Merge master into staging-nixos

doc/languages-frameworks/neovim.section.md

@@ -115,6 +115,25 @@ patch those plugins but expose the necessary configuration under
 `PLUGIN.passthru.initLua` for neovim plugins. For instance, the `unicode-vim` plugin
 needs the path towards a unicode database so we expose the following snippet `vim.g.Unicode_data_directory="${self.unicode-vim}/autoload/unicode"` under `vimPlugins.unicode-vim.passthru.initLua`.
 
+### Plugin license overrides {#neovim-plugin-license-overrides}
+
+Generated Vim and Neovim plugins get their `meta.license` from GitHub license metadata when possible.
+Some upstream repositories do not expose a license file that GitHub can detect, or only mention the license in a README.
+In those cases, add a manual `meta.license` override in [overrides.nix](https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/editors/vim/plugins/overrides.nix).
+
+For example, if upstream documents that a plugin uses the Vim license but GitHub does not detect it:
+
+```nix
+{
+  foo-nvim = super.foo-nvim.overrideAttrs (old: {
+    meta = old.meta // {
+      # README says this plugin is distributed under the Vim license.
+      license = lib.licenses.vim;
+    };
+  });
+}
+```
+
 ## LuaRocks based plugins {#neovim-luarocks-based-plugins}
 
 In order to automatically handle plugin dependencies, several Neovim plugins

doc/redirects.json

@@ -4483,6 +4483,9 @@
     "index.html#neovim-plugin-required-snippet",
     "index.html#vim-plugin-required-snippet"
   ],
+  "neovim-plugin-license-overrides": [
+    "index.html#neovim-plugin-license-overrides"
+  ],
   "updating-plugins-in-nixpkgs": [
     "index.html#updating-plugins-in-nixpkgs"
   ],

nixos/modules/services/home-automation/esphome.nix

@@ -145,6 +145,7 @@ in
         RuntimeDirectoryMode = "0750";
         EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
         ReadWritePaths = [ stateDir ];
+        ExecPaths = [ stateDir ];
 
         # Hardening
         CapabilityBoundingSet = "";

nixos/modules/services/security/spire/agent-tpm.nix

@@ -0,0 +1,34 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+let
+  cfg = config.services.spire.agent;
+in
+{
+  options.services.spire.agent.settings.plugins.NodeAttestor.tpm = lib.mkOption {
+    default = null;
+    description = "TPM 2.0 node attestation plugin. When set, automatically enables security.tpm2 and grants the spire-agent user access to the TPM device.";
+    type = lib.types.nullOr (
+      lib.types.submodule {
+        freeformType = (pkgs.formats.hcl1 { }).type;
+        options.plugin_cmd = lib.mkOption {
+          type = lib.types.str;
+          default = lib.getExe' pkgs.spire-tpm-plugin "tpm_attestor_agent";
+          defaultText = lib.literalExpression ''lib.getExe' pkgs.spire-tpm-plugin "tpm_attestor_agent"'';
+          description = "Path to the TPM attestor agent plugin binary.";
+        };
+      }
+    );
+  };
+
+  config = lib.mkIf (cfg.enable && cfg.settings.plugins.NodeAttestor.tpm != null) {
+    security.tpm2.enable = true;
+
+    systemd.services.spire-agent.serviceConfig.SupplementaryGroups = [
+      config.security.tpm2.tssGroup
+    ];
+  };
+}

nixos/modules/services/security/spire/agent.nix

@@ -26,28 +26,38 @@ in
           agent = {
             trust_domain = lib.mkOption {
               type = lib.types.str;
-              description = "The trust domain that this agent belongs to";
+              description = "The trust domain that this agent belongs to (should be no more than 255 characters)";
               example = "example.com";
             };
             data_dir = lib.mkOption {
               type = lib.types.str;
               default = "$STATE_DIRECTORY";
-              description = "The directory where the SPIRE agent stores its data";
+              description = "A directory the agent can use for its runtime data";
             };
             server_address = lib.mkOption {
               type = lib.types.str;
-              description = "The address of the SPIRE server";
+              description = "DNS name or IP address of the SPIRE server";
               example = "server.example.com";
             };
             server_port = lib.mkOption {
               type = lib.types.port;
               default = 8081;
-              description = "The port on which the SPIRE server is listening";
+              description = "Port number of the SPIRE server";
             };
             socket_path = lib.mkOption {
               type = lib.types.path;
               default = "/run/spire/agent/public/api.sock";
-              description = "The path to the SPIRE agent socket";
+              description = "Location to bind the SPIRE Agent API socket (Unix only)";
+            };
+            join_token = lib.mkOption {
+              type = lib.types.nullOr lib.types.str;
+              default = null;
+              description = "An optional token which has been generated by the SPIRE server";
+            };
+            join_token_file = lib.mkOption {
+              type = lib.types.nullOr lib.types.str;
+              default = null;
+              description = "Path to a file containing an optional join token which has been generated by the SPIRE server";
             };
           };
           plugins = lib.mkOption {
@@ -55,8 +65,39 @@ in
               Built-in plugin types can be found at [the plugin types documentation](https://spiffe.io/docs/latest/deploying/spire_agent/#plugin-types).
               See [plugin configuration](https://spiffe.io/docs/latest/deploying/spire_agent/#plugin-configuration) for options and how to configure external plugins.
             '';
-            # TODO: We can probably enforce some of these constraints with a submodule
-            type = format.type;
+            type = lib.types.submodule {
+              freeformType = format.type;
+              options.NodeAttestor = lib.mkOption {
+                default = { };
+                description = ''
+                  Gathers information used to attest the agent's identity to the server. Generally paired with a server plugin of the same type.
+                '';
+                type = lib.types.submodule {
+                  freeformType = format.type;
+                  options.join_token = lib.mkOption {
+                    default = null;
+                    description = ''
+                      The `join_token` is responsible for attesting the agent's identity using a one-time-use pre-shared key.
+
+                      Must be used in conjunction with the server-side `join_token` plugin.
+                    '';
+                    type = lib.types.nullOr (
+                      lib.types.submodule {
+                        freeformType = format.type;
+                        options.plugin_data = lib.mkOption {
+                          type = lib.types.submodule { };
+                          default = { };
+                          description = ''
+                            As a special case for node attestors, the join token itself is configured by a CLI flag (`-joinToken`)
+                            or by configuring `join_token` in the agent's main config body.
+                          '';
+                        };
+                      }
+                    );
+                  };
+                };
+              };
+            };
             example = {
               KeyManager.memory.plugin_data = { };
               NodeAttestor.join_token.plugin_data = { };
@@ -71,7 +112,7 @@ in
     configFile = lib.mkOption {
       type = lib.types.path;
       defaultText = "Config file generated from services.spire.agent.settings";
-      default = format.generate "agent.conf" cfg.settings;
+      default = format.generate "agent.conf" (lib.filterAttrsRecursive (_: v: v != null) cfg.settings);
       description = ''
         Path to the SPIRE agent configuration file. See [the documentation](https://spiffe.io/docs/latest/deploying/spire_agent/) for more information.
       '';
@@ -80,10 +121,12 @@ in
     expandEnv = lib.mkOption {
       type = lib.types.bool;
       default = true;
-      description = "Expand environment variables in SPIRE config file";
+      description = "Expand environment $VARIABLES in the config file";
     };
 
   };
+  imports = [ ./agent-tpm.nix ];
+
   config = lib.mkIf cfg.enable {
     environment.systemPackages = [ cfg.package ];
 

nixos/modules/services/security/spire/server-tpm.nix

@@ -0,0 +1,59 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+let
+  format = pkgs.formats.hcl1 { };
+in
+{
+  options.services.spire.server.settings.plugins.NodeAttestor.tpm = lib.mkOption {
+    default = null;
+    description = ''
+      TPM 2.0 node attestation plugin from
+      [spire-tpm-plugin](https://github.com/spiffe/spire-tpm-plugin).
+    '';
+    type = lib.types.nullOr (
+      lib.types.submodule {
+        freeformType = format.type;
+        options = {
+          plugin_cmd = lib.mkOption {
+            type = lib.types.str;
+            default = lib.getExe' pkgs.spire-tpm-plugin "tpm_attestor_server";
+            defaultText = lib.literalExpression ''lib.getExe' pkgs.spire-tpm-plugin "tpm_attestor_server"'';
+            description = "Path to the TPM attestor server plugin binary.";
+          };
+          plugin_data = lib.mkOption {
+            default = { };
+            description = ''
+              Plugin data for the TPM NodeAttestor. Either `ca_path`,
+              `hash_path`, or both must be configured.
+            '';
+            type = lib.types.submodule {
+              freeformType = format.type;
+              options = {
+                ca_path = lib.mkOption {
+                  type = lib.types.nullOr lib.types.str;
+                  default = null;
+                  description = ''
+                    The path to the CA directory. Contains the manufacturer CA
+                    cert that signed the TPM's EK certificate in PEM or DER
+                    format.
+                  '';
+                };
+                hash_path = lib.mkOption {
+                  type = lib.types.nullOr lib.types.str;
+                  default = null;
+                  description = ''
+                    The path to the Hash directory. Contains empty files named
+                    after the EK public key hash.
+                  '';
+                };
+              };
+            };
+          };
+        };
+      }
+    );
+  };
+}

nixos/modules/services/security/spire/server.nix

@@ -11,6 +11,8 @@ in
 {
   meta.maintainers = [ lib.maintainers.arianvp ];
 
+  imports = [ ./server-tpm.nix ];
+
   options.services.spire.server = {
     enable = lib.mkEnableOption "SPIRE Server";
 
@@ -59,8 +61,35 @@ in
               Built-in plugin types can be found at [the plugin types documentation](https://spiffe.io/docs/latest/deploying/spire_server/#plugin-types).
               See [plugin configuration](https://spiffe.io/docs/latest/deploying/spire_server/#plugin-configuration) for options and how to configure external plugins.
             '';
-            # TODO: We can probably enforce some of these constraints with a submodule
-            type = format.type;
+            type = lib.types.submodule {
+              freeformType = format.type;
+              options.NodeAttestor = lib.mkOption {
+                default = { };
+                description = ''
+                  NodeAttestor plugins implement validation logic for nodes attempting to assert their identity.
+                  They are generally paired with an agent plugin of the same type.
+                  See [the documentation](https://spiffe.io/docs/latest/deploying/spire_server/#nodeattestor)
+                  for the list of built-in NodeAttestor plugins.
+                '';
+                type = lib.types.submodule {
+                  freeformType = format.type;
+                  options.join_token = lib.mkOption {
+                    default = null;
+                    description = "Join token based node attestation.";
+                    type = lib.types.nullOr (
+                      lib.types.submodule {
+                        freeformType = format.type;
+                        options.plugin_data = lib.mkOption {
+                          type = format.type;
+                          default = { };
+                          description = "Plugin data for the join_token NodeAttestor.";
+                        };
+                      }
+                    );
+                  };
+                };
+              };
+            };
             example = {
               KeyManager.memory.plugin_data = { };
               DataStore.sql.plugin_data = {
@@ -76,7 +105,7 @@ in
 
     configFile = lib.mkOption {
       type = lib.types.path;
-      default = format.generate "server.conf" cfg.settings;
+      default = format.generate "server.conf" (lib.filterAttrsRecursive (_: v: v != null) cfg.settings);
       defaultText = "Config file generated from services.spire.server.settings";
       description = ''
         Path to the SPIRE server configuration file. See [the documentation](https://spiffe.io/docs/latest/deploying/spire_server/) for more information.

nixos/tests/spire.nix

@@ -1,5 +1,51 @@
+{ pkgs, ... }:
 let
   trustDomain = "example.com";
+
+  # TODO: tpm-ek test has similar stuff. Also the whole tpm provisioning should probably
+  # just use the vtpm provisioning commands in the future?
+
+  # OpenSSL config to sign the swtpm EK with TPM-specific certificate extensions
+  ekSignConf = pkgs.writeText "ek-sign.cnf" ''
+    [ tpm_policy ]
+    basicConstraints = critical, CA:FALSE
+    keyUsage = critical, keyEncipherment
+    certificatePolicies = 2.23.133.2.1
+    extendedKeyUsage = 2.23.133.8.1
+    subjectAltName = ASN1:SEQUENCE:dirname_tpm
+
+    [ dirname_tpm ]
+    seq = EXPLICIT:4,SEQUENCE:dirname_tpm_seq
+
+    [ dirname_tpm_seq ]
+    set = SET:dirname_tpm_set
+
+    [ dirname_tpm_set ]
+    seq.1 = SEQUENCE:dirname_tpm_seq_manufacturer
+    seq.2 = SEQUENCE:dirname_tpm_seq_model
+    seq.3 = SEQUENCE:dirname_tpm_seq_version
+
+    [dirname_tpm_seq_manufacturer]
+    oid = OID:2.23.133.2.1
+    str = UTF8:"id:53544D20"
+
+    [dirname_tpm_seq_model]
+    oid = OID:2.23.133.2.2
+    str = UTF8:"ST33HTPHAHD4"
+
+    [dirname_tpm_seq_version]
+    oid = OID:2.23.133.2.3
+    str = UTF8:"id:00010101"
+  '';
+
+  agent =
+    { config, ... }:
+    {
+      environment.variables.SPIFFE_ENDPOINT_SOCKET =
+        config.services.spire.agent.settings.agent.socket_path;
+      virtualisation.credentials."spire.trust_bundle".source = "./trust_bundle";
+      systemd.services.spire-agent.serviceConfig.ImportCredential = [ "spire.trust_bundle" ];
+    };
 in
 {
   name = "spire";
@@ -9,6 +55,7 @@ in
       { config, ... }:
       {
         networking.domain = trustDomain;
+        environment.etc."spire/server/certs/tpm-ca.crt".source = ./tpm-ek/ca.crt;
         services.spire.server = {
           enable = true;
           openFirewall = true;
@@ -21,21 +68,17 @@ in
                 connection_string = "$STATE_DIRECTORY/datastore.sqlite3";
               };
               NodeAttestor.join_token.plugin_data = { };
+              NodeAttestor.tpm.plugin_data.ca_path = "/etc/spire/server/certs";
             };
           };
         };
       };
 
     agent = {
-      virtualisation.credentials = {
-        "spire.join_token".source = "./join_token";
-        "spire.trust_bundle".source = "./trust_bundle";
-      };
+      imports = [ agent ];
 
-      systemd.services.spire-agent.serviceConfig.ImportCredential = [
-        "spire.join_token"
-        "spire.trust_bundle"
-      ];
+      virtualisation.credentials."spire.join_token".source = "./join_token";
+      systemd.services.spire-agent.serviceConfig.ImportCredential = [ "spire.join_token" ];
 
       services.spire.agent = {
         enable = true;
@@ -56,44 +99,116 @@ in
         };
       };
     };
+
+    tpmAgent =
+      { pkgs, lib, ... }:
+      {
+        imports = [ agent ];
+        virtualisation = {
+          useEFIBoot = true;
+          tpm = {
+            enable = true;
+            # Provision the swtpm with an EK certificate signed by testCA so that
+            # the SPIRE server can verify the agent's identity.
+            provisioning = ''
+              export PATH=${
+                lib.makeBinPath [
+                  pkgs.openssl
+                  pkgs.tpm2-tools
+                ]
+              }:$PATH
+
+              tpm2_createek -G rsa -u ek.pub -c ek.ctx -f pem
+
+              openssl x509 \
+                -extfile ${ekSignConf} \
+                -new -days 365 \
+                -subj "/CN=swtpm-ekcert" \
+                -extensions tpm_policy \
+                -CA ${./tpm-ek/ca.crt} -CAkey ${./tpm-ek/ca.priv} \
+                -out ekcert.der -outform der \
+                -force_pubkey ek.pub
+
+              tpm2_nvdefine 0x01c00002 \
+                -C o \
+                -a "ownerread|policyread|policywrite|ownerwrite|authread|authwrite" \
+                -s "$(wc -c < ekcert.der)"
+
+              tpm2_nvwrite 0x01c00002 -C o -i ekcert.der
+            '';
+          };
+        };
+
+        environment.systemPackages = [ pkgs.spire-tpm-plugin ];
+
+        services.spire.agent = {
+          enable = true;
+          settings = {
+            agent = {
+              trust_domain = trustDomain;
+              server_address = "server.${trustDomain}";
+              trust_bundle_format = "pem";
+              trust_bundle_path = "$CREDENTIALS_DIRECTORY/spire.trust_bundle";
+            };
+            plugins = {
+              KeyManager.memory.plugin_data = { };
+              NodeAttestor.tpm.plugin_data = { };
+              WorkloadAttestor.systemd.plugin_data = { };
+              WorkloadAttestor.unix.plugin_data = { };
+            };
+          };
+        };
+      };
   };
 
   testScript =
     { nodes, ... }:
     let
       adminSocket = nodes.server.services.spire.server.settings.server.socket_path;
-      workloadSocket = nodes.agent.services.spire.agent.settings.agent.socket_path;
     in
     ''
-      # TODO: instead of trust bundle to talk to the spire-server, use an upstream CA?
-      def provision(agent, spiffe_id):
+      spiffe_id = "spiffe://${trustDomain}/service/backdoor"
 
-        # expose as system credentials
+      def provision_trust_bundle(agent):
+        # TODO: instead of trust bundle to talk to the spire-server, use an upstream CA?
         bundle = server.succeed("spire-server bundle show -socketPath ${adminSocket}")
         with open(agent.state_dir / "trust_bundle", "w") as f:
           f.write(bundle)
+
+
+      def provision_join_token(agent):
         join_token = server.succeed("spire-server token generate -socketPath ${adminSocket}").split()[1]
         with open(agent.state_dir / "join_token", "w") as f:
           f.write(join_token)
+        parent_id = f"spiffe://${trustDomain}/spire/agent/join_token/{join_token}"
+        server.succeed(f"spire-server entry create -socketPath ${adminSocket} -selector 'systemd:id:backdoor.service' -parentID {parent_id} -spiffeID {spiffe_id}")
+
+
+      def provision_tpm(agent):
+        agent.wait_for_unit("tpm2.target")
+        ek_hash = agent.succeed("get_tpm_pubhash").strip()
+        parent_id = f"spiffe://${trustDomain}/spire/agent/tpm/{ek_hash}"
+        server.succeed(f"spire-server entry create -socketPath ${adminSocket} -selector 'systemd:id:backdoor.service' -parentID '{parent_id}' -spiffeID {spiffe_id}")
+
+
+      def test_agent(name, agent_node, provision_fn):
+        with subtest(f"Setup SPIRE agent with {name} attestation"):
+          provision_trust_bundle(agent_node)
+          provision_fn(agent_node)
+          agent_node.wait_for_unit("spire-agent.service")
+          agent_node.wait_until_succeeds("spire-agent healthcheck -socketPath $SPIFFE_ENDPOINT_SOCKET", timeout=90)
+        with subtest(f"Test certificate authentication from {name} agent"):
+          agent_node.wait_until_succeeds("spire-agent api fetch x509 -socketPath $SPIFFE_ENDPOINT_SOCKET -write .")
+        # TODO: Add something to communicate with
 
-        # register a workload on the node
-        parent_id=f"spiffe://${trustDomain}/spire/agent/join_token/{join_token}"
-        server.succeed(f"spire-server entry create -socketPath ${adminSocket} -selector 'systemd:id:backdoor.service' -parentID {parent_id} -spiffeID 'spiffe://${trustDomain}/service/backdoor'")
 
       with subtest("SPIRE server startup and health checks"):
         server.wait_for_unit("spire-server.service")
-        server.wait_until_succeeds("spire-server healthcheck -socketPath ${adminSocket}", timeout=5)
+        server.wait_until_succeeds("spire-server healthcheck -socketPath ${adminSocket}", timeout=30)
 
 
-      with subtest("Setup SPIRE agent on agent node"):
-        provision(agent, "spiffe://${trustDomain}/server/agent")
-        agent.wait_for_unit("spire-agent.service")
-        agent.wait_until_succeeds("spire-agent healthcheck -socketPath ${workloadSocket}", timeout=5)
+      test_agent("join_token", agent, provision_join_token)
+      test_agent("tpm", tpmAgent, provision_tpm)
 
-
-      with subtest("Test certificate authentication from agent node"):
-        agent.succeed("spire-agent api fetch x509 -socketPath ${workloadSocket} -write .")
-
-      # TODO: Add something to communicate with
     '';
 }

pkgs/applications/editors/vim/plugins/utils/get-plugins.nix

@@ -17,6 +17,7 @@ let
   parse = _name: value: {
     inherit (value) pname version;
     homePage = value.meta.homepage;
+    license = value.meta.license.spdxId or null;
     checksum =
       if hasChecksum value then
         {

pkgs/applications/editors/vim/plugins/utils/update.py

@@ -19,6 +19,7 @@
 #
 
 import inspect
+import json
 import logging
 import os
 import textwrap
@@ -36,18 +37,27 @@ from nixpkgs_plugin_update import PluginDesc, run_nix_expr
 treesitter = importlib.import_module("nvim-treesitter.update")
 
 
-HEADER = (
-    "# GENERATED by ./pkgs/applications/editors/vim/plugins/utils/update.py. Do not edit!"
-)
+HEADER = "# GENERATED by ./pkgs/applications/editors/vim/plugins/utils/update.py. Do not edit!"
 
 NIXPKGS_NVIMTREESITTER_FOLDER = "pkgs/applications/editors/vim/plugins/nvim-treesitter"
 
+SPDX_LICENSE_NORMALIZATION = {
+    "AGPL-3.0": "AGPL-3.0-only",
+    "GPL-2.0": "GPL-2.0-only",
+    "GPL-3.0": "GPL-3.0-only",
+    "LGPL-2.0": "LGPL-2.0-only",
+    "LGPL-2.1": "LGPL-2.1-only",
+    "LGPL-3.0": "LGPL-3.0-only",
+}
+
 
 class VimEditor(nixpkgs_plugin_update.Editor):
     nvim_treesitter_updated = False
 
     def generate_nix(
-        self, plugins: List[Tuple[PluginDesc, nixpkgs_plugin_update.Plugin]], outfile: str
+        self,
+        plugins: List[Tuple[PluginDesc, nixpkgs_plugin_update.Plugin]],
+        outfile: str,
     ):
         log.info("Generating nix code")
         log.debug("Loading nvim-treesitter source reference from nix...")
@@ -93,7 +103,10 @@ class VimEditor(nixpkgs_plugin_update.Editor):
             for pdesc, plugin in plugins:
                 content = self.plugin2nix(pdesc, plugin, _isNeovimPlugin(plugin))
                 f.write(content)
-                if plugin.name == "nvim-treesitter" and (plugin.tag or plugin.commit) != nvim_treesitter_ref:
+                if (
+                    plugin.name == "nvim-treesitter"
+                    and (plugin.tag or plugin.commit) != nvim_treesitter_ref
+                ):
                     self.nvim_treesitter_updated = True
             f.write("}\n")
         print(f"updated {outfile}")
@@ -102,16 +115,29 @@ class VimEditor(nixpkgs_plugin_update.Editor):
         self, pdesc: PluginDesc, plugin: nixpkgs_plugin_update.Plugin, isNeovim: bool
     ) -> str:
         if isNeovim:
-            raise RuntimeError(f"Plugin {plugin.name} is already packaged in `luaPackages`, please use that")
+            raise RuntimeError(
+                f"Plugin {plugin.name} is already packaged in `luaPackages`, please use that"
+            )
         repo = pdesc.repo
 
         content = f"  {plugin.normalized_name} = "
         src_nix = repo.as_nix(plugin)
+        license_spdx_id = plugin.license
+        if license_spdx_id is not None:
+            license_spdx_id = SPDX_LICENSE_NORMALIZATION.get(
+                license_spdx_id, license_spdx_id
+            )
+        license_nix = (
+            f"    meta.license = lib.meta.getLicenseFromSpdxId {json.dumps(license_spdx_id)};\n"
+            if license_spdx_id
+            else "    meta.license = lib.licenses.unfree;\n"
+        )
         content += """{buildFn} {{
     pname = "{plugin.name}";
     version = "{plugin.version}";
     src = {src_nix};
     meta.homepage = "{repo.uri}";
+{license_nix}\
     meta.hydraPlatforms = [ ];
   }};
 
@@ -120,6 +146,7 @@ class VimEditor(nixpkgs_plugin_update.Editor):
             plugin=plugin,
             src_nix=src_nix,
             repo=repo,
+            license_nix=license_nix,
         )
         log.debug(content)
         return content

pkgs/applications/virtualization/docker/compose.nix

@@ -4,19 +4,18 @@
   fetchFromGitHub,
   versionCheckHook,
 }:
-
 buildGoModule rec {
   pname = "docker-compose";
-  version = "5.0.2";
+  version = "5.1.3";
 
   src = fetchFromGitHub {
     owner = "docker";
     repo = "compose";
     tag = "v${version}";
-    hash = "sha256-2lyjTNd4jf+wTtnFZaRT10ga0MHZondzb+0cM0ftCuY=";
+    hash = "sha256-9c/epAjLJMQhLXcray5JylVVQVXZ04mgpCBCXJULqTU=";
   };
 
-  vendorHash = "sha256-A9RHSM6BmcaIVHWOou50T1+N/Vh8H1+KtSKeh/ZJ2JQ=";
+  vendorHash = "sha256-LL4gz1Sy0ITnMh/zz/pUoshOeobg8+yPh//QM7qgVbI=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
 
@@ -46,6 +45,6 @@ buildGoModule rec {
     mainProgram = "docker-compose";
     homepage = "https://github.com/docker/compose";
     license = lib.licenses.asl20;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ airone01 ];
   };
 }

pkgs/by-name/an/ananicy-cpp/package.nix

@@ -2,7 +2,6 @@
   lib,
   clangStdenv,
   fetchFromGitLab,
-  fetchpatch,
   cmake,
   pkg-config,
   spdlog,
@@ -18,42 +17,18 @@
 
 clangStdenv.mkDerivation (finalAttrs: {
   pname = "ananicy-cpp";
-  version = "1.1.1";
+  version = "1.2.0";
 
   src = fetchFromGitLab {
     owner = "ananicy-cpp";
     repo = "ananicy-cpp";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-oPinSc00+Z6SxjfTh7DttcXSjsLv1X0NI+O37C8M8GY=";
+    hash = "sha256-Nl7Ugj5VPHwW85GJ44luUc2e95kFCanQhDRopGH9nTU=";
   };
 
   patches = [
     ./match-wrappers.patch
-
-    # FIXME: remove these when updating to next stable release
-    (fetchpatch {
-      name = "allow-regex-pattern-matching.patch";
-      url = "https://gitlab.com/ananicy-cpp/ananicy-cpp/-/commit/6ea2dccceec39b6c4913f617dad81d859aa20f24.patch";
-      hash = "sha256-C+7x/VpVwewXEPwibi7GxGfjuhDkhcjTyGbZHlYL2Bs=";
-    })
-    (fetchpatch {
-      name = "use-a-reliable-path-for-mounts-file.patch";
-      url = "https://gitlab.com/ananicy-cpp/ananicy-cpp/-/commit/de6f11978db98bfd13a1e87dcdab61dbe6496710.patch";
-      hash = "sha256-9bJlFCClddlAEknfqp7Gcij7NX6tqohE2wqoalLoN5I=";
-    })
-    # https://gitlab.com/ananicy-cpp/ananicy-cpp/-/merge_requests/30
-    (fetchpatch {
-      name = "fix-build-with-clang-19.patch";
-      url = "https://gitlab.com/ananicy-cpp/ananicy-cpp/-/commit/b2589a9b1faa2ecf54aeede40ea781c33bfb09a8.patch";
-      hash = "sha256-nfyCdhvnWj446z5aPFCXGi79Xgja8W0Eopl6I30fOBM=";
-    })
-
-    # fix build w/ glibc-2.42 (don't conflict with sched_* API from glibc 2.41)
-    (fetchpatch {
-      url = "https://gitlab.com/ananicy-cpp/ananicy-cpp/-/commit/99e64815bacaf3baa28ad89d022e33ebede94fa9.patch";
-      hash = "sha256-V9yf0nUa91DXRufDYhufybQUTP6R1CUzF51SEBMdjmA=";
-    })
   ];
 
   strictDeps = true;

pkgs/by-name/as/assetripper/deps.json

@@ -89,11 +89,6 @@
     "version": "1.1.2",
     "hash": "sha256-FiLz2N5gjpNi5vIiuO/FtL2okjkTdBNOSAvrZ5ZcAWY="
   },
-  {
-    "pname": "AssetRipper.Primitives",
-    "version": "3.1.3",
-    "hash": "sha256-17RT4wzgcZwzWjS92fX9lsZk91BKxEM8/kHc5aG/WU0="
-  },
   {
     "pname": "AssetRipper.Primitives",
     "version": "3.1.6",
@@ -121,8 +116,8 @@
   },
   {
     "pname": "AssetRipper.SourceGenerated",
-    "version": "1.3.11.1",
-    "hash": "sha256-ZIVM61VLFQT4q8jnnZlmNcsLAPb0QsVN4V4LEGv+FKA="
+    "version": "1.3.14.2",
+    "hash": "sha256-7FZZbYV8ImJkgKLqWplWiZNzLWNV4FGQxkMuBovUzLE="
   },
   {
     "pname": "AssetRipper.Text.Html",
@@ -141,8 +136,8 @@
   },
   {
     "pname": "AssetRipper.Tpk",
-    "version": "1.1.0",
-    "hash": "sha256-1FJI8HbeJsXc77+uQngG3LJJQt7LshTKoYwtnQ+gyoc="
+    "version": "1.2.0",
+    "hash": "sha256-J1JfyN05hZCGirp650MPzQRRnb8Mk/TELIkbsqmuwV8="
   },
   {
     "pname": "Disarm",
@@ -172,13 +167,18 @@
   },
   {
     "pname": "Microsoft.AspNetCore.OpenApi",
-    "version": "10.0.5",
-    "hash": "sha256-CQXAu6Tm8nOy/rrZksIKGaLW7USEP/N1kwKBMLoh7js="
+    "version": "10.0.7",
+    "hash": "sha256-WlAW49otxYzgrmuqHewUoBsjDcAZwhNz5WVbCT4EiIA="
   },
   {
     "pname": "Microsoft.Bcl.AsyncInterfaces",
-    "version": "10.0.3",
-    "hash": "sha256-+wTcmczUD1qSnnWZ1miijr62/glcRbNWRpEZh/OBU2g="
+    "version": "10.0.7",
+    "hash": "sha256-8K0bmY/vRqUklylaiqmUpgm3ys5s25w83cCw18sn4Gc="
+  },
+  {
+    "pname": "Microsoft.Bcl.Memory",
+    "version": "10.0.7",
+    "hash": "sha256-b/NxUzH+Ut3OIAgY0wYlp5jnE5baHr25uYzofJpe+Zo="
   },
   {
     "pname": "Microsoft.Bcl.Memory",
@@ -235,6 +235,11 @@
     "version": "2.2.1",
     "hash": "sha256-eUZF2/0w5IgGY9UtnZIk1VwwH6VCKP9iPJXVcseIc0c="
   },
+  {
+    "pname": "NAudio.Core",
+    "version": "2.3.0",
+    "hash": "sha256-KUDC2+q+dzZCRUkifePSfxAQCFi+VpIKsSDkYht/Mgw="
+  },
   {
     "pname": "NAudio.Vorbis",
     "version": "1.5.0",
@@ -277,13 +282,13 @@
   },
   {
     "pname": "SharpCompress",
-    "version": "0.38.0",
-    "hash": "sha256-bQL3kazuqbuqn+Csy9RYMMUsNMtqkGXF7x32s787UBM="
+    "version": "0.47.3",
+    "hash": "sha256-q33Y/kVPNAWgfBF2Yz8lyUDrcpqkDNYgUjI3l/QSG9w="
   },
   {
     "pname": "SharpCompress",
-    "version": "0.47.1",
-    "hash": "sha256-rRzSU1SCGOj0E0or5odH7yEExH0IasSSx9RALH7QFYw="
+    "version": "0.47.4",
+    "hash": "sha256-mH0R+al2GUomIYkieYudTmF1mAnIUiifQPTp13eUFg8="
   },
   {
     "pname": "SourceGenerator.Foundations",
@@ -297,23 +302,23 @@
   },
   {
     "pname": "Swashbuckle.AspNetCore",
-    "version": "10.1.5",
-    "hash": "sha256-Xyh9X/naQzXrQ/S6iij/NTCM+jRIWBJzT7qAiSIcHTI="
+    "version": "10.1.7",
+    "hash": "sha256-6NUOoTHcPdJAtrlMVkmgKs/sxuwV1Q78QzG+tt4j4wo="
   },
   {
     "pname": "Swashbuckle.AspNetCore.Swagger",
-    "version": "10.1.5",
-    "hash": "sha256-XXz1DIP7wD3tRJXOsL9qhzOaEAP2kyKIbwZFJdLhI2A="
+    "version": "10.1.7",
+    "hash": "sha256-jRCchEG4ESpuYtbzMDGtKkR9BkLO4Ac3PQwSmu8B6m8="
   },
   {
     "pname": "Swashbuckle.AspNetCore.SwaggerGen",
-    "version": "10.1.5",
-    "hash": "sha256-4NAg4PW934OglxtKgl5x0kvzRlNJThGDpyMX+8NFE+E="
+    "version": "10.1.7",
+    "hash": "sha256-+6xUOc4EJS7KXQySb2wH2FF9yGM5rgzvlJz45QQyXBw="
   },
   {
     "pname": "Swashbuckle.AspNetCore.SwaggerUI",
-    "version": "10.1.5",
-    "hash": "sha256-/XIglebzW9xLEzX19K+lL9/rQDhrBGbfhPP4ZNPcIx0="
+    "version": "10.1.7",
+    "hash": "sha256-5JYW0MKQ0ePdMHHZrDDaWuj7BX0pvA7NT/K6M49TFm4="
   },
   {
     "pname": "System.Buffers",
@@ -337,8 +342,8 @@
   },
   {
     "pname": "System.IO.Pipelines",
-    "version": "10.0.3",
-    "hash": "sha256-+LsHlaUFMFVb60U7GFcvD1l7IpEcjdm1+Iw2g+qrUik="
+    "version": "10.0.7",
+    "hash": "sha256-/xWNrU7ZXdaewiV0YgSestYG+eWCiP13Zx42w3GMzRQ="
   },
   {
     "pname": "System.Memory",
@@ -402,13 +407,13 @@
   },
   {
     "pname": "System.Text.Encodings.Web",
-    "version": "10.0.3",
-    "hash": "sha256-TuOSPfi9dfFnHvH5++zIi30JpRERp35HFpm2R0NWUAk="
+    "version": "10.0.7",
+    "hash": "sha256-6bj4zekpls9T1yPAqlK6oMeoCfl7rabEiy5vDqmOlGI="
   },
   {
     "pname": "System.Text.Json",
-    "version": "10.0.3",
-    "hash": "sha256-E1gPHMAuk2tR4cyScCfsSlDDerhlLAQCUZZMiByIk18="
+    "version": "10.0.7",
+    "hash": "sha256-QBcrNSbTpvMuNEYYCSP9E+i1CXbglJKpS9kVgeDlIsQ="
   },
   {
     "pname": "System.Threading.Tasks.Extensions",
@@ -425,11 +430,6 @@
     "version": "10.0.26100.6",
     "hash": "sha256-oC1WDA7w1kVB9adGZh2KDCvJisRcOkw4Cy87wDjh2qc="
   },
-  {
-    "pname": "ZstdSharp.Port",
-    "version": "0.8.1",
-    "hash": "sha256-PeQvyz3lUrK+t+n1dFtNXCLztQtAfkqUuM6mOqBZHLg="
-  },
   {
     "pname": "ZstdSharp.Port",
     "version": "0.8.7",

pkgs/by-name/as/assetripper/package.nix

@@ -11,13 +11,13 @@
 
 buildDotnetModule (finalAttrs: {
   pname = "assetripper";
-  version = "1.3.12";
+  version = "1.3.14";
 
   src = fetchFromGitHub {
     owner = "AssetRipper";
     repo = "AssetRipper";
     tag = finalAttrs.version;
-    hash = "sha256-pBza6yuMdExKqzhds8Ib5SzRzXRdD5TdEN/Yz7V+zGA=";
+    hash = "sha256-bRz+kvDSPxyt8CNn6sszEcMIxgNNv4FQRFO7zFglPkU=";
   };
 
   buildInputs = [

pkgs/by-name/cl/cloudfox/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "cloudfox";
-  version = "2.0.3";
+  version = "2.0.4";
 
   src = fetchFromGitHub {
     owner = "BishopFox";
     repo = "cloudfox";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cJUbI2DoSsU0NTa3+IB9TrZopwVww3nVZzekk6wk8VU=";
+    hash = "sha256-6GP6NwgBesU9bN997pfQ3jdHeimxOIyBBmiP/v6RT94=";
   };
 
   vendorHash = "sha256-RO/Xn8gDqCWVfI0yFuqHBj4rYh/fIMAJ80kKFj1ZFwI=";

pkgs/by-name/da/davfs2/package.nix

@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchurl,
-  autoreconfHook,
+  autoreconfHook269,
   neon,
   procps,
   replaceVars,
@@ -12,15 +12,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "davfs2";
-  version = "1.7.2";
+  version = "1.7.3";
 
   src = fetchurl {
     url = "mirror://savannah/davfs2/davfs2-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-G9wrsjWp8uVGpqE8VZ7PQ8ZEB+PESX13uOw/YvS4TkY=";
+    sha256 = "sha256-pTaBYetQVWUdfl6BgMFgbaleeMlBtruKkobfeSPPy6k=";
   };
 
   nativeBuildInputs = [
-    autoreconfHook
+    autoreconfHook269
   ];
 
   buildInputs = [

pkgs/by-name/fo/forge-mtg/package.nix

@@ -16,13 +16,13 @@
 }:
 
 let
-  version = "2.0.11";
+  version = "2.0.12";
 
   src = fetchFromGitHub {
     owner = "Card-Forge";
     repo = "forge";
     rev = "forge-${version}";
-    hash = "sha256-72BeLmX6TDz/Z3LwnKsEEK4BntE4dp9DsbsrAkh1K2U=";
+    hash = "sha256-OwrjpK5aqEx5HCZqU+iLJtkUtmt5yGW1bHLrX1UYf3Q=";
   };
 
   # launch4j downloads and runs a native binary during the package phase.
@@ -33,7 +33,7 @@ maven.buildMavenPackage {
   pname = "forge-mtg";
   inherit version src patches;
 
-  mvnHash = "sha256-OnxgoJhpJndYpkSmFdM+aniwrArPjPtn2E/4McU6J2k=";
+  mvnHash = "sha256-OmjrAwYzvW8ejR3/bUVQhy05vACVTG19Bznpl1SbaYs=";
 
   doCheck = false; # Needs a running Xorg
 

pkgs/by-name/fr/frr/package.nix

@@ -31,7 +31,8 @@
   readline,
   rtrlib,
   protobufc,
-  zeromq,
+  sqlite,
+  lua53Packages,
 
   # tests
   net-tools,
@@ -80,13 +81,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "frr";
-  version = "10.5.3";
+  version = "10.6.0";
 
   src = fetchFromGitHub {
     owner = "FRRouting";
     repo = "frr";
     rev = "frr-${finalAttrs.version}";
-    hash = "sha256-nVXoRApW8EZtP1HiGJ5JBJaoQXVISfPK2k+xmCtdVH0=";
+    hash = "sha256-o0h9adGvb9FEcAMYrjrjTb7MMozdXriOsK6fE0fGjss=";
   };
 
   # Without the std explicitly set, we may run into abseil-cpp
@@ -119,7 +120,8 @@ stdenv.mkDerivation (finalAttrs: {
     python3
     readline
     rtrlib
-    zeromq
+    lua53Packages.lua
+    sqlite
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     libcap
@@ -148,11 +150,14 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   configureFlags = [
+    "--disable-zeromq"
     "--disable-silent-rules"
     "--enable-configfile-mask=0640"
     "--enable-group=frr"
     "--enable-logfile-mask=0640"
     "--enable-multipath=${toString numMultipath}"
+    "--enable-config-rollbacks"
+    "--enable-scripting"
     "--enable-user=frr"
     "--enable-vty-group=frrvty"
     "--localstatedir=/var"

pkgs/by-name/gr/grype/0001-test_helpers-redact-support-nix.patch

@@ -0,0 +1,35 @@
+diff --git a/grype/presenter/internal/test_helpers.go b/grype/presenter/internal/test_helpers.go
+index 2bfafbc2..6e70ed87 100644
+--- a/grype/presenter/internal/test_helpers.go
++++ b/grype/presenter/internal/test_helpers.go
+@@ -1,6 +1,7 @@
+ package internal
+ 
+ import (
++	"os"
+ 	"regexp"
+ 	"testing"
+ 
+@@ -92,8 +93,21 @@ func Redact(s []byte) []byte {
+ 	cycloneDxBomRefPattern := regexp.MustCompile(`[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}`)
+ 	tempDirPattern := regexp.MustCompile(`/tmp/[^"]+`)
+ 	macTempDirPattern := regexp.MustCompile(`/var/folders/[^"]+`)
++	// nix build dir isn't always /build so we'll identify it by $TMP
++	nixDir := os.Getenv("TMP")
++	if nixDir == "" {
++		panic("missing $TMP for identifying nix build dir")
++	}
++	end := regexp.QuoteMeta(nixDir)
++	pattern := `[^"]+`
++	// add slash prefix to pattern only if required
++	// don't use strings lib to reduce chance of merge conflicts above
++	if end[len(end)-1] != '/' {
++		pattern = "/" + pattern
++	}
++	nixBuildDirPattern := regexp.MustCompile(end + pattern)
+ 
+-	for _, pattern := range []*regexp.Regexp{serialPattern, rfc3339Pattern, refPattern, uuidPattern, cycloneDxBomRefPattern, tempDirPattern, macTempDirPattern} {
++	for _, pattern := range []*regexp.Regexp{serialPattern, rfc3339Pattern, refPattern, uuidPattern, cycloneDxBomRefPattern, tempDirPattern, macTempDirPattern, nixBuildDirPattern} {
+ 		s = pattern.ReplaceAll(s, []byte(""))
+ 	}
+ 	return s

pkgs/by-name/gr/grype/package.nix

@@ -7,17 +7,21 @@
   installShellFiles,
   openssl,
   net-tools,
+  zstd,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "grype";
-  version = "0.108.0";
+  version = "0.111.1";
+
+  # required for tests
+  __darwinAllowLocalNetworking = true;
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = "grype";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5TYQKLVl3iM1Litp86n0aAaj3p2yKA1fbJ6bduIjfp8=";
+    hash = "sha256-eAiExxvLFkHsmslfhhbQG0ogaSMF9eOeCq0u2wUimp0=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -32,7 +36,13 @@ buildGoModule (finalAttrs: {
 
   proxyVendor = true;
 
-  vendorHash = "sha256-8LVpcSjWdGwYv8CMuMZyaHC9+wMJNPDSNV6a8VsmA0M=";
+  vendorHash = "sha256-rsdZt+xKjIJpWS5pYx8A+ryY1D2WIKquKjsQBkxToUQ=";
+
+  patches = [
+    # several test golden files have unstable paths based on the platform
+    # this patch adjusts the `Redact` helper to also work for builds by nix.
+    ./0001-test_helpers-redact-support-nix.patch
+  ];
 
   nativeBuildInputs = [ installShellFiles ];
 
@@ -40,6 +50,7 @@ buildGoModule (finalAttrs: {
     git
     openssl
     net-tools
+    zstd
   ];
 
   subPackages = [ "cmd/grype" ];
@@ -70,54 +81,39 @@ buildGoModule (finalAttrs: {
     unset ldflags
 
     # patch utility script
-    patchShebangs grype/db/v5/distribution/test-fixtures/tls/generate-x509-cert-pair.sh
-
-    # FIXME: these tests fail when building with Nix
-    substituteInPlace test/cli/config_test.go \
-      --replace-fail "Test_configLoading" "Skip_configLoading"
-    substituteInPlace test/cli/db_providers_test.go \
-      --replace-fail "TestDBProviders" "SkipDBProviders"
-    substituteInPlace grype/presenter/cyclonedx/presenter_test.go \
-      --replace-fail "TestCycloneDxPresenterDir" "SkipCycloneDxPresenterDir" \
-      --replace-fail "Test_CycloneDX_Valid" "Skip_CycloneDX_Valid"
-
-    # remove tests that depend on docker
-    substituteInPlace test/cli/cmd_test.go \
-      --replace-fail "TestCmd" "SkipCmd"
-    substituteInPlace grype/pkg/provider_test.go \
-      --replace-fail "TestSyftLocationExcludes" "SkipSyftLocationExcludes"
-    substituteInPlace test/cli/cmd_test.go \
-      --replace-fail "Test_descriptorNameAndVersionSet" "Skip_descriptorNameAndVersionSet"
-
-    # remove tests that depend on git
-    substituteInPlace test/cli/db_validations_test.go \
-      --replace-fail "TestDBValidations" "SkipDBValidations"
-    substituteInPlace test/cli/registry_auth_test.go \
-      --replace-fail "TestRegistryAuth" "SkipRegistryAuth"
-    substituteInPlace test/cli/sbom_input_test.go \
-      --replace-fail "TestSBOMInput_FromStdin" "SkipSBOMInput_FromStdin" \
-      --replace-fail "TestSBOMInput_AsArgument" "SkipSBOMInput_AsArgument"
-    substituteInPlace test/cli/subprocess_test.go \
-      --replace-fail "TestSubprocessStdin" "SkipSubprocessStdin"
-    substituteInPlace grype/internal/packagemetadata/names_test.go \
-      --replace-fail "TestAllNames" "SkipAllNames"
-    substituteInPlace test/cli/version_cmd_test.go \
-      --replace-fail "TestVersionCmdPrintsToStdout" "SkipVersionCmdPrintsToStdout"
-    substituteInPlace grype/presenter/sarif/presenter_test.go \
-      --replace-fail "Test_SarifIsValid" "SkipTest_SarifIsValid"
-    substituteInPlace test/cli/config_test.go \
-      --replace-fail "Test_dpkgUseCPEsForEOLEnvVar" "SkipTest_dpkgUseCPEsForEOLEnvVar" \
-      --replace-fail "Test_rpmUseCPEsForEOLEnvVar" "SkipTest_rpmUseCPEsForEOLEnvVar"
-
-    # May fail on NixOS, probably due bug in how syft handles tmpfs.
-    # See https://github.com/anchore/grype/issues/1822
-    substituteInPlace grype/distro/distro_test.go \
-      --replace-fail "Test_NewDistroFromRelease_Coverage" "SkipTest_NewDistroFromRelease_Coverage"
-
-    # segfault
-    rm grype/db/v5/namespace/cpe/namespace_test.go
+    patchShebangs grype/db/v5/distribution/testdata/tls/generate-x509-cert-pair.sh
   '';
 
+  checkFlags =
+    let
+      skippedTests = [
+        # depend on docker
+        "TestCmd"
+        "TestSyftLocationExcludes"
+        "Test_descriptorNameAndVersionSet"
+        # depend on .git
+        "Test_configLoading"
+        "TestDBProviders"
+        "TestDBValidations"
+        "TestRegistryAuth"
+        "TestRegistryAuthRedactions"
+        "TestSBOMInput_FromStdin"
+        "TestSBOMInput_AsArgument"
+        "TestSubprocessStdin"
+        "TestAllNames"
+        "TestVersionCmdPrintsToStdout"
+        "Test_SarifIsValid"
+        "Test_dpkgUseCPEsForEOLEnvVar"
+        "Test_rpmUseCPEsForEOLEnvVar"
+      ]
+      ++ lib.optionals stdenv.isDarwin [
+        # fails to generate x509 certificate
+        # cat: /etc/ssl/openssl.cnf: Operation not permitted
+        "Test_defaultHTTPClientHasCert"
+      ];
+    in
+    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
+
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd grype \
       --bash <($out/bin/grype completion bash) \

pkgs/by-name/ho/home-assistant-matter-hub/package.nix

@@ -11,13 +11,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "home-assistant-matter-hub";
-  version = "2.0.41";
+  version = "2.0.42";
 
   src = fetchFromGitHub {
     owner = "RiDDiX";
     repo = "home-assistant-matter-hub";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+W0HjULERuW+RY7938xGnEXwmCpkumLpUlZmvfuhX2Y=";
+    hash = "sha256-joaw/YrDmYhfxRwr73IMc2FVEOG6zSlLGIru9lHKHjo=";
   };
 
   # The bundled cli.js imports transitive dependencies (e.g. @noble/curves)

pkgs/by-name/ho/homebridge-config-ui-x/package.nix

@@ -13,23 +13,23 @@
 
 buildNpmPackage.override { nodejs = nodejs_22; } (finalAttrs: {
   pname = "homebridge-config-ui-x";
-  version = "5.18.0";
+  version = "5.22.0";
 
   src = fetchFromGitHub {
     owner = "homebridge";
     repo = "homebridge-config-ui-x";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bdE/uu3uh3qgPNaDKU47wD1LtER/wJfLmwp2J624rK4=";
+    hash = "sha256-UVrl0TGSNQPnNZ76XkY+nf+a/6r037k0Y2RWe4nyBwI=";
   };
 
   # Deps hash for the root package
-  npmDepsHash = "sha256-pbmnAAQs6RVwklAoKY4LY0k+nheX2BeAgkQEFNVDofc=";
+  npmDepsHash = "sha256-AStDHQSDD2CpS9eSuDYeogs0PgHoQ4doTwzHD0XVU+A=";
 
   # Deps src and hash for ui subdirectory
   npmDeps_ui = fetchNpmDeps {
     name = "npm-deps-ui";
     src = "${finalAttrs.src}/ui";
-    hash = "sha256-uBB2WxbCXJL2Ys6sMFcLUlh88TLAz3U+XMhvDc8yFPk=";
+    hash = "sha256-20WItWmuHiNF/DNbenlxCro09O3bOTBsTD9T+gvvlJ0=";
   };
 
   # Need to also run npm ci in the ui subdirectory

pkgs/by-name/i2/i2pd/package.nix

@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "i2pd";
-  version = "2.59.0";
+  version = "2.60.0";
 
   src = fetchFromGitHub {
     owner = "PurpleI2P";
     repo = "i2pd";
     tag = finalAttrs.version;
-    hash = "sha256-PBwjP54gVtMduN//OXxd35KnRJv7sbA1MIUU+1KNUac=";
+    hash = "sha256-oVC31GpygznXbmjQ3qv3XZ58jZ9l6ibBoueuBM5Hk0M=";
   };
 
   postPatch = lib.optionalString (!stdenv.hostPlatform.isx86) ''

pkgs/by-name/in/intel-compute-runtime/package.nix

@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "intel-compute-runtime";
-  version = "26.09.37435.1";
+  version = "26.14.37833.4";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "compute-runtime";
     tag = finalAttrs.version;
-    hash = "sha256-FKqsyjkxOcqtVv+chGTFn9dhYwkWaDomWdFQlF85RDM=";
+    hash = "sha256-W8lRvxvmsWQbVj+1a6RPLnjqLY206o1yl7PN5wf5DPw=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/in/intel-llvm/package.nix

@@ -24,6 +24,19 @@ let
   #      .override { .. }
   #      .overrideAttrs { .. }
   #  })
+  #
+  # Note that this package does not support cross-compilation at the moment.
+  #
+  # TODO: Support cross
+  #  The easiest path for this will likely be to use standalone packaging,
+  #  and use the existing LLVM derivation with overrides. Though that won't
+  #  be very workable until upstream support for standalone improves,
+  #  see https://github.com/intel/llvm/issues/21877 for that.
+  #
+  #  Due to the multi-stage build, at several times during compilation
+  #  the package runs binaries that were just compiled, and for cross these
+  #  would need to be compiled for the host and not target platform,
+  #  which is non-trivial to configure.
   scope = lib.makeScope newScope (self: {
     # == Parameters for overriding ==
 
@@ -89,22 +102,23 @@ let
         ;
     };
 
-    wrapper =
-      (wrapCCWith {
-        cc = self.unwrapped;
-        # This is needed for tools like clang-scan-deps to find headers.
-        # The build commands here are the same as the vanilla LLVM derivation.
-        extraBuildCommands = ''
-          rsrc="$out/resource-root"
-          mkdir "$rsrc"
-          echo "-resource-dir=$rsrc" >> $out/nix-support/cc-cflags
-          ln -s "${lib.getLib self.unwrapped}/lib/clang/${self.llvmMajorVersion}/include" "$rsrc"
-        '';
-      }).overrideAttrs
-        (old: {
-          # OpenCL needs to be passed through
-          propagatedBuildInputs = old.propagatedBuildInputs ++ self.unwrapped.propagatedBuildInputs;
-        });
+    wrapper = wrapCCWith {
+      cc = self.unwrapped;
+      # This is needed for tools like clang-scan-deps to find headers.
+      # The build commands here are the same as the vanilla LLVM derivation.
+      extraBuildCommands = ''
+        rsrc="$out/resource-root"
+        mkdir "$rsrc"
+        echo "-resource-dir=$rsrc" >> $out/nix-support/cc-cflags
+        ln -s "${lib.getLib self.unwrapped}/lib/clang/${self.llvmMajorVersion}/include" "$rsrc"
+      '';
+
+      extraPackages =
+        # We need to explicitly link to the dev package to get headers like sycl.hpp
+        [ self.unwrapped.dev ] # TODO: This needs to be from targetPackages once the package gets cross support
+        # OpenCL and such need to be passed through
+        ++ self.unwrapped.propagatedBuildInputs;
+    };
 
     clang-tools-wrapper = callPackage ./clang-tools.nix {
       inherit (self) unwrapped wrapper;

pkgs/by-name/in/intel-media-driver/package.nix

@@ -17,7 +17,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "intel-media-driver";
-  version = "26.1.2";
+  version = "26.1.6";
 
   outputs = [
     "out"
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "intel";
     repo = "media-driver";
     tag = "intel-media-${finalAttrs.version}";
-    hash = "sha256-Vy489YYuaI+atWiNiVyN/JXIMhSCWC5murJcn/qVb74=";
+    hash = "sha256-Jk9pIZ1V1tKi9l6u10tftClVZhYn2ECvALt26n58XC0=";
   };
 
   patches = [

pkgs/by-name/js/jsoncons/package.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "jsoncons";
-  version = "1.6.0";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "danielaparker";
     repo = "jsoncons";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-p+LMT0231ZKtxoTqWjUZof3WQu+lLqAS3n20u9dYTzM=";
+    hash = "sha256-OhXcHMec+cExLLl0GuXoro93u1w/BTLY5bBh+4uUK5s=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/li/librime-lua/package.nix

@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "librime-lua";
-  version = "0-unstable-2025-07-07";
+  version = "0-unstable-2026-04-26";
 
   src = fetchFromGitHub {
     owner = "hchunhui";
     repo = "librime-lua";
-    rev = "68f9c364a2d25a04c7d4794981d7c796b05ab627";
-    hash = "sha256-m7/qXdIlMMHscDDcFmusNuOR0cuzPpDQdprqRci8qZw=";
+    rev = "ef17b1f5e0c3f430d6039309d8ebd27bb26bc671";
+    hash = "sha256-kuNvJUiAlt+78U5ZqRbets2M/mrsVaECYxVFZRW/R40=";
   };
 
   propagatedBuildInputs = [ lua ];

pkgs/by-name/mo/moon-child-fe/package.nix

@@ -0,0 +1,104 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  sdl3,
+  zlib,
+  pkg-config,
+  sdl_gamecontrollerdb,
+  copyDesktopItems,
+  makeDesktopItem,
+  iconConvTools,
+}:
+let
+  plMpegSrc = fetchFromGitHub {
+    owner = "phoboslab";
+    repo = "pl_mpeg";
+    rev = "c871f2be022ece7ef4f64230b4fb8e1fb9eb6023";
+    hash = "sha256-Mr+hid5RRQ2Yh6UcNDFFbbHMrGGVju0o20KIAEvzEg8=";
+  };
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "moon-child-fe";
+  version = "1.0.5";
+
+  src = fetchFromGitHub {
+    owner = "MorsGames";
+    repo = "MoonChildFE";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-SqoCSAFkQKcEbwDwHqicYXnQ8/HC523c+ePQFB+6rus=";
+  };
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  cmakeFlags = [
+    (lib.cmakeFeature "MOONCHILD_RENDERER_BACKEND" "SDL3")
+    (lib.cmakeBool "MOONCHILD_VENDORED_SDL3" false)
+    (lib.cmakeBool "MOONCHILD_VENDORED_ZLIB" false)
+    (lib.cmakeBool "MOONCHILD_VENDORED_GAMECONTROLLERDB" false)
+    (lib.cmakeBool "MOONCHILD_VENDORED_PL_MPEG" false)
+  ];
+
+  env = {
+    MOONCHILD_PL_MPEG_PATH = plMpegSrc;
+    MOONCHILD_GAMECONTROLLERDB_PATH = "${sdl_gamecontrollerdb}/share/gamecontrollerdb.txt";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    copyDesktopItems
+    iconConvTools
+  ];
+
+  buildInputs = [
+    sdl3
+    zlib
+    sdl_gamecontrollerdb
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin $out/share/icons/hicolor/256x256/apps/
+
+    cd /build/source
+    mv ./Bin/Release $out/share/MoonChildFE
+    icoFileToHiColorTheme game.ico MoonChildFE $out
+
+    ln -s $out/share/MoonChildFE/MoonChildFE $out/bin/MoonChildFE
+
+    runHook postInstall
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "MoonChildFE";
+      desktopName = "Moon Child - Friend Edition";
+      exec = "MoonChildFE";
+      icon = "MoonChildFE";
+      comment = finalAttrs.meta.description;
+      startupWMClass = "MoonChildFE";
+      categories = [
+        "Game"
+      ];
+    })
+  ];
+
+  meta = {
+    changelog = "https://github.com/MorsGames/MoonChildFE/releases/tag/v${finalAttrs.version}";
+    description = "Modern source port of the 1997 Windows 95 classic, Moon Child";
+    homepage = "https://github.com/MorsGames/MoonChildFE";
+    license = with lib.licenses; [
+      # Code
+      mit
+      # Assets
+      cc-by-nc-40
+    ];
+    mainProgram = "MoonChildFE";
+    maintainers = [ lib.maintainers.pyrox0 ];
+    platforms = lib.platforms.linux;
+  };
+})

pkgs/by-name/mo/moon-child-fe/unvendor-deps.patch

@@ -0,0 +1,132 @@
+diff --git c/CMakeLists.txt w/CMakeLists.txt
+index 63803d8..49982bc 100644
+--- c/CMakeLists.txt
++++ w/CMakeLists.txt
+@@ -25,6 +25,12 @@ option(MOONCHILD_INPUT_SDL3 "Use SDL3 input backend" ON)
+ 
+ option(MOONCHILD_AUDIO_SDL3 "Use SDL3 audio backend" ON)
+ 
++# Vendoring options
++option(MOONCHILD_VENDORED_SDL3 "Use vendored SDL3 library" ON)
++option(MOONCHILD_VENDORED_ZLIB "Use vendored zlib library" ON)
++option(MOONCHILD_VENDORED_GAMECONTROLLERDB "Use vendored SDL_GameControllerDB" ON)
++option(MOONCHILD_VENDORED_PL_MPEG "Use vendored pl_mpeg library" ON)
++
+ # Aggregate flags
+ if(MOONCHILD_WINDOW_SDL3 OR MOONCHILD_RENDERER_SDL3 OR MOONCHILD_INPUT_SDL3 OR MOONCHILD_AUDIO_SDL3)
+     set(MOONCHILD_USE_SDL3 ON)
+@@ -57,6 +63,7 @@ endif()
+ 
+ # SDL3 stuff
+ if(MOONCHILD_USE_SDL3)
++  if(MOONCHILD_VENDORED_SDL3)
+     set(SDL_SHARED       OFF CACHE BOOL "" FORCE)
+     set(SDL_STATIC       ON  CACHE BOOL "" FORCE)
+     set(SDL_TEST_LIBRARY OFF CACHE BOOL "" FORCE)
+@@ -74,13 +81,28 @@ if(MOONCHILD_USE_SDL3)
+     else()
+         message(FATAL_ERROR "Could not find an SDL3 target to link!")
+     endif()
++  else()
++    find_package(SDL3)
++  endif()
+ endif()
+ 
+ # zlib stuff
+-set(ZLIB_BUILD_EXAMPLES OFF CACHE BOOL "" FORCE)
+-set(ZLIB_BUILD_SHARED   OFF CACHE BOOL "" FORCE)
+-set(ZLIB_BUILD_STATIC   ON  CACHE BOOL "" FORCE)
+-add_subdirectory("${LIBRARY_DIR}/zlib" "${CMAKE_BINARY_DIR}/zlib" EXCLUDE_FROM_ALL)
++if(MOONCHILD_VENDORED_ZLIB)
++  set(ZLIB_BUILD_EXAMPLES OFF CACHE BOOL "" FORCE)
++  set(ZLIB_BUILD_SHARED   OFF CACHE BOOL "" FORCE)
++  set(ZLIB_BUILD_STATIC   ON  CACHE BOOL "" FORCE)
++  add_subdirectory("${LIBRARY_DIR}/zlib" "${CMAKE_BINARY_DIR}/zlib" EXCLUDE_FROM_ALL)
++else()
++  find_package(ZLIB)
++endif()
++
++# SDL_gamecontrollerdb path
++if(MOONCHILD_VENDORED_GAMECONTROLLERDB)
++  set(MOONCHILD_GAMECONTROLLERDB_PATH "gamecontrollerdb.txt")
++else()
++  set(MOONCHILD_GAMECONTROLLERDB_PATH "$ENV{MOONCHILD_GAMECONTROLLERDB_PATH}")
++  file(TO_CMAKE_PATH "${MOONCHILD_GAMECONTROLLERDB_PATH}" MOONCHILD_GAMECONTROLLERDB_PATH)
++endif()
+ 
+ # Game + framework
+ # TODO: Unglobify this
+@@ -171,6 +193,15 @@ target_include_directories(${EXECUTABLE_NAME} PRIVATE
+     ${LIBRARY_DIR}/pl_mpeg
+     ${BACKEND_INCLUDES}
+ )
++if(MOONCHILD_VENDORED_PL_MPEG)
++  target_include_directories(${EXECUTABLE_NAME} PRIVATE
++    ${LIBRARY_DIR}/pl_mpeg
++  )
++else()
++  target_include_directories(${EXECUTABLE_NAME} PRIVATE
++    $ENV{MOONCHILD_PL_MPEG_PATH}
++  )
++endif()
+ 
+ # Backend selection macros
+ if(MOONCHILD_WINDOW_SDL3)
+@@ -185,6 +216,11 @@ if(MOONCHILD_RENDERER_SDL3)
+ endif()
+ if(MOONCHILD_INPUT_SDL3)
+     target_compile_definitions(${EXECUTABLE_NAME} PRIVATE MOONCHILD_INPUT_SDL3)
++    if(NOT MOONCHILD_GAMECONTROLLERDB_PATH STREQUAL "")
++        target_compile_definitions(${EXECUTABLE_NAME} PRIVATE
++            MOONCHILD_GAMECONTROLLERDB_PATH=\"${MOONCHILD_GAMECONTROLLERDB_PATH}\"
++        )
++    endif()
+ endif()
+ if(MOONCHILD_AUDIO_SDL3)
+     target_compile_definitions(${EXECUTABLE_NAME} PRIVATE MOONCHILD_AUDIO_SDL3)
+@@ -201,10 +237,16 @@ if(MSVC)
+     target_compile_definitions(${EXECUTABLE_NAME} PRIVATE _CRT_SECURE_NO_WARNINGS)
+ endif()
+ 
+-target_link_libraries(${EXECUTABLE_NAME} PRIVATE zlibstatic)
++if(MOONCHILD_VENDORED_ZLIB)
++  target_link_libraries(${EXECUTABLE_NAME} PRIVATE zlibstatic)
++else()
++  target_link_libraries(${EXECUTABLE_NAME} PRIVATE ZLIB::ZLIB)
++endif()
+ 
+-if(MOONCHILD_USE_SDL3)
++if(MOONCHILD_USE_SDL3 AND MOONCHILD_VENDORED_SDL3)
+     target_link_libraries(${EXECUTABLE_NAME} PRIVATE ${MOONCHILD_SDL_TARGET})
++elseif(MOONCHILD_USE_SDL3 AND NOT MOONCHILD_VENDORED_SDL3)
++    target_link_libraries(${EXECUTABLE_NAME} PRIVATE SDL3::SDL3)
+ endif()
+ 
+ # Platform specific configuration
+@@ -239,7 +281,7 @@ set_target_properties(${EXECUTABLE_NAME} PROPERTIES
+     RUNTIME_OUTPUT_DIRECTORY_RELEASE        ${MOONCHILD_BIN_DIR}/Release
+ )
+ 
+-if(MOONCHILD_INPUT_SDL3 AND NOT EMSCRIPTEN)
++if(MOONCHILD_INPUT_SDL3 AND NOT EMSCRIPTEN AND MOONCHILD_VENDORED_GAMECONTROLLERDB)
+     add_custom_command(TARGET ${EXECUTABLE_NAME} POST_BUILD
+         COMMAND ${CMAKE_COMMAND} -E copy_if_different
+             "${LIBRARY_DIR}/SDL_GameControllerDB/gamecontrollerdb.txt"
+diff --git c/Platform/Backends/Input/SDL3Input.cpp w/Platform/Backends/Input/SDL3Input.cpp
+index d214516..1412c00 100644
+--- c/Platform/Backends/Input/SDL3Input.cpp
++++ w/Platform/Backends/Input/SDL3Input.cpp
+@@ -19,10 +19,12 @@ bool SDL3Input::Init()
+         return false;
+     }
+ 
+-    if (SDL_AddGamepadMappingsFromFile("gamecontrollerdb.txt") < 0)
++#ifdef MOONCHILD_GAMECONTROLLERDB_PATH
++    if (SDL_AddGamepadMappingsFromFile(MOONCHILD_GAMECONTROLLERDB_PATH) < 0)
+     {
+         printf("SDL gamepad mapping load failed! %s\n", SDL_GetError());
+     }
++#endif
+ 
+     int count = 0;
+     if (SDL_JoystickID* ids = SDL_GetGamepads(&count))

pkgs/by-name/mu/munge/package.nix

@@ -20,6 +20,12 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-Hoaldm55E0HC3qqqBS5uZvlgcWepnVLyJNQMB2P/t9Q=";
   };
 
+  outputs = [
+    "out"
+    "dev"
+    "man"
+  ];
+
   nativeBuildInputs = [
     autoreconfHook
     libgcrypt # provides libgcrypt.m4

pkgs/by-name/ni/nixl/package.nix

@@ -0,0 +1,156 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+
+  # nativeBuildInputs
+  cmake,
+  gitMinimal,
+  meson,
+  ninja,
+  pkg-config,
+  python3,
+
+  # buildInputs
+  abseil-cpp,
+  asio,
+  aws-sdk-cpp,
+  hwloc,
+  libaio,
+  libfabric,
+  liburing,
+  numactl,
+  python3Packages,
+  taskflow,
+  ucx,
+
+  # passthru
+  nix-update-script,
+
+  config,
+  cudaPackages,
+  cudaSupport ? config.cudaSupport,
+}:
+let
+  effectiveStdenv = if cudaSupport then cudaPackages.backendStdenv else stdenv;
+in
+effectiveStdenv.mkDerivation (finalAttrs: {
+  pname = "nixl";
+  version = "1.0.1";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "ai-dynamo";
+    repo = "nixl";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-mDpDqwUwI0baIDDpt9/wgIP3saBWY8yWKgwzHgrzJiU=";
+  };
+
+  postPatch =
+    # Fix deprecated abseil-cpp Mutex API (Lock/Unlock/ReaderLock/ReaderUnlock
+    # replaced by lock/unlock/lock_shared/unlock_shared in abseil 20260107)
+    ''
+      substituteInPlace src/core/sync.h \
+        --replace-fail 'm.Lock()' 'm.lock()' \
+        --replace-fail 'm.Unlock()' 'm.unlock()' \
+        --replace-fail 'm.ReaderLock()' 'm.lock_shared()' \
+        --replace-fail 'm.ReaderUnlock()' 'm.unlock_shared()'
+    ''
+    # Fix asio::io_context::post() removed in asio 1.36+
+    # Use the free function asio::post(io_context, handler) instead
+    + ''
+      substituteInPlace src/plugins/ucx/ucx_backend.cpp \
+        --replace-fail 'io_->post(' 'asio::post(*io_, '
+    ''
+    # Fix UB: explicit destructor call on lock_guard (GCC 15 -Werror=maybe-uninitialized)
+    # Replace lock_guard + manual destructor with unique_lock + unlock()
+    + ''
+      substituteInPlace src/plugins/libfabric/libfabric_backend.cpp \
+        --replace-fail \
+          'std::lock_guard<std::mutex> lock(connection_state_mutex_);' \
+          'std::unique_lock<std::mutex> lock(connection_state_mutex_);' \
+        --replace-fail \
+          'lock.~lock_guard();' \
+          'lock.unlock();'
+    ''
+    # Fix GDS plugin: Nix uses lib/ not lib64/
+    + ''
+      substituteInPlace src/plugins/cuda_gds/meson.build src/plugins/gds_mt/meson.build \
+        --replace-fail "'/lib64'" "'/lib'"
+    '';
+
+  nativeBuildInputs = [
+    cmake
+    gitMinimal
+    meson
+    ninja
+    pkg-config
+    python3
+  ]
+  ++ lib.optionals cudaSupport [
+    cudaPackages.cuda_nvcc
+  ];
+  dontUseCmakeConfigure = true;
+
+  buildInputs = [
+    abseil-cpp
+    asio
+    aws-sdk-cpp
+    hwloc
+    libaio
+    libfabric
+    liburing
+    numactl
+    taskflow
+    ucx
+
+    python3Packages.python
+    # Using C++ header files, not Python import
+    python3Packages.pybind11
+  ]
+  ++ lib.optionals cudaSupport (
+    with cudaPackages;
+    [
+      cuda_cudart
+      cuda_nvcc # crt/host_config.h; even though we include this in nativeBuildInputs, it's needed here too
+      libcufile # cufile.h
+    ]
+    # libcuobjclient is only available on cuda>=13.1
+    ++ lib.optionals (libcuobjclient.meta.available or false) [
+      libcuobjclient
+    ]
+  );
+
+  mesonFlags = [
+    (lib.mesonOption "cudapath_lib" "${lib.getLib cudaPackages.cuda_cudart}/lib")
+    (lib.mesonOption "gds_path" (lib.getInclude cudaPackages.cuda_cudart).outPath)
+
+    # Override C++17 -> C++20: taskflow 4.0 headers require C++20 features
+    # (std::bit_ceil, std::atomic::wait/notify, std::atomic_flag::test, etc.)
+    (lib.mesonOption "cpp_std" "c++20")
+
+    # Disable -Werror to prevent false positives from stricter GCC 15 -Wmaybe-uninitialized
+    (lib.mesonOption "werror" "false")
+  ];
+
+  passthru = {
+    updateScript = nix-update-script { };
+
+    # propagate the stdenv so that the python API can consume it directly
+    stdenv = effectiveStdenv;
+
+    pythonPackage = python3Packages.nixl;
+  };
+
+  meta = {
+    description = "NVIDIA Inference Xfer Library";
+    homepage = "https://github.com/ai-dynamo/nixl";
+    changelog = "https://github.com/ai-dynamo/nixl/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+    platforms = lib.platforms.all;
+    broken = !cudaSupport;
+  };
+})

pkgs/by-name/ow/owi/package.nix

@@ -15,14 +15,14 @@ let
 in
 ocamlPackages.buildDunePackage {
   pname = "owi";
-  version = "0.2-unstable-2026-04-12";
+  version = "0.2-unstable-2026-04-27";
 
   src = fetchFromGitHub {
     owner = "ocamlpro";
     repo = "owi";
-    rev = "cd54ee715561dc40c9338a16d37eabaa65cbbeaf";
+    rev = "1a26145d95835096b3e86e8b2376c5650159b6c6";
     fetchSubmodules = true;
-    hash = "sha256-ET/UHwQ0wwXtP1CzAksPi7BRJXyefE4qvi+2r1vl3OI=";
+    hash = "sha256-xVNz9B3a6khlA7omv1+vJDreLrVNAFpcLBxPPx36/5E=";
   };
 
   nativeBuildInputs = with ocamlPackages; [

pkgs/by-name/pd/pdfcpu/package.nix

@@ -4,17 +4,18 @@
   stdenv,
   fetchFromGitHub,
   writableTmpDirAsHomeHook,
+  installShellFiles,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "pdfcpu";
-  version = "0.11.1";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "pdfcpu";
     repo = "pdfcpu";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0xsa7/WlqjRMP961FTonfty40+C1knI3szCmCDfZJ/0=";
+    hash = "sha256-qCSfcxeMM7HzJIaeZJxjUVc834NmigpDKaxFQ0oSdkg=";
     # Apparently upstream requires that the compiled executable will know the
     # commit hash and the date of the commit. This information is also presented
     # in the output of `pdfcpu version` which we use as a sanity check in the
@@ -37,7 +38,7 @@ buildGoModule (finalAttrs: {
     '';
   };
 
-  vendorHash = "sha256-wZYYIcPhyDlmIhuJs91EqPB8AjLIDHz39lXh35LHUwQ=";
+  vendorHash = "sha256-5+zHlHp/8Jp9TE87IUgJqQHDINNe7ah34jPW/n5ORz8=";
 
   ldflags = [
     "-s"
@@ -51,6 +52,17 @@ buildGoModule (finalAttrs: {
     ldflags+=" -X main.date=$(cat SOURCE_DATE)"
   '';
 
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
+  postInstall = ''
+    installShellCompletion --cmd pdfcpu \
+      --zsh <($out/bin/pdfcpu completion zsh) \
+      --fish <($out/bin/pdfcpu completion fish) \
+      --bash <($out/bin/pdfcpu completion bash)
+  '';
+
   # No tests
   doCheck = false;
   doInstallCheck = true;

pkgs/by-name/pg/pgbackrest/package.nix

@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pgbackrest";
-  version = "2.57.0";
+  version = "2.58.0";
 
   src = fetchFromGitHub {
     owner = "pgbackrest";
     repo = "pgbackrest";
     tag = "release/${finalAttrs.version}";
-    hash = "sha256-TwyMWE9/aCWBIn+AKGaR0UC5qScWPEaDyOG723/2NHA=";
+    hash = "sha256-RxvVqThfGnTCWTaM54Job+2HgJ7baf6ciFYTz496aKQ=";
   };
 
   strictDeps = true;

pkgs/by-name/pl/plus42/package.nix

@@ -11,11 +11,11 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "plus42";
-  version = "1.3.13";
+  version = "1.3.14";
 
   src = fetchurl {
     url = "https://thomasokken.com/plus42/upstream/plus42-upstream-${finalAttrs.version}.tgz";
-    hash = "sha256-I5SAR6vEufzT2Cgs4RQk8AWDZWm+QOLtHRqaED2DQtA=";
+    hash = "sha256-ndw4wI+o5eGfqOceSBGnpdQoel89MYxuv8G3CQRZ+6c=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/pm/pmix/package.nix

@@ -61,7 +61,8 @@ stdenv.mkDerivation (finalAttrs: {
   configureFlags = [
     "--with-libevent=${lib.getDev libevent}"
     "--with-libevent-libdir=${lib.getLib libevent}/lib"
-    "--with-munge=${munge}"
+    "--with-munge=${lib.getDev munge}"
+    "--with-munge-libdir=${lib.getLib munge}/lib"
     "--with-hwloc=${lib.getDev hwloc}"
     "--with-hwloc-libdir=${lib.getLib hwloc}/lib"
   ];

pkgs/by-name/ra/radicle-node/unstable.nix

@@ -1,8 +1,8 @@
 { radicle-node }:
 
 radicle-node.override {
-  version = "1.8.0";
-  srcHash = "sha256-QjAdZO5PwJ6FuThzQYnkF+hAeArltXxhEnzIcAePwzA=";
-  cargoHash = "sha256-m8CqRTJD/1bOqTB2SoUjglZsOWGfv/nBNTOQftNvIqE=";
+  version = "1.9.0-rc.1";
+  srcHash = "sha256-CM1BdpdnAyAelrPAJjvsD7qOfHkV3EEmF4pTNOFvQik=";
+  cargoHash = "sha256-N28PQpuTcDAszWF0TPY/H5uzWfQZSuxn0XVYLeKNmn0=";
   updateScript = ./update-unstable.sh;
 }

pkgs/by-name/re/ready-check/package.nix

@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "ready-check";
-  version = "1.2.6";
+  version = "1.7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "sesh";
     repo = "ready";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-j0UY2Q1jYGRtjvaWMwgMJrNaQZQnEJ5ST4o4PAVYWVc=";
+    hash = "sha256-QdYg2kemfZCY5RkEiry1U5eLStd10HdRpQHn7+hOL/g=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
@@ -22,6 +22,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
 
   propagatedBuildInputs = with python3.pkgs; [
     beautifulsoup4
+    cryptography
     thttp
     tld
   ];

pkgs/by-name/s5/s5cmd/package.nix

@@ -2,6 +2,7 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  versionCheckHook,
 }:
 
 buildGoModule (finalAttrs: {
@@ -17,9 +18,18 @@ buildGoModule (finalAttrs: {
 
   vendorHash = null;
 
+  ldflags = [ "-X github.com/peak/s5cmd/v2/version.Version=v${finalAttrs.version}" ];
+
   # Skip e2e tests requiring network access
   excludedPackages = [ "./e2e" ];
 
+  # Fix tests creating network sockets on macOS
+  __darwinAllowLocalNetworking = true;
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+  versionCheckProgramArg = [ "version" ];
+
   meta = {
     homepage = "https://github.com/peak/s5cmd";
     description = "Parallel S3 and local filesystem execution tool";

pkgs/by-name/sh/shairport-sync/package.nix

@@ -23,6 +23,7 @@
   libao,
   libsoundio,
   mosquitto,
+  nix-update-script,
   pipewire,
   soxr,
   alac,
@@ -43,7 +44,7 @@
   enableMqttClient ? true,
   enableDbus ? stdenv.hostPlatform.isLinux,
   enableSoxr ? true,
-  enableAlac ? true,
+  enableAlac ? !enableAirplay2, # airplay2 build uses ffmpeg for alac
   enableConvolution ? true,
   enableLibdaemon ? false,
   enableTinySVCmDNS ? true,
@@ -55,13 +56,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "shairport-sync";
-  version = "5.0.2";
+  version = "5.0.4";
 
   src = fetchFromGitHub {
     repo = "shairport-sync";
     owner = "mikebrady";
     tag = finalAttrs.version;
-    hash = "sha256-tmnAVO9XpVNOwS8ze/23v4TV5Gq+goaVNnA9INf17wk=";
+    hash = "sha256-7/QB0lvpjZnGXo4vjKSYogjhi66S/QRRpypsqEMLGj0=";
   };
 
   nativeBuildInputs = [
@@ -141,6 +142,11 @@ stdenv.mkDerivation (finalAttrs: {
 
   strictDeps = true;
 
+  passthru.updateScript = nix-update-script {
+    # ignore -dev tagged releases
+    extraArgs = [ "--version-regex=^([0-9\\.]+)$" ];
+  };
+
   meta = {
     homepage = "https://github.com/mikebrady/shairport-sync";
     description = "Airtunes server and emulator with multi-room capabilities";

pkgs/by-name/sh/shipwright/package.nix

@@ -122,7 +122,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "harbourmasters";
     repo = "shipwright";
     tag = finalAttrs.version;
-    hash = "sha256-hQxYKZi6YJPittwes3sUZySChPBdGTz0GADbqgfjP5M=";
+    hash = "sha256-jTKhvyFaP59+T85CI7IteMABggOt6WVvQJ1vbSz1ops=";
     fetchSubmodules = true;
     deepClone = true;
     postFetch = ''

pkgs/by-name/si/signal-desktop/force-90-days-expiration.patch

@@ -1,12 +1,12 @@
-diff --git a/ts/scripts/get-expire-time.node.ts b/ts/scripts/get-expire-time.node.ts
-index deebfcee6..50f6df652 100644
---- a/ts/scripts/get-expire-time.node.ts
-+++ b/ts/scripts/get-expire-time.node.ts
-@@ -18,7 +18,7 @@ const buildCreation = unixTimestamp * 1000;
+diff --git a/scripts/get-expire-time.mjs b/scripts/get-expire-time.mjs
+index 8c520ba5b..f23c32e35 100644
+--- a/scripts/get-expire-time.mjs
++++ b/scripts/get-expire-time.mjs
+@@ -19,7 +19,7 @@ const isNotUpdatable = !parseVersion(packageJson.version).isUpdatable;
  
  // NB: Build expirations are also determined via users' auto-update settings; see
  // getExpirationTimestamp
--const validDuration = isNotUpdatable(packageJson.version) ? DAY * 30 : DAY * 90;
+-const validDuration = isNotUpdatable ? DAY * 30 : DAY * 90;
 +const validDuration = DAY * 90;
  const buildExpiration = buildCreation + validDuration;
  
@@ -25,4 +25,4 @@ index c2ac24c6d..65260f8bd 100644
 +  const safeExpirationMs = NINETY_ONE_DAYS;
  
    const buildExpirationDuration = buildExpirationTimestamp - now;
-   const tooFarIntoFuture = buildExpirationDuration > safeExpirationMs;
+   const tooFarIntoFuture = buildExpirationDuration > safeExpirationMs;

pkgs/by-name/si/signal-desktop/libsignal-node.nix

@@ -15,23 +15,23 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "libsignal-node";
-  version = "0.91.0";
+  version = "0.92.1";
 
   src = fetchFromGitHub {
     owner = "signalapp";
     repo = "libsignal";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-icmmQWWVCWg8dpNkQtLi3YWSxBrUwaGP4ezTDqC/0kc=";
+    hash = "sha256-gAXLt0e2k5PA6PgFRQa22oGuNLM7TGkOKQnYtFhn8I8=";
   };
 
-  cargoHash = "sha256-NaFl9r4e08I3+/asek7VMA0yikxPR0MtBX9TnHaebSU=";
+  cargoHash = "sha256-TqYxkkzlbgrc7jkAubz3TsXhcU8Do5IFaLRqSPiZVR0=";
 
   npmRoot = "node";
   npmDeps = fetchNpmDeps {
     name = "${finalAttrs.pname}-npm-deps";
     inherit (finalAttrs) version src;
     sourceRoot = "${finalAttrs.src.name}/${finalAttrs.npmRoot}";
-    hash = "sha256-TTU7cfoS0h2fqHanSOCsF+dtkhBfaWApfOC3O4DGClo=";
+    hash = "sha256-c6Alk2tyloaPAP2Qfgurle0ziVs8vbxb2klKJZaGlaQ=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/si/signal-desktop/package.nix

@@ -3,9 +3,10 @@
   lib,
   nodejs_24,
   pnpm_10_29_2,
+  node-gyp,
   fetchPnpmDeps,
   pnpmConfigHook,
-  electron_40,
+  electron_41,
   python3,
   makeWrapper,
   callPackage,
@@ -29,7 +30,7 @@ assert lib.warnIf (commandLineArgs != "")
 let
   nodejs = nodejs_24;
   pnpm = pnpm_10_29_2;
-  electron = electron_40;
+  electron = electron_41;
 
   libsignal-node = callPackage ./libsignal-node.nix { inherit nodejs; };
   signal-sqlcipher = callPackage ./signal-sqlcipher.nix { inherit pnpm nodejs; };
@@ -58,13 +59,13 @@ let
     '';
   });
 
-  version = "8.6.1";
+  version = "8.8.0";
 
   src = fetchFromGitHub {
     owner = "signalapp";
     repo = "Signal-Desktop";
     tag = "v${version}";
-    hash = "sha256-UeCjj3txcBQxfvEJOuCKka3VVfd4OY/4wXoQ4lq4NiE=";
+    hash = "sha256-moWEqKWZgqIfhK01RUROF4Waxbn5kcmxZQ94PGai4ww=";
   };
 
   sticker-creator = stdenv.mkDerivation (finalAttrs: {
@@ -76,7 +77,7 @@ let
       inherit (finalAttrs) pname src version;
       inherit pnpm;
       fetcherVersion = 3;
-      hash = "sha256-WbdYcI5y01gdS9AIzy4VZZ6eFaTHaVPscTawLSsHzlc=";
+      hash = "sha256-CPZkybD/rCBMBK9qUSweBdLr9hXu0Ztn8fekqrRzUR4=";
     };
 
     strictDeps = true;
@@ -159,11 +160,11 @@ stdenv.mkDerivation (finalAttrs: {
     # language-pack postprocessing), and they expect a different macOS
     # app layout than nixpkgs' Electron provides.
     substituteInPlace package.json \
-      --replace-fail '"artifactBuildCompleted": "ts/scripts/artifact-build-completed.node.ts",' "" \
-      --replace-fail '"afterSign": "ts/scripts/after-sign.node.ts",' "" \
-      --replace-fail '"afterPack": "ts/scripts/after-pack.node.ts",' "" \
-      --replace-fail '"sign": "./ts/scripts/sign-macos.node.ts",' "" \
-      --replace-fail '"afterAllArtifactBuild": "ts/scripts/after-all-artifact-build.node.ts",' ""
+      --replace-fail '"artifactBuildCompleted": "scripts/artifact-build-completed.mjs",' "" \
+      --replace-fail '"afterSign": "scripts/after-sign.mjs",' "" \
+      --replace-fail '"afterPack": "scripts/after-pack.mjs",' "" \
+      --replace-fail '"sign": "scripts/sign-macos.mjs",' "" \
+      --replace-fail '"afterAllArtifactBuild": "scripts/after-all-artifact-build.mjs",' ""
   '';
 
   pnpmDeps = fetchPnpmDeps {
@@ -177,15 +178,15 @@ stdenv.mkDerivation (finalAttrs: {
     fetcherVersion = 3;
     hash =
       if withAppleEmojis then
-        "sha256-d6ul6MTJhnM4PyxMlMaVovnvSPfYh3DmMjHjmOideB4="
+        "sha256-Ib+NQbnCawbGgx45u27ubf1a6lHkrGde+m1DUT23w5Y="
       else
-        "sha256-JymcPdFMi0wfceOJnPrwEBG4PnosIFnrxiIrTlcGf/g=";
+        "sha256-0HzY/4XHjc8uAIMy6OzgGcuDNGfqQVW2RHOtyeYPJaw=";
   };
 
   env = {
     ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
     SIGNAL_ENV = "production";
-    SOURCE_DATE_EPOCH = 1776101010;
+    SOURCE_DATE_EPOCH = 1777225303;
   }
   // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
     # Disable code signing during local macOS builds.
@@ -240,7 +241,7 @@ stdenv.mkDerivation (finalAttrs: {
     # Build it explicitly against Electron headers ahead of packaging.
     export npm_config_nodedir=${electron.headers}
     pushd node_modules/fs-xattr
-    pnpm exec node-gyp rebuild
+    ${lib.getExe node-gyp} rebuild
     popd
     test -f node_modules/fs-xattr/build/Release/xattr.node
   '';

pkgs/by-name/si/signal-desktop/replace-apple-emoji-with-noto-emoji.patch

@@ -46,32 +46,32 @@ index 483d1c4e4..66609d9e9 100644
      getBadgesPath(userDataPath),
      getDraftPath(userDataPath),
 diff --git a/package.json b/package.json
-index 8585e6bdc..4d900ebfe 100644
+index dd87037e7..f16dd8d1f 100644
 --- a/package.json
 +++ b/package.json
-@@ -122,7 +122,6 @@
-     "@signalapp/sqlcipher": "3.2.1",
-     "@signalapp/windows-ucv": "1.0.1",
-     "emoji-datasource": "16.0.0",
+@@ -240,7 +240,6 @@
+     "electron": "41.2.2",
+     "electron-builder": "26.0.14",
+     "electron-mocha": "13.1.0",
 -    "emoji-datasource-apple": "16.0.0",
-     "google-libphonenumber": "3.2.39"
-   },
-   "devDependencies": {
+     "emoji-regex": "10.6.0",
+     "enhanced-resolve": "5.20.1",
+     "enquirer": "2.4.1",
 diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
-index 756130661..4872be4cf 100644
+index d659475fc..2f1e3cfdb 100644
 --- a/pnpm-lock.yaml
 +++ b/pnpm-lock.yaml
-@@ -97,9 +97,6 @@ importers:
-       emoji-datasource:
-         specifier: 16.0.0
-         version: 16.0.0
+@@ -430,9 +430,6 @@ importers:
+       electron-mocha:
+         specifier: 13.1.0
+         version: 13.1.0
 -      emoji-datasource-apple:
 -        specifier: 16.0.0
 -        version: 16.0.0
-       google-libphonenumber:
-         specifier: 3.2.39
-         version: 3.2.39
-@@ -6068,9 +6065,6 @@ packages:
+       emoji-regex:
+         specifier: 10.6.0
+         version: 10.6.0
+@@ -6154,9 +6151,6 @@ packages:
      resolution: {integrity: sha512-DeWwawk6r5yR9jFgnDKYt4sLS0LmHJJi3ZOnb5/JdbYwj3nW+FxQnHIjhBKz8YLC7oRNPVM9NQ47I3CVx34eqQ==}
      engines: {node: '>=12'}
  
@@ -81,7 +81,7 @@ index 756130661..4872be4cf 100644
    emoji-datasource@16.0.0:
      resolution: {integrity: sha512-/qHKqK5Nr3+8zhgO6kHmF43Fm5C8HNn0AaFRIpgw8HF3+uF0Vfc8jgLI1ZQS5ba1vBzksS8NBCjHejwLb2D/Sg==}
  
-@@ -16954,8 +16948,6 @@ snapshots:
+@@ -16387,8 +16381,6 @@ snapshots:
  
    emittery@0.13.1: {}
  
@@ -89,7 +89,7 @@ index 756130661..4872be4cf 100644
 -
    emoji-datasource@16.0.0: {}
  
-   emoji-regex@10.4.0: {}
+   emoji-regex@10.6.0: {}
 diff --git a/stylesheets/components/fun/FunEmoji.scss b/stylesheets/components/fun/FunEmoji.scss
 index 1cc4bb43c..a6444101a 100644
 --- a/stylesheets/components/fun/FunEmoji.scss

pkgs/by-name/si/sing-box/package.nix

@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "sing-box";
-  version = "1.13.9";
+  version = "1.13.11";
 
   src = fetchFromGitHub {
     owner = "SagerNet";
     repo = "sing-box";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mEvvFSIK2U/IZ8VGGwe3aipnko6dW8DRvjdKPXTrdoo=";
+    hash = "sha256-kyte9o+w240o6Q+X97m4QQ6nQjuLthoh6O9ksUtgmZU=";
   };
 
-  vendorHash = "sha256-Wk72wVRKoJZ7nEiiQZZ8w2hKiuanYFnLFWlFxj6cZBA=";
+  vendorHash = "sha256-b7RUr787qEdZAb31VWlpN7t8Yauxa32KDJmvTTf9//g=";
 
   tags = [
     "with_gvisor"

pkgs/by-name/sl/slurm/package.nix

@@ -126,7 +126,7 @@ stdenv.mkDerivation (finalAttrs: {
     "--with-json=${lib.getDev json_c}"
     "--with-jwt=${libjwt}"
     "--with-lz4=${lib.getDev lz4}"
-    "--with-munge=${munge}"
+    "--with-munge=${lib.getDev munge}"
     "--with-yaml=${lib.getDev libyaml}"
     "--with-ofed=${lib.getDev rdma-core}"
     "--sysconfdir=/etc/slurm"

pkgs/by-name/ti/tigerbeetle/package.nix

@@ -10,14 +10,14 @@ let
   platform =
     if stdenvNoCC.hostPlatform.isDarwin then "universal-macos" else stdenvNoCC.hostPlatform.system;
   hash = builtins.getAttr platform {
-    "universal-macos" = "sha256-PzlZt+Fou0I4360thQJ3gihGQkH40DrlLZh+i7Uds0o=";
-    "x86_64-linux" = "sha256-7bjM+3sN/D9reEhZ2iwWMghyjp0/8rXVauzY2OdW9rI=";
-    "aarch64-linux" = "sha256-P+7zui/lpc7ilrpNsyB9v+K/WaeuG8jUsbQEH6xEmpk=";
+    "universal-macos" = "sha256-1BmWy1AJ0ZA+eu458LuiimT4jsl9YAyvefmDHR5D7o4=";
+    "x86_64-linux" = "sha256-GJmsca+mTIRe1borkK8sozVgRK56aDEpp7tu/3fWjmM=";
+    "aarch64-linux" = "sha256-SM8tApCGyBoOZ6CTCnmc6aeAjuIj8yA6Mm94dNAfp4Y=";
   };
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "tigerbeetle";
-  version = "0.17.0";
+  version = "0.17.1";
 
   src = fetchzip {
     url = "https://github.com/tigerbeetle/tigerbeetle/releases/download/${finalAttrs.version}/tigerbeetle-${platform}.zip";

pkgs/by-name/tp/tpm-trust/package.nix

@@ -0,0 +1,48 @@
+{
+  lib,
+  stdenv,
+  buildGo125Module,
+  fetchFromGitHub,
+  installShellFiles,
+}:
+
+buildGo125Module (finalAttrs: {
+  pname = "tpm-trust";
+  version = "0.4.1";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "loicsikidi";
+    repo = "tpm-trust";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-hhcIO+Od5Hhzm9evRlBHIicj+rivFn1H647mCKMq048=";
+  };
+
+  vendorHash = "sha256-MKUZ87Ketw29cyCa/7fVcQmlsJa8shwz4gHT3mhRaco=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=${finalAttrs.version}"
+    "-X main.builtBy=nix"
+  ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd tpm-trust \
+      --bash <($out/bin/tpm-trust completion bash) \
+      --zsh <($out/bin/tpm-trust completion zsh) \
+      --fish <($out/bin/tpm-trust completion fish)
+  '';
+
+  meta = {
+    description = "Validate TPM authenticity by checking its Endorsement Key certificate against manufacturer root certificates";
+    homepage = "https://github.com/loicsikidi/tpm-trust";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ thillux ];
+    mainProgram = "tpm-trust";
+    platforms = lib.platforms.linux;
+  };
+})

pkgs/by-name/tr/trufflehog/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "trufflehog";
-  version = "3.95.1";
+  version = "3.95.2";
 
   src = fetchFromGitHub {
     owner = "trufflesecurity";
     repo = "trufflehog";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pzhFc0TrC1GQHIlM1MDs4I+bVE01cFb2fAXPZ649fuU=";
+    hash = "sha256-7hHeJ+RBUUBznl9gm6IwemFsHLiKHh6B7T96jpEsAC0=";
   };
 
   vendorHash = "sha256-2WBdBsOXjj4/9hLA+yk5PQAqOgi5vn1cH4NnkHg8umI=";

pkgs/by-name/un/undock/package.nix

@@ -5,13 +5,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "undock";
-  version = "0.12.0";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "crazy-max";
     repo = "undock";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ZjvF7BvjL/IZ25JDO4P9ELPdgCrGc9b+ldqFOx/i0ic=";
+    hash = "sha256-bddCRAphSn01kWHkE32/4I+EAMvcaEJ4VIbDG5ydE0Y=";
   };
 
   vendorHash = null;

pkgs/by-name/us/usbvfiod/package.nix

@@ -29,9 +29,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
   __structuredAttrs = true;
 
   meta = {
-    homepage = "https://github.com/cloud-hypervisor/cloud-hypervisor";
+    homepage = "https://github.com/cyberus-technology/usbvfiod";
     description = "A tool for USB device pass-through using the vfio-user protocol.";
-    changelog = "https://github.com/cyberus-technology/usb/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/cyberus-technology/usbvfiod/releases/tag/v${finalAttrs.version}";
     license = with lib.licenses; [
       asl20
       mit
@@ -39,6 +39,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     mainProgram = "usbvfiod";
     maintainers = with lib.maintainers; [
       lbeierlieb
+      snu
     ];
     platforms = [
       "aarch64-linux"

pkgs/by-name/v2/v2ray-domain-list-community/package.nix

@@ -9,12 +9,12 @@
 let
   generator = pkgsBuildBuild.buildGoModule rec {
     pname = "v2ray-domain-list-community";
-    version = "20260418094517";
+    version = "20260424125239";
     src = fetchFromGitHub {
       owner = "v2fly";
       repo = "domain-list-community";
       rev = version;
-      hash = "sha256-6UmTW+Fc8Kp9nmov4t56haCYCZ2RZuuGvghXlePA8r4=";
+      hash = "sha256-iptsh0r9KHrCynHem6ma0050olxTDLQ7DCSy3aB6CJs=";
     };
     vendorHash = "sha256-9tXv+rDBowxDN9gH4zHCr4TRbic4kijco3Y6bojJKRk=";
     meta = {

pkgs/by-name/va/vaultwarden/package.nix

@@ -19,16 +19,16 @@ in
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "vaultwarden";
-  version = "1.35.7";
+  version = "1.35.8";
 
   src = fetchFromGitHub {
     owner = "dani-garcia";
     repo = "vaultwarden";
     tag = finalAttrs.version;
-    hash = "sha256-HJDpGsKLsVbeUPqTAph5luROpz7ioJXs/PV5nwtmAz8=";
+    hash = "sha256-bEPwH0+b4cQTh1hNiiX2qvTNeRxxShm2JXNKNfn4xm8=";
   };
 
-  cargoHash = "sha256-LSmzR3X04i2dmPwj1ivPm/YeNtxGhfwsEXG93iVvhrI=";
+  cargoHash = "sha256-gcE3qfSVCk08haADyqOff4R0ekd9Q6RB59LUtow9Yi4=";
 
   # used for "Server Installed" version in admin panel
   env.VW_VERSION = finalAttrs.version;

pkgs/by-name/va/vaultwarden/webvault.nix

@@ -10,16 +10,16 @@
 
 buildNpmPackage rec {
   pname = "vaultwarden-webvault";
-  version = "2026.2.0+0";
+  version = "2026.3.1+0";
 
   src = fetchFromGitHub {
     owner = "vaultwarden";
     repo = "vw_web_builds";
     tag = "v${version}";
-    hash = "sha256-rXBDv8ecImA6qdM5JVYy5QJHRj0jP7zinj/8gWRREtQ=";
+    hash = "sha256-nUhSoqf655eOs+rKqAZB0XzPD6ePL6CIxVAnB5dmJAs=";
   };
 
-  npmDepsHash = "sha256-PATpmxIHYSgmuOj8dOoa7ynzkGw5l7z62DiulJmufJY=";
+  npmDepsHash = "sha256-dlYN2aiv6XbDXQVstfI6XIe+X5Q1lqs62eNalGTGx7k=";
 
   nativeBuildInputs = [
     python3

pkgs/by-name/zs/zsh/fix-sigsuspend-probe-c23.patch

@@ -0,0 +1,17 @@
+Prototype the K&R handler so the probe still compiles under -std=gnu23
+(selected by autoconf 2.73). Upstream removed the probe in 8dd271fdec52,
+which does not apply against 5.9 with the PCRE backports.
+
+https://github.com/NixOS/nixpkgs/issues/513543
+--- a/configure.ac
++++ b/configure.ac
+@@ -2334,8 +2334,7 @@ if test x$signals_style = xPOSIX_SIGNALS; then
+ #include <signal.h>
+ #include <unistd.h>
+ int child=0;
+-void handler(sig)
+-    int sig;
++void handler(int sig)
+ {if(sig==SIGCHLD) child=1;}
+ int main() {
+     struct sigaction act;

pkgs/by-name/zs/zsh/package.nix

@@ -63,6 +63,9 @@ stdenv.mkDerivation (finalAttrs: {
       hash = "sha256-bl1PG9Zk1wK+2mfbCBhD3OEpP8HQboqEO8sLFqX8DmA=";
       excludes = [ "ChangeLog" ];
     })
+    # autoconf 2.73 picks -std=gnu23, breaking the K&R sigsuspend probe and
+    # causing $(...) hangs. Drop with the next zsh release.
+    ./fix-sigsuspend-probe-c23.patch
   ]
   ++ lib.optionals stdenv.cc.isGNU [
     # Fixes compilation with gcc >= 14.

pkgs/desktops/lomiri/qml/lomiri-ui-extras/default.nix

@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lomiri-ui-extras";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchFromGitLab {
     owner = "ubports";
     repo = "development/core/lomiri-ui-extras";
     tag = finalAttrs.version;
-    hash = "sha256-wNYAcWcihMFXWuVfrSzxDVE15MR2+cgnss018FextpU=";
+    hash = "sha256-0rP88+OVLzK3ZDXZHqYR+0uF4eNur/RUV8DY0ijZBVo=";
   };
 
   postPatch = ''

pkgs/development/cuda-modules/packages/cuda_crt.nix

@@ -2,6 +2,7 @@
   lib,
   backendStdenv,
   buildRedist,
+  cudaOlder,
   glibc,
 }:
 buildRedist {
@@ -11,10 +12,11 @@ buildRedist {
   outputs = [ "out" ];
 
   # Fix compatibility with glibc 2.42:
-  # CUDA >= 13.0 fixed sinpi/cospi (using __NV_IEC_60559_FUNCS_EXCEPTION_SPECIFIER), but
-  # rsqrt/rsqrtf in math_functions.h still lack noexcept, conflicting with glibc 2.42's
-  # declarations.
-  postInstall = lib.optionalString (lib.versionAtLeast glibc.version "2.42") ''
+  # - CUDA >= 13.0 fixed sinpi/cospi (using __NV_IEC_60559_FUNCS_EXCEPTION_SPECIFIER), but
+  #   rsqrt/rsqrtf in math_functions.h still lack noexcept, conflicting with glibc 2.42's
+  #   declarations.
+  # - CUDA >= 13.2 fixed rsqrt/rsqrtf as well (using _NV_RSQRT_SPECIFIER).
+  postInstall = lib.optionalString (cudaOlder "13.2" && lib.versionAtLeast glibc.version "2.42") ''
     nixLog "Patching math_functions.h rsqrt signatures to match glibc's ones"
     substituteInPlace "''${!outputInclude:?}/include/crt/math_functions.h" \
       --replace-fail \

pkgs/development/python-modules/bentoml/default.nix

@@ -63,7 +63,6 @@
   starlette,
   tomli-w,
   tritonclient,
-  uv,
   uvicorn,
   watchfiles,
   # native check inputs
@@ -202,7 +201,6 @@ buildPythonPackage {
     simple-di
     starlette
     tomli-w
-    uv
     uvicorn
     watchfiles
   ];

pkgs/development/python-modules/claude-agent-sdk/default.nix

@@ -13,14 +13,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "claude-agent-sdk";
-  version = "0.1.66";
+  version = "0.1.68";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "anthropics";
     repo = "claude-agent-sdk-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Y8mWJDw/pYrNuA9tm3nAWplin+zGbd/x/I2KnKI8oww=";
+    hash = "sha256-m42AYi9OkII9NOSNV9D9M7GMamh2Qncpz21s7BS1E70=";
   };
 
   build-system = [ hatchling ];

pkgs/development/python-modules/cli-helpers/default.nix

@@ -11,13 +11,13 @@
 
 buildPythonPackage rec {
   pname = "cli-helpers";
-  version = "2.10.0";
+  version = "2.14.0";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "cli_helpers";
     inherit version;
-    hash = "sha256-Dgk2F5t4bADGtzhjtbklKIn3pUUl8UAU7HJ+Qf8iryg=";
+    hash = "sha256-eY4HMfL01CV2fLEqOtlmvyi13nelZRZiBhu0pmvujzU=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/iamdata/default.nix

@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iamdata";
-  version = "0.1.202604251";
+  version = "0.1.202604271";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-nKFt32gK7SYyKoMxy28QDM2YySglu6ftpgcDWUwo28Y=";
+    hash = "sha256-WKbjXsBprC/z4FFRaEztdGCRKdZ926muGUM6tCxLXu0=";
   };
 
   __darwinAllowLocalNetworking = true;

pkgs/development/python-modules/llama-index-embeddings-huggingface/default.nix

@@ -9,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "llama-index-embeddings-huggingface";
-  version = "0.6.1";
+  version = "0.7.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "llama_index_embeddings_huggingface";
     inherit version;
-    hash = "sha256-OyH/7aIvgiHtVXeLs9rtcWZKsHs0Hx3S9AiWO9IDVbk=";
+    hash = "sha256-2ooqZd+UBBEsRDDfraCdT4RroWUZeiXb539zQBTFaoc=";
   };
 
   build-system = [ hatchling ];

pkgs/development/python-modules/llama-index-workflows/default.nix

@@ -10,13 +10,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "llama-index-workflows";
-  version = "2.19.0";
+  version = "2.20.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "llama_index_workflows";
     inherit (finalAttrs) version;
-    hash = "sha256-GXuiE9KDdRaQL4V1hYkatWsUI+9P1yh/Xn8z+i8hVXU=";
+    hash = "sha256-3ydg/qnhAMl6TpGdJVRh40RBOsrEOC0X2CFzN4BuR3I=";
   };
 
   postPatch = ''

pkgs/development/python-modules/lxmf/default.nix

@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "lxmf";
-  version = "0.9.4";
+  version = "0.9.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "markqvist";
     repo = "lxmf";
     tag = finalAttrs.version;
-    hash = "sha256-WeEGwdbW2hmN7sdMl8tR5pmaXGqRb6y5Zb536ty3eiY=";
+    hash = "sha256-Q84v1CkyEYpW4QdtOD6zp7bn4UzMDeS9Q8fO91BnuPA=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/nixl/default.nix

@@ -0,0 +1,84 @@
+{
+  lib,
+  buildPythonPackage,
+  python,
+  nixl,
+
+  # build-system
+  build,
+  meson-python,
+  pybind11,
+  pytest,
+  pyyaml,
+  setuptools,
+  types-pyyaml,
+
+  # dependencies
+  numpy,
+  torch,
+
+  config,
+  cudaSupport ? config.cudaSupport,
+  cudaPackages,
+}:
+
+buildPythonPackage.override { inherit (nixl) stdenv; } (finalAttrs: {
+  inherit (nixl)
+    pname
+    version
+    src
+    __structuredAttrs
+    strictDeps
+    nativeBuildInputs
+    dontUseCmakeConfigure
+    buildInputs
+    mesonFlags
+    ;
+  pyproject = true;
+
+  postPatch = (nixl.postPatch or "") + ''
+    substituteInPlace pyproject.toml \
+      --replace-fail \
+        '"patchelf",' \
+        ""
+  '';
+
+  build-system = [
+    build
+    meson-python
+    pybind11
+    pytest
+    pyyaml
+    setuptools
+    types-pyyaml
+  ];
+  dontUseMesonConfigure = true;
+
+  dependencies = [
+    numpy
+    torch
+  ];
+
+  # Install the `nixl` shim module (re-exports nixl_cu{12,13}).
+  # Upstream builds this as a separate wheel via `uv build` (nixl-meta), but that doesn't work in
+  # the sandbox.
+  postInstall = ''
+    install -Dm644 \
+      src/bindings/python/nixl-meta/nixl/__init__.py \
+      "$out/${python.sitePackages}/nixl/__init__.py"
+  '';
+
+  pythonImportsCheck = [
+    "nixl"
+  ]
+  ++ lib.optionals cudaSupport [
+    "nixl_cu${cudaPackages.cudaMajorVersion}"
+  ];
+
+  # No tests we can run in the sandbox
+  doCheck = false;
+
+  meta = nixl.meta // {
+    description = "Python API for nixl";
+  };
+})

pkgs/development/python-modules/nixpkgs-plugin-update/nixpkgs-plugin-update/src/nixpkgs_plugin_update/__init__.py

@@ -89,7 +89,7 @@ class FetchConfig:
 
 def make_request(url: str, token=None) -> urllib.request.Request:
     headers = {}
-    if token is not None:
+    if token:
         headers["Authorization"] = f"token {token}"
     return urllib.request.Request(url, headers=headers)
 
@@ -140,7 +140,7 @@ class Repo:
         self._branch = branch
         # Redirect is the new Repo to use
         self.redirect: "Repo | None" = None
-        self.token: str | None = "dummy_token"
+        self.token: str | None = None
 
     @property
     def name(self):
@@ -234,7 +234,9 @@ class Repo:
 
     def as_nix(self, plugin: "Plugin") -> str:
         ref_attr = (
-            f'tag = "{plugin.tag}";' if plugin.tag is not None else f'rev = "{plugin.commit}";'
+            f'tag = "{plugin.tag}";'
+            if plugin.tag is not None
+            else f'rev = "{plugin.commit}";'
         )
         return f"""fetchgit {{
       url = "{self.uri}";
@@ -242,6 +244,9 @@ class Repo:
       hash = "{plugin.to_sri_hash()}";
     }}"""
 
+    def get_license_spdx_id(self, fallback_license: str | None = None) -> str | None:
+        return fallback_license
+
 
 class RepoGitHub(Repo):
     def __init__(self, owner: str, repo: str, branch: str) -> None:
@@ -439,9 +444,7 @@ class RepoGitHub(Repo):
     def _check_for_redirect(self, url: str, req: http.client.HTTPResponse):
         response_url = req.geturl()
         if url != response_url:
-            new_owner, new_name = (
-                urlsplit(response_url).path.strip("/").split("/")[:2]
-            )
+            new_owner, new_name = urlsplit(response_url).path.strip("/").split("/")[:2]
 
             new_repo = RepoGitHub(owner=new_owner, repo=new_name, branch=self._branch)
             self.redirect = new_repo
@@ -460,6 +463,41 @@ class RepoGitHub(Repo):
         loaded = json.loads(data)
         return loaded["hash"]
 
+    def get_license_spdx_id(self, fallback_license: str | None = None) -> str | None:
+        license_url = f"https://api.github.com/repos/{self.owner}/{self.repo}/license"
+        log.debug("Fetching license metadata from %s", license_url)
+
+        def log_fetch_failure(reason: str) -> str | None:
+            log.warning(
+                "Failed to fetch license metadata for %s/%s: %s; reusing %s",
+                self.owner,
+                self.repo,
+                reason,
+                fallback_license or "no cached license",
+            )
+            return fallback_license
+
+        try:
+            req = make_request(license_url, self.token)
+            with urllib.request.urlopen(req, timeout=10) as response:
+                data = json.load(response)
+        except urllib.error.HTTPError as e:
+            if e.code == 404:
+                return None
+            return log_fetch_failure(f"HTTP {e.code}")
+        except urllib.error.URLError as e:
+            return log_fetch_failure(str(e))
+
+        license_info = data.get("license")
+        if not isinstance(license_info, dict):
+            return None
+
+        spdx_id = license_info.get("spdx_id")
+        if not spdx_id or spdx_id == "NOASSERTION":
+            return None
+
+        return spdx_id
+
     def as_nix(self, plugin: "Plugin") -> str:
         if plugin.has_submodules:
             submodule_attr = "\n      fetchSubmodules = true;"
@@ -467,7 +505,9 @@ class RepoGitHub(Repo):
             submodule_attr = ""
 
         ref_attr = (
-            f'tag = "{plugin.tag}";' if plugin.tag is not None else f'rev = "{plugin.commit}";'
+            f'tag = "{plugin.tag}";'
+            if plugin.tag is not None
+            else f'rev = "{plugin.commit}";'
         )
 
         return f"""fetchFromGitHub {{
@@ -526,6 +566,7 @@ class Plugin:
     date: datetime | None = None
     last_tag: str | None = None
     tag: str | None = None
+    license: str | None = None
 
     @property
     def normalized_name(self) -> str:
@@ -781,6 +822,7 @@ class Editor:
                 date,
                 last_tag=last_tag,
                 tag=source_tag,
+                license=attr.get("license"),
             )
 
             plugins.append((pdesc, p))
@@ -1105,9 +1147,16 @@ def prefetch_plugin(
         latest_tag,
     )
 
-    cached_plugin = cache[target_cache_key(p.repo.uri, commit, source_tag)] if cache else None
+    cached_plugin = (
+        cache[target_cache_key(p.repo.uri, commit, source_tag)] if cache else None
+    )
     if cached_plugin is not None:
         log.debug(f"Cache hit for {p.name}!")
+        license_spdx_id = (
+            cached_plugin.license
+            or (current_plugin.license if current_plugin else None)
+            or p.repo.get_license_spdx_id()
+        )
         return (
             replace(
                 cached_plugin,
@@ -1117,6 +1166,7 @@ def prefetch_plugin(
                 date=date,
                 last_tag=latest_tag,
                 tag=source_tag,
+                license=license_spdx_id,
             ),
             p.repo.redirect,
         )
@@ -1124,7 +1174,14 @@ def prefetch_plugin(
     has_submodules = p.repo.has_submodules()
     log.debug(f"prefetch {p.name}")
     sha256 = (
-        p.repo.prefetch(f"{GIT_TAGS_PREFIX}{source_tag}") if source_tag else p.repo.prefetch(commit)
+        p.repo.prefetch(f"{GIT_TAGS_PREFIX}{source_tag}")
+        if source_tag
+        else p.repo.prefetch(commit)
+    )
+    license_spdx_id = (
+        current_plugin.license
+        if current_plugin and current_plugin.license
+        else p.repo.get_license_spdx_id()
     )
 
     return (
@@ -1137,6 +1194,7 @@ def prefetch_plugin(
             date=date,
             last_tag=latest_tag,
             tag=source_tag,
+            license=license_spdx_id,
         ),
         p.repo.redirect,
     )
@@ -1243,6 +1301,7 @@ class Cache:
                     attr.get("version", ""),
                     last_tag=attr.get("last_tag"),
                     tag=attr.get("tag"),
+                    license=attr.get("license"),
                 )
                 downloads[cache_key] = p
         return downloads

pkgs/development/python-modules/nomadnet/default.nix

@@ -12,14 +12,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "nomadnet";
-  version = "0.9.9";
+  version = "0.9.11";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "markqvist";
     repo = "NomadNet";
     tag = finalAttrs.version;
-    hash = "sha256-qLe9fnIE9kY9JerAAH318dq1SOshP9xX3l/2c91fnSA=";
+    hash = "sha256-vIV3FEvwqd2je/DzGWeshEx5Tb+DhOQIg7l0LbffEwY=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/podman/default.nix

@@ -14,14 +14,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "podman";
-  version = "5.7.0";
+  version = "5.8.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "podman-py";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5GbgqwsFBXE3kXdOpbbcmIEkj5FWNBqyWdq2tZQbvK8=";
+    hash = "sha256-i4eWC1MyBdc+en3W3+4fdeDP79Z2hsk9SIg3PfG0mI0=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/publicsuffixlist/default.nix

@@ -11,12 +11,12 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "publicsuffixlist";
-  version = "1.0.2.20260422";
+  version = "1.0.2.20260425";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-dFmSz317sHAg2PCBg2wAGM3shb27sqRkx5M1xcO2gsw=";
+    hash = "sha256-FF+G2zaTBUnxlyRPbxAK4cbIzSbdN5bW0CGbRTVBwIc=";
   };
 
   postPatch = ''

pkgs/development/python-modules/pygount/default.nix

@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "pygount";
-  version = "3.1.1";
+  version = "3.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "roskakori";
     repo = "pygount";
     tag = "v${version}";
-    hash = "sha256-4RHztsMmC7WW1cNA1QU3Qodni1HGZF7Gbr4DOj8ffP4=";
+    hash = "sha256-1Ws/8znFusdn2jKFvbiPD7ZRbOnPDqBZceMizWfeVlM=";
   };
 
   build-system = [

pkgs/development/python-modules/pygtfs/default.nix

@@ -6,19 +6,18 @@
   pytz,
   setuptools,
   setuptools-scm,
-  six,
   sqlalchemy,
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pygtfs";
-  version = "0.1.10";
+  version = "0.1.11";
   pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-bOG/bXz97eWM77AprQvEgtl9g2fQbbKcwniF1fAC0d0=";
+    inherit (finalAttrs) pname version;
+    hash = "sha256-NaSGjzBBFK3mqHibcKV2gQIQoWn+qZay7KJasjcwxW4=";
   };
 
   build-system = [
@@ -29,20 +28,21 @@ buildPythonPackage rec {
   dependencies = [
     docopt
     pytz
-    six
     sqlalchemy
   ];
 
   nativeCheckInputs = [ pytestCheckHook ];
+
   enabledTestPaths = [ "pygtfs/test/test.py" ];
 
   pythonImportsCheck = [ "pygtfs" ];
 
   meta = {
     description = "Python module for GTFS";
-    mainProgram = "gtfs2db";
     homepage = "https://github.com/jarondl/pygtfs";
-    license = with lib.licenses; [ mit ];
+    changelog = "https://github.com/jarondl/pygtfs/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "gtfs2db";
   };
-}
+})

pkgs/development/python-modules/pyqtgraph/default.nix

@@ -26,7 +26,7 @@
 let
   fontsConf = makeFontsConf { fontDirectories = [ freefont_ttf ]; };
 in
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pyqtgraph";
   version = "0.14.0";
   pyproject = true;
@@ -34,7 +34,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "pyqtgraph";
     repo = "pyqtgraph";
-    tag = "pyqtgraph-${version}";
+    tag = "pyqtgraph-${finalAttrs.version}";
     hash = "sha256-T5rhaBtcKP/sYjCmYNMYR0BGttkiLhWTfEbZNeAdJJ0=";
   };
 
@@ -70,10 +70,11 @@ buildPythonPackage rec {
   ];
 
   disabledTests = [
-    # ZeroDivisionError: float division by zero
+    # See https://github.com/pyqtgraph/pyqtgraph/issues/3485
     "test_maps_tick_values_to_local_times"
     "test_maps_hour_ticks_to_local_times_when_skip_greater_than_one"
-
+    "test_plotscene"
+    "test_simple"
   ]
   ++ lib.optionals (!stdenv.hostPlatform.isx86) [
     # small precision-related differences on other architectures,
@@ -89,7 +90,7 @@ buildPythonPackage rec {
   meta = {
     description = "Scientific Graphics and GUI Library for Python";
     homepage = "https://www.pyqtgraph.org/";
-    changelog = "https://github.com/pyqtgraph/pyqtgraph/blob/${src.tag}/CHANGELOG";
+    changelog = "https://github.com/pyqtgraph/pyqtgraph/blob/${finalAttrs.src.tag}/CHANGELOG";
     license = lib.licenses.mit;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [
@@ -97,4 +98,4 @@ buildPythonPackage rec {
       doronbehar
     ];
   };
-}
+})

pkgs/development/python-modules/rgbxy/default.nix

@@ -0,0 +1,37 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "rgbxy";
+  # version 0.5 suffix is based upon pypi version not tagged on GitHub, see:
+  # - https://pypi.org/project/rgbxy/
+  # - https://github.com/benknight/hue-python-rgb-converter/tags
+  version = "0.5-unstable-2025-12-16";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "benknight";
+    repo = "hue-python-rgb-converter";
+    rev = "22a09c3c7d395b6e7b91b5f82944ccf1a7e9e47a";
+    hash = "sha256-J14vg/kDF1TuLt6kTNHN/5qxqDHbxkdGkqEAn3V57nU=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  pythonImportsCheck = [
+    "rgbxy"
+  ];
+
+  meta = {
+    description = "RGB conversion tool written in Python for Philips Hue";
+    homepage = "https://github.com/benknight/hue-python-rgb-converter";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ doronbehar ];
+  };
+})

pkgs/development/python-modules/rich-tables/default.nix

@@ -1,29 +1,39 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
+
+  # build-system
   poetry-core,
+
+  # dependencies
   coloraide,
+  decorator,
   humanize,
   multimethod,
   platformdirs,
   rich,
   sqlparse,
   typing-extensions,
-  rgbxy ? null,
+
+  # tests
+  pytestCheckHook,
+  pytest-cov-stub,
+  freezegun,
+
+  # passthru
+  rgbxy,
 }:
-let
-  version = "0.8.0";
-in
-buildPythonPackage {
+buildPythonPackage (finalAttrs: {
   pname = "rich-tables";
-  inherit version;
+  version = "0.9.0";
   pyproject = true;
 
-  src = fetchPypi {
-    pname = "rich_tables";
-    inherit version;
-    hash = "sha256-MN8QH6kLyogbcQ0VE9U034cwSFnaFDB2/Rnvy1DYyl4=";
+  src = fetchFromGitHub {
+    owner = "snejus";
+    repo = "rich-tables";
+    tag = finalAttrs.version;
+    hash = "sha256-6sXWrFP8TDBcFaGCymsZfHL8bfsRbj63VZCeY1H6h/Y=";
   };
 
   build-system = [
@@ -32,6 +42,7 @@ buildPythonPackage {
 
   dependencies = [
     coloraide
+    decorator
     humanize
     multimethod
     platformdirs
@@ -40,6 +51,13 @@ buildPythonPackage {
     typing-extensions
   ];
 
+  nativeBuildInputs = [
+    pytestCheckHook
+    pytest-cov-stub
+    freezegun
+  ]
+  ++ finalAttrs.finalPackage.passthru.optional-dependencies.hue;
+
   optional-dependencies = {
     hue = [
       rgbxy
@@ -63,4 +81,4 @@ buildPythonPackage {
     ];
     mainProgram = "table";
   };
-}
+})

pkgs/development/python-modules/rns/default.nix

@@ -14,14 +14,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "rns";
-  version = "1.1.8";
+  version = "1.1.9";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "markqvist";
     repo = "Reticulum";
     tag = finalAttrs.version;
-    hash = "sha256-HBH7TAHEDAygkfZC1vUQ502J8qwocKp9B1fWaAgLkHo=";
+    hash = "sha256-JYBXk/IOL+XVhvF1qEs/1H9VMWbfLQmIPrLJgJv2ZBw=";
   };
 
   patches = [

pkgs/development/python-modules/tesla-fleet-api/default.nix

@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "tesla-fleet-api";
-  version = "1.4.5";
+  version = "1.4.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Teslemetry";
     repo = "python-tesla-fleet-api";
     tag = "v${version}";
-    hash = "sha256-YmhLVbTIn2zthmw2d2AsmQFbWNHZvRFYAF5DB4gwIhQ=";
+    hash = "sha256-2LCpwVf10dsgZlouvu3Spr0geK8uDpEXKOI1l6sZqmM=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/weatherflow4py/default.nix

@@ -14,14 +14,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "weatherflow4py";
-  version = "1.5.2";
+  version = "1.5.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jeeftor";
     repo = "weatherflow4py";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cfQWdQhjW6KjBLQWO9BSAVZ2btRCMjx1CpUifoOwPsU=";
+    hash = "sha256-4Bzoj3SABuziJdbDlDMcbAzGVRRBg5an5Lexlfq9vdw=";
   };
 
   build-system = [ hatchling ];

pkgs/development/python-modules/yardstick/default.nix

@@ -26,14 +26,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "yardstick";
-  version = "0.16.1";
+  version = "0.16.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = "yardstick";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4Kwgm2gmgOam7AVzlGYT3QhAyJf14h3pZohrhbzprpg=";
+    hash = "sha256-jKf1LH+YLRuds/5SKSgKm8PbI9OvkxgBhm5vOmg5EU0=";
   };
 
   build-system = [

pkgs/development/python-modules/yolink-api/default.nix

@@ -11,14 +11,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "yolink-api";
-  version = "0.6.4";
+  version = "0.6.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "YoSmart-Inc";
     repo = "yolink-api";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8gzVaBne79t2Muen9QuYg8/tKwxWwDWBS98IopxiWn0=";
+    hash = "sha256-2nZNrCLxgO/pwjZZQYb3C4ImVn70WRa+THbi4iRDgJw=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/zarr/default.nix

@@ -33,7 +33,6 @@
   pytest-asyncio,
   pytestCheckHook,
   tomlkit,
-  uv,
 }:
 
 buildPythonPackage (finalAttrs: {
@@ -87,7 +86,6 @@ buildPythonPackage (finalAttrs: {
     pytest-asyncio
     pytestCheckHook
     tomlkit
-    uv
   ]
   ++ finalAttrs.finalPackage.passthru.optional-dependencies.cli;
 

pkgs/top-level/python-packages.nix

@@ -11136,6 +11136,8 @@ self: super: with self; {
 
   nix-prefetch-github = callPackage ../development/python-modules/nix-prefetch-github { };
 
+  nixl = callPackage ../development/python-modules/nixl { inherit (pkgs) nixl; };
+
   nixpkgs-plugin-update = callPackage ../development/python-modules/nixpkgs-plugin-update { };
 
   nixpkgs-pytools = callPackage ../development/python-modules/nixpkgs-pytools { };
@@ -16925,6 +16927,8 @@ self: super: with self; {
 
   rflink = callPackage ../development/python-modules/rflink { };
 
+  rgbxy = callPackage ../development/python-modules/rgbxy { };
+
   rgpio = toPythonModule (
     pkgs.lgpio.override {
       inherit buildPythonPackage;