Merge staging-next into staging

maintainers/maintainer-list.nix

@@ -14702,6 +14702,13 @@
     githubId = 2422454;
     name = "Kai Wohlfahrt";
   };
+  kxxt = {
+    name = "kxxt";
+    email = "rsworktech@outlook.com";
+    matrix = "@kxxt:matrix.org";
+    github = "kxxt";
+    githubId = 18085551;
+  };
   kyehn = {
     name = "kyehn";
     github = "kyehn";

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -225,6 +225,15 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.
 
 - Wine has been updated to the 11.0 branch. Please check the [upstream announcement](https://gitlab.winehq.org/wine/wine/-/releases/wine-11.0) for more details.
 
+- `security.acme` now defaults to a dynamic renewal duration, if
+  [security.acme.defaults.validMinDays](#opt-security.acme.defaults.validMinDays)
+  remains unset. This accomodates certificates with different ACME profile:
+    - For certificates with a total validity at or above 10 days renewal will happen
+      after two thirds of the lifetime has passed (e.g. a certificate valid for 90
+      days renews once the validity falls below 30 days)
+    - For shortlived certificates with a total validty below 10 days renewal
+      will happen after half of the total lifetime has passed
+
 - Cinnamon has been updated to 6.6, please check the [upstream announcement](https://www.linuxmint.com/rel_zena_whatsnew.php) for more details.
 
 - Budgie has been updated to 10.10, please check the [upstream announcement](https://buddiesofbudgie.org/blog/budgie-10-10-released) for more details.

nixos/modules/security/acme/default.nix

@@ -15,11 +15,33 @@ let
   numCerts = lib.length (builtins.attrNames cfg.certs);
   _24hSecs = 60 * 60 * 24;
 
+  # The placerholder email address used by lego in case none gets passed
+  placeholderEmail = "noemail@example.com";
+
   # Used to make unique paths for each cert/account config set
   mkHash = with builtins; val: lib.substring 0 20 (hashString "sha256" val);
-  mkAccountHash = acmeServer: data: mkHash "${toString acmeServer} ${data.keyType} ${data.email}";
+  mkAccountHash =
+    acmeServer: data:
+    mkHash (
+      lib.concatStringsSep " " [
+        (toString acmeServer)
+        data.keyType
+        (if (data.email != null) then data.email else placeholderEmail)
+      ]
+
+    );
   accountDirRoot = "/var/lib/acme/.lego/accounts/";
 
+  isIP =
+    address:
+    let
+      isIPv6 = lib.length (lib.splitString ":" address) > 2;
+      isIPv4 = (lib.match "^([0-9]+\\.){3}[0-9]+$" address) != null;
+    in
+    isIPv6 || isIPv4;
+
+  isDomainName = name: !isIP name;
+
   # Lockdir is acme-setup.service's RuntimeDirectory.
   # Since that service is a oneshot with RemainAfterExit,
   # the folder will exist during all renewal services.
@@ -263,6 +285,8 @@ let
         "--accept-tos" # Checking the option is covered by the assertions
         "--path"
         "."
+      ]
+      ++ lib.optionals (data.email != null) [
         "--email"
         data.email
       ]
@@ -389,10 +413,14 @@ let
             exit 0
           fi
 
-          minica \
-            --ca-key ca/key.pem \
-            --ca-cert ca/cert.pem \
-            --domains ${lib.escapeShellArg (builtins.concatStringsSep "," ([ data.domain ] ++ extraDomains))}
+          minica ${
+            lib.cli.toCommandLineShellGNU { } {
+              ca-key = "ca/key.pem";
+              ca-cert = "ca/cert.pem";
+              domains = lib.concatStringsSep "," (lib.filter isDomainName ([ data.domain ] ++ extraDomains));
+              ip-addresses = lib.concatStringsSep "," (lib.filter isIP ([ data.domain ] ++ extraDomains));
+            }
+          }
 
           # Create files to match directory layout for real certificates
           (
@@ -523,20 +551,42 @@ let
 
             [[ -e $pem ]]
 
-            expiration_line="$(
-              set -euxo pipefail
-              openssl x509 -noout -enddate <"$pem" \
-                    | grep notAfter \
-                    | sed -e 's/^notAfter=//'
-            )"
-            [[ -n "$expiration_line" ]]
+            # Read certificate valid duration
+            not_before=$(openssl x509 -in "$pem" -noout -startdate | cut -d= -f2)
+            not_after=$(openssl x509 -in "$pem" -noout -enddate | cut -d= -f2)
 
-            expiration_date="$(date -d "$expiration_line" +%s)"
-            now="$(date +%s)"
-            expiration_s=$((expiration_date - now))
-            expiration_days=$((expiration_s / (3600 * 24)))   # rounds down
+            # Convert timestamp to seconds since epoch
+            not_before_epoch=$(date -d "$not_before" +%s)
+            not_after_epoch=$(date -d "$not_after" +%s)
+            now_epoch=$(date +%s)
 
-            [[ $expiration_days -gt ${toString data.validMinDays} ]]
+            # Determine total and remaining duration
+            total_duration=$((not_after_epoch - not_before_epoch))
+            remaining_duration=$((not_after_epoch - now_epoch))
+
+            ${
+              if (data.validMinDays != null) then
+                ''
+                  # Convert to days and round down
+                  total_days=$((total_duration / 86400))
+                  remaining_days=$((remaining_duration / 86400))
+
+                  [[ $remaining_days -gt ${toString data.validMinDays} ]]
+                ''
+              else
+                ''
+                  # Recreate --dynamic logic from lego
+                  if (( total_duration < 864000 )); then
+                    # 1/2 for shortlived certificates with total lifetime < 10 days
+                    threshold=$(( total_duration / 2))
+                  else
+                    # 1/3 for longer validity durations with total lifetime >= 10 days
+                    threshold=$(( total_duration / 3))
+                  fi
+
+                  [[ $remaining_duration -gt $threshold ]]
+                ''
+            }
           }
 
           echo '${domainHash}' > domainhash.txt
@@ -544,13 +594,20 @@ let
           # Check if a new order is needed
           # We can only renew if the list of domains has not changed.
           # We also need an account key. Avoids #190493
-          if cmp -s domainhash.txt certificates/domainhash.txt && [ -e '${certificateKey}' ] && [ -e 'certificates/${keyName}.crt' ] && [ -n "$(find accounts -name '${data.email}.key')" ]; then
+          if cmp -s domainhash.txt certificates/domainhash.txt && [ -e '${certificateKey}' ] && \
+            [ -e 'certificates/${keyName}.crt' ] && \
+            [ -n "$(find accounts -name '${
+              if (data.email != null) then data.email else placeholderEmail
+            }.key')" ];
+          then
             # Even if a cert is not expired, it may be revoked by the CA.
             # Try to renew, and silently fail if the cert is not expired.
             # Avoids #85794 and resolves #129838
-            if ! lego ${renewOpts} --days ${toString data.validMinDays}; then
+            if ! lego ${renewOpts} ${
+              if data.validMinDays != null then "--days ${toString data.validMinDays}" else "--dynamic"
+            }; then
               if is_expiration_skippable out/full.pem; then
-                echo 1>&2 "nixos-acme: Ignoring failed renewal because expiration isn't within the coming ${toString data.validMinDays} days"
+                echo 1>&2 "nixos-acme: Ignoring failed renewal because expiration isn't due yet"
               else
                 # High number to avoid Systemd reserved codes.
                 exit 11
@@ -626,9 +683,15 @@ let
 
       options = {
         validMinDays = lib.mkOption {
-          type = lib.types.int;
-          inherit (defaultAndText "validMinDays" 30) default defaultText;
-          description = "Minimum remaining validity before renewal in days.";
+          type = lib.types.nullOr lib.types.int;
+          default = null;
+          description = ''
+            Minimum remaining validity before renewal in days.
+
+            If unset, the renewal time is calculated dynamically:
+            - for regular certificates, renewal occurs when less than one-third of the lifetime remains
+            - for short-lived certificates, renewal occurs when less than half of the lifetime remains
+          '';
         };
 
         renewInterval = lib.mkOption {
@@ -1074,14 +1137,6 @@ in
           certs = lib.attrValues cfg.certs;
         in
         [
-          {
-            assertion = cfg.defaults.email != null || lib.all (certOpts: certOpts.email != null) certs;
-            message = ''
-              You must define `security.acme.certs.<name>.email` or
-              `security.acme.defaults.email` to register with the CA. Note that using
-              many different addresses for certs may trigger account rate limits.
-            '';
-          }
           {
             assertion = cfg.acceptTerms;
             message = ''

nixos/tests/acme/http01-builtin.nix

@@ -1,11 +1,11 @@
 {
-  config,
   lib,
   pkgs,
   ...
 }:
 let
   domain = "example.test";
+  ip = "192.168.1.2";
 in
 {
   name = "http01-builtin";
@@ -34,6 +34,7 @@ in
         environment.systemPackages = [ pkgs.openssl ];
 
         security.acme.certs."${config.networking.fqdn}" = {
+          extraDomainNames = [ ip ];
           listenHTTP = ":80";
         };
 
@@ -51,7 +52,14 @@ in
           };
 
           accountchange.configuration = {
-            security.acme.certs."${config.networking.fqdn}".email = "admin@example.test";
+            # Providing an email address is optional
+            security.acme.certs."${config.networking.fqdn}".email = null;
+          };
+
+          emailplaceholder.configuration = {
+            # but Lego will default to this email address, which should not
+            # result in any change when configured
+            security.acme.certs."${config.networking.fqdn}".email = "noemail@example.com";
           };
 
           keytype.configuration = {
@@ -124,6 +132,7 @@ in
 
                 [ alt_names ]
                 DNS.1 = ${config.networking.fqdn}
+                IP.1 = ${ip}
               '';
               csrData =
                 pkgs.runCommand "csr-and-key"
@@ -142,6 +151,7 @@ in
               security.acme.certs."${config.networking.fqdn}" = {
                 csr = "${csrData}/request.csr";
                 csrKey = "${csrData}/key.pem";
+                extraDomainNames = lib.mkForce [ ];
               };
             };
         };
@@ -154,10 +164,12 @@ in
       certName = nodes.builtin.networking.fqdn;
       caDomain = nodes.acme.test-support.acme.caDomain;
     in
+    # python
     ''
       ${(import ./utils.nix).pythonUtils}
 
       domain = "${domain}"
+      ip = "${ip}"
       cert = "${certName}"
       cert2 = "builtin-2." + domain
       cert3 = "builtin-3." + domain
@@ -173,6 +185,7 @@ in
 
           check_issuer(builtin, cert, "pebble")
           check_domain(builtin, cert, cert)
+          check_ip(builtin, cert, ip)
 
       with subtest("Validate permissions"):
           check_permissions(builtin, cert, "acme")
@@ -212,11 +225,23 @@ in
           hash_after = builtin.succeed(f"sha256sum /var/lib/acme/{cert}/cert.pem")
           # Has to do a full run to register account, which creates new certs.
           assert hash != hash_after, "Certificate was not renewed"
+          hash = hash_after
+
+          builtin.succeed("systemctl stop renew-triggered.target")
+          switch_to(builtin, "emailplaceholder")
+          builtin.wait_for_unit("renew-triggered.target")
+
+          # Check that there are still two account directories
+          builtin.succeed("test $(ls -1 /var/lib/acme/.lego/accounts | tee /dev/stderr | wc -l) -eq 2")
+          hash_after = builtin.succeed(f"sha256sum /var/lib/acme/{cert}/cert.pem")
+          assert hash == hash_after, "Implicit to explicit email placeholder renewed the certificate"
+
           # Remove the new account directory
           builtin.succeed(
               "cd /var/lib/acme/.lego/accounts"
               " && ls -1 --sort=time | tee /dev/stderr | head -1 | xargs rm -rf"
           )
+
           # old_hash will be used in the preservation tests later
           old_hash = hash_after
 
@@ -300,6 +325,7 @@ in
           builtin.wait_for_unit("renew-triggered.target")
 
           check_issuer(builtin, cert, "pebble")
+          check_ip(builtin, cert, ip)
 
       with subtest("Generate self-signed certs"):
           acme.shutdown()

nixos/tests/acme/python-utils.py

@@ -84,6 +84,11 @@ def check_domain(node, cert_name, domain, fail=False) -> None:
     cmd = f"openssl x509 -noout -checkhost '{domain}' -in /var/lib/acme/{cert_name}/cert.pem"
     run(node, cmd, fail=fail)
 
+# Ensures the provided ip address matches with the given cert
+def check_ip(node, cert_name, ip_address, fail=False) -> None:
+    cmd = f"openssl x509 -noout -checkip '{ip_address}' -in /var/lib/acme/{cert_name}/cert.pem"
+    run(node, cmd, fail=fail)
+
 # Ensures the required values for OCSP stapling are present
 # Pebble doesn't provide a full OCSP responder, so just checks the URL
 def check_stapling(node, cert_name, ca_domain, fail=False):

pkgs/applications/audio/snapcast/default.nix

@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "snapcast";
-  version = "0.34.0";
+  version = "0.35.0";
 
   src = fetchFromGitHub {
     owner = "badaix";
     repo = "snapcast";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-BPsAGFLWUfONuyQ1pzsJzGV/Jlxv+4TkVT1KG7j8H0s=";
+    hash = "sha256-kUw4yQpCxgjP4hH2Lpxc7l+ufhYSKs7xL80aJuPrqOo=";
   };
 
   nativeBuildInputs = [

pkgs/applications/editors/neovim/utils.nix

@@ -82,7 +82,7 @@ let
       neovimConfig =
         structuredConfigure:
         let
-          module = import ./module.nix;
+          module = import ./plugin-submodule.nix;
           # Generate init.vim configuration
           cfg = (
             lib.evalModules {
@@ -97,6 +97,7 @@ let
 
       checked_cfg = neovimConfig {
         inherit plugins;
+        _file = "pkgs/applications/editors/neovim/plugin-submodule.nix";
       };
 
       pluginsNormalized = checked_cfg.plugins;

pkgs/applications/editors/vim/plugins/generated.nix

@@ -21783,6 +21783,18 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  vim-syntax-shakespeare = buildVimPlugin {
+    pname = "vim-syntax-shakespeare";
+    version = "0-unstable-2018-06-25";
+    src = fetchgit {
+      url = "https://codeberg.org/pbrisbin/vim-syntax-shakespeare";
+      rev = "2f4f61eae55b8f1319ce3a086baf9b5ab57743f3";
+      hash = "sha256-sdCXJOvB+vJE0ir+qsT/u1cHNxrksMnqeQi4D/Vg6UA=";
+    };
+    meta.homepage = "https://codeberg.org/pbrisbin/vim-syntax-shakespeare";
+    meta.hydraPlatforms = [ ];
+  };
+
   vim-tabby = buildVimPlugin {
     pname = "vim-tabby";
     version = "2.0.2-unstable-2025-01-13";

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -1673,6 +1673,7 @@ https://github.com/lambdalisue/vim-suda/,,
 https://github.com/tpope/vim-surround/,,
 https://github.com/evanleck/vim-svelte/,,
 https://github.com/machakann/vim-swap/,,
+https://codeberg.org/pbrisbin/vim-syntax-shakespeare,HEAD,
 https://github.com/TabbyML/vim-tabby/,HEAD,
 https://github.com/dhruvasagar/vim-table-mode/,,
 https://github.com/kana/vim-tabpagecd/,,

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -219,13 +219,13 @@
     "vendorHash": "sha256-6MKWpiDq4yI3mfIJyzEsWLa7gi0+DScI5jKcOcM6Qs0="
   },
   "cloudposse_utils": {
-    "hash": "sha256-TcCDv6IB6Z4llvogKWasAK4u2NFsOG4UKAUERDH6SXg=",
+    "hash": "sha256-Fjb+9NG+p+oTvKziRYHaNdAZaUv8Rs/FYLXmtwrfkOI=",
     "homepage": "https://registry.terraform.io/providers/cloudposse/utils",
     "owner": "cloudposse",
     "repo": "terraform-provider-utils",
-    "rev": "v1.31.0",
+    "rev": "v2.4.0",
     "spdx": "Apache-2.0",
-    "vendorHash": "sha256-djz3kNV+13Sz9prRPhWaWi50hvYXq3I3cp4neLexeEs="
+    "vendorHash": "sha256-LNsJygeBSpY4xawhWfIcYOB0TEVK4DMeyiSgyn8PJ2A="
   },
   "cloudscale-ch_cloudscale": {
     "hash": "sha256-r+0HrY+5ciNb3+JHV05ez/uPElbD7LcQqlUHWYp865Q=",
@@ -679,13 +679,13 @@
     "vendorHash": "sha256-OvotUEh+P2b3ngaD/8lVbemnM3lrtwqduPXPjF/bqVA="
   },
   "hashicorp_vault": {
-    "hash": "sha256-Rg18X+VFDA9p3Dx/fA/C982X4XEvSRPU0+Zkq8HWqas=",
+    "hash": "sha256-e0BcPLQFUjdZPlKAnuxBB3se+MjDSj78KJy5zNlsHKA=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/vault",
     "owner": "hashicorp",
     "repo": "terraform-provider-vault",
-    "rev": "v5.7.0",
+    "rev": "v5.8.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-XnyEPnB0995S7LzGAlkB/O3VKWXAm1rp9NQcDvIhRVw="
+    "vendorHash": "sha256-XBXkDvblC/u3lYq/dfjm38Hw8uGwumz4ZAiG+kJkNUQ="
   },
   "hashicorp_vsphere": {
     "hash": "sha256-vRO6vxzi4d0hNc0MmQLhN7roONnsjxPBtFt0fyvxWd8=",
@@ -1148,13 +1148,13 @@
     "vendorHash": null
   },
   "sacloud_sakuracloud": {
-    "hash": "sha256-gcl4ClYxmZbACn8rmcZzn/XeYMeLAuhAr2IVuQRqXoQ=",
+    "hash": "sha256-CVM56qxegsJrH+4SxHhfSR/iuXitgW0HCQH8l+Ay0G0=",
     "homepage": "https://registry.terraform.io/providers/sacloud/sakuracloud",
     "owner": "sacloud",
     "repo": "terraform-provider-sakuracloud",
-    "rev": "v2.34.2",
+    "rev": "v2.35.0",
     "spdx": "Apache-2.0",
-    "vendorHash": "sha256-LQAEOSSqpR8ipYkL6dcJvJvgs17VOYRolYn7Qt4Oer4="
+    "vendorHash": "sha256-SY13J+aguuOicQnNBgutjIGh0njrLubpNl0c0b4kNwo="
   },
   "sap-cloud-infrastructure_sci": {
     "hash": "sha256-m3degJZruqRkA/lSnNQrLfJIlpl5k8qCpbyIcsyV5/U=",

pkgs/by-name/al/allure/package.nix

@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "allure";
-  version = "2.38.0";
+  version = "2.38.1";
 
   src = fetchurl {
     url = "https://github.com/allure-framework/allure2/releases/download/${finalAttrs.version}/allure-${finalAttrs.version}.tgz";
-    hash = "sha256-ApYPTQw0FONwkn7Sr2qyJBm3GoszkjnllJLpFcdXdMA=";
+    hash = "sha256-y241mNyZsqiwvYgFeAgqxevq6bLiwKEdx1yFD7aXNr0=";
   };
 
   dontConfigure = true;

pkgs/by-name/an/antora/package.nix

@@ -8,21 +8,24 @@
 
 buildNpmPackage rec {
   pname = "antora";
-  version = "3.1.9";
+  version = "3.1.14";
 
   src = fetchFromGitLab {
     owner = "antora";
     repo = "antora";
     tag = "v${version}";
-    hash = "sha256-hkavYC2LO8NRIRwHNWIJLRDkVnhAB4Di3IqL8uGt+U8=";
+    hash = "sha256-9x80aBm2ZBj389kX2wioe7BtaNjR7p9aEZg7o49v0vY=";
   };
 
-  npmDepsHash = "sha256-ngreuitwUcIDVF6vW7fZA1OaVxr9fv7s0IjCErXlcxg=";
+  npmDepsHash = "sha256-s/f6/PxvSIlhFsCbsD25MPrk67vKXrnDqbfbW72Tr4I=";
 
   # This is to stop tests from being ran, as some of them fail due to trying to query remote repositories
+  # Also disable the postbuild lint step which tries to download @biomejs/biome at build time
   postPatch = ''
-    substituteInPlace package.json --replace \
+    substituteInPlace package.json --replace-warn \
       '"_mocha"' '""'
+    substituteInPlace package.json --replace-warn \
+      '"npm run lint"' '""'
   '';
 
   postInstall = ''

pkgs/by-name/as/asciijump/package.nix

@@ -0,0 +1,49 @@
+{
+  lib,
+  stdenv,
+  ctags,
+  fetchFromGitLab,
+  slang,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "asciijump";
+  version = "1.0.2_beta-12";
+
+  src = fetchFromGitLab {
+    domain = "salsa.debian.org";
+    owner = "games-team";
+    repo = "asciijump";
+    tag = "debian/${finalAttrs.version}";
+    hash = "sha256-fD/5tWg/GzSfVYvUWsz1FHXhLx9ud0JRMkM9NhVePdA=";
+  };
+
+  patchPhase = ''
+    for file in $(cat debian/patches/series); do
+      echo "$file:"
+      patch -p1 < debian/patches/$file
+    done
+  '';
+
+  strictDeps = true;
+  enableParallelBuilding = true;
+
+  NIX_CFLAGS_COMPILE = [ "-fsigned-char" ];
+
+  nativeBuildInputs = [ ctags ];
+  buildInputs = [ slang ];
+
+  postInstall = ''
+    rm -rf $out/var
+  '';
+
+  meta = {
+    description = "Small and funny ASCII-art game about ski jumping";
+    homepage = "https://salsa.debian.org/games-team/asciijump";
+    changelog = "https://salsa.debian.org/games-team/asciijump/-/blob/${finalAttrs.src.tag}/debian/changelog";
+    license = lib.licenses.gpl2Plus;
+    mainProgram = "asciijump";
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ Zaczero ];
+  };
+})

pkgs/by-name/ca/caddy/package.nix

@@ -1,6 +1,6 @@
 {
   lib,
-  buildGo125Module,
+  buildGoModule,
   callPackage,
   fetchFromGitHub,
   nixosTests,
@@ -19,7 +19,7 @@ let
     hash = "sha256-D1qI7TDJpSvtgpo1FsPZk6mpqRvRharFZ8soI7Mn3RE=";
   };
 in
-buildGo125Module (finalAttrs: {
+buildGoModule (finalAttrs: {
   pname = "caddy";
   inherit version;
 

pkgs/by-name/ca/calibre/package.nix

@@ -40,11 +40,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "calibre";
-  version = "9.4.0";
+  version = "9.5.0";
 
   src = fetchurl {
     url = "https://download.calibre-ebook.com/${finalAttrs.version}/calibre-${finalAttrs.version}.tar.xz";
-    hash = "sha256-3anPEeVB5C7RuS5ZCFMvow5WhkIopgCpxpmcstsIgX4=";
+    hash = "sha256-NDz3SxR8GyJi/POdpgEJzRdYNVV88/NkHczrA0JylfM=";
   };
 
   patches =

pkgs/by-name/ch/chibi/package.nix

@@ -6,14 +6,14 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "0.11";
+  version = "0.12";
   pname = "chibi-scheme";
 
   src = fetchFromGitHub {
     owner = "ashinn";
     repo = "chibi-scheme";
     rev = finalAttrs.version;
-    sha256 = "sha256-i+xiaYwM7a+0T824VSuh7UUNI6HV9KpqzQPE1WAZ+As=";
+    sha256 = "sha256-TQT3/fZqgQP5UfCKN1ShvGgxdjfNdUWnpqdHKQMJHzY=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/by-name/cl/claws-mail/package.nix

@@ -275,11 +275,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "claws-mail";
-  version = "4.3.1";
+  version = "4.4.0";
 
   src = fetchurl {
     url = "https://claws-mail.org/download.php?file=releases/claws-mail-${finalAttrs.version}.tar.xz";
-    hash = "sha256-2K3yEMdnq1glLfxas8aeYD1//bcoGh4zQNLYYGL0aKY=";
+    hash = "sha256-A+BUnV8PzXpZgEGGUkEF0F67XlNNQqS4apqQ9ynKJVs=";
   };
 
   outputs = [
@@ -300,9 +300,9 @@ stdenv.mkDerivation (finalAttrs: {
 
   postPatch = ''
     substituteInPlace configure.ac \
-      --replace 'm4_esyscmd([./get-git-version])' '${finalAttrs.version}'
+      --replace-fail 'm4_esyscmd([./get-git-version])' '${finalAttrs.version}'
     substituteInPlace src/procmime.c \
-        --subst-var-by MIMEROOTDIR ${shared-mime-info}/share
+      --subst-var-by MIMEROOTDIR ${shared-mime-info}/share
   '';
 
   nativeBuildInputs = [

pkgs/by-name/di/diffnav/package.nix

@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "diffnav";
-  version = "0.10.0";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "dlvhdr";
     repo = "diffnav";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hoikRqhVjbd7hH4H+f5OGq0KdIX1etAJhrRL+QsAkx8=";
+    hash = "sha256-6VtAQzZNLQrf8QYVXxLUgb3F6xguFDbwaE9kahPhbSE=";
   };
 
-  vendorHash = "sha256-VNpmcniSpeocl9B+aNwLh4XPyPnYC8SXowJPYWHyzWs=";
+  vendorHash = "sha256-gmmckzR0D1oFuTG5TAb6gLMoNbcZl9EsjbFjhPfJqnQ=";
 
   ldflags = [
     "-s"

pkgs/by-name/go/gogup/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "gogup";
-  version = "1.1.3";
+  version = "1.1.4";
 
   src = fetchFromGitHub {
     owner = "nao1215";
     repo = "gup";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-R/LTBvutafDTCY39FvUh0dXWwzRKywTlN2G+Qa/rbf8=";
+    hash = "sha256-ptLWQdafFo1zpcgzW0c3C9t8MKquE+fEUEQehSqA2MY=";
   };
 
-  vendorHash = "sha256-tFuZ30GjP2GpRjCUXJRexJYXUNDTNktBMKi7ntu3bWM=";
+  vendorHash = "sha256-2iPRWNbhXiaj3jZjWQeEl/hieIzJ3ePYh75rMWDh/pc=";
   doCheck = false;
 
   ldflags = [

pkgs/by-name/go/google-guest-oslogin/package.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "google-guest-oslogin";
-  version = "20250821.00";
+  version = "20260214.00";
 
   src = fetchFromGitHub {
     owner = "GoogleCloudPlatform";
     repo = "guest-oslogin";
     rev = finalAttrs.version;
-    sha256 = "sha256-dvLr3rOzHs5gRbllxqmnkLlHUFYv9Hm2vz6AkwZoZy4=";
+    hash = "sha256-xMelRZ3OGQwZLOC03TjpUcXWqsViVWffIZcSVLz58S4=";
   };
 
   postPatch = ''
@@ -40,6 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
     "MANDIR=$(out)/share/man"
     "SYSTEMDDIR=$(out)/etc/systemd/system"
     "PRESETDIR=$(out)/etc/systemd/system-preset"
+    "GOOGLEUSERSDIR=$(out)/google-users.d" # A readme is installed to this directory
   ];
 
   postInstall = ''

pkgs/by-name/iw/iwd/package.nix

@@ -15,12 +15,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "iwd";
-  version = "3.11";
+  version = "3.12";
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/network/wireless/iwd.git";
     tag = finalAttrs.version;
-    hash = "sha256-H8kyj5RTY20wwRUJIYJF8lIQ367biItJpHYZeMcNHSE=";
+    hash = "sha256-78Zw/i2dXecvC+DDSunPlUzqJj0FFYf7Sm6iN5VXBbA=";
   };
 
   patches = [

pkgs/by-name/kr/kratos/package.nix

@@ -3,6 +3,7 @@
   buildGoModule,
   lib,
   stdenv,
+  versionCheckHook,
 }:
 
 buildGoModule (finalAttrs: {
@@ -24,9 +25,12 @@ buildGoModule (finalAttrs: {
 
   # Pass versioning information via ldflags
   ldflags = [
-    "-X github.com/ory/kratos/driver/config.Version=${finalAttrs.version}"
+    "-X github.com/ory/kratos/driver/config.Version=v${finalAttrs.version}"
   ];
 
+  # large portion of tests fail due to:
+  #     provider.go:39: building the Go binary returned error: exit status 1
+  #        cannot find module providing package github.com/ory/x/jsonnetsecure/cmd: import lookup disabled by -mod=vendor
   doCheck = false;
 
   preBuild = ''
@@ -43,6 +47,10 @@ buildGoModule (finalAttrs: {
     substituteInPlace Makefile --replace-fail '/usr/bin/env bash' '${stdenv.shell}'
   '';
 
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = [ "version" ];
+
   meta = {
     mainProgram = "kratos";
     description = "API-first Identity and User Management system that is built according to cloud architecture best practices";

pkgs/by-name/li/librewolf-unwrapped/src.json

@@ -1,8 +1,8 @@
 {
-  "packageVersion": "148.0.2-2",
+  "packageVersion": "148.0.2-3",
   "source": {
-    "rev": "148.0.2-2",
-    "hash": "sha256-vP2m9iewrQdPXIfTIl7d331AAJMo4Hz7BQCBJqI4FcQ="
+    "rev": "148.0.2-3",
+    "hash": "sha256-HPmzhmDvM3wccpKT9auKsV3w0tA9wQEs3sxFyBKCfqQ="
   },
   "firefox": {
     "version": "148.0.2",

pkgs/by-name/li/linyaps/package.nix

@@ -39,13 +39,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "linyaps";
-  version = "1.12.0";
+  version = "1.12.1";
 
   src = fetchFromGitHub {
     owner = "OpenAtom-Linyaps";
     repo = finalAttrs.pname;
     tag = finalAttrs.version;
-    hash = "sha256-5vbCic+kAa1c5Io92LyJ20y+/v3M3fKh+AHKaf7kP14=";
+    hash = "sha256-hNXpJCz7px8uw2mbBhou3+Gb5InlMXJT2PjWmUycX5A=";
   };
 
   patches = [

pkgs/by-name/ll/lldpd/package.nix

@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lldpd";
-  version = "1.0.20";
+  version = "1.0.21";
 
   src = fetchurl {
     url = "https://media.luffy.cx/files/lldpd/lldpd-${finalAttrs.version}.tar.gz";
-    hash = "sha256-YbjLItSHnmj3glovuOHpKrtKukdzl3zwJYvDLtn1VFA=";
+    hash = "sha256-WxsBBgeaB4W1XhvkXOxAtmtBd58+5vGo0tvXXTid8JE=";
   };
 
   configureFlags = [

pkgs/by-name/me/mediamtx/package.nix

@@ -15,16 +15,16 @@ in
 buildGo126Module (finalAttrs: {
   pname = "mediamtx";
   # check for hls.js version updates in internal/servers/hls/hlsjsdownloader/VERSION
-  version = "1.16.3";
+  version = "1.17.0";
 
   src = fetchFromGitHub {
     owner = "bluenviron";
     repo = "mediamtx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TjeNm6gfhw+5IWtlojdO24k/N8oDZddFgQY7/e+dlPY=";
+    hash = "sha256-k+XpnoERFJdpjvyby6vvRyJst9nA2NDq3cMkGL7kRQE=";
   };
 
-  vendorHash = "sha256-JHM7yNUaT1UjK0t97ppxW9dTAwcSdF8gmPat5+k3uzo=";
+  vendorHash = "sha256-h3i9pSjCs4A2HBiVF8yz0BN6n9UmuOxNurPFlxFGxtw=";
 
   postPatch = ''
     cp ${hlsJs} internal/servers/hls/hls.min.js

pkgs/by-name/me/meilisearch/package.nix

@@ -8,18 +8,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "meilisearch";
-  version = "1.38.2";
+  version = "1.39.0";
 
   src = fetchFromGitHub {
     owner = "meilisearch";
     repo = "meilisearch";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-JzcAE3rZAWU83qinJONzWbWxakYy+kNtZFAUrUljXF4=";
+    hash = "sha256-bgW/++VAnKzmUYm7A6JCzIBzXKlAgSMgxAseMfApce8=";
   };
 
   cargoBuildFlags = [ "--package=meilisearch" ];
 
-  cargoHash = "sha256-M85fk7Lx91B9D8Wl+g0wbdr/P0dHKjiVCM2nSlB2yo0=";
+  cargoHash = "sha256-IsrYJD/S5Or9AOa6+KtafRRCrCmFLdt68ysVIQQhJkE=";
 
   # Default features include mini dashboard which downloads something from the internet.
   buildNoDefaultFeatures = true;

pkgs/by-name/me/meme-suite/package.nix

@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "meme-suite";
-  version = "5.5.8";
+  version = "5.5.9";
 
   src = fetchurl {
     url = "https://meme-suite.org/meme-software/${version}/meme-${version}.tar.gz";
-    sha256 = "sha256-G0oXU3lcCbHUbebEo/BLM8G8w+QbvPTm4UIg6K12dDs=";
+    sha256 = "sha256-BAb7ex3Cf2qrPW06KezfYXu92UZpDPqXyiEpvCEL/RI=";
   };
 
   buildInputs = [ zlib ];

pkgs/by-name/mo/mochi/package.nix

@@ -12,14 +12,14 @@
 
 let
   pname = "mochi";
-  version = "1.21.1";
+  version = "1.21.3";
 
   linux = appimageTools.wrapType2 rec {
     inherit pname version meta;
 
     src = fetchurl {
       url = "https://download.mochi.cards/releases/Mochi-${version}.AppImage";
-      hash = "sha256-JgKzq4iUqpFiB6TpC5Wv7vx+pjeqr9EzNwftiNjEl/I=";
+      hash = "sha256-wJ08L5sWNgBhGyT5m9yVKWdZU8YGiCwhpJQ/3veMpsM=";
     };
 
     appimageContents = appimageTools.extractType2 { inherit pname version src; };
@@ -44,9 +44,9 @@ let
       url = "https://download.mochi.cards/releases/Mochi-${version}${lib.optionalString stdenv.hostPlatform.isAarch64 "-arm64"}.dmg";
       hash =
         if stdenv.hostPlatform.isAarch64 then
-          "sha256-b6lANyQWbovy2XegEJ/cNFrhh3YA4G6jzl5rpexi0oQ="
+          "sha256-BEMHe7MOHw2pj15GSYVXv99uNVpwH5zVRRF64Eh3glo="
         else
-          "sha256-iHNBD8MDmH+OzM2xUVOErB3aPypFN0wCkLKgfSjzfSQ=";
+          "sha256-Rup9V4YPoR/VuTTdg8lkLy/+gbHir1PwpC0FCBoJ7DQ=";
     };
 
     sourceRoot = ".";

pkgs/by-name/nu/numr/package.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "numr";
-  version = "0.5.2";
+  version = "0.5.5";
 
   src = fetchFromGitHub {
     owner = "nasedkinpv";
     repo = "numr";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-/tVUISuNspIZTLQxWPq0RSF1wUOYG7wzsYbDAXWobdo=";
+    hash = "sha256-dx5Ow+trL0/gVKj0IOAVwwgNMl4ZwF5K7MEi6fv/QYc=";
   };
 
-  cargoHash = "sha256-tmWK0pQN52Prk0sm8R7BnscucdhY4f7tF5YUbEDClYs=";
+  cargoHash = "sha256-8illKr1unCiZRlcpuzBSCJ/H7HJPW2cHDLq1vF76vss=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/ov/overturemaps/package.nix

@@ -6,22 +6,28 @@
 
 python3Packages.buildPythonPackage rec {
   pname = "overturemaps";
-  version = "0.17.0";
+  version = "0.19.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-s8/yV3eneSsQgK8vJqhEBoidgLurz84XgS7qiuLWOEQ=";
+    hash = "sha256-y91x+S6YKBldy7OWIXCJQ5HuR3KrFRdfBkfMmkaeXy8=";
   };
 
-  build-system = with python3Packages; [ poetry-core ];
+  nativeBuildInputs = with python3Packages; [
+    hatchling
+  ];
 
   dependencies = with python3Packages; [
     click
+    geopandas
+    numpy
     pyarrow
     shapely
   ];
 
+  pythonImportsCheck = [ "overturemaps" ];
+
   meta = {
     description = "Official command-line tool of the Overture Maps Foundation";
     homepage = "https://overturemaps.org/";

pkgs/by-name/pr/proton-pass/package.nix

@@ -10,17 +10,17 @@
 }:
 let
   pname = "proton-pass";
-  version = "1.34.2";
+  version = "1.35.0";
 
   passthru = {
     sources = {
       "x86_64-linux" = fetchurl {
         url = "https://proton.me/download/pass/linux/x64/proton-pass_${version}_amd64.deb";
-        hash = "sha256-i5QQ1uzQ2tSDX4I/APL60QcHh9Ovc7ciueRnz7cZUuE=";
+        hash = "sha256-o85PSfZ0wN+QwjzKLb0/RThfTFsa9xY7r4YesLIWlPI=";
       };
       "aarch64-darwin" = fetchurl {
         url = "https://proton.me/download/pass/macos/ProtonPass_${version}.dmg";
-        hash = "sha256-oo02IYOKZEsr0+4zimSFkutTGuS63ZvMZTeUTapZrVw=";
+        hash = "sha256-zwV1jBbtplM7TdS1KkEi813Z2ex45z3BP2ZA72s6pxE=";
       };
       "x86_64-darwin" = passthru.sources."aarch64-darwin";
     };

pkgs/by-name/rt/rtk/package.nix

@@ -12,18 +12,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rtk";
-  version = "0.30.0";
+  version = "0.31.0";
 
   src = fetchFromGitHub {
     owner = "rtk-ai";
     repo = "rtk";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-aB9SWF9jYHeH3Apz5v4mQptLa6tS9cIfyfo6rHqsD8w=";
+    hash = "sha256-p4OX3SSDGKlHVLIWhgKpcme449wOHbfWbc3mxlCkaMI=";
   };
 
   strictDeps = true;
 
-  cargoHash = "sha256-0dpZRBPubzd2GuK02/jbNBWOR/TpFM5lVMucEii/JxM=";
+  cargoHash = "sha256-37YHhccgPNUrlFh35CoQv2H+Y4e41ax0ZoIvrIC0o6I=";
 
   nativeBuildInputs = [
     makeWrapper

pkgs/by-name/ta/tana/package.nix

@@ -62,7 +62,7 @@ let
     stdenv.cc.cc
     stdenv.cc.libc
   ];
-  version = "1.511.5";
+  version = "1.515.0";
 in
 stdenv.mkDerivation {
   pname = "tana";
@@ -70,7 +70,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://github.com/tanainc/tana-desktop-releases/releases/download/v${version}/tana_${version}_amd64.deb";
-    hash = "sha256-AUnA7Q7cq0z8TeTQF2/3aT6WHypZQ+7J9UjfkMJYnoA=";
+    hash = "sha256-L6opOfwlcgADWbMibPtF4YijsFWroYL7alpvDHN5rtg=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ti/tirith/package.nix

@@ -8,15 +8,15 @@
 }:
 rustPlatform.buildRustPackage (final: {
   pname = "tirith";
-  version = "0.2.1";
+  version = "0.2.8";
   src = fetchFromGitHub {
     owner = "sheeki03";
     repo = "tirith";
     tag = "v${final.version}";
-    hash = "sha256-zm39lMApUtSrIcXZ7JGeR6ayqtg7dljfRGBYi8zH4UI=";
+    hash = "sha256-Kd6Rr8x35COc9DA+zskxEPXwHupP9kGNyvKDPcwP09A=";
   };
 
-  cargoHash = "sha256-1363uY+um9U2zT2ss7Ysm8SOb2zf1SuRbc43P1bVlls=";
+  cargoHash = "sha256-D4jN7M1tWW5s+VNJlMFb2EDQ3zdLDtBwuztNbrLMiCA=";
 
   cargoBuildFlags = [
     "-p"

pkgs/by-name/tr/tracexec/package.nix

@@ -15,16 +15,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tracexec";
-  version = "0.13.1";
+  version = "0.17.0";
 
   src = fetchFromGitHub {
     owner = "kxxt";
     repo = "tracexec";
-    rev = "dbb9b733370f5200df2a0de7f007312c23431480";
-    hash = "sha256-M2ZIfWupnFxQZvr5cl8V0xtLgh+xBcaHHVsHIoio7nI=";
+    rev = "ecbda651a4006789debf565376cd6f37241dec3e";
+    hash = "sha256-wP7jAGoWgvm3/4XBHr27MD8M9qwyVpuDVR96S8+I3eo=";
   };
 
-  cargoHash = "sha256-cyzSxibLw6sb0V3ueNcp55OhFQ5jUNJWcSF8uYnzG2M=";
+  cargoHash = "sha256-kJrWAyRcU5eEfTwaAxcN6oE5KHgBdjznWeI21/3c/UE=";
 
   hardeningDisable = [ "zerocallusedregs" ];
 
@@ -44,20 +44,18 @@ rustPlatform.buildRustPackage (finalAttrs: {
   cargoBuildFlags = [
     "--no-default-features"
     "--features=recommended"
-  ]
-  # Remove RiscV64 specialisation when this is fixed:
-  # * https://github.com/NixOS/nixpkgs/pull/310158#pullrequestreview-2046944158
-  # * https://github.com/rust-vmm/seccompiler/pull/72
-  ++ lib.optional stdenv.hostPlatform.isRiscV64 "--no-default-features";
+  ];
 
   preBuild = ''
     sed -i '1ino-clearly-defined = true' about.toml  # disable network requests
     cargo about generate --config about.toml -o THIRD_PARTY_LICENSES.HTML about.hbs
   '';
 
-  checkFlags = [
-    "--skip=cli::test::log_mode_without_args_works" # `Permission denied` (needs `CAP_SYS_PTRACE`)
-  ];
+  # tracexec uses $XDG_DATA_HOME/tracexec for storing temporary files and logs.
+  # Set this directory to $TMPDIR because integration tests needs to access it.
+  preCheck = ''
+    export TRACEXEC_DATA="$TMPDIR"
+  '';
 
   postInstall = ''
     # Remove test binaries (e.g. `empty-argv`, `corrupted-envp`) and only retain `tracexec`
@@ -77,6 +75,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     mainProgram = "tracexec";
     maintainers = with lib.maintainers; [
       fpletz
+      kxxt
       nh2
     ];
     platforms = lib.platforms.linux;

pkgs/by-name/tu/turingdb/package.nix

@@ -26,13 +26,13 @@ let
 in
 turingstdenv.mkDerivation (finalAttrs: {
   pname = "turingdb";
-  version = "1.22";
+  version = "1.23";
 
   src = fetchFromGitHub {
     owner = "turing-db";
     repo = "turingdb";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gG3KzEC90nLbIisBt4xnHXtz6LesqJxaviIkTrcTMG0=";
+    hash = "sha256-v9uZqgC4UT2EnBJ+SRr96TiWAPIy1v39GEa2vF9hLf4=";
 
     fetchSubmodules = true;
 

pkgs/by-name/ur/url-parser/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "url-parser";
-  version = "2.1.14";
+  version = "2.1.15";
 
   src = fetchFromGitHub {
     owner = "thegeeklab";
     repo = "url-parser";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jTytdeIAU59DjtFT2eOx9Tf1hZcWYRVOD577mAfx2Ag=";
+    hash = "sha256-lWEzzCR4EuiaFJ4kAfzV0qZlGWVLCclXjwPm5ZEHZrM=";
   };
 
-  vendorHash = "sha256-cs1dPW2AYdSM786Ei7Zle/audU2o866vDIhpOzWdMkI=";
+  vendorHash = "sha256-Do+zP+dZQE0piuzAzbr0GN4Qw/JJQEhht6AOInFVi0A=";
 
   ldflags = [
     "-s"

pkgs/by-name/ve/verifpal/package.nix

@@ -7,27 +7,21 @@
 
 buildGoModule (finalAttrs: {
   pname = "verifpal";
-  version = "0.27.4";
+  version = "0.31.2";
 
   src = fetchFromGitHub {
     owner = "symbolicsoft";
     repo = "verifpal";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-kBeQ7U97Ezj85A/FbNnE1dXR7VJzx0EUrDbzwOgKl8E=";
+    hash = "sha256-k8SGCo36tk4Etg4jt0NDeEj1BmSYjaZZptNNnrOXs4E=";
   };
 
-  vendorHash = "sha256-FvboLGdT+/W5on7NSzRp9QfV2peNVICypSFWAGFakLU=";
+  vendorHash = "sha256-Vg375DBPvurRpwl918AGQU+wJGnB1tYisgch9FA+Y/g=";
 
   nativeBuildInputs = [ pigeon ];
 
   subPackages = [ "cmd/verifpal" ];
 
-  # goversioninfo is for Windows only and can be skipped during go generate
-  preBuild = ''
-    substituteInPlace cmd/verifpal/main.go --replace "go:generate goversioninfo" "(disabled goversioninfo)"
-    go generate verifpal.com/cmd/verifpal
-  '';
-
   meta = {
     homepage = "https://verifpal.com/";
     description = "Cryptographic protocol analysis for students and engineers";

pkgs/by-name/wh/whois/package.nix

@@ -50,7 +50,10 @@ stdenv.mkDerivation (finalAttrs: {
     done
   '';
 
-  makeFlags = [ "HAVE_ICONV=1" ];
+  makeFlags = [
+    "HAVE_ICONV=1"
+    "CONFIG_FILE=/etc/whois.conf"
+  ];
   buildFlags = [ "whois" ];
 
   installTargets = [ "install-whois" ];

pkgs/development/cuda-modules/packages/cuda_nvcc.nix

@@ -189,6 +189,29 @@ buildRedist (finalAttrs: {
           --replace-fail \
             "rsqrtf(float x);" \
             "rsqrtf(float x) noexcept (true);"
+
+        # math_functions.hpp has the same functions wrapped in __func__() macros.
+        # These also need throw() annotations to match glibc 2.42's declarations.
+        nixLog "Patching math_functions.hpp signatures to match glibc's ones"
+        substituteInPlace "''${!outputInclude:?}/include/crt/math_functions.hpp" \
+          --replace-fail \
+            "__func__(double rsqrt(const double a))" \
+            "__func__(double rsqrt(const double a) throw())" \
+          --replace-fail \
+            "__func__(double sinpi(double a))" \
+            "__func__(double sinpi(double a) throw())" \
+          --replace-fail \
+            "__func__(double cospi(double a))" \
+            "__func__(double cospi(double a) throw())" \
+          --replace-fail \
+            "__func__(float rsqrtf(const float a))" \
+            "__func__(float rsqrtf(const float a) throw())" \
+          --replace-fail \
+            "__func__(float sinpif(const float a))" \
+            "__func__(float sinpif(const float a) throw())" \
+          --replace-fail \
+            "__func__(float cospif(const float a))" \
+            "__func__(float cospif(const float a) throw())"
       ''
     );
 

pkgs/development/python-modules/cymem/default.nix

@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "cymem";
-  version = "2.0.13";
+  version = "2.0.14";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "explosion";
     repo = "cymem";
     tag = "release-v${version}";
-    hash = "sha256-n65tkACZi1G4qS/VQWB5ghopzCd5QHRyp9qit+yENIs=";
+    hash = "sha256-pb7AWkCOLfoH2kLNNwIxxHyGsxCpq72Qzid4aCYu9XM=";
   };
 
   build-system = [

pkgs/development/python-modules/ddgs/default.nix

@@ -1,53 +1,44 @@
 {
-  lib,
   buildPythonPackage,
-  fetchFromGitHub,
-  setuptools,
   click,
+  fastapi,
+  fetchFromGitHub,
+  lib,
   lxml,
-  httpx,
-  h2,
-  fake-useragent,
+  mcp,
+  primp,
+  setuptools,
+  uvicorn,
   versionCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "ddgs";
-  version = "9.10.0";
+  version = "9.11.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "deedy5";
     repo = "ddgs";
-    tag = "v${version}";
-    hash = "sha256-NNXGvDGynu6QtVqxVr74b/qehQ7qhq1NiVxyuKw2C4w=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-+UefNpWKq1Rcm90M+hQavEORYZF4FWC1FzH7TfAH6WA=";
   };
 
-  patches = [
-    # We're removing the HTTP client primp below for security reasons,
-    # but can use the already included httpx instead.
-    # Note that while httpx is only used for HTTP/2 by upstream,
-    # it can handle HTTP/1.1 just fine as well.
-    ./replace-primp.patch
-  ];
-
-  pythonRemoveDeps = [
-    # primp requires a very outdated, potentially insecure version of boringssl
-    "primp"
-  ];
-
   build-system = [ setuptools ];
 
   dependencies = [
     click
     lxml
-    httpx
-    h2
-    fake-useragent
-  ]
-  ++ httpx.optional-dependencies.http2
-  ++ httpx.optional-dependencies.socks
-  ++ httpx.optional-dependencies.brotli;
+    primp
+  ];
+
+  optional-dependencies = {
+    api = [
+      fastapi
+      mcp
+      uvicorn
+    ];
+  };
 
   nativeCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = "version";
@@ -55,11 +46,11 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "ddgs" ];
 
   meta = {
-    description = "D.D.G.S. | Dux Distributed Global Search. A metasearch library that aggregates results from diverse web search services";
+    description = "A metasearch library that aggregates results from diverse web search services";
     mainProgram = "ddgs";
     homepage = "https://github.com/deedy5/ddgs";
-    changelog = "https://github.com/deedy5/ddgs/releases/tag/${src.tag}";
+    changelog = "https://github.com/deedy5/ddgs/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ drawbu ];
   };
-}
+})

pkgs/development/python-modules/ddgs/replace-primp.patch

@@ -1,39 +0,0 @@
-diff --git a/ddgs/base.py b/ddgs/base.py
-index 11111acc7a..b71ee337d9 100644
---- a/ddgs/base.py
-+++ b/ddgs/base.py
-@@ -9,7 +9,7 @@
- from lxml import html
- from lxml.etree import HTMLParser as LHTMLParser
- 
--from .http_client import HttpClient
-+from .http_client2 import HttpClient2 as HttpClient
- from .results import BooksResult, ImagesResult, NewsResult, TextResult, VideosResult
- 
- logger = logging.getLogger(__name__)
-diff --git a/ddgs/cli.py b/ddgs/cli.py
-index 36cf2f373c..7cf0b2f35d 100644
---- a/ddgs/cli.py
-+++ b/ddgs/cli.py
-@@ -9,11 +9,11 @@
- from urllib.parse import unquote
- 
- import click
--import primp
- 
- from . import __version__
- from .ddgs import DDGS
- from .utils import _expand_proxy_tb_alias
-+from .http_client2 import HttpClient2
- 
- logger = logging.getLogger(__name__)
- 
-@@ -103,7 +103,7 @@
- 
- def _download_file(url: str, dir_path: str, filename: str, proxy: str | None, *, verify: bool) -> None:
-     try:
--        resp = primp.Client(proxy=proxy, impersonate="random", impersonate_os="random", timeout=10, verify=verify).get(
-+        resp = HttpClient2(proxy=proxy, timeout=10, verify=verify).get(
-             url,
-         )
-         if resp.status_code == 200:

pkgs/development/python-modules/einx/default.nix

@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "einx";
-  version = "0.4.1";
+  version = "0.4.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "fferflo";
     repo = "einx";
     rev = "v${version}";
-    hash = "sha256-n+39RMmdMPsfSufa7rHas2cbRa0SQMTaU5oRksHlDr0=";
+    hash = "sha256-dOwAcTs7e1BuqUFfqJGKsJhD8mxHTuctkgMH8H0gakA=";
   };
 
   build-system = [

pkgs/development/python-modules/escapism/default.nix

@@ -2,20 +2,29 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  setuptools,
+  setuptools-scm,
+  pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "escapism";
   version = "1.1.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
-    sha256 = "sha256-rdEw5IqFuxquo+dPsDH1AzxwVa7bOaMmX5I9X0DD+XQ=";
+    inherit (finalAttrs) pname version;
+    hash = "sha256-rdEw5IqFuxquo+dPsDH1AzxwVa7bOaMmX5I9X0DD+XQ=";
   };
 
-  # No tests distributed
-  doCheck = false;
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
   meta = {
     description = "Simple, generic API for escaping strings";
@@ -23,4 +32,4 @@ buildPythonPackage rec {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ bzizou ];
   };
-}
+})

pkgs/development/python-modules/optimum-onnx/default.nix

@@ -47,9 +47,6 @@ buildPythonPackage rec {
       onnxruntime
     ];
     # onnxruntime-gpu = [ onnxruntime-gpu ];
-    quality = [
-      ruff
-    ];
   };
 
   pythonImportsCheck = [ "optimum.onnxruntime" ];

pkgs/development/python-modules/optimum/default.nix

@@ -15,14 +15,7 @@
   transformers,
 
   # optional-dependencies
-  diffusers,
-  h5py,
-  onnx,
-  onnxruntime,
-  protobuf,
-  tensorflow,
-  tf2onnx,
-  timm,
+  optimum-onnx,
 }:
 
 buildPythonPackage rec {
@@ -47,33 +40,16 @@ buildPythonPackage rec {
     packaging
     torch
     transformers
-  ]
-  ++ transformers.optional-dependencies.sentencepiece;
+  ];
 
   optional-dependencies = {
+    onnx = [
+      optimum-onnx
+    ];
     onnxruntime = [
-      onnx
-      datasets
-      protobuf
-      onnxruntime
-    ];
-    exporters = [
-      onnx
-      timm
-      onnxruntime
-      protobuf
-    ];
-    exporters-tf = [
-      onnx
-      timm
-      h5py
-      tf2onnx
-      onnxruntime
-      numpy
-      datasets
-      tensorflow
-    ];
-    diffusers = [ diffusers ];
+      optimum-onnx
+    ]
+    ++ optimum-onnx.optional-dependencies.onnxruntime;
     intel = [
       # optimum-intel
     ];
@@ -90,7 +66,6 @@ buildPythonPackage rec {
       # optimum-graphcore
     ];
     habana = [
-      transformers
       # optimum-habana
     ];
     neuron = [

pkgs/development/python-modules/primp/default.nix

@@ -0,0 +1,61 @@
+{
+  lib,
+  stdenv,
+  buildPythonPackage,
+  fetchFromGitHub,
+  rustPlatform,
+  libiconv,
+  pytestCheckHook,
+  pytest-asyncio,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "primp";
+  version = "1.1.3";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "deedy5";
+    repo = "primp";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ahTIEStYQ5M7EYidQYpYEVbYwwFFRfBXErWOMDdgNnk=";
+  };
+
+  # The Cargo.lock is not pushed upstream
+  cargoDeps = rustPlatform.importCargoLock { lockFile = ./Cargo.lock; };
+  postPatch = ''
+    cp ${./Cargo.lock} Cargo.lock
+  '';
+
+  buildAndTestSubdir = "crates/primp-python";
+
+  nativeBuildInputs = [
+    rustPlatform.bindgenHook
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+  ];
+
+  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
+    libiconv
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-asyncio
+  ];
+  disabledTestPaths = [ "crates/primp-python/tests/test_impersonate.py" ];
+
+  # Tests crash with Abort trap: 6 on Darwin due to tokio runtime
+  # initialization in PyInit_pyo3_async_runtimes being blocked by the sandbox.
+  doCheck = !stdenv.isDarwin;
+
+  pythonImportsCheck = [ "primp" ];
+
+  meta = {
+    changelog = "https://github.com/deedy5/primp/releases/tag/${finalAttrs.src.tag}";
+    description = " HTTP client that can impersonate web browsers";
+    homepage = "https://github.com/deedy5/primp";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ drawbu ];
+  };
+})

pkgs/development/python-modules/pydantic-zarr/default.nix

@@ -21,14 +21,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pydantic-zarr";
-  version = "0.9.1";
+  version = "0.9.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "zarr-developers";
     repo = "pydantic-zarr";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rgtRN3EXSORa2g2a4aCZacCDLeWM6BosZe5XR0Pg6pU=";
+    hash = "sha256-zwC1qds2/KbwdBvoB2Eep0nL+6WLZBNEtxgKmvrRYE4=";
   };
 
   build-system = [

pkgs/development/python-modules/torch/source/default.nix

@@ -118,7 +118,7 @@ let
 
   setBool = v: if v then "1" else "0";
 
-  # https://github.com/pytorch/pytorch/blob/v2.8.0/torch/utils/cpp_extension.py#L2411-L2414
+  # https://github.com/pytorch/pytorch/blob/v2.10.0/torch/utils/cpp_extension.py#L2411-L2414
   supportedTorchCudaCapabilities =
     let
       real = [
@@ -140,10 +140,9 @@ let
         "9.0"
         "9.0a"
         "10.0"
-        "10.0"
         "10.0a"
-        "10.1"
-        "10.1a"
+        "11.0"
+        "11.0a"
         "10.3"
         "10.3a"
         "12.0"

pkgs/os-specific/linux/kernel/xanmod-kernels.nix

@@ -15,14 +15,14 @@ let
   variants = {
     # ./update-xanmod.sh lts
     lts = {
-      version = "6.18.18";
-      hash = "sha256-ynfFioeCP2kvuCE6swH6OmqbfVDGBGEDfCJjaUfZ9g4=";
+      version = "6.18.19";
+      hash = "sha256-m0EYkUY4EfNaWKJ7XE+3CCcJubcZEBbkV8wumykZH+Y=";
       isLTS = true;
     };
     # ./update-xanmod.sh main
     main = {
-      version = "6.19.8";
-      hash = "sha256-Ay3tWPDz//Pnaam0EjqvVOM3zxSFTby0YxdWBW1a4es=";
+      version = "6.19.9";
+      hash = "sha256-O3R19FuTw2Q80I8HEJM3gzl/yWWF40TRZvMLUfI6N3Y=";
     };
   };
 

pkgs/stdenv/adapters.nix

@@ -127,27 +127,23 @@ rec {
 
   # Return a modified stdenv that builds static libraries instead of
   # shared libraries.
-  makeStaticLibraries =
-    stdenv:
-    stdenv.override (old: {
-      mkDerivationFromStdenv = extendMkDerivationArgs old (
-        args:
-        {
-          dontDisableStatic = true;
-        }
-        // lib.optionalAttrs (!(args.dontAddStaticConfigureFlags or false)) {
-          configureFlags = (args.configureFlags or [ ]) ++ [
-            "--enable-static"
-            "--disable-shared"
-          ];
-          cmakeFlags = (args.cmakeFlags or [ ]) ++ [ "-DBUILD_SHARED_LIBS:BOOL=OFF" ];
-          mesonFlags = (args.mesonFlags or [ ]) ++ [
-            "-Ddefault_library=static"
-            "-Ddefault_both_libraries=static"
-          ];
-        }
-      );
-    });
+  makeStaticLibraries = overrideMkDerivationArgs (
+    args:
+    {
+      dontDisableStatic = true;
+    }
+    // lib.optionalAttrs (!(args.dontAddStaticConfigureFlags or false)) {
+      configureFlags = (args.configureFlags or [ ]) ++ [
+        "--enable-static"
+        "--disable-shared"
+      ];
+      cmakeFlags = (args.cmakeFlags or [ ]) ++ [ "-DBUILD_SHARED_LIBS:BOOL=OFF" ];
+      mesonFlags = (args.mesonFlags or [ ]) ++ [
+        "-Ddefault_library=static"
+        "-Ddefault_both_libraries=static"
+      ];
+    }
+  );
 
   # Best effort static binaries. Will still be linked to libSystem,
   # but more portable than Nix store binaries.
@@ -196,14 +192,10 @@ rec {
     Modify a stdenv so that all buildInputs are implicitly propagated to
     consuming derivations
   */
-  propagateBuildInputs =
-    stdenv:
-    stdenv.override (old: {
-      mkDerivationFromStdenv = extendMkDerivationArgs old (args: {
-        propagatedBuildInputs = (args.propagatedBuildInputs or [ ]) ++ (args.buildInputs or [ ]);
-        buildInputs = [ ];
-      });
-    });
+  propagateBuildInputs = overrideMkDerivationArgs (args: {
+    propagatedBuildInputs = (args.propagatedBuildInputs or [ ]) ++ (args.buildInputs or [ ]);
+    buildInputs = [ ];
+  });
 
   /*
     Modify a stdenv so that the specified attributes are added to
@@ -215,11 +207,7 @@ rec {
           { env.NIX_CFLAGS_COMPILE = "-O0"; }
           stdenv;
   */
-  addAttrsToDerivation =
-    extraAttrs: stdenv:
-    stdenv.override (old: {
-      mkDerivationFromStdenv = extendMkDerivationArgs old (_: extraAttrs);
-    });
+  addAttrsToDerivation = extraAttrs: overrideMkDerivationArgs (_: extraAttrs);
 
   /*
     Modify a stdenv so as to extend `mkDerivation`'s arguments.
@@ -269,28 +257,20 @@ rec {
     binaries have debug info, and compiler optimisations are
     disabled.
   */
-  keepDebugInfo =
-    stdenv:
-    stdenv.override (old: {
-      mkDerivationFromStdenv = extendMkDerivationArgs old (args: {
-        dontStrip = true;
-        env = (args.env or { }) // {
-          NIX_CFLAGS_COMPILE = toString (args.env.NIX_CFLAGS_COMPILE or "") + " -ggdb -Og";
-          NIX_RUSTFLAGS = toString (args.env.NIX_RUSTFLAGS or "") + " -g -C opt-level=0 -C strip=none";
-        };
-      });
-    });
+  keepDebugInfo = overrideMkDerivationArgs (args: {
+    dontStrip = true;
+    env = (args.env or { }) // {
+      NIX_CFLAGS_COMPILE = toString (args.env.NIX_CFLAGS_COMPILE or "") + " -ggdb -Og";
+      NIX_RUSTFLAGS = toString (args.env.NIX_RUSTFLAGS or "") + " -g -C opt-level=0 -C strip=none";
+    };
+  });
 
   # Modify a stdenv so that it uses the Gold linker.
-  useGoldLinker =
-    stdenv:
-    stdenv.override (old: {
-      mkDerivationFromStdenv = extendMkDerivationArgs old (args: {
-        env = (args.env or { }) // {
-          NIX_CFLAGS_LINK = toString (args.env.NIX_CFLAGS_LINK or "") + " -fuse-ld=gold";
-        };
-      });
-    });
+  useGoldLinker = overrideMkDerivationArgs (args: {
+    env = (args.env or { }) // {
+      NIX_CFLAGS_LINK = toString (args.env.NIX_CFLAGS_LINK or "") + " -fuse-ld=gold";
+    };
+  });
 
   /*
     Copy the libstdc++ from the model stdenv to the target stdenv.
@@ -389,20 +369,16 @@ rec {
 
     WARNING: this breaks purity!
   */
-  impureUseNativeOptimizations =
-    stdenv:
-    stdenv.override (old: {
-      mkDerivationFromStdenv = extendMkDerivationArgs old (args: {
-        env = (args.env or { }) // {
-          NIX_CFLAGS_COMPILE = toString (args.env.NIX_CFLAGS_COMPILE or "") + " -march=native";
-        };
+  impureUseNativeOptimizations = overrideMkDerivationArgs (args: {
+    env = (args.env or { }) // {
+      NIX_CFLAGS_COMPILE = toString (args.env.NIX_CFLAGS_COMPILE or "") + " -march=native";
+    };
 
-        NIX_ENFORCE_NO_NATIVE = false;
+    NIX_ENFORCE_NO_NATIVE = false;
 
-        preferLocalBuild = true;
-        allowSubstitutes = false;
-      });
-    });
+    preferLocalBuild = true;
+    allowSubstitutes = false;
+  });
 
   /*
     Modify a stdenv so that it builds binaries with the specified list of
@@ -419,13 +395,11 @@ rec {
       ];
   */
   withCFlags =
-    compilerFlags: stdenv:
-    stdenv.override (old: {
-      mkDerivationFromStdenv = extendMkDerivationArgs old (args: {
-        env = (args.env or { }) // {
-          NIX_CFLAGS_COMPILE = toString (args.env.NIX_CFLAGS_COMPILE or "") + " ${toString compilerFlags}";
-        };
-      });
+    compilerFlags:
+    overrideMkDerivationArgs (args: {
+      env = (args.env or { }) // {
+        NIX_CFLAGS_COMPILE = toString (args.env.NIX_CFLAGS_COMPILE or "") + " ${toString compilerFlags}";
+      };
     });
 
   withDefaultHardeningFlags =

pkgs/tools/package-management/akku/akku.nix

@@ -23,13 +23,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "akku";
-  version = "1.1.0-unstable-2025-11-08";
+  version = "1.1.0-unstable-2026-01-09";
 
   src = fetchFromGitLab {
     owner = "akkuscm";
     repo = "akku";
-    rev = "411b79ffb40f5ee3b50a72c5a2d5aea97f023c93";
-    sha256 = "sha256-5e4W33EnKvUoLvTsmTPp3GFZsMZp0p3wDwpD9t3clCk=";
+    rev = "5e57de0e144b283b74bc9b050a4aa6510a1cf28c";
+    sha256 = "sha256-5Z2BBfmw3UQaky/7Y8q0Xa+mOxlpOZXQvsGxErmxZSk=";
   };
 
   nativeBuildInputs = [

pkgs/top-level/python-aliases.nix

@@ -358,7 +358,6 @@ mapAliases {
   postgrest-py = postgrest; # added 2025-08-29
   powerlineMemSegment = throw "'powerlineMemSegment' has been renamed to/replaced by 'powerline-mem-segment'"; # Converted to throw 2025-10-29
   prayer-times-calculator = throw "'prayer-times-calculator' has been renamed to/replaced by 'prayer-times-calculator-offline'"; # Converted to throw 2025-10-29
-  primp = throw "primp was removed as it required a very outdated version of boringssl"; # added 2025-10-20
   prometheus_client = throw "'prometheus_client' has been renamed to/replaced by 'prometheus-client'"; # Converted to throw 2025-10-29
   prompt_toolkit = throw "'prompt_toolkit' has been renamed to/replaced by 'prompt-toolkit'"; # Converted to throw 2025-10-29
   protonup = throw "'protonup' has been renamed to/replaced by 'protonup-ng'"; # Converted to throw 2025-10-29

pkgs/top-level/python-packages.nix

@@ -12813,6 +12813,8 @@ self: super: with self; {
 
   primer3 = callPackage ../development/python-modules/primer3 { };
 
+  primp = callPackage ../development/python-modules/primp { };
+
   print-color = callPackage ../development/python-modules/print-color { };
 
   priority = callPackage ../development/python-modules/priority { };