Merge staging-next into staging

lib/meta.nix

@@ -434,8 +434,9 @@ rec {
   getLicenseFromSpdxId =
     licstr:
     getLicenseFromSpdxIdOr licstr (
-      lib.warn "getLicenseFromSpdxId: No license matches the given SPDX ID: ${licstr}" {
+      lib.warn "getLicenseFromSpdxId: No license with the given SPDX ID found: ${licstr}" {
         shortName = licstr;
+        spdxId = licstr;
       }
     );
 

maintainers/maintainer-list.nix

@@ -14183,6 +14183,12 @@
     github = "klDen";
     githubId = 5478260;
   };
+  klea = {
+    email = "klea+nixos@iwnp.org";
+    github = "notklea";
+    githubId = 231780064;
+    name = "Klea";
+  };
   klntsky = {
     email = "klntsky@gmail.com";
     name = "Vladimir Kalnitsky";

nixos/modules/services/continuous-integration/jenkins/job-builder.nix

@@ -175,7 +175,7 @@ in
             (umask 0077; printf "${cfg.accessUser}:@password_placeholder@" >"$auth_file")
             "${pkgs.replace-secret}/bin/replace-secret" "@password_placeholder@" "$access_token_file" "$auth_file"
 
-            if ! "${pkgs.jenkins}/bin/jenkins-cli" -s "$jenkins_url" -auth "@$auth_file" reload-configuration; then
+            if ! "${pkgs.jenkins}/bin/jenkins-cli" -http -s "$jenkins_url" -auth "@$auth_file" reload-configuration; then
                 echo "error: failed to reload configuration"
                 exit 1
             fi

nixos/tests/jenkins-cli.nix

@@ -25,7 +25,7 @@
     assert "http://0.0.0.0:8080" in machine.succeed("echo $JENKINS_URL")
 
     machine.succeed(
-        "jenkins-cli -auth admin:$(cat /var/lib/jenkins/secrets/initialAdminPassword)"
+        "jenkins-cli -http -auth admin:$(cat /var/lib/jenkins/secrets/initialAdminPassword)"
     )
   '';
 }

nixos/tests/jenkins.nix

@@ -118,7 +118,7 @@
           master.wait_until_succeeds("test -f ${jenkinsHome}/jobs/folder-1/jobs/job-2/config.xml")
 
           # Verify that jenkins also sees the jobs.
-          out = master.succeed("${pkgs.jenkins}/bin/jenkins-cli -s ${jenkinsUrl} -auth admin:$(cat ${jenkinsHome}/secrets/initialAdminPassword) list-jobs")
+          out = master.succeed("${pkgs.jenkins}/bin/jenkins-cli -http -s ${jenkinsUrl} -auth admin:$(cat ${jenkinsHome}/secrets/initialAdminPassword) list-jobs")
           jobs = [x.strip() for x in out.splitlines()]
           # Seeing jobs inside folders requires the Folders plugin
           # (https://plugins.jenkins.io/cloudbees-folder/), which we don't have
@@ -135,7 +135,7 @@
           master.wait_until_fails("test -f ${jenkinsHome}/jobs/folder-1/jobs/job-2/config.xml")
 
           # Verify that jenkins also sees the jobs as removed.
-          out = master.succeed("${pkgs.jenkins}/bin/jenkins-cli -s ${jenkinsUrl} -auth admin:$(cat ${jenkinsHome}/secrets/initialAdminPassword) list-jobs")
+          out = master.succeed("${pkgs.jenkins}/bin/jenkins-cli -http -s ${jenkinsUrl} -auth admin:$(cat ${jenkinsHome}/secrets/initialAdminPassword) list-jobs")
           jobs = [x.strip() for x in out.splitlines()]
           assert jobs == [], f"jobs != []: {jobs}"
     '';

pkgs/applications/emulators/libretro/cores/beetle-psx.nix

@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-psx" + lib.optionalString withHw "-hw";
-  version = "0-unstable-2026-03-06";
+  version = "0-unstable-2026-03-20";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-psx-libretro";
-    rev = "3ea167a60bc37bd0c257592bb9a7f559a50465c4";
-    hash = "sha256-gSNsTV1w7i6bTLngU/Zbo7bwLmb+Bu26JwUre6Rj4qc=";
+    rev = "8b5dea564b687dd07d91cea48615fab213d1e2c9";
+    hash = "sha256-vIEjwhE86TsXbAPk6IbMlWWFWE2Nn6R/+gBe9mMmio4=";
   };
 
   extraBuildInputs = lib.optionals withHw [

pkgs/build-support/fetchdarcs/builder.sh

@@ -20,7 +20,7 @@ set -o noglob
 success=
 for repository in $repositories; do
     echo "Trying to clone $repository $tagtext into $out …"
-    if darcs clone --lazy $tagflags "$repository" "$out"; then
+    if darcs clone --lazy --no-cache $tagflags "$repository" "$out"; then
         # remove metadata, because it can change
         rm -rf "$out/_darcs"
         success=1

pkgs/build-support/fetchdarcs/nix-prefetch-darcs

@@ -27,7 +27,7 @@ usage() {
 while [ $# -gt 0 ]; do
 	case "$1" in
 		--quiet)
-		  quiet=1; shift 1 ;;
+			quiet=1; shift 1 ;;
 		--name)
 			name="$2"; shift 2 ;;
 		--repo)
@@ -127,11 +127,7 @@ if [ -z "$final_path" ]; then
 
 	cd "$tmp_clone"
 	# Do not print Darcs progress to stdout (else stdout isn’t parsable JSON)
-	if [ -t 1 ]; then
-		darcs clone $clone_args "$repository" "$name" >/dev/tty
-	else
-		darcs clone $clone_args "$repository" "$name" >/dev/null
-	fi
+	darcs clone "$clone_args" "$repository" "$name" 1>&2
 	# Will put the current Darcs context into the store.
 	new_context="$tmp_clone/${name}-context.txt"
 	darcs log --repodir="$tmp_clone/$name" --context > "$new_context"

pkgs/by-name/as/asusctl/package.nix

@@ -18,16 +18,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "asusctl";
-  version = "6.3.4";
+  version = "6.3.5";
 
   src = fetchFromGitLab {
     owner = "asus-linux";
     repo = "asusctl";
     tag = finalAttrs.version;
-    hash = "sha256-1B4uKX8Aqorxh+QMsUEmSnO56zqYhUb6wLMXPAR5HQo=";
+    hash = "sha256-99SLaDJm+stakrUmlyWznAeYKeD5SXeLAqakrmpalbc=";
   };
 
-  cargoHash = "sha256-aRsrA1j4nYp2rbQM2FbTfWVDkVfKFFa6L+DtW8mKcmk=";
+  cargoHash = "sha256-f6Zut4oknNCKmd5Igt08se2EpCLLmmIQjD02wj2lMQg=";
 
   postPatch = ''
     files="

pkgs/by-name/au/autodiff/package.nix

@@ -0,0 +1,43 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  eigen,
+  catch2_3,
+  python3Packages,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "autodiff";
+  version = "1.1.2";
+
+  src = fetchFromGitHub {
+    owner = "autodiff";
+    repo = "autodiff";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-hKIufS5o5tfsbVchwTJxms1n5Im1iTfY3KGWD1s5g9M=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    eigen
+    catch2_3
+    python3Packages.pybind11
+    python3Packages.distutils
+  ];
+
+  postPatch =
+    # https://github.com/autodiff/autodiff/pull/391
+    ''
+      substituteInPlace python/package/CMakeLists.txt \
+        --replace-fail PYTHON_EXECUTABLE Python_EXECUTABLE
+    '';
+
+  meta = {
+    description = "Automatic differentiation made easier for C++";
+    homepage = "https://github.com/autodiff/autodiff/tree/main";
+    maintainers = [ lib.maintainers.athas ];
+    license = lib.licenses.mit;
+  };
+})

pkgs/by-name/ca/cargo-codspeed/package.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-codspeed";
-  version = "4.4.0";
+  version = "4.4.1";
 
   src = fetchFromGitHub {
     owner = "CodSpeedHQ";
     repo = "codspeed-rust";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hvGpJXkdvVgN1I0xYomdlu0V0zjYK+qZB/FZ6FLbq1s=";
+    hash = "sha256-1cokeZux7US+MUY1w1Z/tFC7gVcgKCZPZnkZeKLIPLo=";
   };
 
-  cargoHash = "sha256-oT10BxbLyHUBz9DHDyBNuqWNYK9zHUo8nlH+cr+LaR0=";
+  cargoHash = "sha256-iAIYMFE81VX6WhDoWzmPt3s+hWCl37isP+tP7LlOMsg=";
 
   nativeBuildInputs = [
     curl

pkgs/by-name/ca/cargo-sort/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-sort";
-  version = "2.1.1";
+  version = "2.1.3";
 
   src = fetchFromGitHub {
     owner = "devinr528";
     repo = "cargo-sort";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-Ad4arLpD8tgNDUGHKBbIKt41oQfjMgzzyWnnw8Cjw0k=";
+    sha256 = "sha256-PtBjs+mqrz9z6tkpajx/OYQATJP81vi4ColjFXr9Rv0=";
   };
 
-  cargoHash = "sha256-BnBo0oEZL5Ilqw/AJzDITkg388LjN+8/AwxRDHQt/9s=";
+  cargoHash = "sha256-ygMtfhwoUEIZx+q6KB5yOr8/Fj5FRMIs7dXlYDUKb2U=";
 
   meta = {
     description = "Tool to check that your Cargo.toml dependencies are sorted alphabetically";

pkgs/by-name/ci/cilium-cli/package.nix

@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "cilium-cli";
-  version = "0.19.0";
+  version = "0.19.2";
 
   src = fetchFromGitHub {
     owner = "cilium";
     repo = "cilium-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pW+9UN+pWkKCYRTvZxslrPgczOezVnPpDF5XdRHCh+g=";
+    hash = "sha256-zlPl6J+Vbv2An1bauzhee8hrtEEg1ENR6SKSzv3PCS0=";
   };
 
   nativeBuildInputs = [ installShellFiles ];

pkgs/by-name/co/commitlint/package.nix

@@ -12,18 +12,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "commitlint";
-  version = "20.4.4";
+  version = "20.5.0";
 
   src = fetchFromGitHub {
     owner = "conventional-changelog";
     repo = "commitlint";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Nt3uq5FkdpLyjSaQin4avcF4hqUxkd18f+k4I1uxy64=";
+    hash = "sha256-AVc3uToQ3hvpesWkhIdYfvawoIJmDW+T5pHonujaL/s=";
   };
 
   yarnOfflineCache = fetchYarnDeps {
     inherit (finalAttrs) src;
-    hash = "sha256-vD+63mWGZAaLut+xMSD7nnAvGSSl7XhSJykUWYDKWQ4=";
+    hash = "sha256-SOUweX/dvA67E6Vjpq3WLITbh6bevErV0wGZgWQ3U7o=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/fz/fzf-git-sh/package.nix

@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fzf-git-sh";
-  version = "0-unstable-2026-03-10";
+  version = "0-unstable-2026-03-19";
 
   src = fetchFromGitHub {
     owner = "junegunn";
     repo = "fzf-git.sh";
-    rev = "52e3f704767f6cf1dad557220e077fbb40162349";
-    hash = "sha256-4dR3bF4iKXZGWwr3FfmGqflhghdBB02EoVgjPu97mAk=";
+    rev = "0f0488331a060cf45aaecb6705a2cf394fb20293";
+    hash = "sha256-fV4RtYL+ksbl5SMVZMoRyo6YUWP/KFvFPgfIbecIOO4=";
   };
 
   dontBuild = true;

pkgs/by-name/ge/geant4/package.nix

@@ -38,12 +38,12 @@ let
 in
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "11.4.0";
+  version = "11.4.1";
   pname = "geant4";
 
   src = fetchurl {
     url = "https://cern.ch/geant4-data/releases/geant4-v${finalAttrs.version}.tar.gz";
-    hash = "sha256-rWTJa4s9cSXnRruX9fVXee1ZRoGmpdY8JwJefJzvWPo=";
+    hash = "sha256-HG3ymOw5hFlDgP/jRJ48I80jKZsX4QZz5pI7jmuNIBc=";
   };
 
   # Fix broken paths in a .pc

pkgs/by-name/gh/ghostfolio/package.nix

@@ -11,13 +11,13 @@
 
 buildNpmPackage rec {
   pname = "ghostfolio";
-  version = "2.249.0";
+  version = "2.250.0";
 
   src = fetchFromGitHub {
     owner = "ghostfolio";
     repo = "ghostfolio";
     tag = version;
-    hash = "sha256-UciTe0IibBLlYzAKfBp8WPVMSF6lgutWkvmZAjRyuBQ=";
+    hash = "sha256-7urvJb2X18XM+ZbdHKuda82IU/ZYBpRAxJhHAAdw3oc=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -27,7 +27,7 @@ buildNpmPackage rec {
     '';
   };
 
-  npmDepsHash = "sha256-pGpA/C9tO2NQQcBxKDllLehcp6bMN5K/CBXktRUGP3g=";
+  npmDepsHash = "sha256-ALmyzbWogE+6Yma6Ul9ATuF7QaG1NwZoVCh5pH01vns=";
 
   nativeBuildInputs = [
     prisma_6

pkgs/by-name/gn/gnome-manuals/package.nix

@@ -56,6 +56,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru.updateScript = gnome.updateScript {
     packageName = "manuals";
+    attrPath = "gnome-manuals";
   };
 
   meta = {

pkgs/by-name/go/goocanvas_1/package.nix

@@ -29,6 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru = {
     updateScript = gnome.updateScript {
+      attrPath = "goocanvas_${lib.versions.major finalAttrs.version}";
       packageName = "goocanvas";
       versionPolicy = "odd-unstable";
       freeze = true;

pkgs/by-name/go/goocanvas_2/package.nix

@@ -63,7 +63,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru = {
     updateScript = gnome.updateScript {
-      attrPath = "goocanvas${lib.versions.major finalAttrs.version}";
+      attrPath = "goocanvas_${lib.versions.major finalAttrs.version}";
       packageName = "goocanvas";
       versionPolicy = "odd-unstable";
       freeze = true;

pkgs/by-name/go/goocanvas_3/package.nix

@@ -61,8 +61,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru = {
     updateScript = gnome.updateScript {
-      attrPath = "${finalAttrs.pname}${lib.versions.major finalAttrs.version}";
-      packageName = finalAttrs.pname;
+      attrPath = "goocanvas_${lib.versions.major finalAttrs.version}";
+      packageName = "goocanvas";
       versionPolicy = "odd-unstable";
     };
   };

pkgs/by-name/ha/haproxy/package.nix

@@ -39,11 +39,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "haproxy";
-  version = "3.3.5";
+  version = "3.3.6";
 
   src = fetchurl {
     url = "https://www.haproxy.org/download/${lib.versions.majorMinor finalAttrs.version}/src/haproxy-${finalAttrs.version}.tar.gz";
-    hash = "sha256-nebnZbQm8HwQgKrdL7pbaCocwXX+jrRdXrlIKSqGbgI=";
+    hash = "sha256-5py13Fnk6x/3K86/MNVfCRmAPGhuQowMOlkD8s98H7Y=";
   };
 
   buildInputs = [

pkgs/by-name/is/istioctl/package.nix

@@ -7,15 +7,15 @@
 
 buildGoModule (finalAttrs: {
   pname = "istioctl";
-  version = "1.28.3";
+  version = "1.29.1";
 
   src = fetchFromGitHub {
     owner = "istio";
     repo = "istio";
     rev = finalAttrs.version;
-    hash = "sha256-V8yG0Dj2/KevTiG9C68SlkLzo5xkblxMYhsZOq1ucgc=";
+    hash = "sha256-+VdMmBf4YRAroMw0Jub7+Np3qEz648FqTgxCjL20WYQ=";
   };
-  vendorHash = "sha256-QcPtQV3sO+B2NtxJvOi5x5hlAI1ace4LqWO84fAovGw=";
+  vendorHash = "sha256-OXd29tw9UzrTF1q4ACWuA0xMOIcptDnUrkmnP576vhg=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/je/jenkins/package.nix

@@ -18,11 +18,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "jenkins";
-  version = "2.541.2";
+  version = "2.541.3";
 
   src = fetchurl {
     url = "https://get.jenkins.io/war-stable/${finalAttrs.version}/jenkins.war";
-    hash = "sha256-3J1TLlTUt+t9eO3NMheHbdSBG0nRo7ZuWZrUpkLVcZM=";
+    hash = "sha256-AACt36hyKWMWQTek4OYKvCJ9nWBxDE3rGUgfmnUc9RI=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/by-name/ml/mlkit/package.nix

@@ -25,6 +25,13 @@ stdenv.mkDerivation (finalAttrs: {
   buildFlags = [
     "mlkit"
     "mlkit_libs"
+    "smltojs"
+    "smltojs_basislibs"
+  ];
+
+  installTargets = [
+    "install"
+    "install_smltojs"
   ];
 
   doCheck = true;

pkgs/by-name/no/node-core-utils/package.nix

@@ -9,16 +9,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "node-core-utils";
-  version = "6.1.1";
+  version = "6.2.0";
 
   src = fetchFromGitHub {
     owner = "nodejs";
     repo = "node-core-utils";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wDsDWiPCFJMbPj1VNelcSptVnmmxf7L6cqDVt4XD77g=";
+    hash = "sha256-5VztsAIkLcvLUAH0KkwgWzrgYeDG8u8zXjwVPxN2XIg=";
   };
 
-  npmDepsHash = "sha256-TMIdWHYrt+SvjVvamJqShmX9XbIWsi72uToz1vSf+q8=";
+  npmDepsHash = "sha256-3XE0FOlEQ+GhXYt4nK5LyVD/vCPYaylyn7rzqndl+u4=";
 
   dontNpmBuild = true;
   dontNpmPrune = true;

pkgs/by-name/pa/packcc/package.nix

@@ -11,13 +11,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "packcc";
-  version = "3.0.0";
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "arithy";
     repo = "packcc";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-uRvZr6mw9eI0a4JxFwDNyPBIrwTHgq3KmarDP/NmrEs=";
+    hash = "sha256-vBRi9Pxcy6MhdrbZd13Xgel3w3qiIrU8F3rO1GFqSgE=";
   };
 
   postPatch = ''

pkgs/by-name/pi/pihole/0001-Remove-sudo.patch

@@ -1,32 +1,33 @@
-From 833856bd77dc6ea77557ab0659c1459bee393653 Mon Sep 17 00:00:00 2001
+From 16f94593a18e7a0668df6ed9d4744252185e5876 Mon Sep 17 00:00:00 2001
 From: averyv <avery@averyv.me>
-Date: Sat, 6 Sep 2025 17:51:48 +0100
+Date: Sat, 6 Sep 2025 18:04:11 +0100
 Subject: [PATCH 1/2] Remove sudo
 
 Rely on polkit and sensible permissions
 ---
- pihole | 8 --------
- 1 file changed, 8 deletions(-)
+ pihole | 9 ---------
+ 1 file changed, 9 deletions(-)
 
 diff --git a/pihole b/pihole
-index 7b5e3eb..b00617e 100755
+index 5af46fa6..96acb1ae 100755
 --- a/pihole
 +++ b/pihole
-@@ -570,14 +570,6 @@ if [[ -z ${USER} ]]; then
+@@ -587,15 +587,6 @@ if [[ -z ${USER} ]]; then
    USER=$(whoami)
  fi
- 
+
 -# Check if the current user is not root and if the command
 -# requires root. If so, exit with an error message.
--if [[ $EUID -ne 0 && need_root -eq 1 ]];then
--  echo -e "  ${CROSS} The Pi-hole command requires root privileges, try:"
+-# Add an exception for the user "pihole" to allow the webserver running gravity
+-if [[ ( $EUID -ne 0 && ${USER} != "pihole" ) && -n "${need_root}" ]]; then
+-  echo -e "  ${CROSS} This Pi-hole command requires root privileges, try:"
 -  echo -e "      ${COL_GREEN}sudo pihole $*${COL_NC}"
 -  exit 1
 -fi
 -
  # Handle redirecting to specific functions based on arguments
  case "${1}" in
-   "allow" | "allowlist"           ) listFunc "$@";;
--- 
-2.50.1
+   "-d" | "debug"                  ) debugFunc "$@";;
+--
+2.50.1 (Apple Git-155)
 

pkgs/by-name/pi/pihole/package.nix

@@ -32,13 +32,13 @@
 
 (resholve.mkDerivation rec {
   pname = "pihole";
-  version = "6.1.4";
+  version = "6.4";
 
   src = fetchFromGitHub {
     owner = "pi-hole";
     repo = "pi-hole";
     tag = "v${version}";
-    hash = "sha256-2B2GUJKt4jHEjQLBx96FRuHpnLCTzE4UPDaeQvnDONc=";
+    hash = "sha256-aBQO+wAqeuXc9ekByVFlOZQ9SBCGsozGdoS8r1qhGuk=";
   };
 
   patches = [
@@ -61,11 +61,11 @@
     install -Dm 555 -t $out/bin pihole
     install -Dm 555 -t $scriptsDir/advanced/Scripts gravity.sh
 
-    # The installation script is sourced by advanced/Scripts/piholeARPTable.sh etc
+    # The installation script is sourced by advanced/Scripts/piholeDebug.sh etc
     cp --parents -r -t $scriptsDir/ 'automated install/' advanced/{Scripts,Templates}/
 
     installShellCompletion --bash --name pihole.bash \
-      advanced/bash-completion/pihole
+      advanced/bash-completion/pihole.bash
 
     runHook postInstall
   '';
@@ -86,10 +86,10 @@
           "${relativeScripts}/database_migration/gravity-db.sh"
           "${relativeScripts}/gravity.sh"
           "${relativeScripts}/list.sh"
-          "${relativeScripts}/piholeARPTable.sh"
           "${relativeScripts}/piholeCheckout.sh"
           "${relativeScripts}/piholeDebug.sh"
           "${relativeScripts}/piholeLogFlush.sh"
+          "${relativeScripts}/piholeNetworkFlush.sh"
           "${relativeScripts}/query.sh"
           "${relativeScripts}/update.sh"
           "${relativeScripts}/updatecheck.sh"
@@ -129,6 +129,7 @@
           "/etc/os-release"
           "/etc/pihole/versions"
           "/etc/pihole/setupVars.conf"
+          "/opt/pihole/utils.sh"
         ];
         external = [
           # Used by chronometer.sh to get GPU information on Raspberry Pis
@@ -178,6 +179,7 @@
           "/etc/pihole/versions"
           "/etc/pihole/setupVars.conf"
           "$cachedVersions"
+          "/opt/pihole/utils.sh"
         ];
 
         "$PIHOLE_SETUP_VARS_FILE" = true;
@@ -190,9 +192,9 @@
         "${scriptsDir}/api.sh" = true;
         "${scriptsDir}/gravity.sh" = true;
         "${scriptsDir}/list.sh" = true;
-        "${scriptsDir}/piholeARPTable.sh" = true;
         "${scriptsDir}/piholeDebug.sh" = true;
         "${scriptsDir}/piholeLogFlush.sh" = true;
+        "${scriptsDir}/piholeNetworkFlush.sh" = true;
         "${scriptsDir}/query.sh" = true;
         "${scriptsDir}/uninstall.sh" = true;
         "${scriptsDir}/update.sh" = true;
@@ -241,9 +243,7 @@
 
   passthru.tests = nixosTests.pihole-ftl;
 
-  passthru = {
-    inherit stateDir;
-  };
+  passthru = { inherit stateDir; };
 }).overrideAttrs
   (old: {
     # Resholve can't fix the hardcoded absolute paths, so substitute them before resholving

pkgs/by-name/se/searchix/darwin-sandbox-fix.patch

@@ -0,0 +1,20 @@
+--- vendor/modernc.org/libc/honnef.co/go/netdb/netdb.go
++++ vendor/modernc.org/libc/honnef.co/go/netdb/netdb.go
+@@ -696,7 +696,7 @@ func init() {
+ 	// Load protocols
+ 	data, err := ioutil.ReadFile("/etc/protocols")
+ 	if err != nil {
+-		if !os.IsNotExist(err) {
++		if !os.IsNotExist(err) && !os.IsPermission(err) {
+ 			panic(err)
+ 		}
+ 
+@@ -732,7 +732,7 @@ func init() {
+ 	// Load services
+ 	data, err = ioutil.ReadFile("/etc/services")
+ 	if err != nil {
+-		if !os.IsNotExist(err) {
++		if !os.IsNotExist(err) && !os.IsPermission(err) {
+ 			panic(err)
+ 		}
+ 

pkgs/by-name/se/searchix/package.nix

@@ -19,18 +19,25 @@ in
 
 buildGoModule (finalAttrs: {
   pname = "searchix";
-  version = "0.4.4";
+  version = "0.4.5";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "alinnow";
     repo = "searchix";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-R8/iR8QoeUwNQCFkr+JtoPq/iKkJRIe8dsbvGfFqinE=";
+    hash = "sha256-2pffyKBX+ICYEN+42gwN2byjw+T9H4esi2+oTqs52GE=";
   };
 
   vendorHash = "sha256-yfcQgy4cQFRvtsyLHLojnJaWhle1ZR3unmaFQj8ljuw=";
 
+  overrideModAttrs = old: {
+    # netdb.go allows /etc/protocols and /etc/services to not exist and happily proceeds, but it panic()s if they exist but return permission denied.
+    postBuild = ''
+      patch -p0 < ${./darwin-sandbox-fix.patch}
+    '';
+  };
+
   subPackages = [ "cmd/searchix-web" ];
 
   tags = [ "embed" ];
@@ -45,7 +52,7 @@ buildGoModule (finalAttrs: {
     cp ${simpleCss}/simple.css frontend/static/base.css
   '';
 
-  postInstall = lib.optionalString stdenv.hostPlatform.isLinux ''
+  postInstall = ''
     $out/bin/searchix-web generate-error-page --outdir $out/share/searchix/
   '';
 

pkgs/by-name/sh/shadowsocks-qtun-plugin/package.nix

@@ -0,0 +1,27 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+}:
+
+rustPlatform.buildRustPackage {
+  pname = "shadowsocks-qtun-plugin";
+  version = "0.3.0-unstable-2026-02-07";
+
+  src = fetchFromGitHub {
+    owner = "shadowsocks";
+    repo = "qtun";
+    rev = "ab58110075488f8411b0eafd3d9412be2ace3c61";
+    hash = "sha256-hA/XoSZcnci2PqfeyR0ELi4dty9jE3Lsq/lgOfZ0zQ0=";
+  };
+
+  cargoHash = "sha256-iIqN25t9GxQ4jC5NtpOuDztdS+mCnEh7oDJXm9PivOo=";
+
+  meta = {
+    description = "Yet another SIP003 plugin based on IETF-QUIC";
+    homepage = "https://github.com/shadowsocks/qtun";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ neverbehave ];
+    mainProgram = "qtun-server";
+  };
+}

pkgs/by-name/si/signal-cli/package.nix

@@ -3,7 +3,7 @@
   lib,
   fetchurl,
   makeWrapper,
-  openjdk21_headless,
+  openjdk25_headless,
   libmatthew_java,
   dbus,
   dbus_java,
@@ -12,12 +12,12 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "signal-cli";
-  version = "0.13.24";
+  version = "0.14.1";
 
   # Building from source would be preferred, but is much more involved.
   src = fetchurl {
     url = "https://github.com/AsamK/signal-cli/releases/download/v${finalAttrs.version}/signal-cli-${finalAttrs.version}.tar.gz";
-    hash = "sha256-Xg43pmLi5k+H58UYOhtzYogjuJWQcHxU5IsIS+Zd1D8=";
+    hash = "sha256-zs2ksSxCwYhEZ/Oh8BN3U2ISwqXPshCl82HoL4wWNug=";
   };
 
   buildInputs = lib.optionals stdenvNoCC.hostPlatform.isLinux [
@@ -36,8 +36,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   + (
     if stdenvNoCC.hostPlatform.isLinux then
       ''
-        makeWrapper ${openjdk21_headless}/bin/java $out/bin/signal-cli \
-          --set JAVA_HOME "${openjdk21_headless}" \
+        makeWrapper ${openjdk25_headless}/bin/java $out/bin/signal-cli \
+          --set JAVA_HOME "${openjdk25_headless}" \
           --add-flags "-classpath '$out/lib/*:${libmatthew_java}/lib/jni'" \
           --add-flags "-Djava.library.path=${libmatthew_java}/lib/jni:${dbus_java}/share/java/dbus:$out/lib" \
           --add-flags "org.asamk.signal.Main"
@@ -45,8 +45,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     else
       ''
         wrapProgram $out/bin/signal-cli \
-          --prefix PATH : ${lib.makeBinPath [ openjdk21_headless ]} \
-          --set JAVA_HOME ${openjdk21_headless}
+          --prefix PATH : ${lib.makeBinPath [ openjdk25_headless ]} \
+          --set JAVA_HOME ${openjdk25_headless}
       ''
   )
   + ''
@@ -71,7 +71,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     changelog = "https://github.com/AsamK/signal-cli/blob/v${finalAttrs.version}/CHANGELOG.md";
     sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
     license = lib.licenses.gpl3;
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.klea ];
     platforms = lib.platforms.all;
   };
 })

pkgs/by-name/st/stable-diffusion-cpp/package.nix

@@ -42,7 +42,7 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
   pname = "stable-diffusion-cpp";
-  version = "master-506-c9cd497";
+  version = "master-537-545fac4";
 
   outputs = [
     "out"
@@ -52,8 +52,8 @@ effectiveStdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "leejet";
     repo = "stable-diffusion.cpp";
-    rev = "master-506-c9cd497";
-    hash = "sha256-/dMQm8YKZlyFcbMfBQNpeje/sRq+U6ppnt7DT2mxGds=";
+    rev = "master-537-545fac4";
+    hash = "sha256-JprdyzLkPaZsTg2uxDODBmL5BF3RT+i04ZbbMOLs2z4=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/tr/triton-llvm/package.nix

@@ -128,6 +128,9 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "LLVM_INCLUDE_DOCS" (buildDocs || buildMan))
     (lib.cmakeBool "MLIR_INCLUDE_DOCS" (buildDocs || buildMan))
     (lib.cmakeBool "LLVM_BUILD_DOCS" (buildDocs || buildMan))
+    # It's tempting to set BUILD_SHARED_LIBS, which saves far more space
+    # but currently segfaults in keras's test suite. More work needed.
+    (lib.cmakeBool "LLVM_TOOL_LLVM_DRIVER_BUILD" true) # Save space by using busybox style tool binary
     # Way too slow, only uses one core
     # (lib.cmakeBool "LLVM_ENABLE_DOXYGEN" (buildDocs || buildMan))
     (lib.cmakeBool "LLVM_ENABLE_SPHINX" (buildDocs || buildMan))

pkgs/by-name/tr/trivy/package.nix

@@ -10,19 +10,19 @@
 
 buildGoModule (finalAttrs: {
   pname = "trivy";
-  version = "0.69.4";
+  version = "0.69.3";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = "trivy";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-W3QCBmT6YVqYYxG62iIZ+cR6eh/OtzOz7gQgBy2FO9E=";
+    hash = "sha256-lzFcLyrORA+1LxS4nzJVvilg29GTNiGRmnjJ47ev/yU=";
   };
 
   # Hash mismatch on across Linux and Darwin
   proxyVendor = true;
 
-  vendorHash = "sha256-HtzspJxMYTEd3jtw1ltmoBh8+eQnupqVZAovQzplgac=";
+  vendorHash = "sha256-aqSB2pakYH713GSbIAHwAL9Gio17MzZtwqfh9sbzDBs=";
 
   subPackages = [ "cmd/trivy" ];
 

pkgs/by-name/un/unityhub/package.nix

@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "unityhub";
-  version = "3.16.3";
+  version = "3.16.4";
 
   src = fetchurl {
     url = "https://hub-dist.unity3d.com/artifactory/hub-debian-prod-local/pool/main/u/unity/unityhub_amd64/UnityHubSetup-${version}-amd64.deb";
-    hash = "sha256-Sfgzx2K+38T0v31K4SdtbMS6alAVuOyTS9O89OYjozU=";
+    hash = "sha256-cWE3F4o/VWTewmVrd+VKaHSv84+UlADcm1kFow/pz2Q=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/wt/wttrbar/package.nix

@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "wttrbar";
-  version = "0.14.0";
+  version = "0.14.3";
 
   src = fetchFromGitHub {
     owner = "bjesus";
     repo = "wttrbar";
     tag = finalAttrs.version;
-    hash = "sha256-AgNWz8GiJKyfhvv6+8NZPMcaxPNaufw/k/yVVLoJl7U=";
+    hash = "sha256-MNELUtk3pXw0vcA8I1zUXl6BhojEcIoOUX4G2d4QIMI=";
   };
 
-  cargoHash = "sha256-ZDP9EEQiW57O/Pgjja1/4cb513naymx6quSRLgCpphM=";
+  cargoHash = "sha256-V+XsePgv6Ss6TC/Ej2hQkfj7hdjTNV0V4QNynMRZ24I=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl ];

pkgs/by-name/ya/yazi/plugins/compress/default.nix

@@ -5,13 +5,13 @@
 }:
 mkYaziPlugin {
   pname = "compress.yazi";
-  version = "25.12.29-unstable-2026-01-24";
+  version = "25.12.29-unstable-2026-03-15";
 
   src = fetchFromGitHub {
     owner = "KKV9";
     repo = "compress.yazi";
-    rev = "cb6e8ec0141915dc319ccd6b904dcd2f03502576";
-    hash = "sha256-D/EpcRDIc3toeyjHqi+vGw0v9B22HVvKJua5EVEAc0U=";
+    rev = "46a6b9f02ff2f8aced466a1f01a3fe241f1cd45f";
+    hash = "sha256-Mby185FCJY6nqHcHDQu+D5SLk+wGcyeUHK8yAvrd4TM=";
   };
 
   meta = {

pkgs/by-name/ya/yazi/plugins/lazygit/default.nix

@@ -5,13 +5,13 @@
 }:
 mkYaziPlugin {
   pname = "lazygit.yazi";
-  version = "0-unstable-2025-12-31";
+  version = "0-unstable-2026-03-12";
 
   src = fetchFromGitHub {
     owner = "Lil-Dank";
     repo = "lazygit.yazi";
-    rev = "0e56060192d1ccd307664bf93b3d0beb1efe528e";
-    hash = "sha256-LcEpzSf0E43hnhOxJ/EHNJRk3Au5hcgRZ2Kj412Ykew=";
+    rev = "8c4086c813c5856ab9571ae9142ed7d40ed3211e";
+    hash = "sha256-YpRWnR5fEXzHY9yBFNKy1NvTzHa8B1UhS2Qrfe9+Tpg=";
   };
 
   meta = {

pkgs/by-name/ya/yazi/plugins/mediainfo/default.nix

@@ -5,13 +5,13 @@
 }:
 mkYaziPlugin {
   pname = "mediainfo.yazi";
-  version = "26.1.22-unstable-2026-03-08";
+  version = "26.1.22-unstable-2026-03-17";
 
   src = fetchFromGitHub {
     owner = "boydaihungst";
     repo = "mediainfo.yazi";
-    rev = "6fbed8d3b34e2f72a52a481ea1461db112ea835d";
-    hash = "sha256-wmUseJ1li+J3euxtYtImIQ/NmbyAp8HhRZscC7Pib9s=";
+    rev = "26a75daabe768347d45aa65be4c75cfb15772ef2";
+    hash = "sha256-tE/ov1lF/bxxVCH00dXuWcjyjYkNpqeiMb0eIZ8Nwj4=";
   };
 
   meta = {

pkgs/development/lua-modules/generated-packages.nix

@@ -814,15 +814,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "fzf-lua";
-      version = "0.0.2529-1";
+      version = "0.0.2545-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/fzf-lua-0.0.2529-1.rockspec";
-          sha256 = "0m2p1m9b62j0v97ys12gz0rlwp2rc6cmbdmh01cjpr4bi1fha8v9";
+          url = "mirror://luarocks/fzf-lua-0.0.2545-1.rockspec";
+          sha256 = "0hinizjvfw1ana0wkjqvrn8d3nvmcvhczda144jj6kf7y96xwazr";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/ibhagwan/fzf-lua/archive/d9508cc1d05ffcdc91a32dfd38fc1013a56b20da.zip";
-        sha256 = "04h6ym8sxvcfj7vnmn9ykn192ycv04fbdmg74lh5vadr4vn20vvg";
+        url = "https://github.com/ibhagwan/fzf-lua/archive/8a79ee54d6216d10b2f153921a12b152be0c1a20.zip";
+        sha256 = "128slx673pgpyf9cpkl58gp0b1bgbv7fc23a8hn74n90r628pg4i";
       };
 
       disabled = luaOlder "5.1";
@@ -906,15 +906,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "grug-far.nvim";
-      version = "1.6.62-1";
+      version = "1.6.63-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/grug-far.nvim-1.6.62-1.rockspec";
-          sha256 = "1n9y8azrzpqhp9qalh2fcsvcfhplbaqgc3xzva6v3y67rsklbxxa";
+          url = "mirror://luarocks/grug-far.nvim-1.6.63-1.rockspec";
+          sha256 = "14hmd8i604bfiv51fbpm4xw5f6b750bmxac4ghc5w36wdzg1cl7y";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/MagicDuck/grug-far.nvim/archive/ac52ee2d87399dfd7b0d59d5b1d2bbaf2a4028f1.zip";
-        sha256 = "0zabm0yzgnd7a3zf7wqd1qhhk5ws8xvqpc6vzl0y40n95i4m7ba2";
+        url = "https://github.com/MagicDuck/grug-far.nvim/archive/dc4684e163971bb1f5bfb93fbd4bb3e892bf9b15.zip";
+        sha256 = "1225sn36wqy8bdlyhbhajivhjhp936kbq307d4p94lcagvrvf7vp";
       };
 
       disabled = luaOlder "5.1";
@@ -5252,15 +5252,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "tree-sitter-orgmode";
-      version = "2.0.2-1";
+      version = "2.0.3-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/tree-sitter-orgmode-2.0.2-1.rockspec";
-          sha256 = "0ci1dgnvxxaf9vj2ipa6xcq80apl82yqr6a3r3a6wg2d88r0chkg";
+          url = "mirror://luarocks/tree-sitter-orgmode-2.0.3-1.rockspec";
+          sha256 = "0kqsyrmx9qg80c0czpjqjyf3arccd6gpfy5fz5lgnzwd0n2jmbfp";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/nvim-orgmode/tree-sitter-org/archive/2.0.2.zip";
-        sha256 = "1rqw8malf09vxbmkinfjwhs490xjw41gvaydg590y30qvrqmaa5l";
+        url = "https://github.com/nvim-orgmode/tree-sitter-org/archive/2.0.3.zip";
+        sha256 = "0f531vg0zsc5yr39wp5sm6ra9kf731l3ssl7qhqj0h919fa02kis";
       };
 
       nativeBuildInputs = [ luarocks-build-treesitter-parser ];

pkgs/development/python-modules/jaraco-test/default.nix

@@ -6,7 +6,7 @@
   jaraco-functools,
   jaraco-context,
   jaraco-collections,
-  pytestCheckHook,
+  pytest8_3CheckHook,
 }:
 
 buildPythonPackage rec {
@@ -34,7 +34,7 @@ buildPythonPackage rec {
     jaraco-collections
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [ pytest8_3CheckHook ];
 
   pythonImportsCheck = [ "jaraco.test" ];
 

pkgs/development/python-modules/modelscope/default.nix

@@ -4,26 +4,28 @@
   fetchFromGitHub,
   setuptools,
   filelock,
+  packaging,
   requests,
   tqdm,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "modelscope";
-  version = "1.35.0";
+  version = "1.35.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "modelscope";
     repo = "modelscope";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mWcMJWUdxC3Y5rcfx2urMYmYoJXbV5LudPzVB6wxRJA=";
+    hash = "sha256-p8Pv58IpP165z4CHq+CO6160LyHd3BS3Y3I2JBGp4KE=";
   };
 
   build-system = [ setuptools ];
 
   dependencies = [
     filelock
+    packaging
     requests
     setuptools
     tqdm
@@ -41,6 +43,7 @@ buildPythonPackage (finalAttrs: {
     maintainers = with lib.maintainers; [
       kyehn
       doronbehar
+      ryan4yin
     ];
   };
 })

pkgs/development/python-modules/pydal/default.nix

@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "pydal";
-  version = "20260216.1";
+  version = "20260313.1";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-N4hZkzIWTnU8836ZEcs5/RWddmrCqGjxejq8IVI2Y84=";
+    hash = "sha256-LfjeQV3aiCHwopHNZkWfuImyhFjuZQF3j2guVVMIR+k=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/scim2-models/default.nix

@@ -9,7 +9,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "scim2-models";
-  version = "0.6.4";
+  version = "0.6.6";
 
   pyproject = true;
 
@@ -17,7 +17,7 @@ buildPythonPackage (finalAttrs: {
     owner = "python-scim";
     repo = "scim2-models";
     tag = finalAttrs.version;
-    hash = "sha256-MyKe1OeaYwqHCma/HEunNCJ49ssHM+pTtnM4XnDZBCE=";
+    hash = "sha256-pYINB8avoYt1VUgvyDTXw3ejSBoZDFEQK0F4flTeyaY=";
   };
 
   postPatch = ''

pkgs/development/python-modules/tess/default.nix

@@ -1,22 +1,22 @@
 {
-  lib,
   buildPythonPackage,
-  fetchPypi,
   cython,
-  setuptools,
+  fetchPypi,
+  lib,
   numpy,
-  scipy,
   pytestCheckHook,
   python,
+  scipy,
+  setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "tess";
   version = "0.3.1";
   pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     hash = "sha256-5Ic06+K7CWRh1t2v3aJ5JlBACvHXqQyYzvU71jZJFtI=";
   };
 
@@ -30,6 +30,10 @@ buildPythonPackage rec {
     scipy
   ];
 
+  # scipy has depecrated since version 1.15.0 the function `sph_harm`, and has
+  # been removed in 1.17.0 in favor of `sph_harm_y`
+  patches = [ ./scipy_sph_harm.patch ];
+
   pythonImportsCheck = [ "tess" ];
 
   nativeCheckInputs = [ pytestCheckHook ];
@@ -44,6 +48,6 @@ buildPythonPackage rec {
     description = "Module for calculating and analyzing Voronoi tessellations";
     homepage = "https://tess.readthedocs.org";
     license = lib.licenses.bsd3;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ drawbu ];
   };
-}
+})

pkgs/development/python-modules/tess/scipy_sph_harm.patch

@@ -0,0 +1,20 @@
+diff --git a/tess/__init__.py b/tess/__init__.py
+index b7f8f80..91c518f 100644
+--- a/tess/__init__.py
++++ b/tess/__init__.py
+@@ -374,13 +374,13 @@ def orderQ(l, xyz, weights=1):
+     :math:`w_i` are the `weights`, defaulting to uniform: (:math:`\frac{1}{N_b}`)
+     """
+     import numpy as np
+-    from scipy.special import sph_harm
++    from scipy.special import sph_harm_y
+ 
+     theta, phi = cart_to_spher(xyz).T
+     weights = np.ones(xyz.shape[0]) * weights
+     weights /= np.sum(weights)
+     mmeans = np.zeros(2 * l + 1, dtype=float)
+     for m in range(-l, l + 1):
+-        sph_weighted = sph_harm(m, l, phi, theta).dot(weights)  # Average of Y_{6m}
++        sph_weighted = sph_harm_y(l, m, theta, phi).dot(weights)  # Average of Y_{6m}
+         mmeans[m] = abs(sph_weighted) ** 2
+     return np.sqrt(4 * np.pi / (2 * l + 1) * np.sum(mmeans))