Merge master into staging-next

doc/release-notes/rl-2511.section.md

@@ -24,6 +24,8 @@
 
 - `lima` package now only includes the guest agent for the host's architecture by default. If your guest VM's architecture differs from your Lima host's, you'll need to enable the `lima-additional-guestagents` package by setting `withAdditionalGuestAgents = true` when overriding lima with this input.
 
+- `telegram-desktop` packages now uses `Telegram` for its binary. The previous name was `telegram-desktop`. This is due to [an upstream decision](https://github.com/telegramdesktop/tdesktop/commit/56ff5808a3d766f892bc3c3305afb106b629ef6f) to make the name consistent with other platforms.
+
 ## Other Notable Changes {#sec-nixpkgs-release-25.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

nixos/doc/manual/administration/service-mgmt.chapter.md

@@ -121,7 +121,28 @@ Hence [garbage collection](#sec-nix-gc) will remove that file and you
 will wind up with a broken symlink in your systemd configuration, which
 in turn will not make the service / timer start on login.
 
-## Template units {#sect-nixos-systemd-template-units}
+### Defining custom services {#sect-nixos-systemd-custom-services}
+
+You can define services by adding them to `systemd.services`:
+
+```nix
+systemd.services.myservice = {
+  after = [ "network-online.target" ];
+  requires = [ "network-online.target" ];
+
+  before = [ "multi-user.target" ];
+  wantedBy = [ "multi-user.target" ];
+
+  serviceConfig = {
+    ExecStart = "...";
+  };
+};
+```
+
+If you want to specify a multi-line script for `ExecStart`,
+you may want to use `pkgs.writeShellScript`.
+
+### Template units {#sect-nixos-systemd-template-units}
 
 systemd supports templated units where a base unit can be started multiple
 times with a different parameter. The syntax to accomplish this is

nixos/doc/manual/redirects.json

@@ -1556,6 +1556,9 @@
   "sect-nixos-systemd-nixos": [
     "index.html#sect-nixos-systemd-nixos"
   ],
+  "sect-nixos-systemd-custom-services": [
+    "index.html#sect-nixos-systemd-custom-services"
+  ],
   "sect-nixos-systemd-template-units": [
     "index.html#sect-nixos-systemd-template-units"
   ],

nixos/modules/services/networking/stunnel.nix

@@ -225,8 +225,7 @@ in
   };
 
   meta.maintainers = with lib.maintainers; [
-    # Server side
-    lschuermann
+    # Server side: maintainers wanted
     # Client side
     das_j
   ];

pkgs/applications/emulators/libretro/cores/beetle-psx.nix

@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-psx" + lib.optionalString withHw "-hw";
-  version = "0-unstable-2025-06-06";
+  version = "0-unstable-2025-06-20";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-psx-libretro";
-    rev = "271a967e78dfe2e5936523e3ba52ce6f3c2fa870";
-    hash = "sha256-P8SAX/JujHRnPSSIb9m2fXLHUt20RTJbfjsCrP9jh/U=";
+    rev = "22ba62e8a2e0fb7a8d05b4eec039e58de46924de";
+    hash = "sha256-Z+TMWxPWedZuqpGIfyN7hYC/S5RG1ENnWD2nUDDYDFU=";
   };
 
   extraBuildInputs = lib.optionals withHw [

pkgs/by-name/ar/art/package.nix

@@ -40,13 +40,13 @@
 
 stdenv.mkDerivation rec {
   pname = "art";
-  version = "1.25.5";
+  version = "1.25.6";
 
   src = fetchFromGitHub {
     owner = "artpixls";
     repo = "ART";
     tag = version;
-    hash = "sha256-lKjYSKjZSJ9HtbmGWFR0bVv6hLnRzpklq2ueWirJ+Nw=";
+    hash = "sha256-m3TqtoWjrPXpSL7blrqPm+vANJcpmHyKOm2rpnQ3qQ4=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ba/bagels/package.nix

@@ -2,45 +2,26 @@
   lib,
   python3Packages,
   fetchFromGitHub,
+  writableTmpDirAsHomeHook,
 }:
 
 python3Packages.buildPythonApplication rec {
   pname = "bagels";
-  version = "0.3.8";
+  version = "0.3.9";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "EnhancedJax";
     repo = "bagels";
     tag = version;
-    hash = "sha256-dmBu0HSRGs4LmJY2PHNlRf0RdodmN+ZM0brwuiNmPyU=";
+    hash = "sha256-LlEQ0by6Si37e8FvC4agjLy8eanizSA1iq44BaQ8D5o=";
   };
 
   build-system = with python3Packages; [
     hatchling
   ];
 
-  pythonRelaxDeps = [
-    "aiohappyeyeballs"
-    "aiohttp"
-    "aiosignal"
-    "attrs"
-    "blinker"
-    "click"
-    "multidict"
-    "platformdirs"
-    "propcache"
-    "pydantic-core"
-    "pydantic"
-    "pygments"
-    "requests"
-    "rich"
-    "sqlalchemy"
-    "textual"
-    "typing-extensions"
-    "werkzeug"
-    "yarl"
-  ];
+  pythonRelaxDeps = true;
 
   dependencies = with python3Packages; [
     aiohappyeyeballs
@@ -84,9 +65,34 @@ python3Packages.buildPythonApplication rec {
     yarl
   ];
 
+  nativeCheckInputs =
+    [
+      writableTmpDirAsHomeHook
+    ]
+    ++ (with python3Packages; [
+      freezegun
+      pytestCheckHook
+    ]);
+
+  disabledTests = [
+    # AssertionError: assert 1 == 0
+    "test_delete_category"
+
+    # AttributeError: 'NoneType' object has no attribute 'defaults'
+    "test_basic_balance_calculation"
+    "test_combined_balance_calculation"
+    "test_get_days_in_period"
+    "test_get_period_average"
+    "test_get_period_figures"
+    "test_get_start_end_of_period"
+    "test_get_start_end_of_week"
+    "test_split_balance_calculation"
+    "test_transfer_balance_calculation"
+  ];
+
   meta = {
     homepage = "https://github.com/EnhancedJax/Bagels";
-    description = "Powerful expense tracker that lives in your terminal.";
+    description = "Powerful expense tracker that lives in your terminal";
     longDescription = ''
       Bagels expense tracker is a TUI application where you can track and analyse your money flow, with convenience oriented features and a complete interface.
     '';

pkgs/by-name/c2/c2patool/package.nix

@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "c2patool";
-  version = "0.18.0";
+  version = "0.19.0";
 
   src = fetchFromGitHub {
     owner = "contentauth";
     repo = "c2pa-rs";
     tag = "c2patool-v${finalAttrs.version}";
-    hash = "sha256-Eo69KrIoL1NygLXT46hRVVgsqdBSTA06LtBStQI1BjE=";
+    hash = "sha256-f+YAaqpNGgW1rbOtfTDdNViu7nobSK7yZTKht/JakAQ=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-m/Y6TbsXUV37uvTitLzwXXuU/5BkkMYewfw2DBbIHhw=";
+  cargoHash = "sha256-TxgxMI3Ad5bcwOeLWwugpzfS+K1R6qaZY8gPQCgceoQ=";
 
   # use the non-vendored openssl
   env.OPENSSL_NO_VENDOR = 1;

pkgs/by-name/ca/cargo-nextest/package.nix

@@ -7,17 +7,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-nextest";
-  version = "0.9.98";
+  version = "0.9.99";
 
   src = fetchFromGitHub {
     owner = "nextest-rs";
     repo = "nextest";
     rev = "cargo-nextest-${version}";
-    hash = "sha256-JQw3HWRtTFz1XsqyQLN/7YkePT0Th3QLj3D13au2IKc=";
+    hash = "sha256-I1m4dURisTa4qwUilb8s8bvTsfMSodbZQxRlNDViFeM=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-rf89X1Y0OD4WmaKRwSV506XASo/te/dlC50iBNKNGAg=";
+  cargoHash = "sha256-f75yHVvxC+QhNmn1PUafviONLjrXhcNmMitFU06yAaQ=";
 
   cargoBuildFlags = [
     "-p"

pkgs/by-name/cl/clash-verge-rev/0001-core-validate-bin_path-to-prevent-RCE-in-start_clash.patch

@@ -1,6 +1,6 @@
-From fff6494e26edce6bf8a5b4c40d9535f820608cc3 Mon Sep 17 00:00:00 2001
-From: Moraxyc <i@qaq.li>
-Date: Mon, 28 Apr 2025 16:43:29 +0800
+From 3f86afc3a14474bff39573b1806046c888203096 Mon Sep 17 00:00:00 2001
+From: wxt <3264117476@qq.com>
+Date: Thu, 19 Jun 2025 15:37:16 +0800
 Subject: [PATCH 1/2] core: validate bin_path to prevent RCE in start_clash
 
 Add a security check in CoreManager::start_clash to ensure that the provided
@@ -8,45 +8,22 @@ binary path (`bin_path`) must be located under the current executable's
 directory. This prevents potential remote code execution (RCE) attacks
 caused by arbitrary binary path injection.
 ---
- src/service/core.rs | 21 ++++++++++++++++++---
- 1 file changed, 18 insertions(+), 3 deletions(-)
+ src/service/core.rs | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
 
 diff --git a/src/service/core.rs b/src/service/core.rs
-index 84407a5..51081ed 100644
+index 28e1d42..21efb26 100644
 --- a/src/service/core.rs
 +++ b/src/service/core.rs
 @@ -7,6 +7,7 @@ use once_cell::sync::Lazy;
  use std::{
-     collections::HashMap,
      sync::{atomic::Ordering, Arc, Mutex},
+     fs::File,
 +    env,
  };
+ use log::{info, error};
  
- impl CoreManager {
-@@ -227,7 +228,7 @@ impl CoreManager {
-             .unwrap()
-             .running_pid
-             .load(Ordering::Relaxed) as u32;
--        
-+
-         match process::find_processes("verge-mihomo") {
-             Ok(pids) => {
-                 // 直接在迭代过程中过滤和终止
-@@ -248,18 +249,32 @@ impl CoreManager {
-                     })
-                     .filter(|&success| success)
-                     .count();
--                    
-+
-                 println!("Successfully stopped {} verge-mihomo processes", kill_count);
-             }
-             Err(e) => {
-                 eprintln!("Error finding verge-mihomo processes: {}", e);
-             }
-         }
--        
-+
-         Ok(())
+@@ -223,6 +224,20 @@ impl CoreManager {
      }
  
      pub fn start_clash(&self, body: StartBody) -> Result<(), String> {
@@ -64,9 +41,9 @@ index 84407a5..51081ed 100644
 +                ));
 +            }
 +        }
+         // 设置配置并测试
          {
-             // Check clash & stop if needed
-             let is_running_clash = self
+             info!("设置Clash运行时配置: {:?}", body);
 -- 
 2.49.0
 

pkgs/by-name/cl/clash-verge-rev/0002-core-prevent-overwriting-existing-file-by-validating.patch

@@ -1,6 +1,6 @@
-From b104778a608862789f2be400b9f13a92b1ec5b20 Mon Sep 17 00:00:00 2001
-From: Moraxyc <i@qaq.li>
-Date: Mon, 28 Apr 2025 21:38:02 +0800
+From f7b094a19a47ba515d734f65754d4e57b87239c1 Mon Sep 17 00:00:00 2001
+From: wxt <3264117476@qq.com>
+Date: Thu, 19 Jun 2025 15:45:44 +0800
 Subject: [PATCH 2/2] core: prevent overwriting existing file by validating its
  existence
 
@@ -12,22 +12,22 @@ This enhances the security of log file handling by mitigating arbitrary file ove
  1 file changed, 6 insertions(+)
 
 diff --git a/src/service/core.rs b/src/service/core.rs
-index 51081ed..a2c4f82 100644
+index 21efb26..004d0f0 100644
 --- a/src/service/core.rs
 +++ b/src/service/core.rs
-@@ -275,6 +275,12 @@ impl CoreManager {
-                 ));
-             }
-         }
+@@ -123,6 +123,12 @@ impl CoreManager {
+         let config_file = config.config_file.as_str();
+         let log_file = config.log_file.as_str();
+         let args = vec!["-d", config_dir, "-f", config_file];
 +        {
-+            let log_file = std::path::Path::new(body.log_file.as_str());
-+            if log_file.exists() {
-+                return Err(format!("Log file already exists: {}", log_file.display()));
++            let log_file_2 = std::path::Path::new(log_file);
++            if log_file_2.exists() {
++                return Err(anyhow!(format!("Log file already exists: {}", log_file_2.display())));
 +            }
 +        }
-         {
-             // Check clash & stop if needed
-             let is_running_clash = self
+ 
+         info!("正在启动mihomo: {} -d {} -f {}", bin_path, config_dir, config_file);
+ 
 -- 
 2.49.0
 

pkgs/by-name/cl/clash-verge-rev/package.nix

@@ -12,25 +12,25 @@
 }:
 let
   pname = "clash-verge-rev";
-  version = "2.2.3";
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     owner = "clash-verge-rev";
     repo = "clash-verge-rev";
     tag = "v${version}";
-    hash = "sha256-MJD1FWh/43pOffdWznCVPyGVXcIyqhXzmoEmyM8Tspg=";
+    hash = "sha256-NNP/NDC/Y4oBQftM6Z+pOFMEtdtvcIMYyY3sGwkpmrc=";
   };
 
   src-service = fetchFromGitHub {
     owner = "clash-verge-rev";
     repo = "clash-verge-service";
-    rev = "ffcccc6095e052534980230f9e0ca97db2675062"; # no meaningful tags in this repo. The only way is updating manully every time.
-    hash = "sha256-AbUflPcuSuUigRQB0i52mfVu5sIep1vMZGVMZyznwXY=";
+    rev = "2b36be1417cb30ce592951cbadb1503e61c2c784"; # no meaningful tags in this repo. The only way is updating manully every time.
+    hash = "sha256-yTttQpWmqhgOx9wPGE01Bjp52QjTXLAfg+7+kPny+yg=";
   };
 
-  service-cargo-hash = "sha256-lMOQznPlkHIMSm5nOLuGP9qJXt3CXnd+q8nCu+Xbbt8=";
-  pnpm-hash = "sha256-v9+1NjXo/1ogmep+4IP+9qoUR1GJz87VGeOoMzQ1Rfw=";
-  vendor-hash = "sha256-y3XVHi00mnuVFxSd02YBgfWuXYRVIs+e0tITXNOFRsA=";
+  service-cargo-hash = "sha256-HET7/Lyc0Ip1f9WMVzUWr0QFuL8YN3dgZdK0adl/rYc=";
+  pnpm-hash = "sha256-bhWaDP0gHJC6Mx9QFl4Ltk7y5jozt0eLtsPOWg821Yw=";
+  vendor-hash = "sha256-UkiPJNr5leKuffrrh8n2uhCe/QVjIb4S9heZXP7oKqw=";
 
   service = callPackage ./service.nix {
     inherit

pkgs/by-name/du/duplicity/package.nix

@@ -92,7 +92,6 @@ let
         pycrypto
         # Currently marked as broken.
         # pydrive2
-        future
       ]
       ++ paramiko.optional-dependencies.invoke;
 

pkgs/by-name/gp/gpu-viewer/package.nix

@@ -29,14 +29,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "gpu-viewer";
-  version = "3.13";
+  version = "3.15";
   pyproject = false;
 
   src = fetchFromGitHub {
     owner = "arunsivaramanneo";
     repo = "gpu-viewer";
     tag = "v${version}";
-    hash = "sha256-0owVFnAy2jncNzcWma8vLAAXWOZJ7d56yfn5fr2c2lU=";
+    hash = "sha256-fZsieETJqLbqq3UWtxRtOk5DpxHaTZfYeOLsBTlUtuo=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/hy/hyprshell/package.nix

@@ -9,17 +9,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "hyprshell";
-  version = "4.2.5";
+  version = "4.2.13";
 
   src = fetchFromGitHub {
     owner = "H3rmt";
     repo = "hyprshell";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-J6e2VyakM+8V/s5tSK9bEUfFHSGkyVaCCBZ/zQuMEOE=";
+    hash = "sha256-OgIeNlD2YcW5lWAQvqMvOphIxbIpGOL2WNQmtAGCsbQ=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-ywTS6c+oxkaTmbVal08T0lrNIkqKJNE0Ovs98Yo6pOM=";
+  cargoHash = "sha256-/f1AzpuzhVLeSbemgpXkh/ag33bsRMg3lrRPKVGOcK8=";
 
   nativeBuildInputs = [
     wrapGAppsHook4

pkgs/by-name/ko/komac/package.nix

@@ -16,17 +16,17 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "komac";
-  version = "2.11.2";
+  version = "2.12.0";
 
   src = fetchFromGitHub {
     owner = "russellbanks";
     repo = "Komac";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+PFrncAi0E9SvzfbTBftA5uiDf5LtysIeuIWqwbu2yE=";
+    hash = "sha256-G1oZQ4TgkmBlAfV1aLkA4qvZcBK4K8tvCxaTwPqi16M=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-MDrRKV34JzgayUuemULXLS2GwhlkQKB07LH3X+cVSLk=";
+  cargoHash = "sha256-3o53CJpgCBwjS8IkEHaOIBth6HlKJ0IJYh8qyL5wd1A=";
 
   nativeBuildInputs =
     [

pkgs/by-name/li/limine/package.nix

@@ -42,14 +42,14 @@ in
 # as bootloader for various platforms and corresponding binary and helper files.
 stdenv.mkDerivation (finalAttrs: {
   pname = "limine";
-  version = "9.3.3";
+  version = "9.3.4";
 
   # We don't use the Git source but the release tarball, as the source has a
   # `./bootstrap` script performing network access to download resources.
   # Packaging that in Nix is very cumbersome.
   src = fetchurl {
     url = "https://github.com/limine-bootloader/limine/releases/download/v${finalAttrs.version}/limine-${finalAttrs.version}.tar.gz";
-    hash = "sha256-+yhHFt9SvYUl/tjfwZyR0OJK8+BDzieLS2AFY1VyNLE=";
+    hash = "sha256-GXArMxm7vDyUShTIM1O8/4M8h/ol/b8YcsXdodxJqeM=";
   };
 
   enableParallelBuilding = true;

pkgs/by-name/mo/monitoring-plugins/package.nix

@@ -35,11 +35,6 @@ let
     net-snmp
     procps
   ];
-
-  mailq = runCommand "mailq-wrapper" { preferLocalBuild = true; } ''
-    mkdir -p $out/bin
-    ln -s /run/wrappers/bin/sendmail $out/bin/mailq
-  '';
 in
 stdenv.mkDerivation rec {
   pname = "monitoring-plugins";
@@ -72,7 +67,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [
     "--libexecdir=${placeholder "out"}/bin"
-    "--with-mailq-command=${mailq}/bin/mailq"
+    "--with-mailq-command=/run/wrappers/bin/mailq"
     "--with-sudo-command=/run/wrappers/bin/sudo"
   ];
 

pkgs/by-name/ni/nixos-rebuild-ng/package.nix

@@ -5,7 +5,6 @@
   installShellFiles,
   mkShell,
   nix,
-  nixosTests,
   python3,
   python3Packages,
   runCommand,
@@ -16,6 +15,11 @@
   # Very long tmp dirs lead to "too long for Unix domain socket"
   # SSH ControlPath errors. Especially macOS sets long TMPDIR paths.
   withTmpdir ? if stdenv.hostPlatform.isDarwin then "/tmp" else null,
+  # passthru.tests
+  nixosTests,
+  nixVersions,
+  lixPackageSets,
+  nixos-rebuild-ng,
 }:
 let
   executable = if withNgSuffix then "nixos-rebuild-ng" else "nixos-rebuild";
@@ -23,6 +27,8 @@ let
   # implemented in newer versions of Nix, but not necessary 2.18.
   # However, Lix is a fork of Nix 2.18, so this looks like a good version
   # to cut specific functionality.
+  # ATTN: This currently doesn't disambiguate between Nix and Lix, so using this
+  # in a conditional needs careful checking against both Nix implementations.
   withNix218 = lib.versionAtLeast nix.version "2.18";
 in
 python3Packages.buildPythonApplication rec {
@@ -105,6 +111,25 @@ python3Packages.buildPythonApplication rec {
       };
 
       tests = {
+        with_nix_latest = nixos-rebuild-ng.override {
+          nix = nixVersions.latest;
+        };
+        with_nix_stable = nixos-rebuild-ng.override {
+          nix = nixVersions.stable;
+        };
+        with_nix_2_3 = nixos-rebuild-ng.override {
+          # oldest / minimum supported version in nixpkgs
+          nix = nixVersions.nix_2_3;
+        };
+        with_lix_latest = nixos-rebuild-ng.override {
+          # oldest / minimum supported version in nixpkgs
+          nix = lixPackageSets.latest.lix;
+        };
+        with_lix_stable = nixos-rebuild-ng.override {
+          # oldest / minimum supported version in nixpkgs
+          nix = lixPackageSets.stable.lix;
+        };
+
         inherit (nixosTests)
           nixos-rebuild-install-bootloader-ng
           nixos-rebuild-specialisations-ng

pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py

@@ -11,6 +11,7 @@ import pytest
 from pytest import MonkeyPatch
 
 import nixos_rebuild as nr
+from nixos_rebuild.constants import WITH_NIX_2_18
 
 from .helpers import get_qualified_name
 
@@ -536,6 +537,10 @@ def test_execute_nix_switch_flake(mock_run: Mock, tmp_path: Path) -> None:
 @patch("subprocess.run", autospec=True)
 @patch("uuid.uuid4", autospec=True)
 @patch(get_qualified_name(nr.cleanup_ssh), autospec=True)
+@pytest.mark.skipif(
+    not WITH_NIX_2_18,
+    reason="Tests internal logic based on the assumption that Nix >= 2.18",
+)
 def test_execute_nix_switch_build_target_host(
     mock_cleanup_ssh: Mock,
     mock_uuid4: Mock,

pkgs/by-name/qq/qq/package.nix

@@ -20,6 +20,7 @@
   xorg,
   systemd,
   stdenv,
+  undmg,
   vips,
   at-spi2-core,
   autoPatchelfHook,
@@ -29,107 +30,130 @@
 }:
 
 let
-  sources = import ./sources.nix;
-  srcs = {
-    x86_64-linux = fetchurl {
-      url = sources.amd64_url;
-      hash = sources.amd64_hash;
-    };
-    aarch64-linux = fetchurl {
-      url = sources.arm64_url;
-      hash = sources.arm64_hash;
-    };
-  };
-  src =
-    srcs.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-in
-stdenv.mkDerivation {
+  sources = import ./sources.nix { inherit fetchurl; };
+  source =
+    sources.${stdenv.hostPlatform.system}
+      or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   pname = "qq";
-  version = sources.version;
-  inherit src;
-
-  nativeBuildInputs = [
-    autoPatchelfHook
-    makeShellWrapper
-    wrapGAppsHook3
-    dpkg
-  ];
-
-  buildInputs = [
-    alsa-lib
-    at-spi2-core
-    cups
-    glib
-    gtk3
-    libdrm
-    libpulseaudio
-    libgcrypt
-    libkrb5
-    libgbm
-    nss
-    vips
-    xorg.libXdamage
-  ];
-
-  dontWrapGApps = true;
-
-  runtimeDependencies = map lib.getLib [
-    systemd
-    libkrb5
-  ];
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/bin
-    cp -r opt $out/opt
-    cp -r usr/share $out/share
-    substituteInPlace $out/share/applications/qq.desktop \
-      --replace-fail "/opt/QQ/qq" "$out/bin/qq" \
-      --replace-fail "/usr/share" "$out/share"
-    makeShellWrapper $out/opt/QQ/qq $out/bin/qq \
-      --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH" \
-      --prefix LD_PRELOAD : "${lib.makeLibraryPath [ libssh2 ]}/libssh2.so.1" \
-      --prefix LD_LIBRARY_PATH : "${
-        lib.makeLibraryPath [
-          libGL
-          libuuid
-        ]
-      }" \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}" \
-      --add-flags ${lib.escapeShellArg commandLineArgs} \
-      "''${gappsWrapperArgs[@]}"
-
-    # Remove bundled libraries
-    rm -r $out/opt/QQ/resources/app/sharp-lib
-
-    # https://aur.archlinux.org/cgit/aur.git/commit/?h=linuxqq&id=f7644776ee62fa20e5eb30d0b1ba832513c77793
-    rm -r $out/opt/QQ/resources/app/libssh2.so.1
-
-    # https://github.com/microcai/gentoo-zh/commit/06ad5e702327adfe5604c276635ae8a373f7d29e
-    ln -s ${libayatana-appindicator}/lib/libayatana-appindicator3.so \
-      $out/opt/QQ/libappindicator3.so
-
-    ln -s ${libnotify}/lib/libnotify.so \
-      $out/opt/QQ/libnotify.so
-
-    runHook postInstall
-  '';
-
-  passthru.updateScript = ./update.sh;
-
+  inherit (source) version src;
+  passthru = {
+    updateScript = ./update.sh;
+  };
   meta = {
-    homepage = "https://im.qq.com/linuxqq/";
+    homepage = "https://im.qq.com/index/";
     description = "Messaging app";
     platforms = [
-      "x86_64-linux"
+      "aarch64-darwin"
       "aarch64-linux"
+      "x86_64-darwin"
+      "x86_64-linux"
     ];
     license = lib.licenses.unfree;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     maintainers = with lib.maintainers; [
-      fee1-dead
       bot-wxt1221
+      fee1-dead
+      prince213
     ];
   };
-}
+in
+if stdenv.hostPlatform.isDarwin then
+  stdenv.mkDerivation {
+    inherit
+      pname
+      version
+      src
+      passthru
+      meta
+      ;
+
+    nativeBuildInputs = [ undmg ];
+    sourceRoot = ".";
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/Applications
+      cp -a QQ.app $out/Applications
+
+      runHook postInstall
+    '';
+  }
+else
+  stdenv.mkDerivation {
+    inherit
+      pname
+      version
+      src
+      passthru
+      meta
+      ;
+
+    nativeBuildInputs = [
+      autoPatchelfHook
+      makeShellWrapper
+      wrapGAppsHook3
+      dpkg
+    ];
+
+    buildInputs = [
+      alsa-lib
+      at-spi2-core
+      cups
+      glib
+      gtk3
+      libdrm
+      libpulseaudio
+      libgcrypt
+      libkrb5
+      libgbm
+      nss
+      vips
+      xorg.libXdamage
+    ];
+
+    dontWrapGApps = true;
+
+    runtimeDependencies = map lib.getLib [
+      systemd
+      libkrb5
+    ];
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/bin
+      cp -r opt $out/opt
+      cp -r usr/share $out/share
+      substituteInPlace $out/share/applications/qq.desktop \
+        --replace-fail "/opt/QQ/qq" "$out/bin/qq" \
+        --replace-fail "/usr/share" "$out/share"
+      makeShellWrapper $out/opt/QQ/qq $out/bin/qq \
+        --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH" \
+        --prefix LD_PRELOAD : "${lib.makeLibraryPath [ libssh2 ]}/libssh2.so.1" \
+        --prefix LD_LIBRARY_PATH : "${
+          lib.makeLibraryPath [
+            libGL
+            libuuid
+          ]
+        }" \
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}" \
+        --add-flags ${lib.escapeShellArg commandLineArgs} \
+        "''${gappsWrapperArgs[@]}"
+
+      # Remove bundled libraries
+      rm -r $out/opt/QQ/resources/app/sharp-lib
+
+      # https://aur.archlinux.org/cgit/aur.git/commit/?h=linuxqq&id=f7644776ee62fa20e5eb30d0b1ba832513c77793
+      rm -r $out/opt/QQ/resources/app/libssh2.so.1
+
+      # https://github.com/microcai/gentoo-zh/commit/06ad5e702327adfe5604c276635ae8a373f7d29e
+      ln -s ${libayatana-appindicator}/lib/libayatana-appindicator3.so \
+        $out/opt/QQ/libappindicator3.so
+
+      ln -s ${libnotify}/lib/libnotify.so \
+        $out/opt/QQ/libnotify.so
+
+      runHook postInstall
+    '';
+  }

pkgs/by-name/qq/qq/sources.nix

@@ -1,9 +1,30 @@
 # Generated by ./update.sh - do not update manually!
-# Last updated: 2025-05-30
+# Last updated: 2025-06-17
+{ fetchurl }:
+let
+  any-darwin = {
+    version = "6.9.75-2025.6.16";
+    src = fetchurl {
+      url = "https://dldir1v6.qq.com/qqfile/qq/QQNT/Mac/QQ_6.9.75_250616_01.dmg";
+      hash = "sha256-MS2WGrAuBGlbzzxfUlcixoD1snchEaLu4Ecvt84Hdfo=";
+    };
+  };
+in
 {
-  version = "3.2.17-2025.5.21";
-  amd64_url = "https://dldir1.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.17_250521_amd64_01.deb";
-  arm64_url = "https://dldir1.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.17_250521_arm64_01.deb";
-  arm64_hash = "sha256-PdZ9yHyyx55Y6J59ZsjDsXhXHyNkk1JBS9K0i0vuX/Q=";
-  amd64_hash = "sha256-BG6Qz+hquexSa5QCwWx6vucb4TS0dUQ6UYKB/zkkI1g=";
+  aarch64-darwin = any-darwin;
+  x86_64-darwin = any-darwin;
+  aarch64-linux = {
+    version = "3.2.18-2025.6.16";
+    src = fetchurl {
+      url = "https://dldir1v6.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.18_250616_arm64_01.deb";
+      hash = "sha256-wwZC+hyyrmmjhlk4hdJTnf5WkRxjit6smUmD4jPKbM0=";
+    };
+  };
+  x86_64-linux = {
+    version = "3.2.18-2025.6.16";
+    src = fetchurl {
+      url = "https://dldir1v6.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.18_250616_amd64_01.deb";
+      hash = "sha256-7/c1PwlcWogXO229e7f1gYWktCT+hpyQI1+22TkvzLQ=";
+    };
+  };
 }

pkgs/by-name/qq/qq/update.sh

@@ -5,27 +5,64 @@ set -euo pipefail
 
 cd $(readlink -e $(dirname "${BASH_SOURCE[0]}"))
 
-payload=$(curl https://im.qq.com/rainbow/linuxQQDownload | grep -oP "var params= \K\{.*\}(?=;)")
-amd64_url=$(jq -r .x64DownloadUrl.deb <<< "$payload")
-arm64_url=$(jq -r .armDownloadUrl.deb <<< "$payload")
+# darwin
 
-version=$(jq -r .version <<< "$payload")-$(jq -r .updateDate <<< "$payload")
+darwin_url=$(curl -s https://im.qq.com/macqq/index.shtml | grep -oP 'var rainbowConfigUrl = "\K.*(?=";)')
+darwin_payload=$(curl "$darwin_url" | grep -oP "var params= \K\{.*\}(?=;)")
+darwin_version=$(jq -r .version <<< "$darwin_payload" | awk -F\  '{print $1}')-$(jq -r .updateDate <<< "$darwin_payload")
 
-amd64_hash=$(nix-prefetch-url $amd64_url)
-arm64_hash=$(nix-prefetch-url $arm64_url)
+darwin_url=$(jq -r .downloadUrl <<< "$darwin_payload")
+
+darwin_hash=$(nix-prefetch-url $darwin_url)
 
 # use friendlier hashes
-amd64_hash=$(nix hash convert --to sri --hash-algo sha256 "$amd64_hash")
-arm64_hash=$(nix hash convert --to sri --hash-algo sha256 "$arm64_hash")
+darwin_hash=$(nix hash convert --to sri --hash-algo sha256 "$darwin_hash")
+
+# linux
+
+linux_url=$(curl -s https://im.qq.com/linuxqq/index.shtml | grep -oP 'var rainbowConfigUrl = "\K.*(?=";)')
+linux_payload=$(curl "$linux_url" | grep -oP "var params= \K\{.*\}(?=;)")
+linux_version=$(jq -r .version <<< "$linux_payload")-$(jq -r .updateDate <<< "$linux_payload")
+
+linux_aarch64_url=$(jq -r .armDownloadUrl.deb <<< "$linux_payload")
+linux_x86_64_url=$(jq -r .x64DownloadUrl.deb <<< "$linux_payload")
+
+linux_aarch64_hash=$(nix-prefetch-url $linux_aarch64_url)
+linux_x86_64_hash=$(nix-prefetch-url $linux_x86_64_url)
+
+# use friendlier hashes
+linux_aarch64_hash=$(nix hash convert --to sri --hash-algo sha256 "$linux_aarch64_hash")
+linux_x86_64_hash=$(nix hash convert --to sri --hash-algo sha256 "$linux_x86_64_hash")
 
 cat >sources.nix <<EOF
 # Generated by ./update.sh - do not update manually!
 # Last updated: $(date +%F)
+{ fetchurl }:
+let
+  any-darwin = {
+    version = "$darwin_version";
+    src = fetchurl {
+      url = "$darwin_url";
+      hash = "$darwin_hash";
+    };
+  };
+in
 {
-  version = "$version";
-  amd64_url = "$amd64_url";
-  arm64_url = "$arm64_url";
-  arm64_hash = "$arm64_hash";
-  amd64_hash = "$amd64_hash";
+  aarch64-darwin = any-darwin;
+  x86_64-darwin = any-darwin;
+  aarch64-linux = {
+    version = "$linux_version";
+    src = fetchurl {
+      url = "$linux_aarch64_url";
+      hash = "$linux_aarch64_hash";
+    };
+  };
+  x86_64-linux = {
+    version = "$linux_version";
+    src = fetchurl {
+      url = "$linux_x86_64_url";
+      hash = "$linux_x86_64_hash";
+    };
+  };
 }
 EOF

pkgs/by-name/sc/scrcpy/package.nix

@@ -17,12 +17,12 @@
 }:
 
 let
-  version = "3.3";
+  version = "3.3.1";
   prebuilt_server = fetchurl {
     name = "scrcpy-server";
     inherit version;
     url = "https://github.com/Genymobile/scrcpy/releases/download/v${version}/scrcpy-server-v${version}";
-    hash = "sha256-NRyy7cfkwsdfCaeTP9q88Te+UuJgLfFU8k7ALbRunlE=";
+    hash = "sha256-oPcLIKpJmPv2WMlBGM1sjatqu7Bkejvas0TXC8Hry7g=";
   };
 in
 stdenv.mkDerivation rec {
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
     owner = "Genymobile";
     repo = "scrcpy";
     tag = "v${version}";
-    hash = "sha256-oDv/apC9OOItH4RFqssSo1/cDMyyrBkgLY+KPLEz1+c=";
+    hash = "sha256-WotmLbktFLVpoRSmlxj7RLRYDhVQ7AWp4Awgry7kgIM=";
   };
 
   #   display.c: When run without a hardware accelerator, this allows the command to continue working rather than failing unexpectedly.

pkgs/by-name/so/sourcepawn-studio/package.nix

@@ -8,17 +8,17 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "sourcepawn-studio";
-  version = "8.1.3";
+  version = "8.1.6";
 
   src = fetchFromGitHub {
     owner = "Sarrus1";
     repo = "sourcepawn-studio";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qeKaIYI9+t9D/6/SSoJrnkA6DX6Wv/51vZCJIHm/0ts=";
+    hash = "sha256-XDvVOY1BueavFe9pHMGLDZRaKbDq78xQAUMPVNKG04M=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-8/HTrniZhXT68Ni9zjze8/mDu0TrMJKw41EEWPOhKjw=";
+  cargoHash = "sha256-o4mGOsoayR39gyV5Jit3ZEkdDllqNklfaHs0Oxw+tDc=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/te/terramate/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "terramate";
-  version = "0.13.2";
+  version = "0.13.3";
 
   src = fetchFromGitHub {
     owner = "terramate-io";
     repo = "terramate";
     rev = "v${version}";
-    hash = "sha256-NN7M4ZJ67YwguDzSHkluW1wbwVbn+7otMQm+ot2el5I=";
+    hash = "sha256-KPac6JyDnP2mVJSo3Ffzk3Nrzr9PrJCe4rNtl7uR+a8=";
   };
 
-  vendorHash = "sha256-Ldl4TGmfMLk9DJgoVUYCpjX5TyAwZyCSrOKdb6uo4eM=";
+  vendorHash = "sha256-u9eXi7FjMsXm0H0y7Gs/Wu2I8tp4rRLxtjUxrrHJkEU=";
 
   # required for version info
   nativeBuildInputs = [ git ];

pkgs/by-name/tr/traccar/package.nix

@@ -6,13 +6,13 @@
 }:
 stdenvNoCC.mkDerivation rec {
   pname = "traccar";
-  version = "6.7.2";
+  version = "6.7.3";
   nativeBuildInputs = [ pkgs.makeWrapper ];
 
   src = fetchzip {
     stripRoot = false;
     url = "https://github.com/traccar/traccar/releases/download/v${version}/traccar-other-${version}.zip";
-    hash = "sha256-a6ZDJcviEPXLm91PnP6qflID2MLO4oD6MyVkQNRd688=";
+    hash = "sha256-XUlGxOT9udJUy9tcdKeqvY2EbGokDcp+Wv3ShfHPoGA=";
   };
 
   installPhase = ''