Merge master into staging-nixos

.github/workflows/bot.yml

@@ -91,7 +91,7 @@ jobs:
           GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
         run: gh api /rate_limit | jq
 
-      - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
+      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
         name: Labels from touched files
         if: |
           github.event_name == 'pull_request_target' &&
@@ -101,7 +101,7 @@ jobs:
           configuration-path: .github/labeler.yml # default
           sync-labels: true
 
-      - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
+      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
         name: Labels from touched files (no sync)
         if: |
           github.event_name == 'pull_request_target' &&
@@ -111,7 +111,7 @@ jobs:
           configuration-path: .github/labeler-no-sync.yml
           sync-labels: false
 
-      - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
+      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
         name: Labels from touched files (development branches)
         # Development branches like staging-next, haskell-updates and python-updates get special labels.
         # This is to avoid the mass of labels there, which is mostly useless - and really annoying for

maintainers/maintainer-list.nix

@@ -4530,6 +4530,12 @@
     githubId = 1945;
     name = "Casey Rodarmor";
   };
+  caseyavila = {
+    email = "casey@theavilas.org";
+    github = "caseyavila";
+    githubId = 53847249;
+    name = "Casey Avila";
+  };
   catap = {
     email = "kirill@korins.ky";
     github = "catap";
@@ -19899,6 +19905,12 @@
     name = "Alessio Caiazza";
     matrix = "@alessio:caiazza.info";
   };
+  nomadium = {
+    email = "miguel@miguel.cc";
+    github = "nomadium";
+    githubId = 79817;
+    name = "Miguel Landaeta";
+  };
   nomaterials = {
     email = "nomaterials@gmail.com";
     github = "no-materials";

nixos/modules/misc/nixpkgs.nix

@@ -2,12 +2,51 @@
   config,
   options,
   lib,
+  pkgs,
   ...
 }:
 let
   cfg = config.nixpkgs;
   opt = options.nixpkgs;
 
+  isConfig = x: builtins.isAttrs x || lib.isFunction x;
+
+  optCall = f: x: if lib.isFunction f then f x else f;
+
+  mergeConfig =
+    lhs_: rhs_:
+    let
+      lhs = optCall lhs_ { inherit lib pkgs; };
+      rhs = optCall rhs_ { inherit lib pkgs; };
+    in
+    lib.recursiveUpdate lhs rhs
+    // lib.optionalAttrs (lhs ? allowUnfreePackages) {
+      allowUnfreePackages = lhs.allowUnfreePackages ++ (lib.attrByPath [ "allowUnfreePackages" ] [ ] rhs);
+    }
+    // lib.optionalAttrs (lhs ? packageOverrides) {
+      packageOverrides =
+        pkgs:
+        optCall lhs.packageOverrides pkgs // optCall (lib.attrByPath [ "packageOverrides" ] { } rhs) pkgs;
+    }
+    // lib.optionalAttrs (lhs ? perlPackageOverrides) {
+      perlPackageOverrides =
+        pkgs:
+        optCall lhs.perlPackageOverrides pkgs
+        // optCall (lib.attrByPath [ "perlPackageOverrides" ] { } rhs) pkgs;
+    };
+
+  configType = lib.mkOptionType {
+    name = "nixpkgs-config";
+    description = "nixpkgs config";
+    check =
+      x:
+      let
+        traceXIfNot = c: if c x then true else lib.traceSeqN 1 x false;
+      in
+      traceXIfNot isConfig;
+    merge = args: lib.foldr (def: mergeConfig def.value) { };
+  };
+
   overlayType = lib.mkOptionType {
     name = "nixpkgs-overlay";
     description = "nixpkgs overlay";
@@ -34,8 +73,6 @@ let
     ++ lib.optional (opt.localSystem.highestPrio < (lib.mkOptionDefault { }).priority) opt.localSystem
     ++ lib.optional (opt.crossSystem.highestPrio < (lib.mkOptionDefault { }).priority) opt.crossSystem;
 
-  _configDefinitions = opt.config.definitionsWithLocations;
-
   defaultPkgs =
     if opt.hostPlatform.isDefined then
       let
@@ -53,15 +90,14 @@ let
       in
       import ../../.. (
         {
-          inherit _configDefinitions;
-          inherit (cfg) overlays;
+          inherit (cfg) config overlays;
         }
         // systemArgs
       )
     else
       import ../../.. {
-        inherit _configDefinitions;
         inherit (cfg)
+          config
           overlays
           localSystem
           crossSystem
@@ -129,15 +165,7 @@ in
       example = lib.literalExpression ''
         { allowBroken = true; allowUnfree = true; }
       '';
-      type = lib.types.deferredModuleWith {
-        staticModules = [
-          { _module.args.docPrefix = "https://nixos.org/manual/nixpkgs/unstable/"; }
-          ../../../pkgs/top-level/config.nix
-        ];
-      };
-      # Returns pkgs.config instead of nixpkgs.config
-      # This shadows the deferredModule to make it look like a submodule
-      apply = _: finalPkgs.config;
+      type = configType;
       description = ''
         Global configuration for Nixpkgs.
         The complete list of [Nixpkgs configuration options](https://nixos.org/manual/nixpkgs/unstable/#sec-config-options-reference) is in the [Nixpkgs manual section on global configuration](https://nixos.org/manual/nixpkgs/unstable/#chap-packageconfig).
@@ -378,7 +406,7 @@ in
           '';
         }
         {
-          assertion = opt.pkgs.isDefined -> opt.config.highestPrio == (lib.mkOptionDefault null).priority;
+          assertion = opt.pkgs.isDefined -> cfg.config == { };
           message = ''
             Your system configures nixpkgs with an externally created instance.
             `nixpkgs.config` options should be passed when creating the instance instead.

nixos/modules/programs/nix-required-mounts.nix

@@ -70,7 +70,10 @@ let
 
     zluda = {
       onFeatures = [
+        "amd-gpu"
         "cuda"
+        "gpu"
+        "opengl"
       ];
       paths = [
         pkgs.addDriverRunpath.driverLink

nixos/tests/invidious.nix

@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ ... }:
 {
   name = "invidious";
 
@@ -24,7 +24,7 @@
         networking.firewall.allowedTCPPorts = [ config.services.postgresql.settings.port ];
       };
     machine =
-      { lib, pkgs, ... }:
+      { pkgs, ... }:
       {
         services.invidious = {
           enable = true;
@@ -142,7 +142,7 @@
       # invidious does connect to the sig helper though and crashes when the sig helper is not available
       machine.wait_for_open_port(80)
       curl_assert_status_code("http://invidious.example.com/search", 200)
-      machine.succeed("journalctl -eu invidious.service | grep -o \"SigHelper: Using helper at 'tcp://127.0.0.1:2999'\"")
+      machine.succeed("journalctl -eu invidious.service | grep -o \"WARNING: Invidious companion is required to view and playback videos\"")
 
       postgres_tcp.wait_for_unit("postgresql.target")
       activate_specialisation("postgres-tcp")

pkgs/applications/emulators/libretro/cores/beetle-psx.nix

@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-psx" + lib.optionalString withHw "-hw";
-  version = "0-unstable-2026-05-01";
+  version = "0-unstable-2026-05-09";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-psx-libretro";
-    rev = "ab72423afd429c1e96ca56fbd39094a71270842b";
-    hash = "sha256-j1ZCbB0hKcxay/0BkkuoncYPAkMTgSGEAOzYNgJaAh4=";
+    rev = "c699953afa01bc3f179edbcb14c4cfbeee6107a2";
+    hash = "sha256-s009GuPnsufDT70dBmhwfZmYjdf7pYO13FjycYvUF4c=";
   };
 
   extraBuildInputs = lib.optionals withHw [

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -914,13 +914,13 @@
     "vendorHash": "sha256-JRqBv5N+i5yhKrC+Eenm1xmwylNF7k/EIJXaklrsFfA="
   },
   "mongey_kafka-connect": {
-    "hash": "sha256-XMGpK22Ww8swvfrnbClxjErVmkBKX3dxdlkjgNJHlCE=",
+    "hash": "sha256-A20rLdvunuTU3zZOJ1bj/yIaWs+xsdvSmpDPuxN7XQc=",
     "homepage": "https://registry.terraform.io/providers/Mongey/kafka-connect",
     "owner": "Mongey",
     "repo": "terraform-provider-kafka-connect",
-    "rev": "v0.4.3",
+    "rev": "v0.5.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-5cqj1O57snU+NoVqmWc/KIGnowQNMww+rJxYfIPvHWU="
+    "vendorHash": "sha256-ulhKT0DaS6gg9Ucz9pqqIg4mxRpGDGz2rN1R0RNuumg="
   },
   "mongodb_mongodbatlas": {
     "hash": "sha256-8HZOdEHD5KwVuSDe3EDX54nPqn3Uz6kooi/HEGoI3F0=",
@@ -1049,11 +1049,11 @@
     "vendorHash": null
   },
   "oracle_oci": {
-    "hash": "sha256-xB/wHvFmv14Lz1IR4+n7+l+RbRJCtDqZisLURK9IB4E=",
+    "hash": "sha256-Yt46N9wVwgz8VbPSHQF1UQ4XT1ENIcE+yeKmO0JqnlM=",
     "homepage": "https://registry.terraform.io/providers/oracle/oci",
     "owner": "oracle",
     "repo": "terraform-provider-oci",
-    "rev": "v8.12.0",
+    "rev": "v8.13.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },

pkgs/applications/video/obs-studio/plugins/obs-plugin-countdown.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "obs-plugin-countdown";
-  version = "2.1.1";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "ashmanix";
     repo = "obs-plugin-countdown";
     tag = finalAttrs.version;
-    hash = "sha256-rDs+X2eH8aUUH6phEo/pelUY1mHnnJNc6mqcT/lT+6c=";
+    hash = "sha256-0E2pNRg4vwXK54aYuWYZyuRJaNrpwX7X0Dq6V8B/SgA=";
   };
 
   buildInputs = [

pkgs/by-name/am/amnezia-vpn-bin/package.nix

@@ -110,7 +110,7 @@ stdenv.mkDerivation (finalAttrs: {
       --set CQT_PKG_ROOT "$out/share/amnezia-vpn/service"
 
     substituteInPlace $out/share/amnezia-vpn/AmneziaVPN.service \
-      --replace-fail "ExecStart=/opt/AmneziaVPN/service/AmneziaVPN-service.sh" "AmneziaVPN-service" \
+      --replace-fail "/opt/AmneziaVPN/service/AmneziaVPN-service.sh" "AmneziaVPN-service" \
       --replace-fail "Environment=LD_LIBRARY_PATH=/opt/AmneziaVPN/client/lib" ""
     ln -s $out/share/amnezia-vpn/AmneziaVPN.service $out/lib/systemd/system/AmneziaVPN.service
 

pkgs/by-name/am/amnezia-vpn/dev_agw_public_key

@@ -0,0 +1,14 @@
+-----BEGIN PUBLIC KEY-----
+MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAwMJbYlGxn3l+0XiGA9I/
+BHK8HX/aet7A9GVL817apDUeL6sdISRBdopv5Y0FdrBHSJWSUdWtVxVazJB46J8x
+327/5H5pi0nkfRbcgxBGSGxhKOvwRe+WPVb2f81jlkenZK46c9C7dNmX/310rlHY
+BwOnZcdw2oKu6hTNDwk3nyUo2v2/leNIMLsv84RlHAX6Tyx5slq8ysewhcmdfv17
+WQjF7albq12ZafTSjtXqDcsrk2oF8mfyzxLjSXbxQHKIDHkfz3SUXCs/H9tt1ydK
+2Yj6nIxv98HESZ8Ng40OZPhHDex8Ru1NjcWlo2EWNM1xT8IqmBT21PLuyzGjNSwG
+Ojnm1V2EcjerVmRNhFTJG70RkURD/i2MDbG+ZKpqPtW1uL8wEt2IkSqNfKcf+TF+
+UJZZfm1lDUMpWJ2eWJGrgOUX8/f8v/GB+x4PxUo1m7V/pDLqCUPm3l2dkaM9P0sM
+6lO0+jKqfIFnG1zjc3if7r1YbDsZlyl389q9Hrh7t+Lwj/JXkDxFaTnudM8egaXk
+GX5YxZiEDmCCLRskRwBBUaYffXIpFbI8sO2Xj0J5/im5xtu7TtfJktcPzDL9uyG1
+Ebt8oSA4FTzTid6Zwj55YgDfz0FMnNmXh80T1xMzlbi6y+BCuna+I+7McMRo8yz3
+VzzYJ0/J7PpHpXoZv7K1qDsCAwEAAQ==
+-----END PUBLIC KEY-----

pkgs/by-name/am/amnezia-vpn/package.nix

@@ -58,13 +58,26 @@ let
 
   amnezia-xray = callPackage ./xray-lib.nix { };
 
-  amneziaPremiumConfig = fetchurl {
-    url = "https://raw.githubusercontent.com/amnezia-vpn/amnezia-client-lite/f45d6b242c1ac635208a72914e8df76ccb3aa44c/macos-signed-build.sh";
-    hash = "sha256-PnaPVPlyglUphhknWwP7ziuwRz+WOz0k9WRw6Q0nG2c=";
-    postFetch = ''
-      sed -nri '/PROD_AGW_PUBLIC_KEY|PROD_S3_ENDPOINT/p' $out
-    '';
-  };
+  # Amnezia Gateway (AGW) public keys for premium server list verification.
+  # These PEM-formatted RSA public keys are hardcoded in the upstream binary
+  # and used to verify signatures on server list responses from the AGW service.
+  # The original values were extracted from the upstream linux binary using
+  # `strings` command, as they are not present in any public source files.
+  # Newlines are escaped (\n -> \\n) to prevent Makefile generation failures
+  # during build when these variables are exported via preConfigure.
+  dev-agw-public-key = lib.replaceStrings [ "\n" ] [ "\\n" ] (builtins.readFile ./dev_agw_public_key);
+  dev-agw-endpoint = "http://gw.dev.amzsvc.com:80/";
+  dev-s3-endpoint = "https://s3.eu-north-1.amazonaws.com/amnezia-dev/";
+
+  prod-agw-public-key = lib.replaceStrings [ "\n" ] [ "\\n" ] (
+    builtins.readFile ./prod_agw_public_key
+  );
+  prod-s3-endpoint = lib.concatStringsSep ", " [
+    "https://s3.eu-north-1.amazonaws.com/amnezia/"
+    "https://amnzstrg01.blob.core.windows.net/lambda-list/"
+    "https://storage.googleapis.com/lambda-list/"
+    "https://objectstorage.eu-zurich-1.oraclecloud.com/n/zrhfyaq6qxvh/b/lambda-list/o/"
+  ];
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "amnezia-vpn";
@@ -134,8 +147,15 @@ stdenv.mkDerivation (finalAttrs: {
     qt6.qttools
   ];
 
+  # These environment variables are baked into the binary at build time.
+  # They configure which Amnezia Gateway servers and S3 endpoints the client
+  # uses for fetching verified server lists (premium functionality).
   preConfigure = ''
-    source ${amneziaPremiumConfig}
+    export DEV_AGW_PUBLIC_KEY="${dev-agw-public-key}"
+    export DEV_AGW_ENDPOINT="${dev-agw-endpoint}"
+    export DEV_S3_ENDPOINT="${dev-s3-endpoint}"
+    export PROD_AGW_PUBLIC_KEY="${prod-agw-public-key}"
+    export PROD_S3_ENDPOINT="${prod-s3-endpoint}"
   '';
 
   installPhase = ''

pkgs/by-name/am/amnezia-vpn/prod_agw_public_key

@@ -0,0 +1,14 @@
+-----BEGIN PUBLIC KEY-----
+MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAj5mxl/4DL3Sk89ntxs5G
+X3JawGQWIoq6rvNkOzNGuNgedNS2+pi6hZl3Izl1Io9om4KiUlMT6mgLO1hTr9q+
+s7CYhlvroFA7ErucF+9L+7FCt0Igi0kIK/R2/vxd/2HaUrorn/aSvvutkYwbfxqW
+SwtzE+RuBeDWGvEt937OW0oqYONPYv9E4T56Dz/EZ6v2t8ejAnKLbGD/GocMmipK
+7etFSiSMAB2RmaztqTq4NleBepfO80XpYlW9pCSXuHcE8wxHczkzxsbyMAMsG/K3
+vUQY6qPtohqqzSSBwa/8u2ptNHBeor7l7DdYXeR/Nqcc4z92VUkZ5lOVR4evkS5V
+/wQqp5tnOJEj3NjUhEhXFoNEapbZd1bh6iQoUk7jC1TdvKJ/nPKGZAsHRpr0rNKz
+fx/N/Oo6lr2yh/+ps6VxTkbPmB6E85WOO3UvjImZUY0XQdBjWle/4iJLdEC77Nr0
+jXhdgeypucy6jkB6iBHMeVMlrNMEV7UxoBR/cCNx55zu/8sml5ByiDvCDT7sRomN
+NgVt5S/FaVjYuzFUifJ12ToChXFgESKFmuso7WluEaWvMIGREdrMrKQKHfYLOzWF
+2B5ZJDqw4o03fU4J/6rw61M1b+rjVpXMjPnzc2A+RgcjTvXv955gfZkwe4lt5wk/
+3j8zMVo3+zLrMTAaEeIUM0UCAwEAAQ==
+-----END PUBLIC KEY-----

pkgs/by-name/as/astyle/package.nix

@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "astyle";
-  version = "3.6.14";
+  version = "3.6.15";
 
   src = fetchurl {
     url = "mirror://sourceforge/astyle/astyle-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-HEb9wiy+mcYDWTmTt1C6pMouC0yeSx2Q4vtg10nWCNA=";
+    hash = "sha256-W0B31otZQWCJFs2KJjBGo1Yfl1k3A8BIMccwsjCoGuk=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/ba/balatro-mod-manager/package.nix

@@ -92,6 +92,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
   '';
 
   meta = {
+    # Rollup for ARM64 is broken with Node modules
+    broken = stdenv.hostPlatform.isAarch64;
     description = "A mod manager for the game Balatro";
     homepage = "https://balatro-mod-manager.dasguney.com/";
     license = lib.licenses.gpl3Plus;

pkgs/by-name/cl/cloudcompare/package.nix

@@ -157,6 +157,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://cloudcompare.org";
     license = lib.licenses.gpl2Plus;
     maintainers = with lib.maintainers; [ nh2 ];
+    teams = [ lib.teams.geospatial ];
     mainProgram = "CloudCompare";
     platforms = with lib.platforms; linux; # only tested here; might work on others
   };

pkgs/by-name/cu/cue/package.nix

@@ -7,6 +7,7 @@
   testers,
   tests,
   callPackage,
+  pkgs,
 }:
 
 buildGoModule (finalAttrs: {
@@ -49,7 +50,7 @@ buildGoModule (finalAttrs: {
 
       tests = {
         validation = tests.cue-validation.override {
-          callPackage = (path: attrs: callPackage path (attrs // { inherit writeCueValidator; }));
+          pkgs = pkgs.extend (_: _: { inherit writeCueValidator; });
         };
 
         test-001-all-good = callPackage ./tests/001-all-good.nix { inherit cue; };

pkgs/by-name/em/emmylua-check/package.nix

@@ -9,7 +9,7 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "emmylua_check";
-  inherit (emmylua-ls) version src;
+  inherit (emmylua-ls) version src cargoHash;
 
   nativeBuildInputs = [
     pkg-config
@@ -24,8 +24,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   buildAndTestSubdir = "crates/emmylua_check";
 
-  cargoHash = "sha256-JNirHIKXFsiLme5oByerHjB/3lumuAr2u3pNfxh4qa0=";
-
   nativeInstallCheckInputs = [
     versionCheckHook
   ];

pkgs/by-name/em/emmylua-doc-cli/package.nix

@@ -6,12 +6,10 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "emmylua_doc_cli";
-  inherit (emmylua-ls) version src;
+  inherit (emmylua-ls) version src cargoHash;
 
   buildAndTestSubdir = "crates/emmylua_doc_cli";
 
-  cargoHash = "sha256-JNirHIKXFsiLme5oByerHjB/3lumuAr2u3pNfxh4qa0=";
-
   nativeInstallCheckInputs = [
     versionCheckHook
   ];

pkgs/by-name/em/emmylua-ls/package.nix

@@ -9,13 +9,13 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "emmylua_ls";
-  version = "0.22.0";
+  version = "0.23.0";
 
   src = fetchFromGitHub {
     owner = "EmmyLuaLs";
     repo = "emmylua-analyzer-rust";
     tag = finalAttrs.version;
-    hash = "sha256-Zj5nLeTH/4sVElYP+erg6bSTX8jFqF7sqiXfaMam8pE=";
+    hash = "sha256-2HC2BeT4x4QGjj2tKB0yM9Bh7zsQ/S0xX/KaJvlgq2o=";
   };
 
   nativeBuildInputs = [
@@ -31,7 +31,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   buildAndTestSubdir = "crates/emmylua_ls";
 
-  cargoHash = "sha256-JNirHIKXFsiLme5oByerHjB/3lumuAr2u3pNfxh4qa0=";
+  cargoHash = "sha256-AruojLPjozzajHksLDfi39Qq6gvnHem2glgS454yxVQ=";
 
   nativeInstallCheckInputs = [
     versionCheckHook

pkgs/by-name/fm/fmit/package.nix

@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  libsForQt5,
+  qt6,
   fftw,
   itstool,
   alsaSupport ? true,
@@ -19,31 +19,34 @@ assert portaudioSupport -> portaudio != null;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fmit";
-  version = "1.2.14";
+  version = "1.3.3";
 
   src = fetchFromGitHub {
     owner = "gillesdegottex";
     repo = "fmit";
     rev = "v${finalAttrs.version}";
-    sha256 = "1q062pfwz2vr9hbfn29fv54ip3jqfd9r99nhpr8w7mn1csy38azx";
+    sha256 = "sha256-fi5/JCgum+TYexUuTRZNFWPPsR87P73gfYhozQYx3Rw=";
   };
 
   nativeBuildInputs = [
-    libsForQt5.qmake
+    qt6.qmake
     itstool
-    libsForQt5.wrapQtAppsHook
+    qt6.wrapQtAppsHook
   ];
   buildInputs = [
     fftw
-    libsForQt5.qtbase
-    libsForQt5.qtmultimedia
+    qt6.qtbase
+    qt6.qtmultimedia
+    qt6.qtsvg
   ]
   ++ lib.optionals alsaSupport [ alsa-lib ]
   ++ lib.optionals jackSupport [ libjack2 ]
   ++ lib.optionals portaudioSupport [ portaudio ];
 
   postPatch = ''
-    substituteInPlace fmit.pro --replace '$$FMITVERSIONGITPRO' '${finalAttrs.version}'
+    substituteInPlace fmit.pro \
+      --replace-fail 'FMITVERSIONPRO = $$system(git describe --tags --always)' 'FMITVERSIONPRO = ${finalAttrs.version}' \
+      --replace-fail 'FMITBRANCHGITPRO = $$system(git rev-parse --abbrev-ref HEAD)' 'FMITBRANCHGITPRO = master'
   '';
 
   qmakeFlags = [

pkgs/by-name/ha/hacompanion/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "hacompanion";
-  version = "1.0.27";
+  version = "1.0.30";
 
   src = fetchFromGitHub {
     owner = "tobias-kuendig";
     repo = "hacompanion";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-tm9qx2SPkyzxP7fHXAzlk/iMn/67zMJlmeTq9veRg98=";
+    hash = "sha256-TC1ZnYT5WGbKP2Y2pOKaLj8Hmr3lU+LShkNV2DpcyDk=";
   };
 
   vendorHash = "sha256-SohjueM0DwSuh7XVClYiWA/5d0V6x2vmp5aPxgmIJYY=";

pkgs/by-name/ho/hoppscotch/package.nix

@@ -8,22 +8,22 @@
 
 let
   pname = "hoppscotch";
-  version = "26.3.1-0";
+  version = "26.4.0-0";
 
   src =
     fetchurl
       {
         aarch64-darwin = {
           url = "https://github.com/hoppscotch/releases/releases/download/v${version}/Hoppscotch_mac_aarch64.dmg";
-          hash = "sha256-9Ahc/Gi4MRgloWND82lZQhWG2oR85Fytsz2BYi+fVpc=";
+          hash = "sha256-qpwtXAVrBAdDnK9FLkvPdbVtPIZpAaZ0srT+Hw7ckNA=";
         };
         x86_64-darwin = {
           url = "https://github.com/hoppscotch/releases/releases/download/v${version}/Hoppscotch_mac_x64.dmg";
-          hash = "sha256-YXvLzdm493xAvCRuRg0WwBTJ4VXKO50wzr2TfWN3J84=";
+          hash = "sha256-LtEHmdSxIiWNHIAkVycsNMhmjS7VWkMiwLcY544fQ1Y=";
         };
         x86_64-linux = {
           url = "https://github.com/hoppscotch/releases/releases/download/v${version}/Hoppscotch_linux_x64.AppImage";
-          hash = "sha256-6dFCCYkof0N4AqWZko741LN6NW2K4F5gpwzzK4U5QCM=";
+          hash = "sha256-bgo+R01NJ3ElfHHvRZ42K8AcioJyjhs52yHkq30nsyg=";
         };
       }
       .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");

pkgs/by-name/hy/hyprviz/package.nix

@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "hyprviz";
-  version = "0.8.4";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "timasoft";
     repo = "hyprviz";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-UvFtZzQuUgqxY/pMfFaMEM/5VRJuMjSBOXiViwLB0TE=";
+    hash = "sha256-d1JNCCzCpJw646VrwSdrj175F4w4AsAfvGv4CnCEEv4=";
   };
 
-  cargoHash = "sha256-QuwxJw77ccUnvHcPNrPD5EwgZ3MJV4VvGb7MtUnYu88=";
+  cargoHash = "sha256-Wjk1nqSoqeHvdTRzoRl3NTJIB5Chp14Cm/6weniVwiI=";
 
   nativeBuildInputs = [
     pkg-config
@@ -35,7 +35,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
   ];
 
   postInstall = ''
-    install -Dm644 hyprviz.desktop -t $out/share/applications
+    install -Dm644 assets/hyprviz.desktop -t $out/share/applications
+    install -Dm644 assets/hyprviz.svg -t $out/share/icons/hicolor/scalable/apps
+    install -Dm644 assets/hyprviz.png -t $out/share/icons/hicolor/256x256/apps
   '';
 
   meta = {

pkgs/by-name/jw/jwt-hack/package.nix

@@ -2,17 +2,19 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
+  pkg-config,
+  openssl,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "jwt-hack";
-  version = "2.0.0";
+  version = "2.5.0";
 
   src = fetchFromGitHub {
     owner = "hahwul";
     repo = "jwt-hack";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-uJur/ABoAaQT3BBO2yprK/0/bQPT138Yg9IbztZ6w2w=";
+    hash = "sha256-kutt5VhMY/YIXBpVZTg/xAwa9d+J5ypfLi5aLakjfaY=";
   };
 
   cargoLock = {
@@ -23,6 +25,16 @@ rustPlatform.buildRustPackage (finalAttrs: {
     ln -s ${./Cargo.lock} Cargo.lock
   '';
 
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+  ];
+
+  OPENSSL_NO_VENDOR = 1;
+
   meta = {
     description = "JSON Web Token Hack Toolkit";
     homepage = "https://github.com/hahwul/jwt-hack";

pkgs/by-name/ki/kimai/package.nix

@@ -7,13 +7,13 @@
 
 php.buildComposerProject2 (finalAttrs: {
   pname = "kimai";
-  version = "2.55.0";
+  version = "2.56.0";
 
   src = fetchFromGitHub {
     owner = "kimai";
     repo = "kimai";
     tag = finalAttrs.version;
-    hash = "sha256-p4Y5hCWr5BVOGYUJtFJhhDftm+A/CWxbdBhPgOR1TcY=";
+    hash = "sha256-rax67E/Zr50ejSAjA4Aa1NDsAbJYuAAE4k8hji5UhOg=";
   };
 
   php = php.buildEnv {
@@ -38,7 +38,7 @@ php.buildComposerProject2 (finalAttrs: {
     '';
   };
 
-  vendorHash = "sha256-Vlaqe3FTItRZDiYWzOVDL+q7HZ8TgpiLPFTDzUyL4LY=";
+  vendorHash = "sha256-XHicbYXOfCPFIMKrhyBpchd89anj6kG1/7prpER7aCo=";
 
   composerNoPlugins = false;
   postInstall = ''

pkgs/by-name/li/lintspec/package.nix

@@ -8,17 +8,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "lintspec";
-  version = "0.16.0";
+  version = "0.17.0";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "beeb";
     repo = "lintspec";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hMBDOpmz8EMSWPKU16EleSxVZbLSbZPynqhrJifgt04=";
+    hash = "sha256-iIanf/lQRD+JZEa9jAa4JNATJq2EYoKoiA4dOmXxgtY=";
   };
 
-  cargoHash = "sha256-WaMuHTvadj1GoFyT0p4II6EFp7nmN5LJN3SOO2kYujM=";
+  cargoHash = "sha256-+Hi9vciLSeIijTH3tCKMv2USTYrWzfuTUaxSOW0hi4g=";
   cargoBuildFlags = [
     "--package"
     "lintspec"

pkgs/by-name/mo/moor/package.nix

@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "moor";
-  version = "2.12.3";
+  version = "2.13.0";
 
   src = fetchFromGitHub {
     owner = "walles";
     repo = "moor";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-nqwdWDJ4lpWJL79Bjk17U81xqz4l0Q75jG2tJfYmV/w=";
+    hash = "sha256-aEwazj3RXOrPPOxZDfvyHqetO5tvhnzQ19rE+NQf8wQ=";
   };
 
   vendorHash = "sha256-fHOatNwedbDNGp7V8ynW1NiTkqSJmo8vrv6S64gUQqM=";

pkgs/by-name/mr/mruby/package.nix

@@ -10,23 +10,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mruby";
-  version = "3.3.0";
+  version = "4.0.0";
 
   src = fetchFromGitHub {
     owner = "mruby";
     repo = "mruby";
     rev = finalAttrs.version;
-    sha256 = "sha256-rCoEC1ioX6bOocPoPi+Lsn4PM8gY0DjKja1/MJvJ1n8=";
+    sha256 = "sha256-7CDTRQncpjY0HO0S1lM57aUvV6ZseEp+/nxXp4ZuuQs=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "CVE-2025-7207.patch";
-      url = "https://github.com/mruby/mruby/commit/1fdd96104180cc0fb5d3cb086b05ab6458911bb9.patch";
-      hash = "sha256-wtSlLydofkp2brk/pRiJqt4NhkGRdzsx7JpTmWu2B7I=";
-    })
-  ];
-
   nativeBuildInputs = [ rake ];
 
   nativeCheckInputs = [ ruby ];
@@ -53,9 +45,13 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Embeddable implementation of the Ruby language";
     homepage = "https://mruby.org";
-    maintainers = with lib.maintainers; [ nicknovitski ];
+    maintainers = with lib.maintainers; [
+      nicknovitski
+      nomadium
+    ];
     license = lib.licenses.mit;
     platforms = lib.platforms.all;
     mainProgram = "mruby";
+    broken = stdenv.hostPlatform.isDarwin;
   };
 })

pkgs/by-name/my/myanon/package.nix

@@ -5,23 +5,25 @@
   autoreconfHook,
   flex,
   bison,
+  pkg-config,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "myanon";
-  version = "0.8.1";
+  version = "0.8.3";
 
   src = fetchFromGitHub {
     owner = "ppomes";
     repo = "myanon";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HOWwFdNFfebjWcmADyGVFMQ00sLp+ykk9ZCYI9grYWY=";
+    hash = "sha256-5JwD1vPAKZlgnl6vfmqgl/jJBHWi8OGsVFJM4ofe6DM=";
   };
 
   nativeBuildInputs = [
     autoreconfHook
     flex
     bison
+    pkg-config
   ];
 
   meta = {

pkgs/by-name/na/naabu/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "naabu";
-  version = "2.5.0";
+  version = "2.6.1";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "naabu";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8UnZqSjN57rqSpAf3H77TruT7hXMkgUroBhC+VlkXYY=";
+    hash = "sha256-rjGTicUzdFRpJ3VGl/eXLKGdrbuwM3jQbOd0pmknabg=";
   };
 
-  vendorHash = "sha256-HOCbtmb6gVsbErxeM2mXbqqALbz3EqK02ARxgyfZinc=";
+  vendorHash = "sha256-Qay0jAWRnK5oRfOmYLrfWFR5eOT5glcsQ9BgSr2LiS8=";
 
   buildInputs = [ libpcap ];
 

pkgs/by-name/se/sendspin-go/package.nix

@@ -12,18 +12,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "sendspin-go";
-  version = "1.6.2";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "Sendspin";
     repo = "sendspin-go";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ME4LZp5NNLSAtdkIUZJWWWQTUr5Lt3y+HscJAR/AS7c=";
+    hash = "sha256-I4LhgW4uyA9m+tWQKhcAsh+55jtO77TP9AFBpGjGtJs=";
   };
 
   __structuredAttrs = true;
 
-  vendorHash = "sha256-g2u3kkP6FUtHoCnY4PxqTp/d1wYQuz0uFZkeuobtl7U=";
+  vendorHash = "sha256-QAmC6bgOSlV8we9j3rDQ9V3sLdSvELu8zzn5UAw/uIY=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/to/tofu-ls/package.nix

@@ -8,13 +8,15 @@
 
 buildGoModule (finalAttrs: {
   pname = "tofu-ls";
-  version = "0.4.1";
+  version = "0.4.2";
+
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "opentofu";
     repo = "tofu-ls";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-C38Iqk+1TplSeoZcdhskdtGYUqK1ABtInXQkPDnGCsg=";
+    hash = "sha256-B7y22tmD8PLO4FRI0rskffRQAZu8Kvi8TyzmjCYsWs8=";
   };
 
   vendorHash = "sha256-Uq/4rd3OvCBhp53MEMLiWL/V6hkygwdBLSN8Wzwqoew=";
@@ -48,6 +50,7 @@ buildGoModule (finalAttrs: {
   meta = {
     description = "OpenTofu Language Server";
     homepage = "https://github.com/opentofu/tofu-ls";
+    changelog = "https://github.com/opentofu/tofu-ls/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mpl20;
     maintainers = with lib.maintainers; [ GaetanLepage ];
     mainProgram = "tofu-ls";

pkgs/by-name/vc/vcpkg-tool/package.nix

@@ -172,7 +172,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   postFixup = lib.optionalString doWrap ''
     mv "$out/bin/vcpkg" "$out/bin/.vcpkg-wrapped"
-    printf "%s" "$vcpkgWrapper" | install -Dm555 /dev/stdin "$out/bin/vcpkg"
+    printf "%s" "$vcpkgWrapper" > "$out/bin/vcpkg"
+    chmod 555 "$out/bin/vcpkg"
   '';
 
   passthru.tests = lib.optionalAttrs doWrap {

pkgs/by-name/wa/wahjam/package.nix

@@ -0,0 +1,76 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  makeDesktopItem,
+  copyDesktopItems,
+  pkg-config,
+  libsForQt5,
+  libogg,
+  libvorbis,
+  libresample,
+  portaudio,
+  portmidi,
+}:
+
+stdenv.mkDerivation {
+  pname = "wahjam";
+  version = "1.3.1-unstable-2023-05-30";
+
+  src = fetchFromGitHub {
+    owner = "wahjam";
+    repo = "wahjam";
+    rev = "4fde74da3be1fa53cdc2d3bc4b577b40951d6809";
+    hash = "sha256-WYfLQxToyjAE+R2eaBKpDJGfkvrOTza8a6JbN9AL3aE=";
+  };
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    libsForQt5.qmake
+    libsForQt5.wrapQtAppsHook
+    copyDesktopItems
+  ];
+
+  buildInputs = [
+    libsForQt5.qtbase
+    libsForQt5.qtkeychain
+    libogg
+    libvorbis
+    libresample
+    portaudio
+    portmidi
+  ];
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "wahjam";
+      desktopName = "Wahjam";
+      icon = "net.jammr.jammr";
+      exec = "wahjam";
+      comment = "Play with musicians over the internet";
+      categories = [ "AudioVideo" ];
+    })
+  ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    mkdir -p $out/share/icons/hicolor/scalable/apps
+
+    cp qtclient/wahjam $out/bin/wahjam
+    cp qtclient/net.jammr.jammr.svg $out/share/icons/hicolor/scalable/apps
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Software for musicians to play together over the internet";
+    mainProgram = "wahjam";
+    homepage = "https://github.com/wahjam/wahjam";
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ caseyavila ];
+  };
+}

pkgs/by-name/we/welle-io/package.nix

@@ -64,7 +64,8 @@ stdenv.mkDerivation (finalAttrs: {
     "-DRTLSDR=true"
     "-DSOAPYSDR=true"
   ]
-  ++ lib.optional withFlac "-DFLAC=true";
+  ++ lib.optional withFlac "-DFLAC=true"
+  ++ lib.optional stdenv.hostPlatform.isDarwin "-DBUNDLE_INSTALL_DIR=${placeholder "out"}/Applications";
 
   meta = {
     description = "DAB/DAB+ Software Radio";

pkgs/by-name/wi/windsurf/info.json

@@ -1,20 +1,20 @@
 {
   "aarch64-darwin": {
-    "version": "2.1.32",
+    "version": "2.2.17",
     "vscodeVersion": "1.110.1",
-    "url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/63e54ba26dd2a1b975c172966dff80bad8ae74c7/Windsurf-darwin-arm64-2.1.32.zip",
-    "sha256": "0d7ee912cc619678b5d68115f3dfa11a2581d134032410a887babbb595b613fd"
+    "url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/a65d6c4e1fd335336d7a0b601099811667e184ca/Windsurf-darwin-arm64-2.2.17.zip",
+    "sha256": "af7b195ab35e88a34be38edebabd8adedc6fa53cb67955571d86f338ba47f6bc"
   },
   "x86_64-darwin": {
-    "version": "2.1.32",
+    "version": "2.2.17",
     "vscodeVersion": "1.110.1",
-    "url": "https://windsurf-stable.codeiumdata.com/darwin-x64/stable/63e54ba26dd2a1b975c172966dff80bad8ae74c7/Windsurf-darwin-x64-2.1.32.zip",
-    "sha256": "b33d23e38ed15aa11570086c95d1fadddb47635b81571fa82612000c3d5f8d22"
+    "url": "https://windsurf-stable.codeiumdata.com/darwin-x64/stable/a65d6c4e1fd335336d7a0b601099811667e184ca/Windsurf-darwin-x64-2.2.17.zip",
+    "sha256": "6799fa251e55c0860b61867835b0258cb0bf8f7e47f5804893734571380f7740"
   },
   "x86_64-linux": {
-    "version": "2.1.32",
+    "version": "2.2.17",
     "vscodeVersion": "1.110.1",
-    "url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/63e54ba26dd2a1b975c172966dff80bad8ae74c7/Windsurf-linux-x64-2.1.32.tar.gz",
-    "sha256": "b2b8d1644f8684feaa21326d93829f79319381c439fd88663ee570966954d626"
+    "url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/a65d6c4e1fd335336d7a0b601099811667e184ca/Windsurf-linux-x64-2.2.17.tar.gz",
+    "sha256": "9593de6b22e85190788185b033d1f4f1ad013c36e1cc737c3696f430fbbeeb54"
   }
 }

pkgs/by-name/xl/xla/grpc-pin-go-sdk.patch

@@ -0,0 +1,105 @@
+--- a/bazel/grpc_extra_deps.bzl
++++ b/bazel/grpc_extra_deps.bzl
+@@ -1,91 +1,100 @@
+ # Copyright 2021 The gRPC Authors
+ #
+ # Licensed under the Apache License, Version 2.0 (the "License");
+ # you may not use this file except in compliance with the License.
+ # You may obtain a copy of the License at
+ #
+ #     http://www.apache.org/licenses/LICENSE-2.0
+ #
+ # Unless required by applicable law or agreed to in writing, software
+ # distributed under the License is distributed on an "AS IS" BASIS,
+ # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ # See the License for the specific language governing permissions and
+ # limitations under the License.
+ """Loads the dependencies necessary for the external repositories defined in grpc_deps.bzl."""
+ 
+ load("@bazel_features//:deps.bzl", "bazel_features_deps")
+ load("@bazel_gazelle//:deps.bzl", "gazelle_dependencies")
+ load("@build_bazel_apple_support//lib:repositories.bzl", "apple_support_dependencies")
+ load("@build_bazel_rules_apple//apple:repositories.bzl", "apple_rules_dependencies")
+ load("@com_envoyproxy_protoc_gen_validate//:dependencies.bzl", "go_third_party")
+ load("@com_google_googleapis//:repository_rules.bzl", "switched_rules_by_language")
+ load("@com_google_googletest//:googletest_deps.bzl", "googletest_deps")
+ load("@com_google_protobuf//:protobuf_deps.bzl", "protobuf_deps")
+ load("@envoy_api//bazel:repositories.bzl", "api_dependencies")
+ load("@google_cloud_cpp//bazel:google_cloud_cpp_deps.bzl", "google_cloud_cpp_deps")
+-load("@io_bazel_rules_go//go:deps.bzl", "go_register_toolchains", "go_rules_dependencies")
++load("@io_bazel_rules_go//go:deps.bzl", "go_download_sdk", "go_rules_dependencies")
+ load("@rules_java//java:rules_java_deps.bzl", "rules_java_dependencies")
+ load("@rules_proto//proto:repositories.bzl", "rules_proto_dependencies")
+ load("@rules_python//python:repositories.bzl", "py_repositories")
+ load("@rules_shell//shell:repositories.bzl", "rules_shell_dependencies", "rules_shell_toolchains")
+ 
+ def grpc_extra_deps(ignore_version_differences = False):
+     """Loads the extra dependencies.
+ 
+     These are necessary for using the external repositories defined in
+     grpc_deps.bzl. Projects that depend on gRPC as an external repository need
+     to call both grpc_deps and grpc_extra_deps, if they have not already loaded
+     the extra dependencies. For example, they can do the following in their
+     WORKSPACE
+     ```
+     load("@com_github_grpc_grpc//bazel:grpc_deps.bzl", "grpc_deps", "grpc_test_only_deps")
+     grpc_deps()
+ 
+     grpc_test_only_deps()
+ 
+     load("@com_github_grpc_grpc//bazel:grpc_extra_deps.bzl", "grpc_extra_deps")
+ 
+     grpc_extra_deps()
+     ```
+ 
+     Args:
+       ignore_version_differences: Plumbed directly to the invocation of
+         apple_rules_dependencies.
+     """
+     rules_shell_dependencies()
+     rules_shell_toolchains()
+ 
+     rules_java_dependencies()
+ 
+     protobuf_deps()
+ 
+     rules_proto_dependencies()
+     bazel_features_deps()
+ 
+     api_dependencies()
+ 
+     go_rules_dependencies()
+-    go_register_toolchains(version = "1.22.5")
++    go_download_sdk(
++        name = "go_sdk",
++        sdks = {
++            "linux_amd64": [
++                "go1.22.5.linux-amd64.tar.gz",
++                "904b924d435eaea086515bc63235b192ea441bd8c9b198c507e85009e6e4c7f0",
++            ],
++        },
++        version = "1.22.5",
++    )
+     gazelle_dependencies()
+ 
+     # Pull-in the go 3rd party dependencies for protoc_gen_validate, which is
+     # needed for building C++ xDS protos
+     go_third_party()
+ 
+     apple_rules_dependencies(ignore_version_differences = ignore_version_differences)
+ 
+     apple_support_dependencies()
+ 
+     # Initialize Google APIs with only C++ and Python targets
+     switched_rules_by_language(
+         name = "com_google_googleapis_imports",
+         cc = True,
+         grpc = True,
+         python = True,
+     )
+ 
+     google_cloud_cpp_deps()
+ 
+     py_repositories()
+ 
+     googletest_deps()

pkgs/by-name/xl/xla/package.nix

@@ -96,6 +96,19 @@ in
           '] + extra_patches,' \
           '"@xla//third_party/py:rules_python_nix_patchelf.patch",
           ] + extra_patches,'
+    ''
+    # Pin gRPC's rules_go SDK metadata. Without `sdks`, rules_go downloads the
+    # live Go release manifest into @go_sdk/versions.json, making the deps tar
+    # change whenever go.dev publishes a new release.
+    + ''
+      cp ${./grpc-pin-go-sdk.patch} third_party/grpc/grpc-pin-go-sdk.patch
+      substituteInPlace workspace2.bzl \
+        --replace-fail \
+          'patch_file = ["//third_party/grpc:grpc.patch"],' \
+          'patch_file = [
+            "//third_party/grpc:grpc.patch",
+            "//third_party/grpc:grpc-pin-go-sdk.patch",
+          ],'
     '';
 
   # Configure XLA for CPU-only build using the official configure.py script.
@@ -146,7 +159,7 @@ in
   fetchAttrs = {
     sha256 =
       {
-        x86_64-linux = "sha256-QTUqcP5t91Z4s+esxxFz2tGJAJplWXWZuYPqcC7ld+E=";
+        x86_64-linux = "sha256-9L+oVq/yHqUGLhzSpwqxfYSJ1bIVcnaZgFVB3sjokXs=";
       }
       .${stdenv.hostPlatform.system} or (throw "unsupported system: ${stdenv.hostPlatform.system}");
     preInstall =

pkgs/development/libraries/qtstyleplugin-kvantum/default.nix

@@ -23,13 +23,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "qtstyleplugin-kvantum${lib.optionalString isQt5 "5"}";
-  version = "1.1.6";
+  version = "1.1.7";
 
   src = fetchFromGitHub {
     owner = "tsujan";
     repo = "Kvantum";
     rev = "V${finalAttrs.version}";
-    hash = "sha256-5V8r8OylZb1hZI/8Yx7+KEUcyOpKxsL+r1loDj1Kdr0=";
+    hash = "sha256-S/oIkr0C4fj78ih8Tm6pKxlREEMLeF5Va7+3jC6bK3c=";
   };
 
   nativeBuildInputs = [

pkgs/development/lua-modules/overrides.nix

@@ -693,6 +693,11 @@ in
     env = old.env // {
       NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types"; # for gcc15
     };
+
+    meta = (old.meta or { }) // {
+      # https://github.com/wahern/luaossl/pull/221
+      broken = luaAtLeast "5.5";
+    };
   });
 
   luaposix = prev.luaposix.overrideAttrs (old: {

pkgs/development/perl-modules/ImageExifTool/default.nix

@@ -12,13 +12,13 @@
 
 buildPerlPackage rec {
   pname = "Image-ExifTool";
-  version = "13.52";
+  version = "13.58";
 
   src = fetchFromGitHub {
     owner = "exiftool";
     repo = "exiftool";
     tag = version;
-    hash = "sha256-vsIktUk93fA8lqmphl2xk0Hqgh7VJ08LCP98NnD2o/Q=";
+    hash = "sha256-Mzn1m26uBlulwlfkW+CSRBR8CVqy5oL8cv+85NGgwRc=";
   };
 
   postPatch = ''

pkgs/development/python-modules/aiolyric/default.nix

@@ -10,16 +10,16 @@
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "aiolyric";
-  version = "2.0.2";
+  version = "2.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "timmo001";
     repo = "aiolyric";
-    tag = version;
-    hash = "sha256-k0UE9SXHS8lPu3kC+tGtn99rCU2hq+fdCsp6f83+gv4=";
+    tag = finalAttrs.version;
+    hash = "sha256-kLsq1pBRWz49DZgX47k132OipDcfn+kby6/GYDL3pPc=";
   };
 
   build-system = [
@@ -48,8 +48,8 @@ buildPythonPackage rec {
   meta = {
     description = "Python module for the Honeywell Lyric Platform";
     homepage = "https://github.com/timmo001/aiolyric";
-    changelog = "https://github.com/timmo001/aiolyric/releases/tag/${src.tag}";
+    changelog = "https://github.com/timmo001/aiolyric/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})

pkgs/development/python-modules/elkm1-lib/default.nix

@@ -10,14 +10,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "elkm1-lib";
-  version = "2.2.14";
+  version = "2.2.15";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "gwww";
     repo = "elkm1";
     tag = finalAttrs.version;
-    hash = "sha256-lejeRHteVMO7qz8qMPCG5d8V/rj550FL+WuogM/Lcbw=";
+    hash = "sha256-LDzc/njgPGjc9uhNMHG4NOn9P2Sy3lFHgwV9oJJLl2o=";
   };
 
   build-system = [ hatchling ];

pkgs/development/python-modules/iamdata/default.nix

@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iamdata";
-  version = "0.1.202605091";
+  version = "0.1.202605101";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-nvH4NJZcig+ofDwgSLwS2RBh8cQ0Uvj/NaEvuedUOs8=";
+    hash = "sha256-j6shiMU0zlxr8ehgMe6fcpN6CUKznGKeqbBLM1XHcmQ=";
   };
 
   __darwinAllowLocalNetworking = true;

pkgs/development/python-modules/mlx-vlm/default.nix

@@ -76,6 +76,9 @@ buildPythonPackage (finalAttrs: {
     "test_glm4v"
     "test_glm4v_moe"
     "test_kimi_vl"
+
+    # flaky: statistical bias tolerance occasionally exceeded
+    "test_turboquant_prod_is_nearly_unbiased_across_seeds"
   ];
 
   disabledTestPaths = [

pkgs/development/python-modules/nutpie/default.nix

@@ -14,6 +14,7 @@
   arviz,
   obstore,
   pandas,
+  platformdirs,
   pyarrow,
   xarray,
   zarr,
@@ -34,7 +35,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "nutpie";
-  version = "0.16.8";
+  version = "0.16.9";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -42,12 +43,12 @@ buildPythonPackage (finalAttrs: {
     owner = "pymc-devs";
     repo = "nutpie";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-OW638p0mUlzv9SSVwhixozFguh31fvc1FxIYsOJD1SI=";
+    hash = "sha256-2SQrdjQil5fNDzlM+2LgBKaOL5wPP5mB89ofBu4XawI=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-4ENBTEBRpSDC6G0vDHx0BO8Kc4KOwnPBXAggSNBQ4tY=";
+    hash = "sha256-sUq86CxrCgLAeBspWvTIfHYW6MDOtVoTLdBbCu/Ulj8=";
   };
 
   build-system = [
@@ -77,6 +78,7 @@ buildPythonPackage (finalAttrs: {
     numba
     jax
     jaxlib
+    platformdirs
     pymc
     pytest-timeout
     pytestCheckHook
@@ -84,11 +86,7 @@ buildPythonPackage (finalAttrs: {
     writableTmpDirAsHomeHook
   ];
 
-  disabledTests = [
-    # ValueError: Variable name 'a/b' cannot contain '/'.
-    "test_non_identifier_names"
-  ]
-  ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
+  disabledTests = lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
     # flaky (assert np.float64(0.0017554642626285276) > 0.01)
     "test_normalizing_flow"
   ];

pkgs/development/python-modules/onnxslim/default.nix

@@ -15,14 +15,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "onnxslim";
-  version = "0.1.82";
+  version = "0.1.92";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "inisis";
     repo = "OnnxSlim";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hrrCodLaHVo/YRq0HczxogcZQSwZKxZthyLYxz/+XJ0=";
+    hash = "sha256-8X9SYxSDs6j6PaT364WVVPgEcxzyvEBnpE+1gVe0UIE=";
   };
 
   build-system = [

pkgs/development/python-modules/pdf-oxide/default.nix

@@ -1,7 +1,5 @@
 {
-  lib,
   pkgs,
-  fetchFromGitHub,
   buildPythonPackage,
 
   # build-system
@@ -22,6 +20,7 @@ buildPythonPackage (finalAttrs: {
     ;
 
   pyproject = true;
+  __structuredAttrs = true;
 
   nativeBuildInputs = with rustPlatform; [
     cargoSetupHook
@@ -36,10 +35,15 @@ buildPythonPackage (finalAttrs: {
     pytestCheckHook
   ];
 
-  pythonImportsCheck = [
-    "pdf_oxide"
+  disabledTests = [
+    # AssertionError: assert (False or False or False)
+    "test_version_is_038_or_newer"
+    #401: two-font encrypted PDF (19203 B) is too small
+    "test_issue_401_two_embedded_fonts_save_encrypted"
   ];
 
+  pythonImportsCheck = [ "pdf_oxide" ];
+
   meta = pkgs.pdf-oxide.meta // {
     description = "Python bindings for the pdf_oxide library";
   };

pkgs/development/python-modules/pyezvizapi/default.nix

@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "pyezvizapi";
-  version = "1.0.4.7";
+  version = "1.0.4.8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "RenierM26";
     repo = "pyEzvizApi";
     tag = "v${version}";
-    hash = "sha256-1VEEi0ZGPFypw2w78B5PPN5Wv6enPudOAHDQ6KkkfTw=";
+    hash = "sha256-JR+OZ0te2WK7IamZ7FpzbwNc42hjNz2qOW8NlzzOH7Y=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/pymatreader/default.nix

@@ -44,7 +44,7 @@ buildPythonPackage rec {
   meta = {
     description = "Python package to read all kinds and all versions of Matlab mat files";
     homepage = "https://gitlab.com/obob/pymatreader/";
-    changelog = "https://gitlab.com/obob/pymatreader/-/blob/${src.rev}/CHANGELOG.md";
+    changelog = "https://gitlab.com/obob/pymatreader/-/blob/v${version}/CHANGELOG.md";
     license = lib.licenses.bsd2;
     maintainers = [ ];
   };

pkgs/development/python-modules/pynmea2/default.nix

@@ -35,7 +35,6 @@ buildPythonPackage rec {
   meta = {
     description = "Python library for the NMEA 0183 protcol";
     homepage = "https://github.com/Knio/pynmea2";
-    changelog = "https://github.com/Knio/pynmea2/releases/tag/${version}";
     license = lib.licenses.mit;
     maintainers = [ ];
   };

pkgs/development/python-modules/pyorc/default.nix

@@ -71,7 +71,7 @@ buildPythonPackage rec {
   ];
 
   meta = {
-    changelog = "https://github.com/noirello/pyorc/blob/${version}/CHANGELOG.rst";
+    changelog = "https://github.com/noirello/pyorc/blob/v${version}/CHANGELOG.rst";
     description = "Python module for Apache ORC file format";
     homepage = "https://github.com/noirello/pyorc";
     license = lib.licenses.asl20;

pkgs/development/python-modules/pyproject-metadata/default.nix

@@ -32,7 +32,7 @@ buildPythonPackage rec {
   meta = {
     description = "PEP 621 metadata parsing";
     homepage = "https://github.com/FFY00/python-pyproject-metadata";
-    changelog = "https://github.com/FFY00/python-pyproject-metadata/blob/${version}/CHANGELOG.rst";
+    changelog = "https://github.com/pypa/pyproject-metadata/releases/tag/${version}";
     license = lib.licenses.mit;
   };
 }

pkgs/development/python-modules/pyquaternion/default.nix

@@ -21,6 +21,9 @@ buildPythonPackage rec {
 
   patches = [
     ./numpy2-repr.patch
+    # patch tests for numpy v2.4 behaviour
+    # https://numpy.org/devdocs/release/2.4.0-notes.html#raise-typeerror-on-attempt-to-convert-array-with-ndim-0-to-scalar
+    ./numpy2-float.patch
   ];
 
   # The VERSION.txt file is required for setup.py

pkgs/development/python-modules/pyquaternion/numpy2-float.patch

@@ -0,0 +1,13 @@
+diff --git a/pyquaternion/test/test_quaternion.py b/pyquaternion/test/test_quaternion.py
+index f56afff..1a121c4 100644
+--- a/pyquaternion/test/test_quaternion.py
++++ b/pyquaternion/test/test_quaternion.py
+@@ -936,7 +936,7 @@ class TestQuaternionFeatures(unittest.TestCase):
+         for i in range(20):
+             v = np.random.uniform(-1, 1, 3)
+             v /= np.linalg.norm(v)
+-            theta = float(np.random.uniform(-2,2, 1)) * pi
++            theta = np.random.uniform(-2,2, 1).item() * pi
+             self.validate_axis_angle(v, theta)
+ 
+     def test_exp(self):

pkgs/development/python-modules/pysnmpcrypto/default.nix

@@ -40,7 +40,7 @@ buildPythonPackage rec {
   meta = {
     description = "Strong crypto support for Python SNMP library";
     homepage = "https://github.com/lextudio/pysnmpcrypto";
-    changelog = "https://github.com/lextudio/pysnmpcrypto/blob/${version}/CHANGES.txt";
+    changelog = "https://github.com/lextudio/pysnmpcrypto/blob/v${version}/CHANGES.txt";
     license = lib.licenses.bsd2;
     maintainers = [ ];
   };

pkgs/development/python-modules/pythonocc-core/default.nix

@@ -63,7 +63,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Python wrapper for the OpenCASCADE 3D modeling kernel";
     homepage = "https://github.com/tpaviot/pythonocc-core";
-    changelog = "https://github.com/tpaviot/pythonocc-core/releases/tag/${finalAttrs.version}";
+    changelog = "https://github.com/tpaviot/pythonocc-core/blob/${finalAttrs.src.rev}/NEWS";
     license = lib.licenses.lgpl3;
     platforms = lib.platforms.unix;
     maintainers = [ ];

pkgs/development/python-modules/rns/default.nix

@@ -14,14 +14,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "rns";
-  version = "1.2.4";
+  version = "1.2.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "markqvist";
     repo = "Reticulum";
     tag = finalAttrs.version;
-    hash = "sha256-HuHMRdwyA1A7JwhE7OcipZs3Ey952Y4TFa791AjdTD8=";
+    hash = "sha256-FEpQiq6pnFGCMEGOikkf8QFRVPhlTf0X40foqCBfGpU=";
   };
 
   patches = [

pkgs/development/python-modules/seaborn/default.nix

@@ -84,7 +84,7 @@ buildPythonPackage rec {
   meta = {
     description = "Statistical data visualization";
     homepage = "https://seaborn.pydata.org/";
-    changelog = "https://github.com/mwaskom/seaborn/blob/master/doc/whatsnew/${src.rev}.rst";
+    changelog = "https://github.com/mwaskom/seaborn/blob/v${version}/doc/whatsnew/v${version}.rst";
     license = with lib.licenses; [ bsd3 ];
   };
 }

pkgs/development/python-modules/smpplib/default.nix

@@ -34,7 +34,6 @@ buildPythonPackage rec {
   meta = {
     description = "SMPP library for Python";
     homepage = "https://github.com/python-smpplib/python-smpplib";
-    changelog = "https://github.com/python-smpplib/python-smpplib/releases/tag/${version}";
     license = lib.licenses.lgpl3Plus;
     maintainers = [ ];
   };

pkgs/development/python-modules/sqlalchemy/1_3.nix

@@ -76,7 +76,11 @@ buildPythonPackage (finalAttrs: {
   pythonImportsCheck = [ "sqlalchemy" ];
 
   meta = {
-    changelog = "https://github.com/sqlalchemy/sqlalchemy/releases/tag/${finalAttrs.src.tag})";
+    changelog =
+      let
+        shortVersion = lib.replaceString "." "" (lib.versions.majorMinor finalAttrs.version);
+      in
+      "https://github.com/sqlalchemy/sqlalchemy/blob/${finalAttrs.src.rev}/doc/build/changelog/changelog_${shortVersion}.rst";
     description = "Database Toolkit for Python";
     homepage = "https://github.com/sqlalchemy/sqlalchemy";
     license = lib.licenses.mit;

pkgs/development/python-modules/sqlalchemy/1_4.nix

@@ -100,9 +100,11 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "sqlalchemy" ];
 
   meta = {
-    changelog = "https://github.com/sqlalchemy/sqlalchemy/releases/tag/rel_${
-      builtins.replaceStrings [ "." ] [ "_" ] version
-    }";
+    changelog =
+      let
+        shortVersion = lib.replaceString "." "" (lib.versions.majorMinor version);
+      in
+      "https://github.com/sqlalchemy/sqlalchemy/blob/${src.rev}/doc/build/changelog/changelog_${shortVersion}.rst";
     description = "Database Toolkit for Python";
     homepage = "https://github.com/sqlalchemy/sqlalchemy";
     license = lib.licenses.mit;

pkgs/development/python-modules/starlette-wtf/default.nix

@@ -40,7 +40,7 @@ buildPythonPackage rec {
 
   meta = {
     description = "Simple tool for integrating Starlette and WTForms";
-    changelog = "https://github.com/muicss/starlette-wtf/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/amorey/starlette-wtf/releases/tag/${version}";
     homepage = "https://github.com/muicss/starlette-wtf";
     license = lib.licenses.mit;
   };

pkgs/development/python-modules/stm32loader/default.nix

@@ -59,7 +59,6 @@ buildPythonPackage rec {
     description = "Flash firmware to STM32 microcontrollers in Python";
     mainProgram = "stm32loader";
     homepage = "https://github.com/florisla/stm32loader";
-    changelog = "https://github.com/florisla/stm32loader/blob/v${version}/CHANGELOG.md";
     license = lib.licenses.gpl3;
     maintainers = [ ];
   };

pkgs/development/python-modules/terminaltexteffects/default.nix

@@ -23,7 +23,7 @@ buildPythonPackage rec {
   meta = {
     description = "Collection of visual effects that can be applied to terminal piped stdin text";
     homepage = "https://chrisbuilds.github.io/terminaltexteffects";
-    changelog = "https://chrisbuilds.github.io/terminaltexteffects/changeblog/";
+    changelog = "https://chrisbuilds.github.io/terminaltexteffects/changeblog/changeblog/";
     license = lib.licenses.mit;
     platforms = lib.platforms.unix;
     maintainers = [ ];

pkgs/development/python-modules/verspec/default.nix

@@ -31,7 +31,6 @@ buildPythonPackage rec {
   meta = {
     description = "Flexible version handling";
     homepage = "https://github.com/jimporter/verspec";
-    changelog = "https://github.com/jimporter/averspec/releases/tag/v${version}";
     license = with lib.licenses; [
       bsd2 # and
       asl20

pkgs/development/python-modules/victron-mqtt/default.nix

@@ -12,14 +12,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "victron-mqtt";
-  version = "2026.4.19";
+  version = "2026.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tomer-w";
     repo = "victron_mqtt";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-KJAq/tYQHdlgeUTG+o3yKD5x1XKpYLDlDAr1ti2lbYI=";
+    hash = "sha256-0VGDGtuMs1Bw+98ddI0Gggxm1nWEWWn4Z/RbuTfzqoY=";
   };
 
   build-system = [

pkgs/development/python-modules/yark/default.nix

@@ -49,7 +49,7 @@ buildPythonPackage rec {
     description = "Module for YouTube archiving";
     mainProgram = "yark";
     homepage = "https://github.com/Owez/yark";
-    changelog = "https://github.com/Owez/yark/releases/tag/v${version}";
+    changelog = "https://github.com/Owez/yark/releases/tag/v${lib.versions.majorMinor version}";
     license = lib.licenses.mit;
     maintainers = [ ];
   };

pkgs/development/python-modules/zipfile2/default.nix

@@ -6,7 +6,7 @@
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage {
   pname = "zipfile2";
   version = "0.0.12-unstable-2024-09-28";
   pyproject = true;
@@ -33,7 +33,6 @@ buildPythonPackage rec {
   meta = {
     description = "Backwards-compatible improved zipfile class";
     homepage = "https://github.com/cournape/zipfile2";
-    changelog = "https://github.com/itziakos/zipfile2/releases/tag/v${version}";
     license = lib.licenses.psfl;
     maintainers = [ ];
   };

pkgs/servers/home-assistant/tests.nix

@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   home-assistant,
 }:
 
@@ -93,10 +94,6 @@ let
   };
 
   extraDisabledTestPaths = {
-    hypontech = [
-      # outdated snapshot
-      "tests/components/hypontech/test_sensor.py::test_sensors"
-    ];
     influxdb = [
       # These tests fail because they check for the number of warnings in the
       # logs and there is an extra warning in the logs:
@@ -117,21 +114,6 @@ let
       "tests/components/minecraft_server/test_init.py"
       "tests/components/minecraft_server/test_sensor.py"
     ];
-    modem_callerid = [
-      # aioserial mock produces wrong state
-      "tests/components/modem_callerid/test_init.py::test_setup_entry"
-    ];
-    nzbget = [
-      # type assertion fails due to introduction of parameterized type
-      "tests/components/nzbget/test_config_flow.py::test_user_form"
-      "tests/components/nzbget/test_config_flow.py::test_user_form_show_advanced_options"
-      "tests/components/nzbget/test_config_flow.py::test_user_form_cannot_connect"
-      "tests/components/nzbget/test_init.py::test_async_setup_raises_entry_not_ready"
-    ];
-    overseerr = [
-      # imports broken future module
-      "tests/components/overseerr/test_event.py"
-    ];
     systemmonitor = [
       # sandbox doesn't grant access to /sys/class/power_supply
       "tests/components/systemmonitor/test_config_flow.py::test_add_and_remove_processes"
@@ -139,8 +121,8 @@ let
   };
 
   extraDisabledTests = {
-    conversation = [
-      # intent fixture mismatch
+    conversation = lib.optionals stdenv.hostPlatform.isAarch64 [
+      # intent fixture mismatch on aarch64
       "test_error_no_device_on_floor"
     ];
     ecovacs = [
@@ -155,30 +137,6 @@ let
       # 2026.5.0: after reload device is in loaded state instead of retry state
       "test_usb_device_reactivity"
     ];
-    roborock = [
-      # Translation not found for vacuum
-      "test_clean_segments_mixed_maps"
-      "test_segments_changed_issue"
-    ];
-    sensor = [
-      # Failed: Translation not found for sensor
-      "test_validate_unit_change_convertible"
-      "test_validate_statistics_unit_change_no_device_class"
-      "test_validate_statistics_state_class_removed"
-      "test_validate_statistics_state_class_removed_issue_cleaned_up"
-      "test_validate_statistics_unit_change_no_conversion"
-      "test_validate_statistics_unit_change_equivalent_units_2"
-      "test_update_statistics_issues"
-      "test_validate_statistics_mean_type_changed"
-    ];
-    shell_command = [
-      # tries to retrieve file from github
-      "test_non_text_stdout_capture"
-    ];
-    vacuum = [
-      # Translation not found for vacuum
-      "test_segments_changed_issue"
-    ];
     zeroconf = [
       # multicast socket bind, not possible in the sandbox
       "test_subscribe_discovery"

pkgs/servers/web-apps/freshrss/default.nix

@@ -9,13 +9,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "FreshRSS";
-  version = "1.28.1";
+  version = "1.29.0";
 
   src = fetchFromGitHub {
     owner = "FreshRSS";
     repo = "FreshRSS";
     rev = version;
-    hash = "sha256-T9I3tZOxAzbQxeNa77VcN+HuMmDlDrZvdncBeplui6c=";
+    hash = "sha256-8OWEo+X0+MuS5/74BNIOOXXnDQjeo209UfwTMqRe8ek=";
   };
 
   postPatch = ''

pkgs/test/config-nix-unit.nix

@@ -1,117 +0,0 @@
-# Tests for nixpkgs config forwarding from NixOS modules.
-#
-# Run with:
-#   nix-unit pkgs/test/config-nix-unit.nix
-# or
-#   nix-build -A tests.config-nix-unit
-#
-{
-  nixpkgsPath ? ../..,
-  pkgs ? import nixpkgsPath { },
-}:
-let
-  lib = pkgs.lib;
-
-  # Test helper
-  evalNixos =
-    modules:
-    import (nixpkgsPath + "/nixos/lib/eval-config.nix") {
-      modules = [ { nixpkgs.hostPlatform = "x86_64-linux"; } ] ++ modules;
-    };
-in
-{
-  # Basic: a single config option is forwarded correctly.
-  testSingleConfigOption = {
-    expr = (evalNixos [ { nixpkgs.config.allowUnfree = true; } ]).config.nixpkgs.config.allowUnfree;
-    expected = true;
-  };
-
-  # Multiple config definitions from separate modules are merged.
-  testMultipleModulesMerge = {
-    expr =
-      let
-        eval = evalNixos [
-          { nixpkgs.config.allowUnfree = true; }
-          { nixpkgs.config.allowBroken = true; }
-        ];
-      in
-      {
-        inherit (eval.config.nixpkgs.config) allowUnfree allowBroken;
-      };
-    expected = {
-      allowUnfree = true;
-      allowBroken = true;
-    };
-  };
-
-  # mkForce works. Also covers other properties
-  testMkForce = {
-    expr =
-      (evalNixos [
-        { nixpkgs.config.allowUnfree = true; }
-        { nixpkgs.config.allowUnfree = lib.mkForce false; }
-      ]).config.nixpkgs.config.allowUnfree;
-    expected = false;
-  };
-
-  testDefaults = {
-    expr = (evalNixos [ ]).config.nixpkgs.config.allowUnfree;
-    expected = false;
-  };
-
-  # Standalone nixpkgs (i.e. import <nixpkgs> { ... })
-  testStandaloneConfig = {
-    expr = (import nixpkgsPath { config.allowUnfree = true; }).config.allowUnfree;
-    expected = true;
-  };
-
-  # Standalone nixpkgs with a function (i.e. import <nixpkgs> ({pkgs, lib, ...}: { ... })
-  testStandaloneConfigFunctionPkgs = {
-    expr =
-      (import nixpkgsPath {
-        config =
-          { pkgs, lib, ... }:
-          {
-            allowUnfree = lib.isAttrs pkgs;
-          };
-      }).config.allowUnfree;
-    expected = true;
-  };
-
-  # NixOS module sets nixpkgs.config as a function
-  testNixosConfigFunction = {
-    expr =
-      (evalNixos [
-        {
-          nixpkgs.config =
-            { lib, ... }:
-            {
-              allowUnfree = lib.isFunction lib.id;
-            };
-        }
-      ]).config.nixpkgs.config.allowUnfree;
-    expected = true;
-  };
-
-  # Passing both config and _configDefinitions is not allowed
-  testConfigAndDefinitionsMutuallyExclusive = {
-    expr =
-      (import nixpkgsPath {
-        config = {
-          allowUnfree = true;
-        };
-        _configDefinitions = [
-          {
-            file = "test";
-            value = {
-              allowBroken = true;
-            };
-          }
-        ];
-      }).config.allowUnfree;
-    expectedError = {
-      type = "ThrownError";
-      msg = ".*_configDefinitions.*internal.*must not be combined.*";
-    };
-  };
-}

pkgs/test/default.nix

@@ -128,26 +128,6 @@ in
 
   config = callPackage ./config.nix { };
 
-  # Technically nix-unit binds to a fixed nix version
-  # We have tests in lib to test the module system itself against different nix-versions
-  # Based on this assumption (transitivity of correctness) this test should therefore also cover all tested nix-versions
-  config-nix-unit =
-    pkgs.runCommand "config-nix-unit"
-      {
-        nativeBuildInputs = [ pkgs.nix-unit ];
-      }
-      ''
-        export HOME=$TMPDIR
-        nix-unit --eval-store "$HOME" ${./config-nix-unit.nix} \
-          --arg nixpkgsPath "${
-            builtins.path {
-              path = pkgs.path;
-              name = "source";
-            }
-          }"
-        mkdir $out
-      '';
-
   top-level = callPackage ./top-level { };
 
   haskell = callPackage ./haskell { };

pkgs/top-level/config.nix

@@ -6,12 +6,7 @@
 #     nix-build -A tests.config
 #
 
-{
-  config,
-  lib,
-  docPrefix,
-  ...
-}:
+{ config, lib, ... }:
 
 let
   inherit (lib)
@@ -120,13 +115,13 @@ let
     gitConfig = mkOption {
       type = types.attrsOf (types.attrsOf types.anything);
       description = ''
-        The default [git configuration](https://git-scm.com/docs/git-config#_variables) for all [`pkgs.fetchgit`](${docPrefix}#fetchgit) calls.
+        The default [git configuration](https://git-scm.com/docs/git-config#_variables) for all [`pkgs.fetchgit`](#fetchgit) calls.
 
         Among many other potential uses, this can be used to override URLs to point to local mirrors.
 
         Changing this will not cause any rebuilds because `pkgs.fetchgit` produces a [fixed-output derivation](https://nix.dev/manual/nix/stable/glossary.html?highlight=fixed-output%20derivation#gloss-fixed-output-derivation).
 
-        To set the configuration file directly, use the [`gitConfigFile`](${docPrefix}#opt-gitConfigFile) option instead.
+        To set the configuration file directly, use the [`gitConfigFile`](#opt-gitConfigFile) option instead.
 
         To set the configuration file for individual calls, use `fetchgit { gitConfigFile = "..."; }`.
       '';
@@ -140,9 +135,9 @@ let
     gitConfigFile = mkOption {
       type = types.nullOr types.path;
       description = ''
-        A path to a [git configuration](https://git-scm.com/docs/git-config#_variables) file, to be used for all [`pkgs.fetchgit`](${docPrefix}#fetchgit) calls.
+        A path to a [git configuration](https://git-scm.com/docs/git-config#_variables) file, to be used for all [`pkgs.fetchgit`](#fetchgit) calls.
 
-        This overrides the [`gitConfig`](${docPrefix}#opt-gitConfig) option, see its documentation for more details.
+        This overrides the [`gitConfig`](#opt-gitConfig) option, see its documentation for more details.
       '';
       default =
         if config.gitConfig != { } then
@@ -160,7 +155,7 @@ let
 
         For example, an override like `"registry.npmjs.org" = "my-mirror.local/registry.npmjs.org"` will replace a URL like `https://registry.npmjs.org/foo.tar.gz` with `https://my-mirror.local/registry.npmjs.org/foo.tar.gz`.
 
-        To set the string directly, see [`npmRegistryOverridesString`](${docPrefix}#opt-npmRegistryOverridesString).
+        To set the string directly, see [`npmRegistryOverridesString`](#opt-npmRegistryOverridesString).
       '';
       default = { };
       example = {
@@ -179,7 +174,7 @@ let
       description = ''
         A string containing a string with a JSON representation of npm registry overrides for `fetchNpmDeps`.
 
-        This overrides the [`npmRegistryOverrides`](${docPrefix}#opt-npmRegistryOverrides) option, see its documentation for more details.
+        This overrides the [`npmRegistryOverrides`](#opt-npmRegistryOverrides) option, see its documentation for more details.
       '';
       default = builtins.toJSON config.npmRegistryOverrides;
     };
@@ -417,7 +412,7 @@ let
       type = types.listOf types.str;
       default = [ "https://tarballs.nixos.org" ];
       description = ''
-        The set of content-addressed/hashed mirror URLs used by [`pkgs.fetchurl`](${docPrefix}#sec-pkgs-fetchers-fetchurl).
+        The set of content-addressed/hashed mirror URLs used by [`pkgs.fetchurl`](#sec-pkgs-fetchers-fetchurl).
         In case `pkgs.fetchurl` can't download from the given URLs,
         it will try the hashed mirrors based on the expected output hash.
 
@@ -471,27 +466,11 @@ let
         Silence the warning for the upcoming deprecation of the
         `x86_64-darwin` platform in Nixpkgs 26.11.
 
-        See the [release notes](${docPrefix}#x86_64-darwin-26.05) for more
+        See the [release notes](#x86_64-darwin-26.05) for more
         information.
       '';
     };
 
-    packageOverrides = mkOption {
-      type = types.functionTo types.attrs;
-      default = pkgs: { };
-      description = ''
-        A function to replace or add packages in `pkgs` expects an attrset to be returned when called.
-      '';
-    };
-
-    perlPackageOverrides = mkOption {
-      type = types.functionTo types.attrs;
-      default = pkgs: { };
-      description = ''
-        The same as `packageOverrides` but for packages in the perl package set.
-      '';
-    };
-
     problems = (import ../stdenv/generic/problems.nix { inherit lib; }).configOptions;
   };
 
@@ -515,7 +494,6 @@ in
   inherit options;
 
   config = {
-    _module.args.docPrefix = lib.mkDefault "";
     warnings =
       optionals config.warnUndeclaredOptions (
         mapAttrsToList (k: v: "undeclared Nixpkgs option set: config.${k}") config._undeclared or { }

pkgs/top-level/default.nix

@@ -64,11 +64,6 @@ in
   # list it returns.
   stdenvStages ? import ../stdenv,
 
-  # Temporary parameter to unify nixpkgs/pkgs evaluation
-  # Internal, do not use this manually!
-  # Will be removed again within the next releases
-  _configDefinitions ? null,
-
   # Ignore unexpected args.
   ...
 }@args:
@@ -114,13 +109,7 @@ let
         then
           x86_64DarwinDeprecationWarning
         else
-          x:
-          x throwIfNot (lib.all lib.isFunction crossOverlays)
-            "All crossOverlays passed to nixpkgs must be functions."
-      )
-      (
-        throwIfNot (_configDefinitions == null || config0 == { })
-          "The `_configDefinitions` argument is an internal interface and must not be combined with `config`."
+          x: x
       );
 
   localSystem = lib.systems.elaborate args.localSystem;
@@ -145,24 +134,20 @@ let
 
   # Allow both:
   # { /* the config */ } and
-  # { lib, pkgs, ... } : { /* the config */ }
+  # { pkgs, ... } : { /* the config */ }
   config1 = if lib.isFunction config0 then config0 { inherit lib pkgs; } else config0;
 
   configEval = lib.evalModules {
     modules = [
       ./config.nix
-    ]
-    ++ (
-      if _configDefinitions != null then
-        map (def: lib.modules.setDefaultModuleLocation def.file def.value) _configDefinitions
-      else
-        [
-          {
-            _file = "nixpkgs.config";
-            config = config1;
-          }
-        ]
-    );
+      (
+        { options, ... }:
+        {
+          _file = "nixpkgs.config";
+          config = config1;
+        }
+      )
+    ];
     class = "nixpkgsConfig";
   };