Merge master into staging-nixos

maintainers/maintainer-list.nix

@@ -588,6 +588,11 @@
       { fingerprint = "CE85 54F7 B9BC AC0D D648  5661 AB5F C04C 3C94 443F"; }
     ];
   };
+  adam-tj = {
+    github = "adam-tj";
+    githubId = 9314405;
+    name = "Adam Tjörnhammar";
+  };
   adam248 = {
     email = "adamjbutler091@gmail.com";
     github = "adam248";
@@ -1044,7 +1049,7 @@
     keys = [ { fingerprint = "F354 FFAB EA89 A49D 33ED  2590 4729 B829 AC5F CC72"; } ];
   };
   ALameLlama = {
-    email = "NicholasACiechanowski@gmail.com";
+    email = "nicholas@ciech.anow.ski";
     name = "Nicholas Ciechanowski";
     github = "ALameLlama";
     githubId = 55490546;
@@ -4944,6 +4949,12 @@
     githubId = 136485;
     name = "Chad Jablonski";
   };
+  cjimti = {
+    email = "cj@imti.co";
+    github = "cjimti";
+    githubId = 356698;
+    name = "Craig Johnston";
+  };
   cjshearer = {
     email = "cjshearer@live.com";
     github = "cjshearer";
@@ -7903,6 +7914,7 @@
     email = "eric@eric.dev.br";
     github = "EpicEric";
     githubId = 3129194;
+    matrix = "@epiceric:nixos.dev";
     name = "Eric Rodrigues Pires";
   };
   epireyn = {
@@ -21703,6 +21715,12 @@
     githubId = 115877;
     name = "Kenny Shen";
   };
+  qrzbing = {
+    email = "qrzbing@foxmail.com";
+    github = "qrzbing";
+    githubId = 23500397;
+    name = "qrzbing";
+  };
   quadradical = {
     email = "nixos@henryhiles.com";
     github = "Henry-Hiles";

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -58,6 +58,8 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
+- `opentrack`, `slushload`, `synthesia`, `vtfedit`, `winbox`, `wineasio`, and `yabridge` use wineWow64Packages instead of wineWowPackages as wine versions >= 11.0 have deprecated wineWowPackages. As such, the prefixes for these packages are NOT backwards compatible and need to be regenerated with potential for data loss.
+
 - `services.crabfit` was removed because its upstream packages are unmaintained and insecure.
 
 - `services.tandoor-recipes` now uses a sub-directory for media files by default starting with `26.05`. Existing setups should move media files out of the data directory and adjust `services.tandoor-recipes.extraConfig.MEDIA_ROOT` accordingly. See [Migrating media files for pre 26.05 installations](#module-services-tandoor-recipes-migrating-media).
@@ -84,6 +86,8 @@ of pulling the upstream container image from Docker Hub. If you want the old beh
   - `systemd.services.stalwart` owned by `stalwart:stalwart`. The `user` and `group` are configurable via `services.stalwart.user` and `services.stalwart.group`, respectively. By default, if `stateVersion` is older than `26.05`, will fallback to legacy value of `stalwart-mail` for both `user` and `group`.
   - Default value for `services.stalwart.dataDir` has changed to `/var/lib/stalwart`. If `stateVersion` is older than `26.05`, will fallback to legacy value of `/var/lib/stalwart-mail`.
 
+- `services.oauth2-proxy.clientSecret` and `services.oauth2-proxy.cookie.secret` have been replaced with `services.oauth2-proxy.clientSecretFile` and `services.oauth2-proxy.cookie.secretFile` respectively. This was done to ensure secrets don't get made world-readable.
+
 - Ethercalc and its associated module have been removed, as the package is unmaintained and cannot be installed from source with npm now.
 
 - `services.cgit` before always had the git-http-backend and its "export all" setting enabled, which sidestepped any access control configured in cgit's settings. Now you have to make a decision and either enable or disable `services.cgit.gitHttpBackend.checkExportOkFiles` (or disable the git-http-backend).
@@ -153,6 +157,8 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
+- Wine has been updated to the 11.0 branch. Please check the [upstream announcement](https://gitlab.winehq.org/wine/wine/-/releases/wine-11.0) for more details.
+
 - Cinnamon has been updated to 6.6, please check the [upstream announcement](https://www.linuxmint.com/rel_zena_whatsnew.php) for more details.
 
 - Budgie has been updated to 10.10, please check the [upstream announcement](https://buddiesofbudgie.org/blog/budgie-10-10-released) for more details.

nixos/modules/services/networking/netbird.nix

@@ -660,46 +660,66 @@ in
         }
       );
 
-      systemd.services = toHardenedClientAttrs (
-        client:
-        nameValuePair client.service.name (
-          mkIf client.hardened {
-            serviceConfig = {
-              RuntimeDirectoryMode = "0750";
+      systemd.services = mkMerge [
+        # netbird services
+        (toHardenedClientAttrs (
+          client:
+          nameValuePair client.service.name (
+            mkIf client.hardened {
+              serviceConfig = {
+                RuntimeDirectoryMode = "0750";
 
-              User = client.user.name;
-              Group = client.user.group;
+                User = client.user.name;
+                Group = client.user.group;
 
-              # settings implied by DynamicUser=true, without actually using it,
-              # see https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#DynamicUser=
-              RemoveIPC = true;
-              PrivateTmp = true;
-              ProtectSystem = "strict";
-              ProtectHome = "yes";
+                # settings implied by DynamicUser=true, without actually using it,
+                # see https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#DynamicUser=
+                RemoveIPC = true;
+                PrivateTmp = true;
+                ProtectSystem = "strict";
+                ProtectHome = "yes";
 
-              AmbientCapabilities = [
-                # see https://man7.org/linux/man-pages/man7/capabilities.7.html
-                # see https://docs.netbird.io/how-to/installation#running-net-bird-in-docker
-                #
-                # seems to work fine without CAP_SYS_ADMIN and CAP_SYS_RESOURCE
-                # CAP_NET_BIND_SERVICE could be added to allow binding on low ports, but is not required,
-                #  see https://github.com/netbirdio/netbird/pull/1513
+                AmbientCapabilities = [
+                  # see https://man7.org/linux/man-pages/man7/capabilities.7.html
+                  # see https://docs.netbird.io/how-to/installation#running-net-bird-in-docker
+                  #
+                  # seems to work fine without CAP_SYS_ADMIN and CAP_SYS_RESOURCE
+                  # CAP_NET_BIND_SERVICE could be added to allow binding on low ports, but is not required,
+                  #  see https://github.com/netbirdio/netbird/pull/1513
 
-                # failed creating tunnel interface wt-priv: [operation not permitted
-                "CAP_NET_ADMIN"
-                # failed to pull up wgInterface [wt-priv]: failed to create ipv4 raw socket: socket: operation not permitted
-                "CAP_NET_RAW"
-              ]
-              # required for eBPF filter, used to be subset of CAP_SYS_ADMIN
-              ++ optional (versionAtLeast kernel.version "5.8") "CAP_BPF"
-              ++ optional (versionOlder kernel.version "5.8") "CAP_SYS_ADMIN"
-              ++ optional (
-                client.dns-resolver.address != null && client.dns-resolver.port < 1024
-              ) "CAP_NET_BIND_SERVICE";
-            };
-          }
-        )
-      );
+                  # failed creating tunnel interface wt-priv: [operation not permitted
+                  "CAP_NET_ADMIN"
+                  # failed to pull up wgInterface [wt-priv]: failed to create ipv4 raw socket: socket: operation not permitted
+                  "CAP_NET_RAW"
+                ]
+                # required for eBPF filter, used to be subset of CAP_SYS_ADMIN
+                ++ optional (versionAtLeast kernel.version "5.8") "CAP_BPF"
+                ++ optional (versionOlder kernel.version "5.8") "CAP_SYS_ADMIN"
+                ++ optional (
+                  client.dns-resolver.address != null && client.dns-resolver.port < 1024
+                ) "CAP_NET_BIND_SERVICE";
+              };
+            }
+          )
+        ))
+        # netbird-login services
+        (toHardenedClientAttrs (
+          client:
+          nameValuePair "${client.service.name}-login" (
+            mkIf client.hardened {
+              serviceConfig = {
+                User = client.user.name;
+                Group = client.user.group;
+
+                RemoveIPC = true;
+                PrivateTmp = "disconnected"; # "disconnected" puts /tmp on `tmpfs`
+                ProtectSystem = "strict";
+                ProtectHome = "yes";
+              };
+            }
+          )
+        ))
+      ];
 
       # see https://github.com/systemd/systemd/blob/17f3e91e8107b2b29fe25755651b230bbc81a514/src/resolve/org.freedesktop.resolve1.policy#L43-L43
       # see all actions used at https://github.com/netbirdio/netbird/blob/13e7198046a0d73a9cd91bf8e063fafb3d41885c/client/internal/dns/systemd_linux.go#L29-L32
@@ -736,14 +756,6 @@ in
               Type = "oneshot";
               RemainAfterExit = true;
 
-              User = client.user.name;
-              Group = client.user.group;
-
-              RemoveIPC = true;
-              PrivateTmp = "disconnected"; # "disconnected" puts /tmp on `tmpfs`
-              ProtectSystem = "strict";
-              ProtectHome = "yes";
-
               LoadCredential = [ "setup-key:${client.login.setupKeyFile}" ];
             };
 

nixos/modules/services/security/oauth2-proxy.nix

@@ -46,7 +46,7 @@ let
       approval-prompt = approvalPrompt;
       basic-auth-password = basicAuthPassword;
       client-id = clientID;
-      client-secret = clientSecret;
+      client-secret-file = if clientSecretFile != null then "%d/client-secret" else null;
       custom-templates-dir = customTemplatesDir;
       email-domain = email.domains;
       http-address = httpAddress;
@@ -71,9 +71,9 @@ let
           secure
           expire
           name
-          secret
           refresh
           ;
+        secret-file = if cookie.secretFile != null then "%d/cookie-secret" else null;
         httponly = cookie.httpOnly;
       };
       set-xauthrequest = setXauthrequest;
@@ -159,6 +159,7 @@ in
 
     clientID = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
+      default = null;
       description = ''
         The OAuth Client ID.
       '';
@@ -174,11 +175,13 @@ in
       example = "https://login.microsoftonline.com/{TENANT_ID}/v2.0";
     };
 
-    clientSecret = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
+    clientSecretFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
       description = ''
-        The OAuth Client Secret.
+        The path to a file containing the OAuth Client Secret.
       '';
+      example = "/run/keys/oauth2-client-secret";
     };
 
     skipAuthRegexes = lib.mkOption {
@@ -423,11 +426,13 @@ in
         example = "168h0m0s";
       };
 
-      secret = lib.mkOption {
-        type = lib.types.nullOr lib.types.str;
+      secretFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
+        default = null;
         description = ''
-          The seed string for secure cookies.
+          The path to a file containing the seed string for secure cookies.
         '';
+        example = "/run/keys/oauth2-cookie-secret";
       };
 
       secure = lib.mkOption {
@@ -595,14 +600,23 @@ in
 
   imports = [
     (lib.mkRenamedOptionModule [ "services" "oauth2_proxy" ] [ "services" "oauth2-proxy" ])
+    (lib.mkRemovedOptionModule [ "services" "oauth2-proxy" "clientSecret" ] ''
+      This option has been removed as it made the client secret world-readable.
+      Use services.oauth2-proxy.clientSecretFile instead.
+    '')
+    (lib.mkRemovedOptionModule [ "services" "oauth2-proxy" "cookie" "secret" ] ''
+      This option has been removed as it made the cookie secret world-readable.
+      Use services.oauth2-proxy.cookie.secretFile instead.
+    '')
   ];
 
   config = lib.mkIf cfg.enable {
-    services.oauth2-proxy = lib.mkIf (cfg.keyFile != null) {
-      clientID = lib.mkDefault null;
-      clientSecret = lib.mkDefault null;
-      cookie.secret = lib.mkDefault null;
-    };
+    assertions = [
+      {
+        assertion = cfg.clientID != null || cfg.keyFile != null;
+        message = "Either services.oauth2-proxy.clientID or services.oauth2-proxy.keyFile must be specified.";
+      }
+    ];
 
     users.users.oauth2-proxy = {
       description = "OAuth2 Proxy";
@@ -633,6 +647,9 @@ in
           Restart = "always";
           ExecStart = "${lib.getExe cfg.package} ${configString}";
           EnvironmentFile = lib.mkIf (cfg.keyFile != null) cfg.keyFile;
+          LoadCredential =
+            lib.optional (cfg.clientSecretFile != null) "client-secret:${cfg.clientSecretFile}"
+            ++ lib.optional (cfg.cookie.secretFile != null) "cookie-secret:${cfg.cookie.secretFile}";
         };
       };
   };

nixos/tests/kmscon.nix

@@ -29,8 +29,7 @@
   enableOCR = true;
 
   testScript = ''
-    machine.succeed(":")
-    # ^ this create a screen
+    machine.wait_for_unit("multi-user.target")
 
     with subtest("ensure we can open a tty"):
       machine.wait_for_text("machine login:")
@@ -38,6 +37,8 @@
       machine.wait_for_text("Password:")
       machine.send_chars("foobar\n")
       machine.wait_for_text("alice@machine")
+      machine.send_chars("echo $TERM\n")
+      machine.wait_for_text("xterm-256color")
       machine.screenshot("tty.png")
   '';
 }

nixos/tests/wine.nix

@@ -68,21 +68,12 @@ listToAttrs (
   map (makeWineTest "winePackages" [ hello32 ]) variants
   ++ optionals pkgs.stdenv.hostPlatform.is64bit (
     map
-      (makeWineTest "wineWowPackages" [
+      (makeWineTest "wineWow64Packages" [
         hello32
         hello64
       ])
       # This wayland combination times out after spending many hours.
       # https://hydra.nixos.org/job/nixos/trunk-combined/nixos.tests.wine.wineWowPackages-wayland.x86_64-linux
       (pkgs.lib.remove "wayland" variants)
-    ++
-      map
-        (makeWineTest "wineWow64Packages" [
-          hello32
-          hello64
-        ])
-        # This wayland combination times out after spending many hours.
-        # https://hydra.nixos.org/job/nixos/trunk-combined/nixos.tests.wine.wineWowPackages-wayland.x86_64-linux
-        (pkgs.lib.remove "wayland" variants)
   )
 )

pkgs/applications/emulators/wine/packages.nix

@@ -77,7 +77,7 @@ in
       "x86_64-linux"
       "x86_64-darwin"
     ];
-    mainProgram = "wine64";
+    mainProgram = "wine";
   };
   wineWow = callPackage ./base.nix {
     pname = "wine-wow";
@@ -112,7 +112,7 @@ in
       ];
     };
     platforms = [ "x86_64-linux" ];
-    mainProgram = "wine64";
+    mainProgram = "wine";
   };
   wineWow64 = callPackage ./base.nix {
     pname = "wine-wow64";

pkgs/applications/emulators/wine/sources.nix

@@ -97,9 +97,9 @@ in
 rec {
 
   stable = fetchurl rec {
-    version = "10.0";
-    url = "https://dl.winehq.org/wine/source/10.0/wine-${version}.tar.xz";
-    hash = "sha256-xeCz9ffvr7MOnNTZxiS4XFgxcdM1SdkzzTQC80GsNgE=";
+    version = "11.0";
+    url = "https://dl.winehq.org/wine/source/11.0/wine-${version}.tar.xz";
+    hash = "sha256-wHpoV5M8H8YN/1RI1585ySSBwenbWqYo250DWERuBwE=";
 
     ## see http://wiki.winehq.org/Gecko
     gecko32 = fetchurl rec {
@@ -115,17 +115,15 @@ rec {
 
     ## see http://wiki.winehq.org/Mono
     mono = fetchurl rec {
-      version = "8.1.0";
+      version = "10.0.0";
       url = "https://dl.winehq.org/wine/wine-mono/${version}/wine-mono-${version}-x86.msi";
-      hash = "sha256-DtPsUzrvebLzEhVZMc97EIAAmsDFtMK8/rZ4rJSOCBA=";
+      hash = "sha256-26ynPl0J96OnwVetBCia+cpHw87XAS1GVEpgcEaQK4c=";
     };
 
     patches = [
       # Also look for root certificates at $NIX_SSL_CERT_FILE
       ./cert-path.patch
-    ]
-    ++ patches-binutils-2_44-fix-wine-older-than-10_2
-    ++ patches-add-truncf-to-the-import-library;
+    ];
 
     updateScript = writeShellScript "update-wine-stable" ''
       ${updateScriptPreamble}
@@ -144,9 +142,9 @@ rec {
 
   unstable = fetchurl rec {
     # NOTE: Don't forget to change the hash for staging as well.
-    version = "10.20";
-    url = "https://dl.winehq.org/wine/source/10.x/wine-${version}.tar.xz";
-    hash = "sha256-gbShU5WPYkf+UEHV32Xq3Lvuoba6jNok6349fOLR/jw=";
+    version = "11.1";
+    url = "https://dl.winehq.org/wine/source/11.x/wine-${version}.tar.xz";
+    hash = "sha256-v0x8j7XYwfZW8wor6pOHDIXxP/gxGrL2Hd75AOsoy48=";
 
     patches = [
       # Also look for root certificates at $NIX_SSL_CERT_FILE
@@ -156,7 +154,7 @@ rec {
     # see https://gitlab.winehq.org/wine/wine-staging
     staging = fetchFromGitLab {
       inherit version;
-      hash = "sha256-Ys0VNYj568qMHq56ZCprnsbpb/iqtiDlU3w0er8Ol5g=";
+      hash = "sha256-KBiESkLVEEWyUPzv1I7j8U9zjqfYdF+FL6wRCcIE290=";
       domain = "gitlab.winehq.org";
       owner = "wine";
       repo = "wine-staging";

pkgs/applications/networking/instant-messengers/discord/sources.json

@@ -1,8 +1,8 @@
 {
   "linux-canary": {
-    "hash": "sha256-HtcgQS8P5R57qV3pKYyVLcT9FCOtZ6UbFBQWFkvU8B0=",
-    "url": "https://canary.dl2.discordapp.net/apps/linux/0.0.854/discord-canary-0.0.854.tar.gz",
-    "version": "0.0.854"
+    "hash": "sha256-kjIrLBHbCvDEi/lyJadyaqR/5z77u5CvOekbptJZnxY=",
+    "url": "https://canary.dl2.discordapp.net/apps/linux/0.0.862/discord-canary-0.0.862.tar.gz",
+    "version": "0.0.862"
   },
   "linux-development": {
     "hash": "sha256-EVkjWoqWl9Z+iHCLPOLu4PIUb2wC3HVcPVjOVz++IVw=",
@@ -10,19 +10,19 @@
     "version": "0.0.94"
   },
   "linux-ptb": {
-    "hash": "sha256-Y+e3HHXE5D9Q9qKE7ipaLijZ+E6yEr9NzEOy5c+Gk54=",
-    "url": "https://ptb.dl2.discordapp.net/apps/linux/0.0.173/discord-ptb-0.0.173.tar.gz",
-    "version": "0.0.173"
+    "hash": "sha256-SOShH+EzFN1ti1RcgvRaxaD45nHosi4R6lSXSY3MGYU=",
+    "url": "https://ptb.dl2.discordapp.net/apps/linux/0.0.176/discord-ptb-0.0.176.tar.gz",
+    "version": "0.0.176"
   },
   "linux-stable": {
-    "hash": "sha256-WR9xyw3Zn/HAZQlfiKMAXqc2TueF6wCfQzvYtnXd1yM=",
-    "url": "https://stable.dl2.discordapp.net/apps/linux/0.0.121/discord-0.0.121.tar.gz",
-    "version": "0.0.121"
+    "hash": "sha256-2cNAfYzPbZ9O8s4b3RBLki8aM9TiFuZcGffFbY4zxJQ=",
+    "url": "https://stable.dl2.discordapp.net/apps/linux/0.0.123/discord-0.0.123.tar.gz",
+    "version": "0.0.123"
   },
   "osx-canary": {
-    "hash": "sha256-q/PAGdlOTdkQudiH/NFXSgwhz2XBL9ZwrhJXiY9Iibc=",
-    "url": "https://canary.dl2.discordapp.net/apps/osx/0.0.958/DiscordCanary.dmg",
-    "version": "0.0.958"
+    "hash": "sha256-KPneQR4BBC/1CHWYm1ie8m//tiagRCk92e1/Tz+Fx9Y=",
+    "url": "https://canary.dl2.discordapp.net/apps/osx/0.0.966/DiscordCanary.dmg",
+    "version": "0.0.966"
   },
   "osx-development": {
     "hash": "sha256-B1//zMlTv2+RWHfWZSaaU8ubVOwWob+EYjNdtFRwlgg=",
@@ -30,13 +30,13 @@
     "version": "0.0.107"
   },
   "osx-ptb": {
-    "hash": "sha256-QCzJsb1RH6HORk9hw9F9Xu0rE+NCFYJDTJQO9UrdBxo=",
-    "url": "https://ptb.dl2.discordapp.net/apps/osx/0.0.205/DiscordPTB.dmg",
-    "version": "0.0.205"
+    "hash": "sha256-EPhQwolrHda8gh+G84quVlbNGYSThqJsg4qjK44nZuc=",
+    "url": "https://ptb.dl2.discordapp.net/apps/osx/0.0.208/DiscordPTB.dmg",
+    "version": "0.0.208"
   },
   "osx-stable": {
-    "hash": "sha256-/CEN67VbRRwK64Iy7GIhs2XFwHe47njI5X6n45j5Q/E=",
-    "url": "https://stable.dl2.discordapp.net/apps/osx/0.0.373/Discord.dmg",
-    "version": "0.0.373"
+    "hash": "sha256-pRL1fCBXQL3iMNM/po73KrtJRQhWNvED7H8PrOBWTaU=",
+    "url": "https://stable.dl2.discordapp.net/apps/osx/0.0.375/Discord.dmg",
+    "version": "0.0.375"
   }
 }

pkgs/by-name/ai/airwave/package.nix

@@ -2,7 +2,7 @@
   lib,
   multiStdenv,
   fetchFromGitHub,
-  wineWowPackages,
+  wineWow64Packages,
   cmake,
   makeWrapper,
   file,
@@ -12,7 +12,7 @@
 }:
 
 let
-  wine-wow64 = wineWowPackages.stableFull;
+  wine-wow64 = wineWow64Packages.stableFull;
 in
 multiStdenv.mkDerivation (finalAttrs: {
   pname = "airwave";
@@ -65,7 +65,7 @@ multiStdenv.mkDerivation (finalAttrs: {
     mkdir $out/bin
     mv $out/libexec/airwave-manager $out/bin
     wrapProgram $out/libexec/airwave-host-32.exe --set WINELOADER ${lib.getExe' wine-wow64 "wine"}
-    wrapProgram $out/libexec/airwave-host-64.exe --set WINELOADER ${lib.getExe' wine-wow64 "wine64"}
+    wrapProgram $out/libexec/airwave-host-64.exe --set WINELOADER ${lib.getExe' wine-wow64 "wine"}
   '';
 
   meta = {

pkgs/by-name/bs/bs-manager/package.nix

@@ -18,15 +18,15 @@
   steam-run-free,
 }:
 
-buildNpmPackage.override { nodejs = nodejs_22; } (finalAttrs: {
+buildNpmPackage (finalAttrs: {
   pname = "bs-manager";
-  version = "1.5.4";
+  version = "1.5.6";
 
   src = fetchFromGitHub {
     owner = "Zagrios";
     repo = "bs-manager";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YitQjhnadQrpdBOV2CUedRNm/RW7/rpXtS9PJTa9kUU=";
+    hash = "sha256-hx6ciEz772NYd9+7WjLqTzNNenWMoOq57IneqsDC1Qg=";
   };
 
   postPatch = ''
@@ -39,13 +39,13 @@ buildNpmPackage.override { nodejs = nodejs_22; } (finalAttrs: {
     ln -s ${finalAttrs.passthru.depotdownloader}/bin/DepotDownloader assets/scripts/DepotDownloader
   '';
 
-  npmDepsHash = "sha256-3NMqYD7S4wYjwYuGJOmq2/C82qtG1mImsR4crjFLe30=";
+  npmDepsHash = "sha256-wmPZv1lqGr31wBGaeLw7LL6ZMzq/x8lkoy/iMxU+M80=";
 
   extraNpmDeps = fetchNpmDeps {
     name = "bs-manager-${finalAttrs.version}-extra-npm-deps";
     inherit (finalAttrs) src;
     sourceRoot = "${finalAttrs.src.name}/release/app";
-    hash = "sha256-UWsxty1kfxMr5fybtykrN2G+yiQ9dw/bbMwfcVLJgp4=";
+    hash = "sha256-jE/M22QQzuTS0zgcB+tLEL8Ey61HE8MP7H1MTX060gY=";
   };
 
   makeCacheWritable = true;
@@ -64,6 +64,10 @@ buildNpmPackage.override { nodejs = nodejs_22; } (finalAttrs: {
     stdenv.cc.cc
   ];
 
+  autoPatchelfIgnoreMissingDeps = [
+    "libc.musl-x86_64.so.1" # musl-based node modules won't be used on glibc systems
+  ];
+
   preBuild = ''
     pushd release/app
 

pkgs/by-name/ca/cargo-nextest/package.nix

@@ -8,13 +8,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-nextest";
-  version = "0.9.124";
+  version = "0.9.126";
 
   src = fetchFromGitHub {
     owner = "nextest-rs";
     repo = "nextest";
     tag = "cargo-nextest-${finalAttrs.version}";
-    hash = "sha256-qvJ/dqbls2fVSPY++kYBIeiu14eDD8ORuvcD8dEtMZ8=";
+    hash = "sha256-meAry18+M+VizSWFvMY99F4ZDbb2LuaTqi3kBuoxhD0=";
   };
 
   # FIXME: we don't support dtrace probe generation on macOS until we have a dtrace build: https://github.com/NixOS/nixpkgs/pull/392918
@@ -22,7 +22,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     ./no-dtrace-macos.patch
   ];
 
-  cargoHash = "sha256-3fZSXBP6vMh7GN2eY2upsvV/mTuDOcSovdsbcZBQA4U=";
+  cargoHash = "sha256-I25ObQEM9sxwnmqebb4P6EXFUMkXWjNfoV01WyZOivA=";
 
   cargoBuildFlags = [
     "-p"

pkgs/by-name/ch/chhoto-url/package.nix

@@ -8,13 +8,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "chhoto-url";
-  version = "6.5.5";
+  version = "6.5.8";
 
   src = fetchFromGitHub {
     owner = "SinTan1729";
     repo = "chhoto-url";
     tag = finalAttrs.version;
-    hash = "sha256-Kr/DpxptU3j3Q97G+5fG5y7oLrpK7KaqlDv0TtsAl4E=";
+    hash = "sha256-JrGiRYE9YLuUdOhIqtNOsk+yiTLeiaTVQ7A5g3jqk/8=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/actix";
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail "./resources/" "${placeholder "out"}/share/chhoto-url/resources/"
   '';
 
-  cargoHash = "sha256-3WZgjf2ytnnTKVR0E6n3d4WhHS/cjgEgfENtOpBf57w=";
+  cargoHash = "sha256-QXSOeiXJadTQaCRRfbn3C3KDyKIV4eOa2IdHHPK5Dzo=";
 
   postInstall = ''
     mkdir -p $out/share/chhoto-url

pkgs/by-name/ch/chirp/package.nix

@@ -11,14 +11,14 @@
 
 python3Packages.buildPythonApplication {
   pname = "chirp";
-  version = "0.4.0-unstable-2026-02-01";
+  version = "0.4.0-unstable-2026-02-06";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kk7ds";
     repo = "chirp";
-    rev = "52a3a4be4035fac1bec56ee6f20ae50ea15f8c31";
-    hash = "sha256-HrLOo9duWDOxoranH2fo9KVs3OIV0oHDvzEcWdwthTs=";
+    rev = "450cf8a7a126419400eb3b271e4e22f7a8ada1ec";
+    hash = "sha256-UjLVYLd+OjDPoSBSSQQuh5eXn+7Hq5BFXnoy/PuaUsI=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/cl/cloudflared/tests.nix

@@ -56,7 +56,7 @@ in
       }
       ''
         export HOME="$(mktemp -d)"
-        wine64 $exe help
+        wine $exe help
         mkdir $out
       '';
 }

pkgs/by-name/co/commitlint/package.nix

@@ -12,18 +12,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "commitlint";
-  version = "20.4.0";
+  version = "20.4.1";
 
   src = fetchFromGitHub {
     owner = "conventional-changelog";
     repo = "commitlint";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Koi4twmDeCV716rGEUUmkt25gzBROBFL5y48qr+J/FA=";
+    hash = "sha256-FJod+jzd8zHOcyoHyxw+UltS2NsHmbocIWIbxHk2EDg=";
   };
 
   yarnOfflineCache = fetchYarnDeps {
     inherit (finalAttrs) src;
-    hash = "sha256-ihN9DmW46nKeFjcZWdxsutE+Q6ezdqPXO0i/xkNJdI0=";
+    hash = "sha256-pnxnFvEv6fo1I6XAFZw6xcues52WYxFjdehH9BzB+w4=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/co/convertx/package.nix

@@ -0,0 +1,154 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+
+  # Build deps
+  bun,
+  tailwindcss_4,
+  typescript,
+  makeBinaryWrapper,
+
+  # Runtime deps
+  assimp,
+  calibre,
+  dasel,
+  ffmpeg-headless,
+  graphicsmagick,
+  imagemagick,
+  inkscape,
+  libheif,
+  libjxl,
+  libreoffice,
+  libva,
+  pandoc,
+  perl5Packages,
+  potrace,
+  python3,
+  resvg,
+  texliveBasic,
+  vips,
+  vtracer,
+}:
+let
+  pin = lib.importJSON ./pin.json;
+  inherit (pin) version;
+
+  pname = "convertx";
+
+  src = fetchFromGitHub {
+    owner = "C4illin";
+    repo = "ConvertX";
+    tag = "v${version}";
+    hash = pin.srcHash;
+  };
+
+  node_modules = stdenv.mkDerivation (finalAttrs: {
+    pname = "${pname}-node_modules";
+    inherit version src;
+
+    dontConfigure = true;
+
+    nativeBuildInputs = [
+      bun
+    ];
+
+    buildPhase = ''
+      runHook preBuild
+
+      bun install --frozen-lockfile --no-progress
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      mkdir -p $out/lib/node_modules
+
+      rm -rf ./node_modules/.cache
+      rm -rf node_modules/.bin
+      cp -R ./node_modules $out/lib
+      cp package.json $out/lib
+    '';
+
+    outputHash = pin."${stdenv.system}";
+    outputHashMode = "recursive";
+  });
+in
+stdenv.mkDerivation {
+  inherit pname version src;
+
+  nativeBuildInputs = [
+    makeBinaryWrapper
+    tailwindcss_4
+    typescript
+  ];
+
+  dontConfigure = true;
+
+  buildPhase = ''
+    runHook preBuild
+
+    ln -s ${node_modules}/lib/node_modules ./node_modules
+    tailwindcss -i ./src/main.css -o ./public/generated.css
+    tsc
+
+    substituteInPlace ./dist/src/index.js \
+      --replace-fail "assets: \"public\"" "assets: \"$out/share/convertx/dist/public\""
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin
+    mkdir -p $out/share/convertx
+    cp -R ./dist $out/share/convertx
+    cp -R ./public $out/share/convertx/dist
+    ln -s ${node_modules}/lib/node_modules $out
+
+    makeBinaryWrapper ${bun}/bin/bun $out/bin/convertx \
+      --add-flags "run --prefer-offline --no-install $out/share/convertx/dist/src/index.js" \
+      --set NODE_ENV production \
+      --suffix PATH : ${
+        lib.makeBinPath [
+          assimp
+          calibre
+          dasel
+          ffmpeg-headless
+          graphicsmagick
+          imagemagick
+          inkscape
+          libheif
+          libjxl
+          libreoffice
+          libva
+          pandoc
+          perl5Packages.EmailOutlookMessage
+          potrace
+          (python3.withPackages (ps: [ ps.markitdown ]))
+          resvg
+          (texliveBasic.withPackages (ps: [
+            ps.dvisvgm
+            ps.latex
+            ps.latexmk
+            ps.unicode-math
+            ps.xcolor
+            ps.xetex
+          ]))
+          vips
+          vtracer
+        ]
+      }
+  '';
+
+  meta = {
+    description = "Self-hosted online file converter";
+    homepage = "https://github.com/C4illin/ConvertX/tree/main";
+    license = lib.licenses.agpl3Only;
+    platforms = lib.platforms.linux;
+    changelog = "https://github.com/C4illin/ConvertX/blob/main/CHANGELOG.md";
+    mainProgram = "convertx";
+    maintainers = with lib.maintainers; [
+      EpicEric
+    ];
+  };
+}

pkgs/by-name/co/convertx/pin.json

@@ -0,0 +1,6 @@
+{
+  "version": "0.17.0",
+  "srcHash": "sha256-1W7M9BfAh89ntmJW7tNwydwPCkVy5CoddWb2aPPUFds=",
+  "x86_64-linux": "sha256-7B4ZGGew6isFnz7EoaLyJgO6a66V9ZTKsKxXwVSsnfs=",
+  "aarch64-linux": "sha256-IoQP9UBd64qecOwmI8oQREgiYCL2pXGjfVx1Ylvd/WA="
+}

pkgs/by-name/dx/dxvk/setup_dxvk.sh

@@ -145,7 +145,7 @@ export WINEDEBUG=-all
 export WINEDLLOVERRIDES="mscoree,mshtml="
 
 wine="wine"
-wine64="wine64"
+wine64="wine"
 wineboot="wineboot"
 
 # $PATH is the way for user to control where wine is located (including custom Wine versions).

pkgs/by-name/eb/ebusd/package.nix

@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ebusd";
-  version = "25.1";
+  version = "26.1";
 
   src = fetchFromGitHub {
     owner = "john30";
     repo = "ebusd";
     rev = version;
-    sha256 = "sha256-rj0Wkfk3Tpm58fbCUkgCdHt5MvW+tGgDyUd5COXfBc0=";
+    sha256 = "sha256-CmArhkJfxf8lL6FoHRQKjk/8ObfEy3Xef9DUtOVKRas=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/en/ente-web/package.nix

@@ -1,9 +1,15 @@
 {
   lib,
   stdenv,
+  binaryen,
+  cargo,
   fetchFromGitHub,
   fetchYarnDeps,
   nodejs,
+  rustPlatform,
+  rustc,
+  wasm-bindgen-cli_0_2_106,
+  wasm-pack,
   yarnConfigHook,
   yarnBuildHook,
   nix-update-script,
@@ -19,43 +25,73 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ente-web-${enteApp}";
-  version = "1.2.22";
+  version = "1.3.10";
 
   src = fetchFromGitHub {
     owner = "ente-io";
     repo = "ente";
-    sparseCheckout = [ "web" ];
+    sparseCheckout = [
+      "rust"
+      "web"
+    ];
     tag = "photos-v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-ckrACrgQ9qj6e44QifiUPtldBbDVrKv29s5oQ1Y+gvk=";
+    hash = "sha256-2f4A8RQFhXjPpHKvZACUmUcoukJ800yqTTMWBtLyIlI=";
   };
   sourceRoot = "${finalAttrs.src.name}/web";
 
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs)
+      pname
+      version
+      src
+      sourceRoot
+      cargoRoot
+      ;
+    hash = "sha256-dedLmQP15V+gAtycXx1fpWfjXWsTPLXPPcCIAcr/ME0=";
+  };
+  cargoRoot = "packages/wasm";
+
   offlineCache = fetchYarnDeps {
     yarnLock = "${finalAttrs.src}/web/yarn.lock";
-    hash = "sha256-omFNobZ+2hb1cEO2Gfn+F3oYy7UDSrtIY4cliQ80CUs=";
+    hash = "sha256-H9ZNnbY22BddJl3SDhg+cEN0IaBZtilBFBDUf+zOzV0=";
   };
 
   nativeBuildInputs = [
     yarnConfigHook
     yarnBuildHook
+    binaryen
+    cargo
+    rustPlatform.cargoSetupHook
+    rustc
+    rustc.llvmPackages.lld
     nodejs
+    wasm-bindgen-cli_0_2_106
+    wasm-pack
   ];
 
   # See: https://github.com/ente-io/ente/blob/main/web/apps/photos/.env
   env = extraBuildEnv;
 
-  # Replace hardcoded ente.io urls if desired
-  postPatch = lib.optionalString (enteMainUrl != null) ''
-    substituteInPlace \
-      apps/payments/src/services/billing.ts \
-      apps/photos/src/pages/shared-albums.tsx \
-      --replace-fail "https://ente.io" ${lib.escapeShellArg enteMainUrl}
+  postPatch =
+    # Use our `wasm-pack` binary, rather than the Node version, which is
+    # just a wrapper that tries to download the actual binary
+    ''
+      substituteInPlace \
+        packages/wasm/package.json \
+        --replace-fail "wasm-pack " ${lib.escapeShellArg "${wasm-pack}/bin/wasm-pack "}
+    ''
+    # Replace hardcoded ente.io urls if desired
+    + lib.optionalString (enteMainUrl != null) ''
+      substituteInPlace \
+        apps/payments/src/services/billing.ts \
+        apps/photos/src/pages/shared-albums.tsx \
+        --replace-fail "https://ente.io" ${lib.escapeShellArg enteMainUrl}
 
-    substituteInPlace \
-      apps/accounts/src/pages/index.tsx \
-      --replace-fail "https://web.ente.io" ${lib.escapeShellArg enteMainUrl}
-  '';
+      substituteInPlace \
+        apps/accounts/src/pages/index.tsx \
+        --replace-fail "https://web.ente.io" ${lib.escapeShellArg enteMainUrl}
+    '';
 
   yarnBuildScript = "build:${enteApp}";
   installPhase =
@@ -85,6 +121,7 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = with lib.maintainers; [
       pinpox
       oddlama
+      nicegamer7
     ];
     platforms = lib.platforms.all;
   };

pkgs/by-name/gi/github-copilot-cli/package.nix

@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "github-copilot-cli";
-  version = "0.0.400";
+  version = "0.0.406";
 
   src = fetchzip {
     url = "https://registry.npmjs.org/@github/copilot/-/copilot-${finalAttrs.version}.tgz";
-    hash = "sha256-TZDeDmN2GF0a4KFOHt+oXn4IXDRl+OwvlEkBefNR3io=";
+    hash = "sha256-APjQW8YDoIO+Q2D5SkH0KI4u+w5mAF3VfEk/Yda2/54=";
   };
 
   nativeBuildInputs = [ makeBinaryWrapper ];

pkgs/by-name/i2/i2pd/package.nix

@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "i2pd";
-  version = "2.58.0";
+  version = "2.59.0";
 
   src = fetchFromGitHub {
     owner = "PurpleI2P";
     repo = "i2pd";
     tag = finalAttrs.version;
-    hash = "sha256-moUcivW3YIE2SvjS7rCXTjeCKUW/u/NXWH3VmJ9x6jg=";
+    hash = "sha256-PBwjP54gVtMduN//OXxd35KnRJv7sbA1MIUU+1KNUac=";
   };
 
   postPatch = lib.optionalString (!stdenv.hostPlatform.isx86) ''

pkgs/by-name/js/jsoncons/package.nix

@@ -18,7 +18,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [ cmake ];
 
-  env.NIX_CFLAGS_COMPILE = "-std=c++20 -Wno-error";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=tautological-overlap-compare";
 
   meta = {
     description = "C++, header-only library for constructing JSON and JSON-like data formats";

pkgs/by-name/km/kmscon/package.nix

@@ -12,6 +12,7 @@
   pango,
   pkg-config,
   docbook_xsl,
+  docbook_xml_dtd_42,
   libxslt,
   libgbm,
   ninja,
@@ -23,13 +24,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "kmscon";
-  version = "9.3.0";
+  version = "9.3.1";
 
   src = fetchFromGitHub {
     owner = "kmscon";
     repo = "kmscon";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vdM/3n3Y2FM+PLDgVuU10kkNLCSzTrFI35CaY5NxWks=";
+    hash = "sha256-pH+dBcUKXrVh9/y6mNWmYBx6HVbuSZX/F2sCG/Yj5UQ=";
   };
 
   strictDeps = true;
@@ -60,10 +61,23 @@ stdenv.mkDerivation (finalAttrs: {
     libxslt # xsltproc
   ];
 
+  outputs = [
+    "out"
+    "man"
+  ];
+
   patches = [
     ./sandbox.patch # Generate system units where they should be (nix store) instead of /etc/systemd/system
   ];
 
+  postPatch = ''
+    for i in ./docs/man/*.in; do
+      substituteInPlace "''${i}" \
+        --replace-fail "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" \
+                       "${docbook_xml_dtd_42}/xml/dtd/docbook/docbookx.dtd"
+    done
+  '';
+
   passthru = {
     tests.kmscon = nixosTests.kmscon;
     updateScript = nix-update-script { extraArgs = [ "--use-github-releases" ]; };
@@ -73,6 +87,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "KMS/DRM based System Console";
     mainProgram = "kmscon";
     homepage = "https://www.freedesktop.org/wiki/Software/kmscon/";
+    changelog = "https://github.com/kmscon/kmscon/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ ccicnce113424 ];
     platforms = lib.platforms.linux;

pkgs/by-name/ku/kubefwd/package.nix

@@ -6,16 +6,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "kubefwd";
-  version = "1.22.5";
+  version = "1.25.9";
 
   src = fetchFromGitHub {
     owner = "txn2";
     repo = "kubefwd";
-    rev = finalAttrs.version;
-    hash = "sha256-xTd/1h9fW2GbZ2u3RsExbQouRZot9CUDuqNLItRySxM=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-eJcmQRVrBYcT/o++d4hKUd8UWJDS/Z395M/sz8kpLfw=";
   };
 
-  vendorHash = "sha256-qAlzgPw1reDZYK+InlnAsBgVemVumWwLgEuYm+ALcCs=";
+  vendorHash = "sha256-l0iHkuSX1ECtOYY2HIFTPFVSYiZL9fi5BDOjhxWpDyA=";
+
+  subPackages = [ "cmd/kubefwd" ];
 
   ldflags = [
     "-s"
@@ -25,9 +27,9 @@ buildGoModule (finalAttrs: {
 
   meta = {
     description = "Bulk port forwarding Kubernetes services for local development";
-    homepage = "https://github.com/txn2/kubefwd";
+    homepage = "https://kubefwd.com";
     license = lib.licenses.asl20;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ cjimti ];
     mainProgram = "kubefwd";
   };
 })

pkgs/by-name/li/libtsm/package.nix

@@ -35,6 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Terminal-emulator State Machine";
     homepage = "https://www.freedesktop.org/wiki/Software/kmscon/libtsm/";
+    changelog = "https://github.com/kmscon/libtsm/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ ccicnce113424 ];
     platforms = lib.platforms.linux;

pkgs/by-name/lu/lux-cli/package.nix

@@ -18,18 +18,18 @@
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "lux-cli";
 
-  version = "0.25.1";
+  version = "0.25.2";
 
   src = fetchFromGitHub {
     owner = "lumen-oss";
     repo = "lux";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0VPXRO8ApVKToP1/2xJlOxi5UTXSfXkCuHV0hECv4VA=";
+    hash = "sha256-wxVXQIqOenq8MRt6PGKGwuVDRgylGxVNlDMc1gWSCXw=";
   };
 
   buildAndTestSubdir = "lux-cli";
 
-  cargoHash = "sha256-GkzTN4DjbzyvLAuiXONyMXm8Bgd9t6tj2cqTi/ir268=";
+  cargoHash = "sha256-A47laM9WvAldFvC3Fz8kkJh1Q8MzOFj1Mmu7ZQS2mI0=";
 
   nativeInstallCheckInputs = [
     versionCheckHook
@@ -90,6 +90,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     license = lib.licenses.lgpl3Plus;
     maintainers = with lib.maintainers; [
       mrcjkb
+      ALameLlama
     ];
     platforms = lib.platforms.all;
     mainProgram = "lx";

pkgs/by-name/mi/miriway/package.nix

@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "miriway";
-  version = "25.13";
+  version = "26.01";
 
   src = fetchFromGitHub {
     owner = "Miriway";
     repo = "Miriway";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-W05XAhZwdqotlDSklnw4Yh3k8VJNQJzHCJsMQn1p5rQ=";
+    hash = "sha256-JHLP5M9uBS4CmTGx3xgNq7YN1Tj8FZyKo1C8aGTtG9E=";
   };
 
   postPatch = ''

pkgs/by-name/mu/museum/package.nix

@@ -10,14 +10,14 @@
 
 buildGoModule (finalAttrs: {
   pname = "museum";
-  version = "1.2.28";
+  version = "1.3.10";
 
   src = fetchFromGitHub {
     owner = "ente-io";
     repo = "ente";
     sparseCheckout = [ "server" ];
     tag = "photos-v${finalAttrs.version}";
-    hash = "sha256-t0GYaIce5fmQfwpI1cqZEL3OXPmdIet+i1BegIbpU3s=";
+    hash = "sha256-x22RzmDHTb6YVB0/+KcaFlX3e/c8vvFR/572MZWNvL8=";
   };
 
   vendorHash = "sha256-napF55nA/9P8l5lddnEHQMjLXWSyTzgblIQCbSZ20MA=";
@@ -61,6 +61,7 @@ buildGoModule (finalAttrs: {
     maintainers = with lib.maintainers; [
       pinpox
       oddlama
+      nicegamer7
     ];
     mainProgram = "museum";
     platforms = lib.platforms.linux;

pkgs/by-name/nv/nvc/package.nix

@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nvc";
-  version = "1.19.0";
+  version = "1.19.1";
 
   src = fetchFromGitHub {
     owner = "nickg";
     repo = "nvc";
     tag = "r${finalAttrs.version}";
-    hash = "sha256-99aYjP5YGMSM9V2gkU5tT5KeyddGjlxvzT7oKzU9WCg=";
+    hash = "sha256-r/fgOy2KnDwcNxLrOFYFYqUqBLL8NkmuaBOFbfn/gug=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ob/obs-cmd/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "obs-cmd";
-  version = "0.20.1";
+  version = "0.31.0";
 
   src = fetchFromGitHub {
     owner = "grigio";
     repo = "obs-cmd";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-67kMAUwgrQcGipsbKo0kubkVJA4/T4nfqghEZlhnvHU=";
+    hash = "sha256-xjtNQZDgo7DIUsoH0PNHbsgE+FSXYnqWXpISdiRqTKw=";
   };
 
-  cargoHash = "sha256-t0R2QMmNpLgqmqLVL4hgEcqN0xIUIK3gIwxZxzkupbQ=";
+  cargoHash = "sha256-yoXwiNkEOj/wDw70wWHmuTyOE8nPaCXFar9FFiKOOAM=";
 
   meta = {
     description = "Minimal CLI to control OBS Studio via obs-websocket";

pkgs/by-name/op/opentrack/package.nix

@@ -15,7 +15,7 @@
   libxdmcp,
   libevdev,
   makeDesktopItem,
-  wineWowPackages,
+  wineWow64Packages,
   onnxruntime,
   nix-update-script,
   withWine ? stdenv.targetPlatform.isx86_64,
@@ -49,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
     qt6.wrapQtAppsHook
   ]
-  ++ lib.optionals withWine [ wineWowPackages.stable ];
+  ++ lib.optionals withWine [ wineWow64Packages.stable ];
 
   buildInputs = [
     finalAttrs.aruco

pkgs/by-name/os/oscar64/package.nix

@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "oscar64";
-  version = "1.32.266";
+  version = "1.32.267";
 
   src = fetchFromGitHub {
     owner = "drmortalwombat";
     repo = "oscar64";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-udbVRdGIGv3jgeh1cKp7MhSDxNs56FlqEbpzgfWcieE=";
+    hash = "sha256-SxjR+HAUJrjBPCn5doEx+6lzUikG55/KgiV/e3Vg/tQ=";
   };
 
   postPatch = ''

pkgs/by-name/pi/picgo/launcher.cjs

@@ -0,0 +1,12 @@
+const { app } = require("electron");
+const path = require("path");
+
+// Set application name (determines config directory as ~/.config/picgo)
+app.setName("picgo");
+
+if (process.platform === "linux") {
+  app.setDesktopName("picgo.desktop");
+}
+
+// Load main process
+require(path.join(__dirname, "dist_electron/main/index.js"));

pkgs/by-name/pi/picgo/package.nix

@@ -0,0 +1,120 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  nodejs_22,
+  pnpm,
+  fetchPnpmDeps,
+  pnpmConfigHook,
+  electron_38,
+  makeWrapper,
+  copyDesktopItems,
+  makeDesktopItem,
+  writableTmpDirAsHomeHook,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "picgo";
+  version = "2.5.0";
+
+  src = fetchFromGitHub {
+    owner = "Molunerfinn";
+    repo = "PicGo";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-M3cA17DoPXfldvq1vjF3P9HEXGkd+TXFuTr95iqIWsQ=";
+  };
+
+  pnpmDeps = fetchPnpmDeps {
+    inherit (finalAttrs) version src;
+    pname = "picgo";
+    hash = "sha256-BfKTZy9NBfBj0MwREoxYmyvhfXP4FlADam2SwNTOJ2U=";
+    fetcherVersion = 3; # lockfileVersion 9.0 corresponds to fetcherVersion 3
+  };
+
+  nativeBuildInputs = [
+    nodejs_22
+    pnpm
+    pnpmConfigHook
+    makeWrapper
+    copyDesktopItems
+    writableTmpDirAsHomeHook
+  ];
+
+  env = {
+    NODE_ENV = "development";
+  };
+
+  buildPhase = ''
+    runHook preBuild
+
+    pnpm run build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    # Create application directory
+    mkdir -p $out/lib/picgo
+
+    # Copy build outputs
+    cp -r dist_electron $out/lib/picgo/
+    cp -r public $out/lib/picgo/
+    cp package.json $out/lib/picgo/
+    cp -r node_modules $out/lib/picgo/
+
+    # Create launcher script to set application name
+    cp ${./launcher.cjs} $out/lib/picgo/.launcher.cjs
+
+    # Create startup script
+    mkdir -p $out/bin
+    makeWrapper ${lib.getExe electron_38} $out/bin/picgo \
+      --add-flags "$out/lib/picgo/.launcher.cjs" \
+      --add-flags "--name picgo" \
+      --set NODE_ENV production \
+      --set-default ELECTRON_OZONE_PLATFORM_HINT auto \
+      --chdir "$out/lib/picgo"
+
+    # Install icons
+    for size in 256x256 512x512; do
+      if [ -f "build/icons/$size.png" ]; then
+        mkdir -p $out/share/icons/hicolor/$size/apps
+        cp "build/icons/$size.png" $out/share/icons/hicolor/$size/apps/picgo.png
+      fi
+    done
+
+    runHook postInstall
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "picgo";
+      desktopName = "PicGo";
+      genericName = "Picture Uploader";
+      comment = "A simple & beautiful tool for pictures uploading";
+      exec = "picgo %U";
+      icon = "picgo";
+      categories = [
+        "Utility"
+        "Graphics"
+      ];
+      mimeTypes = [ "x-scheme-handler/picgo" ];
+      startupWMClass = "picgo";
+    })
+  ];
+
+  meta = {
+    description = "Simple tool for uploading pictures";
+    longDescription = ''
+      PicGo is a simple & beautiful tool for uploading pictures built by `electron-vue`.
+      It supports uploading images to various cloud storage services and clipboard management.
+      The application features a plugin system for extending functionality.
+    '';
+    homepage = "https://picgo.app";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
+    mainProgram = "picgo";
+    maintainers = with lib.maintainers; [ qrzbing ];
+  };
+})

pkgs/by-name/pr/procmail/package.nix

@@ -1,10 +1,15 @@
 {
   lib,
   stdenv,
+  gcc14Stdenv,
   fetchurl,
   fetchpatch,
   buildPackages,
-}:
+}@args:
+
+let
+  stdenv = if args.stdenv.cc.isGNU then gcc14Stdenv else args.stdenv;
+in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "procmail";

pkgs/by-name/pr/protols/package.nix

@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "protols";
-  version = "0.13.2";
+  version = "0.13.3";
 
   src = fetchFromGitHub {
     owner = "coder3101";
     repo = "protols";
     tag = finalAttrs.version;
-    hash = "sha256-kPYCvkPVxWDNgYpieDMIwvM7Q/HWKu0hNbKW1K5jo+Y=";
+    hash = "sha256-GgCJPL18xcMSipaM4YwyuaR1sEadu1Zwyt5qWJXdS3c=";
   };
 
-  cargoHash = "sha256-TIzPXQm9SPi1H+KpZuoLag1C90skMiKQvTwXVt6jy+0=";
+  cargoHash = "sha256-1HZlNW4wLMXpFp+Z3HAEC0w3Ro+Rh/EdPxoBuFeyDjE=";
 
   env.FALLBACK_INCLUDE_PATH = "${protobuf}/include";
 

pkgs/by-name/py/pyradio/package.nix

@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "pyradio";
-  version = "0.9.3.11.25";
+  version = "0.9.3.11.27";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "coderholic";
     repo = "pyradio";
     tag = finalAttrs.version;
-    hash = "sha256-+0anoFhbADIMAMBQUqDfI7liui+7sDgUtG9+ZwFg+nI=";
+    hash = "sha256-0NcVjXkGhWYqgllEsbV+I8RzDgPn8CTPkRWRPUsmw0M=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ru/ruqola/package.nix

@@ -11,14 +11,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ruqola";
-  version = "2.5.3";
+  version = "2.6.1";
 
   src = fetchFromGitLab {
     domain = "invent.kde.org";
     owner = "network";
     repo = "ruqola";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-OX4eATqcV7k+TIHQINujT5opItDwffIxC577M9q5ef8=";
+    hash = "sha256-z/JyIXZKXdOc92Ebq1Jcnhx/6EL7rkcdnxN2BsQn5Cw=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/sl/slushload/package.nix

@@ -3,7 +3,7 @@
   stdenvNoCC,
   fetchzip,
   makeWrapper,
-  wineWowPackages,
+  wineWow64Packages,
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "slushload";
@@ -25,7 +25,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     runHook preInstall
 
     mkdir -p $out/{bin,share}
-    makeWrapper ${wineWowPackages.base}/bin/wine $out/bin/slushload \
+    makeWrapper ${wineWow64Packages.stable}/bin/wine $out/bin/slushload \
       --set WINEDEBUG "-all" \
       --run "export WINEPREFIX=''${XDG_DATA_HOME:-\$HOME/.local/share}/slushload" \
       --add-flags $src/slushload_v3.exe
@@ -42,6 +42,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfree;
     mainProgram = "slushload";
+    platforms = wineWow64Packages.stable.meta.platforms;
     maintainers = with lib.maintainers; [ matthewcroughan ];
   };
 })

pkgs/by-name/so/socks-to-http-proxy/package.nix

@@ -0,0 +1,50 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  openssl,
+  pkg-config,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+let
+  version = "0.5.0";
+in
+rustPlatform.buildRustPackage {
+  pname = "socks-to-http-proxy";
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "KaranGauswami";
+    repo = "socks-to-http-proxy";
+    tag = "v${version}";
+    hash = "sha256-adtrGMkYueplW6rJ+pK+6+LaMU++YeV48m2Ntliqsy4=";
+  };
+
+  cargoHash = "sha256-jR0uX/edFby9OYCF0HVkRDT3fiz4bI3yGr8Yc3IlnRM=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+  ];
+
+  doCheck = false; # Skip network tests
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+  versionCheckProgramArg = "--version";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Converts SOCKS5 proxy into HTTP proxy";
+    homepage = "https://github.com/KaranGauswami/socks-to-http-proxy";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ mksafavi ];
+    mainProgram = "sthp";
+  };
+}

pkgs/by-name/so/solaar/package.nix

@@ -18,14 +18,14 @@
 # instead of adding this to `services.udev.packages` on NixOS,
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "solaar";
-  version = "1.1.16";
+  version = "1.1.19";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "pwr-Solaar";
     repo = "Solaar";
     tag = finalAttrs.version;
-    hash = "sha256-PhZoDRsckJXk2t2qR8O3ZGGeMUhmliqSpibfQDO7BeA=";
+    hash = "sha256-Z3rWGmFQmfJvsWiPgxQmfXMPHXAAiFneBaoSVIXnAV8=";
   };
 
   outputs = [
@@ -67,7 +67,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   preConfigure = ''
     substituteInPlace lib/solaar/listener.py \
-      --replace-fail /usr/bin/getfacl "${lib.getExe' acl "getfacl"}"
+      --replace-fail getfacl "${lib.getExe' acl "getfacl"}"
   '';
 
   # the -cli symlink is just to maintain compabilility with older versions where

pkgs/by-name/sp/splayer/package.nix

@@ -10,21 +10,23 @@
   rustPlatform,
   cargo,
   rustc,
+  python3,
   makeWrapper,
   copyDesktopItems,
   makeDesktopItem,
   nix-update-script,
+  removeReferencesTo,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "splayer";
-  version = "3.0.0-beta.8.2025";
+  version = "3.0.0-beta.9";
 
   src = fetchFromGitHub {
     owner = "imsyy";
     repo = "SPlayer";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = false;
-    hash = "sha256-LS9Z+dfL50ICaF8WskiKswl3LD7aSrpJHu6DY9m6ByE=";
+    hash = "sha256-+9F4ckATxRE+/PhMi5c1GVDq5V9QMOogCD9uT6QkREM=";
   };
 
   pnpmDeps = fetchPnpmDeps {
@@ -35,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
       ;
     pnpm = pnpm_10;
     fetcherVersion = 2;
-    hash = "sha256-t1pZJ7j+VyvXSTctNVg2XkoQ4CA6DlkxOlK9akDghUU=";
+    hash = "sha256-tAOtrxQasIQ1IS2jKdcX4KEM5p3zhshqw8phzsj667Q=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
@@ -44,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
       version
       src
       ;
-    hash = "sha256-LJuY9BFI+/GSckilZCXs3cw1EEG5Oy/iSljIABqsD/E=";
+    hash = "sha256-QKk1coOuZNaqKgvbBgorvOotHmTJ+YXTHBfyhF0L37E=";
   };
 
   nativeBuildInputs = [
@@ -54,6 +56,7 @@ stdenv.mkDerivation (finalAttrs: {
     rustPlatform.cargoSetupHook
     cargo
     rustc
+    python3
     makeWrapper
     copyDesktopItems
   ];
@@ -73,6 +76,21 @@ stdenv.mkDerivation (finalAttrs: {
   buildPhase = ''
     runHook preBuild
 
+    # After the pnpm configure, we need to build the binaries of all instances
+    # of better-sqlite3. It has a native part that it wants to build using a
+    # script which is disallowed.
+    # What's more, we need to use headers from electron to avoid ABI mismatches.
+    # Adapted from mkYarnModules.
+    for f in $(find . -path '*/node_modules/better-sqlite3' -type d); do
+      (cd "$f" && (
+      npm run build-release --offline --nodedir="${electron.headers}"
+      find build -type f -exec \
+        ${lib.getExe removeReferencesTo} \
+        -t "${electron.headers}" {} \;
+      ))
+    done
+    rm -rf build/Release/{.deps,obj,obj.target,test_extension.node}
+
     pnpm build
 
     npm exec electron-builder -- \
@@ -130,9 +148,18 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Simple Netease Cloud Music player";
     homepage = "https://github.com/imsyy/SPlayer";
+    changelog = "https://github.com/imsyy/SPlayer/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.agpl3Only;
     maintainers = with lib.maintainers; [ ccicnce113424 ];
     mainProgram = "splayer";
     platforms = lib.platforms.linux;
+    sourceProvenance = with lib.sourceTypes; [
+      fromSource
+      # public/wasm/ffmpeg.wasm
+      # source: https://github.com/apoint123/ffmpeg-audio-player
+      # native/ferrous-opencc-wasm/pkg/ferrous_opencc_wasm_bg.wasm
+      # source: native/ferrous-opencc-wasm
+      binaryBytecode
+    ];
   };
 })

pkgs/by-name/st/steam-art-manager/package.nix

@@ -0,0 +1,35 @@
+{
+  lib,
+  fetchurl,
+  appimageTools,
+}:
+
+let
+  pname = "steam-art-manager";
+  version = "3.12.1";
+  src = fetchurl {
+    url = "https://github.com/Tormak9970/Steam-Art-Manager/releases/download/v${version}/steam-art-manager.AppImage";
+    hash = "sha256-eH2Adl0+i+8I7+hPUyCGHzrm7xW34D7MdVex5Yi7pfI=";
+  };
+  appimageContents = appimageTools.extract { inherit pname version src; };
+in
+appimageTools.wrapType2 {
+  inherit pname version src;
+
+  extraInstallCommands = ''
+    install -m 444 -D "${appimageContents}/usr/share/applications/Steam Art Manager.desktop" $out/share/applications/steam-art-manager.desktop
+    install -m 444 -D "${appimageContents}/Steam Art Manager.png" $out/share/icons/hicolor/512x512/apps/steam-art-manager.png
+    substituteInPlace $out/share/applications/steam-art-manager.desktop \
+      --replace 'Exec=AppRun' 'Exec=${pname}' \
+      --replace 'Icon=Steam Art Manager' 'Icon=steam-art-manager'
+  '';
+
+  meta = with lib; {
+    description = "A tool to manage and change Steam library artwork";
+    homepage = "https://github.com/Tormak9970/Steam-Art-Manager";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ adam-tj ];
+    platforms = [ "x86_64-linux" ];
+    mainProgram = "steam-art-manager";
+  };
+}

pkgs/by-name/sy/synthesia/package.nix

@@ -5,7 +5,7 @@
   runtimeShell,
   copyDesktopItems,
   makeDesktopItem,
-  wineWowPackages,
+  wineWow64Packages,
 }:
 
 let
@@ -36,7 +36,7 @@ stdenvNoCC.mkDerivation rec {
 
   nativeBuildInputs = [
     copyDesktopItems
-    wineWowPackages.stable
+    wineWow64Packages.stable
   ];
 
   src = fetchurl {
@@ -53,7 +53,7 @@ stdenvNoCC.mkDerivation rec {
     mkdir -p $out/bin
     cat <<'EOF' > $out/bin/synthesia
     #!${runtimeShell}
-    export PATH=${wineWowPackages.stable}/bin:$PATH
+    export PATH=${wineWow64Packages.stable}/bin:$PATH
     export WINEARCH=win64
     export WINEPREFIX="''${SYNTHESIA_HOME:-"''${XDG_DATA_HOME:-"''${HOME}/.local/share"}/synthesia"}/wine"
     export WINEDLLOVERRIDES="mscoree=" # disable mono
@@ -75,6 +75,6 @@ stdenvNoCC.mkDerivation rec {
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfree;
     maintainers = with lib.maintainers; [ ners ];
-    platforms = wineWowPackages.stable.meta.platforms;
+    platforms = wineWow64Packages.stable.meta.platforms;
   };
 }

pkgs/by-name/ve/vega-lite/package.nix

@@ -11,16 +11,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "vega-lite";
-  version = "6.4.1";
+  version = "6.4.2";
 
   src = fetchFromGitHub {
     owner = "vega";
     repo = "vega-lite";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-X6O7ZehY3tS7dFBaKnBuDokCfG+zWmSDHl1d+ifyc/o=";
+    hash = "sha256-UQEgZk9SZTSKiAfOvBxnpkyiih9QcSv08O8vt4ooeYQ=";
   };
 
-  npmDepsHash = "sha256-YjZdh5R7hawgf8EAGlKEAkqchcFuN1j2yMJo9Ptnjyk=";
+  npmDepsHash = "sha256-EOJGMmIObN4XCC4ZbZQQ89X12+STKejt6vugyIb7v0A=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/vi/vikunja-desktop/package.nix

@@ -7,7 +7,7 @@
   pnpmConfigHook,
   nodejs,
   electron,
-  unstableGitUpdater,
+  nix-update-script,
   fetchFromGitHub,
   fetchPnpmDeps,
   vikunja,
@@ -15,12 +15,12 @@
 
 let
   executableName = "vikunja-desktop";
-  version = "1.0.0";
+  version = "1.1.0";
   src = fetchFromGitHub {
     owner = "go-vikunja";
     repo = "vikunja";
     rev = "v${version}";
-    hash = "sha256-IJ6985gLuI0O08xZq8NYoet02NPFqQQhDLND+nfmdbA=";
+    hash = "sha256-xxfn3UoKreRDRC5GR7pLL8gkBLe6VmBYdps9eFc5c3g=";
   };
 in
 stdenv.mkDerivation (finalAttrs: {
@@ -40,7 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
       pnpmInstallFlags
       ;
     fetcherVersion = 1;
-    hash = "sha256-BvQfRsV5hiOTkxK+W3qHvVQwMAGdLB3X+PwYBa6Bwl4=";
+    hash = "sha256-mzrck/JdfN3Qu+xhf/iM4HFamVmQkVSwUwU2KBK5XsA=";
   };
 
   env = {
@@ -94,9 +94,7 @@ stdenv.mkDerivation (finalAttrs: {
     true
   '';
 
-  passthru.updateScript = unstableGitUpdater {
-    url = "${src.meta.homepage}.git";
-  };
+  passthru.updateScript = nix-update-script { };
 
   # The desktop item properties should be kept in sync with data from upstream:
   desktopItem = makeDesktopItem {

pkgs/by-name/vi/vikunja/package.nix

@@ -14,12 +14,12 @@
 }:
 
 let
-  version = "1.0.0";
+  version = "1.1.0";
   src = fetchFromGitHub {
     owner = "go-vikunja";
     repo = "vikunja";
     rev = "v${version}";
-    hash = "sha256-IJ6985gLuI0O08xZq8NYoet02NPFqQQhDLND+nfmdbA=";
+    hash = "sha256-xxfn3UoKreRDRC5GR7pLL8gkBLe6VmBYdps9eFc5c3g=";
   };
 
   frontend = stdenv.mkDerivation (finalAttrs: {
@@ -37,7 +37,7 @@ let
         ;
       pnpm = pnpm_10;
       fetcherVersion = 1;
-      hash = "sha256-OmLFn5aKsXPSbW6AehjkuTJMgOMzDSaYo2XbPvU6WXo=";
+      hash = "sha256-NrysokKNmKAUdiC0o4qEPvsHr7KH7mMrcrEjxwmgb+g=";
     };
 
     nativeBuildInputs = [
@@ -138,6 +138,7 @@ buildGoModule {
   passthru = {
     tests.vikunja = nixosTests.vikunja;
     frontend = frontend;
+    updateScript = ./update.sh;
   };
 
   meta = {

pkgs/by-name/vi/vikunja/update.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nix wget jq nurl
+
+# shellcheck shell=bash
+
+set -euo pipefail
+
+if [[ $# -gt 1 || "${1:-}" == -* ]]; then
+    echo "Regenerates packaging data for the vikunja package."
+    echo "Usage: $0 [version]"
+    exit 1
+fi
+
+version="${1:-}"
+
+NIXPKGS_ROOT="$(git rev-parse --show-toplevel)"
+
+if [ -z "$version" ]; then
+    TOKEN_ARGS=()
+    if [ -n "${GITHUB_TOKEN:-}" ]; then
+        TOKEN_ARGS=(--header "Authorization: token $GITHUB_TOKEN")
+    fi
+    version="$(wget -q -O- ${TOKEN_ARGS[@]+"${TOKEN_ARGS[@]}"} "https://api.github.com/repos/go-vikunja/vikunja/releases?per_page=10" | jq -r '[.[] | select(.prerelease == false)][0].tag_name')"
+fi
+
+# strip leading "v"
+version="${version#v}"
+
+cd "$(dirname "$0")"
+
+# Update version, blank out all hashes so nurl can recompute them
+sed -i -E 's#version = ".*"#version = "'"$version"'"#' package.nix
+sed -i -E '/fetchFromGitHub \{/,/\};/ s#hash = ".*"#hash = ""#' package.nix
+sed -i -E '/fetchPnpmDeps \{/,/\};/ s#hash = ".*"#hash = ""#' package.nix
+sed -i -E 's#vendorHash = ".*"#vendorHash = ""#' package.nix
+
+# Source hash (must be computed first, pnpm and vendor depend on it)
+src_hash=$(nurl -e "(import $NIXPKGS_ROOT/. { }).vikunja.src")
+sed -i -E '/fetchFromGitHub \{/,/\};/ s#hash = ".*"#hash = "'"$src_hash"'"#' package.nix
+
+# pnpm dependencies hash for frontend
+pnpm_hash=$(nurl -e "(import $NIXPKGS_ROOT/. { }).vikunja.frontend.pnpmDeps")
+sed -i -E '/fetchPnpmDeps \{/,/\};/ s#hash = ".*"#hash = "'"$pnpm_hash"'"#' package.nix
+
+# Go modules vendor hash
+vendor_hash=$(nurl -e "(import $NIXPKGS_ROOT/. { }).vikunja.goModules")
+sed -i -E 's#vendorHash = ".*"#vendorHash = "'"$vendor_hash"'"#' package.nix
+
+echo "Update complete!"
+echo "Version: $version"
+echo "Source hash: $src_hash"
+echo "Frontend pnpm hash: $pnpm_hash"
+echo "Go vendor hash: $vendor_hash"

pkgs/by-name/vt/vtfedit/package.nix

@@ -7,11 +7,11 @@
 
   copyDesktopItems,
   makeWrapper,
-  wineWowPackages,
+  wineWow64Packages,
   winetricks,
 }:
 let
-  wine = wineWowPackages.staging;
+  wine = wineWow64Packages.staging;
 in
 stdenv.mkDerivation rec {
   pname = "vtfedit";
@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
     chmod +x $out/bin/vtfedit
 
     cp ${icon} $out/share/icons/hicolor/256x256/apps/vtfedit.png
-    cp -r ${if wine.meta.mainProgram == "wine64" then "x64" else "x86"}/* $out/share/lib
+    cp -r ${if builtins.elem "i686-linux" wine.meta.platforms then "x86" else "x64"}/* $out/share/lib
     cp ${./mimetype.xml} $out/share/mime/packages/vtfedit.xml
 
     runHook postInstall

pkgs/by-name/wa/watcher/package.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "watcher";
-  version = "0.14.3";
+  version = "0.14.4";
 
   src = fetchFromGitHub {
     owner = "e-dant";
     repo = "watcher";
     tag = finalAttrs.version;
-    hash = "sha256-LDzZk47GHSh+SSolz7FdOVNKsNhVNrrsuNGBtXanC+U=";
+    hash = "sha256-V3s7IpnDJMV0ojNcJhg+15VXQviZptu2hB5oE/2B5Hw=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/wi/winbox3/package.nix

@@ -5,11 +5,11 @@
   copyDesktopItems,
   makeDesktopItem,
   makeBinaryWrapper,
-  wineWowPackages,
+  wineWow64Packages,
 }:
 
 let
-  wine = wineWowPackages.stable;
+  wine = wineWow64Packages.stable;
   # The icon is also from the winbox AUR package (see above).
   icon = fetchurl {
     name = "winbox.png";
@@ -22,16 +22,16 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   version = "3.43";
 
   src = fetchurl (
-    if (wine.meta.mainProgram == "wine64") then
-      {
-        url = "https://download.mikrotik.com/routeros/winbox/${finalAttrs.version}/winbox64.exe";
-        hash = "sha256-W0HPUf2B6NCCaH9rUiFZz0q6IubfjtxIZyHU4JUHtuk=";
-      }
-    else
+    if (builtins.elem "i686-linux" wine.meta.platforms) then
       {
         url = "https://download.mikrotik.com/routeros/winbox/${finalAttrs.version}/winbox.exe";
         hash = "sha256-pAOOTgmjQoXI2o2MKTDuOOpb7q0rb/zWATDNyAMOLms=";
       }
+    else
+      {
+        url = "https://download.mikrotik.com/routeros/winbox/${finalAttrs.version}/winbox64.exe";
+        hash = "sha256-W0HPUf2B6NCCaH9rUiFZz0q6IubfjtxIZyHU4JUHtuk=";
+      }
   );
 
   dontUnpack = true;

pkgs/by-name/wi/wineasio/package.nix

@@ -4,7 +4,7 @@
   fetchFromGitHub,
   libjack2,
   pkg-config,
-  wineWowPackages,
+  wineWow64Packages,
   pkgsi686Linux,
   python3,
   python3Packages,
@@ -53,7 +53,7 @@ multiStdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     pkg-config
-    wineWowPackages.stable
+    wineWow64Packages.stable
   ];
 
   buildInputs = [
@@ -63,7 +63,7 @@ multiStdenv.mkDerivation rec {
 
   dontConfigure = true;
 
-  makeFlags = [ "PREFIX=${wineWowPackages.stable}" ];
+  makeFlags = [ "PREFIX=${wineWow64Packages.stable}" ];
 
   buildPhase = ''
     runHook preBuild

pkgs/by-name/ya/yabridge/package.nix

@@ -8,13 +8,13 @@
   meson,
   ninja,
   pkg-config,
-  wineWowPackages,
+  wineWow64Packages,
   libxcb,
   nix-update-script,
 }:
 
 let
-  wine = wineWowPackages.yabridge;
+  wine = wineWow64Packages.yabridge;
 
   # Derived from subprojects/asio.wrap
   asio = fetchFromGitHub {

pkgs/by-name/ya/yabridgectl/package.nix

@@ -3,7 +3,7 @@
   rustPlatform,
   yabridge,
   makeWrapper,
-  wineWowPackages,
+  wineWow64Packages,
 }:
 
 rustPlatform.buildRustPackage {
@@ -31,7 +31,7 @@ rustPlatform.buildRustPackage {
     wrapProgram "$out/bin/yabridgectl" \
       --prefix PATH : ${
         lib.makeBinPath [
-          wineWowPackages.yabridge # winedump
+          wineWow64Packages.yabridge # winedump
         ]
       }
   '';

pkgs/development/python-modules/jupyter-collaboration-ui/default.nix

@@ -7,15 +7,15 @@
   jupyter-collaboration,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "jupyter-collaboration-ui";
-  version = "2.2.0";
+  version = "2.2.1";
   pyproject = true;
 
   src = fetchPypi {
     pname = "jupyter_collaboration_ui";
-    inherit version;
-    hash = "sha256-ZQHBVZ/yMxWE+hg8OLIzTBiGdh5xy+CvjV9SXyXqM20=";
+    inherit (finalAttrs) version;
+    hash = "sha256-KpqOmQz10rp4+pkzRWhpHEaBXrcp4XM5JWzHplJioZY=";
   };
 
   postPatch = ''
@@ -41,4 +41,4 @@ buildPythonPackage rec {
     license = lib.licenses.bsd3;
     teams = [ lib.teams.jupyter ];
   };
-}
+})

pkgs/development/python-modules/redbaron/default.nix

@@ -16,6 +16,8 @@ buildPythonPackage rec {
     sha256 = "0bqkq0wn20cc3qrcd1ifq74p4m570j345bkq4axl08kbr8whfba7";
   };
 
+  patches = [ ./fix-pygments-test.patch ];
+
   propagatedBuildInputs = [ baron ];
 
   preCheck = ''

pkgs/development/python-modules/redbaron/fix-pygments-test.patch

@@ -0,0 +1,30 @@
+diff --git a/tests/test_no_pygments.py b/tests/test_no_pygments.py
+index 1064653c23..f536bcca4b 100644
+--- a/tests/test_no_pygments.py
++++ b/tests/test_no_pygments.py
+@@ -55,15 +55,15 @@
+         out = captured.out
+     assert out == """\
+ 0 -----------------------------------------------------
+-\x1b[38;5;148mAssignmentNode\x1b[39m\x1b[38;5;197m(\x1b[39m\x1b[38;5;197m)\x1b[39m
+-\x1b[38;5;15m  \x1b[39m\x1b[38;5;242m# identifiers: assign, assignment, assignment_, assignmentnode\x1b[39m
+-\x1b[38;5;15m  \x1b[39m\x1b[38;5;15moperator\x1b[39m\x1b[38;5;197m=\x1b[39m\x1b[38;5;186m''\x1b[39m
+-\x1b[38;5;15m  \x1b[39m\x1b[38;5;15mtarget\x1b[39m\x1b[38;5;15m \x1b[39m\x1b[38;5;197m->\x1b[39m
+-\x1b[38;5;15m    \x1b[39m\x1b[38;5;148mNameNode\x1b[39m\x1b[38;5;197m(\x1b[39m\x1b[38;5;197m)\x1b[39m
+-\x1b[38;5;15m      \x1b[39m\x1b[38;5;242m# identifiers: name, name_, namenode\x1b[39m
+-\x1b[38;5;15m      \x1b[39m\x1b[38;5;15mvalue\x1b[39m\x1b[38;5;197m=\x1b[39m\x1b[38;5;186m'a'\x1b[39m
+-\x1b[38;5;15m  \x1b[39m\x1b[38;5;15mannotation\x1b[39m\x1b[38;5;15m \x1b[39m\x1b[38;5;197m->\x1b[39m
++\x1b[38;5;148mAssignmentNode\x1b[39m\x1b[38;5;204m(\x1b[39m\x1b[38;5;204m)\x1b[39m
++\x1b[38;5;15m  \x1b[39m\x1b[38;5;245m# identifiers: assign, assignment, assignment_, assignmentnode\x1b[39m
++\x1b[38;5;15m  \x1b[39m\x1b[38;5;15moperator\x1b[39m\x1b[38;5;204m=\x1b[39m\x1b[38;5;186m''\x1b[39m
++\x1b[38;5;15m  \x1b[39m\x1b[38;5;15mtarget\x1b[39m\x1b[38;5;15m \x1b[39m\x1b[38;5;204m->\x1b[39m
++\x1b[38;5;15m    \x1b[39m\x1b[38;5;148mNameNode\x1b[39m\x1b[38;5;204m(\x1b[39m\x1b[38;5;204m)\x1b[39m
++\x1b[38;5;15m      \x1b[39m\x1b[38;5;245m# identifiers: name, name_, namenode\x1b[39m
++\x1b[38;5;15m      \x1b[39m\x1b[38;5;15mvalue\x1b[39m\x1b[38;5;204m=\x1b[39m\x1b[38;5;186m'a'\x1b[39m
++\x1b[38;5;15m  \x1b[39m\x1b[38;5;15mannotation\x1b[39m\x1b[38;5;15m \x1b[39m\x1b[38;5;204m->\x1b[39m
+ \x1b[38;5;15m    \x1b[39m\x1b[38;5;186mNone\x1b[39m
+-\x1b[38;5;15m  \x1b[39m\x1b[38;5;15mvalue\x1b[39m\x1b[38;5;15m \x1b[39m\x1b[38;5;197m->\x1b[39m
+-\x1b[38;5;15m    \x1b[39m\x1b[38;5;15m[\x1b[39m\x1b[38;5;15m]\x1b[39m
++\x1b[38;5;15m  \x1b[39m\x1b[38;5;15mvalue\x1b[39m\x1b[38;5;15m \x1b[39m\x1b[38;5;204m->\x1b[39m
++\x1b[38;5;15m    \x1b[39m\x1b[38;5;15m\x1b[38;5;15m[\x1b[39m\x1b[39m\x1b[38;5;15m\x1b[38;5;15m]\x1b[39m\x1b[39m
+ """

pkgs/development/python-modules/symbolic/default.nix

@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "symbolic";
-  version = "12.17.1";
+  version = "12.17.2";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -23,12 +23,12 @@ buildPythonPackage rec {
     tag = version;
     # the `py` directory is not included in the tarball, so we fetch the source via git instead
     forceFetchGit = true;
-    hash = "sha256-rO+bLg2TgSxWJ+ub3TLejKdWTlp9e5/++TEna73Y0Lk=";
+    hash = "sha256-Rcijs9yq+WzzADxq0SKcL99jvquZTVb2dPs+qUB7zJc=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-Us3xROXFKmlYOavXVyvxraMuY6p75AKjh9AOX49ui4Q=";
+    hash = "sha256-yTSBWs7wN+XGh687LSryJ1d55ZTV5GbojwPyQ+JXKNI=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/ultralytics/default.nix

@@ -34,14 +34,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "ultralytics";
-  version = "8.4.9";
+  version = "8.4.13";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ultralytics";
     repo = "ultralytics";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yZI0lvmXC2yFH8qiDPgCMN+7gxd4BwidwDrLoDDr1Mc=";
+    hash = "sha256-D3b0KFqdbd6DaGkblek5MEI2J3OmoNQ2xlMMoW13C6k=";
   };
 
   build-system = [ setuptools ];
@@ -134,6 +134,14 @@ buildPythonPackage (finalAttrs: {
     description = "Train YOLO models for computer vision tasks";
     mainProgram = "yolo";
     license = lib.licenses.agpl3Only;
-    maintainers = with lib.maintainers; [ osbm ];
+    maintainers = with lib.maintainers; [
+      osbm
+      mana-byte
+    ];
+    badPlatforms = [
+      # Tests crash with:
+      # Fatal Python error: Segmentation fault for x86_64 Darwin in tests/python.py
+      "x86_64-darwin"
+    ];
   };
 })

pkgs/development/ruby-modules/bundler-app/default.nix

@@ -57,7 +57,7 @@ let
     ]
     // {
       inherit preferLocalBuild allowSubstitutes; # pass the defaults
-      inherit (basicEnv) version;
+      inherit (basicEnv) version pname;
 
       nativeBuildInputs = nativeBuildInputs ++ lib.optionals (scripts != [ ]) [ makeWrapper ];
 

pkgs/development/ruby-modules/bundler-env/default.nix

@@ -69,7 +69,7 @@ else
     bundlerEnvArgs = {
       inherit ignoreCollisions;
 
-      name = basicEnv.name;
+      inherit (basicEnv) pname version;
 
       paths = envPaths;
       pathsToLink = [ "/lib" ];

pkgs/development/tools/ocaml/ocp-index/default.nix

@@ -1,6 +1,6 @@
 {
   lib,
-  fetchFromGitHub,
+  fetchurl,
   buildDunePackage,
   cppo,
   ocp-indent,
@@ -8,17 +8,13 @@
   re,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "ocp-index";
-  version = "1.4.0";
+  version = "1.4.1";
 
-  minimalOCamlVersion = "4.08";
-
-  src = fetchFromGitHub {
-    owner = "OCamlPro";
-    repo = "ocp-index";
-    rev = version;
-    hash = "sha256-pv6aBJjRkibISpZEnlfyn72smcYEbZoPQoQH2p/JwH0=";
+  src = fetchurl {
+    url = "https://github.com/OCamlPro/ocp-index/releases/download/${finalAttrs.version}/ocp-index-${finalAttrs.version}.tbz";
+    hash = "sha256:59adbd99a9c88106dcf23bc0e3424a00f840fcedee4e4b644eaf0385ada3f911";
   };
 
   nativeBuildInputs = [ cppo ];
@@ -32,8 +28,8 @@ buildDunePackage rec {
   meta = {
     homepage = "https://www.typerex.org/ocp-index.html";
     description = "Simple and light-weight documentation extractor for OCaml";
-    changelog = "https://github.com/OCamlPro/ocp-index/raw/${version}/CHANGES.md";
+    changelog = "https://github.com/OCamlPro/ocp-index/raw/${finalAttrs.version}/CHANGES.md";
     license = lib.licenses.lgpl3;
     maintainers = with lib.maintainers; [ vbgl ];
   };
-}
+})

pkgs/servers/http/nginx/mainline.nix

@@ -1,6 +1,6 @@
 { callPackage, ... }@args:
 
 callPackage ./generic.nix args {
-  version = "1.29.4";
-  hash = "sha256-Wn037uUFhm+6tYEPqfeCR9bV2RV6WVxOenIEMUHdqyU=";
+  version = "1.29.5";
+  hash = "sha256-Z0R2ikEUiA83sToEQyROcxvLMTDAoGXX432P1Ymt43Q=";
 }

pkgs/servers/http/nginx/stable.nix

@@ -1,13 +1,6 @@
-{ callPackage, fetchpatch, ... }@args:
+{ callPackage, ... }@args:
 
 callPackage ./generic.nix args {
-  version = "1.28.0";
-  hash = "sha256-xrXGsIbA3508o/9eCEwdDvkJ5gOCecccHD6YX1dv92o=";
-  extraPatches = [
-    (fetchpatch {
-      name = "CVE-2025-53859.patch";
-      url = "https://nginx.org/download/patch.2025.smtp.txt";
-      hash = "sha256-v49sLskFNMoKuG8HQISw8ST7ga6DS+ngJiL0D3sUyGk=";
-    })
-  ];
+  version = "1.28.2";
+  hash = "sha256-IOXg8skXrPtREg7sL7qaS6Th4Q/ShGUGfMh6fYGoKaM=";
 }

pkgs/servers/monitoring/grafana/plugins/mesak-imagesave-panel/default.nix

@@ -0,0 +1,13 @@
+{ grafanaPlugin, lib }:
+
+grafanaPlugin {
+  pname = "mesak-imagesave-panel";
+  version = "1.0.4";
+  zipHash = "sha256-WwGCcMhPhE8q2E/0uXYNMpd0HitPvVOCbazhpX/1q2U=";
+  meta = {
+    description = "Plugin for Grafana that allows you to save image to grafana and display it in dashboard";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ drupol ];
+    platforms = lib.platforms.unix;
+  };
+}

pkgs/servers/monitoring/grafana/plugins/plugins.nix

@@ -29,6 +29,7 @@
   marcusolsson-csv-datasource = callPackage ./marcusolsson-csv-datasource { };
   marcusolsson-dynamictext-panel = callPackage ./marcusolsson-dynamictext-panel { };
   marcusolsson-json-datasource = callPackage ./marcusolsson-json-datasource { };
+  mesak-imagesave-panel = callPackage ./mesak-imagesave-panel { };
   redis-app = callPackage ./redis-app { };
   redis-datasource = callPackage ./redis-datasource { };
   redis-explorer-app = callPackage ./redis-explorer-app { };

pkgs/servers/monitoring/grafana/plugins/victoriametrics-metrics-datasource/default.nix

@@ -2,8 +2,8 @@
 
 grafanaPlugin {
   pname = "victoriametrics-metrics-datasource";
-  version = "0.20.1";
-  zipHash = "sha256-OITIzKV4eGc4RniVFrgp4VBAM5m38Zms8xj9EgC5YZc=";
+  version = "0.21.0";
+  zipHash = "sha256-S+MKGEIZ3dq2sN8yxR/Cuos/AXV66aXololLY7BaJco=";
   meta = {
     description = "VictoriaMetrics metrics datasource for Grafana";
     license = lib.licenses.agpl3Only;

pkgs/top-level/aliases.nix

@@ -1947,6 +1947,11 @@ mapAliases {
   win-pvdrivers = throw "'win-pvdrivers' has been removed as it was subject to the Xen build machine compromise (XSN-01) and has open security vulnerabilities (XSA-468)"; # Added 2025-08-29
   win-virtio = throw "'win-virtio' has been renamed to/replaced by 'virtio-win'"; # Converted to throw 2025-10-27
   wineWayland = throw "'wineWayland' has been renamed to/replaced by 'wine-wayland'"; # Converted to throw 2025-10-27
+  wineWowPackages =
+    warnAlias
+      "'wineWowPackages' is deprecated as it is no longer preferred by upstream. Use wineWow64Packages instead"
+      lib.recurseIntoAttrs
+      (winePackagesFor "wineWow");
   wingpanel-indicator-ayatana = throw "'wingpanel-indicator-ayatana' has been removed as it is archived upstream and doesn't work with pantheon 8 and onwards. Use wingpanel-indicator-namarupa instead"; # Added 2026-01-14
   winhelpcgi = throw "'winhelpcgi' has been removed as it was unmaintained upstream and broken with GCC 14"; # Added 2025-06-14
   wireshark-qt = warnAlias "'wireshark-qt' has been renamed to/replaced by 'wireshark'" wireshark; # Added 2026-01-23

pkgs/top-level/all-packages.nix

@@ -12841,7 +12841,6 @@ with pkgs;
 
   winePackages = recurseIntoAttrs (winePackagesFor (config.wine.build or "wine32"));
   wine64Packages = recurseIntoAttrs (winePackagesFor "wine64");
-  wineWowPackages = recurseIntoAttrs (winePackagesFor "wineWow");
   wineWow64Packages = recurseIntoAttrs (winePackagesFor "wineWow64");
 
   wine = winePackages.full;