Merge staging-next into staging

maintainers/maintainer-list.nix

@@ -15335,6 +15335,12 @@
     githubId = 15693688;
     name = "Lucas Eduardo Wendt";
   };
+  lucasfa = {
+    name = "Lucas Fehlau Arbulu";
+    githubId = 23667494;
+    github = "LucasFA";
+    matrix = "@lucasfa:matrix.org";
+  };
   lucastso10 = {
     email = "lucastso10@gmail.com";
     github = "lucastso10";

nixos/modules/module-list.nix

@@ -1735,6 +1735,7 @@
   ./services/web-apps/suwayomi-server.nix
   ./services/web-apps/szurubooru.nix
   ./services/web-apps/trilium.nix
+  ./services/web-apps/tt-rss.nix
   ./services/web-apps/tuliprox.nix
   ./services/web-apps/umami.nix
   ./services/web-apps/vikunja.nix

nixos/modules/programs/nh.nix

@@ -10,6 +10,7 @@ in
 {
   meta.maintainers = with lib.maintainers; [
     NotAShelf
+    mdaniels5757
     viperML
   ];
 

nixos/modules/programs/tmux.nix

@@ -29,7 +29,12 @@ let
     setw -g pane-base-index ${toString cfg.baseIndex}
     set  -g history-limit   ${toString cfg.historyLimit}
 
-    ${optionalString cfg.newSession "new-session"}
+    ${optionalString cfg.newSession ''
+      # Use -A to make new-session idempotent: attach if session "0" exists,
+      # otherwise create it. This prevents duplicate sessions when multiple
+      # configs (e.g., system and user) both enable newSession.
+      new-session -A -s 0
+    ''}
 
     ${optionalString cfg.reverseSplit ''
       bind v split-window -h

nixos/modules/rename.nix

@@ -290,9 +290,6 @@ in
     (mkRemovedOptionModule [ "services" "sourcehut" ] ''
       The sourcehut packages and the corresponding module have been removed due to being broken and unmaintained.
     '')
-    (mkRemovedOptionModule [ "services" "tt-rss" ] ''
-      The tt-rss package and module have been removed, since upstream development ceased 2025-11-01 and the source is no longer available officially.
-    '')
     (mkRemovedOptionModule [ "services" "tvheadend" ]
       "The tvheadend package and the corresponding module have been removed as nobody was willing to maintain them and they were stuck on an unmaintained version that required FFmpeg 4; please see https://github.com/NixOS/nixpkgs/pull/332259 if you are interested in maintaining a newer version."
     )

nixos/modules/services/misc/forgejo.nix

@@ -340,7 +340,7 @@ in
             };
             mailer = {
               ENABLED = true;
-              MAILER_TYPE = "sendmail";
+              PROTOCOL = "sendmail";
               FROM = "do-not-reply@example.org";
               SENDMAIL_PATH = "''${pkgs.system-sendmail}/bin/sendmail";
             };

nixos/modules/services/web-apps/tt-rss.nix

@@ -0,0 +1,714 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+with lib;
+let
+  cfg = config.services.tt-rss;
+
+  inherit (cfg) phpPackage;
+
+  configVersion = 26;
+
+  dbPort =
+    if cfg.database.port == null then
+      (if cfg.database.type == "pgsql" then 5432 else 3306)
+    else
+      cfg.database.port;
+
+  poolName = "tt-rss";
+
+  mysqlLocal = cfg.database.createLocally && cfg.database.type == "mysql";
+  pgsqlLocal = cfg.database.createLocally && cfg.database.type == "pgsql";
+
+  tt-rss-config =
+    let
+      password =
+        if (cfg.database.password != null) then
+          "'${(escape [ "'" "\\" ] cfg.database.password)}'"
+        else if (cfg.database.passwordFile != null) then
+          "file_get_contents('${cfg.database.passwordFile}')"
+        else
+          null;
+    in
+    pkgs.writeText "config.php" ''
+      <?php
+        putenv('TTRSS_PHP_EXECUTABLE=${phpPackage}/bin/php');
+
+        putenv('TTRSS_LOCK_DIRECTORY=${cfg.root}/lock');
+        putenv('TTRSS_CACHE_DIR=${cfg.root}/cache');
+        putenv('TTRSS_ICONS_DIR=${cfg.root}/feed-icons');
+        putenv('TTRSS_ICONS_URL=feed-icons');
+        putenv('TTRSS_SELF_URL_PATH=${cfg.selfUrlPath}');
+
+        putenv('TTRSS_MYSQL_CHARSET=UTF8');
+
+        putenv('TTRSS_DB_TYPE=${cfg.database.type}');
+        putenv('TTRSS_DB_HOST=${optionalString (cfg.database.host != null) cfg.database.host}');
+        putenv('TTRSS_DB_USER=${cfg.database.user}');
+        putenv('TTRSS_DB_NAME=${cfg.database.name}');
+        putenv('TTRSS_DB_PASS=' ${optionalString (password != null) ". ${password}"});
+        putenv('TTRSS_DB_PORT=${toString dbPort}');
+
+        putenv('TTRSS_AUTH_AUTO_CREATE=${boolToString cfg.auth.autoCreate}');
+        putenv('TTRSS_AUTH_AUTO_LOGIN=${boolToString cfg.auth.autoLogin}');
+
+        putenv('TTRSS_FEED_CRYPT_KEY=${escape [ "'" "\\" ] cfg.feedCryptKey}');
+
+
+        putenv('TTRSS_SINGLE_USER_MODE=${boolToString cfg.singleUserMode}');
+
+        putenv('TTRSS_SIMPLE_UPDATE_MODE=${boolToString cfg.simpleUpdateMode}');
+
+        # Never check for updates - the running version of the code should
+        # be controlled entirely by the version of TT-RSS active in the
+        # current Nix profile. If TT-RSS updates itself to a version
+        # requiring a database schema upgrade, and then the SystemD
+        # tt-rss.service is restarted, the old code copied from the Nix
+        # store will overwrite the updated version, causing the code to
+        # detect the need for a schema "upgrade" (since the schema version
+        # in the database is different than in the code), but the update
+        # schema operation in TT-RSS will do nothing because the schema
+        # version in the database is newer than that in the code.
+        putenv('TTRSS_CHECK_FOR_UPDATES=false');
+
+        putenv('TTRSS_FORCE_ARTICLE_PURGE=${toString cfg.forceArticlePurge}');
+        putenv('TTRSS_SESSION_COOKIE_LIFETIME=${toString cfg.sessionCookieLifetime}');
+        putenv('TTRSS_ENABLE_GZIP_OUTPUT=${boolToString cfg.enableGZipOutput}');
+
+        putenv('TTRSS_PLUGINS=${builtins.concatStringsSep "," cfg.plugins}');
+
+        putenv('TTRSS_LOG_DESTINATION=${cfg.logDestination}');
+        putenv('TTRSS_CONFIG_VERSION=${toString configVersion}');
+
+
+        putenv('TTRSS_PUBSUBHUBBUB_ENABLED=${boolToString cfg.pubSubHubbub.enable}');
+        putenv('TTRSS_PUBSUBHUBBUB_HUB=${cfg.pubSubHubbub.hub}');
+
+        putenv('TTRSS_SPHINX_SERVER=${cfg.sphinx.server}');
+        putenv('TTRSS_SPHINX_INDEX=${builtins.concatStringsSep "," cfg.sphinx.index}');
+
+        putenv('TTRSS_ENABLE_REGISTRATION=${boolToString cfg.registration.enable}');
+        putenv('TTRSS_REG_NOTIFY_ADDRESS=${cfg.registration.notifyAddress}');
+        putenv('TTRSS_REG_MAX_USERS=${toString cfg.registration.maxUsers}');
+
+        putenv('TTRSS_SMTP_SERVER=${cfg.email.server}');
+        putenv('TTRSS_SMTP_LOGIN=${cfg.email.login}');
+        putenv('TTRSS_SMTP_PASSWORD=${escape [ "'" "\\" ] cfg.email.password}');
+        putenv('TTRSS_SMTP_SECURE=${cfg.email.security}');
+
+        putenv('TTRSS_SMTP_FROM_NAME=${escape [ "'" "\\" ] cfg.email.fromName}');
+        putenv('TTRSS_SMTP_FROM_ADDRESS=${escape [ "'" "\\" ] cfg.email.fromAddress}');
+        putenv('TTRSS_DIGEST_SUBJECT=${escape [ "'" "\\" ] cfg.email.digestSubject}');
+
+        ${cfg.extraConfig}
+    '';
+
+  # tt-rss and plugins and themes and config.php
+  servedRoot = pkgs.runCommand "tt-rss-served-root" { } ''
+    cp --no-preserve=mode -r ${pkgs.tt-rss} $out
+    cp ${tt-rss-config} $out/config.php
+    ${optionalString (cfg.pluginPackages != [ ]) ''
+      for plugin in ${concatStringsSep " " cfg.pluginPackages}; do
+      cp -r "$plugin"/* "$out/plugins.local/"
+      done
+    ''}
+    ${optionalString (cfg.themePackages != [ ]) ''
+      for theme in ${concatStringsSep " " cfg.themePackages}; do
+      cp -r "$theme"/* "$out/themes.local/"
+      done
+    ''}
+  '';
+
+in
+{
+
+  ###### interface
+
+  options = {
+
+    services.tt-rss = {
+
+      enable = mkEnableOption "tt-rss";
+
+      root = mkOption {
+        type = types.path;
+        default = "/var/lib/tt-rss";
+        description = ''
+          Root of the application.
+        '';
+      };
+
+      user = mkOption {
+        type = types.str;
+        default = "tt_rss";
+        description = ''
+          User account under which both the update daemon and the web-application run.
+        '';
+      };
+
+      pool = mkOption {
+        type = types.str;
+        default = "${poolName}";
+        description = ''
+          Name of existing phpfpm pool that is used to run web-application.
+          If not specified a pool will be created automatically with
+          default values.
+        '';
+      };
+
+      virtualHost = mkOption {
+        type = types.nullOr types.str;
+        default = "tt-rss";
+        description = ''
+          Name of the nginx virtualhost to use and setup. If null, do not setup any virtualhost.
+        '';
+      };
+
+      database = {
+        type = mkOption {
+          type = types.enum [
+            "pgsql"
+            "mysql"
+          ];
+          default = "pgsql";
+          description = ''
+            Database to store feeds. Supported are pgsql and mysql.
+          '';
+        };
+
+        host = mkOption {
+          type = types.nullOr types.str;
+          default = null;
+          description = ''
+            Host of the database. Leave null to use Unix domain socket.
+          '';
+        };
+
+        name = mkOption {
+          type = types.str;
+          default = "tt_rss";
+          description = ''
+            Name of the existing database.
+          '';
+        };
+
+        user = mkOption {
+          type = types.str;
+          default = "tt_rss";
+          description = ''
+            The database user. The user must exist and has access to
+            the specified database.
+          '';
+        };
+
+        password = mkOption {
+          type = types.nullOr types.str;
+          default = null;
+          description = ''
+            The database user's password.
+          '';
+        };
+
+        passwordFile = mkOption {
+          type = types.nullOr types.str;
+          default = null;
+          description = ''
+            The database user's password.
+          '';
+        };
+
+        port = mkOption {
+          type = types.nullOr types.port;
+          default = null;
+          description = ''
+            The database's port. If not set, the default ports will be provided (5432
+            and 3306 for pgsql and mysql respectively).
+          '';
+        };
+
+        createLocally = mkOption {
+          type = types.bool;
+          default = true;
+          description = "Create the database and database user locally.";
+        };
+      };
+
+      auth = {
+        autoCreate = mkOption {
+          type = types.bool;
+          default = true;
+          description = ''
+            Allow authentication modules to auto-create users in tt-rss internal
+            database when authenticated successfully.
+          '';
+        };
+
+        autoLogin = mkOption {
+          type = types.bool;
+          default = true;
+          description = ''
+            Automatically login user on remote or other kind of externally supplied
+            authentication, otherwise redirect to login form as normal.
+            If set to true, users won't be able to set application language
+            and settings profile.
+          '';
+        };
+      };
+
+      pubSubHubbub = {
+        hub = mkOption {
+          type = types.str;
+          default = "";
+          description = ''
+            URL to a PubSubHubbub-compatible hub server. If defined, "Published
+            articles" generated feed would automatically become PUSH-enabled.
+          '';
+        };
+
+        enable = mkOption {
+          type = types.bool;
+          default = false;
+          description = ''
+            Enable client PubSubHubbub support in tt-rss. When disabled, tt-rss
+            won't try to subscribe to PUSH feed updates.
+          '';
+        };
+      };
+
+      sphinx = {
+        server = mkOption {
+          type = types.str;
+          default = "localhost:9312";
+          description = ''
+            Hostname:port combination for the Sphinx server.
+          '';
+        };
+
+        index = mkOption {
+          type = types.listOf types.str;
+          default = [
+            "ttrss"
+            "delta"
+          ];
+          description = ''
+            Index names in Sphinx configuration. Example configuration
+            files are available on tt-rss wiki.
+          '';
+        };
+      };
+
+      registration = {
+        enable = mkOption {
+          type = types.bool;
+          default = false;
+          description = ''
+            Allow users to register themselves. Please be aware that allowing
+            random people to access your tt-rss installation is a security risk
+            and potentially might lead to data loss or server exploit. Disabled
+            by default.
+          '';
+        };
+
+        notifyAddress = mkOption {
+          type = types.str;
+          default = "";
+          description = ''
+            Email address to send new user notifications to.
+          '';
+        };
+
+        maxUsers = mkOption {
+          type = types.int;
+          default = 0;
+          description = ''
+            Maximum amount of users which will be allowed to register on this
+            system. 0 - no limit.
+          '';
+        };
+      };
+
+      email = {
+        server = mkOption {
+          type = types.str;
+          default = "";
+          example = "localhost:25";
+          description = ''
+            Hostname:port combination to send outgoing mail. Blank - use system
+            MTA.
+          '';
+        };
+
+        login = mkOption {
+          type = types.str;
+          default = "";
+          description = ''
+            SMTP authentication login used when sending outgoing mail.
+          '';
+        };
+
+        password = mkOption {
+          type = types.str;
+          default = "";
+          description = ''
+            SMTP authentication password used when sending outgoing mail.
+          '';
+        };
+
+        security = mkOption {
+          type = types.enum [
+            ""
+            "ssl"
+            "tls"
+          ];
+          default = "";
+          description = ''
+            Used to select a secure SMTP connection. Allowed values: ssl, tls,
+            or empty.
+          '';
+        };
+
+        fromName = mkOption {
+          type = types.str;
+          default = "Tiny Tiny RSS";
+          description = ''
+            Name for sending outgoing mail. This applies to password reset
+            notifications, digest emails and any other mail.
+          '';
+        };
+
+        fromAddress = mkOption {
+          type = types.str;
+          default = "";
+          description = ''
+            Address for sending outgoing mail. This applies to password reset
+            notifications, digest emails and any other mail.
+          '';
+        };
+
+        digestSubject = mkOption {
+          type = types.str;
+          default = "[tt-rss] New headlines for last 24 hours";
+          description = ''
+            Subject line for email digests.
+          '';
+        };
+      };
+
+      sessionCookieLifetime = mkOption {
+        type = types.int;
+        default = 86400;
+        description = ''
+          Default lifetime of a session (e.g. login) cookie. In seconds,
+          0 means cookie will be deleted when browser closes.
+        '';
+      };
+
+      selfUrlPath = mkOption {
+        type = types.str;
+        description = ''
+          Full URL of your tt-rss installation. This should be set to the
+          location of tt-rss directory, e.g. http://example.org/tt-rss/
+          You need to set this option correctly otherwise several features
+          including PUSH, bookmarklets and browser integration will not work properly.
+        '';
+        example = "http://localhost";
+      };
+
+      feedCryptKey = mkOption {
+        type = types.str;
+        default = "";
+        description = ''
+          Key used for encryption of passwords for password-protected feeds
+          in the database. A string of 24 random characters. If left blank, encryption
+          is not used. Requires mcrypt functions.
+          Warning: changing this key will make your stored feed passwords impossible
+          to decrypt.
+        '';
+      };
+
+      singleUserMode = mkOption {
+        type = types.bool;
+        default = false;
+
+        description = ''
+          Operate in single user mode, disables all functionality related to
+          multiple users and authentication. Enabling this assumes you have
+          your tt-rss directory protected by other means (e.g. http auth).
+        '';
+      };
+
+      simpleUpdateMode = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Enables fallback update mode where tt-rss tries to update feeds in
+          background while tt-rss is open in your browser.
+          If you don't have a lot of feeds and don't want to or can't run
+          background processes while not running tt-rss, this method is generally
+          viable to keep your feeds up to date.
+          Still, there are more robust (and recommended) updating methods
+          available, you can read about them here: <https://tt-rss.org/wiki/UpdatingFeeds>
+        '';
+      };
+
+      forceArticlePurge = mkOption {
+        type = types.int;
+        default = 0;
+        description = ''
+          When this option is not 0, users ability to control feed purging
+          intervals is disabled and all articles (which are not starred)
+          older than this amount of days are purged.
+        '';
+      };
+
+      enableGZipOutput = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Selectively gzip output to improve wire performance. This requires
+          PHP Zlib extension on the server.
+          Enabling this can break tt-rss in several httpd/php configurations,
+          if you experience weird errors and tt-rss failing to start, blank pages
+          after login, or content encoding errors, disable it.
+        '';
+      };
+
+      phpPackage = lib.mkOption {
+        type = lib.types.package;
+        default = pkgs.php;
+        defaultText = "pkgs.php";
+        description = ''
+          php package to use for php fpm and update daemon.
+        '';
+      };
+
+      plugins = mkOption {
+        type = types.listOf types.str;
+        default = [
+          "auth_internal"
+          "note"
+        ];
+        description = ''
+          List of plugins to load automatically for all users.
+          System plugins have to be specified here. Please enable at least one
+          authentication plugin here (auth_*).
+          Users may enable other user plugins from Preferences/Plugins but may not
+          disable plugins specified in this list.
+          Disabling auth_internal in this list would automatically disable
+          reset password link on the login form.
+        '';
+      };
+
+      pluginPackages = mkOption {
+        type = types.listOf types.package;
+        default = [ ];
+        description = ''
+          List of plugins to install. The list elements are expected to
+          be derivations. All elements in this derivation are automatically
+          copied to the `plugins.local` directory.
+        '';
+      };
+
+      themePackages = mkOption {
+        type = types.listOf types.package;
+        default = [ ];
+        description = ''
+          List of themes to install. The list elements are expected to
+          be derivations. All elements in this derivation are automatically
+          copied to the `themes.local` directory.
+        '';
+      };
+
+      logDestination = mkOption {
+        type = types.enum [
+          ""
+          "sql"
+          "syslog"
+        ];
+        default = "sql";
+        description = ''
+          Log destination to use. Possible values: sql (uses internal logging
+          you can read in Preferences -> System), syslog - logs to system log.
+          Setting this to blank uses PHP logging (usually to http server
+          error.log).
+        '';
+      };
+
+      updateDaemon = {
+        commandFlags = mkOption {
+          type = types.str;
+          default = "--quiet";
+          description = ''
+            Command-line flags passed to the update daemon.
+            The default --quiet flag mutes all logging, including errors.
+          '';
+        };
+      };
+
+      extraConfig = mkOption {
+        type = types.lines;
+        default = "";
+        description = ''
+          Additional lines to append to `config.php`.
+        '';
+      };
+    };
+  };
+
+  imports = [
+    (mkRemovedOptionModule [ "services" "tt-rss" "checkForUpdates" ] ''
+      This option was removed because setting this to true will cause TT-RSS
+      to be unable to start if an automatic update of the code in
+      services.tt-rss.root leads to a database schema upgrade that is not
+      supported by the code active in the Nix store.
+    '')
+  ];
+
+  ###### implementation
+
+  config = mkIf cfg.enable {
+
+    assertions = [
+      {
+        assertion = cfg.database.password != null -> cfg.database.passwordFile == null;
+        message = "Cannot set both password and passwordFile";
+      }
+      {
+        assertion =
+          cfg.database.createLocally -> cfg.database.name == cfg.user && cfg.database.user == cfg.user;
+        message = ''
+          When creating a database via NixOS, the db user and db name must be equal!
+          If you already have an existing DB+user and this assertion is new, you can safely set
+          `services.tt-rss.database.createLocally` to `false` because removal of `ensureUsers`
+          and `ensureDatabases` doesn't have any effect.
+        '';
+      }
+    ];
+
+    services.phpfpm.pools = mkIf (cfg.pool == "${poolName}") {
+      ${poolName} = {
+        inherit (cfg) user;
+        inherit phpPackage;
+        settings = mapAttrs (name: mkDefault) {
+          "listen.owner" = "nginx";
+          "listen.group" = "nginx";
+          "listen.mode" = "0600";
+          "pm" = "dynamic";
+          "pm.max_children" = 75;
+          "pm.start_servers" = 10;
+          "pm.min_spare_servers" = 5;
+          "pm.max_spare_servers" = 20;
+          "pm.max_requests" = 500;
+          "catch_workers_output" = 1;
+        };
+      };
+    };
+
+    # NOTE: No configuration is done if not using virtual host
+    services.nginx = mkIf (cfg.virtualHost != null) {
+      enable = true;
+      virtualHosts = {
+        ${cfg.virtualHost} = {
+          root = "${cfg.root}/www";
+
+          locations."/" = {
+            index = "index.php";
+          };
+
+          # some clients might still access this old path directly, forward them to the API instead
+          # e.g. https://apps.apple.com/de/app/tiny-reader-rss/id689519762 at version 2.2.0
+          locations."~* /feed-icons/(\\d+)\\.ico" = {
+            return = "302 /public.php?op=feed_icon&id=$1";
+          };
+
+          locations."~ \\.php$" = {
+            extraConfig = ''
+              fastcgi_split_path_info ^(.+\.php)(/.+)$;
+              fastcgi_pass unix:${config.services.phpfpm.pools.${cfg.pool}.socket};
+              fastcgi_index index.php;
+            '';
+          };
+        };
+      };
+    };
+
+    systemd.tmpfiles.rules = [
+      "d '${cfg.root}' 0555 ${cfg.user} tt_rss - -"
+      "d '${cfg.root}/lock' 0755 ${cfg.user} tt_rss - -"
+      "d '${cfg.root}/cache' 0755 ${cfg.user} tt_rss - -"
+      "d '${cfg.root}/cache/upload' 0755 ${cfg.user} tt_rss - -"
+      "d '${cfg.root}/cache/images' 0755 ${cfg.user} tt_rss - -"
+      "d '${cfg.root}/cache/export' 0755 ${cfg.user} tt_rss - -"
+      "d '${cfg.root}/cache/feed-icons' 0755 ${cfg.user} tt_rss - -"
+      "L+ '${cfg.root}/www' - - - - ${servedRoot}"
+    ];
+
+    systemd.services = {
+      phpfpm-tt-rss = mkIf (cfg.pool == "${poolName}") {
+        restartTriggers = [ servedRoot ];
+      };
+
+      tt-rss = {
+        description = "Tiny Tiny RSS feeds update daemon";
+
+        preStart = ''
+          ${phpPackage}/bin/php ${cfg.root}/www/update.php --update-schema --force-yes
+        '';
+
+        serviceConfig = {
+          User = "${cfg.user}";
+          Group = "tt_rss";
+          ExecStart = "${phpPackage}/bin/php ${cfg.root}/www/update.php --daemon ${cfg.updateDaemon.commandFlags}";
+          Restart = "on-failure";
+          RestartSec = "60";
+          SyslogIdentifier = "tt-rss";
+        };
+
+        wantedBy = [ "multi-user.target" ];
+        requires = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.target";
+        after = [
+          "network.target"
+        ]
+        ++ optional mysqlLocal "mysql.service"
+        ++ optional pgsqlLocal "postgresql.target";
+      };
+    };
+
+    services.mysql = mkIf mysqlLocal {
+      enable = true;
+      package = mkDefault pkgs.mariadb;
+      ensureDatabases = [ cfg.database.name ];
+      ensureUsers = [
+        {
+          name = cfg.user;
+          ensurePermissions = {
+            "${cfg.database.name}.*" = "ALL PRIVILEGES";
+          };
+        }
+      ];
+    };
+
+    services.postgresql = mkIf pgsqlLocal {
+      enable = mkDefault true;
+      ensureDatabases = [ cfg.database.name ];
+      ensureUsers = [
+        {
+          name = cfg.database.user;
+          ensureDBOwnership = true;
+        }
+      ];
+    };
+
+    users.users.tt_rss = optionalAttrs (cfg.user == "tt_rss") {
+      description = "tt-rss service user";
+      isSystemUser = true;
+      group = "tt_rss";
+    };
+
+    users.groups.tt_rss = { };
+  };
+}

nixos/tests/all-tests.nix

@@ -1582,6 +1582,7 @@ in
   trickster = runTest ./trickster.nix;
   trilium-server = runTestOn [ "x86_64-linux" ] ./trilium-server.nix;
   tsm-client-gui = runTest ./tsm-client-gui.nix;
+  tt-rss = runTest ./web-apps/tt-rss.nix;
   ttyd = runTest ./web-servers/ttyd.nix;
   tuliprox = runTest ./tuliprox.nix;
   tuned = runTest ./tuned.nix;

nixos/tests/web-apps/tt-rss.nix

@@ -0,0 +1,45 @@
+{ ... }:
+{
+  name = "tt-rss-nixos";
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.tt-rss = {
+        enable = true;
+        virtualHost = "localhost";
+        selfUrlPath = "http://localhost/";
+        pluginPackages = with pkgs; [
+          tt-rss-plugin-auth-ldap
+          tt-rss-plugin-feediron
+        ];
+        plugins = [
+          "auth_internal"
+          "feediron"
+          "note"
+        ];
+        singleUserMode = true;
+        themePackages = with pkgs; [ tt-rss-theme-feedly ];
+      };
+    };
+
+  testScript = ''
+    import json
+    import re
+    machine.wait_for_unit("tt-rss.service")
+
+    matches = re.search('__csrf_token = "([^"]*)"', machine.succeed("curl -sSfL --cookie cjar --cookie-jar cjar -sSfL http://localhost/"))
+    if matches is None:
+      assert False, "CSRF token not found"
+    csrf_token = matches.group(1)
+
+    # Ensure themes are loaded. No API found for these, so it's a crude check.
+    preference_page = machine.succeed("curl -sSfL --cookie cjar --cookie-jar cjar http://localhost/backend.php?op=Pref_Prefs")
+    assert "feedly" in preference_page
+
+    plugins = json.loads(machine.succeed(f"curl -sSfL --cookie cjar --cookie-jar cjar 'http://localhost/backend.php' -X POST --data-raw 'op=Pref_Prefs&method=getPluginsList&csrf_token={csrf_token}'"))["plugins"]
+    expected_plugins = ["auth_internal", "auth_ldap", "feediron", "note"];
+    found_plugins = [p["name"] for p in plugins if p["name"] in expected_plugins]
+    assert len(found_plugins) == len(expected_plugins), f"Expected plugins {expected_plugins}, found {found_plugins}"
+  '';
+}

pkgs/build-support/fetchgit/default.nix

@@ -47,7 +47,7 @@ lib.makeOverridable (
 
       # Hashes, handled by `lib.fetchers.withNormalizedHash`
       # whose outputs contain outputHash* attributes.
-      "hash"
+      # Use `hash` when overriding with `<pkg>.overrideAttrs`.
       "sha256"
     ];
 
@@ -131,6 +131,11 @@ lib.makeOverridable (
           server admins start using the new version?
         */
 
+        let
+          finalHashHasColon = lib.hasInfix ":" finalAttrs.hash;
+          finalHashColonMatch = lib.match "([^:]+)[:](.*)" finalAttrs.hash;
+        in
+
         derivationArgs
         // {
           inherit name;
@@ -145,7 +150,20 @@ lib.makeOverridable (
           ++ lib.optionals fetchLFS [ git-lfs ]
           ++ nativeBuildInputs;
 
-          inherit outputHash outputHashAlgo;
+          hash =
+            if outputHashAlgo == null || outputHash == "" || lib.hasPrefix outputHashAlgo outputHash then
+              outputHash
+            else
+              "${outputHashAlgo}:${outputHash}";
+
+          outputHash =
+            if finalAttrs.hash == "" then
+              lib.fakeHash
+            else if finalHashHasColon then
+              lib.elemAt finalHashColonMatch 1
+            else
+              finalAttrs.hash;
+          outputHashAlgo = if finalHashHasColon then lib.head finalHashColonMatch else null;
           outputHashMode = "recursive";
 
           sparseCheckout =

pkgs/build-support/fetchurl/default.nix

@@ -64,7 +64,6 @@ lib.extendMkDerivation {
     "derivationArgs"
 
     # Hash attributes will be map to the corresponding outputHash*
-    "hash"
     "sha1"
     "sha256"
     "sha512"
@@ -214,12 +213,15 @@ lib.extendMkDerivation {
           }
         else if cacert != null then
           {
-            outputHashAlgo = "sha256";
-            outputHash = "";
+            outputHashAlgo = null;
+            outputHash = lib.fakeHash;
           }
         else
           throw "fetchurl requires a hash for fixed-output derivation: ${lib.generators.toPretty { } urls_}";
 
+      finalHashHasColon = lib.hasInfix ":" finalAttrs.hash;
+      finalHashColonMatch = lib.match "([^:]+)[:](.*)" finalAttrs.hash;
+
       resolvedUrl =
         let
           mirrorSplit = lib.match "mirror://([[:alpha:]]+)/(.+)" url;
@@ -259,7 +261,23 @@ lib.extendMkDerivation {
       preferHashedMirrors = false;
 
       # New-style output content requirements.
-      inherit (hash_) outputHashAlgo outputHash;
+      hash =
+        if
+          hash_.outputHashAlgo == null
+          || hash_.outputHash == ""
+          || lib.hasPrefix hash_.outputHashAlgo hash_.outputHash
+        then
+          hash_.outputHash
+        else
+          "${hash_.outputHashAlgo}:${hash_.outputHash}";
+      outputHashAlgo = if finalHashHasColon then lib.head finalHashColonMatch else null;
+      outputHash =
+        if finalAttrs.hash == "" then
+          lib.fakeHash
+        else if finalHashHasColon then
+          lib.elemAt finalHashColonMatch 1
+        else
+          finalAttrs.hash;
 
       # Disable TLS verification only when we know the hash and no credentials are
       # needed to access the resource

pkgs/by-name/ai/airwin2rack/package.nix

@@ -49,8 +49,8 @@ let
   clapJuceExtensions = fetchFromGitHub {
     owner = "free-audio";
     repo = "clap-juce-extensions";
-    rev = "4f33b4930b6af806018c009f0f24b3a50808af99";
-    hash = "sha256-M+T7ll3Ap6VIP5ub+kfEKwT2RW2IxxY4wUPRQKFIotk=";
+    rev = "645ed2fd0949d36639e3d63333f26136df6df769";
+    hash = "sha256-Lx88nyEFjPLA5yh8rrqBdyZIxe/j0FgIHoyKcbjuuI4=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/al/alist/package.nix

@@ -9,16 +9,15 @@
   versionCheckHook,
   callPackage,
 }:
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "alist";
-  version = "3.45.0";
-  webVersion = "3.45.0";
+  version = "3.55.0";
 
   src = fetchFromGitHub {
     owner = "AlistGo";
     repo = "alist";
-    tag = "v${version}";
-    hash = "sha256-h8oWeTX3z3xye5O4+s7LA7Wm36JOrsU+UdKGZXaDKXk=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-/psFL/dCG82y1uWEcg45JG6S7+MD0avqU/HjrR+vklA=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -30,13 +29,9 @@ buildGoModule rec {
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-  web = fetchzip {
-    url = "https://github.com/AlistGo/alist-web/releases/download/${webVersion}/dist.tar.gz";
-    hash = "sha256-rNVa+dr/SX2aYHBzeV8QdD5XYCFyelhbqkTpvhF+S2g=";
-  };
 
   proxyVendor = true;
-  vendorHash = "sha256-IMoLVAgOaVM1xIFDe8BGOpzyBnDMfD9Q6VogFfOWFzU=";
+  vendorHash = "sha256-aRnS3LLG25FK1ELKd7K1e5aGLmKnQ7w/3QVe4P9RRLI=";
 
   buildInputs = [ fuse ];
 
@@ -46,13 +41,13 @@ buildGoModule rec {
     "-s"
     "-w"
     "-X \"github.com/alist-org/alist/v3/internal/conf.GitAuthor=Xhofe <i@nn.ci>\""
-    "-X github.com/alist-org/alist/v3/internal/conf.Version=${version}"
-    "-X github.com/alist-org/alist/v3/internal/conf.WebVersion=${webVersion}"
+    "-X github.com/alist-org/alist/v3/internal/conf.Version=${finalAttrs.version}"
+    "-X github.com/alist-org/alist/v3/internal/conf.WebVersion=${finalAttrs.passthru.webVersion}"
   ];
 
   preConfigure = ''
     rm -rf public/dist
-    cp -r ${web} public/dist
+    cp -r ${finalAttrs.passthru.web} public/dist
   '';
 
   preBuild = ''
@@ -92,12 +87,17 @@ buildGoModule rec {
 
   passthru = {
     updateScript = lib.getExe (callPackage ./update.nix { });
+    webVersion = "3.55.0";
+    web = fetchzip {
+      url = "https://github.com/AlistGo/alist-web/releases/download/${finalAttrs.passthru.webVersion}/dist.tar.gz";
+      hash = "sha256-v0o4G2mzd63sShJZRjijIFAUB+ocvF4jspxf841lZ8U=";
+    };
   };
 
   meta = {
     description = "File list/WebDAV program that supports multiple storages";
     homepage = "https://github.com/alist-org/alist";
-    changelog = "https://github.com/alist-org/alist/releases/tag/v${version}";
+    changelog = "https://github.com/alist-org/alist/releases/tag/v${finalAttrs.version}";
     license = with lib.licenses; [
       agpl3Only
       # alist-web
@@ -115,4 +115,4 @@ buildGoModule rec {
     ];
     mainProgram = "alist";
   };
-}
+})

pkgs/by-name/ap/apostrophe/package.nix

@@ -5,7 +5,7 @@
   libspelling,
   fetchFromGitHub,
   python312Packages,
-  nodePackages,
+  mathjax,
   meson,
   ninja,
   pkg-config,
@@ -57,7 +57,7 @@ python312Packages.buildPythonApplication {
   # Use mathjax from nixpkgs to avoid loading from CDN
   + ''
     substituteInPlace apostrophe/preview_converter.py \
-      --replace-fail "--mathjax" "--mathjax=file://${nodePackages.mathjax}/lib/node_modules/mathjax/es5/tex-chtml-full.js"
+      --replace-fail "--mathjax" "--mathjax=file://${mathjax}/lib/node_modules/mathjax/tex-chtml-full.js"
   '';
 
   # Should be done in postInstall, but meson checks this eagerly before build

pkgs/by-name/ba/bazaar/package.nix

@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bazaar";
-  version = "0.5.10";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "kolunmi";
     repo = "bazaar";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-isswXfOJZ04MQbaQ6AcNSxasNllGSRS6vukskS0FvCk=";
+    hash = "sha256-78X2Vxytxan0OD7cNgL1y4LUBaqgoKb+k80sCIi9ag4=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/cl/clickhouse-backup/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "clickhouse-backup";
-  version = "2.6.39";
+  version = "2.6.41";
 
   src = fetchFromGitHub {
     owner = "Altinity";
     repo = "clickhouse-backup";
     rev = "v${version}";
-    hash = "sha256-fx300EyGm9iy4kozcffh8KZz/EYF6yqkdNLSqW1dYQg=";
+    hash = "sha256-o7twdOyd53rP95Pi+l5MIo+U/lDqB0cynqONokfy8do=";
   };
 
-  vendorHash = "sha256-MwyjjEePxcwcESfBhmFtYy8aOI50HL7x05cJyGk5gGg=";
+  vendorHash = "sha256-UxbQ/Q4HsTBkbIMBdeKns6t8tZnfdBRaHDMOA2RYDLI=";
 
   ldflags = [
     "-X main.version=${version}"

pkgs/by-name/fb/fblog/package.nix

@@ -2,26 +2,35 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "fblog";
-  version = "4.16.0";
+  version = "4.17.0";
 
   src = fetchFromGitHub {
     owner = "brocode";
     repo = "fblog";
-    rev = "v${version}";
-    hash = "sha256-SWwk7qNe2R1aBYGBFqltUZjeOvr4jG1P7/CPIAfHCc8=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-SDOYW9CpC7E62nVnZL04Kx9ckVEZyvcMolJCfKDqdMk=";
   };
 
-  cargoHash = "sha256-du9FXuUNqQm1AMqcCFqeso5OPrPCxzTVl5e7kR0rpwc=";
+  cargoHash = "sha256-Pn8HsBz+5OHz4jF6xmORLQSLYClTHpaJXWiS5sPyV2w=";
 
-  meta = with lib; {
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     description = "Small command-line JSON log viewer";
     mainProgram = "fblog";
     homepage = "https://github.com/brocode/fblog";
-    license = licenses.wtfpl;
-    maintainers = [ ];
+    changelog = "https://github.com/brocode/fblog/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.wtfpl;
+    maintainers = [ lib.maintainers.progrm_jarvis ];
   };
-}
+})

pkgs/by-name/fo/forgejo-runner/package.nix

@@ -38,6 +38,10 @@ let
     # These tests rely on outbound IP address
     "TestHandler"
     "TestHandler_gcCache"
+  ]
+  ++ lib.optionals stdenv.isDarwin [
+    # Uses docker-specific options, unsupported on Darwin
+    "TestMergeJobOptions"
   ];
 in
 buildGoModule rec {
@@ -91,8 +95,6 @@ buildGoModule rec {
   };
 
   meta = with lib; {
-    # Cannot process container options: '--pid=host --device=/dev/sda': 'unknown server OS: darwin'
-    broken = stdenv.hostPlatform.isDarwin;
     description = "Runner for Forgejo based on act";
     homepage = "https://code.forgejo.org/forgejo/runner";
     changelog = "https://code.forgejo.org/forgejo/runner/releases/tag/${src.rev}";
@@ -102,6 +104,7 @@ buildGoModule rec {
       emilylange
       christoph-heiss
       tebriel
+      nrabulinski
     ];
     mainProgram = "forgejo-runner";
   };

pkgs/by-name/fo/fosrl-pangolin/package.nix

@@ -168,5 +168,9 @@ buildNpmPackage (finalAttrs: {
     ];
     platforms = lib.platforms.linux;
     mainProgram = "pangolin";
+    insecure = true;
+    knownVulnerabilities = [
+      "CVE-2025-55182"
+    ];
   };
 })

pkgs/by-name/fr/froide-govplan/package.nix

@@ -12,12 +12,7 @@
   gettext,
 }:
 let
-  python = python3Packages.python.override {
-    packageOverrides = self: super: {
-      django_5 = super.django_5.override { withGdal = true; };
-      django = super.django_5;
-    };
-  };
+  inherit (froide) python;
 in
 python.pkgs.buildPythonApplication rec {
   pname = "froide-govplan";

pkgs/by-name/fr/froide/package.nix

@@ -191,6 +191,10 @@ python.pkgs.buildPythonApplication rec {
   # Playwright tests not supported on RiscV yet
   doCheck = lib.meta.availableOn stdenv.hostPlatform playwright-driver.browsers;
 
+  passthru = {
+    inherit python;
+  };
+
   meta = {
     description = "Freedom of Information Portal";
     homepage = "https://github.com/okfde/froide";

pkgs/by-name/hy/hyperspeedcube/package.nix

@@ -119,7 +119,10 @@ rustPlatform.buildRustPackage rec {
       records and runs on all major operating systems plus the web.
     '';
     homepage = "https://ajfarkas.dev/hyperspeedcube/";
-    license = lib.licenses.cc-by-nc-sa-40;
+    license = with lib.licenses; [
+      mit
+      asl20
+    ];
     maintainers = [ lib.maintainers.omnipotententity ];
     platforms = [ "x86_64-linux" ];
   };

pkgs/by-name/hy/hyprshell/package.nix

@@ -4,25 +4,25 @@
   fetchFromGitHub,
   pkg-config,
   wrapGAppsHook4,
-  gtk4,
   gtk4-layer-shell,
   hyprland,
   gcc,
   pixman,
+  libadwaita,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "hyprshell";
-  version = "4.7.2";
+  version = "4.8.1";
 
   src = fetchFromGitHub {
     owner = "H3rmt";
     repo = "hyprshell";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6WC7vcPdtKR4iw5VHF88i/NQ+EBfvGxex8AvJONnG5w=";
+    hash = "sha256-NsFOXepWzgbopnoqwg8EekDLbj01jr8vjaEz/F3QFKU=";
   };
 
-  cargoHash = "sha256-g23W5cgGxWNyJ4uew2x12vgF5Bvaid1+phV2fxyHbas=";
+  cargoHash = "sha256-/4mC1cgQKOSOME8WT61hggyHPALj0knVPtGZTa7lO1w=";
 
   nativeBuildInputs = [
     wrapGAppsHook4
@@ -30,7 +30,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   ];
 
   buildInputs = [
-    gtk4
+    libadwaita
     gtk4-layer-shell
   ];
 

pkgs/by-name/io/ioping/package.nix

@@ -2,28 +2,19 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
 }:
 
 stdenv.mkDerivation rec {
   pname = "ioping";
-  version = "1.2";
+  version = "1.3";
 
   src = fetchFromGitHub {
     owner = "koct9i";
     repo = "ioping";
     rev = "v${version}";
-    sha256 = "10bv36bqga8sdifxzywzzpjil7vmy62psirz7jbvlsq1bw71aiid";
+    hash = "sha256-9lJEjns8ttjgI52ZXeWgL77GMd7o7IvefBJ5UH9y9ks=";
   };
 
-  patches = [
-    # add netdata support: https://github.com/koct9i/ioping/pull/41
-    (fetchpatch {
-      url = "https://github.com/koct9i/ioping/commit/e7b818457ddb952cbcc13ae732ba0328f6eb73b3.patch";
-      sha256 = "122ivp4rqsnjszjfn33z8li6glcjhy7689bgipi8cgs5q55j99gf";
-    })
-  ];
-
   makeFlags = [ "PREFIX=$(out)" ];
 
   meta = with lib; {

pkgs/by-name/ku/kubectl-gadget/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "kubectl-gadget";
-  version = "0.46.0";
+  version = "0.47.0";
 
   src = fetchFromGitHub {
     owner = "inspektor-gadget";
     repo = "inspektor-gadget";
     rev = "v${version}";
-    hash = "sha256-y5eqkTt9CnEPOyFERWhBPqrgnMGaVuWN2FoDV0pDjdI=";
+    hash = "sha256-ZGi7zsIphiXNLfVc6u+ZSGsgWWcMaBpyt1BpwS2WRCU=";
   };
 
-  vendorHash = "sha256-TBaMbIwR/7MzPn8rYgjqeMLma3arwr5W9HiTztd8z9E=";
+  vendorHash = "sha256-0vpPBQ1ty4FZMj3bgB56Gu5pNdo7SyhxvGQOHos6m9s=";
 
   env.CGO_ENABLED = 0;
 

pkgs/by-name/le/letterpress/package.nix

@@ -73,7 +73,7 @@ python3Packages.buildPythonApplication rec {
     homepage = "https://apps.gnome.org/Letterpress/";
     changelog = "https://gitlab.gnome.org/World/Letterpress/-/releases/${version}";
     license = licenses.gpl3Plus;
-    maintainers = [ maintainers.dawidd6 ];
+    maintainers = [ ];
     teams = [ teams.gnome-circle ];
     platforms = platforms.linux;
     mainProgram = "letterpress";

pkgs/by-name/ma/mathjax/package.nix

@@ -0,0 +1,35 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "mathjax";
+  version = "4.0.0";
+
+  src = fetchFromGitHub {
+    owner = "mathjax";
+    repo = "mathjax";
+    tag = finalAttrs.version;
+    hash = "sha256-36lTjx4zuFeT1+QFemiQcCZfAjyh7vFPpYeRhO2mzGI=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib/node_modules/mathjax
+    mv * $out/lib/node_modules/mathjax
+    # This is a MathJax v3 compat shim, notably still needed for sagemath
+    ln -s $out/lib/node_modules/mathjax $out/lib/node_modules/mathjax/es5
+
+    runHook postInstall
+  '';
+
+  meta = {
+    changelog = "https://github.com/mathjax/MathJax/releases/tag/${finalAttrs.version}";
+    description = "Beautiful and accessible math in all browsers";
+    homepage = "https://www.mathjax.org/";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ pyrox0 ];
+  };
+})

pkgs/by-name/ne/nebula-lighthouse-service/package.nix

@@ -9,14 +9,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "nebula-lighthouse-service";
-  version = "2.0.0";
+  version = "2.0.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "manuels";
     repo = "nebula-lighthouse-service";
     tag = "v${version}";
-    hash = "sha256-cRwmOGuPEYlURVbaf9AwaSmhvUzzZvATv5RGPUztnbY=";
+    hash = "sha256-I2eoofEAY1Bbk17opx5cHWK4R+n2RE8JOUVGX1409Xk=";
   };
 
   postPatch = ''

pkgs/by-name/ne/networkd-dispatcher/package.nix

@@ -5,6 +5,7 @@
   fetchpatch,
   installShellFiles,
   python3Packages,
+  python3,
   asciidoc,
   wrapGAppsNoGuiHook,
   iw,
@@ -46,10 +47,14 @@ stdenv.mkDerivation rec {
     asciidoc # for a2x
     installShellFiles
     wrapGAppsNoGuiHook
-    python3Packages.wrapPython
   ];
 
-  dontWrapGApps = true;
+  buildInputs = [
+    (python3.withPackages (ps: [
+      ps.dbus-python
+      ps.pygobject3
+    ]))
+  ];
 
   checkInputs = with python3Packages; [
     dbus-python
@@ -59,14 +64,10 @@ stdenv.mkDerivation rec {
     pytestCheckHook
   ];
 
-  pythonPath = with python3Packages; [
-    dbus-python
-    pygobject3
-  ];
-
   installPhase = ''
     runHook preInstall
     install -D -m755 -t $out/bin networkd-dispatcher
+    patchShebangs --host $out/bin/networkd-dispatcher
     install -Dm644 networkd-dispatcher.service $out/lib/systemd/system/networkd-dispatcher.service
     install -Dm644 networkd-dispatcher.conf $out/etc/conf.d/networkd-dispatcher.conf
     installManPage networkd-dispatcher.8
@@ -76,13 +77,7 @@ stdenv.mkDerivation rec {
   doCheck = true;
 
   preFixup = ''
-    makeWrapperArgs+=( \
-      "''${gappsWrapperArgs[@]}" \
-      --prefix PATH : "${lib.makeBinPath [ iw ]}" \
-    )
-  '';
-  postFixup = ''
-    wrapPythonPrograms
+    gappsWrapperArgs+=("--prefix" "PATH" ":" "${lib.makeBinPath [ iw ]}")
   '';
 
   meta = with lib; {

pkgs/by-name/nh/nh-unwrapped/package.nix

@@ -4,12 +4,13 @@
   rustPlatform,
   installShellFiles,
   fetchFromGitHub,
+  fetchpatch,
   nix-update-script,
   buildPackages,
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "nh-unwrapped";
-  version = "4.2.0";
+  version = "4.2.0"; # Did you remove the patch below (and this comment)?
 
   src = fetchFromGitHub {
     owner = "nix-community";
@@ -18,6 +19,13 @@ rustPlatform.buildRustPackage (finalAttrs: {
     hash = "sha256-6n5SVO8zsdVTD691lri7ZcO4zpqYFU8GIvjI6dbxkA8=";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/nix-community/nh/commit/8bf323483166797a204579a43ed8810113eb128c.patch";
+      hash = "sha256-hg0LgDPjiPWR+1DRzqORv6QPlrds7ys4PTDXFw6PUoI=";
+    })
+  ];
+
   strictDeps = true;
 
   nativeBuildInputs = [
@@ -56,6 +64,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     mainProgram = "nh";
     maintainers = with lib.maintainers; [
       NotAShelf
+      mdaniels5757
       viperML
       midischwarz12
     ];

pkgs/by-name/np/nps/package.nix

@@ -1,25 +1,28 @@
 {
   lib,
   nix,
+  nix-update-script,
   fetchFromGitHub,
   rustPlatform,
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "nps";
-  version = "0.2.9";
+  version = "0.2.12";
 
   src = fetchFromGitHub {
     owner = "OleMussmann";
     repo = "nps";
     tag = "v${version}";
-    hash = "sha256-q/PkigsNAI7MCmeDFBMGuZJFXVL95pQCNOVhNvBH9dc=";
+    hash = "sha256-kOVpn13lJYeO/99e39c0wbe7qcKHyMj5v4prBtZ3N7s=";
   };
 
-  cargoHash = "sha256-MThyvhzZXRM4l0K8csLDldMVKiDxKZ5EIFATGVpGpVc=";
+  cargoHash = "sha256-dJA9fOU06txPAx5kMl7aGoFeKo7UXqB7X+viUfJqG/M=";
 
   nativeCheckInputs = [ nix ];
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Cache the nix package list, query and sort results by relevance";
     longDescription = ''
@@ -38,7 +41,10 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/OleMussmann/nps";
     license = lib.licenses.mit;
     mainProgram = "nps";
-    maintainers = with lib.maintainers; [ olemussmann ];
+    maintainers = with lib.maintainers; [
+      mdaniels5757
+      olemussmann
+    ];
     platforms = lib.platforms.all;
   };
 }

pkgs/by-name/ol/ollama/package.nix

@@ -138,13 +138,13 @@ in
 goBuild (finalAttrs: {
   pname = "ollama";
   # don't forget to invalidate all hashes each update
-  version = "0.13.1";
+  version = "0.13.2";
 
   src = fetchFromGitHub {
     owner = "ollama";
     repo = "ollama";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1+ACdAaad74LttkdJ9L/T0PFNNkBWHKuOpVczv6iQeA=";
+    hash = "sha256-ffovCXdL/Ooo2Gi/G/A5d+vIwa9LFnaiV1931x2vyG8=";
   };
 
   vendorHash = "sha256-NM0vtue0MFrAJCjmpYJ/rPEDWBxWCzBrWDb0MVOhY+Q=";

pkgs/by-name/pa/parseable/package.nix

@@ -11,21 +11,21 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "parseable";
-  version = "2.4.0";
+  version = "2.5.1";
 
   src = fetchFromGitHub {
     owner = "parseablehq";
     repo = "parseable";
     tag = "v${version}";
-    hash = "sha256-0PyXrwFh2YroxeAPL2GCZiOUfzFLThN0ZnL0a7BDnfw=";
+    hash = "sha256-+KTSpkrMlIu24YvHvLOLHZiqRZua3D7/kprFqtRuNOQ=";
   };
 
   LOCAL_ASSETS_PATH = fetchzip {
     url = "https://parseable-prism-build.s3.us-east-2.amazonaws.com/v${version}/build.zip";
-    hash = "sha256-7uJvWAGDexzWhnm1ofPHzoRD8Q70fQ+eyUPpQHcWv4o=";
+    hash = "sha256-tSH9gyB9T2ywut+joLIp55Us2ALKvgsyiG/gBQgYLfI=";
   };
 
-  cargoHash = "sha256-VAdivS7zxoFrjeTnRGbUqtEgCj73iF29ZiCUfzdP1Yo=";
+  cargoHash = "sha256-3hMGiQmXxar4n4cGPrj4UUznNi8V5YokH+29UGmz34Y=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/pa/pavucontrol/package.nix

@@ -19,14 +19,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pavucontrol";
-  version = "6.1";
+  version = "6.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "pulseaudio";
     repo = "pavucontrol";
-    rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-cru4I+LljYKIpIr7gSolnuLuUIXgc8l+JUmPrme4+YA=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-If76Qt2BFgGMYt2PSzDQWmNPsbzneZ6zW9yYnS3lo84=";
   };
 
   buildInputs = [
@@ -48,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   mesonFlags = [
     "--prefix=${placeholder "out"}"
-    (lib.mesonBool "lynx" false)
+    (lib.mesonEnable "lynx" false)
   ];
 
   enableParallelBuilding = true;

pkgs/by-name/pd/pdf2djvu/package.nix

@@ -1,69 +0,0 @@
-{
-  stdenv,
-  lib,
-  fetchFromGitHub,
-  autoreconfHook,
-  gettext,
-  libtool,
-  pkg-config,
-  djvulibre,
-  exiv2,
-  fontconfig,
-  graphicsmagick,
-  libjpeg,
-  libuuid,
-  poppler,
-}:
-
-stdenv.mkDerivation rec {
-  version = "0.9.19";
-  pname = "pdf2djvu";
-
-  src = fetchFromGitHub {
-    owner = "jwilk";
-    repo = "pdf2djvu";
-    rev = version;
-    sha256 = "sha256-j4mYdmLZ56qTA1KbWBjBvyTyLaeuIITKYsALRIO7lj0=";
-  };
-
-  nativeBuildInputs = [
-    autoreconfHook
-    pkg-config
-  ];
-
-  buildInputs = [
-    djvulibre
-    exiv2
-    fontconfig
-    graphicsmagick
-    libjpeg
-    libuuid
-    poppler
-  ];
-
-  postPatch = ''
-    substituteInPlace private/autogen \
-      --replace /usr/share/gettext ${gettext}/share/gettext \
-      --replace /usr/share/libtool ${libtool}/share/libtool
-
-    substituteInPlace configure.ac \
-      --replace '$djvulibre_bin_path' ${djvulibre.bin}/bin
-  '';
-
-  preAutoreconf = ''
-    private/autogen
-  '';
-
-  enableParallelBuilding = true;
-
-  # Required by Poppler
-  CXXFLAGS = "-std=c++20";
-
-  meta = with lib; {
-    description = "Creates djvu files from PDF files";
-    homepage = "https://jwilk.net/software/pdf2djvu";
-    license = licenses.gpl2Only;
-    maintainers = with maintainers; [ pSub ];
-    mainProgram = "pdf2djvu";
-  };
-}

pkgs/by-name/pe/peazip/package.nix

@@ -24,13 +24,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "peazip";
-  version = "10.7.0";
+  version = "10.8.0";
 
   src = fetchFromGitHub {
     owner = "peazip";
     repo = "peazip";
     rev = finalAttrs.version;
-    hash = "sha256-JVSr4ztDHjJF+vzhaMSSAWt6PEtxNzfCRBQBlfLA4xs=";
+    hash = "sha256-A95rFW5kZ+gUbaLkAXRKu8jaBb43ONX+2wZXDWfT2G4=";
   };
   sourceRoot = "${finalAttrs.src.name}/peazip-sources";
 

pkgs/by-name/ph/phpunit/package.nix

@@ -10,16 +10,16 @@
 
 php.buildComposerProject2 (finalAttrs: {
   pname = "phpunit";
-  version = "12.4.4";
+  version = "12.5.1";
 
   src = fetchFromGitHub {
     owner = "sebastianbergmann";
     repo = "phpunit";
     tag = finalAttrs.version;
-    hash = "sha256-J57kK1wtiNJ54pAwnQNxvqdmA/omVyZKrnRJSeNX0Tg=";
+    hash = "sha256-fbHHoqCHL3KizoVRWm+Dj+nfb5CLF8SGfMc1D2OjbHY=";
   };
 
-  vendorHash = "sha256-xaOM6BHaW4aEm5tAv3zFRg4QpV8L3p8y7KoipWtnqKI=";
+  vendorHash = "sha256-CuH86qqKVIQSRgTslKWBt8c9G06Ti6hbFw3bQ0ouL3k=";
 
   passthru = {
     updateScript = nix-update-script { };

pkgs/by-name/pr/prettier-plugin-jinja-template/package.nix

@@ -0,0 +1,30 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+buildNpmPackage (finalAttrs: {
+  pname = "prettier-plugin-jinja-template";
+  version = "2.1.0";
+
+  src = fetchFromGitHub {
+    owner = "davidodenwald";
+    repo = "prettier-plugin-jinja-template";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-qAmN4VJCJana7YbrQC/51JKCbP2DN10HpIt+S88yvPE=";
+  };
+
+  npmDepsHash = "sha256-/m0+z2fSwX77zRY4Yg4xdyI/ZEzAKNUuicaqz0b8f5w=";
+
+  passthru.update-script = nix-update-script { };
+
+  meta = {
+    description = "Formatter plugin for Jinja2 template files";
+    homepage = "https://github.com/davidodenwald/prettier-plugin-jinja-template";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ adamperkowski ];
+    mainProgram = "prettier-plugin-jinja-template";
+  };
+})

pkgs/by-name/re/readest/package.nix

@@ -20,13 +20,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "readest";
-  version = "0.9.94";
+  version = "0.9.95";
 
   src = fetchFromGitHub {
     owner = "readest";
     repo = "readest";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yDMVkcypw+7zoVAUeVL23agNr8rG3gvNJFbVJW/VNKY=";
+    hash = "sha256-0fWxmip7Emu4z4v5VyV0nW9Dj1JvOOLJub1szboawP8=";
     fetchSubmodules = true;
   };
 
@@ -40,7 +40,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     fetcherVersion = 1;
-    hash = "sha256-Q+kGrf24zKeLyM4JhSXXKtKRGQbwwiHm+aUuHHSyN/U=";
+    hash = "sha256-hYwkPqePFPEdqZ3w0mNvNEypsVL1PKv29LFk7b11zkg=";
   };
 
   pnpmRoot = "../..";

pkgs/by-name/sa/sage/package.nix

@@ -10,7 +10,7 @@
 # is always preferred, see `sage-src.nix` for that.
 
 let
-  inherit (pkgs) symlinkJoin callPackage nodePackages;
+  inherit (pkgs) symlinkJoin callPackage mathjax;
 
   python3 = pkgs.python3 // {
     pkgs = pkgs.python3.pkgs.overrideScope (
@@ -66,7 +66,7 @@ let
     inherit singular maxima;
     inherit three;
     cysignals = python3.pkgs.cysignals;
-    mathjax = nodePackages.mathjax;
+    mathjax = mathjax;
   };
 
   # The shell file that gets sourced on every sage start. Will also source

pkgs/by-name/tt/tt-rss-plugin-auth-ldap/package.nix

@@ -0,0 +1,34 @@
+{
+  lib,
+  nixosTests,
+  stdenv,
+  fetchFromGitHub,
+}:
+
+stdenv.mkDerivation {
+  pname = "tt-rss-plugin-auth-ldap";
+  version = "unstable-2022-11-30";
+
+  src = fetchFromGitHub {
+    owner = "hydrian";
+    repo = "TTRSS-Auth-LDAP";
+    rev = "582ade49fd433a30b403caa1d0689fca5f3c99e1";
+    sha256 = "sha256-favz/2KvWqvv8ehTv3gc7TBbFDjkrOmutChnyKPgces=";
+  };
+
+  installPhase = ''
+    install -D plugins/auth_ldap/init.php $out/auth_ldap/init.php
+  '';
+
+  passthru = {
+    tests = { inherit (nixosTests) tt-rss; };
+  };
+
+  meta = with lib; {
+    description = "Plugin for TT-RSS to authenticate users via ldap";
+    license = licenses.asl20;
+    homepage = "https://github.com/hydrian/TTRSS-Auth-LDAP";
+    maintainers = with maintainers; [ mic92 ];
+    platforms = platforms.all;
+  };
+}

pkgs/by-name/tt/tt-rss-plugin-data-migration/package.nix

@@ -0,0 +1,33 @@
+{
+  lib,
+  stdenv,
+  fetchgit,
+}:
+
+stdenv.mkDerivation {
+  pname = "tt-rss-plugin-data-migration";
+  version = "0-unstable-2023-11-01";
+
+  src = fetchgit {
+    url = "https://git.tt-rss.org/fox/ttrss-data-migration.git";
+    rev = "e13d5f97b4887ce7b57b3d76228d838dec15963d";
+    hash = "sha256-xnbR5IQ0h7ilxchNj55ROZdq1L7MIAwv3/00k09WTTs=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D init.php $out/data_migration/init.php
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Plugin for TT-RSS to exports and imports *all* articles of a specific user via neutral format (JSON files in a ZIP archive)";
+    # this plugin doesn't have a license file
+    license = lib.licenses.unfree;
+    homepage = "https://git.tt-rss.org/fox/ttrss-data-migration.git/";
+    maintainers = with lib.maintainers; [ wrvsrx ];
+    platforms = lib.platforms.all;
+  };
+}

pkgs/by-name/tt/tt-rss-plugin-feediron/package.nix

@@ -0,0 +1,38 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  tt-rss,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "tt-rss-plugin-feediron";
+  version = "1.33";
+
+  src = fetchFromGitHub {
+    owner = "feediron";
+    repo = "ttrss_plugin-feediron";
+    rev = "v${version}";
+    sha256 = "sha256-KU4XQJNK7Ua7rZaXA32lv16RlloCysAb54E5kEY847A=";
+  };
+
+  installPhase = ''
+    mkdir -p $out/feediron
+
+    cp -r bin filters init.php preftab recipes $out/feediron/
+  '';
+
+  meta = with lib; {
+    description = "Evolution of ttrss_plugin-af_feedmod";
+    longDescription = ''
+      This is a plugin for Tiny Tiny RSS (tt-rss).
+      It allows you to replace an article's contents by the contents of an element on the linked URL's page
+
+      i.e. create a "full feed".
+    '';
+    license = licenses.mit;
+    homepage = "https://github.com/feediron/ttrss_plugin-feediron";
+    maintainers = with maintainers; [ milogert ];
+    inherit (tt-rss.meta) platforms;
+  };
+}

pkgs/by-name/tt/tt-rss-plugin-ff-instagram/package.nix

@@ -0,0 +1,37 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+}:
+
+stdenv.mkDerivation {
+  pname = "tt-rss-plugin-ff-instagram";
+  version = "0-unstable-2019-01-10"; # No release, see https://github.com/wltb/ff_instagram/issues/6
+
+  src = fetchFromGitHub {
+    owner = "wltb";
+    repo = "ff_instagram";
+    rev = "0366ffb18c4d490c8fbfba2f5f3367a5af23cfe8";
+    sha256 = "0vvzl6wi6jmrqknsfddvckjgsgfizz1d923d1nyrpzjfn6bda1vk";
+  };
+
+  installPhase = ''
+    mkdir -p $out/ff_instagram
+
+    cp *.php $out/ff_instagram
+  '';
+
+  meta = with lib; {
+    broken = true; # Plugin code does not conform to plugin API changes. See https://github.com/wltb/ff_instagram/issues/13
+    description = "Plugin for Tiny Tiny RSS that allows to fetch posts from Instagram user sites";
+    longDescription = ''
+      Plugin for Tiny Tiny RSS that allows to fetch posts from Instagram user sites.
+
+      The name of the plugin in TT-RSS is 'ff_instagram'.
+    '';
+    license = licenses.agpl3Plus;
+    homepage = "https://github.com/wltb/ff_instagram";
+    maintainers = with maintainers; [ gileri ];
+    platforms = platforms.all;
+  };
+}

pkgs/by-name/tt/tt-rss-plugin-freshapi/package.nix

@@ -0,0 +1,35 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+}:
+
+stdenv.mkDerivation {
+  pname = "tt-rss-plugin-freshapi";
+  version = "0-unstable-2024-11-14";
+
+  src = fetchFromGitHub {
+    owner = "eric-pierce";
+    repo = "freshapi";
+    rev = "44c98f12e8a4423501fc6d8cb7903cca11094dc6";
+    hash = "sha256-1cQ4QMrXOdtelAbmMEuhWJPFi5XrAoR3IGlFzb8122k=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D init.php $out/freshapi/init.php
+    install -D api/greader.php $out/freshapi/api/greader.php
+    install -D api/freshapi.php $out/freshapi/api/freshapi.php
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "FreshRSS / Google Reader API Plugin for Tiny-Tiny RSS";
+    license = lib.licenses.agpl3Only;
+    homepage = "https://github.com/eric-pierce/freshapi";
+    maintainers = with lib.maintainers; [ wrvsrx ];
+    platforms = lib.platforms.all;
+  };
+}

pkgs/by-name/tt/tt-rss-theme-feedly/package.nix

@@ -0,0 +1,38 @@
+{
+  lib,
+  nixosTests,
+  stdenv,
+  fetchFromGitHub,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "tt-rss-theme-feedly";
+  version = "4.1.0";
+
+  src = fetchFromGitHub {
+    owner = "levito";
+    repo = "tt-rss-feedly-theme";
+    rev = "v${version}";
+    sha256 = "sha256-3mD1aY7gjdvucRzY7sLmZ1RsHtraAg1RGE/3uDp6/o4=";
+  };
+
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir $out
+
+    cp -ra feedly *.css $out
+  '';
+
+  passthru = {
+    tests = { inherit (nixosTests) tt-rss; };
+  };
+
+  meta = with lib; {
+    description = "Feedly theme for Tiny Tiny RSS";
+    license = licenses.mit;
+    homepage = "https://github.com/levito/tt-rss-feedly-theme";
+    maintainers = with maintainers; [ das_j ];
+    platforms = platforms.all;
+  };
+}

pkgs/by-name/tt/tt-rss/package.nix

@@ -0,0 +1,49 @@
+# nixpkgs-update: no auto update
+{
+  lib,
+  stdenv,
+  fetchgit,
+  nixosTests,
+  unstableGitUpdater,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "tt-rss";
+  version = "0-unstable-2025-11-01";
+
+  src = fetchgit {
+    url = "https://github.com/tt-rss/tt-rss.git";
+    rev = "912162ad811869af334232d32fe6c79b3cf095ca";
+    hash = "sha256-2U9V4MTWGNZzdVr9AlH/S7KdBGPap+mm5/KieWLcF1A=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir $out
+    cp -ra * $out/
+
+    # see the code of Config::get_version(). you can check that the version in
+    # the footer of the preferences pages is not UNKNOWN
+    echo "${version}" > $out/version_static.txt
+
+    runHook postInstall
+  '';
+
+  passthru = {
+    tests = { inherit (nixosTests) tt-rss; };
+    updateScript = unstableGitUpdater { hardcodeZeroVersion = true; };
+  };
+
+  meta = with lib; {
+    description = "Web-based news feed (RSS/Atom) aggregator";
+    license = licenses.gpl3Plus;
+    homepage = "https://tt-rss.org";
+    maintainers = with maintainers; [
+      gileri
+      globin
+      zohl
+    ];
+    platforms = platforms.all;
+  };
+}

pkgs/by-name/va/vaporizer2/package.nix

@@ -30,6 +30,15 @@ stdenv.mkDerivation (finalAttrs: {
     fetchSubmodules = true;
   };
 
+  postPatch = ''
+    # LTO needs special setup on Linux
+    substituteInPlace CMakeLists.txt \
+      --replace-fail 'juce::juce_recommended_lto_flags' '# Not forcing LTO'
+
+    rm -rf clap-juce-extensions
+    ln -s ${finalAttrs.passthru.clapJuceExtensions} clap-juce-extensions
+  '';
+
   strictDeps = true;
 
   nativeBuildInputs = [
@@ -56,11 +65,13 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeFeature "USE_SYSTEM_JUCE" "ON")
   ];
 
-  # LTO needs special setup on Linux
-  postPatch = ''
-    substituteInPlace CMakeLists.txt \
-      --replace-fail 'juce::juce_recommended_lto_flags' '# Not forcing LTO'
-  '';
+  passthru.clapJuceExtensions = fetchFromGitHub {
+    owner = "free-audio";
+    repo = "clap-juce-extensions";
+    rev = "645ed2fd0949d36639e3d63333f26136df6df769";
+    hash = "sha256-Lx88nyEFjPLA5yh8rrqBdyZIxe/j0FgIHoyKcbjuuI4=";
+    fetchSubmodules = true;
+  };
 
   meta = {
     description = "Wavetable synthesizer";

pkgs/by-name/vi/vicinae/package.nix

@@ -20,13 +20,13 @@
 }:
 gcc15Stdenv.mkDerivation (finalAttrs: {
   pname = "vicinae";
-  version = "0.16.12";
+  version = "0.16.14";
 
   src = fetchFromGitHub {
     owner = "vicinaehq";
     repo = "vicinae";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GolXMuAvhWqljCdMo/9hlY0Vo52Bxx+dnLfYQWr9tk8=";
+    hash = "sha256-G9zuw0IuzOxCeAcLE+IXcsdp0vAGMXBBdlfjBISnL90=";
   };
 
   apiDeps = fetchNpmDeps {

pkgs/by-name/wa/wayland-bongocat/package.nix

@@ -12,12 +12,12 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "wayland-bongocat";
-  version = "1.2.5";
+  version = "1.3.2";
   src = fetchFromGitHub {
     owner = "saatvik333";
     repo = "wayland-bongocat";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VkBuqmen6s/LDFu84skQ3wOpIeURZ5e93lvAiEdny70=";
+    hash = "sha256-hsCNbweWBqCQRCKnVTSQwwQCPz/U2KoqpZZE92Q5BhA=";
   };
 
   # Package dependencies

pkgs/by-name/xr/xreader/package.nix

@@ -20,7 +20,7 @@
   libspectre,
   libgxps,
   webkitgtk_4_1,
-  nodePackages,
+  mathjax,
   ninja,
   djvulibre,
   backends ? [
@@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
   ];
 
   mesonFlags = [
-    "-Dmathjax-directory=${nodePackages.mathjax}"
+    "-Dmathjax-directory=${mathjax}"
     "-Dintrospection=true"
   ]
   ++ (map (x: "-D${x}=true") backends);
@@ -74,7 +74,7 @@ stdenv.mkDerivation rec {
     libspectre
     libgxps
     webkitgtk_4_1
-    nodePackages.mathjax
+    mathjax
     djvulibre
   ];
 

pkgs/desktops/pantheon/apps/elementary-files/default.nix

@@ -26,7 +26,7 @@
 
 stdenv.mkDerivation rec {
   pname = "elementary-files";
-  version = "7.1.6";
+  version = "7.2.0";
 
   outputs = [
     "out"
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
     owner = "elementary";
     repo = "files";
     rev = version;
-    hash = "sha256-z6trjczB+ZLPvWO/R41PTSA1tSBIVD/kMF12TupwId4=";
+    hash = "sha256-m6ICWL2JZoWh3myHLOhrKZ4St8zJcyVWhfozg+kdOng=";
   };
 
   nativeBuildInputs = [

pkgs/desktops/pantheon/services/pantheon-agent-polkit/default.nix

@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pantheon-agent-polkit";
-  version = "8.0.1";
+  version = "8.0.2";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = "pantheon-agent-polkit";
     rev = version;
-    hash = "sha256-qqeB8SLuES/KoK7ycQ2J1YBA07HITovdnO8kSsrVcfs=";
+    hash = "sha256-tuugtrnamY9QMlF/ju5+4gwcEESFqH4jDH/kz790v5Y=";
   };
 
   nativeBuildInputs = [

pkgs/development/haskell-modules/configuration-darwin.nix

@@ -323,6 +323,18 @@ self: super:
       '';
     }) super.di-core;
 
+    # Template Haskell on Darwin fails to load an available symbol in these
+    # transitive dependencies since GHC 9.10.3.
+    # See issue https://github.com/NixOS/nixpkgs/issues/461651
+    hercules-ci-agent = overrideCabal (old: {
+      preBuild = ''
+        DYLD_INSERT_LIBRARIES="''${DYLD_INSERT_LIBRARIES:+$DYLD_INSERT_LIBRARIES:}$(pkg-config --variable=libdir nix-store)/libnixstore.dylib:$(pkg-config --variable=libdir nix-util)/libnixutil.dylib"
+        export DYLD_INSERT_LIBRARIES
+        echo "DYLD_INSERT_LIBRARIES=$DYLD_INSERT_LIBRARIES"
+      ''
+      + (old.preBuild or "");
+    }) super.hercules-ci-agent;
+
     # Require /usr/bin/security which breaks sandbox
     http-reverse-proxy = dontCheck super.http-reverse-proxy;
     servant-auth-server = dontCheck super.servant-auth-server;

pkgs/development/node-packages/aliases.nix

@@ -242,6 +242,7 @@ mapAliases {
   inherit (pkgs) markdown-link-check; # added 2024-06-28
   markdownlint-cli = pkgs.markdownlint-cli; # added 2023-07-29
   inherit (pkgs) markdownlint-cli2; # added 2023-08-22
+  inherit (pkgs) mathjax; # Added 2025-11-28
   inherit (pkgs) mathjax-node-cli; # added 2023-11-02
   mastodon-bot = throw "'mastodon-bot' has been removed because it was archived by upstream in 2021."; # Added 2025-11-07
   mdctl-cli = self."@medable/mdctl-cli"; # added 2023-08-21

pkgs/development/node-packages/node-packages.json

@@ -18,7 +18,6 @@
 , "gulp-cli"
 , "js-yaml"
 , "lcov-result-merger"
-, "mathjax"
 , "node2nix"
 , "postcss"
 , "prebuild-install"

pkgs/development/node-packages/node-packages.nix

@@ -21722,24 +21722,6 @@ in
     bypassCache = true;
     reconstructLock = true;
   };
-  mathjax = nodeEnv.buildNodePackage {
-    name = "mathjax";
-    packageName = "mathjax";
-    version = "3.2.2";
-    src = fetchurl {
-      url = "https://registry.npmjs.org/mathjax/-/mathjax-3.2.2.tgz";
-      sha512 = "Bt+SSVU8eBG27zChVewOicYs7Xsdt40qm4+UpHyX7k0/O9NliPc+x77k1/FEsPsjKPZGJvtRZM1vO+geW0OhGw==";
-    };
-    buildInputs = globalBuildInputs;
-    meta = {
-      description = "Beautiful and accessible math in all browsers. MathJax is an open-source JavaScript display engine for LaTeX, MathML, and AsciiMath notation that works in all browsers. This package includes the packaged components (install mathjax-full to get the source ";
-      homepage = "https://github.com/mathjax/MathJax#readme";
-      license = "Apache-2.0";
-    };
-    production = true;
-    bypassCache = true;
-    reconstructLock = true;
-  };
   node2nix = nodeEnv.buildNodePackage {
     name = "node2nix";
     packageName = "node2nix";

pkgs/development/ocaml-modules/graphql/lwt.nix

@@ -2,7 +2,7 @@
   buildDunePackage,
   alcotest,
   graphql,
-  ocaml_lwt,
+  lwt,
 }:
 
 buildDunePackage {
@@ -10,11 +10,9 @@ buildDunePackage {
 
   inherit (graphql) version src;
 
-  duneVersion = "3";
-
   propagatedBuildInputs = [
     graphql
-    ocaml_lwt
+    lwt
   ];
 
   checkInputs = [ alcotest ];

pkgs/development/python-modules/ansible-compat/default.nix

@@ -86,6 +86,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/ansible/ansible-compat";
     changelog = "https://github.com/ansible/ansible-compat/releases/tag/${src.tag}";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ dawidd6 ];
+    maintainers = [ ];
   };
 }

pkgs/development/python-modules/caldav/default.nix

@@ -1,8 +1,10 @@
 {
   lib,
   buildPythonPackage,
+  dnspython,
   fetchFromGitHub,
   icalendar,
+  icalendar-searcher,
   lxml,
   manuel,
   pytestCheckHook,
@@ -23,14 +25,14 @@
 
 buildPythonPackage rec {
   pname = "caldav";
-  version = "2.1.0";
+  version = "2.2.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "python-caldav";
     repo = "caldav";
     tag = "v${version}";
-    hash = "sha256-iVM3dBG2CNaMOUlEM0nGVKYUZHfX0LKjars7HJ1QWC0=";
+    hash = "sha256-FsIF4BcwAUyYw8J7o4j4CnSd8eIc1Yd5WtxErC6RZ7Y=";
   };
 
   build-system = [
@@ -39,9 +41,11 @@ buildPythonPackage rec {
   ];
 
   dependencies = [
+    dnspython
     lxml
     requests
     icalendar
+    icalendar-searcher
     recurring-ical-events
   ];
 
@@ -57,6 +61,11 @@ buildPythonPackage rec {
     (toPythonModule (xandikos.override { python3Packages = python.pkgs; }))
   ];
 
+  disabledTests = [
+    # test contacts CalDAV servers on the internet
+    "test_rfc8764_test_conf"
+  ];
+
   pythonImportsCheck = [ "caldav" ];
 
   meta = with lib; {

pkgs/development/python-modules/colorful/default.nix

@@ -29,6 +29,9 @@ buildPythonPackage rec {
     homepage = "https://github.com/timofurrer/colorful";
     changelog = "https://github.com/timofurrer/colorful/releases/tag/${src.tag}";
     license = licenses.mit;
-    maintainers = with maintainers; [ kalbasit ];
+    maintainers = with maintainers; [
+      kalbasit
+      l33tname
+    ];
   };
 }

pkgs/development/python-modules/django-pghistory/default.nix

@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "django-pghistory";
-  version = "3.8.3";
+  version = "3.9.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Opus10";
     repo = "django-pghistory";
     tag = version;
-    hash = "sha256-Sx2dR5l86D+2t+1DViW1PfI74zyLmgwNm81zVmZ7IH8=";
+    hash = "sha256-v0Qya5IuRA2nD8LjVEtliDRL9Qxnanod6WhPCu5RJ90=";
   };
 
   build-system = [

pkgs/development/python-modules/hidapi/default.nix

@@ -14,12 +14,12 @@
 
 buildPythonPackage rec {
   pname = "hidapi";
-  version = "0.14.0.post4";
+  version = "0.15.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-SPziU+Um0XtmP7+ZicccfvdlPO1fS+ZfFDfDE/s9vfY=";
+    hash = "sha256-7LwmXL6Le4h1X0IeC6JfCECR7FUMK5D/no3dT81UAxE=";
   };
 
   build-system = [

pkgs/development/python-modules/icalendar-searcher/default.nix

@@ -0,0 +1,53 @@
+{
+  buildPythonPackage,
+  fetchFromGitHub,
+  icalendar,
+  lib,
+  poetry-core,
+  poetry-dynamic-versioning,
+  pyicu,
+  pytestCheckHook,
+  recurring-ical-events,
+}:
+
+buildPythonPackage rec {
+  pname = "icalendar-searcher";
+  version = "1.0.3";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "python-caldav";
+    repo = "icalendar-searcher";
+    tag = "v${version}";
+    hash = "sha256-RwWm41+7AyoqwVGBaa+50ljUILJG5kCD4LMsULWjVEM=";
+  };
+
+  build-system = [
+    poetry-core
+    poetry-dynamic-versioning
+  ];
+
+  dependencies = [
+    icalendar
+    recurring-ical-events
+  ];
+
+  optional-dependencies = {
+    collation = [ pyicu ];
+  };
+
+  pythonImportsCheck = [ "icalendar_searcher" ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ]
+  ++ lib.concatAttrValues optional-dependencies;
+
+  meta = {
+    changelog = "https://github.com/python-caldav/icalendar-searcher/blob/${src.tag}/CHANGELOG.md";
+    description = "Search, filter and sort iCalendar components";
+    homepage = "https://github.com/python-caldav/icalendar-searcher";
+    license = lib.licenses.agpl3Only;
+    maintainers = [ lib.maintainers.dotlambda ];
+  };
+}

pkgs/development/python-modules/molecule/default.nix

@@ -72,7 +72,7 @@ buildPythonPackage rec {
     homepage = "https://github.com/ansible-community/molecule";
     changelog = "https://github.com/ansible/molecule/releases/tag/v${version}";
     license = licenses.mit;
-    maintainers = with maintainers; [ dawidd6 ];
+    maintainers = [ ];
     mainProgram = "molecule";
   };
 }

pkgs/development/python-modules/molecule/plugins.nix

@@ -37,7 +37,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Collection on molecule plugins";
     homepage = "https://github.com/ansible-community/molecule-plugins";
-    maintainers = with maintainers; [ dawidd6 ];
+    maintainers = [ ];
     license = licenses.mit;
   };
 }

pkgs/development/python-modules/nltk/default.nix

@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "nltk";
-  version = "3.9.1";
+  version = "3.9.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-h9EnvT3kvYmk+BJl5fpZyxsZmydEAXU3D3QX0rx66Gg=";
+    hash = "sha256-D0CemwacpBd8GQPD6EPu+Qx+kpkvpJMa5gfabeSeFBk=";
   };
 
   dependencies = [

pkgs/development/python-modules/python-google-weather-api/default.nix

@@ -0,0 +1,43 @@
+{
+  aiohttp,
+  buildPythonPackage,
+  fetchFromGitHub,
+  lib,
+  mashumaro,
+  pytestCheckHook,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "python-google-weather-api";
+  version = "0.0.4";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "tronikos";
+    repo = "python-google-weather-api";
+    tag = "v${version}";
+    hash = "sha256-5ljKaIwG78oufb0iRaqTY46wxelAiuQUvhmRbZWo5Fk=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    aiohttp
+    mashumaro
+  ];
+
+  pythonImportsCheck = [ "google_weather_api" ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  meta = {
+    changelog = "https://github.com/tronikos/python-google-weather-api/releases/tag/${src.tag}";
+    description = "Python client library for the Google Weather API";
+    homepage = "https://github.com/tronikos/python-google-weather-api";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.dotlambda ];
+  };
+}

pkgs/development/python-modules/python-rapidjson/default.nix

@@ -10,7 +10,7 @@
 }:
 
 buildPythonPackage rec {
-  version = "1.22";
+  version = "1.23";
   pname = "python-rapidjson";
   pyproject = true;
 
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "python-rapidjson";
     repo = "python-rapidjson";
     tag = "v${version}";
-    hash = "sha256-q+qIuFD3TboevD88iaBQxwOoOdb6I+yyCsNXIqMcR3g=";
+    hash = "sha256-BlEmEvwGAm3Ix2YwJSwrxgqqANqmgiWRiRWP91JITio=";
   };
 
   patches = [

pkgs/development/tools/parsing/tree-sitter/grammars/default.nix

@@ -96,6 +96,7 @@
   tree-sitter-scala = lib.importJSON ./tree-sitter-scala.json;
   tree-sitter-scheme = lib.importJSON ./tree-sitter-scheme.json;
   tree-sitter-scss = lib.importJSON ./tree-sitter-scss.json;
+  tree-sitter-slint = lib.importJSON ./tree-sitter-slint.json;
   tree-sitter-smithy = lib.importJSON ./tree-sitter-smithy.json;
   tree-sitter-sml = lib.importJSON ./tree-sitter-sml.json;
   tree-sitter-solidity = lib.importJSON ./tree-sitter-solidity.json;

pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-slint.json

@@ -0,0 +1,14 @@
+{
+  "url": "https://github.com/slint-ui/tree-sitter-slint",
+  "rev": "96bc969d20ff347030519184ea2467f4046a524d",
+  "date": "2025-07-13T19:36:58Z",
+  "path": "/nix/store/vns80yp0k4hpjrdxyasbijnj1q2v1rlf-tree-sitter-slint",
+  "sha256": "0q55q7rjf53jvhdxxr4qbnxwi5j1vxbda6g9pw18swn11nw72dn9",
+  "hash": "sha256-yTZxuA3Bco0Cv+kZ1VbfQZbIu12Y5N4b3HIUJ/PBpWA=",
+  "fetchLFS": false,
+  "fetchSubmodules": false,
+  "deepClone": false,
+  "fetchTags": false,
+  "leaveDotGit": false,
+  "rootDir": ""
+}

pkgs/development/tools/parsing/tree-sitter/update.nix

@@ -500,6 +500,10 @@ let
       orga = "crystal-lang-tools";
       repo = "tree-sitter-crystal";
     };
+    "tree-sitter-slint" = {
+      orga = "slint-ui";
+      repo = "tree-sitter-slint";
+    };
   };
 
   pinnedGrammars = [

pkgs/development/tools/rust/rustup/0001-dynamically-patchelf-binaries.patch

@@ -39,7 +39,7 @@ index dfccc661..85233f3b 100644
 +set -eu -o pipefail +o posix
 +shopt -s nullglob
 +export PROG=\"{}\"
-+\"{}\" $@",
++\"{}\" \"$@\"",
 +        unwrapped_lld.to_string_lossy().to_string(),
 +        ld_wrapper_path.to_string_lossy().to_string(),
 +    );

pkgs/kde/generated/sources/plasma.json

@@ -1,352 +1,352 @@
 {
   "aurorae": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/aurorae-6.5.3.tar.xz",
-    "hash": "sha256-veKz6r6F9CQmsylkuSgqtoiKlckkmlc6aAoPJ751dHA="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/aurorae-6.5.4.tar.xz",
+    "hash": "sha256-+88IekKANr5effxH5nb3OzZHE6azPWbf+lDqa97vsXY="
   },
   "bluedevil": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/bluedevil-6.5.3.tar.xz",
-    "hash": "sha256-7kHZ+GTQSYH5ITSx+rke4jxZwW16f9x/hQqa+sfQBVo="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/bluedevil-6.5.4.tar.xz",
+    "hash": "sha256-OBPu54ecgYHPFrW8cDsFZYaO390GLZ7DhHnEBsuzJPE="
   },
   "breeze": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/breeze-6.5.3.tar.xz",
-    "hash": "sha256-14KHWkUQwxQ1zNWq0gnrUZwKTd/bfaOS9U6uhjwuhpk="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/breeze-6.5.4.tar.xz",
+    "hash": "sha256-K1Cy6P8lDKeC/2X46lFAEh1UTYuLpOqjRdYiToB2w9E="
   },
   "breeze-grub": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/breeze-grub-6.5.3.tar.xz",
-    "hash": "sha256-SFOW2Up8UGzeZlxr+4BuT208kOIxmU+d3EsBU3V2e+M="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/breeze-grub-6.5.4.tar.xz",
+    "hash": "sha256-nyb6GML1WysYFjr/Z7gwxx8soSniBLRUycZ1c9tpEVY="
   },
   "breeze-gtk": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/breeze-gtk-6.5.3.tar.xz",
-    "hash": "sha256-0mpg9i/OwNq4IBeGP0tb64oHt6IcpIr0Rw5FC/nco6o="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/breeze-gtk-6.5.4.tar.xz",
+    "hash": "sha256-nKoO1Av8nW5cuZeC+uugUnE/G5n86/qjJuGALRaKNks="
   },
   "breeze-plymouth": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/breeze-plymouth-6.5.3.tar.xz",
-    "hash": "sha256-5RVJfEOFu9vXFd05NHSURPtOAqN0Is5EicGIcF4FNpo="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/breeze-plymouth-6.5.4.tar.xz",
+    "hash": "sha256-mq4caQ/Luwai0QkDBDSWDgWYKw50KAZvq33y2YJJzGM="
   },
   "discover": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/discover-6.5.3.tar.xz",
-    "hash": "sha256-2FutPU1ugVREFgzZ1uG9NX3IOZUQ+0Uv77JVmqruiYI="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/discover-6.5.4.tar.xz",
+    "hash": "sha256-oVq82Akoj2/x+XXE4WweajmdXh4PAriFUMU9Dd0Qjk4="
   },
   "drkonqi": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/drkonqi-6.5.3.tar.xz",
-    "hash": "sha256-P361CnXx/geU4ipxV7w7Zjtn5E/tg2NRbxoYkwXf6v4="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/drkonqi-6.5.4.tar.xz",
+    "hash": "sha256-7Mo3qm/aOpcZxO/aeg066sFTwOfQuvUvJ2SDDSSl4+0="
   },
   "flatpak-kcm": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/flatpak-kcm-6.5.3.tar.xz",
-    "hash": "sha256-QnBULxIREYZSy1o7kZixsBGNSYHHaYe5g0JpKmvKAaE="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/flatpak-kcm-6.5.4.tar.xz",
+    "hash": "sha256-DbNbXxYR53ps7ShEhLIqgagus9JridxlFTr4xeeAEbk="
   },
   "kactivitymanagerd": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/kactivitymanagerd-6.5.3.tar.xz",
-    "hash": "sha256-rscEXnx5aZLiJneOnozXIOE7yI+f5CTf5wV0na98L+0="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/kactivitymanagerd-6.5.4.tar.xz",
+    "hash": "sha256-JbbLsIRwmuBUgvG0NEu0NZhmpM37lmU44xCImvJJc0g="
   },
   "kde-cli-tools": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/kde-cli-tools-6.5.3.tar.xz",
-    "hash": "sha256-/VMsPfWm20FRgIK8lFw2kxyNqCkRfCE3+zC5ORrrY/w="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/kde-cli-tools-6.5.4.tar.xz",
+    "hash": "sha256-iP5DNUKczshC3pDqqIGTDszSm8lHUoyvb+Esk+YJ77Y="
   },
   "kde-gtk-config": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/kde-gtk-config-6.5.3.tar.xz",
-    "hash": "sha256-jyRSFJWF4+BciP/tuC5D2sHsdmmgjmozwDutAzKJnz4="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/kde-gtk-config-6.5.4.tar.xz",
+    "hash": "sha256-N0dJbEdpGtsJEWsbhVh6ekQBWyUSnIoE+moqH63tJKg="
   },
   "kdecoration": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/kdecoration-6.5.3.tar.xz",
-    "hash": "sha256-MjihNaZwNvhtlX81JHxR6xjktGYJJgR4pmMMrck0Sb0="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/kdecoration-6.5.4.tar.xz",
+    "hash": "sha256-CIzTUnNbCZavj5GVTBjYN8n6O02KVFsIzDMZsQqiDvc="
   },
   "kdeplasma-addons": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/kdeplasma-addons-6.5.3.tar.xz",
-    "hash": "sha256-hCZCmq8VvzPTx7f2GDfptWeem3znP2EiczmKepd8Yoc="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/kdeplasma-addons-6.5.4.tar.xz",
+    "hash": "sha256-JRBkaaaB82P3tBX7Jtia7Vc03CNxg5aXovBf1FWLQW8="
   },
   "kgamma": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/kgamma-6.5.3.tar.xz",
-    "hash": "sha256-gfa5/TueYUXRHznfkUl1cLJF14welMPuHmHWL7gDlg0="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/kgamma-6.5.4.tar.xz",
+    "hash": "sha256-Ezq5LfMlQ3H9F93wUTaRfygW40+aCOrrwAml3JXQ4r0="
   },
   "kglobalacceld": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/kglobalacceld-6.5.3.tar.xz",
-    "hash": "sha256-R6nJgVsd00/Z7HfygmzpWSFvASdYUzdZNkNPEtySh9I="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/kglobalacceld-6.5.4.tar.xz",
+    "hash": "sha256-Fga1AWtvpVTjpmD8A+Wf00AmneUtbKTuOmLmt53YWNI="
   },
   "kinfocenter": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/kinfocenter-6.5.3.tar.xz",
-    "hash": "sha256-wrRk7VgKCCPY0XH7LRpTOmqi2huItBQtNgRTwVKDQwQ="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/kinfocenter-6.5.4.tar.xz",
+    "hash": "sha256-qFRmn6yDFb7CBc0XrXmwPLQfn5wPevOngj1kEcaMM8o="
   },
   "kmenuedit": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/kmenuedit-6.5.3.tar.xz",
-    "hash": "sha256-5QA00JFjVIb1Lo1De7ujg9DfAYWkFm0ZfTH4dl5bCuc="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/kmenuedit-6.5.4.tar.xz",
+    "hash": "sha256-5X12tCMeVvI3lXyc19imiBpCY4zt5ADR5CprtIoYlqk="
   },
   "knighttime": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/knighttime-6.5.3.tar.xz",
-    "hash": "sha256-Gu+3bcfhD3IrrGwMQphajowi3EDs4eqG0SxE1taVa5k="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/knighttime-6.5.4.tar.xz",
+    "hash": "sha256-33u/T+rbzUN9Xpd4WHjF2oKgyeyZvVoB3VeIQywHsMc="
   },
   "kpipewire": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/kpipewire-6.5.3.tar.xz",
-    "hash": "sha256-Dw+IQFfHkCbOaak/LtltM1gUABVf7Ivdzi0ro7GX3MU="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/kpipewire-6.5.4.tar.xz",
+    "hash": "sha256-/InvfM3Nu9xVuRR0IPX1z4W/OQLAezrgwNv51KI7pIo="
   },
   "krdp": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/krdp-6.5.3.tar.xz",
-    "hash": "sha256-W+z7fNiPdW31LU8g0/IytkUwPG4TLW1+33W2bhNC0ro="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/krdp-6.5.4.tar.xz",
+    "hash": "sha256-VCfuR//i9snQ1kaToQ8A7fQkWhNak90yc4W7fRkFMIk="
   },
   "kscreen": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/kscreen-6.5.3.tar.xz",
-    "hash": "sha256-fwnvdUbO8khN/+CRhT1pKK2jindtX78LENR6yW3poMc="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/kscreen-6.5.4.tar.xz",
+    "hash": "sha256-ofJ/FTVWiL0M5EhNtNBjzOwZKJRO3ZYM1EEqyr9fZiU="
   },
   "kscreenlocker": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/kscreenlocker-6.5.3.tar.xz",
-    "hash": "sha256-JkZKRhNHMF8qLLOyjjoOj8YC/KbKirXSynE3O32dpo4="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/kscreenlocker-6.5.4.tar.xz",
+    "hash": "sha256-RwAhqGtIalT10KYx3tw8KwKJmVPf+CSgPFNLYMhiOJk="
   },
   "ksshaskpass": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/ksshaskpass-6.5.3.tar.xz",
-    "hash": "sha256-2vXSFN7Mz7Xyi5LhyLwQKL8FEbJa2fUBFoSPXavpbg4="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/ksshaskpass-6.5.4.tar.xz",
+    "hash": "sha256-T97wef64lj1anlVNwRrOjHKHMndfA0D8H0Oxq6mhaGE="
   },
   "ksystemstats": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/ksystemstats-6.5.3.tar.xz",
-    "hash": "sha256-GbN+ASZI0n/ob6MA0s0s5lwhZy07ohRcplVbrw4qqRM="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/ksystemstats-6.5.4.tar.xz",
+    "hash": "sha256-pTA4IyIht3PGlTEsbNPxGpA74aoYb9TCdN3e2MGsMfs="
   },
   "kwallet-pam": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/kwallet-pam-6.5.3.tar.xz",
-    "hash": "sha256-NvH4KbfonJdu7eN35sEhrp0bRAJcontVZW8lfRiNDHQ="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/kwallet-pam-6.5.4.tar.xz",
+    "hash": "sha256-Ztng423uos53E0uyTDTL+Nz2IxcEYrSpBC9/DmTCfd8="
   },
   "kwayland": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/kwayland-6.5.3.tar.xz",
-    "hash": "sha256-5sE7ekgSckEC/i+C9QLkL4gSEUOBqCu4G4YT6lqzhyU="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/kwayland-6.5.4.tar.xz",
+    "hash": "sha256-67c3G0AqC+0MxVlmzBDRO0MbKIy30Z4fQVGYU/mOPTk="
   },
   "kwayland-integration": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/kwayland-integration-6.5.3.tar.xz",
-    "hash": "sha256-FydO4DEBAM9/Ey+lN3ohFrTmjt9K2A0k4mppaBb+6nM="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/kwayland-integration-6.5.4.tar.xz",
+    "hash": "sha256-0aQwQ1KbPl4GmHBpYt5WIH25wscWP7TZDDKhZtguQs4="
   },
   "kwin": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/kwin-6.5.3.tar.xz",
-    "hash": "sha256-kOr3TXczpZHl+RcLWaSe4ONoTelUq3Vv7wQhwDUUn3E="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/kwin-6.5.4.tar.xz",
+    "hash": "sha256-JYRD9yGAz1qBQbRAu1GnFKLmfjCGdzYpB5POUNe7HXA="
   },
   "kwin-x11": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/kwin-x11-6.5.3.tar.xz",
-    "hash": "sha256-rnUVpZDXn4YT3DIrRBNyTLBGZ3EDaYb0fQEs7Oeem9k="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/kwin-x11-6.5.4.tar.xz",
+    "hash": "sha256-dVdiUjbQwGeTgEyTqS31AYklvG8AncHyBnCfw0cloiU="
   },
   "kwrited": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/kwrited-6.5.3.tar.xz",
-    "hash": "sha256-HB9zeSc+qnmRio+r1hcIztxIJpxNNn8vpWQwnkHTcJw="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/kwrited-6.5.4.tar.xz",
+    "hash": "sha256-jhMPXSHOYkqXTY5yZ0RvMXoX+gEqU9u3XRQPZdq36aY="
   },
   "layer-shell-qt": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/layer-shell-qt-6.5.3.tar.xz",
-    "hash": "sha256-lNfYVKFRw/UCh0jW6ojGiiimwdjHYQ02EHRdGI0nMEk="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/layer-shell-qt-6.5.4.tar.xz",
+    "hash": "sha256-u5XbJT/80p4IGRZWtqVEn4qIAMOCVoc+JSl0m1XqqAo="
   },
   "libkscreen": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/libkscreen-6.5.3.tar.xz",
-    "hash": "sha256-HgA2xIhoJLvrMPPOVYueTRA3OIXmAIfW2RVT8nN00i8="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/libkscreen-6.5.4.tar.xz",
+    "hash": "sha256-mKaE+sAdDT6jCaifAKdznsMiY9849ae5iOdDAq9Ub5Q="
   },
   "libksysguard": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/libksysguard-6.5.3.tar.xz",
-    "hash": "sha256-640B+89kEKnVrnjFODklJOILv03AqWGaNzKkcx1ecYc="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/libksysguard-6.5.4.tar.xz",
+    "hash": "sha256-dPNwviRyKvoq55rPPXPtxqI/Dsuo4LcX3pc/XQ2gUI4="
   },
   "libplasma": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/libplasma-6.5.3.tar.xz",
-    "hash": "sha256-H+QPSIUBB43HAPPKAY5P9dTF00T7zUrbdqzoYmnHqfU="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/libplasma-6.5.4.tar.xz",
+    "hash": "sha256-Hunzem8cJr7ANTYNCdgbRNe27Yw/YKFV2Lhkw6ZQBu4="
   },
   "milou": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/milou-6.5.3.tar.xz",
-    "hash": "sha256-cnOvFoA9eFGo+ObbZggWWvSbd9E6fsauPPiOjjZyHLc="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/milou-6.5.4.tar.xz",
+    "hash": "sha256-3VaTgeooJaR+uz9LmY/TXXU0EfRTUO+wBWbfaBRBtfc="
   },
   "ocean-sound-theme": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/ocean-sound-theme-6.5.3.tar.xz",
-    "hash": "sha256-QSmDsRVvICX8FYFQdfKbG5bzvC3hXFQM6iViRSEYQfY="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/ocean-sound-theme-6.5.4.tar.xz",
+    "hash": "sha256-wEzJT3AEe6o6yFBDSRWhGIctV2MHyKHqbtYzT+isvuQ="
   },
   "oxygen": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/oxygen-6.5.3.tar.xz",
-    "hash": "sha256-N5+Y252Cm5dbClmjilbZoyT+rEu2+V/CCl6loiA9bZQ="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/oxygen-6.5.4.tar.xz",
+    "hash": "sha256-vz8iRNLlBmK0G8cqrWkm17v1t9Dpa2W43BIwItyDuxI="
   },
   "oxygen-sounds": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/oxygen-sounds-6.5.3.tar.xz",
-    "hash": "sha256-mw4pp6gZ5q7qCb3TenQTQRX/ZnboK6dvOXuodsbxpyI="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/oxygen-sounds-6.5.4.tar.xz",
+    "hash": "sha256-CVh/F4twpdFqzkk3ykoVfzu9SjfCVBXtghUQFov5yZg="
   },
   "plasma-activities": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/plasma-activities-6.5.3.tar.xz",
-    "hash": "sha256-67KZCpUEhk7TMt6D+SlBkkr6dOV5udG0Brudh20O4h0="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/plasma-activities-6.5.4.tar.xz",
+    "hash": "sha256-niLzry86POMIUlZPrFlvSVY09DGcCtI+x2OplKvlBTk="
   },
   "plasma-activities-stats": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/plasma-activities-stats-6.5.3.tar.xz",
-    "hash": "sha256-3PMkaMumXscGfqY6rAz61BncJJdYBmmYk2mYFO45/NQ="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/plasma-activities-stats-6.5.4.tar.xz",
+    "hash": "sha256-3xJiOjD0uw60H87MtL6lOBcu8Jtx1qtAobRDr6jfvMo="
   },
   "plasma-browser-integration": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/plasma-browser-integration-6.5.3.tar.xz",
-    "hash": "sha256-zE1y8l5CkRDCpa0q2AjeN+0TiVfjLe/cFdGcigv/3U4="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/plasma-browser-integration-6.5.4.tar.xz",
+    "hash": "sha256-OlDZTf/wbr+wOJ5BsHS6FXSowa9sUmqPgTlcltGW3rA="
   },
   "plasma-desktop": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/plasma-desktop-6.5.3.tar.xz",
-    "hash": "sha256-u3ZKLJd0f54wJ0KUJwRnVPs6x9/2rIIXFRHHFvqk0Lc="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/plasma-desktop-6.5.4.tar.xz",
+    "hash": "sha256-4I0YQa36N0rxAByGYEpL8vDVoiMP4fLJJdthzZhLjAw="
   },
   "plasma-dialer": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/plasma-dialer-6.5.3.tar.xz",
-    "hash": "sha256-ZbmtEPxJf3Bk+9bPBeFtCadTTspxcLW0Tky51RMoa6s="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/plasma-dialer-6.5.4.tar.xz",
+    "hash": "sha256-C196ifp1IJAMeBB2jDdrvXxPPriBo65baLQRfwkjqfI="
   },
   "plasma-disks": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/plasma-disks-6.5.3.tar.xz",
-    "hash": "sha256-/6ismcPTQN/qCMedow34t2GOymN4NwjtG6ihBtr3m/w="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/plasma-disks-6.5.4.tar.xz",
+    "hash": "sha256-7IboZZwD8L2IZ7sX+odlhu4VrCSq1SiRHevxLFNMcRs="
   },
   "plasma-firewall": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/plasma-firewall-6.5.3.tar.xz",
-    "hash": "sha256-9b6VaxRJ+ZVq8tSg42+jwpHct2ywlQVz42Z7MsfuEGA="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/plasma-firewall-6.5.4.tar.xz",
+    "hash": "sha256-LD/k5O/zG2vwaUhf5Y2kfqnZLDXbU88Eml4JUEJEIhA="
   },
   "plasma-integration": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/plasma-integration-6.5.3.tar.xz",
-    "hash": "sha256-qq/y0E4+f8KJNT9GTJvgsneCrjWWpTxmfO1Drmu53Lg="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/plasma-integration-6.5.4.tar.xz",
+    "hash": "sha256-QeTBBz+aiFJzOq4/NHOHU/jt4GuYVZHuZ6eY5KCqXiM="
   },
   "plasma-mobile": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/plasma-mobile-6.5.3.tar.xz",
-    "hash": "sha256-a+TU1gevnBYbkg8TClUyuYyL8+4kMLi+IruyEQdbMFk="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/plasma-mobile-6.5.4.tar.xz",
+    "hash": "sha256-/VqGOZi6velx5LcuezsKl7ADxbB7/HEVvfogX4e9Pgg="
   },
   "plasma-nano": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/plasma-nano-6.5.3.tar.xz",
-    "hash": "sha256-4wECuW6/1MYdMMnPqA+a+ybWHvrt96UggNCKUOt8DLc="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/plasma-nano-6.5.4.tar.xz",
+    "hash": "sha256-gOIdbA/L2z1f/CRXOsk4qe/4W7WW0sckGMjbEoVO0GM="
   },
   "plasma-nm": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/plasma-nm-6.5.3.tar.xz",
-    "hash": "sha256-mtaWHwzmxNGE79bufP4mH7RKrulkTrTKdMja68RW78M="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/plasma-nm-6.5.4.tar.xz",
+    "hash": "sha256-pYTGi+mBro76+qalQzmD1kdUVO4ngG7kHH4qTQhZyK8="
   },
   "plasma-pa": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/plasma-pa-6.5.3.tar.xz",
-    "hash": "sha256-Wyzwyyxq1nGji5ojJ4SVLKVhlzD3zeMA6uMpvFaosu4="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/plasma-pa-6.5.4.tar.xz",
+    "hash": "sha256-ptuvnYR2Jw7NeAkF321Z0rXclwJXrrqPYmnu0d1/83U="
   },
   "plasma-sdk": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/plasma-sdk-6.5.3.tar.xz",
-    "hash": "sha256-DosLY3mbt4VVu82I4/gEUR3utWJ4WIVFRg6MeULeD98="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/plasma-sdk-6.5.4.tar.xz",
+    "hash": "sha256-DZyudSwhx1+pyHL+dQXONok8hjIQ1ztoeZp1G2VuewM="
   },
   "plasma-systemmonitor": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/plasma-systemmonitor-6.5.3.tar.xz",
-    "hash": "sha256-pPJKX+oGPMCyLT4ENvB80mxZ8qZy/KwZln/vOlOqHY0="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/plasma-systemmonitor-6.5.4.tar.xz",
+    "hash": "sha256-uGWG8jTCMQHukDJuD1F1GIJ20aBJdZIxZLQR8kAOg2c="
   },
   "plasma-thunderbolt": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/plasma-thunderbolt-6.5.3.tar.xz",
-    "hash": "sha256-YCvRd/aYjKgB64XXNyLxfYEfQBy40lzCVHOhymusihE="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/plasma-thunderbolt-6.5.4.tar.xz",
+    "hash": "sha256-AuklIfhbtqkza2q9c6x4zSLyMqXU9hTEekTV77DGs6g="
   },
   "plasma-vault": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/plasma-vault-6.5.3.tar.xz",
-    "hash": "sha256-5h5HULUzsofkAUAznD9d4gPmPpBgTyCkTgboHcpcK48="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/plasma-vault-6.5.4.tar.xz",
+    "hash": "sha256-7NiMm+J+zgC1QoEKcda9KD0bK/GuIlJgVQQWKBXKsMY="
   },
   "plasma-welcome": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/plasma-welcome-6.5.3.tar.xz",
-    "hash": "sha256-ZGgg/Gk7OI1wame2oet/RAlYUfa4fpQLywfM1UGqnzk="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/plasma-welcome-6.5.4.tar.xz",
+    "hash": "sha256-hU3qQRZWA+oszOtAGpHCIAx/4vI9CrwjH5TbcVosK+g="
   },
   "plasma-workspace": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/plasma-workspace-6.5.3.tar.xz",
-    "hash": "sha256-/2TLrcl0k+rw9jPLAJErz8IFNt2mhLq8+ks+7NSDyhc="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/plasma-workspace-6.5.4.tar.xz",
+    "hash": "sha256-SUtnHXD2fuOC/q7Q3Kcu1n/npCOmM44s2yQR+TvOdB4="
   },
   "plasma-workspace-wallpapers": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/plasma-workspace-wallpapers-6.5.3.tar.xz",
-    "hash": "sha256-RH06VnUNU/U84aJzXzUSRGY3bOPQiQtAIAvF+4jwHZc="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/plasma-workspace-wallpapers-6.5.4.tar.xz",
+    "hash": "sha256-k9byTW4KjZFXi8B98qv8leiCaMSk/dZvJHGhxr+fYvs="
   },
   "plasma5support": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/plasma5support-6.5.3.tar.xz",
-    "hash": "sha256-tYu3vLWRTj88dtPekg2VPIeR8Pmo4tbrhBBRsYAJeX8="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/plasma5support-6.5.4.tar.xz",
+    "hash": "sha256-rd62LZ7ubnCgZCh2zgDifkN8/W5tC9ruMaN4wmrD0lg="
   },
   "plymouth-kcm": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/plymouth-kcm-6.5.3.tar.xz",
-    "hash": "sha256-Y0uV8uUDNcuWgQt97Y2kV/RAad5JpR7AdrxcdFlEU0Q="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/plymouth-kcm-6.5.4.tar.xz",
+    "hash": "sha256-X+z5WUhcfWFnOXbjBrPz4UGXHfVc1HJdRWcxLoOAQIc="
   },
   "polkit-kde-agent-1": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/polkit-kde-agent-1-6.5.3.tar.xz",
-    "hash": "sha256-CytHmBtRqVsWVaOsOYX/BM6rurNxfrQDjo+uao6wdZo="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/polkit-kde-agent-1-6.5.4.tar.xz",
+    "hash": "sha256-q0RoQvzWDJp0DDTYUf7vmPyi72AKPJSfLsOFiDj7iiQ="
   },
   "powerdevil": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/powerdevil-6.5.3.tar.xz",
-    "hash": "sha256-KZksuRClYnVIYjvOWjv1Hn+mggxM1lDqJVtNPdCKOGM="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/powerdevil-6.5.4.tar.xz",
+    "hash": "sha256-meQnt1drGTC7QKNYQZ+brDbjtZ+R/30cTHO7bFgDPho="
   },
   "print-manager": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/print-manager-6.5.3.tar.xz",
-    "hash": "sha256-6+pmZL0fPNejAzufxvh5dkgiHF19c526VSQ9OnpHe+I="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/print-manager-6.5.4.tar.xz",
+    "hash": "sha256-h3YlVrEyf8420tHuxOQPxpA7rdxSBPKKt6QEXoRkZos="
   },
   "qqc2-breeze-style": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/qqc2-breeze-style-6.5.3.tar.xz",
-    "hash": "sha256-/zG01G47iypgAxpblk6on3wULN0zkr3mC0qA9i8mW9M="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/qqc2-breeze-style-6.5.4.tar.xz",
+    "hash": "sha256-qTZpnFZY4Rc3dGiDF34pxx0PDNqRsKWuSZ4fv5LffA8="
   },
   "sddm-kcm": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/sddm-kcm-6.5.3.tar.xz",
-    "hash": "sha256-f+4ZDdHK6g4ZP3BQMKl4qxhOBlGbTUUxO09+Oxk5QKM="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/sddm-kcm-6.5.4.tar.xz",
+    "hash": "sha256-4J+cYbWJ0eGA5EXTCYyNLuaQ/5JlZq59w6IB1BCv3rc="
   },
   "spacebar": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/spacebar-6.5.3.tar.xz",
-    "hash": "sha256-5ambyJlQ9M4rZEIj0sgDz5O5NSnZzYuP2LUXRErlqWM="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/spacebar-6.5.4.tar.xz",
+    "hash": "sha256-R2CWpBJVnayKunYwdAzSsDfyMuG/RQlvYQrYkBmWQFk="
   },
   "spectacle": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/spectacle-6.5.3.tar.xz",
-    "hash": "sha256-zxUBZuzUtAwvp7O0dhzuIv8IssyNpoz4zW/8Dvx4yLc="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/spectacle-6.5.4.tar.xz",
+    "hash": "sha256-s1bdk2LZVXIC2H1VYc5F7d4o+etKsOOP07iSYj8tS8E="
   },
   "systemsettings": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/systemsettings-6.5.3.tar.xz",
-    "hash": "sha256-lwLQeN/0+vrWpa+Mq5+GWcZF4d10x7n/firu7nKGf4o="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/systemsettings-6.5.4.tar.xz",
+    "hash": "sha256-eY72yCYQX0Qzlhr1mpoYL/do1YvUpRbhjJEuUCBgOAM="
   },
   "wacomtablet": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/wacomtablet-6.5.3.tar.xz",
-    "hash": "sha256-RssHC6n02Lv0yfc1M/qllwFe3msk9tABHDok6L2tOx4="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/wacomtablet-6.5.4.tar.xz",
+    "hash": "sha256-Tif/a3wDoMYkACCIrerDomfYl9sgjSdVVitIGasJpr4="
   },
   "xdg-desktop-portal-kde": {
-    "version": "6.5.3",
-    "url": "mirror://kde/stable/plasma/6.5.3/xdg-desktop-portal-kde-6.5.3.tar.xz",
-    "hash": "sha256-HtvipF/LxiAbm9M8XTX0CQDTxAQb9bIvaEyztth94ZI="
+    "version": "6.5.4",
+    "url": "mirror://kde/stable/plasma/6.5.4/xdg-desktop-portal-kde-6.5.4.tar.xz",
+    "hash": "sha256-ALPyDbI3kA6wFaEAlfuF0yTagIDSCrr931ywROsSUWs="
   }
 }

pkgs/kde/plasma/breeze/default.nix

@@ -8,19 +8,6 @@
 mkKdeDerivation {
   pname = "breeze";
 
-  # Fix extra thicc padding on menu items
-  # FIXME: remove in next update
-  patches = [
-    (fetchpatch {
-      url = "https://invent.kde.org/plasma/breeze/-/commit/4a8a46aba6b9e39bfb02c7f46933079b5a50eff5.diff";
-      hash = "sha256-ZzRMMwz3OihChywzQWBNv9rPcZI+IcXNVzoRuXTWt9c=";
-    })
-    (fetchpatch {
-      url = "https://invent.kde.org/plasma/breeze/-/commit/2cd5b37dad8f213aab4029b6d3b80ca7f159ea50.diff";
-      hash = "sha256-3pOJEH1H3o+U40K/mtKnruPsoA+vy+HrAa8vU5Oza6c=";
-    })
-  ];
-
   outputs = [
     "out"
     "dev"

pkgs/os-specific/linux/qc71_laptop/default.nix

@@ -39,7 +39,10 @@ stdenv.mkDerivation rec {
     description = "Linux driver for QC71 laptop";
     homepage = "https://github.com/pobrn/qc71_laptop/";
     license = licenses.gpl2Only;
-    maintainers = with maintainers; [ aacebedo ];
+    maintainers = with maintainers; [
+      aacebedo
+      lucasfa
+    ];
     platforms = [ "x86_64-linux" ];
   };
 }

pkgs/servers/home-assistant/component-packages.nix

@@ -2168,7 +2168,8 @@
       ];
     "google_weather" =
       ps: with ps; [
-      ]; # missing inputs: python-google-weather-api
+        python-google-weather-api
+      ];
     "google_wifi" =
       ps: with ps; [
       ];
@@ -7381,6 +7382,7 @@
     "google_tasks"
     "google_translate"
     "google_travel_time"
+    "google_weather"
     "google_wifi"
     "govee_ble"
     "govee_light_local"

pkgs/servers/home-assistant/custom-components/ingress/package.nix

@@ -0,0 +1,26 @@
+{
+  lib,
+  buildHomeAssistantComponent,
+  fetchFromGitHub,
+}:
+
+buildHomeAssistantComponent rec {
+  owner = "lovelylain";
+  domain = "ingress";
+  version = "1.2.9";
+
+  src = fetchFromGitHub {
+    inherit owner;
+    repo = "hass_ingress";
+    tag = version;
+    hash = "sha256-jjig0Dl/vdeuN7e25CH5L/Xvc60RM3BiAt3jUw/C9q4=";
+  };
+
+  meta = {
+    changelog = "https://github.com/lovelylain/hass_ingress/releases/tag/${src.tag}";
+    description = "Add additional ingress panels to your Home Assistant frontend";
+    homepage = "https://github.com/lovelylain/hass_ingress";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ David-Kopczynski ];
+  };
+}

pkgs/servers/mastodon/source.nix

@@ -5,14 +5,14 @@
   patches ? [ ],
 }:
 let
-  version = "4.5.2";
+  version = "4.5.3";
 in
 applyPatches {
   src = fetchFromGitHub {
     owner = "mastodon";
     repo = "mastodon";
     rev = "v${version}";
-    hash = "sha256-LePly+CcM+Dv6ipX9jIWWKhy2PiF1j8vgc9CXn2o+DQ=";
+    hash = "sha256-OOcy4eBGao2cVnRYhAogeSw0X234TEr50tFT2sSjmaQ=";
     passthru = {
       inherit version;
       yarnHash = "sha256-2MOl6kHidkGU2I/cZaUmbQCiEl9SDfL/j9fT/6eNdFA=";

pkgs/servers/monitoring/grafana/plugins/grafana-exploretraces-app/default.nix

@@ -2,8 +2,8 @@
 
 grafanaPlugin {
   pname = "grafana-exploretraces-app";
-  version = "1.2.0";
-  zipHash = "sha256-QXBOODMgFJvPLgr1Gr6mkpW2YJwYlDO/ZXL3BlEhEJ0=";
+  version = "1.2.2";
+  zipHash = "sha256-vQSnjSPiYvgwpbO7VvmG77DfP85+R6fRoGGpr+xslTc=";
   meta = with lib; {
     description = "Opinionated traces app";
     license = licenses.agpl3Only;

pkgs/test/overriding.nix

@@ -5,7 +5,13 @@
 }:
 
 let
-  tests = tests-stdenv // test-extendMkDerivation // tests-fetchhg // tests-go // tests-python;
+  tests =
+    tests-stdenv
+    // test-extendMkDerivation
+    // tests-fetchhg
+    // tests-fetchurl
+    // tests-go
+    // tests-python;
 
   tests-stdenv =
     let
@@ -131,6 +137,98 @@ let
       };
     };
 
+  tests-fetchgit =
+    let
+      src-with-sha256 = pkgs.fetchgit {
+        url = "https://example.com/source.git";
+        sha256 = lib.fakeSha256;
+      };
+    in
+    {
+      test-fetchgit-hash-compat = {
+        expr = {
+          inherit (src-with-sha256)
+            outputHash
+            outputHashAlgo
+            ;
+        };
+        expected = {
+          outputHash = lib.fakeSha256;
+          outputHashAlgo = "sha256";
+        };
+      };
+      test-fetchgit-overrideAttrs-hash = {
+        expr = {
+          inherit (src-with-sha256.overrideAttrs { hash = pkgs.nix.src.hash; })
+            outputHash
+            outputHashAlgo
+            ;
+        };
+        expected = {
+          outputHash = pkgs.nix.src.hash;
+          outputHashAlgo = null;
+        };
+      };
+      test-fetchurl-overrideAttrs-hash-empty = {
+        expr = {
+          inherit (src-with-sha256.overrideAttrs { hash = ""; })
+            outputHash
+            outputHashAlgo
+            ;
+        };
+        expected = {
+          outputHash = lib.fakeHash;
+          outputHashAlgo = null;
+        };
+      };
+    };
+
+  tests-fetchurl =
+    let
+      src-with-sha256 = pkgs.fetchurl {
+        url = "https://example.com/source.tar.gz";
+        sha256 = lib.fakeSha256;
+      };
+    in
+    {
+      test-fetchurl-hash-compat = {
+        expr = {
+          inherit (src-with-sha256)
+            outputHash
+            outputHashAlgo
+            ;
+        };
+        expected = {
+          outputHash = lib.fakeSha256;
+          outputHashAlgo = "sha256";
+        };
+      };
+      test-fetchurl-overrideAttrs-hash = {
+        expr = {
+          inherit (src-with-sha256.overrideAttrs { hash = pkgs.hello.src.hash; })
+            outputHash
+            outputHashAlgo
+            ;
+        };
+        expected = {
+          outputHash = pkgs.hello.src.hash;
+          outputHashAlgo = null;
+        };
+      };
+      test-fetchurl-overrideAttrs-hash-empty = {
+        expr = {
+          inherit (src-with-sha256.overrideAttrs { hash = ""; })
+            outputHash
+            outputHashAlgo
+            ;
+        };
+        expected = {
+          outputHash = lib.fakeHash;
+          outputHashAlgo = null;
+        };
+      };
+    };
+
   tests-fetchhg =
     let
       ruamel_0_18_14-hash = "sha256-HDkPPp1xI3uoGYlS9mwPp1ZjG2gKvx6vog0Blj6tBuI=";

pkgs/tools/misc/pandoc-plantuml-filter/default.nix

@@ -28,7 +28,10 @@ buildPythonApplication rec {
     homepage = "https://github.com/timofurrer/pandoc-plantuml-filter";
     description = "Pandoc filter which converts PlantUML code blocks to PlantUML images";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ cmcdragonkai ];
+    maintainers = with lib.maintainers; [
+      cmcdragonkai
+      l33tname
+    ];
     mainProgram = "pandoc-plantuml";
   };
 }

pkgs/top-level/aliases.nix

@@ -1243,6 +1243,7 @@ mapAliases {
   pcp = throw "'pcp' has been removed because the upstream repo was archived and it hasn't been updated since 2021"; # Added 2025-09-23
   pcre16 = throw "'pcre16' has been removed because it is obsolete. Consider migrating to 'pcre2' instead."; # Added 2025-05-29
   pcsctools = throw "'pcsctools' has been renamed to/replaced by 'pcsc-tools'"; # Converted to throw 2025-10-27
+  pdf2djvu = throw "pdf2djvu has been removed because it was broken and archived upstream"; # added 2025-12-06
   pdf4tcl = throw "'pdf4tcl' has been renamed to/replaced by 'tclPackages.pdf4tcl'"; # Converted to throw 2025-10-27
   pds = warnAlias "'pds' has been renamed to 'bluesky-pds'" bluesky-pds; # Added 2025-08-20
   pdsadmin = warnAlias "'pdsadmin' has been renamed to 'bluesky-pdsadmin'" bluesky-pdsadmin; # Added 2025-08-20
@@ -1611,13 +1612,6 @@ mapAliases {
   trilium-next-server = trilium-server; # Added 2025-08-30
   trojita = throw "'trojita' has been dropped as it depends on KDE Gear 5, and is unmaintained"; # Added 2025-08-20
   trust-dns = throw "'trust-dns' has been renamed to/replaced by 'hickory-dns'"; # Converted to throw 2025-10-27
-  tt-rss = throw "'tt-rss' has been removed, as it was discontinued on 2025-11-01"; # Added 2025-10-03
-  tt-rss-plugin-auth-ldap = throw "'tt-rss-plugin-auth-ldap' has been removed, as tt-rss was discontinued and removed"; # Added 2025-10-03
-  tt-rss-plugin-data-migration = throw "'tt-rss-plugin-data-migration' has been removed, as tt-rss was discontinued and removed"; # Added 2025-10-03
-  tt-rss-plugin-feediron = throw "'tt-rss-plugin-feediron' has been removed, as tt-rss was discontinued and removed"; # Added 2025-10-03
-  tt-rss-plugin-feedly = throw "'tt-rss-plugin-feedly' has been removed, as tt-rss was discontinued and removed"; # Added 2025-10-03
-  tt-rss-plugin-ff-instagram = throw "'tt-rss-plugin-ff-instagram' has been removed, as tt-rss was discontinued and removed"; # Added 2025-10-03
-  tt-rss-plugin-freshapi = throw "'tt-rss-plugin-freshapi' has been removed, as tt-rss was discontinued and removed"; # Added 2025-10-03
   tvbrowser-bin = throw "'tvbrowser-bin' has been renamed to/replaced by 'tvbrowser'"; # Converted to throw 2025-10-27
   typst-fmt = throw "'typst-fmt' has been renamed to/replaced by 'typstfmt'"; # Converted to throw 2025-10-27
   typstfmt = throw "'typstfmt' has been removed due to lack of upstream maintenance, consider using 'typstyle' instead"; # Added 2025-10-26
@@ -1733,6 +1727,7 @@ mapAliases {
   zinc = throw "'zinc' has been renamed to/replaced by 'zincsearch'"; # Converted to throw 2025-10-27
   zint = throw "'zint' has been renamed to/replaced by 'zint-qt'"; # Converted to throw 2025-10-27
   zombietrackergps = throw "'zombietrackergps' has been dropped, as it depends on KDE Gear 5 and is unmaintained"; # Added 2025-08-20
+  zotero_7 = throw "'zotero_7' has been renamed to/replaced by 'zotero'"; # Added 2025-12-09
   zotify = throw "zotify has been removed due to lack of upstream maintenance"; # Added 2025-09-26
   zq = throw "zq has been replaced by zed"; # Converted to throw 2025-10-26
   zsh-git-prompt = throw "zsh-git-prompt was removed as it is unmaintained upstream"; # Added 2025-08-28

pkgs/top-level/all-packages.nix

@@ -12617,8 +12617,6 @@ with pkgs;
     SDL_image = SDL_image.override { SDL = SDL_sixel; };
   };
 
-  zotero_7 = pkgs.zotero;
-
   zynaddsubfx = callPackage ../applications/audio/zynaddsubfx {
     guiModule = "zest";
     fftw = fftwSinglePrec;

pkgs/top-level/ocaml-packages.nix

@@ -1394,8 +1394,6 @@ let
 
         ocaml-lua = callPackage ../development/ocaml-modules/ocaml-lua { };
 
-        ocaml_lwt = lwt;
-
         ocaml-migrate-parsetree = ocaml-migrate-parsetree-1-8;
 
         ocaml-migrate-parsetree-1-8 =
@@ -2251,6 +2249,7 @@ let
         chacha = throw "chacha has been removed because it has been marked as broken since at least November 2024. It is now vendored inside mirage-crypto, consider using that instead."; # Added 2025-10-11
         gd4o = throw "ocamlPackages.gd4o is not maintained, use ocamlPackages.gd instead";
         ocaml-vdom = throw "2023-10-09: ocamlPackages.ocaml-vdom was renamed to ocamlPackages.vdom";
+        ocaml_lwt = throw "ocamlPackages.ocaml_lwt has been renamed to ocamlPackages.lwt"; # Added 2025-12-05
       }
     )).overrideScope
       liftJaneStreet;

pkgs/top-level/python-packages.nix

@@ -5749,8 +5749,6 @@ self: super: with self; {
 
   fritzconnection = callPackage ../development/python-modules/fritzconnection { };
 
-  froide = toPythonModule (pkgs.froide.override { python3Packages = self; });
-
   frozendict = callPackage ../development/python-modules/frozendict { };
 
   frozenlist = callPackage ../development/python-modules/frozenlist { };
@@ -7107,6 +7105,8 @@ self: super: with self; {
 
   icalendar-compatibility = callPackage ../development/python-modules/icalendar-compatibility { };
 
+  icalendar-searcher = callPackage ../development/python-modules/icalendar-searcher { };
+
   icalevents = callPackage ../development/python-modules/icalevents { };
 
   icdiff = callPackage ../development/python-modules/icdiff { };
@@ -15177,6 +15177,8 @@ self: super: with self; {
 
   python-google-nest = callPackage ../development/python-modules/python-google-nest { };
 
+  python-google-weather-api = callPackage ../development/python-modules/python-google-weather-api { };
+
   python-gvm = callPackage ../development/python-modules/python-gvm { };
 
   python-hcl2 = callPackage ../development/python-modules/python-hcl2 { };