Merge master into staging-nixos

nixos/doc/manual/release-notes/rl-2511.section.md

@@ -475,6 +475,8 @@ and [release notes for v18](https://goteleport.com/docs/changelog/#1800-070325).
 
 - `services.restic.backups` now includes a `command` option for passing a command to the [--stdin-from-command](https://github.com/restic/restic/pull/4410) flag.
 
+- `services.grafana` does no longer send usage statistics by default.
+
 - `services.postsrsd` now automatically integrates with the local Postfix instance, when enabled. This behavior can disabled using the [services.postsrsd.configurePostfix](#opt-services.postsrsd.configurePostfix) option.
 
 - `services.pfix-srsd` now automatically integrates with the local Postfix instance, when enabled. This behavior can disabled using the [services.pfix-srsd.configurePostfix](#opt-services.pfix-srsd.configurePostfix) option.

nixos/modules/config/stevenblack.nix

@@ -16,6 +16,18 @@ let
     ;
 
   cfg = config.networking.stevenblack;
+
+  filterHostsFile =
+    hostsFile:
+    if cfg.whitelist == [ ] then
+      hostsFile
+    else
+      let
+        pattern = lib.escape [ "." "|" ] (lib.concatStringsSep "|" cfg.whitelist);
+      in
+      pkgs.runCommand "filtered-hosts" { } ''
+        sed '/${pattern}/d' ${hostsFile} > $out
+      '';
 in
 {
   options.networking.stevenblack = {
@@ -35,10 +47,20 @@ in
       default = [ ];
       description = "Additional blocklist extensions.";
     };
+
+    whitelist = mkOption {
+      # https://datatracker.ietf.org/doc/html/rfc1035
+      type = types.listOf (types.strMatching "^[a-zA-Z0-9_-]+([.][a-zA-Z0-9_-]+)+$");
+      default = [ ];
+      description = "Domains to exclude from blocking.";
+      example = [ "s.click.aliexpress.com" ];
+    };
   };
 
   config = mkIf cfg.enable {
-    networking.hostFiles = map (x: "${getOutput x cfg.package}/hosts") ([ "ads" ] ++ cfg.block);
+    networking.hostFiles = map (x: filterHostsFile "${getOutput x cfg.package}/hosts") (
+      [ "ads" ] ++ cfg.block
+    );
   };
 
   meta.maintainers = with maintainers; [

nixos/modules/services/hardware/nvidia-container-toolkit/default.nix

@@ -289,6 +289,7 @@
 
       systemd.services.nvidia-container-toolkit-cdi-generator = {
         description = "Container Device Interface (CDI) for Nvidia generator";
+        after = [ "systemd-udev-settle.service" ];
         requiredBy = lib.mkMerge [
           (lib.mkIf config.virtualisation.docker.enable [ "docker.service" ])
           (lib.mkIf config.virtualisation.podman.enable [ "podman.service" ])
@@ -297,44 +298,6 @@
         serviceConfig = {
           RuntimeDirectory = "cdi";
           RemainAfterExit = true;
-          ExecStartPre = pkgs.writeShellScript "wait-for-nvidia-devices" ''
-            set -eu
-
-            gpus_dir="/proc/driver/nvidia/gpus"
-            max_wait_seconds=60
-
-            if [ ! -d "$gpus_dir" ]; then
-              echo "wait-for-nvidia-devices: $gpus_dir does not exist; nothing to wait for."
-              exit 0
-            fi
-
-            gpu_count=$(find "$gpus_dir" -mindepth 1 -maxdepth 1 -type d 2>/dev/null | wc -l | tr -d ' ')
-
-            if [ "$gpu_count" -eq 0 ]; then
-              echo "wait-for-nvidia-devices: no GPU entries found in $gpus_dir; nothing to wait for."
-              exit 0
-            fi
-
-            echo "wait-for-nvidia-devices: expecting $gpu_count /dev/nvidiaN device node(s)."
-
-            elapsed=0
-            while true; do
-              dev_count=$(find /dev -mindepth 1 -maxdepth 1 -type c -regex '.*/nvidia[0-9]+' 2>/dev/null | wc -l | tr -d ' ')
-
-              if [ "$dev_count" -eq "$gpu_count" ]; then
-                echo "wait-for-nvidia-devices: found $dev_count matching device node(s)."
-                exit 0
-              fi
-
-              if [ "$elapsed" -ge "$max_wait_seconds" ]; then
-                echo "wait-for-nvidia-devices: timed out after $max_wait_seconds seconds; expected $gpu_count node(s) but found $dev_count." >&2
-                exit 1
-              fi
-
-              sleep 1
-              elapsed=$((elapsed + 1))
-            done
-          '';
           ExecStart =
             let
               script = pkgs.callPackage ./cdi-generate.nix {

nixos/modules/services/monitoring/grafana-image-renderer.nix

@@ -2,97 +2,178 @@
   lib,
   pkgs,
   config,
+  utils,
   ...
 }:
 let
   cfg = config.services.grafana-image-renderer;
 
-  format = pkgs.formats.json { };
+  format = {
+    type =
+      with lib.types;
+      attrsOf (
+        attrsOf (oneOf [
+          str
+          int
+          bool
+          (listOf (oneOf [
+            str
+            int
+          ]))
+        ])
+      );
 
-  configFile = format.generate "grafana-image-renderer-config.json" cfg.settings;
+    generate = lib.flip lib.pipe [
+      # Remove legacy option prefixes that only exist for backwards-compat
+      (lib.flip builtins.removeAttrs [
+        "service"
+        "rendering"
+        "assertions"
+        "warnings"
+      ])
+
+      # Normalize CLI args from a nested attr-set to `section.option = value`
+      (lib.concatMapAttrs (block: lib.mapAttrs' (option: lib.nameValuePair "${block}.${option}")))
+
+      # Turn attr-set into a list of arguments, denormalize list options.
+      (lib.mapAttrsToList (
+        option: value:
+        if lib.isBool value then
+          lib.optional value "--${option}"
+        else if lib.isList value then
+          map (v: [
+            "--${option}"
+            v
+          ]) value
+        else
+          [
+            "--${option}"
+            (toString value)
+          ]
+      ))
+      lib.flatten
+
+      # Turn into a string
+      utils.escapeSystemdExecArgs
+    ];
+  };
 in
 {
+  imports = [
+    (lib.mkChangedOptionModule
+      [
+        "services"
+        "grafana-image-renderer"
+        "chromium"
+      ]
+      [
+        "services"
+        "grafana-image-renderer"
+        "settings"
+        "browser"
+        "path"
+      ]
+      (config: lib.getExe config.services.grafana-image-renderer.chromium)
+    )
+    (lib.mkRemovedOptionModule
+      [
+        "services"
+        "grafana-image-renderer"
+        "verbose"
+      ]
+      ''
+        Use `services.grafana-image-renderer.settings.log.level = "debug"` instead.
+      ''
+    )
+  ];
+
   options.services.grafana-image-renderer = {
     enable = lib.mkEnableOption "grafana-image-renderer";
 
-    chromium = lib.mkOption {
-      type = lib.types.package;
-      description = ''
-        The chromium to use for image rendering.
-      '';
-    };
-
-    verbose = lib.mkEnableOption "verbosity for the service";
-
     provisionGrafana = lib.mkEnableOption "Grafana configuration for grafana-image-renderer";
 
     settings = lib.mkOption {
       type = lib.types.submodule {
         freeformType = format.type;
+        imports = [
+          ../../misc/assertions.nix
+          (lib.mkRenamedOptionModule
+            [
+              "rendering"
+              "width"
+            ]
+            [
+              "browser"
+              "min-width"
+            ]
+          )
+          (lib.mkRenamedOptionModule
+            [
+              "rendering"
+              "height"
+            ]
+            [
+              "browser"
+              "min-height"
+            ]
+          )
+          (lib.mkRenamedOptionModule
+            [
+              "rendering"
+              "args"
+            ]
+            [
+
+              "browser"
+              "flag"
+            ]
+          )
+          (lib.mkChangedOptionModule
+            [
+              "service"
+              "port"
+            ]
+            [
+              "server"
+              "addr"
+            ]
+            (config: "0.0.0.0:${toString config.service.port}")
+          )
+          (lib.mkRemovedOptionModule
+            [
+              "rendering"
+              "mode"
+            ]
+            ''
+              This option is obsolete.
+            ''
+          )
+          (lib.mkRenamedOptionModule
+            [
+              "service"
+              "logging"
+            ]
+            [
+              "log"
+            ]
+          )
+        ];
 
         options = {
-          service = {
-            port = lib.mkOption {
-              type = lib.types.port;
-              default = 8081;
-              description = ''
-                The TCP port to use for the rendering server.
-              '';
-            };
-            logging.level = lib.mkOption {
-              type = lib.types.enum [
-                "error"
-                "warning"
-                "info"
-                "debug"
-              ];
-              default = "info";
-              description = ''
-                The log-level of the {file}`grafana-image-renderer.service`-unit.
-              '';
-            };
+          server.addr = lib.mkOption {
+            type = lib.types.str;
+            default = "localhost:8081";
+            description = ''
+              Listen address of the service.
+            '';
           };
-          rendering = {
-            width = lib.mkOption {
-              default = 1000;
-              type = lib.types.ints.positive;
-              description = ''
-                Width of the PNG used to display the alerting graph.
-              '';
-            };
-            height = lib.mkOption {
-              default = 500;
-              type = lib.types.ints.positive;
-              description = ''
-                Height of the PNG used to display the alerting graph.
-              '';
-            };
-            mode = lib.mkOption {
-              default = "default";
-              type = lib.types.enum [
-                "default"
-                "reusable"
-                "clustered"
-              ];
-              description = ''
-                Rendering mode of `grafana-image-renderer`:
-
-                - `default:` Creates on browser-instance
-                  per rendering request.
-                - `reusable:` One browser instance
-                  will be started and reused for each rendering request.
-                - `clustered:` allows to precisely
-                  configure how many browser-instances are supposed to be used. The values
-                  for that mode can be declared in `rendering.clustering`.
-              '';
-            };
-            args = lib.mkOption {
-              type = lib.types.listOf lib.types.str;
-              default = [ "--no-sandbox" ];
-              description = ''
-                List of CLI flags passed to `chromium`.
-              '';
-            };
+          browser.path = lib.mkOption {
+            type = lib.types.path;
+            default = lib.getExe pkgs.chromium;
+            defaultText = lib.literalExpression "lib.getExe pkgs.chromium";
+            description = ''
+              Path to the executable of the chromium to use.
+            '';
           };
         };
       };
@@ -101,9 +182,6 @@ in
 
       description = ''
         Configuration attributes for `grafana-image-renderer`.
-
-        See <https://github.com/grafana/grafana-image-renderer/blob/ce1f81438e5f69c7fd7c73ce08bab624c4c92e25/default.json>
-        for supported values.
       '';
     };
   };
@@ -120,39 +198,53 @@ in
     ];
 
     services.grafana.settings.rendering = lib.mkIf cfg.provisionGrafana {
-      server_url = "http://localhost:${toString cfg.settings.service.port}/render";
+      server_url = "http://${toString cfg.settings.server.addr}/render";
       callback_url = "http://${config.services.grafana.settings.server.http_addr}:${toString config.services.grafana.settings.server.http_port}";
     };
 
-    services.grafana-image-renderer.chromium = lib.mkDefault pkgs.chromium;
-
     services.grafana-image-renderer.settings = {
-      rendering = lib.mapAttrs (lib.const lib.mkDefault) {
-        chromeBin = "${cfg.chromium}/bin/chromium";
-        verboseLogging = cfg.verbose;
-        timezone = config.time.timeZone;
-      };
-
-      service = {
-        logging.level = lib.mkIf cfg.verbose (lib.mkDefault "debug");
-        metrics.enabled = lib.mkDefault false;
-      };
+      browser.timezone = lib.mkIf (config.time.timeZone != null) (lib.mkDefault config.time.timeZone);
     };
 
     systemd.services.grafana-image-renderer = {
       wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ];
+      wants = [ "network-online.target" ];
+      after = [ "network-online.target" ];
       description = "Grafana backend plugin that handles rendering of panels & dashboards to PNGs using headless browser (Chromium/Chrome)";
 
-      environment = {
-        PUPPETEER_SKIP_CHROMIUM_DOWNLOAD = "true";
-      };
-
       serviceConfig = {
         DynamicUser = true;
         PrivateTmp = true;
-        ExecStart = "${pkgs.grafana-image-renderer}/bin/grafana-image-renderer server --config=${configFile}";
+        ExecStart = "${lib.getExe pkgs.grafana-image-renderer} server ${format.generate cfg.settings}";
         Restart = "always";
+        AmbientCapabilities = "";
+        CapabilityBoundingSet = "";
+        LockPersonality = true;
+        MountAPIVFS = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        PrivateUsers = true;
+        ProtectClock = true;
+        ProtectControlGroups = "strict";
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "full";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [
+          "AF_UNIX"
+          "AF_INET"
+          "AF_INET6"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        UMask = 27;
       };
     };
   };

nixos/modules/services/monitoring/grafana.nix

@@ -1267,7 +1267,7 @@ in
                 No IP addresses are being tracked, only simple counters to track running instances, versions, dashboard and error counts.
                 Counters are sent every 24 hours.
               '';
-              default = true;
+              default = false;
               type = types.bool;
             };
 

nixos/modules/services/web-apps/nextcloud.nix

@@ -120,7 +120,8 @@ let
     ++ (lib.optional (
       cfg.config.objectstore.s3.sseCKeyFile != null
     ) "s3_sse_c_key:${cfg.config.objectstore.s3.sseCKeyFile}")
-    ++ (lib.optional (cfg.secretFile != null) "secret_file:${cfg.secretFile}");
+    ++ (lib.optional (cfg.secretFile != null) "secret_file:${cfg.secretFile}")
+    ++ (lib.mapAttrsToList (credential: file: "${credential}:${file}") cfg.secrets);
 
   requiresRuntimeSystemdCredentials = (lib.length runtimeSystemdCredentials) != 0;
 
@@ -296,6 +297,9 @@ let
         ) "'dbtableprefix' => '${toString c.dbtableprefix}',"}
         ${lib.optionalString (c.dbpassFile != null) "'dbpassword' => nix_read_secret('dbpass'),"}
         'dbtype' => '${c.dbtype}',
+        ${lib.concatStringsSep "\n" (
+          lib.mapAttrsToList (name: credential: "'${name}' => nix_read_secret('${name}'),") cfg.secrets
+        )}
         ${objectstoreConfig}
       ];
 
@@ -390,6 +394,24 @@ in
       '';
       example = "/mnt/nextcloud-file";
     };
+    secrets = lib.mkOption {
+      type = lib.types.attrsOf (
+        lib.types.pathWith {
+          inStore = false;
+          absolute = true;
+        }
+      );
+      default = { };
+      description = ''
+        Secret files to read into entries in `config.php`.
+        This uses `nix_read_secret` and LoadCredential to read the contents of the file into the entry in `config.php`.
+      '';
+      example = lib.literalExpression ''
+        {
+          oidc_login_client_secret = "/run/secrets/nextcloud_oidc_secret";
+        }
+      '';
+    };
     extraApps = lib.mkOption {
       type = lib.types.attrsOf lib.types.package;
       default = { };
@@ -957,6 +979,144 @@ in
               Only has an effect in Nextcloud 23 and later.
             '';
           };
+          enabledPreviewProviders = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            default = [
+              "OC\\Preview\\PNG"
+              "OC\\Preview\\JPEG"
+              "OC\\Preview\\GIF"
+              "OC\\Preview\\BMP"
+              "OC\\Preview\\XBitmap"
+              "OC\\Preview\\Krita"
+              "OC\\Preview\\WebP"
+              "OC\\Preview\\MarkDown"
+              "OC\\Preview\\TXT"
+              "OC\\Preview\\OpenDocument"
+            ];
+            description = ''
+              The preview providers that should be explicitly enabled.
+            '';
+          };
+          mail_domain = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = ''
+              The return address that you want to appear on emails sent by the Nextcloud server, for example `nc-admin@example.com`, substituting your own domain, of course.
+            '';
+          };
+          mail_from_address = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = ''
+              FROM address that overrides the built-in `sharing-noreply` and `lostpassword-noreply` FROM addresses.
+              Defaults to different FROM addresses depending on the feature.
+            '';
+          };
+          mail_smtpdebug = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+            description = ''
+              Enable SMTP class debugging.
+              `loglevel` will likely need to be adjusted too.
+              [See docs](https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/email_configuration.html#enabling-debug-mode).
+            '';
+          };
+          mail_smtpmode = lib.mkOption {
+            type = lib.types.enum [
+              "sendmail"
+              "smtp"
+              "qmail"
+              "null" # Yes, this is really a string null and not null.
+            ];
+            default = "smtp";
+            description = ''
+              Which mode to use for sending mail.
+              If you are using local or remote SMTP, set this to `smtp`.
+              For the `sendmail` option, you need an installed and working email system on the server, with your local `sendmail` installation.
+              For `qmail`, the binary is /var/qmail/bin/sendmail, and it must be installed on your Unix system.
+              Use the string null to send no mails (disable mail delivery). This can be useful if mails should be sent via APIs and rendering messages is not necessary.
+            '';
+          };
+          mail_smtphost = lib.mkOption {
+            type = lib.types.str;
+            default = "127.0.0.1";
+            description = ''
+              This depends on `mail_smtpmode`. Specify the IP address of your mail server host. This may contain multiple hosts separated by a semicolon. If you need to specify the port number, append it to the IP address separated by a colon, like this: `127.0.0.1:24`.
+            '';
+          };
+          mail_smtpport = lib.mkOption {
+            type = lib.types.port;
+            default = 25;
+            description = ''
+              This depends on `mail_smtpmode`. Specify the port for sending mail.
+            '';
+          };
+          mail_smtptimeout = lib.mkOption {
+            type = lib.types.int;
+            default = 10;
+            description = ''
+              This depends on `mail_smtpmode`. This sets the SMTP server timeout, in seconds. You may need to increase this if you are running an anti-malware or spam scanner.
+            '';
+          };
+          mail_smtpsecure = lib.mkOption {
+            type = lib.types.enum [
+              ""
+              "ssl"
+            ];
+            default = "";
+            description = ''
+              This depends on `mail_smtpmode`. Specify `ssl` when you are using SSL/TLS. Any other value will be ignored.
+              If the server advertises STARTTLS capabilities, they might be used, but they cannot be enforced by this config option.
+            '';
+          };
+          mail_smtpauth = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+            description = ''
+              This depends on `mail_smtpmode`. Change this to `true` if your mail server requires authentication.
+            '';
+          };
+          mail_smtpname = lib.mkOption {
+            type = lib.types.str;
+            default = "";
+            description = ''
+              This depends on `mail_smtpauth`. Specify the username for authenticating to the SMTP server.
+            '';
+          };
+          # mail_smtppassword is skipped as it must be set through services.nextcloud.secrets
+          mail_template_class = lib.mkOption {
+            type = lib.types.str;
+            default = "\\OC\\Mail\\EMailTemplate";
+            description = ''
+              Replaces the default mail template layout. This can be utilized if the options to modify the mail texts with the theming app are not enough.
+              The class must extend `\OC\Mail\EMailTemplate`
+            '';
+          };
+          mail_send_plaintext_only = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+            description = ''
+              Email will be sent by default with an HTML and a plain text body. This option allows sending only plain text emails.
+            '';
+          };
+          mail_smtpstreamoptions = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            default = [ ];
+            description = ''
+              This depends on `mail_smtpmode`. Array of additional streams options that will be passed to underlying Swift mailer implementation.
+            '';
+          };
+          mail_sendmailmode = lib.mkOption {
+            type = lib.types.enum [
+              "smtp"
+              "pipe"
+            ];
+            default = "smtp";
+            description = ''
+              For `smtp`, the sendmail binary is started with the parameter `-bs`: Use the SMTP protocol on standard input and output.
+              For `pipe`, the binary is started with the parameters `-t`: Read message from STDIN and extract recipients.
+            '';
+          };
         };
       };
       default = { };
@@ -1026,6 +1186,8 @@ in
         The value can be customized for `nextcloud-cron.service` using this option.
       '';
     };
+
+    imaginary.enable = lib.mkEnableOption "Imaginary";
   };
 
   config = lib.mkIf cfg.enable (
@@ -1145,6 +1307,13 @@ in
               If `services.nextcloud.config.adminpassFile` is null, `services.nextcloud.config.adminuser` must be null as well in order to disable initial admin user creation.
             '';
           }
+          {
+            assertion = !(cfg.settings ? mail_smtppassword);
+            message = ''
+              The option `services.nextcloud.settings.mail_smtppassword` must not be used, as it puts the password into the world-readable nix store.
+              Use `services.nextcloud.secrets.mail_smtppassword` instead and set it to a file containing the password.
+            '';
+          }
         ];
       }
 
@@ -1462,6 +1631,20 @@ in
                 port = 0;
               };
             })
+            # https://docs.nextcloud.com/server/latest/admin_manual/installation/server_tuning.html#previews
+            (lib.mkIf cfg.imaginary.enable {
+              preview_imaginary_url = "http://${config.services.imaginary.address}:${toString config.services.imaginary.port}";
+
+              # Imaginary replaces a few of the built-in providers, so the default value has to be adjusted.
+              enabledPreviewProviders = lib.mkDefault [
+                "OC\\Preview\\Imaginary"
+                "OC\\Preview\\ImaginaryPDF"
+                "OC\\Preview\\Krita"
+                "OC\\Preview\\MarkDown"
+                "OC\\Preview\\TXT"
+                "OC\\Preview\\OpenDocument"
+              ];
+            })
           ];
         };
 
@@ -1594,6 +1777,13 @@ in
             ''}
           '';
         };
+
+        services.imaginary = lib.mkIf cfg.imaginary.enable {
+          enable = true;
+          # add -return-size flag recommend by Nextcloud
+          # https://github.com/h2non/imaginary/pull/382
+          settings.return-size = true;
+        };
       }
     ]
   );

nixos/tests/nextcloud/basic.nix

@@ -63,8 +63,11 @@ runTest (
             };
             phpExtraExtensions = all: [ all.bz2 ];
             nginx.enableFastcgiRequestBuffering = true;
+            secrets.mysecret = "/etc/nextcloud/mysecretfile";
           };
 
+          environment.etc."nextcloud/mysecretfile".text = "foobar";
+
           specialisation.withoutMagick.configuration = {
             services.nextcloud.enableImagemagick = false;
           };
@@ -116,6 +119,9 @@ runTest (
             client_hash = client.succeed("nix-hash testfile.bin").strip()
             nextcloud_hash = nextcloud.succeed("nix-hash /var/lib/nextcloud-data/data/root/files/testfile.bin").strip()
             t.assertEqual(client_hash, nextcloud_hash)
+
+        with subtest("secrets"):
+            assert "foobar" == nextcloud.succeed("nextcloud-occ config:system:get mysecret").strip()
       '';
   }
 )

nixos/tests/nextcloud/default.nix

@@ -75,8 +75,7 @@ let
           inherit (config) test-helpers;
         in
         mkBefore ''
-          nextcloud.start()
-          client.start()
+          start_all()
           nextcloud.wait_for_unit("multi-user.target")
 
           ${test-helpers.init}
@@ -136,6 +135,7 @@ let
         ./with-mysql-and-memcached.nix
         ./with-postgresql-and-redis.nix
         ./with-objectstore.nix
+        ./with-mail.nix
       ]
       ++ (pkgs.lib.optional (version >= 32) ./without-admin-user.nix)
     );

nixos/tests/nextcloud/with-mail.nix

@@ -0,0 +1,100 @@
+{
+  name,
+  pkgs,
+  testBase,
+  system,
+  ...
+}:
+with import ../../lib/testing-python.nix { inherit system pkgs; };
+runTest (
+  { config, lib, ... }:
+  let
+    certs = import ../common/acme/server/snakeoil-certs.nix;
+    domain = certs.domain;
+  in
+  {
+    inherit name;
+
+    meta.maintainers = lib.teams.nextcloud.members;
+
+    imports = [ testBase ];
+
+    nodes = {
+      nextcloud =
+        {
+          config,
+          pkgs,
+          nodes,
+          ...
+        }:
+        {
+          security.pki.certificateFiles = [ certs.ca.cert ];
+
+          networking.extraHosts = ''
+            ${nodes.stalwart.networking.primaryIPAddress} ${domain}
+          '';
+
+          environment.etc."nextcloud/mail_smtppassword".text = "foobar";
+
+          services.nextcloud = {
+            config.dbtype = "sqlite";
+
+            settings = {
+              mail_from_address = "alice";
+              mail_domain = domain;
+              mail_smtpmode = "smtp";
+              mail_smtphost = domain;
+              mail_smtpport = 587;
+              mail_smtpauth = true;
+              mail_smtpname = "alice";
+              mail_send_plaintext_only = true;
+            };
+
+            secrets.mail_smtppassword = "/etc/nextcloud/mail_smtppassword";
+          };
+        };
+
+      stalwart =
+        { pkgs, ... }:
+        {
+          imports = [ ../stalwart/stalwart-mail-config.nix ];
+
+          networking.firewall.allowedTCPPorts = [ 587 ];
+
+          environment.systemPackages = [
+            (pkgs.writers.writePython3Bin "test-imap-read" { } ''
+              from imaplib import IMAP4
+
+              with IMAP4('localhost') as imap:
+                  imap.starttls()
+                  status, [caps] = imap.login('bob', 'foobar')
+                  assert status == 'OK'
+                  imap.select()
+                  status, [ref] = imap.search(None, 'ALL')
+                  assert status == 'OK'
+                  [msgId] = ref.split()
+                  status, msg = imap.fetch(msgId, 'BODY[TEXT]')
+                  assert status == 'OK'
+                  assert (msg[0][1].strip()
+                          == (b'Well done, ${config.adminuser}!\r\n\r\n'
+                              b'If you received this email, the email configuration '
+                              b's=\r\neems to be correct.\r\n\r\n\r\n--=20\r\n'
+                              b'Nextcloud - a safe home for all your data=\r\n\r\n'
+                              b'This is an automatically sent email, please do not reply.'))
+            '')
+          ];
+        };
+    };
+
+    test-helpers.init = ''
+      stalwart.wait_for_unit("multi-user.target")
+      stalwart.wait_until_succeeds("nc -vzw 2 localhost 587")
+
+      nextcloud.succeed("nc -vzw 2 ${domain} 587")
+      nextcloud.succeed("curl -sS --fail-with-body -u ${config.adminuser}:${config.adminpass} -H 'OCS-APIRequest: true' -X PUT http://nextcloud/ocs/v2.php/cloud/users/${config.adminuser} -H 'Content-Type: application/json' --data-raw '{\"key\":\"email\",\"value\":\"bob@${domain}\"}'")
+      nextcloud.succeed("curl -sS --fail-with-body -u ${config.adminuser}:${config.adminpass} -H 'OCS-APIRequest: true' -X POST http://nextcloud/settings/admin/mailtest")
+
+      stalwart.succeed("test-imap-read")
+    '';
+  }
+)

nixos/tests/nextcloud/with-objectstore.nix

@@ -111,7 +111,6 @@ runTest (
     };
 
     test-helpers.init = ''
-      minio.start()
       minio.wait_for_open_port(9000)
       minio.wait_for_unit("nginx.service")
       minio.wait_for_open_port(443)

pkgs/applications/editors/vscode/extensions/default.nix

@@ -4337,6 +4337,8 @@ let
         meta.license = lib.licenses.lgpl3Only;
       };
 
+      sourcegraph.amp = callPackage ./sourcegraph.amp { };
+
       sourcery.sourcery = callPackage ./sourcery.sourcery { };
 
       spywhere.guides = buildVscodeMarketplaceExtension {

pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "claude-dev";
     publisher = "saoudrizwan";
-    version = "3.37.1";
-    hash = "sha256-wS893/I6uc6aUy2chPYCTdG7PzLl5tqx8dhMDasmtYA=";
+    version = "3.38.1";
+    hash = "sha256-j3hRW7l+PEq7DJbXENO5Plbg3SePZm1lX60Y4B5RvYs=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/sourcegraph.amp/default.nix

@@ -0,0 +1,21 @@
+{
+  lib,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    publisher = "sourcegraph";
+    name = "amp";
+    version = "0.0.1763727068";
+    hash = "sha256-rbL0i6JS/I59NiOlkt6v3GVea4vLyzN7BMFYkbDpWho=";
+  };
+
+  meta = {
+    description = "Amp is a frontier coding agent for your editor and terminal, built by Sourcegraph.";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=sourcegraph.amp";
+    homepage = "https://ampcode.com/";
+    license = lib.licenses.unfree;
+    maintainers = [ lib.maintainers.katexochen ];
+  };
+}

pkgs/applications/networking/browsers/chromium/info.json

@@ -813,7 +813,7 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "142.0.7444.162",
+    "version": "142.0.7444.175",
     "deps": {
       "depot_tools": {
         "rev": "675a3a9ccd7cf9367bb4caa58c30f08b56d45ef5",
@@ -825,16 +825,16 @@
         "hash": "sha256-sm5GWbkm3ua7EkCWTuY4TG6EXKe3asXTrH1APnNARJQ="
       },
       "ungoogled-patches": {
-        "rev": "142.0.7444.162-1",
-        "hash": "sha256-/XWaUmNyr5SWgPB8MqgbNbbMneIYECW6nXrgloeW90A="
+        "rev": "142.0.7444.175-1",
+        "hash": "sha256-QN7G9LdflMa2Rg9bPFrmT1mgOfM+2ZlBc4GDamkf8J0="
       },
       "npmHash": "sha256-i1eQ4YlrWSgY522OlFtGDDPmxE2zd1hDM03AzR8RafE="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "c076baf266c3ed5efb225de664cfa7b183668ad6",
-        "hash": "sha256-HdVZl4Zvspgm/9wy+WtDc1UiSM1VrszfwpITQchYoSc=",
+        "rev": "302067f14a4ea3f42001580e6101fa25ed343445",
+        "hash": "sha256-2x1IpfD0BXDaPKwdBO4+t8Dw7dYLM7oQDlrXY57tFIw=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -1619,8 +1619,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "9210361d0a26fa4afefad8c5e60c85e59c5e2c8e",
-        "hash": "sha256-otYRT8scmJ9boG2PKXRacL0C5FFwOVctKK/Dh7WG0tU="
+        "rev": "baea8d627b70725fb777ebc1074f8ec4110ef6cb",
+        "hash": "sha256-jECAfgeAgdkhbI/8BgT9TakR9Ylha2zPznjZzibPQbE="
       }
     }
   }

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -1192,13 +1192,13 @@
     "vendorHash": "sha256-MIO0VHofPtKPtynbvjvEukMNr5NXHgk7BqwIhbc9+u0="
   },
   "selectel_selectel": {
-    "hash": "sha256-qGqoljx5G7fmqrnhfVll+hX1afR3+3blcY1Hob5ujYY=",
+    "hash": "sha256-x1vYsdBNYdBhgMSE/x3jCzsiqNXDF3oVnskGOsTBit4=",
     "homepage": "https://registry.terraform.io/providers/selectel/selectel",
     "owner": "selectel",
     "repo": "terraform-provider-selectel",
-    "rev": "v7.1.0",
+    "rev": "v7.2.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-K70gvX9XcMoDCNQk9k7dtBBQxYSiS3TkqGBxMK3pOK0="
+    "vendorHash": "sha256-YX2+JGqS9q9Scl3wjfmqEfT4/alD9Gt8B5OjoYIldCQ="
   },
   "siderolabs_talos": {
     "hash": "sha256-PPD4blyXt4/IalzwEn4+lvuD1Qx7VuUD/CUJILDRI5k=",

pkgs/by-name/al/alsa-utils/package.nix

@@ -12,6 +12,7 @@
   libsamplerate,
   pciutils,
   procps,
+  tree,
   which,
   fftw,
   pipewire,
@@ -64,8 +65,9 @@ stdenv.mkDerivation (finalAttrs: {
         which
         pciutils
         procps
+        tree
       ]
-    }"
+    }" --prefix PATH : $out/bin
     for program in $out/bin/*; do
         wrapProgram "$program" --set-default ALSA_PLUGIN_DIR "${plugin-dir}"
     done

pkgs/by-name/al/althttpd/package.nix

@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation {
   pname = "althttpd";
-  version = "unstable-2023-08-12";
+  version = "0-unstable-2023-08-12";
 
   src = fetchfossil {
     url = "https://sqlite.org/althttpd/";

pkgs/by-name/ap/apachetomcatscanner/package.nix

@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "apachetomcatscanner";
-  version = "3.8.0";
+  version = "3.8.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "p0dalirius";
     repo = "ApacheTomcatScanner";
     tag = version;
-    hash = "sha256-gMyJClEE/i8AKHcSyvvMPwCooLwl/hvcRZgZqF59RUY=";
+    hash = "sha256-9gaue/XfxtU+5URYfg+uYaNcx8G3Eu9DgVEpj/lk8TY=";
   };
 
   # Posted a PR for discussion upstream that can be followed:

pkgs/by-name/bl/blender/fix-hip-path.patch

@@ -0,0 +1,25 @@
+commit 0c7159ed66e28b4da4275cd79e01b2d0669808a3 (HEAD -> fix-hip-path-syntax-error, amarshall/fix-hip-path-syntax-error)
+Author: Andrew Marshall <andrew@johnandrewmarshall.com>
+Date:   Thu Nov 20 20:24:20 2025 -0500
+
+    Fix: Incorrect HIP load path on Linux
+    
+    Missing comma meant the following line was concatenated with this one,
+    causing the path to be
+    "/opt/rocm/hip/lib/libamdhip64.so.6libamdhip64.so.7".
+    
+    Broken in 14bd7a531feddb81a0e522b7db76288639f1ad05.
+
+diff --git a/extern/hipew/src/hipew.c b/extern/hipew/src/hipew.c
+index 3ce13ef7c32..e72ccde69ef 100644
+--- a/extern/hipew/src/hipew.c
++++ b/extern/hipew/src/hipew.c
+@@ -244,7 +244,7 @@ static int hipewHipInit(void) {
+   const char* hip_paths[] = { "libamdhip64.so",
+                             "libamdhip64.so.6",
+                             "/opt/rocm/lib/libamdhip64.so.6",
+-                            "/opt/rocm/hip/lib/libamdhip64.so.6"
++                            "/opt/rocm/hip/lib/libamdhip64.so.6",
+                             "libamdhip64.so.7",
+                             "/opt/rocm/lib/libamdhip64.so.7",
+                             "/opt/rocm/hip/lib/libamdhip64.so.7",

pkgs/by-name/bl/blender/package.nix

@@ -69,6 +69,7 @@
   pugixml,
   python3Packages, # must use instead of python3.pkgs, see https://github.com/NixOS/nixpkgs/issues/211340
   rocmPackages, # comes with a significantly larger closure size
+  rubberband,
   runCommand,
   shaderc,
   spaceNavSupport ? stdenv.hostPlatform.isLinux,
@@ -116,14 +117,18 @@ in
 
 stdenv'.mkDerivation (finalAttrs: {
   pname = "blender";
-  version = "4.5.4";
+  version = "5.0.0";
 
   src = fetchzip {
     name = "source";
     url = "https://download.blender.org/source/blender-${finalAttrs.version}.tar.xz";
-    hash = "sha256-/cYMCWgojkO1mqzJ4BZwbwXPuBmg66T+gzpEuLiOskY=";
+    hash = "sha256-UUHsylDmMWRcr1gGiXuYnno7D6uMjLqTYd9ak4FnZis=";
   };
 
+  patches = [
+    ./fix-hip-path.patch # https://projects.blender.org/blender/blender/pulls/150321
+  ];
+
   postPatch =
     (lib.optionalString stdenv.hostPlatform.isDarwin ''
       : > build_files/cmake/platform/platform_apple_xcode.cmake
@@ -263,6 +268,7 @@ stdenv'.mkDerivation (finalAttrs: {
     pugixml
     python3
     python3Packages.materialx
+    rubberband
     zlib
     zstd
   ]

pkgs/by-name/co/codex/package.nix

@@ -14,18 +14,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "codex";
-  version = "0.60.1";
+  version = "0.61.0";
 
   src = fetchFromGitHub {
     owner = "openai";
     repo = "codex";
     tag = "rust-v${finalAttrs.version}";
-    hash = "sha256-VWvSMS7A8xi6n3RLvWphy8caqolYAaB51E9fyVb1ZNI=";
+    hash = "sha256-1DmnrRgwWNTkjG9DODUfLbz4ZYydhTapnv4yv9qOEmU=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/codex-rs";
 
-  cargoHash = "sha256-F9YU77p7T7sfThP6R3HVOFN1pl05/myUMV6zVRcriHY=";
+  cargoHash = "sha256-9zZZG00TzovQBwhidWt2p84dkj8jU35+lSmNIPmDOZY=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/di/direwolf-unstable/package.nix

@@ -12,13 +12,13 @@
   inherit hamlibSupport gpsdSupport extraScripts;
 }).overrideAttrs
   (oldAttrs: {
-    version = "1.8-unstable-2025-11-07";
+    version = "1.8.1-unstable-2025-11-16";
 
     src = fetchFromGitHub {
       owner = "wb2osz";
       repo = "direwolf";
-      rev = "3658a878920803bbb69a4567579dcc4d6cb80a92";
-      hash = "sha256-EcQrNN0nRxEfhJc3AbYkxlRaBKpoHQRrZbExYBankMk=";
+      rev = "694c95485b21c1c22bc4682703771dec4d7a374b";
+      hash = "sha256-O2ycOQx4EVwdYGC9LTBlxheMFZp0ddHquSUwVsB5fco=";
     };
 
     # drop upstreamed cmake-4 patch

pkgs/by-name/en/enzyme/package.nix

@@ -7,13 +7,13 @@
 }:
 llvmPackages.stdenv.mkDerivation rec {
   pname = "enzyme";
-  version = "0.0.215";
+  version = "0.0.217";
 
   src = fetchFromGitHub {
     owner = "EnzymeAD";
     repo = "Enzyme";
     rev = "v${version}";
-    hash = "sha256-XK3d47Q/6+sJ2RL+on483z9PvZrdaKxIT9/GUQuLPl8=";
+    hash = "sha256-CKNwTuR0sP8U1TrFqZipZcymObMtpw4qrOkGqQn3GX0=";
   };
 
   postPatch = ''

pkgs/by-name/ex/exifprobe/package.nix

@@ -6,7 +6,7 @@
 
 stdenv.mkDerivation {
   pname = "exifprobe";
-  version = "unstable-2018-06-19";
+  version = "2.0.1-unstable-2018-06-19";
 
   src = fetchFromGitHub {
     owner = "hfiguiere";

pkgs/by-name/fm/fmtoy/2001-Build-against-system-installed-libvgm.patch

@@ -0,0 +1,186 @@
+From bcaa94b1c6ccdbedcf7dfa15db98542af12aa46d Mon Sep 17 00:00:00 2001
+From: OPNA2608 <opna2608@protonmail.com>
+Date: Fri, 14 Nov 2025 21:54:21 +0100
+Subject: [PATCH] Build against system-installed libvgm
+
+---
+ Makefile        | 16 ++++++----------
+ fmtoy_ym2151.c  |  4 ++--
+ fmtoy_ym2203.c  |  4 ++--
+ fmtoy_ym2608.c  |  4 ++--
+ fmtoy_ym2610.c  |  4 ++--
+ fmtoy_ym2610b.c |  4 ++--
+ fmtoy_ym2612.c  |  4 ++--
+ fmtoy_ym3812.c  |  4 ++--
+ fmtoy_ymf262.c  |  4 ++--
+ 9 files changed, 22 insertions(+), 26 deletions(-)
+
+diff --git a/Makefile b/Makefile
+index 32f6421..3aa2af9 100644
+--- a/Makefile
++++ b/Makefile
+@@ -2,7 +2,7 @@ CC?=gcc
+ AR?=ar
+ CFLAGS?=-ggdb -Wall
+ ifndef EMSCRIPTEN
+-	CFLAGS+=$(shell pkg-config alsa jack --cflags)
++	CFLAGS+=$(shell pkg-config alsa jack vgm-emu --cflags)
+ endif
+ 
+ EMLDFLAGS?= \
+@@ -38,19 +38,19 @@ endif
+ libfmtoy.a: fmtoy.o fmtoy_ym2151.o fmtoy_ym2203.o fmtoy_ym2608.o fmtoy_ym2610.o fmtoy_ym2610b.o fmtoy_ym2612.o fmtoy_ym3812.o fmtoy_ymf262.o
+ 	$(AR) cr $@ $^
+ 
+-fmtoy_jack: fmtoy_jack.o cmdline.o tools.o libfmtoy.a libfmvoice/libfmvoice.a midilib/libmidi.a libvgm/build/bin/libvgm-emu.a
+-	$(CC) $^ -o $@ $(LIBS) $(shell pkg-config alsa jack --libs)
++fmtoy_jack: fmtoy_jack.o cmdline.o tools.o libfmtoy.a libfmvoice/libfmvoice.a midilib/libmidi.a
++	$(CC) $^ -o $@ $(LIBS) $(shell pkg-config alsa jack vgm-emu --libs)
+ 
+-fmtowWasm.wasm fmtoyWasm.js: glue.o libfmtoy.a libfmvoice/libfmvoice.a libvgm/$(LIBVGM_BUILD_DIR)/bin/libvgm-emu.a
++fmtowWasm.wasm fmtoyWasm.js: glue.o libfmtoy.a libfmvoice/libfmvoice.a
+ 	$(CC) $^ -s WASM=1 -s EXPORT_ES6=1 -s MODULARIZE=1 $(EMLDFLAGS) -o $@
+ 	sed -i '1s/^/\/* eslint-disable *\/ /' $@
+ 
+-fmtoyWorkletWasm.js: glue.o libfmtoy.a libfmvoice/libfmvoice.a libvgm/$(LIBVGM_BUILD_DIR)/bin/libvgm-emu.a
++fmtoyWorkletWasm.js: glue.o libfmtoy.a libfmvoice/libfmvoice.a
+ 	$(CC) $^ -s WASM=1 EXPORT_ES6=1 -s MODULARIZE=1  -s SINGLE_FILE=1 $(EMLDFLAGS) -o $@
+ 	sed -i '1s/^/\/* eslint-disable *\/ /' $@
+ 	sed -i "s/typeof window == 'object' || typeof importScripts == 'function'/1/g" $@
+ 
+-fmtoyAsm.js: glue.o libfmtoy.a libfmvoice/libfmvoice.a libvgm/$(LIBVGM_BUILD_DIR)/bin/libvgm-emu.a
++fmtoyAsm.js: glue.o libfmtoy.a libfmvoice/libfmvoice.a
+ 	$(CC) $^ -s WASM=0 -s EXPORT_ES6=1 -s MODULARIZE=1 $(EMLDFLAGS) -o $@
+ 	sed -i '1s/^/\/* eslint-disable *\/ /' $@
+ 
+@@ -65,9 +65,6 @@ midilib/libmidi.a:
+ 	cd midilib && make libmidi.a
+ libfmvoice/libfmvoice.a:
+ 	cd libfmvoice && make libfmvoice.a
+-libvgm/$(LIBVGM_BUILD_DIR)/bin/libvgm-emu.a:
+-	cd libvgm && cmake -B$(LIBVGM_BUILD_DIR) -DBUILD_LIBAUDIO=OFF -DBUILD_LIBPLAYER=OFF -DBUILD_PLAYER=OFF -DBUILD_VGM2WAV=OFF -DUTIL_LOADERS=OFF
+-	cd libvgm/$(LIBVGM_BUILD_DIR) && make vgm-emu
+ 
+ %.o: %.c
+ 	$(CC) -MMD -c $< -o $@ $(CFLAGS)
+@@ -78,4 +75,3 @@ clean:
+ 	rm -f *.o *.d *.a chips/*.o chips/*.d *.js *.wasm fmtoy_jack
+ 	cd libfmvoice && make clean
+ 	cd midilib && make clean
+-	cd libvgm && rm -rf build
+diff --git a/fmtoy_ym2151.c b/fmtoy_ym2151.c
+index 1e3678e..9332076 100644
+--- a/fmtoy_ym2151.c
++++ b/fmtoy_ym2151.c
+@@ -1,7 +1,7 @@
+ #include "fmtoy.h"
+ #include "fmtoy_ym2151.h"
+-#include "libvgm/emu/SoundEmu.h"
+-#include "libvgm/emu/SoundDevs.h"
++#include <vgm/emu/SoundEmu.h>
++#include <vgm/emu/SoundDevs.h>
+ #include "tools.h"
+ 
+ static int fmtoy_ym2151_init(struct fmtoy *fmtoy, int clock, int sample_rate, struct fmtoy_channel *channel) {
+diff --git a/fmtoy_ym2203.c b/fmtoy_ym2203.c
+index 19275ae..a7285fb 100644
+--- a/fmtoy_ym2203.c
++++ b/fmtoy_ym2203.c
+@@ -1,7 +1,7 @@
+ #include "fmtoy.h"
+ #include "fmtoy_ym2203.h"
+-#include "libvgm/emu/SoundEmu.h"
+-#include "libvgm/emu/SoundDevs.h"
++#include <vgm/emu/SoundEmu.h>
++#include <vgm/emu/SoundDevs.h>
+ 
+ static int fmtoy_ym2203_init(struct fmtoy *fmtoy, int clock, int sample_rate, struct fmtoy_channel *channel) {
+ 	channel->chip->clock = clock;
+diff --git a/fmtoy_ym2608.c b/fmtoy_ym2608.c
+index d149ce1..2449c5d 100644
+--- a/fmtoy_ym2608.c
++++ b/fmtoy_ym2608.c
+@@ -1,7 +1,7 @@
+ #include "fmtoy.h"
+ #include "fmtoy_ym2608.h"
+-#include "libvgm/emu/SoundEmu.h"
+-#include "libvgm/emu/SoundDevs.h"
++#include <vgm/emu/SoundEmu.h>
++#include <vgm/emu/SoundDevs.h>
+ 
+ static int fmtoy_ym2608_init(struct fmtoy *fmtoy, int clock, int sample_rate, struct fmtoy_channel *channel) {
+ 	channel->chip->clock = clock;
+diff --git a/fmtoy_ym2610.c b/fmtoy_ym2610.c
+index fcca9f4..c69c987 100644
+--- a/fmtoy_ym2610.c
++++ b/fmtoy_ym2610.c
+@@ -1,7 +1,7 @@
+ #include "fmtoy.h"
+ #include "fmtoy_ym2610.h"
+-#include "libvgm/emu/SoundEmu.h"
+-#include "libvgm/emu/SoundDevs.h"
++#include <vgm/emu/SoundEmu.h>
++#include <vgm/emu/SoundDevs.h>
+ 
+ static int fmtoy_ym2610_init(struct fmtoy *fmtoy, int clock, int sample_rate, struct fmtoy_channel *channel) {
+ 	channel->chip->clock = clock;
+diff --git a/fmtoy_ym2610b.c b/fmtoy_ym2610b.c
+index cd434c4..a4adfa4 100644
+--- a/fmtoy_ym2610b.c
++++ b/fmtoy_ym2610b.c
+@@ -1,7 +1,7 @@
+ #include "fmtoy.h"
+ #include "fmtoy_ym2610b.h"
+-#include "libvgm/emu/SoundEmu.h"
+-#include "libvgm/emu/SoundDevs.h"
++#include <vgm/emu/SoundEmu.h>
++#include <vgm/emu/SoundDevs.h>
+ 
+ static int fmtoy_ym2610b_init(struct fmtoy *fmtoy, int clock, int sample_rate, struct fmtoy_channel *channel) {
+ 	channel->chip->clock = clock;
+diff --git a/fmtoy_ym2612.c b/fmtoy_ym2612.c
+index 9a012db..e3de3d7 100644
+--- a/fmtoy_ym2612.c
++++ b/fmtoy_ym2612.c
+@@ -1,7 +1,7 @@
+ #include "fmtoy.h"
+ #include "fmtoy_ym2612.h"
+-#include "libvgm/emu/SoundEmu.h"
+-#include "libvgm/emu/SoundDevs.h"
++#include <vgm/emu/SoundEmu.h>
++#include <vgm/emu/SoundDevs.h>
+ 
+ static int fmtoy_ym2612_init(struct fmtoy *fmtoy, int clock, int sample_rate, struct fmtoy_channel *channel) {
+ 	channel->chip->clock = clock;
+diff --git a/fmtoy_ym3812.c b/fmtoy_ym3812.c
+index 391f81a..5d6bae1 100644
+--- a/fmtoy_ym3812.c
++++ b/fmtoy_ym3812.c
+@@ -2,8 +2,8 @@
+ 
+ #include "fmtoy.h"
+ #include "fmtoy_ym3812.h"
+-#include "libvgm/emu/SoundEmu.h"
+-#include "libvgm/emu/SoundDevs.h"
++#include <vgm/emu/SoundEmu.h>
++#include <vgm/emu/SoundDevs.h>
+ 
+ static void fmwrite(DEVFUNC_WRITE_A8D8 writefn, void *dataPtr, uint8_t reg, uint8_t data) {
+ 	writefn(dataPtr, 0, reg);
+diff --git a/fmtoy_ymf262.c b/fmtoy_ymf262.c
+index 2bd1a1a..e281c2b 100644
+--- a/fmtoy_ymf262.c
++++ b/fmtoy_ymf262.c
+@@ -1,7 +1,7 @@
+ #include "fmtoy.h"
+ #include "fmtoy_ymf262.h"
+-#include "libvgm/emu/SoundEmu.h"
+-#include "libvgm/emu/SoundDevs.h"
++#include <vgm/emu/SoundEmu.h>
++#include <vgm/emu/SoundDevs.h>
+ 
+ static void fmwrite(DEVFUNC_WRITE_A8D8 writefn, void *dataPtr, uint8_t reg, uint8_t data) {
+ 	writefn(dataPtr, 0, reg);
+-- 
+2.51.0
+

pkgs/by-name/fm/fmtoy/package.nix

@@ -6,6 +6,7 @@
   alsa-lib,
   cmake,
   libjack2,
+  libvgm,
   pkg-config,
   zlib,
 }:
@@ -22,10 +23,21 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-OiPKtFPlTxdMNSTLJXcXZkqjzUiGQKXSF2udHePBpho=";
   };
 
-  postPatch = ''
-    substituteInPlace Makefile \
-      --replace-fail 'pkg-config' "$PKG_CONFIG"
-  '';
+  patches = [
+    # Build against our libvgm
+    ./2001-Build-against-system-installed-libvgm.patch
+  ];
+
+  postPatch =
+    # We don't want to use this libvgm, make sure it can't be referenced by accident
+    ''
+      rm -r libvgm
+    ''
+    # Fix cross by using pkg-config for hostPlatform packages
+    + ''
+      substituteInPlace Makefile \
+        --replace-fail 'pkg-config' "$PKG_CONFIG"
+    '';
 
   strictDeps = true;
 
@@ -37,6 +49,25 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     alsa-lib
     libjack2
+    (libvgm.override {
+      # Only enable free cores that we actually use
+      enableEmulation = true;
+      withAllEmulators = false;
+      emulators = [
+        "YM2151_ALL"
+        "YM2203_ALL"
+        "YM2608_ALL"
+        "YM2610_ALL"
+        "YM2612_ALL"
+        "YM3812_ALL"
+        "YMF262_ALL"
+      ];
+
+      # Don't need these
+      enableAudio = false;
+      enableLibplayer = false;
+      enableTools = false;
+    })
     zlib
   ];
 

pkgs/by-name/fo/forgejo/lts.nix

@@ -1,8 +1,8 @@
 import ./generic.nix {
-  version = "11.0.7";
-  hash = "sha256-svNysySAE50rgTXTyPiZDv0lQfYGgdgoc5+9GXxv3Bw=";
-  npmDepsHash = "sha256-1lY08jBTx3DRhoaup02076EL9n85y57WCsS/cNcM4aw=";
-  vendorHash = "sha256-Jh8u+iCBhYdKcLj4IzcKtJBnzvclvUeYbR/hjMN+cPs=";
+  version = "11.0.8";
+  hash = "sha256-KwVk4kRvrPQWsDWxX5L9pKjC+VwywLKKd2oYH+vlg74=";
+  npmDepsHash = "sha256-Qs1aZxgjlsjdxfBpa4pOrwEfDfb/96L49uJd29Ysn/I=";
+  vendorHash = "sha256-TVp4WxrGBlKVaPIbsj4EP/3pt5iseXLY7xIVum71ZXU=";
   lts = true;
   nixUpdateExtraArgs = [
     "--override-filename"

pkgs/by-name/fo/forgejo/package.nix

@@ -1,8 +1,8 @@
 import ./generic.nix {
-  version = "13.0.2";
-  hash = "sha256-5am/WiRo+ma2ArhnKxQ6cpFl2q7R4g4UwtdnSY/+RIM=";
+  version = "13.0.3";
+  hash = "sha256-ViqwTEVZkccNx5Pt+lrWvAqzD5RRTzwfBhUTfWyDhtE=";
   npmDepsHash = "sha256-7WjcMsKPtKUWJfDrJc65ZXq2tjK8+8DnqwINj+0XyiQ=";
-  vendorHash = "sha256-PHItbU27d9ouykUlhr9owylMpF+3wz2vc8c0UTR1RVU=";
+  vendorHash = "sha256-gHdggzCJlYvs8JXs4CJ/AyqYMPCC2o4uRwDiem3rNFM=";
   lts = false;
   nixUpdateExtraArgs = [
     "--override-filename"

pkgs/by-name/gi/gitlab-runner/package.nix

@@ -4,6 +4,7 @@
   bash,
   buildGoModule,
   fetchFromGitLab,
+  fetchpatch,
   nix-update-script,
   versionCheckHook,
 }:
@@ -27,6 +28,12 @@ buildGoModule (finalAttrs: {
   patches = [
     ./fix-shell-path.patch
     ./remove-bash-test.patch
+    # fix regression. remove with next release.
+    (fetchpatch {
+      name = "fix-shell-executor-not-working-with-variables-that-use-file-variables.patch";
+      url = "https://gitlab.com/gitlab-org/gitlab-runner/-/commit/6318fe8e38ca9774eb0f52fa2c68555cdad3ab44.patch";
+      hash = "sha256-GTdBo+7kHHpNs6JywjOII4NBcHjFYEZ3xhdGTcGKov4=";
+    })
   ];
 
   prePatch = ''

pkgs/by-name/gr/grafana-image-renderer/package.json

@@ -1,109 +0,0 @@
-{
-  "name": "renderer",
-  "version": "1.0.0",
-  "author": "Grafana Labs",
-  "license": "Apache-2.0",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/grafana/grafana-image-renderer.git"
-  },
-  "scripts": {
-    "eslint": "eslint .",
-    "typecheck": "tsc --noEmit",
-    "prettier:check": "prettier --list-different \"**/*.ts\"",
-    "prettier:write": "prettier --list-different \"**/*.ts\" --write",
-    "precommit": "npm run eslint & npm run typecheck",
-    "watch": "tsc-watch --onSuccess \"node build/app.js server --config=dev.json\"",
-    "watch:debug": "tsc-watch --onSuccess \"cross-env DEBUG=puppeteer-cluster:* node build/app.js server --config=dev.json\"",
-    "build": "tsc",
-    "start": "node build/app.js server --config=dev.json",
-    "create-gcom-plugin-json": "ts-node scripts/createGcomPluginJson.ts ./scripts/tmp",
-    "push-to-gcom": "sh ./scripts/push-to-gcom.sh",
-    "test-update": "cross-env UPDATE_GOLDEN=true jest",
-    "test": "sh ./scripts/run_tests.sh",
-    "test-ci": "jest",
-    "test-diff": "cross-env SAVE_DIFF=true jest"
-  },
-  "dependencies": {
-    "@grpc/grpc-js": "^1.8.22",
-    "@grpc/proto-loader": "^0.7.2",
-    "@hapi/boom": "^10.0.0",
-    "@opentelemetry/api": "^1.9.0",
-    "@opentelemetry/auto-instrumentations-node": "^0.49.0",
-    "@opentelemetry/exporter-trace-otlp-http": "^0.52.1",
-    "@opentelemetry/resources": "^1.25.1",
-    "@opentelemetry/sdk-node": "^0.52.1",
-    "@opentelemetry/semantic-conventions": "^1.25.1",
-    "@puppeteer/browsers": "^2.3.1",
-    "chokidar": "^3.5.2",
-    "dompurify": "^3.2.4",
-    "express": "^4.21.1",
-    "express-prom-bundle": "^6.5.0",
-    "ioredis": "^5.6.1",
-    "jimp": "^0.22.12",
-    "jsdom": "20.0.0",
-    "lodash": "^4.17.21",
-    "minimist": "^1.2.6",
-    "morgan": "^1.9.0",
-    "multer": "^2.0.2",
-    "on-finished": "^2.3.0",
-    "poolpeteer": "^0.24.0",
-    "prom-client": "^14.1.0",
-    "puppeteer": "^22.8.2",
-    "puppeteer-cluster": "^0.24.0",
-    "rate-limiter-flexible": "^7.0.0",
-    "tar-fs": "^3.0.9",
-    "unique-filename": "^2.0.1",
-    "winston": "^3.8.2"
-  },
-  "devDependencies": {
-    "@eslint/js": "^9.31.0",
-    "@grafana/eslint-config": "^8.1.0",
-    "@grafana/sign-plugin": "^3.1.3",
-    "@stylistic/eslint-plugin-ts": "^4.4.1",
-    "@types/content-disposition": "^0.5.9",
-    "@types/express": "^4.17.14",
-    "@types/jest": "^29.5.12",
-    "@types/jsdom": "20.0.0",
-    "@types/lodash": "^4.17.20",
-    "@types/minimist": "^1.2.5",
-    "@types/morgan": "^1.9.10",
-    "@types/multer": "^1.4.7",
-    "@types/node": "^20.17.27",
-    "@types/pixelmatch": "^5.2.6",
-    "@types/supertest": "^2.0.15",
-    "@typescript-eslint/eslint-plugin": "^8.37.0",
-    "@typescript-eslint/parser": "^8.37.0",
-    "@yao-pkg/pkg": "^6.3.0",
-    "axios": "1.8.2",
-    "cross-env": "7.0.3",
-    "eslint": "^9.31.0",
-    "eslint-config-prettier": "^10.1.5",
-    "eslint-plugin-jsdoc": "^51.4.1",
-    "eslint-plugin-react": "^7.37.5",
-    "eslint-plugin-react-hooks": "^5.2.0",
-    "fast-png": "^6.2.0",
-    "jest": "^29.7.0",
-    "jsonwebtoken": "^9.0.2",
-    "lint-staged": "13.0.3",
-    "prettier": "2.7.1",
-    "supertest": "^7.0.0",
-    "ts-jest": "^29.1.1",
-    "ts-node": "10.9.1",
-    "tsc-watch": "5.0.3",
-    "typescript": "^5.8.3",
-    "typescript-eslint": "^8.37.0"
-  },
-  "lint-staged": {
-    "*.ts": [
-      "prettier --write"
-    ]
-  },
-  "pkg": {
-    "assets": "proto/*"
-  },
-  "bin": "build/app.js",
-  "engines": {
-    "node": ">= 22"
-  }
-}

pkgs/by-name/gr/grafana-image-renderer/package.nix

@@ -1,68 +1,23 @@
 {
   lib,
-  mkYarnPackage,
+  buildGoModule,
   fetchFromGitHub,
-  fetchYarnDeps,
-  nodejs,
-  runtimeShell,
 }:
 
-# Notes for the upgrade:
-# * Download the tarball of the new version to use.
-# * Replace new `package.json` here.
-# * Update `version`+`hash` and rebuild.
-
-mkYarnPackage rec {
+buildGoModule (finalAttrs: {
   pname = "grafana-image-renderer";
-  version = "4.0.14";
+  version = "5.0.10";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "grafana-image-renderer";
-    rev = "v${version}";
-    hash = "sha256-CoQTOzQ7h31B3U0yvJYsgC3uaSyjNNLpD+8uMN+naiQ=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-oWJlb1mV1sNgN7EQ8L4msfnKps5oV60JgwZYpAJQaq4=";
   };
 
-  offlineCache = fetchYarnDeps {
-    yarnLock = src + "/yarn.lock";
-    hash = "sha256-xZrIoQlPeyGTbFRUQ0M8Tc6YpzsC5IACW0bbZ+HnsOQ=";
-  };
+  vendorHash = "sha256-wA1XeLO2bYwq7HZOQ5UNcdqqJdEWRUxFoAQucXAj48k=";
 
-  packageJSON = ./package.json;
-
-  buildPhase = ''
-    runHook preBuild
-
-    pushd deps/renderer
-    yarn run build
-    popd
-
-    runHook postBuild
-  '';
-
-  dontInstall = true;
-
-  distPhase = ''
-    runHook preDist
-
-    shopt -s extglob
-
-    pushd deps/renderer
-    install_path="$out/libexec/grafana-image-renderer"
-    mkdir -p $install_path
-    cp -R ../../node_modules $install_path
-    cp -R ./!(node_modules) $install_path
-    popd
-
-    mkdir -p $out/bin
-    cat >$out/bin/grafana-image-renderer <<EOF
-    #! ${runtimeShell}
-    ${nodejs}/bin/node $install_path/build/app.js \$@
-    EOF
-    chmod +x $out/bin/grafana-image-renderer
-
-    runHook postDist
-  '';
+  subPackages = [ "." ];
 
   meta = with lib; {
     homepage = "https://github.com/grafana/grafana-image-renderer";
@@ -70,6 +25,5 @@ mkYarnPackage rec {
     mainProgram = "grafana-image-renderer";
     license = licenses.asl20;
     maintainers = with maintainers; [ ma27 ];
-    platforms = platforms.all;
   };
-}
+})

pkgs/by-name/in/intel-compute-runtime/package.nix

@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-compute-runtime";
-  version = "25.40.35563.4";
+  version = "25.44.36015.5";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "compute-runtime";
     tag = version;
-    hash = "sha256-V2zmS3CFLxhyFYvGOdkix9g3E6JkeVa/pDLPC5NYivo=";
+    hash = "sha256-4CXNSgMyXsoiHdXQwm8oxQZrcFs9suVdC+OxcD/69Xw=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/in/intel-graphics-compiler/package.nix

@@ -19,7 +19,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "intel-graphics-compiler";
-  version = "2.20.3";
+  version = "2.22.2";
 
   # See the repository for expected versions:
   # <https://github.com/intel/intel-graphics-compiler/blob/v2.16.0/documentation/build_ubuntu.md#revision-table>
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
       owner = "intel";
       repo = "intel-graphics-compiler";
       tag = "v${version}";
-      hash = "sha256-OCou4yhx9rY1JznrzGMLhsjj/3CvqQXfXWFAPDxA8Ds=";
+      hash = "sha256-4Tp9kY+Sbirf4kN/C5Q1ClcoUI/fhfUJpqL+/eO8a/o=";
     })
     (fetchFromGitHub {
       name = "llvm-project";
@@ -56,8 +56,8 @@ stdenv.mkDerivation rec {
       name = "llvm-spirv";
       owner = "KhronosGroup";
       repo = "SPIRV-LLVM-Translator";
-      tag = "v16.0.17";
-      hash = "sha256-ta5QbVady9/cwBbAwF1r4ft/ESMnLgcmGMrFhv1PCH0=";
+      tag = "v16.0.18";
+      hash = "sha256-JwFwjHUv1tBC7KDWAhkse557R6QCaVjOekhndQlVetM=";
     })
   ];
 
@@ -95,7 +95,7 @@ stdenv.mkDerivation rec {
 
     # match default LLVM version with our provided version to apply correct patches
     substituteInPlace igc/external/llvm/llvm_preferred_version.cmake \
-      --replace-fail "15.0.7" "${llvmVersion}"
+      --replace-fail "16.0.6" "${llvmVersion}"
   '';
 
   nativeBuildInputs = [

pkgs/by-name/je/jellyfin-web/package.nix

@@ -13,7 +13,7 @@
 }:
 buildNpmPackage rec {
   pname = "jellyfin-web";
-  version = "10.11.2";
+  version = "10.11.3";
 
   src =
     assert version == jellyfin.version;
@@ -21,7 +21,7 @@ buildNpmPackage rec {
       owner = "jellyfin";
       repo = "jellyfin-web";
       rev = "v${version}";
-      hash = "sha256-xgZ2fh2dMpcvXXUWcZSvcARm4Qy8qgi8T5nFyk+sOgs=";
+      hash = "sha256-rsAxV3ABO1HYnVsvsIMMoWizPuFL0GyfKNUGYkqFxBc=";
     };
 
   nodejs = nodejs_20; # does not build with 22
@@ -31,7 +31,7 @@ buildNpmPackage rec {
       --replace-fail "git describe --always --dirty" "echo ${src.rev}" \
   '';
 
-  npmDepsHash = "sha256-Uikude8cNBA79KNPf6D0McwR/AoaaWJVMw2Q08AiK3U=";
+  npmDepsHash = "sha256-OLFjeCgq2c4d22L6yt7ihPuZiwsR1txZpjniuf/0L0I=";
 
   preBuild = ''
     # using sass-embedded fails at executing node_modules/sass-embedded-linux-x64/dart-sass/src/dart

pkgs/by-name/je/jellyfin/package.nix

@@ -13,13 +13,13 @@
 
 buildDotnetModule rec {
   pname = "jellyfin";
-  version = "10.11.2"; # ensure that jellyfin-web has matching version
+  version = "10.11.3"; # ensure that jellyfin-web has matching version
 
   src = fetchFromGitHub {
     owner = "jellyfin";
     repo = "jellyfin";
     rev = "v${version}";
-    hash = "sha256-cq45OP7xNfQ09ZfrKxnmHo68Y7SkfSVArH6PlhewPaM=";
+    hash = "sha256-xNQe0hjY1BjC1D+hYTj1Gv2jCpwhWJv9dlvY6K9jkSk=";
   };
 
   propagatedBuildInputs = [ sqlite ];

pkgs/by-name/mm/mmixware/package.nix

@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation {
   pname = "mmixware";
-  version = "unstable-2021-06-18";
+  version = "1.0-unstable-2021-06-18";
 
   src = fetchFromGitLab {
     domain = "gitlab.lrz.de";

pkgs/by-name/mq/mqtt-exporter/package.nix

@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "mqtt-exporter";
-  version = "1.8.1-1";
+  version = "1.9.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kpetremann";
     repo = "mqtt-exporter";
     tag = "v${version}";
-    hash = "sha256-FBB8KvSLrcJ9pdfVq18ykovwApNZoOcU0xTfvAWTxpc=";
+    hash = "sha256-z2y43sRlwgy3Bwhu8rvlTkf6HOT+v8kjo5FT3lo5CEA=";
   };
 
   build-system = with python3.pkgs; [ setuptools ];

pkgs/by-name/ob/oberon-risc-emu/package.nix

@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation {
   pname = "oberon-risc-emu";
-  version = "unstable-2020-08-18";
+  version = "2016.1-unstable-2020-08-18";
 
   src = fetchFromGitHub {
     owner = "pdewacht";

pkgs/by-name/pl/planify/package.nix

@@ -29,13 +29,13 @@
 
 stdenv.mkDerivation rec {
   pname = "planify";
-  version = "4.15.2";
+  version = "4.16.0";
 
   src = fetchFromGitHub {
     owner = "alainm23";
     repo = "planify";
     tag = "v${version}";
-    hash = "sha256-i6yAObfSMZyHHK/1YUFppU9gcFJj7WL48Eqe6IQAh4M=";
+    hash = "sha256-uNcTP//9YpdwHbZ49jKlrvK8wxCJK3oSrOMjoGAcDjk=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/pl/pleroma/package.nix

@@ -1,6 +1,7 @@
 {
+  beam,
+  elixir_1_17,
   lib,
-  beamPackages,
   fetchFromGitHub,
   fetchFromGitLab,
   fetchHex,
@@ -14,6 +15,9 @@
   fetchpatch,
 }:
 
+let
+  beamPackages = beam.packages.erlang_26.extend (self: super: { elixir = elixir_1_17; });
+in
 beamPackages.mixRelease rec {
   pname = "pleroma";
   version = "2.9.1";

pkgs/by-name/pn/pnpm-shell-completion/package.nix

@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "pnpm-shell-completion";
-  version = "0.5.4";
+  version = "0.5.5";
 
   src = fetchFromGitHub {
     owner = "g-plane";
     repo = "pnpm-shell-completion";
     rev = "v${version}";
-    hash = "sha256-bc2ZVHQF+lSAmhy/fvdiVfg9uzPPcXYrtiNChjkjHtA=";
+    hash = "sha256-lwtRSl0/oqgvFUtCkgExAVTiUt+7PwAD/8ufl+1MIMY=";
   };
 
-  cargoHash = "sha256-JL9bWVHmdSktOEF70WMOmZKdZwO/gNDp0GPDMYteR1E=";
+  cargoHash = "sha256-/G+wiGlQ1UqH2uWmz55klsu1t6zBrwlv1XH3X+CAPQg=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/po/postfix-tlspol/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "postfix-tlspol";
-  version = "1.8.21";
+  version = "1.8.22";
 
   src = fetchFromGitHub {
     owner = "Zuplu";
     repo = "postfix-tlspol";
     tag = "v${version}";
-    hash = "sha256-EBgP2gwq3pei2TBNuinyY2PgLKaV6PBmk3aCkecGvk4=";
+    hash = "sha256-mE6vcXAmlJZSV4q4van4/PeiAadw50OXC6NujrLH4p4=";
   };
 
   vendorHash = null;

pkgs/by-name/py/pyfa/package.nix

@@ -5,6 +5,7 @@
   gsettings-desktop-schemas,
   adwaita-icon-theme,
   wrapGAppsHook3,
+  gobject-introspection,
   gdk-pixbuf,
   makeDesktopItem,
   copyDesktopItems,
@@ -51,6 +52,7 @@ python3Packages.buildPythonApplication rec {
     numpy
     python-jose
     requests-cache
+    pygobject3
   ];
 
   buildInputs = [
@@ -62,6 +64,7 @@ python3Packages.buildPythonApplication rec {
   dontWrapGApps = true;
   nativeBuildInputs = [
     python3Packages.pyinstaller
+    gobject-introspection
     wrapGAppsHook3
     copyDesktopItems
   ];

pkgs/by-name/qu/qui/package.nix

@@ -0,0 +1,87 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  stdenvNoCC,
+  nix-update-script,
+  nodejs,
+  pnpm_9,
+  typescript,
+  versionCheckHook,
+}:
+buildGoModule (finalAttrs: {
+  pname = "qui";
+  version = "1.7.0";
+  src = fetchFromGitHub {
+    owner = "autobrr";
+    repo = "qui";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-CbPdngskDCAAhmsj5DPdnviZSWM0bO13Pbe7wRwaNaw=";
+  };
+
+  qui-web = stdenvNoCC.mkDerivation (finalAttrs': {
+    pname = "${finalAttrs.pname}-web";
+    inherit (finalAttrs) src version;
+
+    nativeBuildInputs = [
+      nodejs
+      pnpm_9.configHook
+      typescript
+    ];
+
+    sourceRoot = "${finalAttrs.src.name}/web";
+
+    pnpmDeps = pnpm_9.fetchDeps {
+      inherit (finalAttrs')
+        pname
+        version
+        src
+        sourceRoot
+        ;
+      fetcherVersion = 2;
+      hash = "sha256-WKoWts+/TGcGy/rFEJN3Qn/vq+gj+Mq+VcTYowEyvus=";
+    };
+
+    postBuild = ''
+      pnpm run build
+    '';
+
+    installPhase = ''
+      cp -r dist $out
+    '';
+  });
+
+  vendorHash = "sha256-rmUEFX8UzxEN7XaJ8Zj+kj3z1pwLkq3FTYzbPWnifW0=";
+
+  preBuild = ''
+    cp -r ${finalAttrs.qui-web}/* web/dist
+  '';
+
+  ldflags = [
+    "-X github.com/autobrr/qui/internal/buildinfo.Version=${finalAttrs.version}"
+    "-X main.PolarOrgID="
+  ];
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = "version";
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--subpackage"
+      "qui-web"
+    ];
+  };
+
+  meta = {
+    description = "Modern alternative webUI for qBittorrent, with multi-instance support";
+    license = lib.licenses.gpl2Plus;
+    homepage = "https://github.com/autobrr/qui";
+    changelog = "https://github.com/autobrr/qui/releases/tag/v${finalAttrs.version}";
+    maintainers = with lib.maintainers; [ pta2002 ];
+    mainProgram = "qui";
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/re/reposilite/package.nix

@@ -18,11 +18,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "Reposilite";
-  version = "3.5.25";
+  version = "3.5.26";
 
   src = fetchurl {
     url = "https://maven.reposilite.com/releases/com/reposilite/reposilite/${finalAttrs.version}/reposilite-${finalAttrs.version}-all.jar";
-    hash = "sha256-g1a+9TGRqRK4qcJW2ZACsiew5f27T4qkm/A+c7sVxHI=";
+    hash = "sha256-JSvp4Ka/98AkeExrSA2WCNoqMQAmpCllIRNyHzhkzqM=";
   };
 
   dontUnpack = true;

pkgs/by-name/re/reposilite/plugins.json

@@ -1,7 +1,7 @@
 {
-  "checksum": "sha256-NAB69EvfAP/2EegqR9ni5bdk5MtYd/Rzn40nUqfivfY=",
-  "groovy": "sha256-WjQy9nUz3LWv/AaTyZFfD/55ukt/FaXrGF3h7tc8KJg=",
-  "migration": "sha256-djEeQIwfNxgaMmPAmQQT+KC1qwP58sjEbQI6nqqTKNo=",
-  "prometheus": "sha256-avwHOdv0kj9TrK9fxhGTNzyFTn0Rjr70PTNDeyUz4cw=",
-  "swagger": "sha256-8Zit1SWYVJv+hn+VR38QBTSMuyucnaNfZePNPN6LhI8="
+  "checksum": "sha256-MSQMx4bD59cTnKb6u5tV2twFkOwSNPs5i5boknuXzbU=",
+  "groovy": "sha256-3/YRKsAsPhghxacLGQp/GvNJ6RHqGhmVwx3iPn5epgw=",
+  "migration": "sha256-HxWKemXxeuhNgfFtj8ztKu8hZVhN8suI2KnS94Qg8G0=",
+  "prometheus": "sha256-Y+d+HudqEgLR5a5u9kq66w6Y0sYhjBDIYBsBUAYl06w=",
+  "swagger": "sha256-a3yoOWxIhXb/pHlstPTBE1DnLBjchKxbIU1G/5kB6Mc="
 }

pkgs/by-name/ru/runme/package.nix

@@ -13,16 +13,16 @@
 
 buildGoModule rec {
   pname = "runme";
-  version = "3.15.4";
+  version = "3.16.1";
 
   src = fetchFromGitHub {
     owner = "runmedev";
     repo = "runme";
     rev = "v${version}";
-    hash = "sha256-RU2VU+yLBrnj9Gf1p0kB2Y6rfPaXIDQ8oMs2MaoJ5kM=";
+    hash = "sha256-cIlX2RvZ5jIdh7+EvjIb8KC4b/3rhkinUsomkJIBYMw=";
   };
 
-  vendorHash = "sha256-Uw5igaQpKKI4y7EoznFdmyTXfex350Pps6nt3lvKeAM=";
+  vendorHash = "sha256-cGoeRjUB5py8yMvWrw2NaRaVb0kcYxXC1eD4cJNsqz8=";
 
   nativeBuildInputs = [
     installShellFiles
@@ -76,6 +76,6 @@ buildGoModule rec {
     homepage = "https://runme.dev";
     changelog = "https://github.com/runmedev/runme/releases/tag/v${version}";
     license = lib.licenses.asl20;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ _7karni ];
   };
 }

pkgs/by-name/si/signal-desktop/package.nix

@@ -3,7 +3,7 @@
   lib,
   nodejs_22,
   pnpm_10,
-  electron_38,
+  electron_39,
   python3,
   makeWrapper,
   callPackage,
@@ -23,7 +23,7 @@
 let
   nodejs = nodejs_22;
   pnpm = pnpm_10.override { inherit nodejs; };
-  electron = electron_38;
+  electron = electron_39;
 
   libsignal-node = callPackage ./libsignal-node.nix { inherit nodejs; };
   signal-sqlcipher = callPackage ./signal-sqlcipher.nix { inherit pnpm nodejs; };
@@ -52,13 +52,13 @@ let
     '';
   });
 
-  version = "7.79.0";
+  version = "7.80.0";
 
   src = fetchFromGitHub {
     owner = "signalapp";
     repo = "Signal-Desktop";
     tag = "v${version}";
-    hash = "sha256-2eEUOOmJuS/MYC+M7tkWaxFTulnFUGuKE+eiD2gIIpw=";
+    hash = "sha256-CU304F6Ib4j/0/BqGUidV9uYUrsvIahpsCYVgr8MWFg=";
   };
 
   sticker-creator = stdenv.mkDerivation (finalAttrs: {
@@ -134,15 +134,15 @@ stdenv.mkDerivation (finalAttrs: {
     fetcherVersion = 1;
     hash =
       if withAppleEmojis then
-        "sha256-Gx7+/vVjYRM4oBWnUFpxWSLjha2t3nLmaZjjzDlKf+Y="
+        "sha256-7zw9qmnQt5NYRKI4bLCM5Hg0d/6kVKovy1k8CpZ/1R8="
       else
-        "sha256-YhxoyNTvtmpo/v0ef+T9OMMvwHqC/PGEwY3cUQ+EtPg=";
+        "sha256-Mya7v0uhjP4GVyD412SMiQ8/YHaq99fDIjGHCJOIWxY=";
   };
 
   env = {
     ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
     SIGNAL_ENV = "production";
-    SOURCE_DATE_EPOCH = 1762988949;
+    SOURCE_DATE_EPOCH = 1763594452;
   };
 
   preBuild = ''

pkgs/by-name/sp/spasm-ng/package.nix

@@ -12,7 +12,7 @@
 stdenv.mkDerivation {
   pname = "spasm-ng";
 
-  version = "unstable-2022-07-05";
+  version = "0.5-beta.3-unstable-2022-07-05";
 
   src = fetchFromGitHub {
     owner = "alberthdev";

pkgs/by-name/st/stb/package.nix

@@ -38,6 +38,7 @@ stdenv.mkDerivation rec {
     runHook preInstall
     mkdir -p $out/include/stb
     cp *.h $out/include/stb/
+    cp *.c $out/include/stb/
     runHook postInstall
   '';
 

pkgs/by-name/sw/swaglyrics/package.nix

@@ -7,7 +7,7 @@
 
 python3.pkgs.buildPythonApplication {
   pname = "swaglyrics";
-  version = "unstable-2021-06-17";
+  version = "1.2.2-unstable-2021-06-17";
   pyproject = true;
 
   src = fetchFromGitHub {

pkgs/by-name/te/tektoncd-cli/package.nix

@@ -14,13 +14,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "tektoncd-cli";
-  version = "0.42.0";
+  version = "0.43.0";
 
   src = fetchFromGitHub {
     owner = "tektoncd";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    sha256 = "sha256-WB3XsXT8bXo2GpHC6hGKilRwloy31y18JD09cQklsV0=";
+    sha256 = "sha256-75pyN+Sr5IttqrQYIveePabcuxnx8G48aiP5rw2v/Jo=";
   };
 
   vendorHash = null;

pkgs/by-name/ty/tyrolienne/package.nix

@@ -0,0 +1,82 @@
+{
+  lib,
+  rustPlatform,
+  copyDesktopItems,
+  fetchFromGitea,
+  ffmpeg,
+  imagemagick,
+  libadwaita,
+  makeDesktopItem,
+  nix-update-script,
+  pkg-config,
+  wrapGAppsHook4,
+  zenity,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "tyrolienne";
+  version = "1.1.0";
+
+  src = fetchFromGitea {
+    domain = "git.uku3lig.net";
+    owner = "uku";
+    repo = "tyrolienne";
+    tag = finalAttrs.version;
+    hash = "sha256-LJZxQLATVGEhb0HK8PO3Fe+N+GjJdwX1Z7mOCIwQkqo=";
+  };
+
+  cargoHash = "sha256-ax8Akv26XFFxKVstUIAHUDKypzkJOS8mpBDIT3NfBbE=";
+
+  nativeBuildInputs = [
+    copyDesktopItems
+    imagemagick
+    pkg-config
+    wrapGAppsHook4
+  ];
+
+  buildInputs = [ libadwaita ];
+
+  # Tests are disabled because there are none, avoids having to recompile everything twice
+  doCheck = false;
+
+  postInstall = ''
+    for size in 16 32 48 128 256; do
+      dir="$out/share/icons/hicolor/''${size}x''${size}/apps"
+      mkdir -p "$dir"
+      magick data/icons/tyrolienne.png -resize ''${size}x "$dir/net.uku3lig.tyrolienne.png"
+    done
+  '';
+
+  preFixup = ''
+    gappsWrapperArgs+=(
+      --prefix PATH : ${
+        lib.makeBinPath [
+          ffmpeg
+          zenity
+        ]
+      }
+    )
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "net.uku3lig.tyrolienne";
+      desktopName = "Tyrolienne";
+      type = "Application";
+      comment = "Compresses and uploads videos to Zipline";
+      exec = "tyrolienne";
+      icon = "net.uku3lig.tyrolienne";
+      terminal = false;
+    })
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Simple tool to convert, upload, and embed videos to Zipline";
+    homepage = "https://git.uku3lig.net/uku/tyrolienne";
+    license = lib.licenses.mpl20;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ uku3lig ];
+    mainProgram = "tyrolienne";
+  };
+})

pkgs/by-name/ve/versitygw/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "versitygw";
-  version = "1.0.18";
+  version = "1.0.19";
 
   src = fetchFromGitHub {
     owner = "versity";
     repo = "versitygw";
     tag = "v${version}";
-    hash = "sha256-IZWcRlVfXAZjkgwD9sdIX6Z2YEshkV+q4vUwPFSB5P4=";
+    hash = "sha256-Cz8hxw+10Cg112Qu+9/FTDWVaf2COBzVJDxZkt8c4Yg=";
   };
 
-  vendorHash = "sha256-L7cxMkPJVDG91PXWA3eu0hWRcDfbp3U3HKXc1IziCBM=";
+  vendorHash = "sha256-R2UxUaqPaQ1TPYI79rmIHVqTDceuqhSdRb03OqI2fBc=";
 
   doCheck = false; # Require access to online S3 services
 

pkgs/by-name/ya/yara-x/package.nix

@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "yara-x";
-  version = "1.9.0";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "VirusTotal";
     repo = "yara-x";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yoQoAtgXBgniNebU9HMxF1m0UHFD6iU095he9tCNNIo=";
+    hash = "sha256-aRFDutYFD476xq2TTVWB5CxF1pi3C24NJpfc5kD+aNA=";
   };
 
-  cargoHash = "sha256-/HMyNofKpeYaFfRcZ1LAb3vfW/TQy+DsILXRCpJFlCQ=";
+  cargoHash = "sha256-CT+walpFIFTaO480ATHO1E38K9Tw14QqLRYzztWQmeA=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/yt/ytdl-sub/package.nix

@@ -8,14 +8,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "ytdl-sub";
-  version = "2025.11.07.post1";
+  version = "2025.11.18";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jmbannon";
     repo = "ytdl-sub";
     tag = version;
-    hash = "sha256-gg4KcYLnHKpIJKhL8x1xUDf38LvmTIc/mgd0Py6Uoe4=";
+    hash = "sha256-dvgQoHSSPsiJdve5O+Mf4oFWAc/1/fuAzzOp2ywe0kU=";
   };
 
   postPatch = ''

pkgs/development/python-modules/boto3-stubs/default.nix

@@ -358,13 +358,13 @@
 
 buildPythonPackage rec {
   pname = "boto3-stubs";
-  version = "1.41.0";
+  version = "1.41.1";
   pyproject = true;
 
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit version;
-    hash = "sha256-dNE48tL19IFAvoHWgHIrAZTgm8340ggKkUwh0nfCz+M=";
+    hash = "sha256-dRusG/uvyg2zCzbfAjxiKtqU2mG1OjMl31SQdZ/7bG8=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/channels/default.nix

@@ -9,22 +9,19 @@
   pytest-asyncio,
   pytest-django,
   pytestCheckHook,
-  pythonOlder,
   setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "channels";
-  version = "4.3.1";
+  version = "4.3.2";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
-
   src = fetchFromGitHub {
     owner = "django";
     repo = "channels";
     tag = version;
-    hash = "sha256-dRKK6AQNlPdBQumbLmPyOTW96N/PJ9yUY6GYe5x/c+A=";
+    hash = "sha256-KBjxaK2j9Xbz35IHqZK68cSLkUk4B7t+J7omcQAtuFM=";
   };
 
   build-system = [ setuptools ];
@@ -56,7 +53,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Brings event-driven capabilities to Django with a channel system";
     homepage = "https://github.com/django/channels";
-    changelog = "https://github.com/django/channels/blob/${version}/CHANGELOG.txt";
+    changelog = "https://github.com/django/channels/blob/${src.tag}/CHANGELOG.txt";
     license = licenses.bsd3;
     maintainers = with maintainers; [ fab ];
   };

pkgs/development/python-modules/dissect-jffs/default.nix

@@ -4,31 +4,28 @@
   dissect-cstruct,
   dissect-util,
   fetchFromGitHub,
-  pythonOlder,
   setuptools,
   setuptools-scm,
 }:
 
 buildPythonPackage rec {
   pname = "dissect-jffs";
-  version = "1.5";
+  version = "1.6";
   pyproject = true;
 
-  disabled = pythonOlder "3.9";
-
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "dissect.jffs";
     tag = version;
-    hash = "sha256-HXGmZZd+fYnOCEpffdZe9dOLJS3jY7dIrb6rmhgbYyw=";
+    hash = "sha256-yzEaOVP4QOQD24cxy+GKS0mQRvYD4GcPwYydwrzFqXs=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     setuptools
     setuptools-scm
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     dissect-cstruct
     dissect-util
   ];

pkgs/development/python-modules/dissect-ole/default.nix

@@ -6,21 +6,18 @@
   fetchFromGitHub,
   setuptools,
   setuptools-scm,
-  pythonOlder,
 }:
 
 buildPythonPackage rec {
   pname = "dissect-ole";
-  version = "3.11";
+  version = "3.12";
   pyproject = true;
 
-  disabled = pythonOlder "3.9";
-
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "dissect.ole";
     tag = version;
-    hash = "sha256-KdqEZxZ2V3AKHgpHfXmnw4sh+P8ZPOMvbRq0xENwiX8=";
+    hash = "sha256-ctPc9YLvu8IIEdgcSSYOvpQeqcrcLgTSZtzSiAvgCWk=";
   };
 
   build-system = [

pkgs/development/python-modules/findimports/default.nix

@@ -3,22 +3,19 @@
   buildPythonPackage,
   fetchFromGitHub,
   python,
-  pythonOlder,
   setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "findimports";
-  version = "2.6.0";
+  version = "2.7.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
-
   src = fetchFromGitHub {
     owner = "mgedmin";
     repo = "findimports";
     tag = version;
-    hash = "sha256-2hhonlv7FF4s+wDOsBGnLsMxJEXlMlNbLEkI8HptyOI=";
+    hash = "sha256-ztbf9F1tz5EhqSkE8W6i7ihJYJTymKQdXI+K/G7DbHM=";
   };
 
   build-system = [ setuptools ];
@@ -37,7 +34,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Module for the analysis of Python import statements";
     homepage = "https://github.com/mgedmin/findimports";
-    changelog = "https://github.com/mgedmin/findimports/blob/${version}/CHANGES.rst";
+    changelog = "https://github.com/mgedmin/findimports/blob/${src.tag}/CHANGES.rst";
     license = with licenses; [
       gpl2Only # or
       gpl3Only

pkgs/development/python-modules/iamdata/default.nix

@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "iamdata";
-  version = "0.1.202511201";
+  version = "0.1.202511211";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${version}";
-    hash = "sha256-fSttA/OKKiOk6V6wr/LZisIuDFkzoJm3zZRJiTfNHjs=";
+    hash = "sha256-2kyHYYmSywok0ZqneSKjhcnSZX6fB3jN7Jub65n/ceI=";
   };
 
   __darwinAllowLocalNetworking = true;

pkgs/development/python-modules/mitogen/default.nix

@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "mitogen";
-  version = "0.3.31";
+  version = "0.3.32";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mitogen-hq";
     repo = "mitogen";
     tag = "v${version}";
-    hash = "sha256-ecDRva+K/caMV9T5W5dxFRwJyGvrURpexOa5bNyXkb4=";
+    hash = "sha256-FYhYo8hnpmXh3U75uOFmiFrKtLpRHwksvxEsCXoLeOc=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/mypy-boto3/default.nix

@@ -150,8 +150,8 @@ in
       "sha256-GTFJ5vTrn2cesnQaPzJzXb3Zd53rzDOA6LyH2lprvug=";
 
   mypy-boto3-autoscaling =
-    buildMypyBoto3Package "autoscaling" "1.41.0"
-      "sha256-a8Z+OxMamZn9fiLrHT55EPqdA4QBhz/5NOqY5DJ6U2E=";
+    buildMypyBoto3Package "autoscaling" "1.41.1"
+      "sha256-oKPvn6pv2wRPu2l3oNOphUgkaAFq+HmhCUXTi71FxLk=";
 
   mypy-boto3-autoscaling-plans =
     buildMypyBoto3Package "autoscaling-plans" "1.41.0"
@@ -174,12 +174,12 @@ in
       "sha256-RW7RKSjeP70MrVWw7Ol5b17FMKvm7E6xHcNh0lwQY4w=";
 
   mypy-boto3-braket =
-    buildMypyBoto3Package "braket" "1.41.0"
-      "sha256-2nufCU050tK3YSXvE7+ZgQZ7+WhxUxdNnBDlfvxggD0=";
+    buildMypyBoto3Package "braket" "1.41.1"
+      "sha256-vkaaGr3aFi+v+g41Np4vwhZGggG/l4W4Ps/rih0JhSQ=";
 
   mypy-boto3-budgets =
-    buildMypyBoto3Package "budgets" "1.41.0"
-      "sha256-m/PWIW+w2Jr7PN0topwKDtfOWcyt0A/PiwqRanuQKnA=";
+    buildMypyBoto3Package "budgets" "1.41.1"
+      "sha256-n0gipTIbrw5NiLK26uhDpIww2Dlw6GFaHmnzzzkBt4M=";
 
   mypy-boto3-ce =
     buildMypyBoto3Package "ce" "1.41.0"
@@ -230,8 +230,8 @@ in
       "sha256-iuHl3slhnfM5R5eFiQwzX8N/Tki7CB/GseC8drzBj0M=";
 
   mypy-boto3-cloudfront =
-    buildMypyBoto3Package "cloudfront" "1.41.0"
-      "sha256-AJobxl5lk6qMCw0jaCe50Es0dne5tFvg2Y1AsVhRIkg=";
+    buildMypyBoto3Package "cloudfront" "1.41.1"
+      "sha256-ccQGB53br+K60woFky3RkNM0WtwtKsY+ECRCFq9x/q4=";
 
   mypy-boto3-cloudhsm =
     buildMypyBoto3Package "cloudhsm" "1.41.0"
@@ -250,8 +250,8 @@ in
       "sha256-A/9+Pz/wgy2k7tcQXhp2VduZbXVnAh6C8vJ+sneyckE=";
 
   mypy-boto3-cloudtrail =
-    buildMypyBoto3Package "cloudtrail" "1.41.0"
-      "sha256-1Pu/8nnFxtRvJiHTUnv672m1/asEeKunpWK2RDGDlFw=";
+    buildMypyBoto3Package "cloudtrail" "1.41.1"
+      "sha256-jPokAbjnIKWlJivK2unV9yV1fbtqYnQZCJmjm3/JqVo=";
 
   mypy-boto3-cloudtrail-data =
     buildMypyBoto3Package "cloudtrail-data" "1.41.0"
@@ -338,8 +338,8 @@ in
       "sha256-sQf9PZa1RxwsUx7iYT5Ynp7mH8yPTKsWUhAkGdcXIBs=";
 
   mypy-boto3-connect =
-    buildMypyBoto3Package "connect" "1.41.0"
-      "sha256-k9B3lZ309sQWaq0DoFiRwS83MChgB6pAcbUDq22m5MQ=";
+    buildMypyBoto3Package "connect" "1.41.1"
+      "sha256-h9foKpV654Ff18bTsFjTgQ4U1CFUR2QHP4bTEQJCmzM=";
 
   mypy-boto3-connect-contact-lens =
     buildMypyBoto3Package "connect-contact-lens" "1.41.0"
@@ -382,8 +382,8 @@ in
       "sha256-e/bO3WVgx9LsA7qvlI/A26pqwtREkyB9AMhRiqxPNE0=";
 
   mypy-boto3-datasync =
-    buildMypyBoto3Package "datasync" "1.41.0"
-      "sha256-AG2BiSvd3Z3bhlT486OjiZd522b7rbTi0BJBZP2w0p8=";
+    buildMypyBoto3Package "datasync" "1.41.1"
+      "sha256-soc/b4zlSAvvUsy5/7Qa53XGCv3xrt1BtiYH+ZrT+fA=";
 
   mypy-boto3-dax =
     buildMypyBoto3Package "dax" "1.41.0"
@@ -394,8 +394,8 @@ in
       "sha256-kA5DMRWtDouDlnmbeitWxzvcqA9wHVHgtouDhuIADXc=";
 
   mypy-boto3-devicefarm =
-    buildMypyBoto3Package "devicefarm" "1.41.0"
-      "sha256-Ie1BSBlKkV79MV1qeQPMtlY8ZJEEdM2Twj/vhXJFbUA=";
+    buildMypyBoto3Package "devicefarm" "1.41.1"
+      "sha256-gZOpY/F1Rmo/po2KpILBh+BMueHDN/Bny+8HNkYk3L8=";
 
   mypy-boto3-devops-guru =
     buildMypyBoto3Package "devops-guru" "1.41.0"
@@ -414,8 +414,8 @@ in
       "sha256-6BsKG8DMvuKMgyYyoW/31N03czHLTFKzb5C/DCVZMBM=";
 
   mypy-boto3-dms =
-    buildMypyBoto3Package "dms" "1.41.0"
-      "sha256-DrFRqxTu7Yu3WL9vsJFq4GM9jpraP1hY0riO2gSAEaA=";
+    buildMypyBoto3Package "dms" "1.41.1"
+      "sha256-aT8zZArTo2AaKZUc6SFkSlfbhH/L0zNIVataHGXJkaU=";
 
   mypy-boto3-docdb =
     buildMypyBoto3Package "docdb" "1.41.0"
@@ -446,8 +446,8 @@ in
       "sha256-8fFnQpctLyNEZrsKI94tcpy7XAN8+ULGsih2oihHcyg=";
 
   mypy-boto3-ec2 =
-    buildMypyBoto3Package "ec2" "1.41.0"
-      "sha256-uvqn0Xx2IooWG+PUvPAh1HmEKaO4SfDyqOwhe0sYUPI=";
+    buildMypyBoto3Package "ec2" "1.41.1"
+      "sha256-UcvnDV+HbSEob1QYIxid5scGaLCXhuWD6Fq0v3D3ieo=";
 
   mypy-boto3-ec2-instance-connect =
     buildMypyBoto3Package "ec2-instance-connect" "1.41.0"
@@ -462,8 +462,8 @@ in
       "sha256-O05+5uzp7lmM7N0jvVKgZuvnqh+zz6HiSvOxtKq56sg=";
 
   mypy-boto3-ecs =
-    buildMypyBoto3Package "ecs" "1.41.0"
-      "sha256-MLI/7uKh8yvEVeUDU/Sy7DwrrT3VBqGODx+zNVIcGVU=";
+    buildMypyBoto3Package "ecs" "1.41.1"
+      "sha256-4Pkp2x9ClR8I2oAiHcHhJbuU4bUGcQQ6v7L2B2RGKO0=";
 
   mypy-boto3-efs =
     buildMypyBoto3Package "efs" "1.41.0"
@@ -494,12 +494,12 @@ in
       "sha256-Qxp3B2PJ/RKE+n4gUxnalGIVqkdB8Ta/zHyJ5lvtflM=";
 
   mypy-boto3-elbv2 =
-    buildMypyBoto3Package "elbv2" "1.41.0"
-      "sha256-k6hbyZO+uRTIbGiNxm87Ybc7i9LCQ6CIrZj1nCg/KNk=";
+    buildMypyBoto3Package "elbv2" "1.41.1"
+      "sha256-vDaagCc7Av5dF0dvem8QEGYD3LZALN9XH9bxWrcgicE=";
 
   mypy-boto3-emr =
-    buildMypyBoto3Package "emr" "1.41.0"
-      "sha256-c8dsPpKA6yVGIbfbRh9ST8zQTRsLu7wfC2v77tOM6q4=";
+    buildMypyBoto3Package "emr" "1.41.1"
+      "sha256-eb5sluqEMtbazfA1wbMxF1bN7vRRDeIpq5Ej7gfN5UU=";
 
   mypy-boto3-emr-containers =
     buildMypyBoto3Package "emr-containers" "1.41.0"
@@ -574,8 +574,8 @@ in
       "sha256-v+p1OJoW9sBuO6uXlRolDD9Kk3bksb0jXLYSpzeR8U0=";
 
   mypy-boto3-glue =
-    buildMypyBoto3Package "glue" "1.41.0"
-      "sha256-uV3/B1d6VMzyE9AsFJTKYyW0OBnWgISCbU3bjX9zqxI=";
+    buildMypyBoto3Package "glue" "1.41.1"
+      "sha256-ke65iQ5nhPzTElnocBO2asAfy5U5GMO0tXCTDIPueuQ=";
   mypy-boto3-grafana =
     buildMypyBoto3Package "grafana" "1.41.0"
       "sha256-VxPgHHmT0p2YQuCnVfi7pNIFuUEaNCBJkghTXqP6e1E=";
@@ -613,8 +613,8 @@ in
       "sha256-WsohLrGnt4ZMcOEdjbjK5057XeLwZ0ujbJD8AqajxW8=";
 
   mypy-boto3-imagebuilder =
-    buildMypyBoto3Package "imagebuilder" "1.41.0"
-      "sha256-gOFH/0ILcXgIW+2eHIFoDcP2MHggIDKr6M569rGycuM=";
+    buildMypyBoto3Package "imagebuilder" "1.41.1"
+      "sha256-7W5dkciCl7gcBD4JuxJXV8Q99NHjUYtx5kUYHb12HWk=";
 
   mypy-boto3-importexport =
     buildMypyBoto3Package "importexport" "1.41.0"
@@ -729,8 +729,8 @@ in
       "sha256-PMjUlZgqSulMtKuHr/LTHGPL39spvSQSBhyL3g09Z7k=";
 
   mypy-boto3-kinesis =
-    buildMypyBoto3Package "kinesis" "1.41.0"
-      "sha256-QXMKPuGxr+bCQlweHA+lHoKF3jBGG4cBJyX3j0LHUnc=";
+    buildMypyBoto3Package "kinesis" "1.41.1"
+      "sha256-3lAGq+cwJ9L2765hbx9Ij9alKGEV33VbYnzmoBdMjOk=";
 
   mypy-boto3-kinesis-video-archived-media =
     buildMypyBoto3Package "kinesis-video-archived-media" "1.41.0"
@@ -765,8 +765,8 @@ in
       "sha256-Wp0iq5lAgQwm96krIGpPzHUSHS8DbRtr+uFC15WCm6o=";
 
   mypy-boto3-lakeformation =
-    buildMypyBoto3Package "lakeformation" "1.41.0"
-      "sha256-EajE0a6k9p6XTui6nruNCzN0Ot5z4xS5ZL9bGfkb9AE=";
+    buildMypyBoto3Package "lakeformation" "1.41.1"
+      "sha256-cj73uXbKmtsTh2l5qBv14RFAmnTgr04JLQK9EyJhjSA=";
 
   mypy-boto3-lambda =
     buildMypyBoto3Package "lambda" "1.41.0"
@@ -789,8 +789,8 @@ in
       "sha256-8GLOqOph4BG3mFcwLVXZ4qinPsSi3YCYMQhgu5g1Jvk=";
 
   mypy-boto3-license-manager =
-    buildMypyBoto3Package "license-manager" "1.41.0"
-      "sha256-j32PWYxkTh7r4cB/L+JpYeddl7KU46naoy+ZI9kd2/Q=";
+    buildMypyBoto3Package "license-manager" "1.41.1"
+      "sha256-AQiCEmxX4kBGt2088BSt94AaFpe/N1WZin36gUo+yv8=";
 
   mypy-boto3-license-manager-linux-subscriptions =
     buildMypyBoto3Package "license-manager-linux-subscriptions" "1.41.0"
@@ -953,8 +953,8 @@ in
       "sha256-0rtTR067/fJ9ZocM6QNDqA5x0CEqjO4uKA8WMB/wOtE=";
 
   mypy-boto3-networkmanager =
-    buildMypyBoto3Package "networkmanager" "1.41.0"
-      "sha256-dzcCZonHrc7Yt4soJUuhE4+tF/qfRaxHJWeieO/MmeI=";
+    buildMypyBoto3Package "networkmanager" "1.41.1"
+      "sha256-QHxkGRF5U/xO8uqVQMJ7k4Vj3kFosjIff1HEWfAZdNI=";
 
   mypy-boto3-nimble =
     buildMypyBoto3Package "nimble" "1.35.0"
@@ -985,8 +985,8 @@ in
       "sha256-JEuEjo0htTuDCZx2nNJK2Zq59oSUqkMf4BrNamerfVk=";
 
   mypy-boto3-organizations =
-    buildMypyBoto3Package "organizations" "1.41.0"
-      "sha256-Ysi3lqJvIEyE1KewQ9jfX71m/GbHpKTDKyZu4Om/j/4=";
+    buildMypyBoto3Package "organizations" "1.41.1"
+      "sha256-onKCxgKRaWRKBhDTBNpUo8BrZgJolV2Exr07vjFuhp0=";
 
   mypy-boto3-osis =
     buildMypyBoto3Package "osis" "1.41.0"
@@ -1073,20 +1073,20 @@ in
       "sha256-YrrEKl3aGz//5Z5JGapHhWtk6hBXQ4cuRQmLqGYztzg=";
 
   mypy-boto3-quicksight =
-    buildMypyBoto3Package "quicksight" "1.41.0"
-      "sha256-ndkiuYmHUSJr2wyR+axlszEORn80QwLy6obJSwE4L+s=";
+    buildMypyBoto3Package "quicksight" "1.41.1"
+      "sha256-hxpZwMRckIBguBLqkQTQNz8indzxF3bYffp6kJEo9VY=";
 
   mypy-boto3-ram =
     buildMypyBoto3Package "ram" "1.41.0"
       "sha256-8migaRgVoR5BkKbd1T1f6IydBhy5D9jGl7AmiEngbBs=";
 
   mypy-boto3-rbin =
-    buildMypyBoto3Package "rbin" "1.41.0"
-      "sha256-DaXgV1Rv/qYPIGczOEGzf0NYPN3iC4ryM21w4nkpjfk=";
+    buildMypyBoto3Package "rbin" "1.41.1"
+      "sha256-pXpULn4yTRRs/MfOCUoACGvgXt8TLQq7ZujEK1l6rZk=";
 
   mypy-boto3-rds =
-    buildMypyBoto3Package "rds" "1.41.0"
-      "sha256-D4WNhRHWymbfYrqybDDns5O5ntJmeaNQrLCz6xBS0zk=";
+    buildMypyBoto3Package "rds" "1.41.1"
+      "sha256-ctmzv5N7phsH0oMY8swFhLAtODG0swu+fhN6tsAJ3BY=";
 
   mypy-boto3-rds-data =
     buildMypyBoto3Package "rds-data" "1.41.0"
@@ -1097,8 +1097,8 @@ in
       "sha256-KedvA/5nwKm8XQu+dd+5wHd7+3TF6KFufBWdxSyFswM=";
 
   mypy-boto3-redshift-data =
-    buildMypyBoto3Package "redshift-data" "1.41.0"
-      "sha256-lODk0m+u2BqZbdyoCVcBVE7JGC7Jh+dYZPFQtRKH2/g=";
+    buildMypyBoto3Package "redshift-data" "1.41.1"
+      "sha256-TyG0MmalnHdViX428FiumY+oy6UohOhtxkF8BMWDGMo=";
 
   mypy-boto3-redshift-serverless =
     buildMypyBoto3Package "redshift-serverless" "1.41.0"
@@ -1161,8 +1161,8 @@ in
       "sha256-Z4dEVofTPpv5cPLNUqK0SNY/PIjzN3TuK0aGtX5GcBE=";
 
   mypy-boto3-s3 =
-    buildMypyBoto3Package "s3" "1.41.0"
-      "sha256-DhQkavncABFF5FDhCvqs6Y/FJJwhMXlojgXm2cDc4go=";
+    buildMypyBoto3Package "s3" "1.41.1"
+      "sha256-FDG7avMbr/zReGC+Gfe/JVhuMxI3L0M8z68GMrHjIJc=";
 
   mypy-boto3-s3control =
     buildMypyBoto3Package "s3control" "1.41.0"
@@ -1173,8 +1173,8 @@ in
       "sha256-Bi97uNPPzYVxPhs1OSYnQPq4HtQ11q9sZHxwRa4q7rM=";
 
   mypy-boto3-sagemaker =
-    buildMypyBoto3Package "sagemaker" "1.41.0"
-      "sha256-AywXhE2uJIRtT1E1qAnj86IqtsVmHfbYzznPLkea82Y=";
+    buildMypyBoto3Package "sagemaker" "1.41.1"
+      "sha256-RvAe5ZhwEAoZyrNti8rFolGm03+h3vaMTyLUXsCc8ok=";
 
   mypy-boto3-sagemaker-a2i-runtime =
     buildMypyBoto3Package "sagemaker-a2i-runtime" "1.41.0"
@@ -1221,8 +1221,8 @@ in
       "sha256-2Mo8Pkx9/Yi4XPD5VlYnNOjzYIqvn5jpZp3CmMBiTV8=";
 
   mypy-boto3-securityhub =
-    buildMypyBoto3Package "securityhub" "1.41.0"
-      "sha256-zVADzOoa0nOUIQS/ZCBKerwDVKIe/Sht+4wT73xYDFM=";
+    buildMypyBoto3Package "securityhub" "1.41.1"
+      "sha256-AJrT6vmP5C61SLPqiUeeKIcJ2rLVBi49tKdrj8/pAwg=";
 
   mypy-boto3-securitylake =
     buildMypyBoto3Package "securitylake" "1.41.0"

pkgs/development/python-modules/pentapy/default.nix

@@ -0,0 +1,52 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  cython,
+  setuptools,
+  setuptools-scm,
+
+  # dependencies
+  numpy,
+
+  # tests
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "pentapy";
+  version = "1.4.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "GeoStat-Framework";
+    repo = "pentapy";
+    tag = "v${version}";
+    hash = "sha256-lw512rZCrwumDunoWFfd0HxCv0HAn/bAmIz8l8VeBP8=";
+  };
+
+  build-system = [
+    cython
+    numpy
+    setuptools
+    setuptools-scm
+  ];
+
+  dependencies = [
+    numpy
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  meta = {
+    description = "A Python toolbox for pentadiagonal linear systems";
+    homepage = "https://github.com/GeoStat-Framework/pentapy";
+    changelog = "https://github.com/GeoStat-Framework/pentapy/blob/v${version}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    teams = [ lib.teams.geospatial ];
+  };
+}

pkgs/development/python-modules/pykrige/default.nix

@@ -5,6 +5,7 @@
 
   # build-system
   cython,
+  pentapy,
   setuptools,
   setuptools-scm,
 
@@ -21,25 +22,20 @@
 
 buildPythonPackage rec {
   pname = "pykrige";
-  version = "1.7.2";
+  version = "1.7.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "GeoStat-Framework";
     repo = "PyKrige";
     tag = "v${version}";
-    hash = "sha256-9f8SNlt4qiTlXgx2ica9Y8rmnYzQ5VarvFRfoZ9bSsY=";
+    hash = "sha256-zdszmT1LEfYBWzd+m2nITtl0lZHyU0fzszYxANQS6yU=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace-fail "numpy>=2.0.0rc1,<2.3; python_version >= '3.9'" "numpy>=2.0.0" \
-      --replace-fail "Cython>=3.0.10,<3.1.0" "Cython>=3.1.0,<4.0.0"
-  '';
-
   build-system = [
     cython
     numpy
+    pentapy
     scipy
     setuptools
     setuptools-scm
@@ -70,6 +66,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/GeoStat-Framework/PyKrige";
     changelog = "https://github.com/GeoStat-Framework/PyKrige/blob/v${version}/CHANGELOG.md";
     license = lib.licenses.bsd3;
-    maintainers = [ lib.maintainers.sikmir ];
+    teams = [ lib.teams.geospatial ];
   };
 }

pkgs/development/python-modules/python-gitlab/default.nix

@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "python-gitlab";
-  version = "6.3.0";
+  version = "7.0.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "python_gitlab";
     inherit version;
-    hash = "sha256-PXdklWlIlJoqOv8geObpOl7+otsKKVZrXhQgkbzAdao=";
+    hash = "sha256-5Nk0Qw9k78CeYgi3gsYcwKM4lSd2XgP/vvF/QyPc5EE=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/python-toolbox/default.nix

@@ -4,22 +4,19 @@
   docutils,
   fetchFromGitHub,
   pytestCheckHook,
-  pythonOlder,
   setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "python-toolbox";
-  version = "1.2.10";
+  version = "1.3.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.9";
-
   src = fetchFromGitHub {
     owner = "cool-RR";
     repo = "python_toolbox";
     tag = version;
-    hash = "sha256-+Q7r4nbubp2xzkBgEyTuA0EeIvpT4bW+2NnckVkEKcY=";
+    hash = "sha256-pbo4vhypM97OXh6CxK42EbZdrXljvj5rmP9C9RDPo5g=";
   };
 
   build-system = [ setuptools ];
@@ -43,7 +40,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Tools for testing PySnooper";
     homepage = "https://github.com/cool-RR/python_toolbox";
-    changelog = "https://github.com/cool-RR/python_toolbox/releases/tag/${version}";
+    changelog = "https://github.com/cool-RR/python_toolbox/releases/tag/${src.tag}";
     license = licenses.mit;
     maintainers = with maintainers; [ seqizz ];
   };

pkgs/development/python-modules/pyvicare/default.nix

@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "pyvicare";
-  version = "2.55.0";
+  version = "2.55.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "openviess";
     repo = "PyViCare";
     tag = version;
-    hash = "sha256-38fYyxFJRFVCe2LZ+7Naj979Jao4jJgIE1GRcCqXpjU=";
+    hash = "sha256-fKQ0NXUsL8NgmKr8BEoGV2fty39l19fg4B6Eg90X2kI=";
   };
 
   postPatch = ''

pkgs/development/python-modules/ray/default.nix

@@ -17,7 +17,6 @@
   protobuf,
   pyyaml,
   requests,
-  watchfiles,
 
   # optional-dependencies
   # cgraph
@@ -34,28 +33,37 @@
   aiohttp-cors,
   colorful,
   opencensus,
+  opentelemetry-exporter-prometheus,
+  opentelemetry-proto,
+  opentelemetry-sdk,
   prometheus-client,
   pydantic,
   py-spy,
   smart-open,
   virtualenv,
+  # llm
+  async-timeout,
+  hf-transfer,
+  jsonref,
+  ninja,
+  # nixl,
+  typer,
+  vllm,
   # observability
   memray,
-  opentelemetry-api,
-  opentelemetry-sdk,
-  opentelemetry-exporter-otlp,
   # rllib
   dm-tree,
   gymnasium,
   lz4,
-  # ormsgpack,
+  ormsgpack,
   scipy,
-  typer,
-  rich,
   # serve
   fastapi,
   starlette,
   uvicorn,
+  watchfiles,
+  # serve-async-inference
+  celery,
   # serve-grpc
   pyopenssl,
   # tune
@@ -125,7 +133,6 @@ buildPythonPackage rec {
     protobuf
     pyyaml
     requests
-    watchfiles
   ];
 
   optional-dependencies = lib.fix (self: {
@@ -141,6 +148,8 @@ buildPythonPackage rec {
       ++ self.observability
       ++ self.rllib
       ++ self.serve
+      ++ self.serve-async-inference
+      ++ self.serve-grpc
       ++ self.train
       ++ self.tune
     );
@@ -160,6 +169,9 @@ buildPythonPackage rec {
       colorful
       grpcio
       opencensus
+      opentelemetry-exporter-prometheus
+      opentelemetry-proto
+      opentelemetry-sdk
       prometheus-client
       pydantic
       py-spy
@@ -167,22 +179,34 @@ buildPythonPackage rec {
       smart-open
       virtualenv
     ];
+    llm = lib.unique (
+      [
+        async-timeout
+        hf-transfer
+        jsonref
+        jsonschema
+        ninja
+        # nixl
+        typer
+        vllm
+      ]
+      ++ self.data
+      ++ self.serve
+    );
     observability = [
       memray
-      opentelemetry-api
-      opentelemetry-sdk
-      opentelemetry-exporter-otlp
-    ];
-    rllib = [
-      dm-tree
-      gymnasium
-      lz4
-      # ormsgpack
-      pyyaml
-      scipy
-      typer
-      rich
     ];
+    rllib = lib.unique (
+      [
+        dm-tree
+        gymnasium
+        lz4
+        ormsgpack
+        pyyaml
+        scipy
+      ]
+      ++ self.tune
+    );
     serve = lib.unique (
       [
         fastapi
@@ -193,6 +217,12 @@ buildPythonPackage rec {
       ]
       ++ self.default
     );
+    serve-async-inference = lib.unique (
+      [
+        celery
+      ]
+      ++ self.serve
+    );
     serve-grpc = lib.unique (
       [
         grpcio
@@ -200,7 +230,12 @@ buildPythonPackage rec {
       ]
       ++ self.serve
     );
-    train = self.tune;
+    train = lib.unique (
+      [
+        pydantic
+      ]
+      ++ self.tune
+    );
     tune = [
       fsspec
       pandas

pkgs/development/python-modules/tencentcloud-sdk-python/default.nix

@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1491";
+  version = "3.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = version;
-    hash = "sha256-ygO1D9l0RPWvzTOxuKx7Mc233pgHmY+nmphw82a2U/Y=";
+    hash = "sha256-WYxfVbqpEqM07/2OmPiTkkEhsIxx4KqJ16A/YPIFUm0=";
   };
 
   build-system = [ setuptools ];

pkgs/development/tools/devpod/default.nix

@@ -87,7 +87,9 @@ let
     cargoRoot = "src-tauri";
     buildAndTestSubdir = "src-tauri";
 
-    cargoHash = "sha256-BwuV5nAQcTAtdfK4+NKEt8Cj7gqnatRwHh/BYJJrIPo=";
+    cargoHash = "sha256-PSgBwa8sZ85W2kBrXkFVvnoYn5l1r3Jvn/LG8tITjbU=";
+
+    cargoPatches = [ ./cargo-lock.patch ];
 
     patches = [
       # don't create a .desktop file automatically registered to open the devpod:// URI scheme

pkgs/development/tools/electron/binary/info.json

@@ -12,35 +12,35 @@
     },
     "37": {
         "hashes": {
-            "aarch64-darwin": "10f0143c4590a7eb9f542ff9e26db929a3690120e7010f74df546f164a4e128b",
-            "aarch64-linux": "902f4382f42b94d36d6fb5bd0b5d136b505a56649a81152d14971294ca94fff8",
-            "armv7l-linux": "099a77b3ad0fe3d71d9efa780d2a4be187ba74c03f15714d7c791e3e64b44fcd",
+            "aarch64-darwin": "62d8cd68fec502201db9d4aa940ef9e3ad0004f27e46d6f56c8cf8924da477e7",
+            "aarch64-linux": "deebbca4a0348ff7dd8564ee413bf7ed0d99c8d71951881286115e82bc4f22ba",
+            "armv7l-linux": "1c53701c915b4180bf09557374944a93050a601c2d36ec5ef014f1f1f620e4ab",
             "headers": "0lwcdw882hjb2vhj9vvngkwq5l6nrh7d2hr9adpqdm1any4rssl5",
-            "x86_64-darwin": "b4ea214ca58bce53f45d24acf1e3be245f787b40d3aa8532f71c91624d9502d6",
-            "x86_64-linux": "3a982dbfe21b72929ffcc80c786e0aa106a9e6ebf83ba7c8ed587dc12898c6e4"
+            "x86_64-darwin": "334478ae40a5a1ea2bc33ec787352073d15f50eb7a164dfbc1f9e7abb203ded8",
+            "x86_64-linux": "f773866342de11ba59ca73bb3cf373302839cc3e41c94f6a3ed7c13c110b3b5c"
         },
-        "version": "37.10.0"
+        "version": "37.10.2"
     },
     "38": {
         "hashes": {
-            "aarch64-darwin": "e89ab60544fa0a11775baf9fe027fa8ad2cf54ecf3ec80cd7b883aba8e32a63c",
-            "aarch64-linux": "08965d6d57f78b6cd26fcef0275e3047fd90e9e55ea2ab2c811c5c19364d3813",
-            "armv7l-linux": "220d9fbd00013fa940a4178f1ec5a8b2ac27bc4288fd51d5459afd1ff7f5de6d",
-            "headers": "1f1381qc705fv50sbm0g5f6wm8pkwqvrbhb1kvi3i9mk2910y14m",
-            "x86_64-darwin": "cdc216cca9541be10c4e2ff6a6c540ff1b2ab0947a6bd184917b243968bf9f8b",
-            "x86_64-linux": "21c15c1b6ea52d57c00551ec667d771ddb9ecc6ea2c7431012060f90868f688d"
+            "aarch64-darwin": "90ac7f8b3a6b6efb83fb5e3b85498456932a2897b862b689312ddde8d9d203c1",
+            "aarch64-linux": "0aa21bf35d9c7214b0809f85a101472a92bc7b93cf6bc0fd019b94ba309c9b09",
+            "armv7l-linux": "6ea202c53a5db24c1a50a939e54aa0ba87987eea462e33c5a25530bd243e8532",
+            "headers": "03ml730a2gli6cmr2lnzbjw9apx2zpgviap4xzw5xa9m76jvdc8h",
+            "x86_64-darwin": "c72b7b42b53f154a928b3b6778422ec27ac4123040366aabda80cdce67038470",
+            "x86_64-linux": "d43bd3ff3f7f9f56825f66a29165ff620d84695d4d06769855acf02c4baa7b9c"
         },
-        "version": "38.7.0"
+        "version": "38.7.1"
     },
     "39": {
         "hashes": {
-            "aarch64-darwin": "3ecbe543ebc728d813ea21f16cedebd6b7af812d716b0ede37f1227179a66c3e",
-            "aarch64-linux": "da7db0ead43e1f560fc1ade4aa50d773d75a5c5339d995f08db49b6fb7267c23",
-            "armv7l-linux": "87fc8b6903559deab6c2aada4e03dddba06a0071b10ecdc6a116da0baaeb639d",
-            "headers": "0pnmlknafq1d4hmfhpqpxv87sqrr9rkv3kz0r5y016j7yldjibh0",
-            "x86_64-darwin": "721ec50aac1c2c4ce0930b4f14eb4e5b92ce58ac41f965825dc986eb5f511fee",
-            "x86_64-linux": "c1f2f123dee6896ff09e4b3e504dfbfe42356c0e6b41b33fd849aa19fd50253d"
+            "aarch64-darwin": "2128a27c1b0fd80be9d608fb293639f76611b4108eca1e045c933fd04097a7b1",
+            "aarch64-linux": "c58c5904d6015cbbfa5f04fbda5c83b9a276a3565b5f3fa166795c789b055cdd",
+            "armv7l-linux": "d7c2f0b5038c49b1e637f8dbda945be4e6f3a6d7ebf802543e6ef5093c9641ff",
+            "headers": "0gaz44jv57aava01fvl35kqdl5yaf6ca7dzsx5f279qkpfyrhx2k",
+            "x86_64-darwin": "f8085a04dc35bfe0c32c36e6feffde07de16459bf36dfab422760181717f5ac0",
+            "x86_64-linux": "5eb51ebcb60487c4fc3a5b74ffb57a03eefd48def32200adf310ffaba4153d64"
         },
-        "version": "39.2.0"
+        "version": "39.2.3"
     }
 }

pkgs/development/tools/electron/chromedriver/info.json

@@ -12,35 +12,35 @@
     },
     "37": {
         "hashes": {
-            "aarch64-darwin": "d2c5aeb337610c011007e36142e9bac64c0c3ac225cdf8b41373267b57b1ae98",
-            "aarch64-linux": "3ec3197a0845556d03fd8389354e2e6eb1fb6dfd4ebfbf4d97448e440020777f",
-            "armv7l-linux": "6fd0945a614e98d0a14e5433e427f9e99414c11bce1dbced47e8e2180721ed09",
+            "aarch64-darwin": "30cfb8b90b0fad7cd0ef473fc03e761d28f98e1a398ff255956e3704c6da0727",
+            "aarch64-linux": "8a536ad3e2d2f0b9e99fc3085a9990f6d70c1de676d0f57219d2094ef1805ffd",
+            "armv7l-linux": "b8d774cf0188324538412201be8827d4224d658129eaf5e66f91c0448cc633f2",
             "headers": "0lwcdw882hjb2vhj9vvngkwq5l6nrh7d2hr9adpqdm1any4rssl5",
-            "x86_64-darwin": "049d25c8c23bbc1ff7060a56df071115895b9ba6268396cb69c6a1d6283918c7",
-            "x86_64-linux": "c0b5cd05437b13f0ad83e1bcc5d61a803962f72b29c0af21f4b19d2b8ff193a2"
+            "x86_64-darwin": "9d3655a3c4a409c9d422e762a913bf6d19c5ca728ac1de5a13e6c6e98c4b263a",
+            "x86_64-linux": "2a1fcc98587a23b4022c4d921016f24126ab1071b395760a0339de5f019f9771"
         },
-        "version": "37.10.0"
+        "version": "37.10.2"
     },
     "38": {
         "hashes": {
-            "aarch64-darwin": "41c15283f64be0f0773aa6a2fd44dbf2cdc9c42a5fe523420ae5b0a2f3969e61",
-            "aarch64-linux": "2bb62a5f1d46261847c95694559558dc32a8bf1b7165dce1011a9b1c31a60116",
-            "armv7l-linux": "c9605552bb48935f540f64fbe7c9cc8b3b3067a5989babfacaacf2016ce87230",
-            "headers": "1f1381qc705fv50sbm0g5f6wm8pkwqvrbhb1kvi3i9mk2910y14m",
-            "x86_64-darwin": "3af644d66d45be674a584cf4bfd89aae4f003650222f1ced86ce9c19aaf6c0a3",
-            "x86_64-linux": "479aaeff15da7187a7e24803a2a4325ccc6e9719b00cdc754f052192a137fadc"
+            "aarch64-darwin": "3faa6337db37dbb0e3e11fe66a6c93087bb5db79df25d2f1296a28edad8b2958",
+            "aarch64-linux": "bf0078dd84a4af9c636ecad448f824ebc2a99da10376746d8b1b600746e84de0",
+            "armv7l-linux": "8d41e3c53f5ab9d06b36a2a456cb35604802f1246adb100490a7770bef29a165",
+            "headers": "03ml730a2gli6cmr2lnzbjw9apx2zpgviap4xzw5xa9m76jvdc8h",
+            "x86_64-darwin": "c4ff20f9b683e1907072302c0cfc38ec0c47eca75b71098d916a6a82d87ff1bb",
+            "x86_64-linux": "997ab3fd934c1ac0ab479565e1def9b2eb6fe6d8a23fd585c8d62250ef05c704"
         },
-        "version": "38.7.0"
+        "version": "38.7.1"
     },
     "39": {
         "hashes": {
-            "aarch64-darwin": "98c036b4be864a3b6518142bb82ec329651d74bb3d38c6e8693058e8cb0a22f3",
-            "aarch64-linux": "ee24ebef991438cb8d3be0ec97c06cd63201e7fdbeb85b57b133a0a0fe32519d",
-            "armv7l-linux": "82b4855a5dcc17548da7826fbb6cc2f98cef515ad09aa5c24fad52bb076161cc",
-            "headers": "0pnmlknafq1d4hmfhpqpxv87sqrr9rkv3kz0r5y016j7yldjibh0",
-            "x86_64-darwin": "daae3a502e68195a30700040d428a4edb9e243d9673dcd10c3f01a5cae0474d5",
-            "x86_64-linux": "d11ae58e17f8f3759d67dc03096e979743825a5a4ea793357b550c50c1881b35"
+            "aarch64-darwin": "1e88807c749e69c9a1b2abef105cf30dbec4fddc365afcaa624b1e2df80fe636",
+            "aarch64-linux": "8de5ed25a12029ca999455c1cadf28341ec5e0de87a3a0c27dbb24df99f154b1",
+            "armv7l-linux": "766b16d8b1297738a0d1fa7e44d992142558f6e12820197746913385590f033e",
+            "headers": "0gaz44jv57aava01fvl35kqdl5yaf6ca7dzsx5f279qkpfyrhx2k",
+            "x86_64-darwin": "5cadee0db7684ae48a7f9f4f1310c3f6e1518b0fa88cf3efb36f58984763d43d",
+            "x86_64-linux": "f35049fe3d8dbfdb7c541b59bdca6982b571761bb8cb7fc85515ceaea9451de9"
         },
-        "version": "39.2.0"
+        "version": "39.2.3"
     }
 }

pkgs/development/tools/electron/info.json

@@ -15,8 +15,8 @@
         "deps": {
             "src": {
                 "args": {
-                    "hash": "sha256-hzgDUuflap7gg60jjHO1n8RCFp4QzpRY5ZttCx0wIYA=",
-                    "postFetch": "rm -r $out/third_party/blink/web_tests; rm -r $out/content/test/data; rm -rf $out/courgette/testdata; rm -r $out/extensions/test/data; rm -r $out/media/test/data; ",
+                    "hash": "sha256-I4lltlu5a+8S9Lg2ESAe3jBzDQmCVBLQ5DIulTNYW2U=",
+                    "postFetch": "rm -rf $(find $out/third_party/blink/web_tests ! -name BUILD.gn -mindepth 1 -maxdepth 1); rm -r $out/content/test/data; rm -rf $out/courgette/testdata; rm -r $out/extensions/test/data; rm -r $out/media/test/data; ",
                     "tag": "138.0.7204.251",
                     "url": "https://chromium.googlesource.com/chromium/src.git"
                 },
@@ -56,10 +56,10 @@
             },
             "src/electron": {
                 "args": {
-                    "hash": "sha256-nE6qhNX6k+TqHS6PPZcsQ3BCH1ckkn6/FNPv12TcHQ0=",
+                    "hash": "sha256-I8C0lT1VnNP4fSMp5LReFe8tQj/3IM1Ko6SohY187Cc=",
                     "owner": "electron",
                     "repo": "electron",
-                    "tag": "v37.10.0"
+                    "tag": "v37.10.2"
                 },
                 "fetcher": "fetchFromGitHub"
             },
@@ -1329,7 +1329,7 @@
         "electron_yarn_hash": "0hm126bl9cscs2mjb3yx2yr4b22agqp9r0c5kv25r3lvc020r9pk",
         "modules": "136",
         "node": "22.21.1",
-        "version": "37.10.0"
+        "version": "37.10.2"
     },
     "38": {
         "chrome": "140.0.7339.249",
@@ -1347,8 +1347,8 @@
         "deps": {
             "src": {
                 "args": {
-                    "hash": "sha256-ny2ZfcFpdt53+UbjZExBPpxZ/SJts/3DfxgFqbz4QfI=",
-                    "postFetch": "rm -r $out/third_party/blink/web_tests; rm -r $out/content/test/data; rm -rf $out/courgette/testdata; rm -r $out/extensions/test/data; rm -r $out/media/test/data; ",
+                    "hash": "sha256-XZsQRWZgPe8zAFTpao98dovXQLfkwnQNQDpAgkzeITY=",
+                    "postFetch": "rm -rf $(find $out/third_party/blink/web_tests ! -name BUILD.gn -mindepth 1 -maxdepth 1); rm -r $out/content/test/data; rm -rf $out/courgette/testdata; rm -r $out/extensions/test/data; rm -r $out/media/test/data; ",
                     "tag": "140.0.7339.249",
                     "url": "https://chromium.googlesource.com/chromium/src.git"
                 },
@@ -1388,10 +1388,10 @@
             },
             "src/electron": {
                 "args": {
-                    "hash": "sha256-FFO1VwcyIRtmDRiQ94ar6+fxOg97eeNGfYdqUPZhXPE=",
+                    "hash": "sha256-1C17jQP8TFxBTHhIz+fHB83OFOykzZToPOrwzl+NN9Q=",
                     "owner": "electron",
                     "repo": "electron",
-                    "tag": "v38.7.0"
+                    "tag": "v38.7.1"
                 },
                 "fetcher": "fetchFromGitHub"
             },
@@ -2653,10 +2653,10 @@
         "electron_yarn_hash": "1knhw3blk3bl2a8nl58ik272qj2q0cpqiih5gcsds1na3bbkbn2z",
         "modules": "139",
         "node": "22.21.1",
-        "version": "38.7.0"
+        "version": "38.7.1"
     },
     "39": {
-        "chrome": "142.0.7444.162",
+        "chrome": "142.0.7444.175",
         "chromium": {
             "deps": {
                 "gn": {
@@ -2665,15 +2665,15 @@
                     "version": "0-unstable-2025-09-18"
                 }
             },
-            "version": "142.0.7444.162"
+            "version": "142.0.7444.175"
         },
         "chromium_npm_hash": "sha256-i1eQ4YlrWSgY522OlFtGDDPmxE2zd1hDM03AzR8RafE=",
         "deps": {
             "src": {
                 "args": {
-                    "hash": "sha256-CiOE22Kxdqovk+/vV2UJWo013DFRFGhEeUVsrKuOixE=",
+                    "hash": "sha256-nRZWCvoGYS4gxoJidkKGqTMGUuFfXfhIrHc3j/xRlaI=",
                     "postFetch": "rm -rf $(find $out/third_party/blink/web_tests ! -name BUILD.gn -mindepth 1 -maxdepth 1); rm -r $out/content/test/data; rm -rf $out/courgette/testdata; rm -r $out/extensions/test/data; rm -r $out/media/test/data; ",
-                    "tag": "142.0.7444.162",
+                    "tag": "142.0.7444.175",
                     "url": "https://chromium.googlesource.com/chromium/src.git"
                 },
                 "fetcher": "fetchFromGitiles"
@@ -2712,10 +2712,10 @@
             },
             "src/electron": {
                 "args": {
-                    "hash": "sha256-uQHUCB+BLguP7GjP+iws5gowFpwYKHa/lIqxCVFM76g=",
+                    "hash": "sha256-Zvu8Puh7j/u84cigKtfhOjBcxIYKJAv1mmbmIFRwdNY=",
                     "owner": "electron",
                     "repo": "electron",
-                    "tag": "v39.2.0"
+                    "tag": "v39.2.3"
                 },
                 "fetcher": "fetchFromGitHub"
             },
@@ -3991,8 +3991,8 @@
             },
             "src/v8": {
                 "args": {
-                    "hash": "sha256-otYRT8scmJ9boG2PKXRacL0C5FFwOVctKK/Dh7WG0tU=",
-                    "rev": "9210361d0a26fa4afefad8c5e60c85e59c5e2c8e",
+                    "hash": "sha256-jECAfgeAgdkhbI/8BgT9TakR9Ylha2zPznjZzibPQbE=",
+                    "rev": "baea8d627b70725fb777ebc1074f8ec4110ef6cb",
                     "url": "https://chromium.googlesource.com/v8/v8.git"
                 },
                 "fetcher": "fetchFromGitiles"
@@ -4001,6 +4001,6 @@
         "electron_yarn_hash": "19mpwfjb85d9kw1awiymj47h06rjk6vxqcgfajh612cgwkbz4m6f",
         "modules": "140",
         "node": "22.21.1",
-        "version": "39.2.0"
+        "version": "39.2.3"
     }
 }

pkgs/servers/mastodon/source.nix

@@ -5,17 +5,17 @@
   patches ? [ ],
 }:
 let
-  version = "4.5.1";
+  version = "4.5.2";
 in
 applyPatches {
   src = fetchFromGitHub {
     owner = "mastodon";
     repo = "mastodon";
     rev = "v${version}";
-    hash = "sha256-bMOM8i67z0rJXnTnh45TCrwLwbyFTImdePEVVoZiwlo=";
+    hash = "sha256-LePly+CcM+Dv6ipX9jIWWKhy2PiF1j8vgc9CXn2o+DQ=";
     passthru = {
       inherit version;
-      yarnHash = "sha256-GTiVGC7lTgK1UFji7CPDYkmxFVBgMAi6rPYkWlj+X1w=";
+      yarnHash = "sha256-2MOl6kHidkGU2I/cZaUmbQCiEl9SDfL/j9fT/6eNdFA=";
       yarnMissingHashes = ./missing-hashes.json;
     };
   };

pkgs/servers/sql/postgresql/13.nix

@@ -1,15 +0,0 @@
-import ./generic.nix {
-  version = "13.23";
-  rev = "refs/tags/REL_13_23";
-  hash = "sha256-GSIHFSt2wzaI3HkA3yX/gZZF+LKwODHYislagdhQjmE=";
-  muslPatches = {
-    disable-test-collate-icu-utf8 = {
-      url = "https://git.alpinelinux.org/aports/plain/main/postgresql13/disable-test-collate.icu.utf8.patch?id=69faa146ec9fff3b981511068f17f9e629d4688b";
-      hash = "sha256-jS/qxezaiaKhkWeMCXwpz1SDJwUWn9tzN0uKaZ3Ph2Y=";
-    };
-    dont-use-locale-a = {
-      url = "https://git.alpinelinux.org/aports/plain/main/postgresql13/dont-use-locale-a-on-musl.patch?id=69faa146ec9fff3b981511068f17f9e629d4688b";
-      hash = "sha256-fk+y/SvyA4Tt8OIvDl7rje5dLs3Zw+Ln1oddyYzerOo=";
-    };
-  };
-}

pkgs/top-level/all-packages.nix

@@ -3718,10 +3718,6 @@ with pkgs;
 
   tautulli = python3Packages.callPackage ../servers/tautulli { };
 
-  pleroma = callPackage ../servers/pleroma {
-    beamPackages = beam.packages.erlang_26.extend (self: super: { elixir = elixir_1_17; });
-  };
-
   plfit = callPackage ../by-name/pl/plfit/package.nix {
     python = null;
   };

pkgs/top-level/python-packages.nix

@@ -11804,6 +11804,8 @@ self: super: with self; {
 
   pendulum = callPackage ../development/python-modules/pendulum { };
 
+  pentapy = callPackage ../development/python-modules/pentapy { };
+
   pep440 = callPackage ../development/python-modules/pep440 { };
 
   pep517 = callPackage ../development/python-modules/pep517 { };