Merge staging-next into staging

ci/pinned.json

@@ -9,9 +9,9 @@
       },
       "branch": "nixpkgs-unstable",
       "submodules": false,
-      "revision": "641d909c4a7538f1539da9240dedb1755c907e40",
-      "url": "https://github.com/NixOS/nixpkgs/archive/641d909c4a7538f1539da9240dedb1755c907e40.tar.gz",
-      "hash": "10hpb1aw884k3zzcy1mhf47dqvfagiyx7kr6hg0p5xcwg04mkx8x"
+      "revision": "a1f79a1770d05af18111fbbe2a3ab2c42c0f6cd0",
+      "url": "https://github.com/NixOS/nixpkgs/archive/a1f79a1770d05af18111fbbe2a3ab2c42c0f6cd0.tar.gz",
+      "hash": "06lqp08pfgnsn8kb4kdpjmmjyhj4bgniv7yf9bjczg4kn25l1dz6"
     },
     "treefmt-nix": {
       "type": "Git",
@@ -22,9 +22,9 @@
       },
       "branch": "main",
       "submodules": false,
-      "revision": "7d81f6fb2e19bf84f1c65135d1060d829fae2408",
-      "url": "https://github.com/numtide/treefmt-nix/archive/7d81f6fb2e19bf84f1c65135d1060d829fae2408.tar.gz",
-      "hash": "1cg20q8ja8k2nb7mzy95hgmd8whxapc3fbyndh1ip5dr6d1grxfs"
+      "revision": "128222dc911b8e2e18939537bed1762b7f3a04aa",
+      "url": "https://github.com/numtide/treefmt-nix/archive/128222dc911b8e2e18939537bed1762b7f3a04aa.tar.gz",
+      "hash": "1p81chik0sb8aligng579m4h0klnndxv76z0p4gyhr4g3s9cydpw"
     }
   },
   "version": 5

nixos/modules/services/continuous-integration/jenkins/default.nix

@@ -254,6 +254,33 @@ in
         StateDirectory = lib.mkIf (lib.hasPrefix "/var/lib/jenkins" cfg.home) "jenkins";
         # For (possible) socket use
         RuntimeDirectory = "jenkins";
+        AmbientCapabilities = "";
+        CapabilityBoundingSet = "";
+        LockPersonality = true;
+        # MemoryDenyWriteExecute = false;   Breaks execution;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        PrivateTmp = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectSystem = "full";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [
+          "AF_UNIX"
+          "AF_INET"
+          "AF_INET6"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        UMask = 27;
       };
     };
   };

nixos/modules/services/networking/murmur.nix

@@ -355,7 +355,10 @@ in
         ProtectKernelLogs = true;
         ProtectKernelModules = true;
         ProtectKernelTunables = true;
-        ProtectSystem = "full";
+        ProtectSystem = "strict";
+        ReadWritePaths = [
+          cfg.stateDir
+        ];
         RestrictAddressFamilies = [
           "AF_INET"
           "AF_INET6"

nixos/modules/services/web-apps/invoiceplane.nix

@@ -95,6 +95,9 @@ let
         ${concatMapStringsSep "\n" (
           template: "cp -r ${template}/. $out/application/views/invoice_templates/pdf/"
         ) cfg.invoiceTemplates}
+        ${concatMapStringsSep "\n" (
+          template: "cp -r ${template}/. $out/application/views/quote_templates/pdf/"
+        ) cfg.quoteTemplates}
       '';
     };
 
@@ -189,6 +192,38 @@ let
           '';
         };
 
+        quoteTemplates = mkOption {
+          type = types.listOf types.path;
+          default = [ ];
+          description = ''
+            List of path(s) to respective template(s) which are copied from the 'quote_templates/pdf' directory.
+
+            ::: {.note}
+            These templates need to be packaged before use, see example.
+            :::
+          '';
+          example = literalExpression ''
+            let
+              # Let's package an example template
+              template-vtdirektmarketing = pkgs.stdenv.mkDerivation {
+                name = "vtdirektmarketing";
+                # Download the template from a public repository
+                src = pkgs.fetchgit {
+                  url = "https://git.project-insanity.org/onny/invoiceplane-vtdirektmarketing.git";
+                  sha256 = "1hh0q7wzsh8v8x03i82p6qrgbxr4v5fb05xylyrpp975l8axyg2z";
+                };
+                sourceRoot = ".";
+                # Installing simply means copying template php file to the output directory
+                installPhase = ""
+                  mkdir -p $out
+                  cp invoiceplane-vtdirektmarketing/vtdirektmarketing.php $out/
+                "";
+              };
+            # And then pass this package to the template list like this:
+            in [ template-vtdirektmarketing ]
+          '';
+        };
+
         poolConfig = mkOption {
           type =
             with types;

pkgs/README.md

@@ -38,7 +38,9 @@ Before adding a new package, please consider the following questions:
 * How realistic is it that it will be used by other people?
   It's good that nixpkgs caters to various niches, but if it's a niche of 5 people it's probably too small.
   A good estimate is checking upstream issues and pull requests, or other software repositories.
-  Library packages should have at least one dependent.
+    * Library packages should have at least one dependent.
+      If possible, that dependent should be packaged in the same PR the library is added in, as a sanity check.
+      If it is not possible to package the dependent, a minimal test program should be added to `passthru.tests`.
 * Is the software actively maintained upstream?
   Especially packages that are security-critical, rely on fast-moving dependencies, or affect data integrity should see regular maintenance.
 * Are you willing to maintain the package?

pkgs/applications/video/mpv/default.nix

@@ -39,7 +39,7 @@
   libvdpau,
   libxkbcommon,
   lua,
-  makeWrapper,
+  makeBinaryWrapper,
   libgbm,
   meson,
   mujs,
@@ -159,7 +159,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     buildPackages.darwin.sigtool
     swift
-    makeWrapper
+    makeBinaryWrapper
   ]
   ++ lib.optionals waylandSupport [ wayland-scanner ];
 

pkgs/applications/video/mpv/wrapper.nix

@@ -3,7 +3,7 @@
   stdenv,
   buildEnv,
   lib,
-  makeWrapper,
+  makeBinaryWrapper,
   mpvScripts,
   symlinkJoin,
   writeTextDir,
@@ -102,7 +102,7 @@ let
       # TODO: don't link all mpv outputs and convert package to mpv-unwrapped?
       paths = [ mpv.all ];
 
-      nativeBuildInputs = [ makeWrapper ];
+      nativeBuildInputs = [ makeBinaryWrapper ];
 
       passthru.unwrapped = mpv;
 

pkgs/applications/video/plex-mpv-shim/default.nix

@@ -16,24 +16,16 @@
 
 buildPythonApplication rec {
   pname = "plex-mpv-shim";
-  version = "1.11.0";
+  version = "1.11.0-unstable-2025-03-17";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "iwalton3";
     repo = pname;
-    tag = "v${version}";
-    sha256 = "sha256-hUGKOJEDZMK5uhHoevFt1ay6QQEcoN4F8cPxln5uMRo=";
+    rev = "fb1f1f3325285e33f9ce3425e9361f5f99277d9a"; # Fetch from this commit to include fixes for python library issues. Should be reverted to release 1.12.0
+    hash = "sha256-tk+bIS93Y726sbrRXEyS7+4ku+g40Z7Aj0++wItjW2s=";
   };
 
-  patches = [
-    # pull in upstream commit to fix python-mpv dependency name -- remove when version > 1.11.0
-    (fetchpatch {
-      url = "https://github.com/iwalton3/plex-mpv-shim/commit/d8643123a8ec79216e02850b08f63b06e4e0a2ea.diff";
-      hash = "sha256-nc+vwYnAtMjVzL2fIQeTAqhf3HBseL+2pFEtv8zNUXo=";
-    })
-  ];
-
   nativeBuildInputs = [
     wrapGAppsHook3
     gobject-introspection

pkgs/by-name/_1/_1password-gui/sources.json

@@ -1,28 +1,28 @@
 {
   "stable": {
     "linux": {
-      "version": "8.11.8",
+      "version": "8.11.10",
       "sources": {
         "x86_64": {
-          "url": "https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.11.8.x64.tar.gz",
-          "hash": "sha256-gidi2lnKFxcSxi6lekWODp9TJNGofWFp72Bp30KoRfY="
+          "url": "https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.11.10.x64.tar.gz",
+          "hash": "sha256-AKqr1jMTFXPYYYJu8wD9P+xXwxobSbpjXwmBQhWYVhg="
         },
         "aarch64": {
-          "url": "https://downloads.1password.com/linux/tar/stable/aarch64/1password-8.11.8.arm64.tar.gz",
-          "hash": "sha256-pZqhWd2K+5+B3eK52OZNSPh3Jx4MKBy+hAnC5tihzhM="
+          "url": "https://downloads.1password.com/linux/tar/stable/aarch64/1password-8.11.10.arm64.tar.gz",
+          "hash": "sha256-Xz66LYXgX64P9TTmI8D8Wtrz7qKTBrZx+rP26yJqcTw="
         }
       }
     },
     "darwin": {
-      "version": "8.11.8",
+      "version": "8.11.10",
       "sources": {
         "x86_64": {
-          "url": "https://downloads.1password.com/mac/1Password-8.11.8-x86_64.zip",
-          "hash": "sha256-MYyWof17KLVRtnPqSICnny24f8YoXJWeGwErWFrb6C4="
+          "url": "https://downloads.1password.com/mac/1Password-8.11.10-x86_64.zip",
+          "hash": "sha256-sQK+qHdGvpIi+h2az8PYq6kROmiaGKBbNGFGXJSe1eg="
         },
         "aarch64": {
-          "url": "https://downloads.1password.com/mac/1Password-8.11.8-aarch64.zip",
-          "hash": "sha256-wii983COooBCXyiV2a2MC7SKnFJLp1JashsOzT3+ZRA="
+          "url": "https://downloads.1password.com/mac/1Password-8.11.10-aarch64.zip",
+          "hash": "sha256-Hb+DEGM7ymDuf71uKTy8L/9bUWZ2+QD+w7h2tNvp0Pk="
         }
       }
     }

pkgs/by-name/as/asciinema_3/package.nix

@@ -10,17 +10,17 @@
 let
   self = rustPlatform.buildRustPackage {
     pname = "asciinema";
-    version = "3.0.0-rc.5";
+    version = "3.0.0";
 
     src = fetchFromGitHub {
       name = "asciinema-source-${self.version}";
       owner = "asciinema";
       repo = "asciinema";
       rev = "v${self.version}";
-      hash = "sha256-CxssC3ftnXgxdvRO7CrVgBSVkh7DPjXRNRet4fB2BKc=";
+      hash = "sha256-P92EZyg8f/mm66SmXAyPX9f4eMgOP6lyn3Uqhqh+D0I=";
     };
 
-    cargoHash = "sha256-OsynIQeGjXHD1E9iDH4P7Jksr1APtGZkchzZB0DawIw=";
+    cargoHash = "sha256-2DQqtCcvSO43+RcMN2/BGqvf+cp/WvzUY4dxVpNcbGU=";
 
     env.ASCIINEMA_GEN_DIR = "gendir";
 
@@ -35,13 +35,6 @@ let
         --zsh gendir/completion/_asciinema
     '';
 
-    checkFlags = [
-      # ---- pty::tests::exec_quick stdout ----
-      # thread 'pty::tests::exec_quick' panicked at src/pty.rs:494:10:
-      # called `Result::unwrap()` on an `Err` value: EBADF: Bad file number
-      "--skip=pty::tests::exec_quick"
-    ];
-
     strictDeps = true;
 
     passthru = {

pkgs/by-name/cn/cnpypp/package.nix

@@ -0,0 +1,55 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  boost,
+  libzip,
+  range-v3,
+}:
+
+stdenv.mkDerivation {
+  pname = "cnpypp";
+  version = "0-unstable-2025-06-22";
+
+  src = fetchFromGitHub {
+    owner = "mreininghaus";
+    repo = "cnpypp";
+    rev = "c6cd4e2078e4f39e862720b66fb211c45577c510";
+    hash = "sha256-aV57931nis0W2cwCNeMjQDip9Au7K76VpC/BqACnT5M=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [
+    boost
+    libzip
+    range-v3
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeFeature "CNPYPP_SPAN_IMPL" "BOOST")
+  ];
+
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+
+  checkPhase = ''
+    runHook preCheck
+
+    ./example1
+    ./example2
+    ./example_c
+    ./range_example
+    ./range_zip_example
+    ./npz_speedtest
+
+    runHook postCheck
+  '';
+
+  meta = {
+    description = "C++17 library that allows to read and write NumPy data files";
+    homepage = "https://github.com/mreininghaus/cnpypp";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jherland ];
+    platforms = lib.platforms.all;
+  };
+}

pkgs/by-name/co/cosmic-reader/package.nix

@@ -19,13 +19,13 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-reader";
-  version = "0-unstable-2025-08-29";
+  version = "0-unstable-2025-09-21";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-reader";
-    rev = "b877809273243f0630b250fd60f12fff48e0bd22";
-    hash = "sha256-kJApZgQkHDP6lD9E2vPLyVGQ0o/xibm83N9CfIJAd0A=";
+    rev = "a5b1b5c0583deacafde19de4ee936cdd126b25df";
+    hash = "sha256-yXY1t67ws2PvK7IubNHT0jp+xnfDAdyK5H7LCMGcMQI=";
   };
 
   cargoHash = "sha256-4ofAtZN3FpYwNahinldALbdEJA5lDwa+CUsVIISnSTc=";

pkgs/by-name/cr/croc/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "croc";
-  version = "10.2.4";
+  version = "10.2.5";
 
   src = fetchFromGitHub {
     owner = "schollz";
     repo = "croc";
     rev = "v${version}";
-    hash = "sha256-iC2Yki8RN+csvNvIQP65bAIN1Q0KR5DUIiZqEVZqG+o=";
+    hash = "sha256-6zeJfRZFpfHsNSD1dICPoOt9HQBaw2eKSX4LH7fLyEk=";
   };
 
-  vendorHash = "sha256-bFn2C5py2STLz8YBlnyK2XDBlgoBnXujeBizN9cDTI0=";
+  vendorHash = "sha256-zMN4SxgnHwLBZ8Lqk6wj/Ne3Hx41VVhf/01DgHT8/Tk=";
 
   subPackages = [ "." ];
 

pkgs/by-name/de/deskflow/package.nix

@@ -34,13 +34,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "deskflow";
-  version = "1.23.0";
+  version = "1.24.0";
 
   src = fetchFromGitHub {
     owner = "deskflow";
     repo = "deskflow";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-REc6TY0eZJgLcDDo3R4evdYuXdgQ8oKNEvhy1zcdTQc=";
+    hash = "sha256-eXQXHi8TMMwyIkZ7gQ9GHIzSOM2rtzV+w1R7hxS+WSA=";
   };
 
   postPatch = ''

pkgs/by-name/go/gonic/package.nix

@@ -20,12 +20,12 @@
 
 buildGoModule rec {
   pname = "gonic";
-  version = "0.17.0";
+  version = "0.18.0";
   src = fetchFromGitHub {
     owner = "sentriz";
     repo = "gonic";
     rev = "v${version}";
-    sha256 = "sha256-/oQKlM8mJuFuIEAXwGuJtdS4mEZXvGPmOUD992Z08ww=";
+    sha256 = "sha256-qWUADZntJg8722Kxt3z1cwIOTcjxS0PYC0RHzselkdI=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -33,7 +33,7 @@ buildGoModule rec {
     taglib
     zlib
   ];
-  vendorHash = "sha256-EPl8qy8d7fs0GJ0b29nBqpg4JYF84Kd4my74ySlCwVA=";
+  vendorHash = "sha256-HY+57SJsz/kPxSadjFl4LQ1Jlu3A5I+rpih67cMMGHA=";
 
   # TODO(Profpatsch): write a test for transcoding support,
   # since it is prone to break

pkgs/by-name/go/gopass-jsonapi/package.nix

@@ -13,7 +13,7 @@
 
 let
 
-  # https://github.com/gopasspw/gopass-jsonapi/blob/v1.15.16/internal/jsonapi/manifest/manifest_path_linux.go
+  # https://github.com/gopasspw/gopass-jsonapi/blob/v1.15.18/internal/jsonapi/manifest/manifest_path_linux.go
   manifestPaths = {
     firefox = "$out/lib/mozilla/native-messaging-hosts/com.justwatch.gopass.json";
     chrome = "$out/etc/opt/chrome/native-messaging-hosts/com.justwatch.gopass.json";
@@ -27,16 +27,16 @@ let
 in
 buildGoModule rec {
   pname = "gopass-jsonapi";
-  version = "1.15.16";
+  version = "1.15.18";
 
   src = fetchFromGitHub {
     owner = "gopasspw";
     repo = "gopass-jsonapi";
     rev = "v${version}";
-    hash = "sha256-Nl69SSqs18zG7eYhBafXFGBVNQglSeffg7Z0Y8zuLmc=";
+    hash = "sha256-TN6GC+T2S3xdUGtQFbsSnFtdb+DsERLjLMCPCb8Q+2c=";
   };
 
-  vendorHash = "sha256-zncWJSA6cUthwcFZQXtJmwJZujaXt0Rubcga8D0+ZQc=";
+  vendorHash = "sha256-PJOGnx0zSxK95bWbweF/VoSfyXkkmru8XYToSh48YOw=";
 
   subPackages = [ "." ];
 
@@ -72,7 +72,7 @@ buildGoModule rec {
       # `gopass-jsonapi configure` will ask for them. (`--libpath` and `--global`
       # are overriden by `--manifest-path`. `--libpath` is only used to
       # compute Firefox's global manifest path. See
-      # https://github.com/gopasspw/gopass-jsonapi/blob/v1.15.16/setup_others.go#L33-L46)
+      # https://github.com/gopasspw/gopass-jsonapi/blob/v1.15.18/setup_others.go#L33-L46)
       #
       # `gopass-jsonapi configure` ask for confirmation before writing any files,
       # `echo y` gives it.

pkgs/by-name/go/goshs/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "goshs";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "patrickhener";
     repo = "goshs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Me57EOUrpz37fsLYQpmPYjrhIokanS6HmICSjHmqeyU=";
+    hash = "sha256-MgWYbM48VbbmiY5mlDWnyU20/SPziHfZQXwNRZ435Mg=";
   };
 
-  vendorHash = "sha256-bDfeQQMMMUGLNvmFKEUgGhFkvY3emQp9lNVPbz2QiNk=";
+  vendorHash = "sha256-eu4ytWargmwSfCVfXPykCX0VD7XO7m/T8Her10XpM3s=";
 
   ldflags = [
     "-s"

pkgs/by-name/is/istat-menus/package.nix

@@ -10,11 +10,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "istat-menus";
-  version = "7.10.2";
+  version = "7.10.4";
 
   src = fetchurl {
     url = "https://cdn.istatmenus.app/files/istatmenus${lib.versions.major finalAttrs.version}/versions/iStatMenus${finalAttrs.version}.zip";
-    hash = "sha256-NDjIsCAxTcCo6APaWyuYmil8b0gzJEmSxFxqm2IQ5dU=";
+    hash = "sha256-9fw0J492ywzuKXGR47WAjL6IROCRByCn7KsbQecUU+w=";
   };
 
   sourceRoot = ".";
@@ -48,7 +48,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     description = "Set of nine separate and highly configurable menu items that let you know exactly what's going on inside your Mac";
     homepage = "https://bjango.com/mac/istatmenus/";
     license = lib.licenses.unfree;
-    maintainers = with lib.maintainers; [ FlameFlag ];
+    maintainers = with lib.maintainers; [
+      FlameFlag
+      iedame
+    ];
     platforms = lib.platforms.darwin;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
   };

pkgs/by-name/it/itsycal/package.nix

@@ -6,11 +6,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "itsycal";
-  version = "0.15.5";
+  version = "0.15.6";
 
   src = fetchzip {
     url = "https://itsycal.s3.amazonaws.com/Itsycal-${finalAttrs.version}.zip";
-    hash = "sha256-kRO9zcyi8Di0NNuT158htKXt4wo7nVys+AV+1EgS1ZI=";
+    hash = "sha256-e1h81Lsi9mC/3HfUbCk9JkLztGZSVRG6NeQb9voPDk0=";
   };
 
   installPhase = ''
@@ -27,7 +27,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     description = "Tiny menu bar calendar";
     homepage = "https://www.mowglii.com/itsycal/";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ FlameFlag ];
+    maintainers = with lib.maintainers; [
+      FlameFlag
+      iedame
+    ];
     platforms = lib.platforms.darwin;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
   };

pkgs/by-name/je/jenkins/package.nix

@@ -18,11 +18,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "jenkins";
-  version = "2.516.2";
+  version = "2.516.3";
 
   src = fetchurl {
     url = "https://get.jenkins.io/war-stable/${finalAttrs.version}/jenkins.war";
-    hash = "sha256-7WucCZXXgGLgVcekKgVbZRh8TSbqNvubSdjy3Ya8b8g=";
+    hash = "sha256-gbOrzA8kzqSOdO/+FS9p3F8NiA7cDCc3xhRGs8WZLAA=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/by-name/mi/millipixels/package.nix

@@ -3,6 +3,7 @@
   stdenv,
   fetchFromGitLab,
   fetchpatch,
+  gitUpdater,
   glib,
   meson,
   ninja,
@@ -25,14 +26,14 @@
 
 stdenv.mkDerivation rec {
   pname = "millipixels";
-  version = "0.22.0";
+  version = "0.23.0";
 
   src = fetchFromGitLab {
     owner = "Librem5";
     repo = "millipixels";
     rev = "v${version}";
     domain = "source.puri.sm";
-    hash = "sha256-pRREQRYyD9+dpRvcfsNiNthFy08Yeup9xDn+x+RWDrE=";
+    hash = "sha256-Sj14t6LeZWNONcgrwJxN4J1/85m1SLgmmcRnHQUULHI=";
   };
   patches = [
     # fix for https://source.puri.sm/Librem5/millipixels/-/issues/87, can be removed with the next release (if there ever will be one)
@@ -74,6 +75,10 @@ stdenv.mkDerivation rec {
       }
   '';
 
+  passthru.updateScript = gitUpdater {
+    rev-prefix = "v";
+  };
+
   meta = with lib; {
     description = "Camera application for the Librem 5";
     homepage = "https://source.puri.sm/Librem5/millipixels";

pkgs/by-name/ne/nextcloud-client/package.nix

@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation rec {
   pname = "nextcloud-client";
-  version = "3.17.1";
+  version = "3.17.2";
 
   outputs = [
     "out"
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     owner = "nextcloud-releases";
     repo = "desktop";
     tag = "v${version}";
-    hash = "sha256-HXi3DDjOFLY9G+aK+QrkmLvLwL6s9lAT+8jVpG87eNM=";
+    hash = "sha256-jBlQh5tHP+2LyFCnP0m/ud3nU40i5cWtUwSeM5auQX8=";
   };
 
   patches = [

pkgs/by-name/ol/olympus/package.nix

@@ -18,6 +18,7 @@
   loennWrapper ? null,
   miniinstallerWrapper ? null,
   skipHandlerCheck ? false, # whether to skip olympus xdg-mime check, true will override it
+  finderHints ? [ ],
 }:
 let
 
@@ -49,6 +50,12 @@ let
     else
       (wrapper-to-env miniinstallerWrapper);
 
+  finderHints' =
+    if lib.isList finderHints then
+      lib.concatMapStringsSep ":" (hint: "${hint}") finderHints
+    else
+      "${finderHints}";
+
 in
 symlinkJoin {
 
@@ -66,6 +73,7 @@ symlinkJoin {
       --set-default OLYMPUS_CELESTE_WRAPPER "${wrapper-to-env celesteWrapper}" \
       --set-default OLYMPUS_LOENN_WRAPPER "${wrapper-to-env loennWrapper}"  \
       --set-default OLYMPUS_MINIINSTALLER_WRAPPER "${miniinstaller-wrapper}" \
-      --set-default OLYMPUS_SKIP_SCHEME_HANDLER_CHECK "${if skipHandlerCheck then "1" else "0"}"
+      --set-default OLYMPUS_SKIP_SCHEME_HANDLER_CHECK "${if skipHandlerCheck then "1" else "0"}" \
+      --suffix OLYMPUS_FINDER_HINTS : "${finderHints'}"
   '';
 }

pkgs/by-name/om/omnictl/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "omnictl";
-  version = "1.0.1";
+  version = "1.1.4";
 
   src = fetchFromGitHub {
     owner = "siderolabs";
     repo = "omni";
     rev = "v${version}";
-    hash = "sha256-T7sX3mIZl361tyG0q/diMakRFAMi7wtiJLfv5VeVHSg=";
+    hash = "sha256-wPatXY9hl1YEzEQyvn+As2MBssCXFJCfNbYlwwdgGR0=";
   };
 
-  vendorHash = "sha256-MdWEMUAAUH4cEyKnANLax05h6ZuhBIXEvOnJ1qOxvWE=";
+  vendorHash = "sha256-9BzR5ZjSoaPYxMhweNaOalFsvX5BM4EVX8HAR17Xzoc=";
 
   ldflags = [
     "-s"

pkgs/by-name/po/portfolio/package.nix

@@ -34,11 +34,11 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "PortfolioPerformance";
-  version = "0.79.1";
+  version = "0.80.0";
 
   src = fetchurl {
     url = "https://github.com/buchen/portfolio/releases/download/${finalAttrs.version}/PortfolioPerformance-${finalAttrs.version}-linux.gtk.x86_64.tar.gz";
-    hash = "sha256-oJjYnJvgNpYpbJ5QSV4dwaB7FEaIqCbkAmzsYpjyfbc=";
+    hash = "sha256-2Qpyc4SXjQQtvDxYxrZrFt91BptlzFNC7Psl9MxII6I=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/pr/prometheus/package.nix

@@ -33,7 +33,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "prometheus";
-  version = "3.5.0";
+  version = "3.6.0";
 
   outputs = [
     "out"
@@ -45,14 +45,14 @@ buildGoModule (finalAttrs: {
     owner = "prometheus";
     repo = "prometheus";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QBmtJ+qBIwQzfJ7tx0P9/3kl6UaZou7qp8jrI+Qrcck=";
+    hash = "sha256-GowtA1iTx6lpRW+RBLYFc8s5H8ECPEmcbdVJvGHl5Cw=";
   };
 
-  vendorHash = "sha256-Svm+rH/cmS9mjiQHVucwKHy6ilw3mgySjRdC3ivw0YE=";
+  vendorHash = "sha256-xGMBd/MhwjCbrQrP5d5aSd99F8GN6wB3jaHpOh0M7OA=";
 
   webUiStatic = fetchurl {
     url = "https://github.com/prometheus/prometheus/releases/download/v${finalAttrs.version}/prometheus-web-ui-${finalAttrs.version}.tar.gz";
-    hash = "sha256-j+wOQ8m2joXZ3/C6bO8pxroM/hntVLP/QhoWVmdLir4=";
+    hash = "sha256-lw097NTDJUWm2RY0RUg/5djNdbj+W9hRdIaF2cQz4Bo=";
   };
 
   excludedPackages = [

pkgs/by-name/ra/railway/package.nix

@@ -7,16 +7,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "railway";
-  version = "4.7.3";
+  version = "4.8.0";
 
   src = fetchFromGitHub {
     owner = "railwayapp";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-1I9YpM89m5NsUYzsFkknMcMJDsOnZEeqXRLhdaCuVNI=";
+    hash = "sha256-zZiEhXVIffYALiXiKwLlPpr8XchGii/i6VmDnoZTeq0=";
   };
 
-  cargoHash = "sha256-2FuK72cyOCEeIjzIoU4cGjHsPvG/yo1sT5TiFK8vNfw=";
+  cargoHash = "sha256-Khk4D7xSfm4q3EWR9UHSzrf+m6NHo74wrPYYAh6tG4g=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/re/rewaita/package.nix

@@ -12,10 +12,11 @@
   appstream-glib,
   blueprint-compiler,
   libadwaita,
+  libportal,
   nix-update-script,
 }:
 let
-  version = "1.0.1";
+  version = "1.0.5";
 in
 python3Packages.buildPythonApplication {
   pname = "rewaita";
@@ -26,16 +27,12 @@ python3Packages.buildPythonApplication {
     owner = "SwordPuffin";
     repo = "Rewaita";
     tag = "v${version}";
-    hash = "sha256-adSXq+DFw3IQxNuUkP1FcKlIh9h4Zb0tJKswYs3S92E=";
+    hash = "sha256-Q4HUly78liI0OfmD9llR+00qUKE+mioeNE0TIypCB9k=";
   };
 
-  # Prevent the app from copying the RO flag of files from /nix/store
   postPatch = ''
-    substituteInPlace src/interface_to_shell_theme.py \
-      --replace-fail 'shutil.copy2' 'shutil.copyfile'
-
     substituteInPlace src/window.py \
-      --replace-fail 'shutil.copy' 'shutil.copyfile'
+      --replace-fail 'shutil.copy(' 'shutil.copyfile('
   '';
 
   strictDeps = true;
@@ -59,6 +56,7 @@ python3Packages.buildPythonApplication {
   buildInputs = [
     libadwaita
     gtk4
+    libportal
   ];
 
   dontWrapGApps = true;
@@ -73,6 +71,9 @@ python3Packages.buildPythonApplication {
     license = lib.licenses.gpl3Plus;
     mainProgram = "rewaita";
     platforms = lib.platforms.linux;
-    maintainers = [ lib.maintainers.awwpotato ];
+    maintainers = with lib.maintainers; [
+      awwpotato
+      getchoo
+    ];
   };
 }

pkgs/by-name/ru/rure/Cargo.lock

@@ -13,21 +13,21 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.172"
+version = "0.2.175"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d750af042f7ef4f724306de029d18836c26c1765a54a6a3f094cbd23a7267ffa"
+checksum = "6a82ae493e598baaea5209805c49bbf2ea7de956d50d7da0da1164f9c6d28543"
 
 [[package]]
 name = "memchr"
-version = "2.7.4"
+version = "2.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
+checksum = "32a282da65faaf38286cf3be983213fcf1d2e2a58700e808f83f4ea9a4804bc0"
 
 [[package]]
 name = "regex"
-version = "1.11.1"
+version = "1.11.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b544ef1b4eac5dc2db33ea63606ae9ffcfac26c1416a2806ae0bf5f56b201191"
+checksum = "23d7fd106d8c02486a8d64e778353d1cffe08ce79ac2e82f540c86d0facf6912"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -37,9 +37,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.9"
+version = "0.4.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "809e8dc61f6de73b46c85f4c96486310fe304c434cfa43669d7b40f711150908"
+checksum = "6b9458fa0bfeeac22b5ca447c63aaf45f28439a709ccd244698632f9aa6394d6"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -48,13 +48,13 @@ dependencies = [
 
 [[package]]
 name = "regex-syntax"
-version = "0.8.5"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c"
+checksum = "caf4aa5b0f434c91fe5c7f1ecb6a5ece2130b02ad2a590589dda5146df959001"
 
 [[package]]
 name = "rure"
-version = "0.2.2"
+version = "0.2.3"
 dependencies = [
  "libc",
  "regex",

pkgs/by-name/ru/rure/pin.json

@@ -1,5 +1,5 @@
 {
   "pname": "rure",
-  "version": "0.2.2",
-  "hash": "sha256:0n2c9b8arfgcq1l7gr8dfcmdvdbggvfd0msy6sbx3bln74wwbr06"
+  "version": "0.2.3",
+  "hash": "sha256:0d8r0fv93ganqi9iyrgljbkvrvys33n0zrkaf11zsb23b2hwcsxa"
 }

pkgs/by-name/sf/sfml/package.nix

@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch2,
 
   # nativeBuildInputs
   cmake,
@@ -26,22 +25,16 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sfml";
-  version = "3.0.1";
+  version = "3.0.2";
 
   src = fetchFromGitHub {
     owner = "SFML";
     repo = "SFML";
     tag = finalAttrs.version;
-    hash = "sha256-yTNoDHcBRzk270QHjSFVpjFKm2+uVvmVLg6XlAppwYk=";
+    hash = "sha256-YqlrY0iIsxcjlLb+buMU0zpXo7/eKSKxOsITWf7BX6s=";
   };
 
   patches = [
-    (fetchpatch2 {
-      name = "Fix-pkg-config-when-SFML_PKGCONFIG_INSTALL_DIR-is-unset.patch";
-      url = "https://github.com/SFML/SFML/commit/a87763becbc4672b38f1021418ed94caa0f6540a.patch?full_index=1";
-      hash = "sha256-tJmXTdhwtWq6XfUPBzw47yTrc6EzwmSiVj9n6jQwHig=";
-    })
-
     # Not upstreamble in the near future, see https://github.com/SFML/SFML/pull/3555
     ./unvendor-miniaudio.patch
   ];

pkgs/by-name/sn/snac2/package.nix

@@ -10,14 +10,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "snac2";
-  version = "2.82";
+  version = "2.83";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "grunfink";
     repo = "snac2";
     tag = finalAttrs.version;
-    hash = "sha256-iYBxx1QqjK1fsrADIiyAzftpNoH33vKRbjkeppHL39k=";
+    hash = "sha256-5BpJKDXA3PO/ZCfFYMngWaAGns2+ANWCpLgiEi4CAXY=";
   };
 
   buildInputs = [

pkgs/by-name/sp/spral/package.nix

@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "spral";
-  version = "2025.05.20";
+  version = "2025.09.18";
 
   src = fetchFromGitHub {
     owner = "ralna";
     repo = "spral";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9QEcAOFB3CtGNqr8LoDaj2vP3KMONlUVooeXECtGsxc=";
+    hash = "sha256-ftyA6zP+VX0fb7e9YKjPCAWYblNyjX/eVeni1tRQIxY=";
   };
 
   # Ignore a failing test on darwin

pkgs/by-name/sw/switch-to-configuration-ng/src/build.rs

@@ -18,6 +18,10 @@ fn main() {
 
     let out_path = std::path::PathBuf::from(std::env::var("OUT_DIR").unwrap());
 
+    let fdo_dbus_code = code_for_dbus_xml("org.freedesktop.DBus.xml");
+    let mut file = std::fs::File::create(out_path.join("fdo_dbus.rs")).unwrap();
+    file.write_all(fdo_dbus_code.as_bytes()).unwrap();
+
     let systemd_manager_code =
         code_for_dbus_xml(systemd_dbus_interface_dir.join("org.freedesktop.systemd1.Manager.xml"));
     let mut file = std::fs::File::create(out_path.join("systemd_manager.rs")).unwrap();

pkgs/by-name/sw/switch-to-configuration-ng/src/org.freedesktop.DBus.xml

@@ -0,0 +1,12 @@
+<!DOCTYPE node PUBLIC "-//freedesktop//DTD D-BUS Object Introspection 1.0//EN"
+"https://www.freedesktop.org/standards/dbus/1.0/introspect.dtd">
+<node>
+  <!-- From https://dbus.freedesktop.org/doc/dbus-specification.html#message-bus-messages. -->
+  <interface name="org.freedesktop.DBus">
+    <signal name="NameOwnerChanged">
+      <arg type="s" direction="out" name="name"/>
+      <arg type="s" direction="out" name="old_owner"/>
+      <arg type="s" direction="out" name="new_owner"/>
+    </signal>
+  </interface>
+</node>

pkgs/by-name/sw/switch-to-configuration-ng/src/src/main.rs

@@ -17,6 +17,8 @@ use std::{
 use anyhow::{anyhow, bail, Context, Result};
 use dbus::{
     blocking::{stdintf::org_freedesktop_dbus::Properties, LocalConnection, Proxy},
+    channel::Sender,
+    strings::{BusName, Interface, Member},
     Message,
 };
 use glob::glob;
@@ -32,6 +34,15 @@ use nix::{
 use regex::Regex;
 use syslog::Facility;
 
+mod fdo_dbus {
+    #![allow(non_upper_case_globals)]
+    #![allow(non_camel_case_types)]
+    #![allow(non_snake_case)]
+    #![allow(unused)]
+    #![allow(clippy::all)]
+    include!(concat!(env!("OUT_DIR"), "/fdo_dbus.rs"));
+}
+
 mod systemd_manager {
     #![allow(non_upper_case_globals)]
     #![allow(non_camel_case_types)]
@@ -50,7 +61,9 @@ mod logind_manager {
     include!(concat!(env!("OUT_DIR"), "/logind_manager.rs"));
 }
 
-use crate::systemd_manager::OrgFreedesktopSystemd1Manager;
+use crate::{
+    fdo_dbus::OrgFreedesktopDBusNameOwnerChanged, systemd_manager::OrgFreedesktopSystemd1Manager,
+};
 use crate::{
     logind_manager::OrgFreedesktopLogin1Manager,
     systemd_manager::{
@@ -894,20 +907,27 @@ impl std::fmt::Display for Job {
     }
 }
 
-fn new_dbus_proxies(
-    conn: &LocalConnection,
-) -> (Proxy<'_, &LocalConnection>, Proxy<'_, &LocalConnection>) {
-    (
-        conn.with_proxy(
-            "org.freedesktop.systemd1",
-            "/org/freedesktop/systemd1",
-            Duration::from_millis(10000),
-        ),
-        conn.with_proxy(
-            "org.freedesktop.login1",
-            "/org/freedesktop/login1",
-            Duration::from_millis(10000),
-        ),
+fn fdo_dbus_proxy(conn: &LocalConnection) -> Proxy<'_, &LocalConnection> {
+    conn.with_proxy(
+        "org.freedesktop.DBus",
+        "/org/freedesktop/DBus",
+        Duration::from_millis(500),
+    )
+}
+
+fn systemd1_proxy(conn: &LocalConnection) -> Proxy<'_, &LocalConnection> {
+    conn.with_proxy(
+        "org.freedesktop.systemd1",
+        "/org/freedesktop/systemd1",
+        Duration::from_millis(10000),
+    )
+}
+
+fn login1_proxy(conn: &LocalConnection) -> Proxy<'_, &LocalConnection> {
+    conn.with_proxy(
+        "org.freedesktop.login1",
+        "/org/freedesktop/login1",
+        Duration::from_millis(10000),
     )
 }
 
@@ -931,6 +951,54 @@ fn remove_file_if_exists(p: impl AsRef<Path>) -> std::io::Result<()> {
     }
 }
 
+fn reexecute_systemd_manager(
+    dbus_conn: &LocalConnection,
+    fdo_dbus: &Proxy<'_, &LocalConnection>,
+) -> anyhow::Result<()> {
+    let reexecute_done = Rc::new(RefCell::new(false));
+    let _reexecute_done = reexecute_done.clone();
+    let owner_changed_token = fdo_dbus
+        .match_signal(
+            move |signal: OrgFreedesktopDBusNameOwnerChanged, _: &LocalConnection, _: &Message| {
+                if signal.name.as_str() == "org.freedesktop.systemd1" {
+                    *_reexecute_done.borrow_mut() = true;
+                }
+
+                true
+            },
+        )
+        .context("Failed to add signal match for DBus name owner changes")?;
+
+    let bus_name = BusName::from("org.freedesktop.systemd1");
+    let object_path = dbus::Path::from("/org/freedesktop/systemd1");
+    let interface = Interface::new("org.freedesktop.systemd1.Manager")
+        .expect("the org.freedesktop.systemd1.Manager interface name should be valid");
+    let method_name = Member::new("Reexecute").expect("the Reexecute method name should be valid");
+
+    // Systemd does not reply to the Reexecute method.
+    let _serial = dbus_conn
+        .send(Message::method_call(
+            &bus_name,
+            &object_path,
+            &interface,
+            &method_name,
+        ))
+        .map_err(|_err| anyhow!("Failed to send org.freedesktop.systemd1.Manager.Reexecute"))?;
+
+    log::debug!("waiting for systemd to finish reexecuting");
+    while !*reexecute_done.borrow() {
+        _ = dbus_conn
+            .process(Duration::from_secs(500))
+            .context("Failed to process dbus messages")?;
+    }
+
+    dbus_conn
+        .remove_match(owner_changed_token)
+        .context("Failed to remove jobs token")?;
+
+    Ok(())
+}
+
 /// Performs switch-to-configuration functionality for a single non-root user
 fn do_user_switch(parent_exe: String) -> anyhow::Result<()> {
     if Path::new(&parent_exe)
@@ -946,7 +1014,10 @@ fn do_user_switch(parent_exe: String) -> anyhow::Result<()> {
     }
 
     let dbus_conn = LocalConnection::new_session().context("Failed to open dbus connection")?;
-    let (systemd, _) = new_dbus_proxies(&dbus_conn);
+    let fdo_dbus = fdo_dbus_proxy(&dbus_conn);
+    let systemd = systemd1_proxy(&dbus_conn);
+
+    reexecute_systemd_manager(&dbus_conn, &fdo_dbus)?;
 
     let nixos_activation_done = Rc::new(RefCell::new(false));
     let _nixos_activation_done = nixos_activation_done.clone();
@@ -964,10 +1035,6 @@ fn do_user_switch(parent_exe: String) -> anyhow::Result<()> {
         )
         .context("Failed to add signal match for systemd removed jobs")?;
 
-    // The systemd user session seems to not send a Reloaded signal, so we don't have anything to
-    // wait on here.
-    _ = systemd.reexecute();
-
     systemd
         .restart_unit("nixos-activation.service", "replace")
         .context("Failed to restart nixos-activation.service")?;
@@ -1140,7 +1207,9 @@ won't take effect until you reboot the system.
     let mut units_to_reload = map_from_list_file(RELOAD_LIST_FILE);
 
     let dbus_conn = LocalConnection::new_system().context("Failed to open dbus connection")?;
-    let (systemd, logind) = new_dbus_proxies(&dbus_conn);
+    let fdo_dbus = fdo_dbus_proxy(&dbus_conn);
+    let systemd = systemd1_proxy(&dbus_conn);
+    let logind = login1_proxy(&dbus_conn);
 
     let submitted_jobs = Rc::new(RefCell::new(HashMap::new()));
     let finished_jobs = Rc::new(RefCell::new(HashMap::new()));
@@ -1664,7 +1733,7 @@ won't take effect until you reboot the system.
     // just in case the new one has trouble communicating with the running pid 1.
     if restart_systemd {
         eprintln!("restarting systemd...");
-        _ = systemd.reexecute(); // we don't get a dbus reply here
+        reexecute_systemd_manager(&dbus_conn, &fdo_dbus)?;
 
         log::debug!("waiting for systemd restart to finish");
         while !*systemd_reload_status.borrow() {

pkgs/by-name/te/terraform-docs/package.nix

@@ -1,23 +1,35 @@
 {
   stdenv,
   lib,
-  buildGoModule,
+  # Build fails with Go 1.25, with the following error:
+  # 'vendor/golang.org/x/tools/internal/tokeninternal/tokeninternal.go:64:9: invalid array length -delta * delta (constant -256 of type int64)'
+  # Wait for upstream to update their vendored dependencies before unpinning.
+  buildGo124Module,
   fetchFromGitHub,
   installShellFiles,
+  testers,
 }:
-buildGoModule rec {
+
+buildGo124Module (finalAttrs: {
   pname = "terraform-docs";
   version = "0.20.0";
 
   src = fetchFromGitHub {
     owner = "terraform-docs";
     repo = "terraform-docs";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-DiKoYAe7vcNy35ormKHYZcZrGK/MEb6VmcHWPgrbmUg=";
   };
 
   vendorHash = "sha256-ynyYpX41LJxGhf5kF2AULj+VKROjsvTjVPBnqG+JGSg=";
 
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  env.CGO_ENABLED = 0;
+
   excludedPackages = [ "scripts" ];
 
   nativeBuildInputs = [ installShellFiles ];
@@ -29,11 +41,19 @@ buildGoModule rec {
     installShellCompletion terraform-docs.{bash,fish,zsh}
   '';
 
+  passthru.tests.version = testers.testVersion {
+    package = finalAttrs.finalPackage;
+    version = "v${finalAttrs.version}";
+  };
+
   meta = with lib; {
     description = "Utility to generate documentation from Terraform modules in various output formats";
     mainProgram = "terraform-docs";
     homepage = "https://github.com/terraform-docs/terraform-docs/";
     license = licenses.mit;
-    maintainers = with maintainers; [ zimbatm ];
+    maintainers = with maintainers; [
+      zimbatm
+      anthonyroussel
+    ];
   };
-}
+})

pkgs/by-name/to/toml11/package.nix

@@ -3,6 +3,7 @@
   stdenv,
   fetchFromGitHub,
   cmake,
+  fetchpatch,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -17,6 +18,14 @@ stdenv.mkDerivation (finalAttrs: {
     fetchSubmodules = true;
   };
 
+  patches = [
+    (fetchpatch {
+      name = "literal-operator-whitespace.patch";
+      url = "https://patch-diff.githubusercontent.com/raw/ToruNiina/toml11/pull/285.patch";
+      hash = "sha256-LZPr/cY6BZXC6/rBIAMCcqEdnhJs1AvbrPjpHF76uKg=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
   ];

pkgs/development/compilers/julia/default.nix

@@ -31,12 +31,12 @@ in
   );
   julia_110-bin = wrapJulia (
     callPackage (import ./generic-bin.nix {
-      version = "1.10.9";
+      version = "1.10.10";
       sha256 = {
-        x86_64-linux = "5a2d2c5224594b683c97e7304cb72407fbcf0be4a0187789cba1a2f73f0cbf09";
-        aarch64-linux = "be222882e3674f960f43b6842f7bbb52a369977e40d5dcd26498793e1cd2dfb6";
-        x86_64-darwin = "f80c93c30a18d8a5dc7f37d0cc94757fd3857651268e4a9e2d42d3b1ea3372f1";
-        aarch64-darwin = "e62e00b22408159cba3d669f2d9e8b60c1d23b5c2d1c22ec25f4957d15ca98ef";
+        x86_64-linux = "6a78a03a71c7ab792e8673dc5cedb918e037f081ceb58b50971dfb7c64c5bf81";
+        aarch64-linux = "a4b157ed68da10471ea86acc05a0ab61c1a6931ee592a9b236be227d72da50ff";
+        x86_64-darwin = "942b0d4accc9704861c7781558829b1d521df21226ad97bd01e1e43b1518d3e6";
+        aarch64-darwin = "52d3f82c50d9402e42298b52edc3d36e0f73e59f81fc8609d22fa094fbad18be";
       };
     }) { }
   );
@@ -62,8 +62,8 @@ in
   );
   julia_110 = wrapJulia (
     callPackage (import ./generic.nix {
-      version = "1.10.9";
-      hash = "sha256-u9by+X76fcXs+w159KTSvw43JeYwJ9Wvn0VyoEfniTM=";
+      version = "1.10.10";
+      hash = "sha256-/NTIGLlcNu4sI1rICa+PS/Jn+YnWi37zFBcbfMnv3Ys=";
       patches = [
         ./patches/1.10/0002-skip-failing-and-flaky-tests.patch
         # Revert https://github.com/JuliaLang/julia/pull/55354

pkgs/development/compilers/llvm/default.nix

@@ -27,9 +27,9 @@ let
     "20.1.8".officialRelease.sha256 = "sha256-ysyB/EYxi2qE9fD5x/F2zI4vjn8UDoo1Z9ukiIrjFGw=";
     "21.1.1".officialRelease.sha256 = "sha256-IB9Z3bIMwfgw2W2Vxo89CmtCM9DfOyV2Ei64nqgHrgc=";
     "22.0.0-git".gitRelease = {
-      rev = "c3fb2e1cee954338acb83955b157e0a2e82a4849";
-      rev-version = "22.0.0-unstable-2025-09-16";
-      sha256 = "sha256-jTRI71x395XnfT06cyYLp8x0Z79ttJmmmasa3LiK790=";
+      rev = "e396dab01f3da49df16c710d105a409973df5a03";
+      rev-version = "22.0.0-unstable-2025-09-21";
+      sha256 = "sha256-pYu/IVFvptxbtMo5GQePPKFlFnD/7FA13uzSuJWq3dc=";
     };
   }
   // llvmVersions;

pkgs/development/haskell-modules/configuration-common.nix

@@ -208,28 +208,9 @@ with haskellLib;
     }
   );
 
-  # Expected test output for these accidentally checks the absolute location of the source directory
-  # https://github.com/dan-t/cabal-cargs/issues/9
-  cabal-cargs = overrideCabal (drv: {
-    testFlags = drv.testFlags or [ ] ++ [
-      "-p"
-      "!/FindCabalFilePure withoutSandbox/"
-      "-p"
-      "!/FromCabalFilePure withoutSandbox/"
-      "-p"
-      "!/FromLibSrcPure withoutSandbox/"
-      "-p"
-      "!/FromExeSrcFilePure withoutSandbox/"
-      "-p"
-      "!/FindCabalFilePure withSandbox/"
-      "-p"
-      "!/FromCabalFilePure withSandbox/"
-      "-p"
-      "!/FromLibSrcPure withSandbox/"
-      "-p"
-      "!/FromExeSrcFilePure withSandbox/"
-    ];
-  }) super.cabal-cargs;
+  # 2025-09-20: Too strict bound on filepath (<1.5)
+  # https://github.com/dan-t/cabal-cargs/issues/10
+  cabal-cargs = doJailbreak super.cabal-cargs;
 
   # Extensions wants a specific version of Cabal for its list of Haskell
   # language extensions.
@@ -409,6 +390,14 @@ with haskellLib;
   # There are numerical tests on random data, that may fail occasionally
   lapack = dontCheck super.lapack;
 
+  # fpr-calc test suite depends on random >= 1.3
+  # see https://github.com/IntersectMBO/lsm-tree/issues/797
+  bloomfilter-blocked =
+    lib.warnIf (lib.versionAtLeast self.random.version "1.3")
+      "haskellPackages.bloomfilter-blocked: dontCheck can potentially be removed"
+      dontCheck
+      super.bloomfilter-blocked;
+
   # support for transformers >= 0.6
   lifted-base = appendPatch (fetchpatch {
     url = "https://github.com/basvandijk/lifted-base/commit/6b61483ec7fd0d5d5d56ccb967860d42740781e8.patch";
@@ -439,6 +428,10 @@ with haskellLib;
   # https://github.com/sw17ch/data-clist/pull/28
   data-clist = doJailbreak super.data-clist;
 
+  # 2025-09-20: Allow QuickCheck >= 2.15
+  # https://github.com/raehik/binrep/issues/14
+  binrep = warnAfterVersion "1.1.0" (doJailbreak super.binrep);
+
   # 2024-06-23: Hourglass is archived and had its last commit 6 years ago.
   # Patch is needed to add support for time 1.10, which is only used in the tests
   # https://github.com/vincenthz/hs-hourglass/pull/56
@@ -519,6 +512,10 @@ with haskellLib;
   ghc-datasize = disableLibraryProfiling super.ghc-datasize;
   ghc-vis = disableLibraryProfiling super.ghc-vis;
 
+  # 2025-09-20: Too strict upper bound on base (<4.20)
+  # https://github.com/phadej/regression-simple/issues/13
+  regression-simple = doJailbreak super.regression-simple;
+
   # Fix 32bit struct being used for 64bit syscall on 32bit platforms
   # https://github.com/haskellari/lukko/issues/15
   lukko = appendPatches [
@@ -916,6 +913,10 @@ with haskellLib;
     ))
   ];
 
+  # Too strict bounds on QuickCheck (<2.15), containers (<0.7), hashable (<1.5), pandoc (<3.7)
+  # https://github.com/jaspervdj/patat/issues/194
+  patat = doJailbreak super.patat;
+
   # Too strict upper bound on data-default-class (< 0.2)
   # https://github.com/stackbuilders/dotenv-hs/issues/203
   dotenv = doJailbreak super.dotenv;
@@ -2707,6 +2708,9 @@ with haskellLib;
   # 2025-08-06: Upper bounds on containers <0.7 and hedgehog < 1.5 too strict.
   hermes-json = doJailbreak super.hermes-json;
 
+  # Allow containers >= 0.7, https://github.com/nomeata/arbtt/issues/181
+  arbtt = doJailbreak super.arbtt;
+
   # hexstring is not compatible with newer versions of base16-bytestring
   # See https://github.com/solatis/haskell-hexstring/issues/3
   hexstring = overrideCabal (old: {
@@ -3322,17 +3326,22 @@ with haskellLib;
   brillo-juicy = warnAfterVersion "0.2.4" (doJailbreak super.brillo-juicy);
   brillo = warnAfterVersion "1.13.3" (doJailbreak super.brillo);
 
-  # Floating point precision issues. Test suite is only checked on x86_64.
-  # https://github.com/tweag/monad-bayes/issues/368
-  monad-bayes = dontCheckIf (
-    let
-      inherit (pkgs.stdenv) hostPlatform;
-    in
-    !hostPlatform.isx86_64
-    # Presumably because we emulate x86_64-darwin via Rosetta, x86_64-darwin
-    # also fails on Hydra
-    || hostPlatform.isDarwin
-  ) super.monad-bayes;
+  monad-bayes =
+    # Floating point precision issues. Test suite is only checked on x86_64.
+    # https://github.com/tweag/monad-bayes/issues/368
+    dontCheckIf
+      (
+        let
+          inherit (pkgs.stdenv) hostPlatform;
+        in
+        !hostPlatform.isx86_64
+        # Presumably because we emulate x86_64-darwin via Rosetta, x86_64-darwin
+        # also fails on Hydra
+        || hostPlatform.isDarwin
+      )
+      # Too strict bounds on brick (<2.6), vty (<6.3)
+      # https://github.com/tweag/monad-bayes/issues/378
+      (doJailbreak super.monad-bayes);
 
   crucible =
     lib.pipe
@@ -3486,6 +3495,10 @@ with haskellLib;
   # including the current one in nixpkgs.
   liquid-fixpoint = dontCheck super.liquid-fixpoint;
 
+  # 2025-09-20: Too strict upper bound on text (<2.1.3)
+  # https://github.com/mchav/dataframe/issues/61
+  dataframe = doJailbreak (warnAfterVersion "0.3.0.4" super.dataframe);
+
   # 2025-8-26: Too strict bounds on containers and text, see: https://github.com/stackbuilders/inflections-hs/pull/83
   inflections = doJailbreak super.inflections;
 

pkgs/development/haskell-modules/configuration-darwin.nix

@@ -356,18 +356,18 @@ self: super:
     # the latter in the future!
     cabal2nix = overrideCabal (old: {
       postInstall = ''
-        remove-references-to -t ${self.hpack} "$out/bin/cabal2nix"
+        remove-references-to -t ${self.hpack} "''${!outputBin}/bin/cabal2nix"
         # Note: The `data` output is needed at runtime.
-        remove-references-to -t ${self.distribution-nixpkgs.out} "$out/bin/hackage2nix"
+        remove-references-to -t ${self.distribution-nixpkgs.out} "''${!outputBin}/bin/hackage2nix"
 
         ${old.postInstall or ""}
       '';
     }) super.cabal2nix;
     cabal2nix-unstable = overrideCabal (old: {
       postInstall = ''
-        remove-references-to -t ${self.hpack} "$out/bin/cabal2nix"
+        remove-references-to -t ${self.hpack} "''${!outputBin}/bin/cabal2nix"
         # Note: The `data` output is needed at runtime.
-        remove-references-to -t ${self.distribution-nixpkgs-unstable.out} "$out/bin/hackage2nix"
+        remove-references-to -t ${self.distribution-nixpkgs-unstable.out} "''${!outputBin}/bin/hackage2nix"
 
         ${old.postInstall or ""}
       '';

pkgs/development/haskell-modules/configuration-hackage2nix/broken.yaml

@@ -231,7 +231,6 @@ broken-packages:
   - arbor-monad-logger # failure in job https://hydra.nixos.org/build/233228659 at 2023-09-02
   - arbor-monad-metric # failure in job https://hydra.nixos.org/build/233236175 at 2023-09-02
   - arbor-postgres # failure in job https://hydra.nixos.org/build/233232935 at 2023-09-02
-  - arbtt # failure in job https://hydra.nixos.org/build/307516851 at 2025-09-19
   - arch-hs # failure in job https://hydra.nixos.org/build/233225768 at 2023-09-02
   - archiver # failure in job https://hydra.nixos.org/build/233245795 at 2023-09-02
   - archlinux # failure in job https://hydra.nixos.org/build/233202430 at 2023-09-02
@@ -485,8 +484,6 @@ broken-packages:
   - bindings-wlc # failure in job https://hydra.nixos.org/build/233332720 at 2023-09-02
   - bindynamic # failure in job https://hydra.nixos.org/build/295091957 at 2025-04-22
   - binembed # failure in job https://hydra.nixos.org/build/233219100 at 2023-09-02
-  - binrep # failure in job https://hydra.nixos.org/build/307517077 at 2025-09-19
-  - binrep-instances # failure in job https://hydra.nixos.org/build/295092045 at 2025-04-22
   - binsm # failure in job https://hydra.nixos.org/build/233232355 at 2023-09-02
   - bio # failure in job https://hydra.nixos.org/build/233225273 at 2023-09-02
   - bio-sequence # failure in job https://hydra.nixos.org/build/233236140 at 2023-09-02
@@ -654,7 +651,6 @@ broken-packages:
   - cabal-auto-expose # failure in job https://hydra.nixos.org/build/233195440 at 2023-09-02
   - cabal-build-programs # failure in job https://hydra.nixos.org/build/257091363 at 2024-04-27
   - cabal-bundle-clib # failure in job https://hydra.nixos.org/build/233199225 at 2023-09-02
-  - cabal-cargs # failure in job https://hydra.nixos.org/build/307517214 at 2025-09-19
   - cabal-constraints # failure in job https://hydra.nixos.org/build/233214316 at 2023-09-02
   - cabal-db # failure in job https://hydra.nixos.org/build/233197235 at 2023-09-02
   - cabal-debian # failure in job https://hydra.nixos.org/build/233255267 at 2023-09-02
@@ -1258,7 +1254,6 @@ broken-packages:
   - database-migrate # failure in job https://hydra.nixos.org/build/233201597 at 2023-09-02
   - database-study # failure in job https://hydra.nixos.org/build/233222466 at 2023-09-02
   - datadog # failure in job https://hydra.nixos.org/build/233191124 at 2023-09-02
-  - dataframe # failure in job https://hydra.nixos.org/build/307517771 at 2025-09-19
   - DataIndex # failure in job https://hydra.nixos.org/build/233254506 at 2023-09-02
   - datalog # failure in job https://hydra.nixos.org/build/233242707 at 2023-09-02
   - datapacker # failure in job https://hydra.nixos.org/build/233206524 at 2023-09-02
@@ -4072,7 +4067,6 @@ broken-packages:
   - mollie-api-haskell # failure in job https://hydra.nixos.org/build/233200867 at 2023-09-02
   - monad-atom # failure in job https://hydra.nixos.org/build/233243367 at 2023-09-02
   - monad-atom-simple # failure in job https://hydra.nixos.org/build/233259038 at 2023-09-02
-  - monad-bayes # failure in job https://hydra.nixos.org/build/307520391 at 2025-09-19
   - monad-branch # failure in job https://hydra.nixos.org/build/233251253 at 2023-09-02
   - monad-choice # failure in job https://hydra.nixos.org/build/233255987 at 2023-09-02
   - monad-fork # failure in job https://hydra.nixos.org/build/233206855 at 2023-09-02
@@ -4653,7 +4647,6 @@ broken-packages:
   - pasta-curves # failure in job https://hydra.nixos.org/build/233196512 at 2023-09-02
   - pastis # failure in job https://hydra.nixos.org/build/233218498 at 2023-09-02
   - pasty # failure in job https://hydra.nixos.org/build/233251812 at 2023-09-02
-  - patat # failure in job https://hydra.nixos.org/build/307611198 at 2025-09-19
   - patches-vector # failure in job https://hydra.nixos.org/build/233244862 at 2023-09-02
   - path-formatting # failure in job https://hydra.nixos.org/build/233199358 at 2023-09-02
   - path-sing # failure in job https://hydra.nixos.org/build/237234354 at 2023-10-21
@@ -5309,7 +5302,6 @@ broken-packages:
   - registry-messagepack # failure in job https://hydra.nixos.org/build/303231364 at 2025-07-27
   - registry-options # failure in job https://hydra.nixos.org/build/295096594 at 2025-04-22
   - regress # failure in job https://hydra.nixos.org/build/233208901 at 2023-09-02
-  - regression-simple # failure in job https://hydra.nixos.org/build/307521504 at 2025-09-19
   - regular # failure in job https://hydra.nixos.org/build/233232656 at 2023-09-02
   - rehoo # failure in job https://hydra.nixos.org/build/233246417 at 2023-09-02
   - rei # failure in job https://hydra.nixos.org/build/233221328 at 2023-09-02

pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml

@@ -309,7 +309,6 @@ dont-distribute-packages:
  - blockio
  - blogination
  - BlogLiterately-diagrams
- - bloomfilter-blocked
  - bloxorz
  - blubber
  - bluetile
@@ -679,6 +678,7 @@ dont-distribute-packages:
  - datadog-tracing
  - datafix
  - dataflow
+ - dataframe_0_3_0_4
  - datasets
  - date-conversions
  - dbjava
@@ -2957,7 +2957,6 @@ dont-distribute-packages:
  - rfc-psql
  - rfc-redis
  - rfc-servant
- - rhine-bayes
  - rhythm-game-tutorial
  - rib
  - ribosome
@@ -3453,7 +3452,6 @@ dont-distribute-packages:
  - tasklite
  - tasklite-core
  - tasty-bdd
- - tasty-bench-fit
  - tasty-groundhog-converters
  - tasty-integrate
  - tasty-jenkins-xml

pkgs/development/haskell-modules/hackage-packages.nix

@@ -81677,9 +81677,7 @@ self: {
       ];
       description = "Automatic Rule-Based Time Tracker";
       license = lib.licenses.gpl2Only;
-      hydraPlatforms = lib.platforms.none;
       maintainers = [ lib.maintainers.rvl ];
-      broken = true;
     }
   ) { };
 
@@ -105652,9 +105650,7 @@ self: {
       ];
       description = "Encode precise binary representations directly in types";
       license = lib.licenses.mit;
-      hydraPlatforms = lib.platforms.none;
       maintainers = [ lib.maintainers.raehik ];
-      broken = true;
     }
   ) { };
 
@@ -105676,8 +105672,6 @@ self: {
       ];
       description = "Orphan instances for binrep";
       license = lib.licenses.mit;
-      hydraPlatforms = lib.platforms.none;
-      broken = true;
     }
   ) { };
 
@@ -111407,7 +111401,6 @@ self: {
       doHaddock = false;
       description = "Classic and block-style bloom filters";
       license = lib.licenses.asl20;
-      hydraPlatforms = lib.platforms.none;
     }
   ) { };
 
@@ -123104,9 +123097,7 @@ self: {
       ];
       description = "A command line program for extracting compiler arguments from a cabal file";
       license = lib.licenses.bsd3;
-      hydraPlatforms = lib.platforms.none;
       mainProgram = "cabal-cargs";
-      broken = true;
     }
   ) { };
 
@@ -180541,9 +180532,7 @@ self: {
       ];
       description = "An intuitive, dynamically-typed DataFrame library";
       license = lib.licenses.gpl3Plus;
-      hydraPlatforms = lib.platforms.none;
       mainProgram = "dataframe";
-      broken = true;
     }
   ) { };
 
@@ -180655,7 +180644,6 @@ self: {
       license = lib.licenses.gpl3Plus;
       hydraPlatforms = lib.platforms.none;
       mainProgram = "dataframe";
-      broken = true;
     }
   ) { };
 
@@ -452610,10 +452598,8 @@ self: {
       ];
       description = "A library for probabilistic programming";
       license = lib.licenses.mit;
-      hydraPlatforms = lib.platforms.none;
       mainProgram = "example";
       maintainers = [ lib.maintainers.turion ];
-      broken = true;
     }
   ) { };
 
@@ -506005,10 +505991,8 @@ self: {
       ];
       description = "Terminal-based presentations using Pandoc";
       license = lib.licenses.gpl2Only;
-      hydraPlatforms = lib.platforms.none;
       mainProgram = "patat";
       maintainers = [ lib.maintainers.dalpd ];
-      broken = true;
     }
   ) { };
 
@@ -566365,8 +566349,6 @@ self: {
       ];
       description = "Simple linear and quadratic regression";
       license = lib.licenses.bsd3;
-      hydraPlatforms = lib.platforms.none;
-      broken = true;
     }
   ) { };
 
@@ -573318,7 +573300,6 @@ self: {
       ];
       description = "monad-bayes backend for Rhine";
       license = lib.licenses.bsd3;
-      hydraPlatforms = lib.platforms.none;
       mainProgram = "rhine-bayes-gloss";
     }
   ) { };
@@ -657093,7 +657074,6 @@ self: {
       ];
       description = "Determine time complexity of a given function";
       license = lib.licenses.mit;
-      hydraPlatforms = lib.platforms.none;
     }
   ) { };
 

pkgs/development/ocaml-modules/fix/default.nix

@@ -6,18 +6,17 @@
 
 buildDunePackage rec {
   pname = "fix";
-  version = "20250428";
+  version = "20250919";
 
   src = fetchFromGitLab {
     domain = "gitlab.inria.fr";
     owner = "fpottier";
     repo = "fix";
-    rev = version;
-    sha256 = "sha256-ZfIKx0BMhnmrqmfyqRi9ElZN1xdkupsDmfRg1GD3l/Q=";
+    tag = version;
+    hash = "sha256-CVxOLlSKKX1kb1bi6IbSo7SH5GsVynI4de0c5NUmq+s=";
   };
 
   minimalOCamlVersion = "4.03";
-  useDune2 = true;
 
   meta = with lib; {
     homepage = "https://gitlab.inria.fr/fpottier/fix/";

pkgs/development/python-modules/asyncserial/default.nix

@@ -2,29 +2,32 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  setuptools,
   pyserial,
 }:
 
-buildPythonPackage {
+buildPythonPackage rec {
   pname = "asyncserial";
-  version = "unstable-2022-06-10";
-  format = "setuptools";
+  version = "1.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "m-labs";
     repo = "asyncserial";
-    rev = "446559fec892a556876b17d17f182ae9647d5952";
-    hash = "sha256-WExmgh55sTH2w7wV3i96J1F1FN7L5rX3L/Ayvt2Kw/g=";
+    tag = version;
+    hash = "sha256-ZHzgJnbsDVxVcp09LXq9JZp46+dorgdP8bAiTB59K28=";
   };
 
-  propagatedBuildInputs = [ pyserial ];
+  build-system = [ setuptools ];
+
+  dependencies = [ pyserial ];
 
   pythonImportsCheck = [ "asyncserial" ];
 
-  meta = with lib; {
+  meta = {
     description = "asyncio support for pyserial";
     homepage = "https://github.com/m-labs/asyncserial";
-    license = licenses.bsd2;
-    maintainers = with maintainers; [ doronbehar ];
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ doronbehar ];
   };
 }

pkgs/development/python-modules/biocframe/default.nix

@@ -0,0 +1,52 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pytestCheckHook,
+  pytest-cov-stub,
+  setuptools,
+  setuptools-scm,
+  biocutils,
+  numpy,
+  polars,
+  pandas,
+}:
+
+buildPythonPackage rec {
+  pname = "biocframe";
+  version = "0.6.3";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "BiocPy";
+    repo = "BiocFrame";
+    tag = "${version}";
+    hash = "sha256-HeXQEVDGrr/oEGqLcKgq2RLDA58sbYtc2O6oEdFxrIw=";
+  };
+
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
+
+  dependencies = [
+    biocutils
+    numpy
+  ];
+
+  nativeCheckInputs = [
+    pytest-cov-stub
+    pytestCheckHook
+    pandas
+    polars
+  ];
+
+  pythonImportsCheck = [ "biocframe" ];
+
+  meta = {
+    description = "Bioconductor-like data frames";
+    homepage = "https://github.com/BiocPy/BiocFrame";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ b-rodrigues ];
+  };
+}

pkgs/development/python-modules/fastexcel/default.nix

@@ -20,19 +20,19 @@
 
 buildPythonPackage rec {
   pname = "fastexcel";
-  version = "0.15.1";
+  version = "0.16.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ToucanToco";
     repo = "fastexcel";
     tag = "v${version}";
-    hash = "sha256-kGGtTgy8k6TeP4iwonIwiQKiYMFAXw9v5Q5dpdcYP7A=";
+    hash = "sha256-6pEE3l3qJ3Nir4oDFXdsGiX/2d1w3bqH0nrIOjBt9PM=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-SdraNHOicCjIKFaTSRn4dEzfW8w243y/w9ym9JduMQo=";
+    hash = "sha256-ULRK7GjMEs0mN/H491XANDT7eipOdPfJyGFtPBM3SC8=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/knowit/default.nix

@@ -0,0 +1,87 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  fetchzip,
+
+  # build-system
+  poetry-core,
+
+  # dependencies
+  babelfish,
+  enzyme,
+  pymediainfo,
+  pyyaml,
+  trakit,
+  pint,
+
+  # nativeCheckInputs
+  pytestCheckHook,
+  ffmpeg,
+  mediainfo,
+  mkvtoolnix,
+  requests,
+}:
+
+buildPythonPackage rec {
+  pname = "knowit";
+  version = "0.5.11";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "ratoaq2";
+    repo = "knowit";
+    tag = version;
+    hash = "sha256-JqzCLdXEWZyvqXpeTJRW0zhY+wVcHLuBYrJbuSqfgkg=";
+  };
+
+  matroska_test_zip = fetchzip {
+    url = "http://downloads.sourceforge.net/project/matroska/test_files/matroska_test_w1_1.zip";
+    hash = "sha256-X8gIfDj2iP043kjO3yqxuIgn8mZMX7XaqzhQ7CTLUhc=";
+    stripRoot = false;
+  };
+
+  postPatch = ''
+    mkdir -p tests/data/videos
+    cp ${matroska_test_zip}/*.mkv tests/data/videos/
+  '';
+
+  build-system = [
+    poetry-core
+  ];
+
+  dependencies = [
+    babelfish
+    enzyme
+    pymediainfo
+    pyyaml
+    trakit
+  ];
+
+  optional-dependencies = {
+    pint = [
+      pint
+    ];
+  };
+
+  pythonImportsCheck = [
+    "knowit"
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    ffmpeg
+    mediainfo
+    mkvtoolnix
+    requests
+  ];
+
+  meta = {
+    changelog = "https://github.com/ratoaq2/knowit/releases/tag/${src.tag}";
+    description = "Extract metadata from media files";
+    homepage = "https://github.com/ratoaq2/knowit";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ iynaix ];
+    mainProgram = "knowit";
+  };
+}

pkgs/development/python-modules/linearmodels/default.nix

@@ -0,0 +1,59 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  cython,
+  formulaic,
+  mypy-extensions,
+  numpy,
+  pandas,
+  pyhdfe,
+  pytestCheckHook,
+  scipy,
+  setuptools,
+  setuptools-scm,
+  statsmodels,
+}:
+
+buildPythonPackage rec {
+  pname = "linearmodels";
+  version = "6.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "bashtage";
+    repo = "linearmodels";
+    tag = "v${version}";
+    hash = "sha256-oWVBsFSKnv/8AHYP5sxO6+u5+hsOw/uQlOetse5ue88=";
+  };
+
+  build-system = [
+    setuptools
+    setuptools-scm
+    cython
+  ];
+
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  dependencies = [
+    formulaic
+    mypy-extensions
+    numpy
+    pandas
+    pyhdfe
+    scipy
+    statsmodels
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "linearmodels" ];
+
+  meta = {
+    description = "Models for panel data, system regression, instrumental variables and asset pricing";
+    homepage = "https://bashtage.github.io/linearmodels/";
+    changelog = "https://github.com/bashtage/linearmodels/releases/tag/v${version}";
+    license = lib.licenses.ncsa;
+    maintainers = with lib.maintainers; [ jherland ];
+  };
+}

pkgs/development/python-modules/mcdreforged/default.nix

@@ -21,14 +21,14 @@
 
 buildPythonPackage rec {
   pname = "mcdreforged";
-  version = "2.15.2";
+  version = "2.15.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "MCDReforged";
     repo = "MCDReforged";
     tag = "v${version}";
-    hash = "sha256-BhiscpbuiP2UWkSfUl5lyZ+eeE3LiH80xXjHs7K3x88=";
+    hash = "sha256-q88jAsgoIFzsOVKeA4fk69wGbnq3HcYJ2YzeZQHmYo4=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/pyhdfe/default.nix

@@ -0,0 +1,41 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  numpy,
+  pytestCheckHook,
+  scipy,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "pyhdfe";
+  version = "0.2.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "jeffgortmaker";
+    repo = "pyhdfe";
+    tag = "v${version}";
+    hash = "sha256-UXVQHf4Nmq/zQZtPaLba4TShhpgPUBwPM+zCEa8qaKs=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    numpy
+    scipy
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "pyhdfe" ];
+
+  meta = {
+    description = "Python 3 implementation of algorithms for absorbing high dimensional fixed effects";
+    homepage = "https://github.com/jeffgortmaker/pyhdfe";
+    changelog = "https://github.com/jeffgortmaker/pyhdfe/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jherland ];
+  };
+}

pkgs/development/python-modules/sentence-transformers/default.nix

@@ -27,14 +27,14 @@
 
 buildPythonPackage rec {
   pname = "sentence-transformers";
-  version = "5.1.0";
+  version = "5.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "UKPLab";
     repo = "sentence-transformers";
     tag = "v${version}";
-    hash = "sha256-snowpTdHelcFjo1+hvqpoVt5ROB0f91yt0GsIvA5cso=";
+    hash = "sha256-n0ZP01BU/s9iJ+RP7rNlBjD11jNDj8A8Q/seekh56nA=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/subliminal/default.nix

@@ -4,23 +4,33 @@
   fetchFromGitHub,
   pythonOlder,
 
+  # build-system
+  hatchling,
+  hatch-vcs,
+
+  # dependencies
   babelfish,
   beautifulsoup4,
   chardet,
   click,
   click-option-group,
+  defusedxml,
   dogpile-cache,
   enzyme,
   guessit,
+  knowit,
   srt,
   pysubs2,
   rarfile,
   requests,
   platformdirs,
-  setuptools,
   stevedore,
   tomli,
+  tomlkit,
 
+  # nativeCheckInputs
+  colorama,
+  pypandoc,
   pytestCheckHook,
   pytest-cov-stub,
   pytest-xdist,
@@ -43,7 +53,10 @@ buildPythonPackage rec {
     hash = "sha256-eAXzD6diep28wCZjWLOZpOX1bnakEldhs2LX5CPu5OI=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [
+    hatchling
+    hatch-vcs
+  ];
 
   propagatedBuildInputs = [
     babelfish
@@ -51,9 +64,11 @@ buildPythonPackage rec {
     chardet
     click
     click-option-group
+    defusedxml
     dogpile-cache
     enzyme
     guessit
+    knowit
     srt
     pysubs2
     rarfile
@@ -61,9 +76,12 @@ buildPythonPackage rec {
     platformdirs
     stevedore
     tomli
+    tomlkit
   ];
 
   nativeCheckInputs = [
+    colorama
+    pypandoc
     pytestCheckHook
     pytest-cov-stub
     pytest-xdist
@@ -76,6 +94,10 @@ buildPythonPackage rec {
 
   disabledTests = [
     # Tests require network access
+    "integration"
+    "test_cli_cache"
+    "test_cli_download"
+    "test_is_supported_archive"
     "test_refine"
     "test_scan"
     "test_hash"

pkgs/development/python-modules/uproot/default.nix

@@ -27,14 +27,14 @@
 
 buildPythonPackage rec {
   pname = "uproot";
-  version = "5.6.4";
+  version = "5.6.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "scikit-hep";
     repo = "uproot5";
     tag = "v${version}";
-    hash = "sha256-2F2uatdrZd5p6baYuGj24EmUv045Jk3Pp76Zv6eH5yg=";
+    hash = "sha256-1zZr+SrGRNBz/Wd1cT2aYOH/MzSZTCuqxYIlA+NXqLk=";
   };
 
   build-system = [

pkgs/os-specific/linux/sssd/default.nix

@@ -29,6 +29,7 @@
   openldap,
   pcre2,
   libkrb5,
+  libcap,
   cifs-utils,
   glib,
   keyutils,
@@ -51,6 +52,7 @@
   docbook_xsl,
   docbook_xml_dtd_45,
   testers,
+  versionCheckHook,
   nix-update-script,
   nixosTests,
   withSudo ? false,
@@ -61,13 +63,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "sssd";
-  version = "2.9.7";
+  version = "2.11.1";
 
   src = fetchFromGitHub {
     owner = "SSSD";
     repo = "sssd";
     tag = finalAttrs.version;
-    hash = "sha256-29KTvwm9ei1Z7yTSYmzcZtZMVvZpFWIlcLMlvRyWp/w=";
+    hash = "sha256-JN4GVx5rBfNBLaMpLcKgyd+CyNDafz85BXUcfg5kDXQ=";
   };
 
   postPatch = ''
@@ -93,6 +95,7 @@ stdenv.mkDerivation (finalAttrs: {
       --with-pid-path=/run
       --with-python3-bindings
       --with-syslog=journald
+      --with-initscript=systemd
       --without-selinux
       --without-semanage
       --with-xml-catalog-path=''${SGML_CATALOG_FILES%%:*}
@@ -108,12 +111,14 @@ stdenv.mkDerivation (finalAttrs: {
   # Disable parallel install due to missing depends:
   #   libtool:   error: error: relink '_py3sss.la' with the above command before installing i
   enableParallelInstalling = false;
+
   nativeBuildInputs = [
     autoreconfHook
     makeWrapper
     pkg-config
     doxygen
   ];
+
   buildInputs = [
     augeas
     dnsutils
@@ -121,6 +126,7 @@ stdenv.mkDerivation (finalAttrs: {
     curl
     cyrus_sasl
     ding-libs
+    libcap
     libnl
     libunistring
     nss
@@ -129,6 +135,7 @@ stdenv.mkDerivation (finalAttrs: {
     p11-kit
     (python3.withPackages (
       p: with p; [
+        setuptools
         distutils
         python-ldap
       ]
@@ -187,31 +194,37 @@ stdenv.mkDerivation (finalAttrs: {
     rm -f "$out"/modules/ldb/memberof.la
     find "$out" -depth -type d -exec rmdir --ignore-fail-on-non-empty {} \;
   '';
+
   postFixup = ''
     for f in $out/bin/sss{ctl,_cache,_debuglevel,_override,_seed}; do
       wrapProgram $f --prefix LDB_MODULES_PATH : $out/modules/ldb
     done
   '';
 
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
   passthru = {
     tests = {
       inherit (nixosTests) sssd sssd-ldap;
       pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      version = testers.testVersion {
-        package = finalAttrs.finalPackage;
-        command = "sssd --version";
-      };
     };
     updateScript = nix-update-script { };
   };
 
-  meta = with lib; {
+  meta = {
     description = "System Security Services Daemon";
     homepage = "https://sssd.io/";
     changelog = "https://sssd.io/release-notes/sssd-${finalAttrs.version}.html";
-    license = licenses.gpl3Plus;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ illustris ];
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [
+      illustris
+      liberodark
+    ];
     pkgConfigModules = [
       "ipa_hbac"
       "sss_certmap"

pkgs/servers/home-assistant/custom-components/xiaomi_miot/package.nix

@@ -11,13 +11,13 @@
 buildHomeAssistantComponent rec {
   owner = "al-one";
   domain = "xiaomi_miot";
-  version = "1.0.20";
+  version = "1.0.21";
 
   src = fetchFromGitHub {
     owner = "al-one";
     repo = "hass-xiaomi-miot";
     rev = "v${version}";
-    hash = "sha256-qn//le4zaS7URP4pWofwsA4FbB20DK7iRRUn8NWzwAI=";
+    hash = "sha256-P/IcWaBv+yj9bMeSm/vDtht0S7YQPOb0+/rWR7DLiJU=";
   };
 
   dependencies = [

pkgs/top-level/python-packages.nix

@@ -1921,6 +1921,8 @@ self: super: with self; {
 
   binsync = callPackage ../development/python-modules/binsync { };
 
+  biocframe = callPackage ../development/python-modules/biocframe { };
+
   biocutils = callPackage ../development/python-modules/biocutils { };
 
   biom-format = callPackage ../development/python-modules/biom-format { };
@@ -7860,6 +7862,8 @@ self: super: with self; {
 
   knot-floer-homology = callPackage ../development/python-modules/knot-floer-homology { };
 
+  knowit = callPackage ../development/python-modules/knowit { };
+
   knx-frontend = callPackage ../development/python-modules/knx-frontend { };
 
   kokoro = callPackage ../development/python-modules/kokoro { };
@@ -8440,6 +8444,8 @@ self: super: with self; {
 
   linear-operator = callPackage ../development/python-modules/linear-operator { };
 
+  linearmodels = callPackage ../development/python-modules/linearmodels { };
+
   lineax = callPackage ../development/python-modules/lineax { };
 
   linecache2 = callPackage ../development/python-modules/linecache2 { };
@@ -13138,6 +13144,8 @@ self: super: with self; {
 
   pyhcl = callPackage ../development/python-modules/pyhcl { };
 
+  pyhdfe = callPackage ../development/python-modules/pyhdfe { };
+
   pyheck = callPackage ../development/python-modules/pyheck { };
 
   pyheos = callPackage ../development/python-modules/pyheos { };