Merge master into staging-next

nixos/modules/services/networking/syncthing.nix

@@ -72,6 +72,7 @@ let
   ) (filterAttrs (_: folder: folder.enable) cfg.settings.folders);
 
   jq = "${pkgs.jq}/bin/jq";
+  grep = lib.getExe pkgs.gnugrep;
   updateConfig = pkgs.writers.writeBash "merge-syncthing-config" (
     ''
       set -efu
@@ -92,6 +93,61 @@ let
               --retry 1000 --retry-delay 1 --retry-all-errors \
               "$@"
       }
+
+      # Before version 2.0.0, Syncthing used LevelDB. In version 2.0.0,
+      # Syncthing started using SQLite. If you upgrade from an older version of
+      # Syncthing that uses LevelDB to a newer version of Syncthing that uses
+      # SQLite, then Syncthing will automatically do a one time database
+      # migration [1]. While the migration is happening, the regular Syncthing
+      # REST API is not available. Instead, a temporary API is made available
+      # in its place.
+      #
+      # The rest of this script depends on Syncthing’s regular REST API. This
+      # next part checks to see if Syncthing is currently providing the
+      # temporary API. If it is, this next part will wait until the regular API
+      # is available.
+      #
+      # [1]: <https://github.com/syncthing/syncthing/releases/tag/v2.0.0>
+      while true
+      do
+        # We can use pretty much any API endpoint here. I chose to use
+        # /rest/noauth/health because it doesn’t return a lot of data and
+        # because doing a “health check” seems like an appropriate way to check
+        # to see if the regular API is “alive” or not.
+        content_type="$(curl \
+          -o /dev/null \
+          -w '%header{Content-Type}' \
+          ${curlAddressArgs "/rest/noauth/health"}
+        )"
+        # The “($|([ \t]*;.*))” part at the end allows us to not worry about
+        # whether or not the Content-Type contains any parameters. “$” matches
+        # the end of the string which indicates that no parameters were used
+        # [1][2]. The “[ \t]*;” part matches OWS [3] followed by a semicolon
+        # which indicates that at least one parameter was used [4].
+        #
+        # We use “grep -i” here because media types are case-insensitive [2].
+        #
+        # [1]: <https://httpwg.org/specs/rfc9110.html#field.content-type>
+        # [2]: <https://httpwg.org/specs/rfc9110.html#media.type>
+        # [3]: <https://httpwg.org/specs/rfc9110.html#whitespace>
+        # [4]: <https://httpwg.org/specs/rfc9110.html#parameter>
+        if printf %s "$content_type" | ${lib.escapeShellArg grep} -qiP '^text/plain($|([ \t]*;.*))'
+        then
+          echo Waiting for Syncthing to finish its database migration…
+          sleep 30
+        # TODO: This next regex pattern can be simplified if this Syncthing bug gets fixed [1].
+        #
+        # [1]: <https://github.com/syncthing/syncthing/issues/10500>
+        elif printf %s "$content_type" | ${lib.escapeShellArg grep} -qiP '^application/json($|([ \t]*;.*))'
+        then
+          echo 'Syncthing is not doing a database migration (anymore).'
+          break
+        else
+          printf 'ERROR: Syncthing responded with an unexpected Content-Type: %s\n' "$content_type"
+          # This is the EX_PROTOCOL exit status from <man:sysexits.h(3head)>.
+          exit 76
+        fi
+      done
     ''
     +
 

nixos/tests/all-tests.nix

@@ -643,7 +643,7 @@ in
   gitdaemon = runTest ./gitdaemon.nix;
   gitea = handleTest ./gitea.nix { giteaPackage = pkgs.gitea; };
   github-runner = runTest ./github-runner.nix;
-  gitlab = import ./gitlab/default.nix {
+  gitlab = import ./gitlab {
     inherit runTest;
   };
   gitolite = runTest ./gitolite.nix;

nixos/tests/gitlab/gitlab.nix

@@ -12,7 +12,7 @@
 { pkgs, lib, ... }:
 
 let
-  inherit (import ./ssh-keys.nix pkgs) snakeOilPrivateKey snakeOilPublicKey;
+  inherit (import ../ssh-keys.nix pkgs) snakeOilPrivateKey snakeOilPublicKey;
   initialRootPassword = "notproduction";
   rootProjectId = "2";
 
@@ -37,7 +37,7 @@ in
     gitlab =
       { ... }:
       {
-        imports = [ common/user-account.nix ];
+        imports = [ ../common/user-account.nix ];
 
         environment.systemPackages = with pkgs; [ git ];
 

pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix

@@ -12,12 +12,12 @@
   pkgs,
 }:
 let
-  version = "0.0.27-unstable-2025-12-09";
+  version = "0.0.27-unstable-2025-12-19";
   src = fetchFromGitHub {
     owner = "yetone";
     repo = "avante.nvim";
-    rev = "bbf6d8f0d9aa072a2ccffc7701936eaa71985f92";
-    hash = "sha256-Ig4yMpoNEWMIHqh3Cq6taAkyBFesLk+C+nb/Kld18ag=";
+    rev = "15548d50fcfb2ebda173bff0d751a1b0bc53e4c5";
+    hash = "sha256-jTXV/IV/vIu+pWL/C1OkWvrVRg39yGalfC28VIfDvqI=";
   };
   avante-nvim-lib = rustPlatform.buildRustPackage {
     pname = "avante-nvim-lib";

pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "claude-code";
     publisher = "anthropic";
-    version = "2.0.74";
-    hash = "sha256-2GhutC0n56fd3+GwLJQFYKuhUOiYWW6S5M3GlsYOEMM=";
+    version = "2.0.75";
+    hash = "sha256-PA7eL4TZTFYVlImXnZCw6aWjrLXl7/KndnkU3D2t1jw=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/detachhead.basedpyright/default.nix

@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "basedpyright";
     publisher = "detachhead";
-    version = "1.34.0";
-    hash = "sha256-XAP26fmn5GM1sRZMF9uTAOTp+5DLjRjr8nO8Vdh/UpQ=";
+    version = "1.36.1";
+    hash = "sha256-D3bKfUb/cm9zGfUCl0G/X2nxylZqSNv406BQ8c5GtgI=";
   };
   meta = {
     changelog = "https://github.com/detachhead/basedpyright/releases";

pkgs/applications/video/obs-studio/plugins/droidcam-obs/default.nix

@@ -2,8 +2,9 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   obs-studio,
-  ffmpeg_7,
+  ffmpeg,
   libjpeg,
   libimobiledevice,
   libusbmuxd,
@@ -21,6 +22,15 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-hxG/v15Q4D+6LU4BNV6ErSa1WvPk4kMPl07pIqiMcc4=";
   };
 
+  patches = [
+    # Fix build with ffmpeg 8 / libavcodec 62
+    # TODO: Drop this once v2.4.3+ is released
+    (fetchpatch {
+      url = "https://github.com/dev47apps/droidcam-obs-plugin/commit/73ec2a01e234e6b2287866c25b4242dca6d9d2f6.patch";
+      hash = "sha256-AI2Z9i3+KfvmpyVX9WwX3jcA1hyUZiFO7kWRsb+8/10=";
+    })
+  ];
+
   preBuild = ''
     mkdir ./build
   '';
@@ -31,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
     libusbmuxd
     libplist
     obs-studio
-    ffmpeg_7
+    ffmpeg
   ];
 
   nativeBuildInputs = [
@@ -47,7 +57,7 @@ stdenv.mkDerivation (finalAttrs: {
     "IMOBILEDEV_DIR=${lib.getDev libimobiledevice}"
     "IMOBILEDEV_DIR=${lib.getLib libimobiledevice}"
     "LIBOBS_INCLUDES=${obs-studio}/include/obs"
-    "FFMPEG_INCLUDES=${lib.getLib ffmpeg_7}"
+    "FFMPEG_INCLUDES=${lib.getLib ffmpeg}"
     "LIBUSBMUXD=libusbmuxd-2.0"
     "LIBIMOBILEDEV=libimobiledevice-1.0"
   ];

pkgs/by-name/ca/cargo-deny/package.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-deny";
-  version = "0.18.6";
+  version = "0.18.9";
 
   src = fetchFromGitHub {
     owner = "EmbarkStudios";
     repo = "cargo-deny";
     tag = finalAttrs.version;
-    hash = "sha256-w3SFU0FSX7nmqzyxey0erJfq8YsFEEukfNhDg5g0I04=";
+    hash = "sha256-2ZexBVt3+tnEwxtRuzS6f7BQyu/nvjC098221hadKw8=";
   };
 
-  cargoHash = "sha256-yrVSXrxfJ4vB85rARq6g71AswRMXhn25tfYZqXm1zoo=";
+  cargoHash = "sha256-2u1DQtvjRfwbCXnX70M7drrMEvNsrVxsbikgrnNOkUE=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/cl/claude-code/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@anthropic-ai/claude-code",
-  "version": "2.0.73",
+  "version": "2.0.74",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@anthropic-ai/claude-code",
-      "version": "2.0.73",
+      "version": "2.0.74",
       "license": "SEE LICENSE IN README.md",
       "bin": {
         "claude": "cli.js"

pkgs/by-name/cl/claude-code/package.nix

@@ -11,14 +11,14 @@
 }:
 buildNpmPackage (finalAttrs: {
   pname = "claude-code";
-  version = "2.0.73";
+  version = "2.0.74";
 
   src = fetchzip {
     url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${finalAttrs.version}.tgz";
-    hash = "sha256-kQRj8Vd735KyPzPZnoieE4TxUKHoCpnC62Blsh5dbWw=";
+    hash = "sha256-J3m1KUO8Bkzwh3fLI96LoWw6VsSwoETcSq2IufeRW9E=";
   };
 
-  npmDepsHash = "sha256-H6EqVQ7DpccxDzlMu9GuRIAQao8m3AO36mQUh1J0TRI=";
+  npmDepsHash = "sha256-kwJDSBAepJ1IVLzf4sydTZpvr6pERD9d7kr+KYC5Y/o=";
 
   postPatch = ''
     cp ${./package-lock.json} package-lock.json

pkgs/by-name/da/daisydisk/package.nix

@@ -11,11 +11,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "daisydisk";
-  version = "4.31";
+  version = "4.32";
 
   src = fetchzip {
     url = "https://daisydiskapp.com/download/DaisyDisk.zip";
-    hash = "sha256-z0F1sHihmXR5hN/AwrxLr9ZxfcCN+OSeWvWBe+qwWMU=";
+    hash = "sha256-HRW851l3zCq43WmLkElvVlIEmfCsCUMFw/LL2cPa2Xk=";
     stripRoot = false;
   };
 

pkgs/by-name/fr/freelens-bin/package.nix

@@ -11,24 +11,24 @@
 let
 
   pname = "freelens-bin";
-  version = "1.6.1";
+  version = "1.7.0";
 
   sources = {
     x86_64-linux = {
       url = "https://github.com/freelensapp/freelens/releases/download/v${version}/Freelens-${version}-linux-amd64.AppImage";
-      hash = "sha256-RiA9OWcs6goRPN8dGsLV3ViBe/ZWB3M7yzTmDHgB3mo=";
+      hash = "sha256-VeWTfJf66Cq4ZyR/mO0kzm8wD+Auo1MZvXPYC1Bbf7U=";
     };
     aarch64-linux = {
       url = "https://github.com/freelensapp/freelens/releases/download/v${version}/Freelens-${version}-linux-arm64.AppImage";
-      hash = "sha256-hYkI9N8fnEIcj7bPp0lXcB89OZ0kzcd2RrJs3htg6Qo=";
+      hash = "sha256-KzX9GEaAVRWUYjaj31PVc4OQvFScXsZqZMR+baPADZA=";
     };
     x86_64-darwin = {
       url = "https://github.com/freelensapp/freelens/releases/download/v${version}/Freelens-${version}-macos-amd64.dmg";
-      hash = "sha256-JXqMaw5KlronrpNYNU0YcVwRddHRrK/Y5b5NE3y5BA8=";
+      hash = "sha256-qtfOf14gmH4HAA/UZ86QR1sA75lzXVaoWNb0N+mJWPw=";
     };
     aarch64-darwin = {
       url = "https://github.com/freelensapp/freelens/releases/download/v${version}/Freelens-${version}-macos-arm64.dmg";
-      hash = "sha256-0Eg3xBE+yjNvNjloUAJJMpY9h7ifgV+4G3a+EvbXL+Q=";
+      hash = "sha256-U6Oj+ip/srVzfyE04rJSZgaAtIt7y0X8nLgHeIvB/So=";
     };
   };
 

pkgs/by-name/li/libxc/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitLab,
+  fetchpatch,
   cmake,
   gfortran,
   perl,
@@ -26,6 +27,14 @@ stdenv.mkDerivation rec {
     hash = versionHashes."${version}";
   };
 
+  patches = [
+    # Fix build with newer CMake versions
+    (fetchpatch {
+      url = "https://gitlab.com/libxc/libxc/-/commit/450202adb8a3d698841dca853f2999b1befd932e.patch";
+      sha256 = "sha256-XDt7+TzszSu+X6/PS+T8Q9BP76+bAXC9FzkA6ueo/OA=";
+    })
+  ];
+
   # Timeout increase has already been included upstream in master.
   # Check upon updates if this can be removed.
   postPatch = ''
@@ -49,7 +58,6 @@ stdenv.mkDerivation rec {
   '';
 
   cmakeFlags = [
-    "-DCMAKE_POLICY_VERSION_MINIMUM=3.5"
     "-DENABLE_FORTRAN=ON"
     "-DBUILD_SHARED_LIBS=ON"
     "-DENABLE_XHOST=OFF"

pkgs/by-name/li/libxc/python.nix

@@ -0,0 +1,34 @@
+{
+  buildPythonPackage,
+  lib,
+  libxc,
+  setuptools,
+  cmake,
+  numpy,
+}:
+
+buildPythonPackage {
+  inherit (libxc)
+    pname
+    version
+    src
+    patches
+    meta
+    nativeBuildInputs
+    ;
+
+  pyproject = true;
+
+  build-system = [
+    setuptools
+    cmake
+  ];
+
+  dependencies = [
+    numpy
+  ];
+
+  dontUseCmakeConfigure = true;
+
+  pythonImportsCheck = [ "pylibxc" ];
+}

pkgs/by-name/me/memos/package.nix

@@ -8,53 +8,14 @@
   fetchPnpmDeps,
   pnpmConfigHook,
   pnpm,
-  buf,
-  cacert,
-  grpc-gateway,
-  protoc-gen-go,
-  protoc-gen-go-grpc,
-  protoc-gen-validate,
 }:
 let
-  version = "0.25.2";
+  version = "0.25.3";
   src = fetchFromGitHub {
     owner = "usememos";
     repo = "memos";
     rev = "v${version}";
-    hash = "sha256-Yag+OxhlWEhWumnB620QREm4G99osKzQNlGN+1YBMTQ=";
-  };
-
-  memos-protobuf-gen = stdenvNoCC.mkDerivation {
-    pname = "memos-protobuf-gen";
-    inherit version src;
-
-    nativeBuildInputs = [
-      buf
-      cacert
-      grpc-gateway
-      protoc-gen-go
-      protoc-gen-go-grpc
-      protoc-gen-validate
-    ];
-
-    buildPhase = ''
-      runHook preBuild
-      pushd proto
-      HOME=$TMPDIR buf generate
-      popd
-      runHook postBuild
-    '';
-    installPhase = ''
-      runHook preInstall
-      mkdir -p $out/{proto,web/src/types}
-      cp -r {.,$out}/proto/gen
-      cp -r {.,$out}/web/src/types/proto
-      runHook postInstall
-    '';
-
-    outputHashMode = "recursive";
-    outputHashAlgo = "sha256";
-    outputHash = "sha256-j9jBxhDi1COowOh5sDjOuVJdHf2/RSwZ0cQUD/j2jt0=";
+    hash = "sha256-lAKzPteGjGa7fnbB0Pm3oWId5DJekbVWI9dnPEGbiBo=";
   };
 
   memos-web = stdenvNoCC.mkDerivation (finalAttrs: {
@@ -64,7 +25,7 @@ let
       inherit (finalAttrs) pname version src;
       sourceRoot = "${finalAttrs.src.name}/web";
       fetcherVersion = 1;
-      hash = "sha256-qvxOY7ASAlYbT5Ju/8b3qiE9KgXkDIj1MZuVH0hmCOA=";
+      hash = "sha256-k+pykzAiZ72cMMH+6qtnNxjaq4m4QyCQuWvQPbZSZho=";
     };
     pnpmRoot = "web";
     nativeBuildInputs = [
@@ -72,9 +33,6 @@ let
       pnpmConfigHook
       pnpm
     ];
-    preBuild = ''
-      cp -r {${memos-protobuf-gen},.}/web/src/types/proto
-    '';
     buildPhase = ''
       runHook preBuild
       pnpm -C web build
@@ -93,23 +51,19 @@ buildGoModule {
     version
     src
     memos-web
-    memos-protobuf-gen
     ;
 
-  vendorHash = "sha256-Eihp7Kcu8AiPL2VEypxx8+8JwjHI8htoOv69xGrp560=";
+  vendorHash = "sha256-BoJxFpfKS/LByvK4AlTNc4gA/aNIvgLzoFOgyal+aF8=";
 
   preBuild = ''
     rm -rf server/router/frontend/dist
     cp -r ${memos-web} server/router/frontend/dist
-    cp -r {${memos-protobuf-gen},.}/proto/gen
   '';
 
   passthru.updateScript = nix-update-script {
     extraArgs = [
       "--subpackage"
       "memos-web"
-      "--subpackage"
-      "memos-protobuf-gen"
     ];
   };
 

pkgs/by-name/st/stackit-cli/package.nix

@@ -12,16 +12,16 @@
 
 buildGoModule rec {
   pname = "stackit-cli";
-  version = "0.49.0";
+  version = "0.50.0";
 
   src = fetchFromGitHub {
     owner = "stackitcloud";
     repo = "stackit-cli";
     rev = "v${version}";
-    hash = "sha256-hhsiFfDrxuBIOWX2tHCMGBRP7z04dmwH4V6KicxzsDc=";
+    hash = "sha256-+bBXpsdF9VSephh8mw8X5ysy+iOCsCEy4Pc9N4IJ42M=";
   };
 
-  vendorHash = "sha256-6AcSPt5CVFUPpP0ve7XtxbM1pJlPrdi3nKtzgeu649Y=";
+  vendorHash = "sha256-QR4/f02vtYLaxP+g0Nm87BFUANcjp72psdbtrmfnmAM=";
 
   subPackages = [ "." ];
 

pkgs/by-name/tu/turntable/package.nix

@@ -12,7 +12,9 @@
   libsoup_3,
   json-glib,
   libsecret,
+  libglycin,
   glib-networking,
+  glycin-loaders,
 
   # Per the upstream request. Key owned by Aleksana
   lastfmKey ? "b5027c5178ca2abfcc31bd04397c3c0e",
@@ -21,14 +23,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "turntable";
-  version = "0.3.3";
+  version = "0.4.0";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "GeopJr";
     repo = "Turntable";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-fBduW49eNOEzRVBb72zcB5arTjTiRUy8jE3sSMjPITE=";
+    hash = "sha256-Rvkzh2Cila6ZhQZyX5zzUrWane6nLAjrwnKk0LPWKuE=";
   };
 
   nativeBuildInputs = [
@@ -45,6 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
     libsoup_3
     json-glib
     libsecret
+    libglycin
     glib-networking
   ];
 
@@ -55,6 +58,12 @@ stdenv.mkDerivation (finalAttrs: {
 
   strictDeps = true;
 
+  preFixup = ''
+    gappsWrapperArgs+=(
+      --prefix XDG_DATA_DIRS : "${glycin-loaders}/share"
+    )
+  '';
+
   meta = {
     description = "Scrobbles your music to multiple services with playback controls for MPRIS players";
     longDescription = ''

pkgs/development/python-modules/submitit/default.nix

@@ -2,12 +2,11 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  setuptools,
   cloudpickle,
   flit-core,
   typing-extensions,
   pytestCheckHook,
-  pytest-asyncio_0,
+  pytest-asyncio,
 }:
 
 buildPythonPackage rec {
@@ -26,14 +25,13 @@ buildPythonPackage rec {
 
   dependencies = [
     cloudpickle
-    setuptools
     typing-extensions
   ];
 
   nativeCheckInputs = [
     pytestCheckHook
     # event_loop was removed in pytest-asyncio 1.x
-    pytest-asyncio_0
+    pytest-asyncio
   ];
 
   pythonImportsCheck = [

pkgs/development/tools/pnpm/generic.nix

@@ -80,10 +80,12 @@ stdenvNoCC.mkDerivation (finalAttrs: {
           "pnpm.fetchDeps: The package attribute is deprecated. Use the top-level fetchPnpmDeps attribute instead"
           (
             { ... }@args:
-            fetchPnpmDeps args
-            // {
-              pnpm = pnpm';
-            }
+            fetchPnpmDeps (
+              args
+              // {
+                pnpm = pnpm';
+              }
+            )
           );
       configHook =
         lib.warn

pkgs/top-level/python-packages.nix

@@ -8663,6 +8663,10 @@ self: super: with self; {
 
   libvirt = callPackage ../development/python-modules/libvirt { inherit (pkgs) libvirt; };
 
+  libxc = callPackage ../by-name/li/libxc/python.nix {
+    libxc = pkgs.libxc_7;
+  };
+
   libxml2 =
     (toPythonModule (
       pkgs.libxml2.override {

pkgs/top-level/release-cuda.nix

@@ -91,7 +91,6 @@ let
       firefox-devedition-unwrapped = linux;
       freecad = linux;
       gimp = linux;
-      gimp3 = linux;
       gpu-screen-recorder = linux;
       gst_all_1.gst-plugins-bad = linux;
       jellyfin-ffmpeg = linux;