Merge master into staging-next

maintainers/maintainer-list.nix

@@ -7164,6 +7164,12 @@
     githubId = 15128988;
     name = "Maksim Dzabraev";
   };
+  dzervas = {
+    name = "Dimitris Zervas";
+    email = "dzervas@dzervas.gr";
+    github = "dzervas";
+    githubId = 1029195;
+  };
   dzmitry-lahoda = {
     email = "dzmitry@lahoda.pro";
     github = "dzmitry-lahoda";
@@ -19295,6 +19301,12 @@
     githubId = 1538622;
     name = "Michael Reilly";
   };
+  onatustun = {
+    email = "contact@onatustun.com";
+    name = "Onat Ustun";
+    github = "onatustun";
+    githubId = 41642110;
+  };
   ondt = {
     name = "Ondrej Telka";
     email = "nix@ondt.dev";
@@ -21460,6 +21472,12 @@
     github = "randomdude16671";
     githubId = 210965013;
   };
+  randoneering = {
+    name = "randoneering";
+    email = "justin@randoneering.tech";
+    github = "randoneering";
+    githubId = 127273550;
+  };
   rane = {
     name = "Rane";
     email = "rane+git@junkyard.systems";

nixos/modules/hardware/facter/default.nix

@@ -0,0 +1,40 @@
+{
+  lib,
+  config,
+  ...
+}:
+{
+  meta.maintainers = with lib.maintainers; [ mic92 ];
+
+  options.hardware.facter = with lib; {
+    report = mkOption {
+      type = types.attrsOf types.anything;
+      default =
+        if config.hardware.facter.reportPath == null then
+          { }
+        else
+          builtins.fromJSON (builtins.readFile config.hardware.facter.reportPath);
+      defaultText = "A JSON import from config.hardware.facter.reportPath (if not null), {} otherwise.";
+      description = ''
+        Hardware report data generated by nixos-facter.
+
+        See <https://nix-community.github.io/nixos-facter/> for more information.
+      '';
+    };
+
+    reportPath = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = ''
+        Path to a hardware report generated by nixos-facter.
+
+        To generate a report, run the following as root:
+        ```
+        nix-shell -p nixos-facter --run nixos-facter > facter.json
+        ```
+
+        See <https://nix-community.github.io/nixos-facter/> for more information.
+      '';
+    };
+  };
+}

nixos/modules/module-list.nix

@@ -66,6 +66,7 @@
   ./hardware/decklink.nix
   ./hardware/device-tree.nix
   ./hardware/digitalbitbox.nix
+  ./hardware/facter
   ./hardware/flipperzero.nix
   ./hardware/flirc.nix
   ./hardware/fw-fanctrl.nix

nixos/modules/services/security/esdm.nix

@@ -45,6 +45,7 @@ in
       {
         systemd.packages = [ cfg.package ];
         systemd.services."esdm-server".wantedBy = [ "basic.target" ];
+        systemd.services."esdm-kernel-seeder".wantedBy = [ "basic.target" ];
       }
       # It is necessary to set those options for these services to be started by systemd in NixOS
       (lib.mkIf cfg.enableLinuxCompatServices {
@@ -64,7 +65,6 @@ in
   );
 
   meta.maintainers = with lib.maintainers; [
-    orichter
     thillux
   ];
 }

nixos/tests/all-tests.nix

@@ -520,6 +520,7 @@ in
   etebase-server = runTest ./etebase-server.nix;
   etesync-dav = runTest ./etesync-dav.nix;
   evcc = runTest ./evcc.nix;
+  facter = runTest ./facter;
   fail2ban = runTest ./fail2ban.nix;
   fakeroute = runTest ./fakeroute.nix;
   fancontrol = runTest ./fancontrol.nix;

nixos/tests/facter/default.nix

@@ -0,0 +1,29 @@
+{ lib, pkgs, ... }:
+{
+  name = "facter";
+  meta = with lib.maintainers; {
+    maintainers = [ mic92 ];
+  };
+
+  nodes.machine = {
+    hardware.facter.reportPath = ./facter.json;
+    environment.systemPackages = [ pkgs.nixos-facter ];
+  };
+
+  testScript = ''
+    from pprint import pprint
+
+    machine.wait_for_unit("multi-user.target")
+
+    with subtest("Run nixos-facter and verify it produces valid JSON"):
+      import json
+      # Run nixos-facter and check it produces valid output
+      output = machine.succeed("nixos-facter")
+      # Parse JSON to verify it's valid
+      report = json.loads(output)
+      pprint(report)
+      assert "version" in report, "Expected version field in nixos-facter output"
+      assert "system" in report, "Expected system field in nixos-facter output"
+      assert report["version"] == 1, f"Expected version 1, got {report['version']}"
+  '';
+}

nixos/tests/facter/facter.json

@@ -0,0 +1,31 @@
+{
+  "version": 1,
+  "system": "x86_64-linux",
+  "virtualisation": "kvm",
+  "hardware": {
+    "bios": {
+      "smbios_version": 520
+    },
+    "cpu": [
+      {
+        "architecture": "x86_64",
+        "vendor_name": "AuthenticAMD",
+        "family": 25,
+        "model": 33
+      }
+    ],
+    "system": {
+      "form_factor": "desktop"
+    }
+  },
+  "smbios": {
+    "bios": {
+      "vendor": "SeaBIOS",
+      "version": "test"
+    },
+    "system": {
+      "manufacturer": "QEMU",
+      "product": "Standard PC"
+    }
+  }
+}

pkgs/applications/blockchains/bitcoin-knots/default.nix

@@ -31,19 +31,19 @@
   # The list can be found at https://github.com/bitcoinknots/guix.sigs/tree/knots/builder-keys
   builderKeys ? [
     "1A3E761F19D2CC7785C5502EA291A2C45D0C504A" # luke-jr.gpg
-    "55058E8947E136A64F9E8AD5C4512A878E4AC2BF" # nsvrn
+    "C1BCB7169AF1A07A0C5E471A047509FA0A6D7350" # ataraxia
     "DAED928C727D3E613EC46635F5073C4F4882FFFC" # leo-haf.gpg
   ],
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = if withGui then "bitcoin-knots" else "bitcoind-knots";
-  version = "29.1.knots20250903";
+  version = "29.2.knots20251010";
 
   src = fetchurl {
     url = "https://bitcoinknots.org/files/29.x/${finalAttrs.version}/bitcoin-${finalAttrs.version}.tar.gz";
     # hash retrieved from signed SHA256SUMS
-    hash = "sha256-2DlJlGNrCOe8UouZ+TLdZ2OahU18AWL6K/KI1YA29QY=";
+    hash = "sha256-p3omcfgX57reHXQX3IG8FPmMy8MHSCN0+D9Hhb24Wck=";
   };
 
   nativeBuildInputs = [
@@ -87,18 +87,18 @@ stdenv.mkDerivation (finalAttrs: {
       publicKeys = fetchFromGitHub {
         owner = "bitcoinknots";
         repo = "guix.sigs";
-        rev = "d441685d5179b91070fadbc764be3a41616f36df";
-        sha256 = "sha256-XO/E51yOFrRYrGnxsyH/ZPF4Yf192x+lT2FPdilkacA=";
+        rev = "7ee29a9ffbd1c26ba065ba06055242a01c3e63ff";
+        sha256 = "sha256-ZW1I7Y35Pi4WZhgCCYSI5gPhcvbfnpBObhOUTqZGVvM=";
       };
 
       checksums = fetchurl {
         url = "https://bitcoinknots.org/files/${majorVersion}.x/${finalAttrs.version}/SHA256SUMS";
-        hash = "sha256-CH5p+u2XvIpWC/yv+UrP3JSq/dcAxq/eCZ+fPzqaI+Q=";
+        hash = "sha256-DQQg2Iahp2H5jDYA9XX5n/ypRzmFggincGNoIH2t5iU=";
       };
 
       signatures = fetchurl {
         url = "https://bitcoinknots.org/files/${majorVersion}.x/${finalAttrs.version}/SHA256SUMS.asc";
-        hash = "sha256-abCiaE3etiXfqC1nrmHMP77HO94L+ZZv4B2s08p1d2k=";
+        hash = "sha256-jy4gxuczCSsJQkkH3axMljuf7k2VdmLp4PkgRoQnoSY=";
       };
 
       verifyBuilderKeys =

pkgs/applications/editors/vscode/extensions/default.nix

@@ -2537,8 +2537,8 @@ let
         mktplcRef = {
           publisher = "jnoortheen";
           name = "nix-ide";
-          version = "0.4.24";
-          hash = "sha256-xtMXd8GVHygl9+9X+QamI5YXXSlvEWOoYKf3OWmIoHw=";
+          version = "0.5.0";
+          hash = "sha256-jVuGQzMspbMojYq+af5fmuiaS3l3moG8L8Kyf40vots=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/jnoortheen.nix-ide/changelog";

pkgs/applications/misc/organicmaps/default.nix

@@ -33,13 +33,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "organicmaps";
-  version = "2025.10.05-7";
+  version = "2025.10.07-1";
 
   src = fetchFromGitHub {
     owner = "organicmaps";
     repo = "organicmaps";
     tag = "${finalAttrs.version}-android";
-    hash = "sha256-U7CGXwClKByLVn2LAgEavZ96+AyvUlrZlB3HQLaQYH0=";
+    hash = "sha256-132C3k8KvnQNC/AOoBlikl+AsRQdaaH00U3AFA4jo1Q=";
     fetchSubmodules = true;
   };
 

pkgs/applications/networking/cluster/terraform-providers/default.nix

@@ -242,7 +242,7 @@ let
     okta = lib.warnOnInstantiate "terraform-providers.okta has been renamed to terraform-providers.okta_okta" actualProviders.okta_okta;
     oktaasa = lib.warnOnInstantiate "terraform-providers.oktaasa has been renamed to terraform-providers.oktadeveloper_oktaasa" actualProviders.oktadeveloper_oktaasa;
     opennebula = lib.warnOnInstantiate "terraform-providers.opennebula has been renamed to terraform-providers.opennebula_opennebula" actualProviders.opennebula_opennebula;
-    openstack = lib.warnOnInstantiate "terraform-providers.openstack has been renamed to terraform-providers.openstack_openstack" actualProviders.openstack_openstack;
+    openstack = lib.warnOnInstantiate "terraform-providers.openstack has been renamed to terraform-providers.terraform-provider-openstack_openstack" actualProviders.terraform-provider-openstack_openstack;
     opentelekomcloud = lib.warnOnInstantiate "terraform-providers.opentelekomcloud has been renamed to terraform-providers.opentelekomcloud_opentelekomcloud" actualProviders.opentelekomcloud_opentelekomcloud;
     opsgenie = lib.warnOnInstantiate "terraform-providers.opsgenie has been renamed to terraform-providers.opsgenie_opsgenie" actualProviders.opsgenie_opsgenie;
     oci = lib.warnOnInstantiate "terraform-providers.oci has been renamed to terraform-providers.oracle_oci" actualProviders.oracle_oci;

pkgs/applications/radio/direwolf/default.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   alsa-lib,
   gpsd,
@@ -28,6 +29,14 @@ stdenv.mkDerivation rec {
     hash = "sha256-Vbxc6a6CK+wrBfs15dtjfRa1LJDKKyHMrg8tqsF7EX4=";
   };
 
+  patches = [
+    # Fix the build with CMake 4.
+    (fetchpatch {
+      url = "https://github.com/wb2osz/direwolf/commit/c499496bbc237d0efdcacec5786607f5e17c1c7e.patch";
+      hash = "sha256-/gKi5dswMQM2nGHS3P72gAcHaT0nEF9O91heF8xmy2Y=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
     udevCheckHook

pkgs/by-name/an/ansel/package.nix

@@ -82,13 +82,13 @@ let
 in
 stdenv.mkDerivation {
   pname = "ansel";
-  version = "0-unstable-2025-10-04";
+  version = "0-unstable-2025-10-07";
 
   src = fetchFromGitHub {
     owner = "aurelienpierreeng";
     repo = "ansel";
-    rev = "dd5b73cd78d32618aca3f81a041e45c8d2adcece";
-    hash = "sha256-x8glXiweW1/mzPjGrGRDeCHIG1GqbjvEmAM4sEhor14=";
+    rev = "486d5585f3a3fe2075f2903f5b2e36518dd82e37";
+    hash = "sha256-jXTxgStRsp8+Z7JLtwI6+OLd0n/wX58Mxg1dbzDb0p0=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/ap/apfs-fuse/cmake-v4.patch

@@ -0,0 +1,18 @@
+From 523ef46031f0d805a651d95e3b193f73acc824ef Mon Sep 17 00:00:00 2001
+From: Skoh <101289702+SkohTV@users.noreply.github.com>
+Date: Fri, 10 Oct 2025 13:53:13 -0400
+Subject: [PATCH] Increase cmake_minimum_required: 3.0 -> 3.10
+
+---
+ CMakeLists.txt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 03acf26..84370f0 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -1,4 +1,4 @@
+-cmake_minimum_required(VERSION 3.0)
++cmake_minimum_required(VERSION 3.0...3.10)
+ # set(CMAKE_C_COMPILER "clang")
+ # set(CMAKE_CXX_COMPILER "clang++")

pkgs/by-name/ap/apfs-fuse/package.nix

@@ -22,6 +22,12 @@ stdenv.mkDerivation {
     fetchSubmodules = true;
   };
 
+  patches = [
+    # fix for CMake v4
+    # https://github.com/sgan81/apfs-fuse/pull/211
+    ./cmake-v4.patch
+  ];
+
   postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
     substituteInPlace CMakeLists.txt \
       --replace "/usr/local/lib/libosxfuse.dylib" "fuse"

pkgs/by-name/as/aspcud/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   boost,
   catch2,
   cmake,
@@ -20,6 +21,15 @@ stdenv.mkDerivation rec {
     hash = "sha256-PdRfpmH7zF5dn+feoijtzdSUjaYhjHwyAUfuYoWCL9E=";
   };
 
+  patches = [
+    # Bump minimal version of cmake to 3.10
+    (fetchpatch {
+      url = "https://github.com/potassco/aspcud/commit/d88c1aad6f9c1c0081aa1a0eea94ecc7d4ebf855.patch?full_index=1";
+      hash = "sha256-JDNpXLb3ow4JnsZrQ8HqGrRpf/6H/ozJca52pIRVo2w=";
+      excludes = [ "cmake/FindRE2C.cmake" ];
+    })
+  ];
+
   postPatch = ''
     cp ${catch2}/include/catch2/catch.hpp libcudf/tests/catch.hpp
   '';

pkgs/by-name/at/atuin-desktop/package.nix

@@ -0,0 +1,89 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  rustPlatform,
+  wrapGAppsHook4,
+  nix-update-script,
+
+  cargo-tauri,
+  nodejs,
+  pkg-config,
+  pnpm,
+
+  glib-networking,
+  libappindicator-gtk3,
+  openssl,
+  webkitgtk_4_1,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "atuin-desktop";
+  version = "0.1.3";
+
+  src = fetchFromGitHub {
+    owner = "atuinsh";
+    repo = "desktop";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-woYWWDJ2JeyghlRh5IKhPfDy4WmcAGlBJgjBPg1hHq8=";
+  };
+
+  cargoRoot = "backend";
+  buildAndTestSubdir = finalAttrs.cargoRoot;
+  cargoHash = "sha256-tyN9gM8U8kOl62Z0N/plcpTOCbOPuT0kkLI/EKLv/mQ=";
+
+  pnpmDeps = pnpm.fetchDeps {
+    inherit (finalAttrs) pname version src;
+    fetcherVersion = 2;
+    hash = "sha256-y+WZF30R/+nvAVr50SWmMN5kfVb1kYiylAd1IBftoVA=";
+  };
+
+  nativeBuildInputs = [
+    cargo-tauri.hook
+    pnpm.configHook
+
+    nodejs
+    pkg-config
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [ wrapGAppsHook4 ];
+
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    glib-networking
+    libappindicator-gtk3
+    openssl
+    webkitgtk_4_1
+  ];
+
+  env = {
+    # Used upstream: https://github.com/atuinsh/desktop/blob/2f9a90963c4a6299bf35d8a49b0a2ffb8a28ee32/.envrc.
+    NODE_OPTIONS = "--max-old-space-size=5120";
+  };
+
+  # Otherwise tauri will look for a private key we don't have.
+  tauriConf = builtins.toJSON { bundle.createUpdaterArtifacts = false; };
+  passAsFile = [ "tauriConf" ];
+  preBuild = ''
+    npm rebuild ts-tiny-activerecord
+    tauriBuildFlags+=(
+      "--config"
+      "$tauriConfPath"
+    )
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Local-first, executable runbook editor";
+    homepage = "https://atuin.sh";
+    downloadPage = "https://github.com/atuinsh/desktop";
+    changelog = "https://github.com/atuinsh/desktop/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
+      adda
+      dzervas
+      randoneering
+    ];
+    mainProgram = "atuin-desktop";
+    platforms = with lib.platforms; windows ++ darwin ++ linux;
+    broken = stdenv.hostPlatform.isDarwin;
+  };
+})

pkgs/by-name/ce/cerberus/package.nix

@@ -1,12 +1,16 @@
 {
   lib,
+  fetchpatch,
   fetchFromGitHub,
-  writableTmpDirAsHomeHook,
-  unstableGitUpdater,
   ocamlPackages,
   opam,
+  makeBinaryWrapper,
+  writableTmpDirAsHomeHook,
+  unstableGitUpdater,
+  testers,
+  cerberus,
 }:
-ocamlPackages.buildDunePackage {
+ocamlPackages.buildDunePackage rec {
   pname = "cerberus";
   version = "0-unstable-2025-08-18";
 
@@ -17,15 +21,33 @@ ocamlPackages.buildDunePackage {
     hash = "sha256-++fCZvk4ee166eciipTQ8GId6DWrG6aonAzHpK/10f0=";
   };
 
+  patches = [
+    # https://github.com/rems-project/cerberus/pull/980
+    (fetchpatch {
+      name = "fix-runtime-lookup";
+      url = "https://github.com/rems-project/cerberus/commit/262c13331d4809dd3742069dbcd1deedee8227f2.patch";
+      hash = "sha256-yPhzswMDkpjvjYyobnqoF3900l4THe0kaGme1eZXLQc=";
+    })
+  ];
+
+  # Cerberus has not had a true release yet, and it parses out a git rev
+  # for version info. We just patch the "didn't find git revs" to
+  # our version since git is impure
+  postPatch = ''
+    substituteInPlace tools/gen_version.ml \
+      --replace-fail '"unknown"' '"${version}"'
+  '';
+
   minimalOCamlVersion = "4.12";
 
-  strictDeps = true;
+  depsBuildBuild = [
+    ocamlPackages.menhir
+    ocamlPackages.lem
+  ];
 
   nativeBuildInputs = [
-    opam
     writableTmpDirAsHomeHook
-    ocamlPackages.lem
-    ocamlPackages.menhir
+    makeBinaryWrapper
   ];
 
   buildInputs = with ocamlPackages; [
@@ -42,15 +64,33 @@ ocamlPackages.buildDunePackage {
     janeStreet.ppx_sexp_conv
   ];
 
+  # Need to set this or it complains. I don't
+  # think the actual value matters much
   env.OPAM_SWITCH_PREFIX = placeholder "out";
+
+  # Use the make file as it does some codegen
   buildPhase = ''
     runHook preBuild
 
-    make Q= cerberus
+    make DUNEFLAGS="--profile=release" Q= -j$NIX_BUILD_CORES cerberus
 
     runHook postBuild
   '';
 
+  # Must install both the stdlib
+  # and the executable itself
+  installPhase = ''
+    runHook preInstall
+
+    dune install --prefix $out --libdir $OCAMLFIND_DESTDIR cerberus-lib --docdir $out/share/doc --mandir $out/share/man
+    dune install --prefix $out --libdir $OCAMLFIND_DESTDIR cerberus --docdir $out/share/doc --mandir $out/share/man
+
+    wrapProgram "$out/bin/cerberus" \
+      --set CERB_INSTALL_PREFIX "$out/lib/ocaml/${ocamlPackages.ocaml.version}/site-lib/"
+
+    runHook postInstall
+  '';
+
   doInstallCheck = true;
   installCheckPhase = ''
     runHook preInstallCheck
@@ -64,7 +104,14 @@ ocamlPackages.buildDunePackage {
     runHook postInstallCheck
   '';
 
-  passthru.updateScript = unstableGitUpdater { branch = "master"; };
+  passthru = {
+    updateScript = unstableGitUpdater { branch = "master"; };
+
+    # Ensure it still runs after outside the container
+    tests.version = testers.testVersion {
+      package = cerberus;
+    };
+  };
 
   meta = {
     homepage = "https://www.cl.cam.ac.uk/~pes20/cerberus/";

pkgs/by-name/es/esdm/package.nix

@@ -18,55 +18,52 @@
   # A brief explanation is given.
 
   # general options
-  selinux ? false, # enable selinux support
-  drngHashDrbg ? true, # set the default drng callback
-  drngChaCha20 ? false, # set the default drng callback
-  ais2031 ? false, # set the seeding strategy to be compliant with AIS 20/31
-  sp80090c ? false, # set compliance with NIST SP800-90C
-  cryptoBackend ? "builtin", # set backend for hash and drbg operations
+  selinux ? true, # enable selinux support
+  fips140 ? true, # enable FIPS 140 checksum support
+  ais2031 ? true, # set the seeding strategy to be compliant with AIS 20/31
+  sp80090c ? true, # set compliance with NIST SP800-90C
+  cryptoBackend ? "botan", # set backend for hash and drbg operations
   linuxDevFiles ? true, # enable linux /dev/random and /dev/urandom support
   linuxGetRandom ? true, # enable linux getrandom support
-  hashSha512 ? false, # set the conditioning hash: SHA2-512
-  hashSha3_512 ? true, # set the conditioning hash: SHA3-512
-  openSSLRandProvider ? false, # build ESDM provider for OpenSSL 3.x
-  botanRng ? false, # build ESDM class for Botan 3.x
-
-  # client-related options (handle with care, consult source code and meson options)
-  # leave as is if in doubt
-  connectTimeoutExponent ? 28, # (1 << EXPONENT nanoseconds)
-  rxTxTimeoutExponent ? 28, # (1 << EXPONENT nanoseconds)
-  reconnectAttempts ? 10, # how often to attempt unix socket connection before giving up
+  openSSLRandProvider ? true, # build ESDM provider for OpenSSL 3.x
+  maxThreads ? 1024, # number of RPC handler threads
+  validationHelpers ? true, # used to analyze entropy output from esdm_es
+  numAuxPools ? 128, # use multiple hash pools for e.g. smartcard input
+  serverTermOnSignal ? false, # use select with timeout in server watch loop
 
   # entropy sources
   esJitterRng ? true, # enable support for the entropy source: jitter rng (running in user space)
   esJitterRngEntropyRate ? 256, # amount of entropy to account for jitter rng source
-  esJitterRngKernel ? true, # enable support for the entropy source: jitter rng (running in kernel space)
+  esJitterRngEntropyBlocks ? 128, # number of cached entropy blocks for jitterentropy
+  esJitterRngKernel ? false, # enable support for the entropy source: jitter rng (running in kernel space)
   esJitterRngKernelEntropyRate ? 256, # amount of entropy to account for kernel jitter rng source
   esCPU ? true, # enable support for the entropy source: cpu-based entropy
-  esCPUEntropyRate ? 8, # amount of entropy to account for cpu rng source
-  esKernel ? true, # enable support for the entropy source: kernel-based entropy
-  esKernelEntropyRate ? 128, # amount of entropy to account for kernel-based source
+  esCPUEntropyRate ? 256, # amount of entropy to account for cpu rng source
+  esKernel ? false, # enable support for the entropy source: kernel-based entropy
+  esKernelEntropyRate ? 256, # amount of entropy to account for kernel-based source
   esIRQ ? false, # enable support for the entropy source: interrupt-based entropy
   esIRQEntropyRate ? 256, # amount of entropy to account for interrupt-based source (only set irq XOR sched != 0)
   esSched ? false, # enable support for the entropy source: scheduler-based entropy
   esSchedEntropyRate ? 0, # amount of entropy to account for interrupt-based source (only set irq XOR sched != 0)
   esHwrand ? true, # enable support for the entropy source: /dev/hwrng
-  esHwrandEntropyRate ? 128, # amount of entropy to account for /dev/hwrng-based sources
+  esHwrandEntropyRate ? 256, # amount of entropy to account for /dev/hwrng-based sources
+
+  # kernel seeding
+  linuxKernelReseedInterval ? 60, # how often to push entropy into Linux kernel, iff seeder service is started
+  linuxKernelReseedEntropyRate ? 256, # how many bits to account on kernel (re-)seeding
 }:
 
-assert drngHashDrbg != drngChaCha20;
-assert hashSha512 != hashSha3_512;
-assert cryptoBackend == "openssl" || cryptoBackend == "botan" || cryptoBackend == "builtin";
+assert cryptoBackend == "openssl" || cryptoBackend == "botan";
 
 stdenv.mkDerivation rec {
   pname = "esdm";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "smuellerDD";
     repo = "esdm";
     rev = "v${version}";
-    hash = "sha256-5XctrI02pfCgK1P76AaSkMjiQqav6LX3SMjKr4F44sw=";
+    hash = "sha256-41vc5mB2MiQJu0HXFzSjiudlu1sRj2IP8FcFPQfu5uo=";
   };
 
   nativeBuildInputs = [
@@ -76,7 +73,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs =
-    lib.optional (cryptoBackend == "botan" || botanRng) botan3
+    lib.optional (cryptoBackend == "botan") botan3
     ++ lib.optional (cryptoBackend == "openssl" || openSSLRandProvider) openssl
     ++ lib.optional selinux libselinux
     ++ lib.optional esJitterRng jitterentropy
@@ -86,20 +83,19 @@ stdenv.mkDerivation rec {
   propagatedBuildInputs = [ protobufc ];
 
   mesonFlags = [
-    (lib.mesonBool "b_lto" false)
-    (lib.mesonBool "fips140" false)
+    (lib.mesonBool "b_lto" true)
+    (lib.mesonBool "fips140" fips140)
     (lib.mesonBool "ais2031" ais2031)
     (lib.mesonBool "sp80090c" sp80090c)
     (lib.mesonEnable "node" true) # multiple DRNGs
-    (lib.mesonOption "threading_max_threads" (toString 64))
+    (lib.mesonEnable "systemd" true) # systemd notify and socket support
+    (lib.mesonOption "threading_max_threads" (toString maxThreads))
     (lib.mesonOption "crypto_backend" cryptoBackend)
     (lib.mesonEnable "linux-devfiles" linuxDevFiles)
     (lib.mesonEnable "linux-getrandom" linuxGetRandom)
-    (lib.mesonOption "client-connect-timeout-exponent" (toString connectTimeoutExponent))
-    (lib.mesonOption "client-rx-tx-timeout-exponent" (toString rxTxTimeoutExponent))
-    (lib.mesonOption "client-reconnect-attempts" (toString reconnectAttempts))
     (lib.mesonEnable "es_jent" esJitterRng)
     (lib.mesonOption "es_jent_entropy_rate" (toString esJitterRngEntropyRate))
+    (lib.mesonOption "es_jent_entropy_blocks" (toString esJitterRngEntropyBlocks))
     (lib.mesonEnable "es_jent_kernel" esJitterRngKernel)
     (lib.mesonOption "es_jent_kernel_entropy_rate" (toString esJitterRngKernelEntropyRate))
     (lib.mesonEnable "es_cpu" esCPU)
@@ -112,15 +108,20 @@ stdenv.mkDerivation rec {
     (lib.mesonOption "es_sched_entropy_rate" (toString esSchedEntropyRate))
     (lib.mesonEnable "es_hwrand" esHwrand)
     (lib.mesonOption "es_hwrand_entropy_rate" (toString esHwrandEntropyRate))
-    (lib.mesonEnable "hash_sha512" hashSha512)
-    (lib.mesonEnable "hash_sha3_512" hashSha3_512)
     (lib.mesonEnable "selinux" selinux)
-    (lib.mesonEnable "drng_hash_drbg" drngHashDrbg)
-    (lib.mesonEnable "drng_chacha20" drngChaCha20)
     (lib.mesonEnable "openssl-rand-provider" openSSLRandProvider)
-    (lib.mesonEnable "botan-rng" botanRng)
+    (lib.mesonOption "linux-reseed-interval" (toString linuxKernelReseedInterval))
+    (lib.mesonOption "linux-reseed-entropy-count" (toString linuxKernelReseedEntropyRate))
+    (lib.mesonEnable "validation-helpers" validationHelpers)
+    (lib.mesonOption "num-aux-pools" (toString numAuxPools))
+    (lib.mesonBool "esdm-server-term-on-signal" serverTermOnSignal)
   ];
 
+  postFixup = lib.optionals fips140 ''
+    $out/bin/esdm-tool --fips-checkfile $out/bin/.esdm-server.hmac \
+                       --fips-targetfile $out/bin/esdm-server
+  '';
+
   doCheck = true;
 
   strictDeps = true;
@@ -135,7 +136,6 @@ stdenv.mkDerivation rec {
     ];
     platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [
-      orichter
       thillux
     ];
   };

pkgs/by-name/fi/fio/package.nix

@@ -4,10 +4,13 @@
   fetchFromGitHub,
   makeWrapper,
   libaio,
+  pkg-config,
   python3,
   zlib,
   withGnuplot ? false,
-  gnuplot ? null,
+  gnuplot,
+  withLibnbd ? true,
+  libnbd,
 }:
 
 stdenv.mkDerivation rec {
@@ -25,16 +28,20 @@ stdenv.mkDerivation rec {
     python3
     zlib
   ]
-  ++ lib.optional (!stdenv.hostPlatform.isDarwin) libaio;
+  ++ lib.optional (!stdenv.hostPlatform.isDarwin) libaio
+  ++ lib.optional withLibnbd libnbd;
 
   # ./configure does not support autoconf-style --build=/--host=.
   # We use $CC instead.
   configurePlatforms = [ ];
 
+  configureFlags = lib.optional withLibnbd "--enable-libnbd";
+
   dontAddStaticConfigureFlags = true;
 
   nativeBuildInputs = [
     makeWrapper
+    pkg-config
     python3.pkgs.wrapPython
   ];
 

pkgs/by-name/hy/hyprmon/package.nix

@@ -0,0 +1,28 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "hyprmon";
+  version = "0.0.12";
+
+  src = fetchFromGitHub {
+    owner = "erans";
+    repo = "hyprmon";
+    rev = "v${version}";
+    hash = "sha256-jZUtdOMmpd75CyjaXdrqXcYxcQ9q7G2YGBHoUUvycX8=";
+  };
+
+  vendorHash = "sha256-THfdsr8jSvbcV1C2C2IJNvjeeonSZDfmCo6Ws2WreBA=";
+
+  meta = {
+    description = "TUI monitor configuration tool for Hyprland with visual layout, drag-and-drop, and profile management";
+    homepage = "https://github.com/erans/hyprmon";
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ onatustun ];
+    mainProgram = "hyprmon";
+  };
+}

pkgs/by-name/li/limine/package.nix

@@ -14,7 +14,6 @@
   biosSupport ? true,
   pxeSupport ? false,
 }:
-
 let
   stdenv = llvmPackages.stdenv;
 
@@ -37,19 +36,18 @@ let
     }
     .${target} or (throw "Unsupported target ${target}");
 in
-
 # The output of the derivation is a tool to create bootable images using Limine
 # as bootloader for various platforms and corresponding binary and helper files.
 stdenv.mkDerivation (finalAttrs: {
   pname = "limine";
-  version = "10.1.0";
+  version = "10.1.1";
 
   # We don't use the Git source but the release tarball, as the source has a
   # `./bootstrap` script performing network access to download resources.
   # Packaging that in Nix is very cumbersome.
   src = fetchurl {
     url = "https://codeberg.org/Limine/Limine/releases/download/v${finalAttrs.version}/limine-${finalAttrs.version}.tar.gz";
-    hash = "sha256-Hn1njCaHcdCocnKpAZhkcMXG6tAojVQQtVAW4pVUFGI=";
+    hash = "sha256-pDhA8N7a5cTorIW8OgCimOxxfZ2slUhp3K+cb8KIAzc=";
   };
 
   enableParallelBuilding = true;

pkgs/by-name/ni/nixos-facter/package.nix

@@ -7,6 +7,7 @@
   gcc,
   pkg-config,
   makeWrapper,
+  nixosTests,
   stdenv,
   systemdMinimal,
 }:
@@ -61,6 +62,10 @@ buildGoModule rec {
     "-X github.com/numtide/nixos-facter/pkg/build.System=${stdenv.hostPlatform.system}"
   ];
 
+  passthru.tests = {
+    inherit (nixosTests) facter;
+  };
+
   meta = {
     description = "Declarative hardware configuration for NixOS";
     homepage = "https://github.com/numtide/nixos-facter";

pkgs/by-name/pe/penpot-desktop/package.nix

@@ -2,7 +2,7 @@
   lib,
   buildNpmPackage,
   copyDesktopItems,
-  electron,
+  electron_37,
   fetchFromGitHub,
   jq,
   makeDesktopItem,
@@ -15,6 +15,7 @@ let
   description = "Unofficial desktop application for the open-source design tool, Penpot";
   icon = "penpot";
   nodejs = nodejs_24;
+  electron = electron_37;
 in
 buildNpmPackage rec {
   pname = "penpot-desktop";

pkgs/by-name/td/tdnf/package.nix

@@ -31,6 +31,11 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://patch-diff.githubusercontent.com/raw/vmware/tdnf/pull/410.patch";
       hash = "sha256-p/ix5O1J/lj2fw7qJokT+wPN4ROoulnVqByfxgFvuEo=";
     })
+    # Bump minimal cmake version
+    (fetchpatch2 {
+      url = "https://github.com/vmware/tdnf/commit/24211f2077d2423e511c43f21cd5ee5b53fa4021.patch?full_index=1";
+      hash = "sha256-twzyVV+VgtRljj1E70Tq5U0sNEiSWU/rG9buoAYDF0o=";
+    })
   ];
 
   nativeBuildInputs = [

pkgs/by-name/te/telegram-bot-api/package.nix

@@ -11,13 +11,14 @@
 
 stdenv.mkDerivation {
   pname = "telegram-bot-api";
-  version = "8.2";
+  version = "9.2";
 
   src = fetchFromGitHub {
     owner = "tdlib";
     repo = "telegram-bot-api";
-    rev = "fa6706fc8f6e22b3c25b512ede6474613f32b32b";
-    hash = "sha256-0ra1sL121ksUIhpV738tL3y1gu1csMf0rK95G8ElMuo=";
+    # https://github.com/tdlib/telegram-bot-api/issues/783
+    rev = "3b6a0b769c4a7fbe064087a4ad9fe6b1dbda498f";
+    hash = "sha256-EpDO1ulIT/RIUjc06BtGRpqdQIMpma5+DRy7i8YVhiU=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/ti/tint2/fix-cmake-version.patch

@@ -0,0 +1,22 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 336dff9..8b8a853 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -1,5 +1,5 @@
++cmake_minimum_required( VERSION 3.10 )
+ project( tint2 )
+-cmake_minimum_required( VERSION 2.8.5 )
+ 
+ option( ENABLE_BATTERY "Enable battery status plugin" ON )
+ option( ENABLE_TINT2CONF "Enable tint2conf build, a GTK+3 theme configurator for tint2" ON )
+diff --git a/src/tint2conf/CMakeLists.txt b/src/tint2conf/CMakeLists.txt
+index 747b9ac..cbe13bb 100644
+--- a/src/tint2conf/CMakeLists.txt
++++ b/src/tint2conf/CMakeLists.txt
+@@ -1,5 +1,5 @@
++cmake_minimum_required(VERSION 3.10)
+ project(tint2conf)
+-cmake_minimum_required(VERSION 2.6)
+ 
+ include( FindPkgConfig )
+ pkg_check_modules( X11_T2C REQUIRED x11 xcomposite xdamage xinerama xrender xrandr>=1.3 )

pkgs/by-name/ti/tint2/package.nix

@@ -44,6 +44,8 @@ stdenv.mkDerivation rec {
       url = "https://gitlab.com/nick87720z/tint2/uploads/7de4501a4fa4fffa5ba8bb0fa3d19f78/glib.patch";
       hash = "sha256-K547KYlRkVl1s2THi3ZCRuM447EFJwTqUEBjKQnV8Sc=";
     })
+    # https://gitlab.com/nick87720z/tint2/-/merge_requests/4
+    ./fix-cmake-version.patch
   ];
 
   # Fix build with gcc14
@@ -80,6 +82,7 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     # Add missing dependency on libm
+    # https://gitlab.com/nick87720z/tint2/-/merge_requests/3
     substituteInPlace src/tint2conf/CMakeLists.txt \
       --replace-fail "RSVG_LIBRARIES} )" "RSVG_LIBRARIES} m)"
 
@@ -90,11 +93,12 @@ stdenv.mkDerivation rec {
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
 
-  meta = with lib; {
+  meta = {
+    mainProgram = "tint2";
     homepage = "https://gitlab.com/nick87720z/tint2";
     description = "Simple panel/taskbar unintrusive and light (memory, cpu, aestetic)";
-    license = licenses.gpl2Only;
-    platforms = platforms.linux;
-    maintainers = [ maintainers.romildo ];
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.linux;
+    maintainers = [ lib.maintainers.romildo ];
   };
 }

pkgs/by-name/tr/trilium-desktop/package.nix

@@ -5,7 +5,7 @@
   fetchurl,
   makeBinaryWrapper,
   # use specific electron since it has to load a compiled module
-  electron_37,
+  electron_38,
   autoPatchelfHook,
   makeDesktopItem,
   copyDesktopItems,
@@ -111,7 +111,7 @@ let
       asar pack $tmp/ $out/share/trilium/resources/app.asar
       rm -rf $tmp
 
-      makeWrapper ${lib.getExe electron_37} $out/bin/trilium \
+      makeWrapper ${lib.getExe electron_38} $out/bin/trilium \
         "''${gappsWrapperArgs[@]}" \
         --set-default ELECTRON_IS_DEV 0 \
         --add-flags $out/share/trilium/resources/app.asar

pkgs/by-name/va/vacuum-tube/package.nix

@@ -9,16 +9,16 @@
 
 buildNpmPackage rec {
   pname = "vacuum-tube";
-  version = "1.3.19";
+  version = "1.3.20";
 
   src = fetchFromGitHub {
     owner = "shy1132";
     repo = "VacuumTube";
     tag = "v${version}";
-    hash = "sha256-WJUxLS7rthRfnXbyHwcC53U/qUvqxlZL5EQk3IareFQ=";
+    hash = "sha256-DmuJ01xrA+rrKnzVQT3X2bfcIwqdn+plWg5o1GwyiS4=";
   };
 
-  npmDepsHash = "sha256-Q9a+B+kRj5n8XcZD1Ue+HMx/VP8/LfYb8Jm6SIPNY0U=";
+  npmDepsHash = "sha256-L/2qSPkHNH7H0Pk4WrX0gfwJs1Dy5DDyJmggCO/ET9s=";
 
   env = {
     ELECTRON_SKIP_BINARY_DOWNLOAD = true;

pkgs/development/ocaml-modules/ca-certs-nss/default.nix

@@ -14,13 +14,13 @@
 
 buildDunePackage rec {
   pname = "ca-certs-nss";
-  version = "3.115";
+  version = "3.117";
 
   minimalOCamlVersion = "4.13";
 
   src = fetchurl {
     url = "https://github.com/mirage/ca-certs-nss/releases/download/v${version}/ca-certs-nss-${version}.tbz";
-    hash = "sha256-cjjvrekr6i7aEj0Ne/+Jhgdi7lf89xh07FlHuS5nOA8=";
+    hash = "sha256-SdcTJ3Og5h5XvqnDqp1flw/hwLWINjlqeT/vIwAg380=";
   };
 
   propagatedBuildInputs = [

pkgs/os-specific/linux/rtl8821ce/default.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rtl8821ce";
-  version = "0-unstable-2025-08-20";
+  version = "0-unstable-2025-10-13";
 
   src = fetchFromGitHub {
     owner = "tomaspinho";
     repo = "rtl8821ce";
-    rev = "5df613d114d1ca6072aeaf9f64666029896eed61";
-    hash = "sha256-JEaMfpu2F9Pcg7aLwKEUnRMMqC0Y0r1WRmHMCRba280=";
+    rev = "4e6b887f0d8c4091a4df9da9fcead9a8294b41ad";
+    hash = "sha256-fY0j6VzwAIsD62+snAWfIgGXcwne0mOwIE/Yh25lwTY=";
   };
 
   hardeningDisable = [ "pic" ];

pkgs/top-level/all-packages.nix

@@ -6263,9 +6263,9 @@ with pkgs;
       electron-source.electron_38
     else
       electron_38-bin;
-  electron = electron_37;
-  electron-bin = electron_37-bin;
-  electron-chromedriver = electron-chromedriver_37;
+  electron = electron_38;
+  electron-bin = electron_38-bin;
+  electron-chromedriver = electron-chromedriver_38;
 
   autoconf = callPackage ../development/tools/misc/autoconf { };
   autoconf269 = callPackage ../development/tools/misc/autoconf/2.69.nix { };
@@ -7075,6 +7075,7 @@ with pkgs;
     botan2
     botan3
     ;
+  botanEsdm = botan3.override { withEsdm = true; };
 
   c-ares = callPackage ../development/libraries/c-ares { };