finalAttrs.version}/support" "$out/share"
+    rm -rf $out/idris2-${finalAttrs.version}
+  '';
+
+  meta.description = "Runtime library for Idris2";
+})

pkgs/by-name/id/idris2/linear.nix

@@ -0,0 +1,12 @@
+{
+  mkPrelude,
+  prelude,
+  base,
+}:
+mkPrelude {
+  name = "linear";
+  dependencies = [
+    prelude
+    base
+  ];
+}

pkgs/by-name/id/idris2/mkPrelude.nix

@@ -0,0 +1,39 @@
+{
+  lib,
+  stdenvNoCC,
+  idris2-src,
+  idris2-version,
+  idris2-unwrapped,
+}:
+lib.extendMkDerivation {
+  constructDrv = stdenvNoCC.mkDerivation;
+
+  excludeDrvArgNames = [
+    "dependencies"
+  ];
+
+  extendDrvArgs =
+    finalAttrs:
+    {
+      name,
+      dependencies ? [ ],
+    }:
+    {
+      pname = name;
+      version = idris2-version;
+      src = idris2-src;
+      strictDeps = true;
+
+      makeFlags = "IDRIS2=${lib.getExe idris2-unwrapped}";
+
+      enableParallelBuilding = true;
+      preBuild = ''
+        cd libs/${name}
+      '';
+
+      env = {
+        IDRIS2_PREFIX = placeholder "out";
+        IDRIS2_PACKAGE_PATH = lib.makeSearchPath "idris2-${idris2-version}" dependencies;
+      };
+    };
+}

pkgs/by-name/id/idris2/network.nix

@@ -0,0 +1,14 @@
+{
+  mkPrelude,
+  prelude,
+  base,
+  linear,
+}:
+mkPrelude {
+  name = "network";
+  dependencies = [
+    prelude
+    base
+    linear
+  ];
+}

pkgs/by-name/id/idris2/package.nix

@@ -0,0 +1,35 @@
+{
+  lib,
+  newScope,
+  fetchFromGitHub,
+}:
+let
+  idris2CompilerPackages = lib.makeScope newScope (
+    self:
+    let
+      inherit (self) callPackage;
+    in
+    {
+      # Compiler version & repo
+      idris2-version = "0.7.0";
+      idris2-src = fetchFromGitHub {
+        owner = "idris-lang";
+        repo = "Idris2";
+        rev = "v${self.idris2-version}";
+        hash = "sha256-VwveX3fZfrxEsytpbOc5Tm6rySpLFhTt5132J6rmrmM=";
+      };
+      # Prelude libraries
+      mkPrelude = callPackage ./mkPrelude.nix { }; # Build helper
+      prelude = callPackage ./prelude.nix { };
+      base = callPackage ./base.nix { };
+      linear = callPackage ./linear.nix { };
+      network = callPackage ./network.nix { };
+      contrib = callPackage ./contrib.nix { };
+      test = callPackage ./test.nix { };
+
+      libidris2_support = callPackage ./libidris2_support.nix { };
+      idris2-unwrapped = callPackage ./unwrapped.nix { };
+    }
+  );
+in
+idris2CompilerPackages.idris2-unwrapped.withPackages (_: [ ])

pkgs/by-name/id/idris2/prelude.nix

@@ -0,0 +1,6 @@
+{
+  mkPrelude,
+}:
+mkPrelude {
+  name = "prelude";
+}

pkgs/by-name/id/idris2/test.nix

@@ -0,0 +1,14 @@
+{
+  mkPrelude,
+  prelude,
+  base,
+  contrib,
+}:
+mkPrelude {
+  name = "test";
+  dependencies = [
+    prelude
+    base
+    contrib
+  ];
+}

pkgs/by-name/id/idris2/tests.nix

@@ -2,9 +2,9 @@
   stdenv,
   runCommand,
   lib,
-  pname,
   idris2,
   idris2Packages,
+  chez,
   zsh,
   tree,
 }:
@@ -18,6 +18,7 @@ let
       packages ? [ ],
     }:
     let
+      inherit (idris2) pname;
       packageString = builtins.concatStringsSep " " (map (p: "--package " + p) packages);
     in
     runCommand "${pname}-${testName}"
@@ -28,7 +29,8 @@ let
         # is not the case with pure nix environments. Thus, we need to include zsh
         # when we build for darwin in tests. While this is impure, this is also what
         # we find in real darwin hosts.
-        nativeBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ zsh ];
+        strictDeps = true;
+        nativeBuildInputs = [ chez ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ zsh ];
       }
       ''
         set -eo pipefail
@@ -39,6 +41,7 @@ let
 
         ${idris2}/bin/idris2 ${packageString} -o packageTest packageTest.idr
 
+        patchShebangs --build ./build/exec/packageTest
         GOT=$(./build/exec/packageTest)
 
         if [ "$GOT" = "${want}" ]; then
@@ -61,12 +64,14 @@ let
       expectedTree,
     }:
     let
+      inherit (idris2) pname;
       idrisPkg = transformBuildIdrisOutput (idris2Packages.buildIdris buildIdrisArgs);
     in
     runCommand "${pname}-${testName}"
       {
         meta.timeout = 60;
 
+        strictDeps = true;
         nativeBuildInputs = [ tree ];
       }
       ''

pkgs/by-name/id/idris2/unwrapped.nix

@@ -0,0 +1,173 @@
+{
+  lib,
+  stdenv,
+  chez,
+  chez-racket,
+  clang,
+  gmp,
+  installShellFiles,
+  gambit,
+  nodejs,
+  zsh,
+  callPackage,
+  idris2Packages,
+  testers,
+  libidris2_support,
+  idris2-version,
+  idris2-src,
+}:
+let
+  inherit (stdenv.hostPlatform) extensions;
+
+  # Runtime library
+  libsupportLib = lib.makeLibraryPath [ libidris2_support ];
+  libsupportShare = lib.makeSearchPath "share" [ libidris2_support ];
+
+  platformChez =
+    if (stdenv.system == "x86_64-linux") || (lib.versionAtLeast chez.version "10.0.0") then
+      chez
+    else
+      chez-racket;
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "idris2";
+  version = idris2-version;
+  src = idris2-src;
+
+  postPatch = ''
+    shopt -s globstar
+
+    # Patch all occurences of the support lib with an absolute path so it
+    # works without wrapping.
+    substituteInPlace **/*.idr \
+      --replace-quiet "libidris2_support" "${libidris2_support}/lib/libidris2_support${extensions.sharedLibrary}"
+
+    # The remove changes libidris2_support.a to /nix/store/..../libidris2_support.so.a
+    # Fix that up so the reference-counted C backend works
+    substituteInPlace src/Compiler/RefC/CC.idr \
+      --replace-fail "libidris2_support${extensions.sharedLibrary}.a" "libidris2_support.a"
+
+    substituteInPlace bootstrap-stage2.sh \
+      --replace-fail "MAKE all" "MAKE idris2-exec"
+
+    patchShebangs --build tests
+  '';
+
+  strictDeps = true;
+  nativeBuildInputs = [
+    clang
+    platformChez
+    installShellFiles
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ zsh ];
+  buildInputs = [
+    platformChez
+    gmp
+    libidris2_support
+  ];
+
+  enableParallelBuilding = true;
+
+  makeFlags = [
+    "PREFIX=${placeholder "out"}"
+    "IDRIS2_SUPPORT_DIR=${libsupportLib}"
+  ]
+  ++ lib.optional stdenv.hostPlatform.isDarwin "OS=";
+
+  # The name of the main executable of pkgs.chez is `scheme`
+  buildFlags = [
+    "bootstrap"
+    "SCHEME=scheme"
+    "IDRIS2_LIBS=${libsupportLib}"
+    "IDRIS2_DATA=${libsupportShare}"
+  ];
+
+  doCheck = false;
+  checkTarget = "test";
+  nativeCheckInputs = [
+    gambit
+    nodejs
+  ];
+  checkFlags = [
+    "INTERACTIVE="
+    "IDRIS2_DATA=${libsupportShare}"
+    "IDRIS2_LIBS=${libsupportLib}"
+    "TEST_IDRIS2_DATA=${libsupportShare}"
+    "TEST_IDRIS2_LIBS=${libsupportLib}"
+    "TEST_IDRIS2_SUPPORT_DIR=${libsupportLib}"
+  ];
+
+  installTargets = "install-idris2";
+
+  postInstall = ''
+    # Remove existing idris2 wrapper that sets incorrect LD_LIBRARY_PATH
+    rm $out/bin/idris2
+
+    # The only thing we need from idris2_app is the actual binary, which is a Chez
+    # scheme object and for some reason *.so on darwin too
+    mv $out/bin/idris2_app/idris2.so $out/bin/idris2
+
+    rm -rf $out/bin/idris2_app
+  ''
+  + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd idris2 \
+      --bash <($out/bin/idris2 --bash-completion-script idris2)
+  '';
+
+  # Run package tests
+  passthru = {
+    inherit libidris2_support;
+    tests = {
+      wrapped = testers.testVersion {
+        package = finalAttrs.finalPackage.withPackages (p: [ p.idris2Api ]);
+      };
+
+      prelude = testers.runCommand {
+        name = "idris2-prelude-wrapped";
+        script = ''
+          local packages=$(idris2 --list-packages)
+
+          if ! [[ $packages =~ "contrib" ]]; then
+            exit 1
+          fi
+
+          touch "$out"
+        '';
+
+        nativeBuildInputs = [
+          (finalAttrs.finalPackage.withPackages (_: [ ]))
+        ];
+      };
+    }
+    // (callPackage ./tests.nix {
+      idris2 = finalAttrs.finalPackage.withPackages (_: [ ]);
+      idris2Packages = idris2Packages.override { idris2 = finalAttrs.finalPackage; };
+    });
+
+    chez = platformChez;
+
+    withPackages =
+      f:
+      callPackage ./wrapped.nix {
+        idris2-unwrapped = finalAttrs.finalPackage;
+        extraPackages = f idris2Packages;
+      };
+
+    updateScript = ./update.nu;
+  };
+
+  meta = {
+    description = "Purely functional programming language with first class types";
+    mainProgram = "idris2";
+    homepage = "https://github.com/idris-lang/Idris2";
+    changelog = "https://github.com/idris-lang/Idris2/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [
+      fabianhjr
+      wchresta
+      mattpolzin
+      RossSmyth
+    ];
+    platforms = lib.platforms.all;
+  };
+})

pkgs/by-name/id/idris2/update.nu

@@ -0,0 +1,28 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -I ./.
+#! nix-shell -i nu
+#! nix-shell -p nushell nix
+
+const PACKAGE = './pkgs/by-name/id/idris2/package.nix'
+
+def main [] {
+  let tag = http get "https://api.github.com/repos/idris-lang/Idris2/releases"
+    | sort-by -r created_at
+    | first
+    | get tag_name
+
+  print $"Newest version: ($tag)"
+
+  let hash = run-external "nix" "flake" "prefetch" "--json" $"github:idris-lang/Idris2/($tag)"
+    | from json
+    | get hash
+
+  let current_hash = nix eval -f ./. idris2.unwrapped.src.outputHash --json | from json
+  let current_version = nix eval -f ./. idris2.version --json | from json
+
+  $PACKAGE
+    | open
+    | str replace $current_version ($tag | str trim -c 'v')
+    | str replace $current_hash $hash
+    | save -f $PACKAGE
+}

pkgs/by-name/id/idris2/wrapped.nix

@@ -0,0 +1,66 @@
+{
+  lib,
+  makeBinaryWrapper,
+  symlinkJoin,
+  idris2-unwrapped,
+  prelude,
+  linear,
+  base,
+  network,
+  contrib,
+  test,
+  extraPackages ? [ ],
+}:
+let
+  preludeLibs = [
+    prelude
+    linear
+    base
+    network
+    contrib
+    test
+  ];
+  supportLibrariesPath = lib.makeLibraryPath [ idris2-unwrapped.libidris2_support ];
+  supportSharePath = lib.makeSearchPath "share" [ idris2-unwrapped.libidris2_support ];
+  packagePath = lib.makeSearchPath "idris2-${idris2-unwrapped.version}" (
+    preludeLibs ++ extraPackages
+  );
+in
+symlinkJoin {
+  inherit (idris2-unwrapped) version;
+  pname = "idris2-wrapped";
+
+  paths = [ idris2-unwrapped ];
+
+  nativeBuildInputs = [ makeBinaryWrapper ];
+
+  postBuild = ''
+    wrapProgram "$out/bin/idris2" \
+      --set CHEZ "${lib.getExe idris2-unwrapped.chez}" \
+      --suffix IDRIS2_LIBS ':' "${supportLibrariesPath}" \
+      --suffix IDRIS2_DATA ':' "${supportSharePath}" \
+      --suffix IDRIS2_PACKAGE_PATH ':' ${packagePath} \
+      --suffix LD_LIBRARY_PATH ':' "${supportLibrariesPath}" \
+      --suffix DYLD_LIBRARY_PATH ':' "${supportLibrariesPath}"
+  '';
+
+  passthru = {
+    prelude = preludeLibs;
+    unwrapped = idris2-unwrapped;
+    src = idris2-unwrapped.src;
+  }
+  // idris2-unwrapped.passthru;
+
+  meta = {
+    # Manually inherit so that pos works
+    inherit (idris2-unwrapped.meta)
+      description
+      mainProgram
+      homepage
+      changelog
+      license
+      maintainers
+      platforms
+      ;
+  };
+}

pkgs/by-name/im/imagelol/package.nix

@@ -37,6 +37,12 @@ stdenv.mkDerivation rec {
     mv imagelol src
     substituteInPlace CMakeLists.txt \
       --replace 'add_subdirectory("imagelol")' 'add_subdirectory("src")'
+
+    substituteInPlace External/zlib-no-examples/CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.4.4)" "cmake_minimum_required(VERSION 3.10)"
+    substituteInPlace External/libpng/CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 3.1)" "cmake_minimum_required(VERSION 3.10)" \
+      --replace-fail "cmake_policy(VERSION 3.1)" "cmake_policy(VERSION 3.10)"
   '';
 
   nativeBuildInputs = [ cmake ];
@@ -59,6 +65,7 @@ stdenv.mkDerivation rec {
     license = licenses.mit;
     maintainers = [ ];
     platforms = platforms.unix;
+    broken = stdenv.hostPlatform.isDarwin;
     mainProgram = "ImageLOL";
   };
 }

pkgs/by-name/li/libretro-shaders-slang/package.nix

@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "libretro-shaders-slang";
-  version = "0-unstable-2025-10-15";
+  version = "0-unstable-2025-10-20";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "slang-shaders";
-    rev = "c94b1bdfd8c973893ac3fe883ae05c420aba2908";
+    rev = "422e59878b7e0b4d5d677e6163cc560767398d20";
-    hash = "sha256-aZ6Xf7suIlUj3NcGtRfoYTKMnenCupS7dLoENGePr/E=";
+    hash = "sha256-PdurVN86deGS1pNvFY1IZblBklc/CEFrB7jKbB8JrG4=";
   };
 
   dontConfigure = true;

pkgs/by-name/li/libuinputplus/package.nix

@@ -25,6 +25,11 @@ stdenv.mkDerivation rec {
     pkg-config
   ];
 
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 3.0)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
   meta = with lib; {
     inherit (src.meta) homepage;
     description = "Easy-to-use uinput library in C++";

pkgs/by-name/ls/lsp-plugins/package.nix

@@ -11,12 +11,12 @@
   libXrandr,
   libsndfile,
   lv2,
-  php82,
+  php84,
   pkg-config,
 }:
 
 let
-  php = php82;
+  php = php84;
 in
 
 stdenv.mkDerivation (finalAttrs: {

pkgs/by-name/mo/moar/package.nix

@@ -1,41 +0,0 @@
-{
-  lib,
-  buildGoModule,
-  fetchFromGitHub,
-  installShellFiles,
-}:
-
-buildGoModule rec {
-  pname = "moar";
-  version = "1.33.0";
-
-  src = fetchFromGitHub {
-    owner = "walles";
-    repo = "moar";
-    rev = "v${version}";
-    hash = "sha256-+06cup9iG+iMyluQPzUQ7vrnFHoeU4KNHGra3AsRRw0=";
-  };
-
-  vendorHash = "sha256-ComKeqnw1PvDaCRVXfInRjSzhyZWGkD/hp5piwhwxds=";
-
-  nativeBuildInputs = [ installShellFiles ];
-
-  postInstall = ''
-    installManPage ./moar.1
-  '';
-
-  ldflags = [
-    "-s"
-    "-w"
-    "-X"
-    "main.versionString=v${version}"
-  ];
-
-  meta = with lib; {
-    description = "Nice-to-use pager for humans";
-    homepage = "https://github.com/walles/moar";
-    license = licenses.bsd2WithViews;
-    mainProgram = "moar";
-    maintainers = with maintainers; [ foo-dogsquared ];
-  };
-}

pkgs/by-name/mo/moor/package.nix

@@ -0,0 +1,56 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  installShellFiles,
+  nix-update-script,
+  pkgsCross,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "moor";
+  version = "2.6.1";
+
+  src = fetchFromGitHub {
+    owner = "walles";
+    repo = "moor";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-5MiTxspdNTFfLnif5C3gcQ0suxRrjerlZl2+kPAjiBM=";
+  };
+
+  vendorHash = "sha256-ve8QT2dIUZGTFYESt9vIllGTan22ciZr8SQzfqtqQfw=";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X"
+    "main.versionString=v${finalAttrs.version}"
+  ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  postInstall = ''
+    installManPage ./moor.1
+  '';
+
+  passthru = {
+    tests.cross-aarch64 = pkgsCross.aarch64-multiplatform.moor;
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Nice-to-use pager for humans";
+    homepage = "https://github.com/walles/moor";
+    changelog = "https://github.com/walles/moor/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.bsd2WithViews;
+    mainProgram = "moor";
+    maintainers = with lib.maintainers; [
+      foo-dogsquared
+      getchoo
+    ];
+  };
+})

pkgs/by-name/mp/mpv-handler/package.nix

@@ -9,16 +9,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "mpv-handler";
-  version = "0.4.1";
+  version = "0.4.2";
 
   src = fetchFromGitHub {
     owner = "akiirui";
     repo = "mpv-handler";
     tag = "v${version}";
-    hash = "sha256-uWV9pjZp5s8H1UDS/T0JK//eJNnsaaby88l/tDqlQHY=";
+    hash = "sha256-QoctjneJA7CdXqGm0ylAh9w6611vv2PD1fzS0exag5A=";
   };
 
-  cargoHash = "sha256-Cps+cPOv8uV8x0MiBdSqsdJ/8n259K6Y5aVl2aWJ/tE=";
+  cargoHash = "sha256-gKDkDLTLzC53obDd7pORsqP6DhORTbx6tvQ4jq61znQ=";
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/ni/ni/package.nix

@@ -13,19 +13,19 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "ni";
-  version = "26.1.0";
+  version = "27.0.0";
 
   src = fetchFromGitHub {
     owner = "antfu-collective";
     repo = "ni";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vde0NUOWVfdrJUgYBLP4C3I+lFv3YJVtcqUgB7Nx2b0=";
+    hash = "sha256-Yh159OpM4LPWJMO2Jv8xkzqRFurgK8EAQDyUIhWfHZ4=";
   };
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     fetcherVersion = 2;
-    hash = "sha256-aNRWBnlZ72OmU619L99aVqL317w4gSaJNtoO25u+s40=";
+    hash = "sha256-pg2zFm84sqTRM/KaNxnvtZMZHhgdrThPoMV58KKbvHA=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/qd/qdmr/package.nix

@@ -6,8 +6,9 @@
   cmake,
   libxslt,
   docbook_xsl_ns,
-  libsForQt5,
+  kdePackages,
   libusb1,
+  librsvg,
   yaml-cpp,
 }:
 
@@ -17,28 +18,30 @@ in
 
 stdenv.mkDerivation rec {
   pname = "qdmr";
-  version = "0.12.3";
+  version = "0.13.1";
 
   src = fetchFromGitHub {
     owner = "hmatuschek";
     repo = "qdmr";
     rev = "v${version}";
-    hash = "sha256-rb59zbYpIziqXWTjTApWXnkcpRiAUIqPiInEJdsYd48=";
+    hash = "sha256-Vz7di9VwrvtSCea3pipSCEw9pHfRv9lJn9jKzboyh6E=";
   };
 
   nativeBuildInputs = [
     cmake
-    libxslt
+    kdePackages.wrapQtAppsHook
-    libsForQt5.wrapQtAppsHook
     installShellFiles
   ];
 
   buildInputs = [
+    librsvg
     libusb1
-    libsForQt5.qtlocation
+    libxslt
-    libsForQt5.qtserialport
+    kdePackages.qtlocation
-    libsForQt5.qttools
+    kdePackages.qtserialport
-    libsForQt5.qtbase
+    kdePackages.qttools
+    kdePackages.qtbase
+    kdePackages.qtpositioning
     yaml-cpp
   ];
 
@@ -59,6 +62,7 @@ stdenv.mkDerivation rec {
   cmakeFlags = [
     "-DBUILD_MAN=ON"
     "-DCMAKE_INSTALL_FULL_MANDIR=share/man"
+    "-DDOCBOOK2MAN_XSLT=docbook_man.${if isLinux then "debian" else "macports"}.xsl"
     "-DINSTALL_UDEV_RULES=OFF"
   ];
 

pkgs/by-name/ru/rustical/package.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rustical";
-  version = "0.9.11";
+  version = "0.9.12";
 
   src = fetchFromGitHub {
     owner = "lennart-k";
     repo = "rustical";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-XDnhHgswje335c3OHR/cUO9qtOj1MQBYvAsoH5coiDY=";
+    hash = "sha256-pmIWLhrf7AsFr+xvYeibAutIigLeQNQepssLpHxjZyQ=";
   };
 
-  cargoHash = "sha256-MevmHEdkczL4CcQpjdvv21rvnCmbnSr37Ny6G0kodag=";
+  cargoHash = "sha256-vU/iXRas6PYUASPTVDkzmZCyOHnH07S4YpvIyg1zybk=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl ];

pkgs/by-name/se/seagoat/failing_tests.nix

@@ -51,4 +51,14 @@
   "test_file_change_many_times_is_first_result"
   "test_newer_change_can_beat_frequent_change_in_past"
   "test_commit_messages_with_three_or_more_colons"
+
+  # Compatibility issue with click 8.2
+  # https://github.com/kantord/SeaGOAT/issues/1021
+  "test_seagoat_warns_on_incomplete_accuracy[99]"
+  "test_seagoat_warns_on_incomplete_accuracy[100]"
+  "test_server_error_handling[File Not Found on Server-500]"
+  "test_server_error_handling[Database Connection Failed-503]"
+  "test_server_does_not_exist_error"
+  "test_no_network_to_update"
+  "test_server_shows_error_when_folder_is_not_a_git_repo"
 ]

pkgs/by-name/sl/slade/package.nix

@@ -11,23 +11,23 @@
   sfml_2,
   fluidsynth,
   curl,
-  freeimage,
   ftgl,
   glew,
   lua,
   mpg123,
   wrapGAppsHook3,
+  libwebp,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "slade";
-  version = "3.2.7";
+  version = "3.2.8";
 
   src = fetchFromGitHub {
     owner = "sirjuddington";
     repo = "SLADE";
     tag = finalAttrs.version;
-    hash = "sha256-+i506uzO2q/9k7en6CKs4ui9gjszrMOYwW+V9W5Lvns=";
+    hash = "sha256-skJpcxLSInAzBHGtxdTWAqocXQKKQY7vJfUx8ZAlMqc=";
   };
 
   nativeBuildInputs = [
@@ -44,11 +44,11 @@ stdenv.mkDerivation (finalAttrs: {
     sfml_2
     fluidsynth
     curl
-    freeimage
     ftgl
     glew
     lua
     mpg123
+    libwebp
   ];
 
   cmakeFlags = [

pkgs/by-name/sp/spek/package.nix

@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Analyse your audio files by showing their spectrogram";
-    homepage = "http://spek.cc/";
+    homepage = "https://www.spek.cc/";
     license = lib.licenses.gpl3;
     maintainers = with lib.maintainers; [ bjornfor ];
     platforms = lib.platforms.all;

pkgs/by-name/sy/sydbox/package.nix

@@ -12,7 +12,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "sydbox";
-  version = "3.40.1";
+  version = "3.41.0";
 
   outputs = [
     "out"
@@ -24,10 +24,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "Sydbox";
     repo = "sydbox";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hO17Rm4gOSCVlmVZTZdJ2qh9pzdrl8Ay9uU6w7V4RPo=";
+    hash = "sha256-Qb7BYBMHKb+hCLNADOgBL8r/YeTiw9Rmy0pTV/jk93o=";
   };
 
-  cargoHash = "sha256-y6FvIH3+daDsYP18BpsoYKsshvpVcSU7s/tjPdnudtY=";
+  cargoHash = "sha256-dx/AP5CiKz6asfYPEmjo+7ZELMyyxaEHZ5virL68IB4=";
 
   nativeBuildInputs = [
     mandoc

pkgs/by-name/tm/tmuxai/package.nix

@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "tmuxai";
-  version = "1.1.3";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "alvinunreal";
     repo = "tmuxai";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-SOqfEaCtJ8xlv0RA83tevbXjxwyGILSWlxNCVrKeLak=";
+    hash = "sha256-5XcqovO1HKNAlZ7H26jWHSLt3bbxzhLJIL9sLDMdHR4=";
   };
 
-  vendorHash = "sha256-6X79tFZCiuVq3ZgHC/EhwF9Nlge/8UoubRG1O9DGwxc=";
+  vendorHash = "sha256-cw/tW7i+CDN7AYLcU7bC1VNeD1aFRvngvtwmgBqKvoc=";
 
   ldflags = [
     "-s"

pkgs/by-name/xe/xen/package.nix

@@ -215,6 +215,16 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://xenbits.xen.org/xsa/xsa473-2.patch";
       hash = "sha256-tGuIGxJFBXbckIruSUeTyrM6GabdIj6Pr3cVxeDvNNY=";
     })
+
+    # XSA 475
+    (fetchpatch {
+      url = "https://xenbits.xen.org/xsa/xsa475-1.patch";
+      hash = "sha256-Bzvtr12g+7+M9jY9Nt2jd41CwYTL+h2fuwzJFsxroio=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xen.org/xsa/xsa475-2.patch";
+      hash = "sha256-7MKtDAJpihpfcBK+hyBFGCP6gHWs2cdgTks8B439b2s=";
+    })
   ];
 
   outputs = [

pkgs/development/compilers/idris2/build-idris.nix

@@ -49,8 +49,8 @@ let
   idrName = "idris2-${idris2.version}";
   libSuffix = "lib/${idrName}";
   libDirs = libs: (lib.makeSearchPath libSuffix libs) + ":${idris2}/${idrName}";
-  supportDir = "${idris2}/${idrName}/lib";
+  supportDir = "${idris2.libidris2_support}/lib";
-  drvAttrs = removeAttrs attrs [
+  drvAttrs = builtins.removeAttrs attrs [
     "ipkgName"
     "idrisLibraries"
   ];

pkgs/development/compilers/idris2/default.nix

@@ -1,6 +1,6 @@
-{ callPackage }:
+{ callPackage, idris2 }:
 {
-  idris2 = callPackage ./idris2.nix { };
+  inherit idris2;
   idris2Api = callPackage ./idris2-api.nix { };
   idris2Lsp = callPackage ./idris2-lsp.nix { };
 

pkgs/development/compilers/idris2/idris2-api.nix

@@ -2,7 +2,7 @@
 let
   inherit (idris2Packages) idris2 buildIdris;
   apiPkg = buildIdris {
-    inherit (idris2) src version;
+    inherit (idris2.unwrapped) src version;
     ipkgName = "idris2api";
     idrisLibraries = [ ];
     preBuild = ''

pkgs/development/compilers/idris2/idris2-lsp.nix

@@ -6,17 +6,18 @@
 }:
 
 let
-  globalLibraries =
+  globalLibrariesPath =
     let
       idrName = "idris2-${idris2Packages.idris2.version}";
-      libSuffix = "lib/${idrName}";
     in
-    [
+    lib.makeSearchPath idrName (
-      "\\$HOME/.nix-profile/lib/${idrName}"
+      [
-      "/run/current-system/sw/lib/${idrName}"
+        "\\$HOME/.nix-profile/lib/"
-      "${idris2Packages.idris2}/${idrName}"
+        "/run/current-system/sw/lib/"
-    ];
+        "${idris2Packages.idris2}"
-  globalLibrariesPath = builtins.concatStringsSep ":" globalLibraries;
+      ]
+      ++ idris2Packages.idris2.prelude
+    );
 
   inherit (idris2Packages) idris2Api;
   lspLib = idris2Packages.buildIdris {

pkgs/development/compilers/idris2/idris2.nix

@@ -1,119 +0,0 @@
-# Almost 1:1 copy of idris2's nix/package.nix. Some work done in their flake.nix
-# we do here instead.
-{
-  stdenv,
-  lib,
-  chez,
-  chez-racket,
-  clang,
-  gmp,
-  fetchFromGitHub,
-  makeWrapper,
-  gambit,
-  nodejs,
-  zsh,
-  callPackage,
-}:
-
-# NOTICE: An `idris2WithPackages` is available at: https://github.com/claymager/idris2-pkgs
-
-let
-  platformChez =
-    if (stdenv.system == "x86_64-linux") || (lib.versionAtLeast chez.version "10.0.0") then
-      chez
-    else
-      chez-racket;
-in
-stdenv.mkDerivation rec {
-  pname = "idris2";
-  version = "0.7.0";
-
-  src = fetchFromGitHub {
-    owner = "idris-lang";
-    repo = "Idris2";
-    rev = "v${version}";
-    sha256 = "sha256-VwveX3fZfrxEsytpbOc5Tm6rySpLFhTt5132J6rmrmM=";
-  };
-
-  strictDeps = true;
-  nativeBuildInputs = [
-    makeWrapper
-    clang
-    platformChez
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [ zsh ];
-  buildInputs = [
-    platformChez
-    gmp
-  ];
-
-  prePatch = ''
-    patchShebangs --build tests
-  '';
-
-  makeFlags = [ "PREFIX=$(out)" ] ++ lib.optional stdenv.hostPlatform.isDarwin "OS=";
-
-  # The name of the main executable of pkgs.chez is `scheme`
-  buildFlags = [
-    "bootstrap"
-    "SCHEME=scheme"
-  ];
-
-  checkTarget = "test";
-  nativeCheckInputs = [
-    gambit
-    nodejs
-  ]; # racket ];
-  checkFlags = [ "INTERACTIVE=" ];
-
-  # TODO: Move this into its own derivation, such that this can be changed
-  #       without having to recompile idris2 every time.
-  postInstall =
-    let
-      name = "${pname}-${version}";
-      globalLibraries = [
-        "\\$HOME/.nix-profile/lib/${name}"
-        "/run/current-system/sw/lib/${name}"
-        "$out/${name}"
-      ];
-      globalLibrariesPath = builtins.concatStringsSep ":" globalLibraries;
-    in
-    ''
-      # Remove existing idris2 wrapper that sets incorrect LD_LIBRARY_PATH
-      rm $out/bin/idris2
-      # The only thing we need from idris2_app is the actual binary
-      mv $out/bin/idris2_app/idris2.so $out/bin/idris2
-      rm $out/bin/idris2_app/*
-      rmdir $out/bin/idris2_app
-      # idris2 needs to find scheme at runtime to compile
-      # idris2 installs packages with --install into the path given by
-      #   IDRIS2_PREFIX. We set that to a default of ~/.idris2, to mirror the
-      #   behaviour of the standard Makefile install.
-      # TODO: Make support libraries their own derivation such that
-      #       overriding LD_LIBRARY_PATH is unnecessary
-      wrapProgram "$out/bin/idris2" \
-        --set-default CHEZ "${platformChez}/bin/scheme" \
-        --run 'export IDRIS2_PREFIX=''${IDRIS2_PREFIX-"$HOME/.idris2"}' \
-        --suffix IDRIS2_LIBS ':' "$out/${name}/lib" \
-        --suffix IDRIS2_DATA ':' "$out/${name}/support" \
-        --suffix IDRIS2_PACKAGE_PATH ':' "${globalLibrariesPath}" \
-        --suffix DYLD_LIBRARY_PATH ':' "$out/${name}/lib" \
-        --suffix LD_LIBRARY_PATH ':' "$out/${name}/lib"
-    '';
-
-  # Run package tests
-  passthru.tests = callPackage ./tests.nix { inherit pname; };
-
-  meta = {
-    description = "Purely functional programming language with first class types";
-    mainProgram = "idris2";
-    homepage = "https://github.com/idris-lang/Idris2";
-    license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [
-      fabianhjr
-      wchresta
-      mattpolzin
-    ];
-    inherit (chez.meta) platforms;
-  };
-}

pkgs/development/python-modules/aiolifx/default.nix

@@ -4,10 +4,9 @@
   bitstring,
   buildPythonPackage,
   click,
-  fetchPypi,
+  fetchFromGitHub,
   ifaddr,
   inquirerpy,
-  pythonOlder,
   setuptools,
 }:
 
@@ -16,15 +15,17 @@ buildPythonPackage rec {
   version = "1.2.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  src = fetchFromGitHub {
-
+    owner = "aiolifx";
-  src = fetchPypi {
+    repo = "aiolifx";
-    inherit pname version;
+    tag = version;
-    hash = "sha256-h82KPrHcWUUrQFyMy3fY6BmQFA5a4DFJdhJ6zRnKMsc=";
+    hash = "sha256-9FTsY/VFfzLlDEjF8ueBQxr30YasdQwei1/KfHiXwMo=";
   };
 
   build-system = [ setuptools ];
 
+  pythonRelaxDeps = [ "click" ];
+
   dependencies = [
     async-timeout
     bitstring
@@ -38,12 +39,12 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "aiolifx" ];
 
-  meta = with lib; {
+  meta = {
     description = "Module for local communication with LIFX devices over a LAN";
     homepage = "https://github.com/aiolifx/aiolifx";
     changelog = "https://github.com/aiolifx/aiolifx/releases/tag/${version}";
-    license = licenses.mit;
+    license = lib.licenses.mit;
-    maintainers = with maintainers; [ netixx ];
+    maintainers = with lib.maintainers; [ netixx ];
     mainProgram = "aiolifx";
   };
 }

pkgs/development/python-modules/chromadb/default.nix

@@ -92,6 +92,11 @@ buildPythonPackage rec {
     # Nixpkgs is taking the version from `chromadb_rust_bindings` which is versioned independently
     substituteInPlace pyproject.toml \
       --replace-fail "dynamic = [\"version\"]" "version = \"${version}\""
+
+    # Flip anonymized telemetry to opt in versus current opt-in out for privacy
+    substituteInPlace chromadb/config.py \
+      --replace-fail "anonymized_telemetry: bool = True" \
+                     "anonymized_telemetry: bool = False"
   '';
 
   pythonRelaxDeps = [

pkgs/development/python-modules/elevenlabs/default.nix

@@ -13,7 +13,7 @@
 }:
 
 let
-  version = "2.18.0";
+  version = "2.20.0";
   tag = "v${version}";
 in
 buildPythonPackage {
@@ -25,7 +25,7 @@ buildPythonPackage {
     owner = "elevenlabs";
     repo = "elevenlabs-python";
     inherit tag;
-    hash = "sha256-FSUKKYG9cMuh4AcU6nYBtzjt+znfel3SHLRDDWPNCv8=";
+    hash = "sha256-oxhXvPUOplftB3b7oXmfLSRdPVVjzuOeVPp19OEHVCk=";
   };
 
   build-system = [ poetry-core ];

pkgs/development/python-modules/python-jose/default.nix

@@ -4,6 +4,7 @@
   cryptography,
   ecdsa,
   fetchFromGitHub,
+  fetchpatch,
   pyasn1,
   pycrypto,
   pycryptodome,
@@ -24,6 +25,15 @@ buildPythonPackage rec {
     hash = "sha256-8DQ0RBQ4ZgEIwcosgX3dzr928cYIQoH0obIOgk0+Ozs=";
   };
 
+  patches = [
+    # https://github.com/mpdavis/python-jose/pull/393
+    (fetchpatch {
+      name = "fix-test_incorrect_public_key_hmac_signing.patch";
+      url = "https://github.com/mpdavis/python-jose/commit/7c0e4c6640bdc9cd60ac66d96d5d90f4377873db.patch";
+      hash = "sha256-bCzxZEWKYD20TLqzVv6neZlpU41otbVqaXc7C0Ky9BQ=";
+    })
+  ];
+
   pythonRelaxDeps = [
     # https://github.com/mpdavis/python-jose/pull/376
     "pyasn1"

pkgs/development/python-modules/rdflib/default.nix

@@ -27,7 +27,7 @@
 
 buildPythonPackage rec {
   pname = "rdflib";
-  version = "7.1.4";
+  version = "7.2.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -36,7 +36,7 @@ buildPythonPackage rec {
     owner = "RDFLib";
     repo = "rdflib";
     tag = version;
-    hash = "sha256-u9hdwxAJIuTQ3zKstbwn88u1opzWXc8otJKbtIl4Li4=";
+    hash = "sha256-FisMiBTiL6emJS0d7UmlwGUzayA+CME5GGWgw/owfhc=";
   };
 
   build-system = [ poetry-core ];
@@ -66,6 +66,8 @@ buildPythonPackage rec {
     # requires network access
     "rdflib/__init__.py::rdflib"
     "test/jsonld/test_onedotone.py::test_suite"
+    # https://github.com/RDFLib/rdflib/issues/3274
+    "test/test_sparql/test_translate_algebra.py::test_roundtrip"
   ];
 
   disabledTests = [

pkgs/os-specific/darwin/impure-cmds/default.nix

@@ -1,38 +0,0 @@
-{ lib, runCommandLocal }:
-
-# On darwin, there are some commands neither opensource nor able to build in nixpkgs.
-# We have no choice but to use those system-shipped impure ones.
-
-let
-  commands = {
-    ditto = "/usr/bin/ditto"; # ditto is not opensource
-    sudo = "/usr/bin/sudo"; # sudo must be owned by uid 0 and have the setuid bit set
-  };
-
-  mkImpureDrv =
-    name: path:
-    runCommandLocal "${name}-impure-darwin"
-      {
-        __impureHostDeps = [ path ];
-
-        meta = {
-          platforms = lib.platforms.darwin;
-        };
-      }
-      ''
-        if ! [ -x ${path} ]; then
-          echo Cannot find command ${path}
-          exit 1
-        fi
-
-        mkdir -p $out/bin
-        ln -s ${path} $out/bin
-
-        manpage="/usr/share/man/man1/${name}.1"
-        if [ -f $manpage ]; then
-          mkdir -p $out/share/man/man1
-          ln -s $manpage $out/share/man/man1
-        fi
-      '';
-in
-lib.mapAttrs mkImpureDrv commands

pkgs/servers/sql/percona-server/8_0.nix

@@ -43,11 +43,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "percona-server";
-  version = "8.0.42-33";
+  version = "8.0.43-34";
 
   src = fetchurl {
-    url = "https://www.percona.com/downloads/Percona-Server-8.0/Percona-Server-${finalAttrs.version}/source/tarball/percona-server-${finalAttrs.version}.tar.gz";
+    url = "https://downloads.percona.com/downloads/Percona-Server-8.0/Percona-Server-${finalAttrs.version}/source/tarball/percona-server-${finalAttrs.version}.tar.gz";
-    hash = "sha256-UDdmBz1RVjX/kRivvk69GPdtjLjWTglKxteiLxXKQGc=";
+    hash = "sha256-RGm144c1WfNm62MsfCMeAapwDBucE8zoaQhdvh7JID4=";
   };
 
   nativeBuildInputs = [
@@ -63,8 +63,6 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [ rpcsvc-proto ];
 
   patches = [
-    # adapted from mysql80's llvm 19 fixes
-    ./libcpp-fixes.patch
     # fixes using -DWITH_SSL=system with CMAKE_PREFIX_PATH on darwin
     # https://github.com/Homebrew/homebrew-core/pull/204799
     (fetchpatch {

pkgs/servers/sql/percona-server/libcpp-fixes.patch

@@ -1,207 +0,0 @@
-diff --git a/include/my_char_traits.h b/include/my_char_traits.h
-new file mode 100644
-index 00000000000..6336bc039c8
---- /dev/null
-+++ b/include/my_char_traits.h
-@@ -0,0 +1,65 @@
-+/* Copyright (c) 2024, Oracle and/or its affiliates.
-+
-+   This program is free software; you can redistribute it and/or modify
-+   it under the terms of the GNU General Public License, version 2.0,
-+   as published by the Free Software Foundation.
-+
-+   This program is designed to work with certain software (including
-+   but not limited to OpenSSL) that is licensed under separate terms,
-+   as designated in a particular file or component or in included license
-+   documentation.  The authors of MySQL hereby grant you an additional
-+   permission to link the program and your derivative works with the
-+   separately licensed software that they have either included with
-+   the program or referenced in the documentation.
-+
-+   This program is distributed in the hope that it will be useful,
-+   but WITHOUT ANY WARRANTY; without even the implied warranty of
-+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+   GNU General Public License, version 2.0, for more details.
-+
-+   You should have received a copy of the GNU General Public License
-+   along with this program; if not, write to the Free Software
-+   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301  USA */
-+
-+#ifndef MY_CHAR_TRAITS_INCLUDED
-+#define MY_CHAR_TRAITS_INCLUDED
-+
-+#include <cstring>
-+
-+template <class CharT>
-+struct my_char_traits;
-+
-+/*
-+  This is a standards-compliant, drop-in replacement for
-+    std::char_traits<unsigned char>
-+  We need this because clang libc++ is removing support for it in clang 19.
-+  It is not a complete implementation. Rather we implement just enough to
-+  compile any usage of char_traits<uchar> we have in our codebase.
-+ */
-+template <>
-+struct my_char_traits<unsigned char> {
-+  using char_type = unsigned char;
-+  using int_type = unsigned int;
-+
-+  static void assign(char_type &c1, const char_type &c2) { c1 = c2; }
-+
-+  static char_type *assign(char_type *s, std::size_t n, char_type a) {
-+    return static_cast<char_type *>(memset(s, a, n));
-+  }
-+
-+  static int compare(const char_type *s1, const char_type *s2, std::size_t n) {
-+    return memcmp(s1, s2, n);
-+  }
-+
-+  static char_type *move(char_type *s1, const char_type *s2, std::size_t n) {
-+    if (n == 0) return s1;
-+    return static_cast<char_type *>(memmove(s1, s2, n));
-+  }
-+
-+  static char_type *copy(char_type *s1, const char_type *s2, std::size_t n) {
-+    if (n == 0) return s1;
-+    return static_cast<char_type *>(memcpy(s1, s2, n));
-+  }
-+};
-+
-+#endif  // MY_CHAR_TRAITS_INCLUDED
-diff --git a/sql/mdl_context_backup.h b/sql/mdl_context_backup.h
-index 89e7e23df34..cf9c307ec2d 100644
---- a/sql/mdl_context_backup.h
-+++ b/sql/mdl_context_backup.h
-@@ -28,6 +28,7 @@
- #include <map>
- #include <memory>
- 
-+#include "my_char_traits.h"
- #include "sql/malloc_allocator.h"
- #include "sql/mdl.h"
- 
-@@ -47,7 +48,8 @@ class MDL_context_backup_manager {
-   /**
-     Key for uniquely identifying MDL_context in the MDL_context_backup map.
-   */
--  typedef std::basic_string<uchar> MDL_context_backup_key;
-+  using MDL_context_backup_key =
-+      std::basic_string<uchar, my_char_traits<uchar>>;
- 
-   class MDL_context_backup;
- 
-diff --git a/sql/range_optimizer/index_range_scan_plan.cc b/sql/range_optimizer/index_range_scan_plan.cc
-index 74fbb100397..8ed1f50da33 100644
---- a/sql/range_optimizer/index_range_scan_plan.cc
-+++ b/sql/range_optimizer/index_range_scan_plan.cc
-@@ -54,6 +54,8 @@
- #include "sql/thr_malloc.h"
- #include "sql_string.h"
- 
-+#include "my_char_traits.h"
-+
- using opt_range::null_element;
- using std::max;
- using std::min;
-@@ -1025,8 +1027,8 @@ static bool null_part_in_key(KEY_PART *key_part, const uchar *key,
- 
- // TODO(sgunders): This becomes a bit simpler with C++20's string_view
- // constructors.
--static inline std::basic_string_view<uchar> make_string_view(const uchar *start,
--                                                             const uchar *end) {
-+static inline std::basic_string_view<uchar, my_char_traits<uchar>>
-+make_string_view(const uchar *start, const uchar *end) {
-   return {start, static_cast<size_t>(end - start)};
- }
- 
-diff --git a/sql/stream_cipher.h b/sql/stream_cipher.h
-index 606d40645c6..358fbb41959 100644
---- a/sql/stream_cipher.h
-+++ b/sql/stream_cipher.h
-@@ -28,6 +28,8 @@
- #include <memory>
- #include <string>
- 
-+#include "my_char_traits.h"
-+
- /**
-   @file stream_cipher.h
- 
-@@ -35,7 +37,8 @@
-          binary log files.
- */
- 
--typedef std::basic_string<unsigned char> Key_string;
-+using Key_string =
-+    std::basic_string<unsigned char, my_char_traits<unsigned char>>;
- 
- /**
-   @class Stream_cipher
-diff --git a/unittest/gunit/binlogevents/transaction_compression-t.cc b/unittest/gunit/binlogevents/transaction_compression-t.cc
-index ba13f979aa3..01af0e3a360 100644
---- a/unittest/gunit/binlogevents/transaction_compression-t.cc
-+++ b/unittest/gunit/binlogevents/transaction_compression-t.cc
-@@ -23,6 +23,7 @@
- */
- 
- #include <array>
-+#include <string>
- 
- #include <gtest/gtest.h>
- #include "libbinlogevents/include/binary_log.h"
-@@ -51,14 +52,13 @@ class TransactionPayloadCompressionTest : public ::testing::Test {
-   using Managed_buffer_t = Decompressor_t::Managed_buffer_t;
-   using Size_t = Decompressor_t::Size_t;
-   using Char_t = Decompressor_t::Char_t;
--  using String_t = std::basic_string<Char_t>;
-   using Decompress_status_t =
-       binary_log::transaction::compression::Decompress_status;
-   using Compress_status_t =
-       binary_log::transaction::compression::Compress_status;
- 
--  static String_t constant_data(Size_t size) {
--    return String_t(size, (Char_t)'a');
-+  static std::string constant_data(Size_t size) {
-+    return std::string(size, (Char_t)'a');
-   }
- 
-  protected:
-@@ -69,7 +69,7 @@ class TransactionPayloadCompressionTest : public ::testing::Test {
-   void TearDown() override {}
- 
-   static void compression_idempotency_test(Compressor_t &c, Decompressor_t &d,
--                                           String_t data) {
-+                                           const std::string &data) {
-     auto debug_string = concat(
-         binary_log::transaction::compression::type_to_string(c.get_type_code()),
-         " ", data.size());
-@@ -104,8 +104,8 @@ class TransactionPayloadCompressionTest : public ::testing::Test {
- 
-     // Check decompressed data
-     ASSERT_EQ(managed_buffer.read_part().size(), data.size()) << debug_string;
--    ASSERT_EQ(data, String_t(managed_buffer.read_part().begin(),
--                             managed_buffer.read_part().end()))
-+    ASSERT_EQ(data, std::string(managed_buffer.read_part().begin(),
-+                                managed_buffer.read_part().end()))
-         << debug_string;
- 
-     // Check that we reached EOF
-@@ -118,7 +118,7 @@ TEST_F(TransactionPayloadCompressionTest, CompressDecompressZstdTest) {
-   for (auto size : buffer_sizes) {
-     binary_log::transaction::compression::Zstd_dec d;
-     binary_log::transaction::compression::Zstd_comp c;
--    String_t data{TransactionPayloadCompressionTest::constant_data(size)};
-+    std::string data{TransactionPayloadCompressionTest::constant_data(size)};
-     TransactionPayloadCompressionTest::compression_idempotency_test(c, d, data);
-     c.set_compression_level(22);
-     TransactionPayloadCompressionTest::compression_idempotency_test(c, d, data);
-@@ -129,7 +129,7 @@ TEST_F(TransactionPayloadCompressionTest, CompressDecompressNoneTest) {
-   for (auto size : buffer_sizes) {
-     binary_log::transaction::compression::None_dec d;
-     binary_log::transaction::compression::None_comp c;
--    String_t data{TransactionPayloadCompressionTest::constant_data(size)};
-+    std::string data{TransactionPayloadCompressionTest::constant_data(size)};
-     TransactionPayloadCompressionTest::compression_idempotency_test(c, d, data);
-   }
- }

pkgs/tools/misc/qjoypad/default.nix

@@ -21,6 +21,11 @@ mkDerivation rec {
     hash = "sha256:1w26ddxb1xirb7qjf7kv9llxzjhbhcb7warnxbx41qhbni46g26y";
   };
 
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.8.11)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
   nativeBuildInputs = [
     pkg-config
     cmake

pkgs/top-level/aliases.nix

@@ -1766,6 +1766,7 @@ mapAliases {
   miru = throw "'miru' has been removed due to lack maintenance"; # Added 2025-08-21
   mmsd = throw "'mmsd' has been removed due to being unmaintained upstream. Consider using 'mmsd-tng' instead"; # Added 2025-06-07
   mmutils = throw "'mmutils' has been removed due to being unmaintained upstream"; # Added 2025-08-29
+  moar = lib.warnOnInstantiate "`moar` has been renamed to `moor` by upstream in v2.0.0. See https://github.com/walles/moor/pull/305 for more." pkgs.moor; # Added 2025-09-02
   mod_dnssd = throw "'mod_dnssd' has been renamed to/replaced by 'apacheHttpdPackages.mod_dnssd'"; # Converted to throw 2024-10-17
   mod_fastcgi = throw "'mod_fastcgi' has been renamed to/replaced by 'apacheHttpdPackages.mod_fastcgi'"; # Converted to throw 2024-10-17
   mod_python = throw "'mod_python' has been renamed to/replaced by 'apacheHttpdPackages.mod_python'"; # Converted to throw 2024-10-17

pkgs/top-level/all-packages.nix

@@ -5049,8 +5049,6 @@ with pkgs;
 
   idris2Packages = recurseIntoAttrs (callPackage ../development/compilers/idris2 { });
 
-  inherit (idris2Packages) idris2;
-
   inherit (callPackage ../development/tools/database/indradb { })
     indradb-server
     indradb-client

pkgs/top-level/darwin-aliases.nix

@@ -116,6 +116,7 @@ stubs
   ### D ###
 
   discrete-scroll = pkgs.discrete-scroll; # added 2024-11-27
+  ditto = throw "'darwin.ditto' has been removed, because it was impure and unused"; # added 2025-10-18
 
   ### I ###
 
@@ -150,5 +151,6 @@ stubs
 
   stdenvNoCF = throw "darwin.stdenvNoCF has been removed; use `stdenv` or `stdenvNoCC`"; # converted to throw 2025-07-29
   stubs = throw "'darwin.stubs.*' have been removed as they were unused"; # added 2025-04-20
+  sudo = throw "'darwin.sudo' has been removed, because it was impure and unused"; # added 2025-10-18
   swift-corelibs-foundation = throw "'darwin.swift-corelibs-foundation' has been removed, as it was broken and is no longer used"; # added 2025-04-20
 }

pkgs/top-level/darwin-packages.nix

@@ -39,14 +39,10 @@ makeScopeWithSplicing' {
         callPackage = self.callPackage;
         directory = ../os-specific/darwin/apple-source-releases;
       };
-
-      # Must use pkgs.callPackage to avoid infinite recursion.
-      impure-cmds = pkgs.callPackage ../os-specific/darwin/impure-cmds { };
     in
 
     lib.recurseIntoAttrs (
-      impure-cmds
+      apple-source-packages
-      // apple-source-packages
       // {
 
         inherit (self.adv_cmds) ps;