Merge 233f4672b9 into haskell-updates

.github/workflows/build.yml

@@ -62,7 +62,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@0b0e072294b088b73964f1d72dfdac0951439dbd # v31
+      - uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31
         with:
           # Sandbox is disabled on MacOS by default.
           extra_nix_config: sandbox = true

.github/workflows/check.yml

@@ -85,7 +85,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@0b0e072294b088b73964f1d72dfdac0951439dbd # v31
+      - uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31
 
       - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
         continue-on-error: true

.github/workflows/eval.yml

@@ -54,7 +54,7 @@ jobs:
             ci/pinned.json
 
       - name: Install Nix
-        uses: cachix/install-nix-action@0b0e072294b088b73964f1d72dfdac0951439dbd # v31
+        uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31
 
       - name: Load supported versions
         id: versions
@@ -100,7 +100,7 @@ jobs:
           target-as-trusted-at: ${{ inputs.targetSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@0b0e072294b088b73964f1d72dfdac0951439dbd # v31
+        uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31
 
       - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
         continue-on-error: true
@@ -189,7 +189,7 @@ jobs:
           merge-multiple: true
 
       - name: Install Nix
-        uses: cachix/install-nix-action@0b0e072294b088b73964f1d72dfdac0951439dbd # v31
+        uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31
 
       - name: Combine all output paths and eval stats
         run: |
@@ -352,7 +352,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@0b0e072294b088b73964f1d72dfdac0951439dbd # v31
+        uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31
 
       - name: Run misc eval tasks in parallel
         run: |

.github/workflows/lint.yml

@@ -35,7 +35,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@0b0e072294b088b73964f1d72dfdac0951439dbd # v31
+      - uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31
 
       # TODO: Figure out how to best enable caching for the treefmt job. Cachix won't work well,
       # because the cache would be invalidated on every commit - treefmt checks every file.
@@ -70,7 +70,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@0b0e072294b088b73964f1d72dfdac0951439dbd # v31
+      - uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31
 
       - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
         continue-on-error: true
@@ -100,7 +100,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@0b0e072294b088b73964f1d72dfdac0951439dbd # v31
+      - uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31
 
       - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
         continue-on-error: true

doc/release-notes/rl-2605.section.md

@@ -32,6 +32,18 @@
 - `nodePackages.prebuild-install` was removed because it appeared to be unmaintained upstream.
   See [upstream's recommendations for alternatives](https://github.com/prebuild/prebuild-install#note).
 
+- `davis` made changes to the `IMAP_AUTH_URL` option. The flags are now standalone parameters that you need to fill:
+  - Before:
+    ```env
+    IMAP_AUTH_URL={imap.gmail.com:993/imap/ssl/novalidate-cert}
+    ```
+  - After:
+    ```env
+    IMAP_AUTH_URL=imap.mydomain.com:993
+    IMAP_ENCRYPTION_METHOD=ssl
+    IMAP_CERTIFICATE_VALIDATION=false
+    ```
+
 - `python3packages.pillow-avif-plugin` has been removed as the functionality is included in `python3packages.pillow` directly since version 11.3.
 
 ## Other Notable Changes {#sec-nixpkgs-release-26.05-notable-changes}

maintainers/maintainer-list.nix

@@ -6612,6 +6612,12 @@
     github = "dietmarw";
     githubId = 9332;
   };
+  Dietr1ch = {
+    name = "Dietrich Daroch";
+    github = "Dietr1ch";
+    githubId = 2096594;
+    email = "Dietrich@Daroch.me";
+  };
   different-name = {
     name = "different-name";
     email = "hello@different-name.dev";
@@ -10845,6 +10851,12 @@
     githubId = 2090758;
     keys = [ { fingerprint = "24F4 1925 28C4 8797 E539  F247 DB2D 93D1 BFAA A6EA"; } ];
   };
+  hythera = {
+    name = "Hythera";
+    github = "Hythera";
+    githubId = 87016780;
+    matrix = "@hythera:matrix.org";
+  };
   hyzual = {
     email = "hyzual@gmail.com";
     github = "Hyzual";
@@ -18062,7 +18074,7 @@
   mynacol = {
     github = "Mynacol";
     githubId = 26695166;
-    name = "Paul Prechtel";
+    name = "Mynacol";
   };
   myrl = {
     email = "myrl.0xf@gmail.com";
@@ -18643,6 +18655,12 @@
     githubId = 151337;
     name = "Nick Novitski";
   };
+  nickthegroot = {
+    name = "Nick DeGroot";
+    email = "nick@nickthegroot.com";
+    github = "nickthegroot";
+    githubId = 1966472;
+  };
   nico202 = {
     email = "anothersms@gmail.com";
     github = "nico202";

nixos/modules/hardware/facter/camera/default.nix

@@ -0,0 +1,3 @@
+{
+  imports = [ ./ipu6.nix ];
+}

nixos/modules/hardware/facter/camera/ipu6-devices.json

@@ -0,0 +1,3 @@
+{
+    "8086:9A19:17AA:508B/0004-0080-0001": true
+}

nixos/modules/hardware/facter/camera/ipu6.nix

@@ -0,0 +1,115 @@
+{ config, lib, ... }:
+let
+  inherit (config.hardware.facter) report detected;
+  facterLib = import ../lib.nix lib;
+
+  isCpuGeneration =
+    _family: models:
+    facterLib.hasIntelCpu report
+    && lib.any (
+      actual: (actual.family or 0) == 6 && builtins.elem (actual.model or 0) models
+    ) report.hardware.cpu;
+
+  # Family model combinations have been looked up at https://en.wikichip.org/wiki/intel/cpuid
+  isTigerLake = isCpuGeneration 6 [
+    140 # Combination tested on actual hardware
+    141
+  ];
+
+  isAdlerLake = isCpuGeneration 6 [
+    151
+    154
+  ];
+
+  isRaptorLake = isCpuGeneration 6 [
+    183
+    186
+    190
+    191
+  ];
+
+  isMeteorLake = isCpuGeneration 6 [
+    170
+    171
+    172
+  ];
+
+  devices = builtins.fromJSON (builtins.readFile ./ipu6-devices.json);
+  isCameraSupported =
+    let
+      default = {
+        value = 0;
+      };
+    in
+    lib.any (
+      {
+        base_class ? default,
+        sub_class ? default,
+        vendor ? default,
+        sub_vendor ? default,
+        device ? default,
+        sub_device ? default,
+        revision ? default,
+        bus_type ? {
+          name = "";
+        },
+        ...
+      }:
+      let
+        baseClassHex = facterLib.toZeroPaddedHex base_class.value;
+        subClassHex = facterLib.toZeroPaddedHex sub_class.value;
+        vendorHex = facterLib.toZeroPaddedHex vendor.value;
+        subVendorHex = facterLib.toZeroPaddedHex sub_vendor.value;
+        deviceHex = facterLib.toZeroPaddedHex device.value;
+        subDeviceHex = facterLib.toZeroPaddedHex sub_device.value;
+        revisionHex = facterLib.toZeroPaddedHex revision.value;
+      in
+      bus_type.name == "PCI"
+      && devices
+      ? "${vendorHex}:${deviceHex}:${subVendorHex}:${subDeviceHex}/${baseClassHex}-${subClassHex}-${revisionHex}"
+    );
+in
+{
+  options.hardware.facter.detected.camera.ipu6.enable =
+    let
+      cameraSupported =
+        isCameraSupported (report.hardware.unknown or [ ])
+        || isCameraSupported (report.hardware.pci or [ ]);
+
+      cpuSupported = lib.any (generation: generation) [
+        isTigerLake
+        isAdlerLake
+        isRaptorLake
+        isMeteorLake
+      ];
+    in
+    lib.mkEnableOption "webcams using ipu6 from Intel"
+    // {
+      default = cameraSupported && cpuSupported;
+      defaultText = "hardware dependent";
+    };
+
+  config.hardware.ipu6 = lib.mkIf detected.camera.ipu6.enable {
+    enable = true;
+    platform =
+      if isTigerLake then
+        "ipu6"
+      else if isAdlerLake || isRaptorLake then
+        "ipu6ep"
+      else if isMeteorLake then
+        "ipu6epmtl"
+      else
+        throw "Unexpected CPU generation for ipu6 detected.";
+  };
+
+  config.warnings =
+    let
+      isKernel6_16OrLater = lib.versionAtLeast config.boot.kernelPackages.kernel.version "6.16";
+      inherit (detected.camera) ipu6;
+    in
+    lib.optional (isKernel6_16OrLater && ipu6.enable) ''
+      A regression bug can occur when combining ipu6 with kernel version 6.16 or later.
+      This will most likely prevent your system from properly suspending or shutting down.
+      For more information see: https://github.com/intel/ipu6-drivers/issues/381
+    '';
+}

nixos/modules/hardware/facter/default.nix

@@ -6,6 +6,7 @@
 {
   imports = [
     ./bluetooth.nix
+    ./camera
     ./disk.nix
     ./fingerprint
     ./firmware.nix

nixos/modules/hardware/facter/lib.nix

@@ -28,7 +28,7 @@ let
     ) cpus;
 
   # Extract all driver_modules from a list of hardware entries
-  collectDrivers = list: lib.catAttrs "driver_modules" list;
+  collectDrivers = list: lib.foldl' (lst: value: lst ++ value.driver_modules or [ ]) [ ] list;
 
   # Convert number to zero-padded 4-digit hex string (for USB device IDs)
   toZeroPaddedHex =

nixos/modules/services/monitoring/prometheus/default.nix

@@ -1969,7 +1969,7 @@ in
       after = [ "network.target" ];
       serviceConfig = {
         ExecStart =
-          "${cfg.package}/bin/prometheus"
+          "${lib.getExe cfg.package}"
           + optionalString (length cmdlineArgs != 0) (" \\\n  " + concatStringsSep " \\\n  " cmdlineArgs);
         ExecReload = mkIf cfg.enableReload "+${reload}/bin/reload-prometheus";
         User = "prometheus";
@@ -1980,6 +1980,7 @@ in
         StateDirectory = cfg.stateDir;
         StateDirectoryMode = "0700";
         # Hardening
+        CapabilityBoundingSet = [ "" ];
         DeviceAllow = [ "/dev/null rw" ];
         DevicePolicy = "strict";
         LockPersonality = true;

nixos/modules/services/security/reaction.nix

@@ -17,7 +17,6 @@ in
 {
   options.services.reaction = {
     enable = mkEnableOption "enable reaction";
-
     package = mkPackageOption pkgs "reaction" { };
 
     settings = mkOption {
@@ -102,8 +101,14 @@ in
         {
           # allows reading journal logs of processess
           users.users.reaction.extraGroups = [ "systemd-journal" ];
+
           # allows modifying ip firewall rules
-          systemd.services.reaction.AmbientCapabilities = [ "CAP_NET_ADMIN" ];
+          systemd.services.reaction.unitConfig.ConditionCapability = "CAP_NET_ADMIN";
+          systemd.services.reaction.serviceConfig = {
+            CapabilityBoundingSet = [ "CAP_NET_ADMIN" ];
+            AmbientCapabilities = [ "CAP_NET_ADMIN" ];
+          };
+
           # optional, if more control over ssh logs is needed
           services.openssh.settings.LogLevel = lib.mkDefault "VERBOSE";
         }
@@ -117,19 +122,14 @@ in
       cfg = config.services.reaction;
 
       generatedSettings = settingsFormat.generate "reaction.yml" cfg.settings;
-      namedGeneratedSettings = lib.optional (cfg.settings != { }) {
-        name = "reaction.yml";
-        path = generatedSettings;
-      };
-
-      # SAFETY: We can discard the dependencies of "file" in the name attribute because we keep them in the path attribute
-      # See https://nix.dev/manual/nix/2.32/language/string-context
-      namedSettingsFiles = builtins.map (file: {
-        name = builtins.unsafeDiscardStringContext (builtins.baseNameOf file);
-        path = file;
-      }) cfg.settingsFiles;
-
-      settingsDir = pkgs.linkFarm "reaction.d" (namedSettingsFiles ++ namedGeneratedSettings);
+      settingsDir = pkgs.runCommand "reaction-settings-dir" { } ''
+        mkdir -p $out
+        ${lib.concatMapStringsSep "\n" (file: ''
+          filename=$(basename "${file}")
+          ln -s "${file}" "$out/$filename"
+        '') cfg.settingsFiles}
+        ln -s ${generatedSettings} $out/reaction.yml
+      '';
     in
     lib.mkIf cfg.enable {
       assertions = [
@@ -157,18 +157,12 @@ in
             ''
           );
 
-      # Easier to debug conf when we have direct access to it,
-      # rather than having to look for it in the systemd service file.
-      environment.etc."reaction".source = settingsDir;
-
       systemd.services.reaction = {
-        enable = true;
         description = "Scan logs and take action";
         after = [ "network.target" ];
         wantedBy = [ "multi-user.target" ];
         partOf = lib.optionals cfg.stopForFirewall [ "firewall.service" ];
         path = [ pkgs.iptables ];
-        unitConfig.ConditionCapability = "CAP_NET_ADMIN";
         serviceConfig = {
           Type = "simple";
           User = if (!cfg.runAsRoot) then "reaction" else "root";
@@ -177,11 +171,29 @@ in
               lib.optionalString (cfg.loglevel != null) " -l ${cfg.loglevel}"
             }
           '';
-          StateDirectory = "reaction";
-          RuntimeDirectory = "reaction";
-          WorkingDirectory = "/var/lib/reaction";
 
-          CapabilityBoundingSet = [ "CAP_NET_ADMIN" ];
+          NoNewPrivileges = true;
+
+          RuntimeDirectory = "reaction";
+          RuntimeDirectoryMode = "0750";
+          WorkingDirectory = "%S/reaction";
+          StateDirectory = "reaction";
+          StateDirectoryMode = "0750";
+          LogsDirectory = "reaction";
+          LogsDirectoryMode = "0750";
+          UMask = 0077;
+
+          RemoveIPC = true;
+          PrivateTmp = true;
+          ProtectHome = true;
+          ProtectClock = true;
+          PrivateDevices = true;
+          ProtectHostname = true;
+          ProtectSystem = "strict";
+          ProtectKernelTunables = true;
+          ProtectKernelModules = true;
+          ProtectControlGroups = true;
+          ProtectKernelLogs = true;
         };
       };
 

nixos/modules/virtualisation/libvirtd.nix

@@ -421,7 +421,7 @@ in
       # this file is expected in /etc/qemu and not sysconfdir (/var/lib)
       etc."qemu/bridge.conf".text = lib.concatMapStringsSep "\n" (e: "allow ${e}") cfg.allowedBridges;
       systemPackages = with pkgs; [
-        libressl.nc
+        netcat
         config.networking.firewall.package
         cfg.package
         cfg.qemu.package

nixos/tests/ceph-multi-node.nix

@@ -53,7 +53,7 @@ let
         sudo
         ceph
         xfsprogs
-        libressl.nc
+        netcat
       ];
 
       boot.kernelModules = [ "xfs" ];

nixos/tests/facter/facter.json

@@ -14,6 +14,18 @@
         "model": 33
       }
     ],
+    "graphics_card": [
+      {
+        "driver_modules": [
+          "i915"
+        ]
+      }
+    ],
+    "monitor": [
+      {
+        "model": "Test Monitor"
+      }
+    ],
     "system": {
       "form_factor": "desktop"
     }

nixos/tests/fail2ban.nix

@@ -14,7 +14,7 @@
   nodes.client = _: {
     environment.systemPackages = [
       pkgs.sshpass
-      pkgs.libressl.nc
+      pkgs.netcat
     ];
 
   };

nixos/tests/jool.nix

@@ -24,7 +24,7 @@ let
           printf 'HTTP/1.0 200 OK\n'
           printf 'Content-Length: ${toString (1 + builtins.stringLength msg)}\n'
           printf '\n${msg}\n\n'
-        } | ${pkgs.libressl.nc}/bin/nc -${toString ip}nvl 80
+        } | ${pkgs.netcat}/bin/nc -${toString ip}nvl 80
         done
       '';
     };

nixos/tests/reaction-firewall.nix

@@ -24,44 +24,44 @@
   testScript = # py
     ''
       start_all()
-      machine.wait_for_unit("multi-user.target")
 
-      # Verify both services start successfully
+      machine.wait_for_unit("multi-user.target")
       machine.wait_for_unit("firewall.service")
       machine.wait_for_unit("reaction.service")
 
-      # Check reaction chain exists in iptables
-      output = machine.succeed("iptables -w -L -n")
-      assert "reaction" in output, "reaction chain not found in iptables"
+      def check_reaction_in_iptables(context = ""):
+        with subtest("check reaction chain exists"):
+          machine.sleep(3)
+          output = machine.succeed("iptables -nvL")
+          assert "reaction" in output, f"error: reaction chain missing in iptables, {context}"
 
-      # Reload firewall and verify there's no issues due to reaction chain
-      machine.succeed("systemctl reload firewall")
-      output = machine.succeed("journalctl -u reaction.service -u firewall.service --no-pager")
-      assert "ERROR" not in output, "firewall reload failed due to reaction"
+      check_reaction_in_iptables()
 
-      # Verify reaction chain still exists after reload
-      output = machine.succeed("iptables -w -L -n")
-      assert "reaction" in output, "reaction chain missing after firewall reload"
+      with subtest("reload firewall"):
+        machine.succeed("systemctl reload firewall")
+        output = machine.succeed("journalctl -u firewall.service --no-pager")
+        assert "ERROR" not in output, "firewall reload failed due to reaction"
 
-      # Restart firewall and verify reaction restarts as well
-      machine.succeed("systemctl restart firewall")
-      output = machine.succeed("journalctl -u reaction.service -u firewall.service --no-pager")
-      assert "INFO stop command" in output and "INFO start command" in output, "reaction did not restart when firewall was restarted"
+        check_reaction_in_iptables(context="after firewall reload")
 
-      output = machine.succeed("iptables -w -L -n")
-      assert "reaction" in output, "reaction chain missing after firewall restart"
+      with subtest("restart firewall"):
+        machine.succeed("systemctl restart firewall")
+        output = machine.succeed("journalctl -u reaction.service --no-pager")
+        assert "INFO stop command" in output and "INFO start command" in output, "reaction did not restart when firewall was restarted"
 
-      # Stop reaction manually and verify chains are cleaned up
-      machine.succeed("systemctl stop reaction")
-      output = machine.succeed("iptables -w -L -n || true")
-      assert "reaction" not in output, "reaction chain still exists after stop"
+        check_reaction_in_iptables(context="after firewall restart")
 
-      # Start reaction again and verify it works
-      machine.succeed("systemctl start reaction")
-      machine.wait_for_unit("reaction.service")
+      with subtest("stop reaction manually and verify chains are cleaned up"):
+        machine.succeed("systemctl stop reaction")
+        machine.sleep(3)
+        output = machine.succeed("iptables -nvL")
+        assert "reaction" not in output, "reaction chain still exists after the service was stopped"
 
-      output = machine.succeed("iptables -w -L -n")
-      assert "reaction" in output, "reaction chain not recreated"
+        with subtest("start reaction again and verify it works"):
+          machine.succeed("systemctl start reaction")
+          machine.wait_for_unit("reaction.service")
+
+          check_reaction_in_iptables()
     '';
 
   # Debug interactively with:

nixos/tests/reaction.nix

@@ -10,18 +10,22 @@
     services.reaction = {
       enable = true;
       stopForFirewall = false;
-      settingsFiles = [
-        "${pkgs.reaction}/share/examples/example.jsonnet"
-        # "${pkgs.reaction}/share/examples/example.yml" # can't specify both because conflicts
-      ];
+      # example.jsonnet/example.yml can be copied and modified from ${pkgs.reaction}/share/examples
+      settingsFiles = [ "${pkgs.reaction}/share/examples/example.jsonnet" ];
       runAsRoot = false;
     };
     services.openssh.enable = true;
+    # If not running as root you need to give the reaction user and service the proper permissions
 
-    # required to access journal of sshd.service as runAsRoot = false
+    # allows reading journal logs of processess
     users.users.reaction.extraGroups = [ "systemd-journal" ];
-    # required for allowing reaction to modifiy firewall rules
-    systemd.services.reaction.serviceConfig.AmbientCapabilities = [ "CAP_NET_ADMIN" ];
+
+    # allows modifying ip firewall rules
+    systemd.services.reaction.unitConfig.ConditionCapability = "CAP_NET_ADMIN";
+    systemd.services.reaction.serviceConfig = {
+      CapabilityBoundingSet = [ "CAP_NET_ADMIN" ];
+      AmbientCapabilities = [ "CAP_NET_ADMIN" ];
+    };
 
     users.users.nixos.isNormalUser = true; # neeeded to establish a ssh connection, by default root login is succeeding without any password
   };
@@ -42,7 +46,6 @@
       server.wait_for_unit("multi-user.target")
       server.wait_for_unit("reaction")
       server.wait_for_unit("sshd")
-      client.wait_for_unit("multi-user.target")
 
       client_addr = "${(lib.head nodes.client.networking.interfaces.eth1.ipv4.addresses).address}"
       server_addr = "${(lib.head nodes.server.networking.interfaces.eth1.ipv4.addresses).address}"

nixos/tests/samba-wsdd.nix

@@ -40,7 +40,7 @@
     server_wsdd.wait_for_unit("samba-wsdd")
 
     client_wsdd.wait_until_succeeds(
-        "echo list | ${pkgs.libressl.nc}/bin/nc -N -U /run/wsdd/wsdd.sock | grep -i SERVER-WSDD"
+        "echo list | ${pkgs.netcat}/bin/nc -N -U /run/wsdd/wsdd.sock | grep -i SERVER-WSDD"
     )
   '';
 }

pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "claude-code";
     publisher = "anthropic";
-    version = "2.0.70";
-    hash = "sha256-ed2oYB6G9EuSRqgt18W69JS73+uf6vqXtwQ1ZY+eWy8=";
+    version = "2.0.72";
+    hash = "sha256-nfzcm8lEtZl3vD129rtpV4Oc5vKW7SKyZHfFg1jd8hU=";
   };
 
   meta = {

pkgs/applications/misc/resp-app/default.nix

@@ -1,105 +0,0 @@
-{
-  mkDerivation,
-  lib,
-  fetchFromGitHub,
-  fetchpatch,
-  brotli,
-  lz4,
-  pyotherside,
-  python3,
-  python3Packages,
-  qtbase,
-  qtcharts,
-  qmake,
-  qttools,
-  rdbtools,
-  snappy,
-  wrapQtAppsHook,
-  zstd,
-}:
-
-let
-  rdbtools-patched = rdbtools.overridePythonAttrs (oldAttrs: {
-    # Add required additional flag for resp-app
-    patches = oldAttrs.patches or [ ] ++ [
-      (fetchpatch {
-        name = "Add-flag-to-parse-only-key-names.patch";
-        url = "https://github.com/uglide/redis-rdb-tools/commit/b74946e6fbca589947ef0186429d5ce45a074b87.patch";
-        hash = "sha256-1gjqB/IDSsAbrwzWSezlAW/2SYr6BFm1QJ2HAHK2fFs=";
-      })
-    ];
-  });
-in
-mkDerivation rec {
-  pname = "RESP.app";
-  version = "2022.5";
-
-  src = fetchFromGitHub {
-    owner = "RedisInsight";
-    repo = "RedisDesktopManager";
-    fetchSubmodules = true;
-    rev = version;
-    hash = "sha256-5eI3J2RsYE5Ejb1r8YkgzmGX2FyaCLFD0lc10J+fOT4=";
-  };
-
-  nativeBuildInputs = [
-    python3Packages.wrapPython
-    qmake
-    wrapQtAppsHook
-  ];
-
-  buildInputs = [
-    brotli
-    lz4
-    pyotherside
-    python3
-    qtbase
-    qtcharts
-    qttools
-    snappy
-    zstd
-  ]
-  ++ pythonPath;
-
-  pythonPath = with python3Packages; [
-    bitstring
-    cbor
-    msgpack
-    phpserialize
-    rdbtools-patched
-    python-lzf
-  ];
-
-  postPatch = ''
-    substituteInPlace src/resp.pro \
-      --replace 'which ccache' "false" \
-      --replace 'target.files = $$DESTDIR/resp' "${placeholder "src"}/bin/linux/release/resp" \
-      --replace '/opt/resp_app' "${placeholder "out"}" \
-      --replace 'target.path = $$LINUX_INSTALL_PATH' 'target.path = $$LINUX_INSTALL_PATH/bin' \
-      --replace '/usr/' "$out/"
-    rm -r 3rdparty/snappy
-  '';
-
-  qmakeFlags = [
-    "SYSTEM_LZ4=1"
-    "SYSTEM_ZSTD=1"
-    "SYSTEM_SNAPPY=1"
-    "SYSTEM_BROTLI=1"
-    "VERSION=${version}"
-    "src/resp.pro"
-  ];
-
-  preFixup = ''
-    buildPythonPath "$pythonPath"
-    qtWrapperArgs+=(--prefix PYTHONPATH : "$program_PYTHONPATH")
-  '';
-
-  meta = {
-    description = "Cross-platform Developer GUI for Redis";
-    mainProgram = "resp";
-    homepage = "https://resp.app/";
-    license = lib.licenses.gpl3Only;
-    platforms = lib.platforms.linux;
-    maintainers = [ ];
-  };
-}

pkgs/applications/networking/browsers/chromium/info.json

@@ -1,10 +1,10 @@
 {
   "chromium": {
-    "version": "143.0.7499.109",
+    "version": "143.0.7499.146",
     "chromedriver": {
-      "version": "143.0.7499.110",
-      "hash_darwin": "sha256-Yvq29D71/S1wlnG+7Dcd4IYuOcdSwxHSKLfdtitnmyQ=",
-      "hash_darwin_aarch64": "sha256-adwfK1Iymjla6lSID08SyEqbnYjJLKfB92Yrh5/9LuQ="
+      "version": "143.0.7499.147",
+      "hash_darwin": "sha256-bsyTxvmiIDdV/ivUjbLk3K+Ve03DvVZG3HF/y4X9JUU=",
+      "hash_darwin_aarch64": "sha256-j5PbvqUsR+XlYZU7xB2MTPJncfSgCIy9tE298ww8Ux4="
     },
     "deps": {
       "depot_tools": {
@@ -21,8 +21,8 @@
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "71a0dbd6672e2ccb6d1008376cbb7acd315cb8d6",
-        "hash": "sha256-K7HzC+M7WIMsyB4Wuy04WvGAX+QsTN5daOhkox1wxnA=",
+        "rev": "c1224fc40c96e7f17f0cdeb87a8f4c64b93c0d74",
+        "hash": "sha256-Sn4j7vs7g/D9GnL+BMCyg73iEeGn7Miq0k42mV6Z3hM=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -132,8 +132,8 @@
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "e1ce227ebf75378c5f60a9d531579982bcdd93ee",
-        "hash": "sha256-RqGCh/InZagPemqMRnR/ziaxDm3ruS4dtnj87mBmIjc="
+        "rev": "479f62d2194fd6e44c37d07654ca6e41c42bd332",
+        "hash": "sha256-rzZn9l0EFcir6k8Xv2svIrhRPwe/rq48H7CX/3yfgFE="
       },
       "src/third_party/dawn/third_party/glfw": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -777,8 +777,8 @@
       },
       "src/third_party/webrtc": {
         "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "1788a81407183acc98163a4e1507c5c63fb175cc",
-        "hash": "sha256-7FIcH5MG7kNHmN2FE00Qyd1NlfYzb1xKmVDX7MCNyXQ="
+        "rev": "4e31d1a1ff41bb1b79609c83f998458a111a149c",
+        "hash": "sha256-3tfB6jNsTLYozYqBfAmYNmq94wQ3OFxBSlOfRaj6wxc="
       },
       "src/third_party/wuffs/src": {
         "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@@ -807,8 +807,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "beee9f5cafde91bbd086077a11db16cb9768e62a",
-        "hash": "sha256-q1gVbNGls2izSDb3KZmteZQvcc6M0JyPuZFPfG4FIAs="
+        "rev": "326f5f8cad3f0e436c8ea8f82a6894936a32e860",
+        "hash": "sha256-crTEZnN5iWTXOxpAkvIDPQ6hyfF54F1/ImoKrdmO2K4="
       }
     }
   },

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -318,13 +318,13 @@
     "vendorHash": "sha256-fP6brpY/wRI1Yjgapzi+FfOci65gxWeOZulXbGdilrE="
   },
   "dnsimple_dnsimple": {
-    "hash": "sha256-Zx4M0TKamyfm5Z5EAtiHWQQTNX/VT0EkAaHM7x/2SGk=",
+    "hash": "sha256-zPvHTSmptdm5w28rpgmwrYBIo+0Y077wZ+FNKbKHaT4=",
     "homepage": "https://registry.terraform.io/providers/dnsimple/dnsimple",
     "owner": "dnsimple",
     "repo": "terraform-provider-dnsimple",
-    "rev": "v1.10.0",
+    "rev": "v2.0.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-M6Z/wMOKhQncuHAhkSPfWT77b14lIZ/sVQT7DmM60FI="
+    "vendorHash": "sha256-DRMbcAR+DDrxrg1jNgnoWUg+OjlKm7wkqgIN6Hhkp3U="
   },
   "dnsmadeeasy_dme": {
     "hash": "sha256-JH9YcM9Fvd1x0BJpLUZCm6a9hZZxySrkFVLP89FO3fU=",
@@ -714,13 +714,13 @@
     "vendorHash": null
   },
   "ibm-cloud_ibm": {
-    "hash": "sha256-S1Azsq42GEqgpqVB3Wpi6EJAL8x+s+i+oTJFPQCVfeI=",
+    "hash": "sha256-xiiQKp4ZBLAR1OM31D8UWJbaZ2SkzrBIr3uW3N3iSZg=",
     "homepage": "https://registry.terraform.io/providers/IBM-Cloud/ibm",
     "owner": "IBM-Cloud",
     "repo": "terraform-provider-ibm",
-    "rev": "v1.86.0",
+    "rev": "v1.86.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-IDv2L1fFqhbThc3kO6UNM+6hRJ+DZkT7voc/m3c5BCA="
+    "vendorHash": "sha256-vHgeVhZV9JLH2vXwFUO0N8xp8BLBPk7ypK+kkWwtbTk="
   },
   "icinga_icinga2": {
     "hash": "sha256-Y/Oq0aTzP+oSKPhHiHY9Leal4HJJm7TNDpcdqkUsCmk=",
@@ -1174,13 +1174,13 @@
     "vendorHash": "sha256-f3b4NULINH8XworCn46fiz4GmBM31ROdAJy1j4GKkx4="
   },
   "scaleway_scaleway": {
-    "hash": "sha256-V0mR72RJa+DgWZxnvSCWI6HwZpqewbHT5FKLdSiwGw4=",
+    "hash": "sha256-LR1e8gAF8htYpxfj/m/Ge266sFRFc8tijaE/9uKYYBw=",
     "homepage": "https://registry.terraform.io/providers/scaleway/scaleway",
     "owner": "scaleway",
     "repo": "terraform-provider-scaleway",
-    "rev": "v2.64.0",
+    "rev": "v2.65.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-Z9EKIWBkmKptQMJFRh5SK2hhKwh5z5Lij0ZwXChOarY="
+    "vendorHash": "sha256-HWAaBgKD/viiFaxvyHE4BuWdsY0tCSQFaf8YJq4PS/0="
   },
   "scottwinkler_shell": {
     "hash": "sha256-LTWEdXxi13sC09jh+EFZ6pOi1mzuvgBz5vceIkNE/JY=",

pkgs/applications/networking/cluster/terraform/default.nix

@@ -194,8 +194,8 @@ rec {
   mkTerraform = attrs: pluggable (generic attrs);
 
   terraform_1 = mkTerraform {
-    version = "1.14.2";
-    hash = "sha256-gYJW31cDsfs/SLBE9InZP1ghG6gbat2pkrmHLIAZVDY=";
+    version = "1.14.3";
+    hash = "sha256-QPVKWtpm67z13hmPgM/YXm+CBOqiI8qZwttx2h6LboU=";
     vendorHash = "sha256-NDtBLa8vokrSRDCNX10lQyfMDzTrodoEj5zbDanL4bk=";
     patches = [ ./provider-path-0_15.patch ];
     passthru = {

pkgs/applications/window-managers/i3/kitti3.nix

@@ -1,15 +1,16 @@
 {
   buildPythonApplication,
   fetchFromGitHub,
-  poetry-core,
   i3ipc,
   lib,
+  poetry-core,
+  writeScript,
 }:
 
-buildPythonApplication {
+buildPythonApplication rec {
   pname = "kitti3";
-  version = "unstable-2021-09-11";
-  format = "pyproject";
+  version = "0.5.1-unstable-2021-09-10";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "LandingEllipse";
@@ -32,6 +33,25 @@ buildPythonApplication {
     i3ipc
   ];
 
+  passthru.updateScript = writeScript "update-kitti3" ''
+    #!/usr/bin/env nix-shell
+    #!nix-shell -i bash -p git common-updater-scripts perl tomlq
+    tmpdir="$(mktemp -d)"
+    trap "rm -rf $tmpdir" EXIT
+    git clone --depth=1 "${src.gitRepoUrl}" "$tmpdir"
+    pushd "$tmpdir"
+    newVersionNumber=$(perl -ne 'print if s/version = "([\d.]+)"/$1/' pyproject.toml)
+    newRevision=$(git show -s --pretty='format:%H')
+    newDate=$(git show -s --pretty='format:%cs')
+    newVersion="$newVersionNumber-unstable-$newDate"
+    echo "newVersion = $newVersion" >&2
+    echo "newRevision = $newRevision" >&2
+    popd
+    update-source-version --rev="$newRevision" "kitti3" "$newVersion"
+    perl -pe 's/^(.*version = ")([\d\.]+)(.*)$/''${1}'"''${newVersion}"'";/' \
+      -i 'pkgs/applications/window-managers/i3/kitti3.nix'
+  '';
+
   meta = {
     homepage = "https://github.com/LandingEllipse/kitti3";
     description = "Kitty drop-down service for sway & i3wm";

pkgs/by-name/an/anytype-heart/package.nix

@@ -26,7 +26,7 @@ buildGoModule (finalAttrs: {
 
   # Use only versions specified in anytype-ts middleware.version file:
   #  https://github.com/anyproto/anytype-ts/blob/v<anytype-ts-version>/middleware.version
-  version = "0.44.5";
+  version = "0.46.3";
 
   # Update only together with 'anytype' package.
   # nixpkgs-update: no auto update
@@ -34,10 +34,10 @@ buildGoModule (finalAttrs: {
     owner = "anyproto";
     repo = "anytype-heart";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wSZcDcGPKbtUWf7hYXiQrS8a4sgnbItW7bu4hxQ2yFM=";
+    hash = "sha256-g3YAi7T6E0o2xjCpmnwmKUugEKyziJIYRaPU4dQH9xw=";
   };
 
-  vendorHash = "sha256-T7CPD6mbxkN1x53oe9jsS2XMqluqWv8VPPd1pnXZvlc=";
+  vendorHash = "sha256-s/otpfRwXFUOek8oVr5eUcKH4Vwd5BbtB0GH+hjzjwI=";
 
   subPackages = [ "cmd/grpcserver" ];
   tags = [

pkgs/by-name/an/anytype/package.nix

@@ -6,7 +6,7 @@
   pkg-config,
   anytype-heart,
   libsecret,
-  electron_37,
+  electron,
   makeDesktopItem,
   copyDesktopItems,
   commandLineArgs ? "",
@@ -14,23 +14,23 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "anytype";
-  version = "0.50.5";
+  version = "0.52.4";
 
   src = fetchFromGitHub {
     owner = "anyproto";
     repo = "anytype-ts";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HLYYuMtgvF0UHHnThEWSpLIZEvLxNrOtkoXEhSAT24A=";
+    hash = "sha256-4R0ROpMH49BrUcjd9Xcgs7wRo1flMg7kEsZS51uL5nE=";
   };
 
   locales = fetchFromGitHub {
     owner = "anyproto";
     repo = "l10n-anytype-ts";
-    rev = "aaa83aae39a7dbf59c3c8580be4700edf7481893";
-    hash = "sha256-MOR7peovTYYQR96lOoxyETY0aOH6KcB9vXCqpXKxI/4=";
+    rev = "910cbb5b05cc390e53205fe275768166c946c041";
+    hash = "sha256-H6f/3paRKJd/GdZBJt0IHLbaGbbXpsbqjvDPu628JGE=";
   };
 
-  npmDepsHash = "sha256-ohlHY7zw+GyaNuwI2t7dQj1bQkXH//LiyiHyi2B+/9I=";
+  npmDepsHash = "sha256-k6iAWWbLmKSoqvWFyd//zlNy/LrdD77qlngL9QeP+nw=";
 
   env = {
     ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
@@ -44,7 +44,7 @@ buildNpmPackage (finalAttrs: {
 
   npmFlags = [
     # keytar needs to be built against electron's ABI
-    "--nodedir=${electron_37.headers}"
+    "--nodedir=${electron.headers}"
   ];
 
   patches = [
@@ -87,7 +87,7 @@ buildNpmPackage (finalAttrs: {
 
     cp LICENSE.md $out/share
 
-    makeWrapper '${lib.getExe electron_37}' $out/bin/anytype \
+    makeWrapper '${lib.getExe electron}' $out/bin/anytype \
       --set-default ELECTRON_IS_DEV 0 \
       --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}" \
       --add-flags $out/lib/anytype/ \

pkgs/by-name/aw/aws-lc/package.nix

@@ -11,13 +11,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "aws-lc";
-  version = "1.65.0";
+  version = "1.66.0";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-lc";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-rpxEhOy9qYwIDa78u1BOgANfnkfGgGacKOjjlqXtn88=";
+    hash = "sha256-OO9TWwaV/GlyrLl4C6oCFxIAeYfWjzvY7o//7OuoRDc=";
   };
 
   outputs = [

pkgs/by-name/ba/bazel_7/package.nix

@@ -431,6 +431,11 @@ stdenv.mkDerivation rec {
           sedVerbose $wrapper \
             -e "s,/usr/bin/xcrun install_name_tool,${cctools}/bin/install_name_tool,g"
         done
+
+        # set --macos_sdk_version to make utimensat visible:
+        sedVerbose compile.sh \
+          -e "/bazel_build /a\  --macos_sdk_version=${stdenv.hostPlatform.darwinMinVersion} \\\\" \
+
       '';
 
       genericPatches = ''

pkgs/by-name/be/bella/package.nix

@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bella";
-  version = "0.1.3";
+  version = "0.1.7";
 
   src = fetchFromGitHub {
     owner = "josephmawa";
     repo = "Bella";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-JSzgh56Ph8LjVY2uPfu1tacdr7BBbBzRfdWtcTRga7I=";
+    hash = "sha256-ePzDnaoGPa5Hku7Rpced989QB6uOXN/jfXgTwtlE7rQ=";
   };
 
   strictDeps = true;

pkgs/by-name/bl/blackmagic-desktop-video/package.nix

@@ -14,7 +14,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "blackmagic-desktop-video";
-  version = "15.3";
+  version = "15.3.1";
 
   buildInputs = [
     autoPatchelfHook
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
       {
         outputHashMode = "recursive";
         outputHashAlgo = "sha256";
-        outputHash = "sha256-QcM/FTEYkG1Zteb2TNysQjP/mNS1B2Wa8rqkJ70m24s=";
+        outputHash = "sha256-4Y7bmN08fZ9hRsyFKP4cfGb4fggLY9bdm32+UTIGiTs=";
 
         impureEnvVars = lib.fetchers.proxyImpureEnvVars;
 

pkgs/by-name/bu/buildkit/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "buildkit";
-  version = "0.26.2";
+  version = "0.26.3";
 
   src = fetchFromGitHub {
     owner = "moby";
     repo = "buildkit";
     rev = "v${version}";
-    hash = "sha256-AMsql+b5yUnkw6KkJte2qjN+MadJn06/0HohXP4N47c=";
+    hash = "sha256-2Utxan85hHmyt+7anfbjFxBHhKzmZb7k9K025vA76Ys=";
   };
 
   vendorHash = null;

pkgs/by-name/ca/cavasik/package.nix

@@ -0,0 +1,83 @@
+{
+  cava,
+  desktop-file-utils,
+  fetchFromGitHub,
+  gobject-introspection,
+  gst_all_1,
+  gtk4,
+  lib,
+  libadwaita,
+  meson,
+  ninja,
+  nix-update-script,
+  pkg-config,
+  python3Packages,
+  wrapGAppsHook4,
+}:
+
+let
+  pname = "cavasik";
+  version = "3.2.0";
+in
+python3Packages.buildPythonApplication {
+  inherit pname version;
+
+  pyproject = false; # Built with meson
+
+  src = fetchFromGitHub {
+    owner = "TheWisker";
+    repo = "Cavasik";
+    tag = "v${version}";
+    hash = "sha256-O8rFtqzmDktXKF3219RAo1yxqjfPm1qkHhAyoT7N8AU=";
+  };
+
+  postPatch = ''
+    substituteInPlace src/cava.py \
+      --replace-fail '"cava"' '"${lib.getExe cava}"'
+  '';
+
+  nativeBuildInputs = [
+    desktop-file-utils
+    gobject-introspection
+    meson
+    ninja
+    pkg-config
+    wrapGAppsHook4
+  ];
+
+  buildInputs = [
+    gst_all_1.gstreamer
+    gtk4
+    libadwaita
+  ];
+
+  dependencies = with python3Packages; [
+    pycairo
+    pydbus
+    pygobject3
+  ];
+
+  checkPhase = ''
+    runHook preCheck
+
+    meson test --print-errorlog
+
+    runHook postCheck
+  '';
+
+  dontWrapGApps = true;
+
+  preFixup = ''
+    makeWrapperArgs+=(''${gappsWrapperArgs[@]})
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Audio visualizer based on CAVA with extended capabilities";
+    mainProgram = "cavasik";
+    homepage = "https://github.com/TheWisker/Cavasik";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ starryreverie ];
+  };
+}

pkgs/by-name/ce/cerberus/package.nix

@@ -10,15 +10,15 @@
   testers,
   cerberus,
 }:
-ocamlPackages.buildDunePackage rec {
+ocamlPackages.buildDunePackage (finalAttrs: {
   pname = "cerberus";
-  version = "0-unstable-2025-11-26";
+  version = "0-unstable-2025-12-15";
 
   src = fetchFromGitHub {
     owner = "rems-project";
     repo = "cerberus";
-    rev = "6d60ef25944ebcdab892158c949a8e05501557dc";
-    hash = "sha256-RucW01xuW5b6F9/O1OL99YJn3rSMCP7l7Cwjuv4PNIc=";
+    rev = "50621977ba282ac527e9259f7e9334d2c5bef41c";
+    hash = "sha256-CAZeLG1M9oBzl/5EsIYwyV3St5fdwmfkPApACbsIYAc=";
   };
 
   patches = [
@@ -35,7 +35,7 @@ ocamlPackages.buildDunePackage rec {
   # our version since git is impure
   postPatch = ''
     substituteInPlace tools/gen_version.ml \
-      --replace-fail '"unknown"' '"${version}"'
+      --replace-fail '"unknown"' '"${finalAttrs.version}"'
   '';
 
   minimalOCamlVersion = "4.12";
@@ -136,4 +136,4 @@ ocamlPackages.buildDunePackage rec {
     ];
     platforms = lib.platforms.unix;
   };
-}
+})

pkgs/by-name/ci/cinnamon-desktop/package.nix

@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cinnamon-desktop";
-  version = "6.6.0";
+  version = "6.6.1";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "cinnamon-desktop";
     tag = version;
-    hash = "sha256-9qgt+E5qbzq+x9fJKkoSBFgA96HBDLysQvg6b04WbMU=";
+    hash = "sha256-vBRaUXsPAPOpMEs2pl6AaaKIMeeXB0UdCb1hzYd43KY=";
   };
 
   outputs = [

pkgs/by-name/ci/cinnamon-screensaver/package.nix

@@ -28,13 +28,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cinnamon-screensaver";
-  version = "6.6.0";
+  version = "6.6.1";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "cinnamon-screensaver";
     tag = version;
-    hash = "sha256-Jo9GRsiPvqGZ2ITaewV5H4VMc5EotTTXIaqzXwDA+Z4=";
+    hash = "sha256-NK33cIrcTicLs59eJ550FghjuWS93yD642ObAS55Dtk=";
   };
 
   patches = [

pkgs/by-name/ci/cinnamon/package.nix

@@ -74,13 +74,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "cinnamon";
-  version = "6.6.0";
+  version = "6.6.2";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "cinnamon";
     tag = version;
-    hash = "sha256-DiAc1Ng03xzNYYpf79g9p338syPScKftmviNw6Y5i5o=";
+    hash = "sha256-evjXa42mo7wkLh5HDax+2Tsc/x/oG3tPHU1tczoxmJU=";
   };
 
   patches = [

pkgs/by-name/cl/claude-code/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@anthropic-ai/claude-code",
-  "version": "2.0.70",
+  "version": "2.0.71",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@anthropic-ai/claude-code",
-      "version": "2.0.70",
+      "version": "2.0.71",
       "license": "SEE LICENSE IN README.md",
       "bin": {
         "claude": "cli.js"

pkgs/by-name/cl/claude-code/package.nix

@@ -11,14 +11,14 @@
 }:
 buildNpmPackage (finalAttrs: {
   pname = "claude-code";
-  version = "2.0.70";
+  version = "2.0.71";
 
   src = fetchzip {
     url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${finalAttrs.version}.tgz";
-    hash = "sha256-RTMhrFhbamO8Ow5iKd3IiLoKoLF5cz279ArjPZymE9o=";
+    hash = "sha256-krbaIy1KfmbwroQRZpGR6bOYNc2l/GZKjhavmiwVCms=";
   };
 
-  npmDepsHash = "sha256-coTUQVOOT/jonVtnmY/zenv1PI93JFlpFEqlUlhssJM=";
+  npmDepsHash = "sha256-cio+ZkVIPIkxRXXQzwFYXr08OUEBVJpRjtvmJLcH3Ag=";
 
   postPatch = ''
     cp ${./package-lock.json} package-lock.json

pkgs/by-name/cl/clojure-lsp/package.nix

@@ -12,11 +12,11 @@
 
 buildGraalvmNativeImage (finalAttrs: {
   pname = "clojure-lsp";
-  version = "2025.08.25-14.21.46";
+  version = "2025.11.28-12.47.43";
 
   src = fetchurl {
     url = "https://github.com/clojure-lsp/clojure-lsp/releases/download/${finalAttrs.version}/clojure-lsp-standalone.jar";
-    hash = "sha256-J89RHgxLJHSRQfbSLT0MhX7kDMsZEWjK8RGGIyx6dik=";
+    hash = "sha256-An7sTudpP2Ct32sYShNhgRsHgJJIN9H+sR5MlQ8i+7o=";
   };
 
   extraNativeImageBuildArgs = [

pkgs/by-name/da/davis/package.nix

@@ -7,16 +7,16 @@
 
 php.buildComposerProject2 (finalAttrs: {
   pname = "davis";
-  version = "5.2.0";
+  version = "5.3.0";
 
   src = fetchFromGitHub {
     owner = "tchapi";
     repo = "davis";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Ih06CKwgR2ljw3w9YfgVUdBCjt5Nbs34fMsErRUkfcc=";
+    hash = "sha256-okysA35sdtvbyn90fqGbhGr2yWYAw1DBJYBBhPep6T0=";
   };
 
-  vendorHash = "sha256-e0qSI5naqM/mUSMduiku0yQkYMGw1y9Uwa5oYlxaDzs=";
+  vendorHash = "sha256-j28IsT7tdTg7+M8KwBa1LDWw0YGgv9EGnaCQNeTJZyw=";
 
   composerNoPlugins = false;
 

pkgs/by-name/db/dbcsr/package.nix

@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dbcsr";
-  version = "2.8.0";
+  version = "2.9.0";
 
   src = fetchFromGitHub {
     owner = "cp2k";
     repo = "dbcsr";
     rev = "v${version}";
-    hash = "sha256-YXySNw3+DiY7E57W1ypeWLyawwcWVGlmTM4Kgj7Nnmo=";
+    hash = "sha256-ZhcatDG0bbl75P3YI5Kqg8lhbDZ8EHYaZSixky6KJyo=";
   };
 
   postPatch = ''

pkgs/by-name/du/dump_syms/package.nix

@@ -39,14 +39,16 @@ rustPlatform.buildRustPackage {
   checkFlags = [
     # Disable tests that require network access
     # ConnectError("dns error", Custom { kind: Uncategorized, error: "failed to lookup address information: Temporary failure in name resolution" })) }', src/windows/pdb.rs:725:56
-    "--skip windows::pdb::tests::test_ntdll"
-    "--skip windows::pdb::tests::test_oleaut32"
+    "--skip=windows::pdb::tests::test_ntdll"
+    "--skip=windows::pdb::tests::test_oleaut32"
   ];
 
   passthru.tests = {
     inherit firefox-esr-unwrapped firefox-unwrapped thunderbird-unwrapped;
   };
 
+  __structuredAttrs = true;
+
   meta = {
     changelog = "https://github.com/mozilla/dump_syms/blob/v${version}/CHANGELOG.md";
     description = "Command-line utility for parsing the debugging information the compiler provides in ELF or stand-alone PDB files";

pkgs/by-name/es/esphome/package.nix

@@ -33,14 +33,14 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "esphome";
-  version = "2025.11.5";
+  version = "2025.12.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "esphome";
     repo = "esphome";
     tag = version;
-    hash = "sha256-ln+LuV//FVb+Jy6cMNth6RaFtusf/ZCLtYowlDnBybE=";
+    hash = "sha256-kp1pFNq5PNrmRzpQ2pUHXW4AEXyHEFKqofzmbe6zOJk=";
   };
 
   patches = [

pkgs/by-name/fa/fastlane/Gemfile.lock

@@ -1,40 +1,40 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    CFPropertyList (3.0.7)
-      base64
-      nkf
-      rexml
+    CFPropertyList (3.0.8)
     abbrev (0.1.2)
-    addressable (2.8.7)
-      public_suffix (>= 2.0.2, < 7.0)
+    addressable (2.8.8)
+      public_suffix (>= 2.0.2, < 8.0)
     artifactory (3.0.17)
     atomos (0.1.3)
-    aws-eventstream (1.3.2)
-    aws-partitions (1.1106.0)
-    aws-sdk-core (3.224.0)
+    aws-eventstream (1.4.0)
+    aws-partitions (1.1194.0)
+    aws-sdk-core (3.239.2)
       aws-eventstream (~> 1, >= 1.3.0)
       aws-partitions (~> 1, >= 1.992.0)
       aws-sigv4 (~> 1.9)
       base64
+      bigdecimal
       jmespath (~> 1, >= 1.6.1)
       logger
-    aws-sdk-kms (1.101.0)
-      aws-sdk-core (~> 3, >= 3.216.0)
+    aws-sdk-kms (1.118.0)
+      aws-sdk-core (~> 3, >= 3.239.1)
       aws-sigv4 (~> 1.5)
-    aws-sdk-s3 (1.186.1)
-      aws-sdk-core (~> 3, >= 3.216.0)
+    aws-sdk-s3 (1.206.0)
+      aws-sdk-core (~> 3, >= 3.234.0)
       aws-sdk-kms (~> 1)
       aws-sigv4 (~> 1.5)
-    aws-sigv4 (1.11.0)
+    aws-sigv4 (1.12.1)
       aws-eventstream (~> 1, >= 1.0.2)
     babosa (1.0.4)
     base64 (0.2.0)
+    bigdecimal (3.3.1)
     claide (1.1.0)
     colored (1.2)
     colored2 (3.1.2)
     commander (4.6.0)
       highline (~> 2.0.0)
+    csv (3.3.5)
     declarative (0.0.20)
     digest-crc (0.7.0)
       rake (>= 12.0.0, < 14.0.0)
@@ -54,14 +54,14 @@ GEM
       faraday-rack (~> 1.0)
       faraday-retry (~> 1.0)
       ruby2_keywords (>= 0.0.4)
-    faraday-cookie_jar (0.0.7)
+    faraday-cookie_jar (0.0.8)
       faraday (>= 0.8.0)
-      http-cookie (~> 1.0.0)
+      http-cookie (>= 1.0.0)
     faraday-em_http (1.0.0)
-    faraday-em_synchrony (1.0.0)
+    faraday-em_synchrony (1.0.1)
     faraday-excon (1.1.0)
     faraday-httpclient (1.0.1)
-    faraday-multipart (1.1.0)
+    faraday-multipart (1.1.1)
       multipart-post (~> 2.0)
     faraday-net_http (1.0.2)
     faraday-net_http_persistent (1.2.0)
@@ -71,15 +71,18 @@ GEM
     faraday_middleware (1.2.1)
       faraday (~> 1.0)
     fastimage (2.4.0)
-    fastlane (2.227.2)
+    fastlane (2.229.1)
       CFPropertyList (>= 2.3, < 4.0.0)
+      abbrev (~> 0.1.2)
       addressable (>= 2.8, < 3.0.0)
       artifactory (~> 3.0)
       aws-sdk-s3 (~> 1.0)
       babosa (>= 1.0.3, < 2.0.0)
+      base64 (~> 0.2.0)
       bundler (>= 1.12.0, < 3.0.0)
       colored (~> 1.2)
       commander (~> 4.6)
+      csv (~> 3.3)
       dotenv (>= 2.1.1, < 3.0.0)
       emoji_regex (>= 0.1, < 4.0)
       excon (>= 0.71.0, < 1.0.0)
@@ -99,7 +102,9 @@ GEM
       jwt (>= 2.1.0, < 3)
       mini_magick (>= 4.9.4, < 5.0.0)
       multipart-post (>= 2.0.0, < 3.0.0)
+      mutex_m (~> 0.3.0)
       naturally (~> 2.2)
+      nkf (~> 0.2.0)
       optparse (>= 0.1.1, < 1.0.0)
       plist (>= 3.1.0, < 4.0.0)
       rubyzip (>= 2.0.0, < 3.0.0)
@@ -158,37 +163,37 @@ GEM
     httpclient (2.9.0)
       mutex_m
     jmespath (1.6.2)
-    json (2.12.1)
-    jwt (2.10.1)
+    json (2.18.0)
+    jwt (2.10.2)
       base64
     logger (1.7.0)
     mini_magick (4.13.2)
     mini_mime (1.1.5)
-    multi_json (1.15.0)
+    multi_json (1.18.0)
     multipart-post (2.4.1)
     mutex_m (0.3.0)
     nanaimo (0.4.0)
-    naturally (2.2.1)
+    naturally (2.3.0)
     nkf (0.2.0)
-    optparse (0.6.0)
+    optparse (0.8.1)
     os (1.1.4)
     plist (3.7.2)
-    public_suffix (6.0.2)
-    rake (13.2.1)
+    public_suffix (7.0.0)
+    rake (13.3.1)
     representable (3.2.0)
       declarative (< 0.1.0)
       trailblazer-option (>= 0.1.1, < 0.2.0)
       uber (< 0.2.0)
     retriable (3.1.2)
-    rexml (3.4.1)
+    rexml (3.4.4)
     rouge (3.28.0)
     ruby2_keywords (0.0.5)
     rubyzip (2.4.1)
     security (0.1.5)
-    signet (0.20.0)
+    signet (0.21.0)
       addressable (~> 2.8)
       faraday (>= 0.17.5, < 3.a)
-      jwt (>= 1.5, < 3.0)
+      jwt (>= 1.5, < 4.0)
       multi_json (~> 1.10)
     simctl (1.6.10)
       CFPropertyList
@@ -225,4 +230,4 @@ DEPENDENCIES
   fastlane
 
 BUNDLED WITH
-   2.6.6
+   2.7.2

pkgs/by-name/fa/fastlane/gemset.nix

@@ -15,10 +15,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0cl2qpvwiffym62z991ynks7imsm87qmgxf0yfsmlwzkgi9qcaa6";
+      sha256 = "0mxhjgihzsx45l9wh2n0ywl9w0c6k70igm5r0d63dxkcagwvh4vw";
       type = "gem";
     };
-    version = "2.8.7";
+    version = "2.8.8";
   };
   artifactory = {
     groups = [ "default" ];
@@ -45,20 +45,20 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1mvjjn8vh1c3nhibmjj9qcwxagj6m9yy961wblfqdmvhr9aklb3y";
+      sha256 = "0fqqdqg15rgwgz3mn4pj91agd20csk9gbrhi103d20328dfghsqi";
       type = "gem";
     };
-    version = "1.3.2";
+    version = "1.4.0";
   };
   aws-partitions = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "12svi07s5hss8wq9xpaxwy1ibl64bd00hsn12v810wvz19fw823l";
+      sha256 = "04887dhff1nw3pwrfxmqwl0mwd1dzmxfdvjgn6f6n9pl6mbwdinw";
       type = "gem";
     };
-    version = "1.1106.0";
+    version = "1.1194.0";
   };
   aws-sdk-core = {
     dependencies = [
@@ -66,6 +66,7 @@
       "aws-partitions"
       "aws-sigv4"
       "base64"
+      "bigdecimal"
       "jmespath"
       "logger"
     ];
@@ -73,10 +74,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1b0pi1iibp644dn78g53s7hs7gcxghfa7h8rz3lvz8ivykisl5y6";
+      sha256 = "0fgjki9wja72m5ip1dq5zx8msn1sdw9qid4z7wd0dnqbxr2ii056";
       type = "gem";
     };
-    version = "3.224.0";
+    version = "3.239.2";
   };
   aws-sdk-kms = {
     dependencies = [
@@ -87,10 +88,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1mv8jc8sbvim2m3y3zxm8z4i5sh4x9ds7y9h5z04qfg7kjvbbn24";
+      sha256 = "1gbgf7xgg2hrrc51g3mpf0isba801w0r0z45mjnh45agdmcm3iy9";
       type = "gem";
     };
-    version = "1.101.0";
+    version = "1.118.0";
   };
   aws-sdk-s3 = {
     dependencies = [
@@ -102,10 +103,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "00sq22mfibxq3rjy9c4vj1s8yjszv8988di7z7rs8v62my53nw2v";
+      sha256 = "1v9as5bvkxk5nqfbchram8v7rsimnpp0v8wxcp20bwdw3dlf9yc5";
       type = "gem";
     };
-    version = "1.186.1";
+    version = "1.206.0";
   };
   aws-sigv4 = {
     dependencies = [ "aws-eventstream" ];
@@ -113,10 +114,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1nx1il781qg58nwjkkdn9fw741cjjnixfsh389234qm8j5lpka2h";
+      sha256 = "003ch8qzh3mppsxch83ns0jra8d222ahxs96p9cdrl0grfazywv9";
       type = "gem";
     };
-    version = "1.11.0";
+    version = "1.12.1";
   };
   babosa = {
     groups = [ "default" ];
@@ -138,20 +139,25 @@
     };
     version = "0.2.0";
   };
-  CFPropertyList = {
-    dependencies = [
-      "base64"
-      "nkf"
-      "rexml"
-    ];
+  bigdecimal = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0k1w5i4lb1z941m7ds858nly33f3iv12wvr1zav5x3fa99hj2my4";
+      sha256 = "0612spks81fvpv2zrrv3371lbs6mwd7w6g5zafglyk75ici1x87a";
       type = "gem";
     };
-    version = "3.0.7";
+    version = "3.3.1";
+  };
+  CFPropertyList = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0qa226xndfs9r6c7qj7zs6yhzrcbmicvvxsjn9x3svakh3cx169c";
+      type = "gem";
+    };
+    version = "3.0.8";
   };
   claide = {
     groups = [ "default" ];
@@ -194,6 +200,16 @@
     };
     version = "4.6.0";
   };
+  csv = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0gz7r2kazwwwyrwi95hbnhy54kwkfac5swh2gy5p5vw36fn38lbf";
+      type = "gem";
+    };
+    version = "3.3.5";
+  };
   declarative = {
     groups = [ "default" ];
     platforms = [ ];
@@ -287,10 +303,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "00hligx26w9wdnpgsrf0qdnqld4rdccy8ym6027h5m735mpvxjzk";
+      sha256 = "1fwx5720g33w3zycyq636m4fbn5fd94fxk4g0b3n7k7q4dc60h01";
       type = "gem";
     };
-    version = "0.0.7";
+    version = "0.0.8";
   };
   faraday-em_http = {
     groups = [ "default" ];
@@ -307,10 +323,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1vgrbhkp83sngv6k4mii9f2s9v5lmp693hylfxp2ssfc60fas3a6";
+      sha256 = "0l0pz1wk2mk6p6hbfd86jfad59jyk201y1db379qhc2lrxfy8g5z";
       type = "gem";
     };
-    version = "1.0.0";
+    version = "1.0.1";
   };
   faraday-excon = {
     groups = [ "default" ];
@@ -338,10 +354,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0l87r9jg06nsh24gwwd1jdnxb1zq89ffybnxab0dd90nfcf0ysw5";
+      sha256 = "00w9imp55hi81q0wsgwak90ldkk7gbyb8nzmmv8hy0s907s8z8bp";
       type = "gem";
     };
-    version = "1.1.0";
+    version = "1.1.1";
   };
   faraday-net_http = {
     groups = [ "default" ];
@@ -417,12 +433,15 @@
   fastlane = {
     dependencies = [
       "CFPropertyList"
+      "abbrev"
       "addressable"
       "artifactory"
       "aws-sdk-s3"
       "babosa"
+      "base64"
       "colored"
       "commander"
+      "csv"
       "dotenv"
       "emoji_regex"
       "excon"
@@ -442,7 +461,9 @@
       "jwt"
       "mini_magick"
       "multipart-post"
+      "mutex_m"
       "naturally"
+      "nkf"
       "optparse"
       "plist"
       "rubyzip"
@@ -461,10 +482,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1dw9smmpzhlca2zzp2pgmr2slhwnz8926s5rnjfjrclilz33p22z";
+      sha256 = "08q875hq41yvw44n55lsjz41pfawys85c4ws9swg5jwx7hf8rv3z";
       type = "gem";
     };
-    version = "2.227.2";
+    version = "2.229.1";
   };
   fastlane-sirp = {
     dependencies = [ "sysrandom" ];
@@ -668,10 +689,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0fr0dxwn5a7z5m3i16v66pc35wmwc6mgj9f8dg7ch2bwq42y73zw";
+      sha256 = "01fmiz052cvnxgdnhb3qwcy88xbv7l3liz0fkvs5qgqqwjp0c1di";
       type = "gem";
     };
-    version = "2.12.1";
+    version = "2.18.0";
   };
   jwt = {
     dependencies = [ "base64" ];
@@ -679,10 +700,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1i8wmzgb5nfhvkx1f6bhdwfm7v772172imh439v3xxhkv3hllhp6";
+      sha256 = "1x64l31nkqjwfv51s2vsm0yqq4cwzrlnji12wvaq761myx3fxq9i";
       type = "gem";
     };
-    version = "2.10.1";
+    version = "2.10.2";
   };
   logger = {
     groups = [ "default" ];
@@ -719,10 +740,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0pb1g1y3dsiahavspyzkdy39j4q377009f6ix0bh1ag4nqw43l0z";
+      sha256 = "0vsrfm36zlg7jbrd1fjbr8kmdvr8bfayrw0hdlza75987vvhrxr3";
       type = "gem";
     };
-    version = "1.15.0";
+    version = "1.18.0";
   };
   multipart-post = {
     groups = [ "default" ];
@@ -759,10 +780,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "04x1nkx6gkqzlc4phdvq05v3vjds6mgqhjqzqpcs6vdh5xyqrf59";
+      sha256 = "00cy2wg40rsasnbl0cjcj3jcghq068v445rh90q63rn2fv7j76a5";
       type = "gem";
     };
-    version = "2.2.1";
+    version = "2.3.0";
   };
   nkf = {
     groups = [ "default" ];
@@ -779,10 +800,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1306kdvq0xr333xma4452zvvvw6mx7fw20fwi6508i6dq5lh9s95";
+      sha256 = "06mx0g76bqwyrv8hxdikhyziyq8x8j8rk9l0y3scyz4hac6s3gj2";
       type = "gem";
     };
-    version = "0.6.0";
+    version = "0.8.1";
   };
   os = {
     groups = [ "default" ];
@@ -809,20 +830,20 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1543ap9w3ydhx39ljcd675cdz9cr948x9mp00ab8qvq6118wv9xz";
+      sha256 = "15dhl6k4gbax0xz8frfs4nsb6lg5zgax9vkr1pqzjmhfxddhn2gp";
       type = "gem";
     };
-    version = "6.0.2";
+    version = "7.0.0";
   };
   rake = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "17850wcwkgi30p7yqh60960ypn7yibacjjha0av78zaxwvd3ijs6";
+      sha256 = "175iisqb211n0qbfyqd8jz2g01q6xj038zjf4q0nm8k6kz88k7lc";
       type = "gem";
     };
-    version = "13.2.1";
+    version = "13.3.1";
   };
   representable = {
     dependencies = [
@@ -854,10 +875,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1jmbf6lf7pcyacpb939xjjpn1f84c3nw83dy3p1lwjx0l2ljfif7";
+      sha256 = "0hninnbvqd2pn40h863lbrn9p11gvdxp928izkag5ysx8b1s5q0r";
       type = "gem";
     };
-    version = "3.4.1";
+    version = "3.4.4";
   };
   rouge = {
     groups = [ "default" ];
@@ -910,10 +931,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "18s7xiclzajp9w9cmq8k28iy5ig1zpx1zv1mrm416cb2c0m0wrmw";
+      sha256 = "0nydm087m5c3j85gvzvz30w1qb9pl2lzpznw746jha29ybxyj5yn";
       type = "gem";
     };
-    version = "0.20.0";
+    version = "0.21.0";
   };
   simctl = {
     dependencies = [

pkgs/by-name/fa/faugus-launcher/package.nix

@@ -18,14 +18,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "faugus-launcher";
-  version = "1.11.3";
+  version = "1.11.4";
   pyproject = false;
 
   src = fetchFromGitHub {
     owner = "Faugus";
     repo = "faugus-launcher";
     tag = version;
-    hash = "sha256-lmQctCjWKBdEtALIdasQ6M3KwB89mmwier8VqecnmzE=";
+    hash = "sha256-zkrjZnsugpdG7SAkSAt3OicxIr2fA1j1/Lyh0lRScWA=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/fu/fulcio/package.nix

@@ -15,13 +15,13 @@
 
 buildGoModule rec {
   pname = "fulcio";
-  version = "1.8.3";
+  version = "1.8.4";
 
   src = fetchFromGitHub {
     owner = "sigstore";
     repo = "fulcio";
     tag = "v${version}";
-    hash = "sha256-yR8Q1ksz1fB8sc8NA6Hr4dwe5VXerEgIQYiIpNTOEf8=";
+    hash = "sha256-+5aYfHR8v7A5U73rTkXoUInWDt044JcPDwQt2iKaqBw=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -33,7 +33,7 @@ buildGoModule rec {
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-  vendorHash = "sha256-G+vtNCm9Ecpj5IzxXojzcjGEQL47R5gNMFI/JCs7C0w=";
+  vendorHash = "sha256-EtanisQJclkIh2m+M51kGrWvOP/4Y+Y2zbxfSJ25cLk=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/ga/gate/package.nix

@@ -6,7 +6,7 @@
 
 let
   pname = "gate";
-  version = "0.61.0";
+  version = "0.62.0";
 in
 buildGoModule {
   inherit pname version;
@@ -15,7 +15,7 @@ buildGoModule {
     owner = "minekube";
     repo = "gate";
     tag = "v${version}";
-    hash = "sha256-HCxsydmCjhbL2hiZ4EEjsODXKWoAv2Azi/HvUU6aOIg=";
+    hash = "sha256-8zvHC6Ghf2IziCLYTxGe/z3u6li37EBOb5AK2gGhoUQ=";
   };
 
   vendorHash = "sha256-f7SkECS80Lwkd0xSzHq+x05ZBjBYKXsA4rPidyIAYak=";

pkgs/by-name/ge/gelly/package.nix

@@ -0,0 +1,80 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  dbus,
+  glib,
+  wrapGAppsHook4,
+  glib-networking,
+  gst_all_1,
+  gtk4,
+  libadwaita,
+  libseccomp,
+  openssl,
+  bubblewrap,
+  glycin-loaders,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "gelly";
+  version = "0.11.0";
+
+  src = fetchFromGitHub {
+    owner = "Fingel";
+    repo = "gelly";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-fZrSfxbWkHX5yUwC4NkDmXcNDTvsdwceEBkmUmxWcoQ=";
+  };
+
+  cargoHash = "sha256-vnFbRvq+EPIcJ4w+QKpkXrl5BLr/KbELbmpRGQwcaUE=";
+
+  nativeBuildInputs = [
+    pkg-config
+    glib # for `glib-compile-schemas` and `glib-compile-resources` (used in upstream's `build.rs`)
+    wrapGAppsHook4
+  ];
+
+  buildInputs = [
+    dbus
+    # Very important, so that gstreamer supports TLS
+    glib-networking
+    gst_all_1.gstreamer
+    gst_all_1.gst-plugins-base
+    gst_all_1.gst-plugins-good
+    gst_all_1.gst-plugins-bad
+    gst_all_1.gst-plugins-ugly
+    gst_all_1.gst-plugins-rs
+    gtk4
+    libadwaita
+    libseccomp
+    openssl
+  ];
+
+  # Adapted from upstream's `justfile`
+  postInstall = ''
+    install -Dm644 resources/io.m51.Gelly.desktop $out/share/applications/io.m51.Gelly.desktop
+    install -Dm644 resources/io.m51.Gelly.metainfo.xml $out/share/metainfo/io.m51.Gelly.metainfo.xml
+    install -Dm644 resources/io.m51.Gelly.svg $out/share/icons/hicolor/scalable/apps/io.m51.Gelly.svg
+
+    # Use the gschemas location as specified in the glib hook
+    install -Dm644 resources/io.m51.Gelly.gschema.xml $out/share/gsettings-schemas/$name/glib-2.0/schemas/io.m51.Gelly.gschema.xml
+    glib-compile-schemas $out/share/gsettings-schemas/$name/glib-2.0/schemas/
+  '';
+
+  preFixup = ''
+    gappsWrapperArgs+=(
+      --prefix PATH : "$out/bin:${lib.makeBinPath [ bubblewrap ]}"
+      --prefix XDG_DATA_DIRS : "${glycin-loaders}/share"
+    )
+  '';
+
+  meta = {
+    description = "A Jellyfin GTK client for Linux focused on music";
+    homepage = "https://github.com/Fingel/gelly";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ minijackson ];
+    mainProgram = "gelly";
+    platforms = lib.platforms.linux;
+  };
+})

pkgs/by-name/gk/gkrellm/package.nix

@@ -17,11 +17,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gkrellm";
-  version = "2.4.0";
+  version = "2.5.0";
 
   src = fetchurl {
     url = "http://gkrellm.srcbox.net/releases/gkrellm-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-b4NmV2C5Nq1LVfkYKx7HYB+vOKDyXqHkvdyZZQiPAy0=";
+    hash = "sha256-aMdaA6Brk1r6k9MzHKHC2GLB1Qw+nfGdmo1Ilw12a1U=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/go/goa/package.nix

@@ -6,15 +6,15 @@
 
 buildGoModule rec {
   pname = "goa";
-  version = "3.23.2";
+  version = "3.23.4";
 
   src = fetchFromGitHub {
     owner = "goadesign";
     repo = "goa";
     rev = "v${version}";
-    hash = "sha256-8AcpYTc909MyQYJBArHypMOefNcj1DaJcM2w4NpmcLI=";
+    hash = "sha256-7+hOXJU2a39ytn08FlR/YAhOnAmVL5JxdcvF1AlOxHk=";
   };
-  vendorHash = "sha256-2H5VtNZiOnx1gFSVaBu7q4HTeLhBbIDK01fixBB66M4=";
+  vendorHash = "sha256-VSjiEgkjLMFRThNI4G7O91wpF8CYaIVYOrtE49S/o3w=";
 
   subPackages = [ "cmd/goa" ];
 

pkgs/by-name/go/google-chrome/package.nix

@@ -170,11 +170,11 @@ let
 
   linux = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "143.0.7499.109";
+    version = "143.0.7499.146";
 
     src = fetchurl {
       url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb";
-      hash = "sha256-36YeOTThfFzMQs+wxxFLwwUmp0uPBb0+b8TD7LG1e+0=";
+      hash = "sha256-GhEPDoloqlnEYZ/laVaQdNolxnW9DBVx2Ete9Mj0GDQ=";
     };
 
     # With strictDeps on, some shebangs were not being patched correctly
@@ -272,11 +272,11 @@ let
 
   darwin = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "143.0.7499.110";
+    version = "143.0.7499.147";
 
     src = fetchurl {
-      url = "http://dl.google.com/release2/chrome/p5xbkc3osahdfsgniofymq5nqq_143.0.7499.110/GoogleChrome-143.0.7499.110.dmg";
-      hash = "sha256-Ed0THsSrWWK0x/h+yhzQdU8PBrZkM/tLiqDEnWAtCMw=";
+      url = "http://dl.google.com/release2/chrome/ad7e74qqebdgksg3f2kar635d3fq_143.0.7499.147/GoogleChrome-143.0.7499.147.dmg";
+      hash = "sha256-/gwm6RxHsqd6cMiGI8P2ZhqKx+/LTcpXAs4dfNZnBn8=";
     };
 
     dontPatch = true;

pkgs/by-name/gr/greenmask/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "greenmask";
-  version = "0.2.14";
+  version = "0.2.15";
 
   src = fetchFromGitHub {
     owner = "GreenmaskIO";
     repo = "greenmask";
     tag = "v${version}";
-    hash = "sha256-AHZJWYHfUKYNXPP6vFIM5tdr5aQ8q2pkqB/M1lhxUic=";
+    hash = "sha256-/At0boolTyge4VNy1EDpK09Yo7hLAdq6SvCbyBTKGbw=";
   };
 
   vendorHash = "sha256-t2U65GAGBGdMRXPTkCQCuXfLuqohA6erTlvAN/xx/ek=";

pkgs/by-name/hi/hifile/package.nix

@@ -27,6 +27,7 @@ appimageTools.wrapType2 {
     install -m 444 -D ${appimageContents}/HiFile.png $out/share/icons/hicolor/512x512/apps/HiFile.png
     substituteInPlace $out/share/applications/HiFile.desktop \
       --replace-fail 'Exec=HiFile' 'Exec=hifile'
+    echo "StartupWMClass=app.hifile.www.HiFile" >> $out/share/applications/HiFile.desktop
   '';
 
   passthru.updateScript = ./update.sh;

pkgs/by-name/hu/hugin/package.nix

@@ -36,11 +36,11 @@
 
 stdenv.mkDerivation rec {
   pname = "hugin";
-  version = "2024.0.1";
+  version = "2025.0.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/hugin/hugin-${version}.tar.bz2";
-    hash = "sha256-E+wM3utOtjFJyDN2jT43Tnz1pqjY0C1QiFzklvBbp+Q=";
+    hash = "sha256-DeJ6XVQy421OXTisJde8r8e33VQqqwMWQKYe1mdnB2w";
   };
 
   buildInputs = [
@@ -82,6 +82,13 @@ stdenv.mkDerivation rec {
   # disable installation of the python scripting interface
   cmakeFlags = [ "-DBUILD_HSI:BOOl=OFF" ];
 
+  # hugin libs are added to NEEDED but not to RUNPATH
+  postFixup = ''
+    for p in $out/bin/..*; do
+      patchelf "$p" --add-rpath $out/lib/hugin
+    done
+  '';
+
   postInstall = ''
     for p in $out/bin/*; do
       wrapProgram "$p" \

pkgs/by-name/hy/hydra/package.nix

@@ -38,7 +38,7 @@
   mdbook,
   foreman,
   python3,
-  libressl,
+  netcat,
   cacert,
   glibcLocales,
   meson,
@@ -210,7 +210,7 @@ stdenv.mkDerivation (finalAttrs: {
     foreman
     glibcLocales
     python3
-    libressl.nc
+    netcat
     nix-eval-jobs
     openldap
     postgresql

pkgs/by-name/hy/hyprspace/package.nix

@@ -9,18 +9,18 @@
 
 buildGoModule rec {
   pname = "hyprspace";
-  version = "0.11.0";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "hyprspace";
     repo = "hyprspace";
     tag = "v${version}";
-    hash = "sha256-Lv/Mb7vj1bUj5TajIdM6bu8299y+B3sZfE6xlA6sXcM=";
+    hash = "sha256-VOufAPhCbLzVxrj/XKwunJkxUx0EAovV4+adrQLwcoI=";
   };
 
   env.CGO_ENABLED = "0";
 
-  vendorHash = "sha256-97uIl3b3hs3BCLH7UZX8NU3kLloVQOCN9ygsdxsfass=";
+  vendorHash = "sha256-m7asItMMFm/lHNl4nemvuMU0mn69kTrC1XK4rUCOor4=";
 
   ldflags = [
     "-s"

pkgs/by-name/in/intel-graphics-compiler/package.nix

@@ -19,7 +19,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "intel-graphics-compiler";
-  version = "2.22.2";
+  version = "2.24.8";
 
   # See the repository for expected versions:
   # <https://github.com/intel/intel-graphics-compiler/blob/v2.16.0/documentation/build_ubuntu.md#revision-table>
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
       owner = "intel";
       repo = "intel-graphics-compiler";
       tag = "v${version}";
-      hash = "sha256-4Tp9kY+Sbirf4kN/C5Q1ClcoUI/fhfUJpqL+/eO8a/o=";
+      hash = "sha256-h/YlZatUn61M5/F4msJljZDWcQyivgCAi1HC9CXvTts=";
     })
     (fetchFromGitHub {
       name = "llvm-project";
@@ -42,22 +42,22 @@ stdenv.mkDerivation rec {
       name = "vc-intrinsics";
       owner = "intel";
       repo = "vc-intrinsics";
-      tag = "v0.23.4";
-      hash = "sha256-zorhOhBTcymnAlShJxJecXD+HIfScGouhSea/A3tBXE=";
+      tag = "v0.24.1";
+      hash = "sha256-IpScRc+sWEcD8ZH5TinMPVFq1++vIVp774TJsg8mUMY=";
     })
     (fetchFromGitHub {
       name = "opencl-clang";
       owner = "intel";
       repo = "opencl-clang";
-      tag = "v16.0.5";
-      hash = "sha256-JfynEsCXltVdVY/LqWvZwzWfzEFUz6nI9Zub+bze1zE=";
+      tag = "v16.0.6";
+      hash = "sha256-qxMnKQWQ32yF2rZGGOel2ynZJKfbAlk9U+ttWuzYRog=";
     })
     (fetchFromGitHub {
       name = "llvm-spirv";
       owner = "KhronosGroup";
       repo = "SPIRV-LLVM-Translator";
-      tag = "v16.0.18";
-      hash = "sha256-JwFwjHUv1tBC7KDWAhkse557R6QCaVjOekhndQlVetM=";
+      tag = "v16.0.19";
+      hash = "sha256-GTTEThCNPyq0CpD6Vp4L0ZEEqOZ7uLbt9sdgXLs7MUg=";
     })
   ];
 
@@ -90,7 +90,7 @@ stdenv.mkDerivation rec {
     git -C llvm-project init
     git -C llvm-project -c user.name=nixbld -c user.email= commit --allow-empty -m stub
     substituteInPlace llvm-project/llvm/projects/opencl-clang/cmake/modules/CMakeFunctions.cmake \
-      --replace-fail 'COMMAND ''${GIT_EXECUTABLE} am --3way --ignore-whitespace -C0 ' \
+      --replace-fail 'COMMAND ''${GIT_EXECUTABLE} am --3way --keep-non-patch --ignore-whitespace -C0 ' \
                      'COMMAND patch -p1 --ignore-whitespace -i '
 
     # match default LLVM version with our provided version to apply correct patches

pkgs/by-name/ku/kubevpn/package.nix

@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "kubevpn";
-  version = "2.9.10";
+  version = "2.9.11";
 
   src = fetchFromGitHub {
     owner = "KubeNetworks";
     repo = "kubevpn";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5yuJfGWNEQ/1ufV1rVze2JrL/67/UlYdG2YH9i+gI3w=";
+    hash = "sha256-x6GYkLGPiH061QQW9YnTeHLNTrM5Q8Odm0seODQRZgk=";
   };
 
   vendorHash = null;

pkgs/by-name/lc/lctime/package.nix

@@ -11,7 +11,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "lctime";
-  version = "0.0.26";
+  version = "0.0.27";
   pyproject = true;
 
   src = fetchFromGitea {
@@ -19,7 +19,7 @@ python3Packages.buildPythonApplication rec {
     owner = "librecell";
     repo = "lctime";
     tag = version;
-    hash = "sha256-oNmeV8r1dtO2y27jAJnlx4mKGjhzL07ad2yBdOLwgF0=";
+    hash = "sha256-KKZhsKNTr+J5+rLUdlwGMsUCa6NYY1X9yaujPe1c0Do=";
   };
 
   build-system = with python3Packages; [
@@ -30,7 +30,6 @@ python3Packages.buildPythonApplication rec {
     joblib
     klayout
     liberty-parser
-    matplotlib
     networkx
     numpy
     pyspice
@@ -38,6 +37,8 @@ python3Packages.buildPythonApplication rec {
     sympy
   ];
 
+  optional-dependencies.debug = with python3Packages; [ matplotlib ];
+
   nativeCheckInputs = with python3Packages; [
     pytestCheckHook
     ngspice

pkgs/by-name/lg/lgpio/package.nix

@@ -55,6 +55,7 @@ mkDerivation rec {
 
   makeFlags = [
     "prefix=$(out)"
+    "CROSS_PREFIX=${stdenv.cc.targetPrefix}"
   ];
 
   meta = {

pkgs/by-name/li/libnspsl/package.nix

@@ -4,6 +4,7 @@
   fetchurl,
   pkg-config,
   netsurf-buildsystem,
+  publicsuffix-list,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -15,6 +16,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-NoTOwy9VXa7UMZk+C/bL2TdPbJCERiN+CJ8LYdaUrIA=";
   };
 
+  postPatch = ''
+    rm public_suffix_list.dat
+    ln -s ${publicsuffix-list}/share/publicsuffix/public_suffix_list.dat public_suffix_list.dat
+  '';
+
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [ netsurf-buildsystem ];

pkgs/by-name/lu/lunar-client/package.nix

@@ -7,11 +7,11 @@
 
 appimageTools.wrapType2 rec {
   pname = "lunarclient";
-  version = "3.5.11";
+  version = "3.5.13";
 
   src = fetchurl {
     url = "https://launcherupdates.lunarclientcdn.com/Lunar%20Client-${version}-ow.AppImage";
-    hash = "sha512-YYsUyuJMYos8aiOCbQy7FlVRakfBXC63HiTbg3YBd8I+kR1zA38FWAkRZeAiA3WyUutmJLJxaDtwBzhq/QgQ7w==";
+    hash = "sha512-MvR5gnJxCUuYstgpGoux2oA3evN9bqXmnEjPBSvBSGzMiZmz0Iox5cfBeaHf+GlwL+9rFs2bhKaeJSinI2FQaw==";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/by-name/ma/maid/Gemfile

@@ -1,3 +1,3 @@
 source 'https://rubygems.org'
-gem 'maid', '~> 0.10.0'
+gem 'maid', '~> 0.11.2'
 gem 'rake'

pkgs/by-name/ma/maid/Gemfile.lock

@@ -21,7 +21,7 @@ GEM
       rb-fsevent (~> 0.10, >= 0.10.3)
       rb-inotify (~> 0.9, >= 0.9.10)
     logger (1.7.0)
-    maid (0.10.0)
+    maid (0.11.2)
       deprecated (~> 3.0.0)
       dimensions (>= 1.0.0, < 2.0)
       escape (>= 0.0.1, < 0.1.0)
@@ -31,7 +31,7 @@ GEM
       mime-types (~> 3.0, < 4.0)
       rubyzip (~> 2.3.2)
       rufus-scheduler (~> 3.8.2)
-      thor (~> 1.2.1)
+      thor (~> 1.4.0)
       xdg (~> 2.2.3)
     mime-types (3.7.0)
       logger
@@ -45,7 +45,7 @@ GEM
     rubyzip (2.3.2)
     rufus-scheduler (3.8.2)
       fugit (~> 1.1, >= 1.1.6)
-    thor (1.2.2)
+    thor (1.4.0)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
     xdg (2.2.5)
@@ -54,8 +54,8 @@ PLATFORMS
   ruby
 
 DEPENDENCIES
-  maid (~> 0.10.0)
+  maid (~> 0.11.2)
   rake
 
 BUNDLED WITH
-   2.6.6
+   2.7.2

pkgs/by-name/ma/maid/gemset.nix

@@ -160,10 +160,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0v1lhwgxyli10rinw6h33ikhskx9j3b20h7plrx8c69z05sfsdd9";
+      sha256 = "154rhbdplhrirxpli2jwwsmzcrk8vj51cn6zh8r7lp97vlrkybgp";
       type = "gem";
     };
-    version = "0.10.0";
+    version = "0.11.2";
   };
   mime-types = {
     dependencies = [
@@ -256,10 +256,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0k7j2wn14h1pl4smibasw0bp66kg626drxb59z7rzflch99cd4rg";
+      sha256 = "0gcarlmpfbmqnjvwfz44gdjhcmm634di7plcx2zdgwdhrhifhqw7";
       type = "gem";
     };
-    version = "1.2.2";
+    version = "1.4.0";
   };
   tzinfo = {
     dependencies = [ "concurrent-ruby" ];

pkgs/by-name/ma/mathjax/package.nix

@@ -5,13 +5,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "mathjax";
-  version = "4.0.0";
+  version = "4.1.0";
 
   src = fetchFromGitHub {
     owner = "mathjax";
     repo = "mathjax";
     tag = finalAttrs.version;
-    hash = "sha256-36lTjx4zuFeT1+QFemiQcCZfAjyh7vFPpYeRhO2mzGI=";
+    hash = "sha256-ri8j/S0mS0I12y3o8NCCMcR3FHeuaNKg/+zEkNB2uXU=";
   };
 
   installPhase = ''

pkgs/by-name/md/mdbook-toc/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mdbook-toc";
-  version = "0.15.1";
+  version = "0.15.2";
 
   src = fetchFromGitHub {
     owner = "badboy";
     repo = "mdbook-toc";
     tag = version;
-    sha256 = "sha256-FPbZH8cEYQ9wbSm6jA5/uiX8Wgx/FyuIJ/gPgSKUhBA=";
+    sha256 = "sha256-gzwsPRhsAQTraiK/N5dKEj8NTpV/mYmECpS4KVl4Ql8=";
   };
 
-  cargoHash = "sha256-haHJkyYAc4+ODJNEWiXzbl1xbJ7pyrtnPX/+ubjvX44=";
+  cargoHash = "sha256-+YvEptJlNjomIsyS7cNImwYa1SxawY05e5vq9VmrktA=";
 
   meta = {
     description = "Preprocessor for mdbook to add inline Table of Contents support";

pkgs/by-name/md/mdfried/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mdfried";
-  version = "0.14.6";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "benjajaja";
     repo = "mdfried";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Ys/CoyaIKVVRtQfmjc4XOABdrktZ1lIPNqw0V8jlY5I=";
+    hash = "sha256-V++xkJBnTlqzcsw6BDkrqScIV+phzxyDqQXcV34L4ps=";
   };
 
-  cargoHash = "sha256-ipNhqxcc+Kfr6XtF3QtFh896YK5v1u4kXapiMUjC9n8=";
+  cargoHash = "sha256-qnsJkwAmBcakYcoqGdYRqfN6e46PG5IH6SAXLvy3mM8=";
 
   doCheck = true;
 

pkgs/by-name/me/meilisearch/package.nix

@@ -8,18 +8,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "meilisearch";
-  version = "1.28.2";
+  version = "1.30.0";
 
   src = fetchFromGitHub {
     owner = "meilisearch";
     repo = "meiliSearch";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Sp3YAAOgkBoBIz4Yj0AKJ0aI0HBAIg75E9BjtzGxXLM=";
+    hash = "sha256-oq/jP+b4KwjpVvj/yBmzIOm+TM13dup40dAD0ID2Juc=";
   };
 
   cargoBuildFlags = [ "--package=meilisearch" ];
 
-  cargoHash = "sha256-W6nTVgD0U4bZ0ybGU6wTQmp+SVvorZCqKOJnf1GG1gU=";
+  cargoHash = "sha256-ooggvDUSrtY6X+GGHjU/rsP/q9Br2OUMTvVYUfVdAtk=";
 
   # Default features include mini dashboard which downloads something from the internet.
   buildNoDefaultFeatures = true;

pkgs/by-name/mi/mint-l-theme/package.nix

@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "mint-l-theme";
-  version = "2.0.3";
+  version = "2.0.4";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "mint-l-theme";
     rev = version;
-    hash = "sha256-RdcojX+8SQDJ9LPb81iMzdoCZBpoypf/+aQcgotnVGE=";
+    hash = "sha256-jrNVeeqOBDf77Lz68qyjHllA4C3PQRySYQH7Sva2UHU=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/mi/mint-themes/package.nix

@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "mint-themes";
-  version = "2.3.4";
+  version = "2.3.5";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "mint-themes";
     rev = version;
-    hash = "sha256-A4k9iy0d9pGPSYa4m3tAv2GKhFuJPrQODbv+LcP/YXU=";
+    hash = "sha256-folnnA4By1Dd1amriGiTl5mOxpcnaFjdp/UsjacE8GA=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/mo/models-dev/package.nix

@@ -9,12 +9,12 @@
 }:
 let
   pname = "models-dev";
-  version = "0-unstable-2025-12-11";
+  version = "0-unstable-2025-12-15";
   src = fetchFromGitHub {
     owner = "sst";
     repo = "models.dev";
-    rev = "0c66fc84a2deb49500b9bb67e37d87428f544119";
-    hash = "sha256-HAGUVpdW0gLXCo3jCU7pnjvh1cTp8xnU59MXgCwQkGs=";
+    rev = "14c7777ca5952619b9dcf46e5bf60a7dd25080be";
+    hash = "sha256-+JJtaUmjwNXPnBP2jCc/r+Yswa+xViH9CVZzdmyXo+A=";
   };
 
   node_modules = stdenvNoCC.mkDerivation {

pkgs/by-name/mo/monado/package.nix

@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitLab,
-  fetchpatch2,
   writeText,
   bluez,
   cjson,
@@ -65,24 +64,16 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "monado";
-  version = "25.0.0";
+  version = "25.1.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "monado";
     repo = "monado";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VxTxvw+ftqlh3qF5qWxpK1OJsRowkRXu0xEH2bDckUA=";
+    hash = "sha256-hUSm76PV+FhvzhiYMUbGcNDQMK1TZCPYh1PNADJmdSU=";
   };
 
-  patches = [
-    # Remove with v26
-    (fetchpatch2 {
-      url = "https://gitlab.freedesktop.org/monado/monado/-/commit/2a6932d46dad9aa957205e8a47ec2baa33041076.patch";
-      hash = "sha256-CZMbGgx7mEDcjcoRJHDZ5P6BecFW8CB4fpzxQ9bpAvE=";
-    })
-  ];
-
   nativeBuildInputs = [
     cmake
     doxygen

pkgs/by-name/ne/nemo/package.nix

@@ -14,6 +14,7 @@
   cinnamon-desktop,
   xapp,
   xapp-symbolic-icons,
+  xdg-user-dirs,
   libexif,
   json-glib,
   exempi,
@@ -36,13 +37,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "nemo";
-  version = "6.6.1";
+  version = "6.6.2";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "nemo";
     rev = version;
-    hash = "sha256-oJvGuPm6FOknSe+5TDLNf0eoE3xC+i78SkYdJUBY4PU=";
+    hash = "sha256-5jgD2C71sQkqnAGsnsjK8W9qaLtNtGeYLXsV2+7u2jU=";
   };
 
   patches = [
@@ -95,13 +96,19 @@ stdenv.mkDerivation rec {
 
   preFixup = ''
     gappsWrapperArgs+=(
-       --prefix XDG_DATA_DIRS : ${
+       --prefix XDG_DATA_DIRS : "${
          lib.makeSearchPath "share" [
            # For non-fd.o icons.
            xapp
            xapp-symbolic-icons
          ]
-       }
+       }"
+       --prefix PATH : "${
+         lib.makeBinPath [
+           # For xdg-user-dirs-update.
+           xdg-user-dirs
+         ]
+       }"
     )
   '';
 

pkgs/by-name/ne/networkmanager-l2tp/package.nix

@@ -23,13 +23,13 @@
 stdenv.mkDerivation rec {
   name = "${pname}${lib.optionalString withGnome "-gnome"}-${version}";
   pname = "NetworkManager-l2tp";
-  version = "1.20.20";
+  version = "1.20.22";
 
   src = fetchFromGitHub {
     owner = "nm-l2tp";
     repo = "network-manager-l2tp";
     rev = version;
-    hash = "sha256-AmbDWBCUG9fvqA6iJopYtbitdRwv2faWvIeKN90p234=";
+    hash = "sha256-TuYLNjogR3psb1B9zonHzRQext0ROS4ueD2WcWkseJk=";
   };
 
   patches = [

pkgs/by-name/ne/nextcloud-client/package.nix

@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation rec {
   pname = "nextcloud-client";
-  version = "4.0.3";
+  version = "4.0.4";
 
   outputs = [
     "out"
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     owner = "nextcloud-releases";
     repo = "desktop";
     tag = "v${version}";
-    hash = "sha256-PwL5USUP60ePxn0U7zyx6hHQlx4xKVquZ1QLTWTsSRU=";
+    hash = "sha256-BEjsIx0knmTj6kgM7fsJV5XN660cRe9DbYxeL7YHPRo=";
   };
 
   patches = [

pkgs/by-name/no/noriskclient-launcher-unwrapped/disable-bundling.patch

@@ -0,0 +1,22 @@
+diff --git a/src-tauri/tauri.conf.json b/src-tauri/tauri.conf.json
+index bb58d13..c1046f8 100644
+--- a/src-tauri/tauri.conf.json
++++ b/src-tauri/tauri.conf.json
+@@ -100,7 +100,7 @@
+         }
+       }
+     },
+-    "active": true,
++    "active": false,
+     "targets": ["app", "dmg", "deb", "appimage", "nsis"],
+     "icon": [
+       "icons/32x32.png",
+@@ -109,7 +109,7 @@
+       "icons/icon.icns",
+       "icons/icon.ico"
+     ],
+-    "createUpdaterArtifacts": true,
++    "createUpdaterArtifacts": false,
+     "fileAssociations": [
+       {
+         "ext": ["noriskpack"],

pkgs/by-name/no/noriskclient-launcher-unwrapped/java-from-path.patch

@@ -0,0 +1,34 @@
+diff --git a/src-tauri/src/minecraft/downloads/java_download.rs b/src-tauri/src/minecraft/downloads/java_download.rs
+index 25ab9b2..d1af896 100644
+--- a/src-tauri/src/minecraft/downloads/java_download.rs
++++ b/src-tauri/src/minecraft/downloads/java_download.rs
+@@ -9,6 +9,7 @@ use flate2::read::GzDecoder;
+ use futures::future::try_join_all;
+ use log::{debug, error, info};
+ use reqwest;
++use std::env;
+ use std::fs::File;
+ use std::io::Cursor;
+ use std::path::PathBuf;
+@@ -526,6 +527,21 @@ impl JavaDownloadService {
+             ],
+         };
+ 
++        let target = format!("openjdk-{}", version);
++        match env::var_os("PATH") {
++            Some(paths) => {
++                for path in env::split_paths(&paths) {
++                    if let Some(path_str) = path.to_str() {
++                        if path_str.contains(&target) {
++                            debug!("Found Java binary at: {:?}", path);
++                            return Ok(path)
++                        }
++                    }
++                }
++            }
++            none => debug!("PATH is not defined"),
++        }
++
+         // Try all possible paths
+         for java_binary in java_binary_paths {
+             debug!("Checking for Java binary at: {:?}", java_binary);

pkgs/by-name/no/noriskclient-launcher-unwrapped/package.nix

@@ -0,0 +1,92 @@
+{
+  cargo-tauri,
+  desktop-file-utils,
+  fetchFromGitHub,
+  fetchYarnDeps,
+  glib,
+  gtk3,
+  libayatana-appindicator,
+  lib,
+  nix-update-script,
+  nodejs,
+  openssl,
+  pkg-config,
+  rustPlatform,
+  webkitgtk_4_1,
+  yarnConfigHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "noriskclient-launcher-unwrapped";
+  version = "0.6.14";
+
+  src = fetchFromGitHub {
+    owner = "NoRiskClient";
+    repo = "noriskclient-launcher";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-9UUNIS8r/695maQ2j2+Wj2L5qy55Wfs/MNhKJnwC6GI=";
+  };
+
+  yarnOfflineCache = fetchYarnDeps {
+    yarnLock = "${finalAttrs.src}/yarn.lock";
+    hash = "sha256-IWgP4VEyEBNsxALKGMpk8WZCIc76qcEu5K+kYqsdYkQ=";
+  };
+
+  patches = [
+    # The tauri.conf.json is configured to build multiple apps. We don't want that here.
+    ./disable-bundling.patch
+
+    # Make the launcher find java from PATH, instead of downloading its own, which is not going to work on NixOS.
+    ./java-from-path.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace $cargoDepsCopy/libappindicator-sys-*/src/lib.rs \
+      --replace-fail "libayatana-appindicator3.so.1" "${libayatana-appindicator}/lib/libayatana-appindicator3.so.1"
+  '';
+
+  cargoHash = "sha256-heSUEW7r9Lt26Fu68Jo/7BHW6Qmp8GrRSavukCS+ySk=";
+
+  cargoRoot = "src-tauri";
+  buildAndTestSubdir = finalAttrs.cargoRoot;
+
+  nativeBuildInputs = [
+    cargo-tauri.hook
+    desktop-file-utils
+    nodejs
+    pkg-config
+    yarnConfigHook
+  ];
+
+  buildInputs = [
+    glib
+    gtk3
+    libayatana-appindicator
+    openssl
+    webkitgtk_4_1
+  ];
+
+  postInstall = ''
+    desktop-file-edit \
+    --set-name "NoRiskClient Launcher" \
+    --set-comment "Launcher for NoRiskClient" \
+    --set-key="Categories" --set-value="Game" \
+    --set-key="Keywords" --set-value="nrc;minecraft;mc;" \
+    $out/share/applications/NoRisk\ Launcher.desktop
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Minecraft Launcher for NoRisk Client";
+    homepage = "https://norisk.gg";
+    license = lib.licenses.gpl3Only;
+    longDescription = ''
+      An easy way to launch the NoRisk Client, create modpacks,
+      manage content for Minecraft, and much more - written in tauri.
+    '';
+    maintainers = with lib.maintainers; [ hythera ];
+    mainProgram = "noriskclient-launcher-v3";
+    platforms = lib.platforms.linux;
+  };
+})

pkgs/by-name/no/noriskclient-launcher/package.nix

@@ -0,0 +1,101 @@
+{
+  addDriverRunpath,
+  alsa-lib,
+  flite,
+  glib,
+  glib-networking,
+  gsettings-desktop-schemas,
+  jdk17,
+  jdk21,
+  jdk8,
+  jdks ? [
+    jdk8
+    jdk17
+    jdk21
+  ],
+  lib,
+  libGL,
+  libjack2,
+  libpulseaudio,
+  libX11,
+  libXcursor,
+  libXext,
+  libXrandr,
+  libXxf86vm,
+  noriskclient-launcher-unwrapped,
+  pipewire,
+  stdenv,
+  symlinkJoin,
+  udev,
+  wrapGAppsHook4,
+}:
+
+symlinkJoin {
+  pname = "noriskclient-launcher";
+  inherit (noriskclient-launcher-unwrapped) version;
+
+  paths = [ noriskclient-launcher-unwrapped ];
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    glib
+    wrapGAppsHook4
+  ];
+
+  buildInputs = [
+    glib-networking
+    gsettings-desktop-schemas
+  ];
+
+  runtimeDependencies = lib.optionalString stdenv.hostPlatform.isLinux (
+    lib.makeLibraryPath [
+      addDriverRunpath.driverLink
+
+      # glfw
+      libGL
+      libX11
+      libXcursor
+      libXext
+      libXrandr
+      libXxf86vm
+
+      # narrator support
+      flite
+
+      # openal
+      alsa-lib
+      libjack2
+      libpulseaudio
+      pipewire
+
+      # oshi
+      udev
+    ]
+  );
+
+  postBuild = ''
+    gappsWrapperArgs+=(
+      --prefix PATH : ${lib.makeSearchPath "bin/java" jdks}
+      ${lib.optionalString stdenv.hostPlatform.isLinux ''
+        --set LD_LIBRARY_PATH $runtimeDependencies
+      ''}
+    )
+
+    glibPostInstallHook
+    gappsWrapperArgsHook
+    wrapGAppsHook
+  '';
+
+  meta = {
+    inherit (noriskclient-launcher-unwrapped.meta)
+      description
+      homepage
+      license
+      longDescription
+      maintainers
+      mainProgram
+      platforms
+      ;
+  };
+}

pkgs/by-name/no/notesnook/package.nix

@@ -9,7 +9,7 @@
 
 let
   pname = "notesnook";
-  version = "3.2.4";
+  version = "3.3.5";
 
   inherit (stdenv.hostPlatform) system;
   throwSystem = throw "Unsupported system: ${system}";
@@ -27,10 +27,10 @@ let
     url = "https://github.com/streetwriters/notesnook/releases/download/v${version}/notesnook_${suffix}";
     hash =
       {
-        x86_64-linux = "sha256-n4yDBaDq09idmjRZ+y2zT7rZcI4wsDhMidx9sNox5cM=";
-        aarch64-linux = "sha256-UQFySvvs+paCzt2XSrbYiChEQJIbef3rCOST1r+zZx8=";
-        x86_64-darwin = "sha256-42US8m6ZbGTUNkU0p4y0pgXKiSsjZZHlQhwv2/LDlO4=";
-        aarch64-darwin = "sha256-eJVyuL5nBGMr8WhOK4NOMNSMYBASQZbsbLPLgug7ZNs=";
+        x86_64-linux = "sha256-jvQph74dMQgino3K1ZFLT/fsJVdTHVqMQaW0RQhfci0=";
+        aarch64-linux = "sha256-jrKmZmdx1T1wrlM0y195Z2MsI1XpFn0gyFyf7N/aUzo=";
+        x86_64-darwin = "sha256-bJ+sq6/lZcLcM7R2KAigemdpRDqSiExfcSunNQ7cGw0=";
+        aarch64-darwin = "sha256-DTY0gq62aXOanZvYletyXl5xmcs30vWTKE4nZujRCq0=";
       }
       .${system} or throwSystem;
   };
@@ -52,6 +52,7 @@ let
     maintainers = with lib.maintainers; [
       cig0
       j0lol
+      keysmashes
     ];
     platforms = [
       "x86_64-linux"

pkgs/by-name/op/opencode/package.nix

@@ -13,12 +13,12 @@
 }:
 let
   pname = "opencode";
-  version = "1.0.150";
+  version = "1.0.164";
   src = fetchFromGitHub {
     owner = "sst";
     repo = "opencode";
     tag = "v${version}";
-    hash = "sha256-8mFmFFk378g93MbFRwMOJkjuXqq3PVPdCuGVLPn6D44=";
+    hash = "sha256-bz20/y6zVhEWQZB17HocvYg0F9XNwy6EKg3LHSkmvLE=";
   };
 
   node_modules = stdenvNoCC.mkDerivation {
@@ -70,7 +70,7 @@ let
     # NOTE: Required else we get errors that our fixed-output derivation references store paths
     dontFixup = true;
 
-    outputHash = "sha256-3swARfDhEfLoaucjiUfse3px40ZBfQsEE8DPgUk/5K0=";
+    outputHash = "sha256-I7y6e+ODXShbMCmKOvC48+Y3wyrLKH0IES4S6gOnMiE=";
     outputHashAlgo = "sha256";
     outputHashMode = "recursive";
   };
@@ -211,6 +211,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     '';
     homepage = "https://github.com/sst/opencode";
     license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ delafthi ];
     platforms = [
       "aarch64-linux"
       "x86_64-linux"

pkgs/by-name/pa/paq/package.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "paq";
-  version = "1.3.3";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "gregl83";
     repo = "paq";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2HlQzb3foNv/F35u7/737eJfNTsiQRCymggKAQ+mIS0=";
+    hash = "sha256-cG1xoe0mtijR5l1T2O/6C6yTdGhSXxYaGGugllOOZoE=";
   };
 
-  cargoHash = "sha256-LlqKdJhmOYnmnZA+xh7sogcnMWgpgm5qV6vwM3n3vng=";
+  cargoHash = "sha256-M3UtXCX4caYYaXoS8F2kKheP5qX5xac2WPNCnw94B6Q=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = "--version";

pkgs/by-name/pe/penelope/package.nix

@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "penelope";
-  version = "0.14.8";
+  version = "0.14.14";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "brightio";
     repo = "penelope";
     tag = "v${version}";
-    hash = "sha256-m4EYP1lKte8r9Xa/xAuv6aiwMNha+B8HXUCizH0JgmI=";
+    hash = "sha256-rSZkktq/XtlDV/bHC7ad4uhOzT3cnCxrHX7NH1t9cO0=";
   };
 
   postPatch = ''

pkgs/by-name/pk/pkgsite/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule {
   pname = "pkgsite";
-  version = "0-unstable-2025-12-09";
+  version = "0-unstable-2025-12-15";
 
   src = fetchFromGitHub {
     owner = "golang";
     repo = "pkgsite";
-    rev = "7dafa59905aea1f9f4a8d2f38c1505796d9b69b3";
-    hash = "sha256-aNpvU/4FFNDJAn11Js+1I41GjLic6gF8MyJXS3TLeRA=";
+    rev = "4eb0af2c34bf5ae5d7e04cc47cd8f7b6269ef079";
+    hash = "sha256-BpNB8wrb3vR5NXAxwRfrQjwcSllWB1YlQJU25OlS8Hw=";
   };
 
   vendorHash = "sha256-6wgJNDzUzSCkwzjqGwzpa63+0HoN5PapKxMBFBuu16M=";

pkgs/by-name/pl/playball/package.nix

@@ -0,0 +1,30 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+}:
+
+buildNpmPackage rec {
+  pname = "playball";
+  version = "3.2.0";
+
+  src = fetchFromGitHub {
+    owner = "paaatrick";
+    repo = "playball";
+    tag = "v${version}";
+    hash = "sha256-xgAhzNWCLNmbrwaYAGmXMercoRgXWPjjV5dcnXunmeA=";
+  };
+
+  npmDepsHash = "sha256-s0JKBJnVYkeXOE62F6BZRKwd0Hg3IOuMai6rmKUi6TI=";
+
+  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+
+  meta = {
+    changelog = "https://github.com/paaatrick/playball/releases/tag/v${version}";
+    description = "Watch MLB games from the comfort of your own terminal";
+    mainProgram = "playball";
+    homepage = "https://github.com/paaatrick/playball";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ nickthegroot ];
+  };
+}

pkgs/by-name/pm/pmbootstrap/package.nix

@@ -15,14 +15,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "pmbootstrap";
-  version = "3.6.0";
+  version = "3.7.0";
   pyproject = true;
 
   src = fetchFromGitLab {
     owner = "postmarketOS";
     repo = "pmbootstrap";
     tag = version;
-    hash = "sha256-sO042kmozpGbiojkivs4xbYDgVV4nVbiWkfxnbJFOJg=";
+    hash = "sha256-l8y1GoNZd6JeWzO2TI0GIVc/WlMv9EunFGH94pZ7ibk=";
     domain = "gitlab.postmarketos.org";
   };
 
@@ -84,6 +84,7 @@ python3Packages.buildPythonApplication rec {
     maintainers = with lib.maintainers; [
       onny
       lucasew
+      ungeskriptet
     ];
     mainProgram = "pmbootstrap";
   };

pkgs/by-name/po/podman/package.nix

@@ -12,7 +12,8 @@
   libapparmor,
   libseccomp,
   libselinux,
-  systemdMinimal,
+  # TODO: investigate why changing from `systemd` to `systemdMinimal` breaks `podman logs`
+  systemd,
   nixosTests,
   python3,
   makeBinaryWrapper,
@@ -83,7 +84,7 @@ buildGoModule (finalAttrs: {
     libseccomp
     libselinux
     lvm2
-    systemdMinimal
+    systemd
   ];
 
   env = {
@@ -135,7 +136,7 @@ buildGoModule (finalAttrs: {
 
   postFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
     RPATH=$(patchelf --print-rpath $out/bin/.podman-wrapped)
-    patchelf --set-rpath "${lib.makeLibraryPath [ systemdMinimal ]}":$RPATH $out/bin/.podman-wrapped
+    patchelf --set-rpath "${lib.makeLibraryPath [ systemd ]}":$RPATH $out/bin/.podman-wrapped
     substituteInPlace "$out/share/systemd/user/podman-user-wait-network-online.service" \
       --replace-fail sleep '${coreutils}/bin/sleep' \
       --replace-fail /bin/sh '${runtimeShell}'

pkgs/by-name/pr/prek/package.nix

@@ -143,6 +143,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "lua::remote_hook"
     # error message differs
     "run_in_non_git_repo"
+    # depends on locale
+    "init_nonexistent_repo"
   ];
 
   passthru.updateScript = nix-update-script { };

pkgs/by-name/pr/prometheus/disable-react-app.diff

@@ -0,0 +1,10 @@
+--- ./build_ui.sh	2025-10-22 23:32:08.739188520 +0100
++++ ./build_ui.sh	2025-10-22 23:32:23.753242986 +0100
+@@ -50,7 +50,6 @@ for i in "$@"; do
+   case ${i} in
+   --all)
+     buildModule
+-    buildReactApp
+     buildMantineUI
+     shift
+     ;;

pkgs/by-name/pr/prometheus/package.nix

@@ -1,11 +1,10 @@
 {
   stdenv,
-  buildPackages,
   lib,
   go,
   buildGoModule,
+  buildNpmPackage,
   fetchFromGitHub,
-  fetchurl,
   nixosTests,
   enableAWS ? true,
   enableAzure ? true,
@@ -30,11 +29,65 @@
   enableVultr ? true,
   enableXDS ? true,
   enableZookeeper ? true,
+  versionCheckHook,
 }:
 
-buildGoModule (finalAttrs: {
+let
+  source = import ./source.nix;
+
+  inherit (source) version vendorHash;
+
   pname = "prometheus";
-  version = "3.8.0";
+
+  src = fetchFromGitHub {
+    owner = "prometheus";
+    repo = "prometheus";
+    tag = "v${version}";
+    hash = source.hash;
+  };
+
+  assets = buildNpmPackage {
+    pname = "${pname}-assets";
+    inherit version;
+
+    src = "${src}/web/ui";
+
+    npmDepsHash = source.npmDepsHash;
+
+    patches = [
+      # Disable old React app as it depends on deprecated create-react-apps
+      # script
+      ./disable-react-app.diff
+    ];
+
+    env.CI = true;
+
+    doCheck = true;
+    checkPhase = ''
+      runHook preCheck
+
+      npm test
+
+      runHook postCheck
+    '';
+
+    postInstall = ''
+      mkdir -p $out/static
+      cp -r $out/lib/node_modules/prometheus-io/static/* $out/static
+      find $out/static -type f -exec gzip -f9 {} \;
+
+      # Remove node_modules
+      rm -rf $out/lib
+    '';
+  };
+in
+buildGoModule (finalAttrs: {
+  inherit
+    pname
+    version
+    vendorHash
+    src
+    ;
 
   outputs = [
     "out"
@@ -42,22 +95,6 @@ buildGoModule (finalAttrs: {
     "cli"
   ];
 
-  src = fetchFromGitHub {
-    owner = "prometheus";
-    repo = "prometheus";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-hRuZxwPPDLxQvy5MPKEyfmanNabcSjLRO+XbNKugPtk=";
-  };
-
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
-
-  vendorHash = "sha256-5wDaG01vcTtGzrS/S33U5XWXoSWM+N9z3dzXZlILxD8=";
-
-  webUiStatic = fetchurl {
-    url = "https://github.com/prometheus/prometheus/releases/download/v${finalAttrs.version}/prometheus-web-ui-${finalAttrs.version}.tar.gz";
-    hash = "sha256-oOEvNZFlYtTNBsn+B2pAWXi0A2oJ6IAo7V8bOLtjfCM=";
-  };
-
   excludedPackages = [
     "documentation/prometheus-mixin"
     "internal/tools"
@@ -65,7 +102,7 @@ buildGoModule (finalAttrs: {
   ];
 
   postPatch = ''
-    tar -C web/ui -xzf ${finalAttrs.webUiStatic}
+    cp -r ${assets}/static web/ui/static/
 
     patchShebangs scripts
 
@@ -99,9 +136,18 @@ buildGoModule (finalAttrs: {
   '';
 
   preBuild = ''
-    if [[ -d vendor ]]; then
-      GOARCH= CC="$CC_FOR_BUILD" LD="$LD_FOR_BUILD" make -o assets assets-compress plugins
-    fi
+    if [[ -d vendor ]]; then GOARCH= make -o assets plugins; fi
+
+    # Recreate the `make assets-compress` target here - workaround permissions
+    # errors
+    cp web/ui/embed.go.tmpl web/ui/embed.go
+
+    find web/ui/static -type f -name '*.gz' -print0 | sort -z | xargs -0 echo //go:embed >> web/ui/embed.go
+
+    echo 'var EmbedFS embed.FS' >> web/ui/embed.go
+
+    # EmbedFS requires relative paths
+    substituteInPlace web/ui/embed.go --replace-fail "web/ui/" ""
   '';
 
   tags = [ "builtinassets" ];
@@ -141,15 +187,26 @@ buildGoModule (finalAttrs: {
     "-skip=TestEvaluations/testdata/aggregators.test"
   ];
 
-  passthru.tests = { inherit (nixosTests) prometheus; };
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru = {
+    tests = { inherit (nixosTests) prometheus; };
+    updateScript = ./update.sh;
+  };
 
   meta = {
     description = "Service monitoring system and time series database";
     homepage = "https://prometheus.io";
     license = lib.licenses.asl20;
+    changelog = "https://github.com/prometheus/prometheus/blob/v${version}/CHANGELOG.md";
     maintainers = with lib.maintainers; [
       fpletz
       Frostman
+      jpds
     ];
     mainProgram = "prometheus";
   };

pkgs/by-name/pr/prometheus/source.nix

@@ -0,0 +1,6 @@
+{
+  version = "3.8.1";
+  hash = "sha256-mb1aMWpIELyZaqjYX1teYdtAK/+W9jzdPwzgbT7AVj4=";
+  npmDepsHash = "sha256-wmxvlQWQO2gP2apupMJssqAPr1ntWWIazduQU3AuodU=";
+  vendorHash = "sha256-35pVMl1Hu970BQE6jMzT1xaz/3FaIFWUtel0cl/uBdw=";
+}

pkgs/by-name/pr/prometheus/update.sh

@@ -0,0 +1,77 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nix coreutils curl jq nix-prefetch-git prefetch-npm-deps
+
+set -euo pipefail
+
+OWNER=prometheus
+REPO=prometheus
+
+# Current version.
+LATEST_NIXPKGS_VERSION=$(nix eval --raw .#prometheus.version 2>/dev/null)
+UPDATE_NIX_OLD_VERSION=${UPDATE_NIX_OLD_VERSION:-$LATEST_NIXPKGS_VERSION}
+
+TARGET_TAG="$(curl -L -s ${GITHUB_TOKEN:+-u ":${GITHUB_TOKEN}"} "https://api.github.com/repos/$OWNER/$REPO/releases/latest" | jq -r '.tag_name')"
+TARGET_VERSION="$(echo "$TARGET_TAG" | sed -e 's/^v//')"
+
+if [[ "$UPDATE_NIX_OLD_VERSION" == "$TARGET_VERSION" ]]; then
+    # prometheus is up-to-date
+    if [[ -n "$UPDATE_NIX_ATTR_PATH" ]]; then
+        echo "[{}]";
+    fi
+
+    exit 0
+fi
+
+extractVendorHash() {
+    original="${1?original hash missing}"
+    result="$(nix-build -A prometheus.goModules 2>&1 | tail -n3 | grep 'got:' | cut -d: -f2- | xargs echo || true)"
+    [ -z "$result" ] && { echo "$original"; } || { echo "$result"; }
+}
+
+TMP=$(mktemp -d)
+trap 'rm -rf "$TMP"' EXIT
+
+NIXPKGS_PROMETHEUS_PATH=$(cd $(dirname ${BASH_SOURCE[0]}); pwd -P)/
+SOURCE_NIX="$NIXPKGS_PROMETHEUS_PATH/source.nix"
+
+PREFETCH_JSON=$TMP/prefetch.json
+nix-prefetch-git --rev "$TARGET_TAG" --url "https://github.com/$OWNER/$REPO" > "$PREFETCH_JSON"
+PREFETCH_HASH="$(jq '.hash' -r < "$PREFETCH_JSON")"
+PREFETCH_PATH="$(jq '.path' -r < "$PREFETCH_JSON")"
+NPM_DEPS_HASH="$(prefetch-npm-deps "$PREFETCH_PATH/web/ui/package-lock.json")"
+
+FAKE_HASH="sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+
+cat > "$SOURCE_NIX" <<-EOF
+{
+  version = "$TARGET_VERSION";
+  hash = "$PREFETCH_HASH";
+  npmDepsHash = "$NPM_DEPS_HASH";
+  vendorHash = "$FAKE_HASH";
+}
+EOF
+
+GO_HASH="$(nix-instantiate --eval -A prometheus.vendorHash | tr -d '"')"
+VENDOR_HASH=$(extractVendorHash "$GO_HASH")
+
+cat > "$SOURCE_NIX" <<-EOF
+{
+  version = "$TARGET_VERSION";
+  hash = "$PREFETCH_HASH";
+  npmDepsHash = "$NPM_DEPS_HASH";
+  vendorHash = "$VENDOR_HASH";
+}
+EOF
+
+if [[ -z "$UPDATE_NIX_ATTR_PATH" ]]; then
+    exit 0
+fi
+
+cat <<-EOF
+[{
+  "attrPath": "$UPDATE_NIX_ATTR_PATH",
+  "oldVersion": "$UPDATE_NIX_OLD_VERSION",
+  "newVersion": "$TARGET_VERSION",
+  "files": ["$SOURCE_NIX"]
+}]
+EOF

pkgs/by-name/pr/proxsuite/fix-cmake-python-version.patch

@@ -0,0 +1,14 @@
+diff --git a/bindings/python/CMakeLists.txt b/bindings/python/CMakeLists.txt
+index 07678691f..1d85e5eb2 100644
+--- a/bindings/python/CMakeLists.txt
++++ b/bindings/python/CMakeLists.txt
+@@ -31,6 +31,9 @@ execute_process(
+   OUTPUT_STRIP_TRAILING_WHITESPACE
+   OUTPUT_VARIABLE nanobind_ROOT
+ )
++if(NOT Python_VERSION AND Python3_VERSION)
++  set(Python_VERSION ${Python3_VERSION})
++endif()
+ find_package(nanobind CONFIG)
+ cmake_policy(POP)
+ if(NOT nanobind_FOUND)

pkgs/by-name/pr/proxsuite/package.nix

@@ -36,6 +36,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-1+a5tFOlEwzhGZtll35EMFceD0iUOOQCbwJd9NcFDlk=";
   };
 
+  patches = [
+    # Set Python_VERSION to Python3_VERSION if not already set
+    ./fix-cmake-python-version.patch
+  ];
+
   # ref. https://github.com/Simple-Robotics/proxsuite/pull/408 merged upstream
   postPatch = ''
     substituteInPlace CMakeLists.txt --replace-fail \

pkgs/by-name/qo/qownnotes/package.nix

@@ -19,11 +19,11 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "qownnotes";
   appname = "QOwnNotes";
-  version = "25.12.5";
+  version = "25.12.6";
 
   src = fetchurl {
     url = "https://github.com/pbek/QOwnNotes/releases/download/v${finalAttrs.version}/qownnotes-${finalAttrs.version}.tar.xz";
-    hash = "sha256-LS1R5+wCkv/IvgC8RMqhvoIrrMmNlS0Hg+IgMViRJys=";
+    hash = "sha256-zlTyh0D7FXB4LDGQXi4Hb8WeujaM7F7hoO9TccZfzFg=";
   };
 
   nativeBuildInputs = [