Merge remote-tracking branch 'origin/master' into staging-next

.github/workflows/bot.yml

@@ -7,7 +7,7 @@ name: Bot
 
 on:
   schedule:
-    - cron: '07,17,27,37,47,57 * * * *'
+    - cron: '05,15,25,35,45,55 * * * *'
   workflow_call:
     inputs:
       headBranch:

.github/workflows/build.yml

@@ -56,7 +56,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@fd24c48048070c1be9acd18c9d369a83f0fe94d7 # v31
+      - uses: cachix/install-nix-action@456688f15bc354bef6d396e4a35f4f89d40bf2b7 # v31
         with:
           # Sandbox is disabled on MacOS by default.
           extra_nix_config: sandbox = true

.github/workflows/check.yml

@@ -82,7 +82,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@fd24c48048070c1be9acd18c9d369a83f0fe94d7 # v31
+      - uses: cachix/install-nix-action@456688f15bc354bef6d396e4a35f4f89d40bf2b7 # v31
 
       - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
         with:

.github/workflows/eval.yml

@@ -52,7 +52,7 @@ jobs:
             ci/pinned.json
 
       - name: Install Nix
-        uses: cachix/install-nix-action@fd24c48048070c1be9acd18c9d369a83f0fe94d7 # v31
+        uses: cachix/install-nix-action@456688f15bc354bef6d396e4a35f4f89d40bf2b7 # v31
 
       - name: Load supported versions
         id: versions
@@ -98,7 +98,7 @@ jobs:
           target-as-trusted-at: ${{ inputs.targetSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@fd24c48048070c1be9acd18c9d369a83f0fe94d7 # v31
+        uses: cachix/install-nix-action@456688f15bc354bef6d396e4a35f4f89d40bf2b7 # v31
 
       - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
         with:
@@ -186,7 +186,7 @@ jobs:
           merge-multiple: true
 
       - name: Install Nix
-        uses: cachix/install-nix-action@fd24c48048070c1be9acd18c9d369a83f0fe94d7 # v31
+        uses: cachix/install-nix-action@456688f15bc354bef6d396e4a35f4f89d40bf2b7 # v31
 
       - name: Combine all output paths and eval stats
         run: |
@@ -349,7 +349,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@fd24c48048070c1be9acd18c9d369a83f0fe94d7 # v31
+        uses: cachix/install-nix-action@456688f15bc354bef6d396e4a35f4f89d40bf2b7 # v31
 
       - name: Run misc eval tasks in parallel
         run: |

.github/workflows/lint.yml

@@ -33,7 +33,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@fd24c48048070c1be9acd18c9d369a83f0fe94d7 # v31
+      - uses: cachix/install-nix-action@456688f15bc354bef6d396e4a35f4f89d40bf2b7 # v31
 
       # TODO: Figure out how to best enable caching for the treefmt job. Cachix won't work well,
       # because the cache would be invalidated on every commit - treefmt checks every file.
@@ -68,7 +68,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@fd24c48048070c1be9acd18c9d369a83f0fe94d7 # v31
+      - uses: cachix/install-nix-action@456688f15bc354bef6d396e4a35f4f89d40bf2b7 # v31
 
       - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
         with:
@@ -97,7 +97,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@fd24c48048070c1be9acd18c9d369a83f0fe94d7 # v31
+      - uses: cachix/install-nix-action@456688f15bc354bef6d396e4a35f4f89d40bf2b7 # v31
 
       - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
         with:

.github/workflows/reviewers.yml

@@ -38,7 +38,7 @@ jobs:
           sparse-checkout: ci
 
       - name: Install Nix
-        uses: cachix/install-nix-action@fd24c48048070c1be9acd18c9d369a83f0fe94d7 # v31
+        uses: cachix/install-nix-action@456688f15bc354bef6d396e4a35f4f89d40bf2b7 # v31
 
       - name: Build the requestReviews derivation
         run: nix-build trusted/ci -A requestReviews

ci/README.md

@@ -43,12 +43,12 @@ These issues effectively list PRs the merge bot has interacted with.
 To ensure security and a focused utility, the bot adheres to specific limitations:
 
 - The PR targets one of the [development branches](#branch-classification).
-- The PR only touches packages located under `pkgs/by-name/*`.
+- The PR only touches files of packages located under `pkgs/by-name/*`.
 - The PR is either:
   - approved by a [committer][@NixOS/nixpkgs-committers].
-  - authored by a [committer][@NixOS/nixpkgs-committers].
   - backported via label.
-  - created by [@r-ryantm](https://nix-community.github.io/nixpkgs-update/r-ryantm/).
+  - opened by a [committer][@NixOS/nixpkgs-committers].
+  - opened by [@r-ryantm](https://nix-community.github.io/nixpkgs-update/r-ryantm/).
 - The user attempting to merge is a member of [@NixOS/nixpkgs-maintainers].
 - The user attempting to merge is a maintainer of all packages touched by the PR.
 

ci/github-script/merge.js

@@ -10,13 +10,15 @@ function runChecklist({
   user,
   userIsMaintainer,
 }) {
-  const allByName = files.every(({ filename }) =>
-    filename.startsWith('pkgs/by-name/'),
+  const allByName = files.every(
+    ({ filename }) =>
+      filename.startsWith('pkgs/by-name/') && filename.split('/').length > 4,
   )
 
   const packages = files
     .filter(({ filename }) => filename.startsWith('pkgs/by-name/'))
     .map(({ filename }) => filename.split('/')[3])
+    .filter(Boolean)
 
   const eligible = !packages.length
     ? new Set()
@@ -34,20 +36,22 @@ function runChecklist({
           // bad code between the approval and the merge.
           commit_id === pull_request.head.sha,
       )
-      .map(({ user }) => user.id),
+      .map(({ user }) => user?.id)
+      // Some users have been deleted, so filter these out.
+      .filter(Boolean),
   )
 
   const checklist = {
     'PR targets a [development branch](https://github.com/NixOS/nixpkgs/blob/-/ci/README.md#branch-classification).':
       classify(pull_request.base.ref).type.includes('development'),
-    'PR touches only packages in `pkgs/by-name/`.': allByName,
+    'PR touches only files of packages in `pkgs/by-name/`.': allByName,
     'PR is at least one of:': {
       'Approved by a committer.': committers.intersection(approvals).size > 0,
-      'Authored by a committer.': committers.has(pull_request.user.id),
       'Backported via label.':
         pull_request.user.login === 'nixpkgs-ci[bot]' &&
         pull_request.head.ref.startsWith('backport-'),
-      'Created by r-ryantm.': pull_request.user.login === 'r-ryantm',
+      'Opened by a committer.': committers.has(pull_request.user.id),
+      'Opened by r-ryantm.': pull_request.user.login === 'r-ryantm',
     },
   }
 
@@ -158,12 +162,14 @@ async function handleMerge({
   )
 
   const comments = events.slice(lastPush + 1).filter(
-    ({ event, body, node_id }) =>
+    ({ event, body, user, node_id }) =>
       ['commented', 'reviewed'].includes(event) &&
       hasMergeCommand(body) &&
+      // Ignore comments where the user has been deleted already.
+      user &&
       // Ignore comments which had already been responded to by the bot.
       !events.some(
-        ({ event, user, body }) =>
+        ({ event, body }) =>
           ['commented'].includes(event) &&
           // We're only testing this hidden reference, but not the author of the comment.
           // We'll just assume that nobody creates comments with this marker on purpose.

nixos/modules/tasks/filesystems/nfs.nix

@@ -60,10 +60,6 @@ let
     else
       pkgs.writeText "nfs.conf" nfsConfDeprecated;
 
-  requestKeyConfFile = pkgs.writeText "request-key.conf" ''
-    create id_resolver * * ${pkgs.nfs-utils}/bin/nfsidmap -t 600 %k %d
-  '';
-
   cfg = config.services.nfs;
 
 in
@@ -162,7 +158,10 @@ in
         environment.etc = {
           "idmapd.conf".source = idmapdConfFile;
           "nfs.conf".source = nfsConfFile;
-          "request-key.conf".source = requestKeyConfFile;
+          "request-key.conf".text = ''
+            create id_resolver * * ${pkgs.nfs-utils}/bin/nfsidmap -t 600 %k %d
+            create dns_resolver * * ${pkgs.keyutils}/bin/key.dns_resolver %k
+          '';
         };
 
         systemd.services.nfs-blkmap = {

pkgs/by-name/op/openorienteering-mapper/package.nix

@@ -36,6 +36,11 @@ stdenv.mkDerivation rec {
       url = "https://github.com/OpenOrienteering/mapper/commit/d1f214ee2abf140ae3615a2995f08c19ad81418a.patch";
       hash = "sha256-eJZpHdFPW7A69aazI+WRSK9N87d4A6x973hMYTHdw5I=";
     })
+    # https://github.com/OpenOrienteering/mapper/pull/2227
+    (fetchpatch {
+      url = "https://github.com/OpenOrienteering/mapper/commit/fa694d74f2840d7f18976d7f35debcb99bd173eb.patch";
+      hash = "sha256-GVlNeIFiCG7anPsJR2nDCbgXEeUEAUvTcSaJ53Q/eV4=";
+    })
   ];
 
   postPatch = ''

pkgs/by-name/op/opentelemetry-cpp/package.nix

@@ -100,7 +100,7 @@ stdenv.mkDerivation (finalAttrs: {
       jfroche
       panicgh
     ];
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.all;
     # https://github.com/protocolbuffers/protobuf/issues/14492
     broken = !(stdenv.buildPlatform.canExecute stdenv.hostPlatform);
   };

pkgs/by-name/si/signal-desktop-bin/copy-noto-emoji.py

@@ -18,24 +18,6 @@ import sys
 from pathlib import Path
 
 
-def signal_name_to_emoji(signal_emoji_name: str) -> str:
-    r"""Return the emoji corresponding to a Signal emoji name.
-
-    Signal emoji names are concatenations of UTF‐16 code units,
-    represented in lowercase big‐endian hex padded to four digits.
-
-    >>> signal_name_to_emoji("d83dde36200dd83cdf2bfe0f")
-    '😶‍🌫️'
-    >>> b"\xd8\x3d\xde\x36\x20\x0d\xd8\x3c\xdf\x2b\xfe\x0f".decode("utf-16-be")
-    '😶‍🌫️'
-    """
-    hex_bytes = zip(signal_emoji_name[::2], signal_emoji_name[1::2])
-    emoji_utf_16_be = bytes(
-        int("".join(hex_pair), 16) for hex_pair in hex_bytes
-    )
-    return emoji_utf_16_be.decode("utf-16-be")
-
-
 def emoji_to_noto_name(emoji: str) -> str:
     r"""Return the Noto emoji name of an emoji.
 
@@ -68,16 +50,15 @@ def _main() -> None:
 
     for signal_emoji_names in jumbomoji_packs.values():
         for signal_emoji_name in signal_emoji_names:
-            emoji = signal_name_to_emoji(signal_emoji_name)
 
             try:
                 shutil.copy(
-                    noto_png_path / f"emoji_u{emoji_to_noto_name(emoji)}.png",
-                    out_path / emoji,
+                    noto_png_path / f"emoji_u{emoji_to_noto_name(signal_emoji_name)}.png",
+                    out_path / signal_emoji_name,
                 )
             except FileNotFoundError:
                 print(
-                    f"Missing Noto emoji: {emoji} {signal_emoji_name}",
+                    f"Missing Noto emoji: {signal_emoji_name}",
                     file=sys.stderr,
                 )
                 continue

pkgs/by-name/si/signal-desktop-bin/generic.nix

@@ -92,12 +92,12 @@ let
   });
 
   noto-emoji-sheet-32 = fetchurl {
-    url = "https://raw.githubusercontent.com/iamcal/emoji-data/refs/tags/v15.1.2/sheet_google_32.png";
-    hash = "sha256-S03NCTbvB5yeQl62WpLNjNGhjNErtgaOB6tAj/X8vPc=";
+    url = "https://raw.githubusercontent.com/iamcal/emoji-data/refs/tags/v16.0.0/sheet_google_32.png";
+    hash = "sha256-tBfp9s1LvBBla7/V4TtumiVFtV5qTPcxLXW+H6qjSVI=";
   };
   noto-emoji-sheet-64 = fetchurl {
-    url = "https://raw.githubusercontent.com/iamcal/emoji-data/refs/tags/v15.1.2/sheet_google_64.png";
-    hash = "sha256-kZYStR5xAuausSpOD6wJZRJZ1K6nPpweE3aYSgWntS4=";
+    url = "https://raw.githubusercontent.com/iamcal/emoji-data/refs/tags/v16.0.0/sheet_google_64.png";
+    hash = "sha256-eVoMWY0WLJpKriPyGIxge4ybwZEst9hDgkWfjekaOuE=";
   };
 in
 stdenv.mkDerivation rec {
@@ -263,8 +263,7 @@ stdenv.mkDerivation rec {
 
     # Fix the desktop link
     substituteInPlace $out/share/applications/signal-desktop.desktop \
-      --replace-fail "/${bindir}/signal-desktop" ${meta.mainProgram} \
-      --replace-fail "StartupWMClass=Signal" "StartupWMClass=signal"
+      --replace-fail "/${bindir}/signal-desktop" ${meta.mainProgram}
 
     mv $out/share/applications/signal{-desktop,}.desktop
 

pkgs/by-name/si/signal-desktop-bin/signal-desktop-aarch64.nix

@@ -1,7 +1,7 @@
 { callPackage, commandLineArgs }:
 callPackage ./generic.nix { inherit commandLineArgs; } {
   pname = "signal-desktop-bin";
-  version = "7.71.0";
+  version = "7.77.1";
 
   libdir = "usr/lib64/signal-desktop";
   bindir = "usr/bin";
@@ -10,6 +10,6 @@ callPackage ./generic.nix { inherit commandLineArgs; } {
     bsdtar -xf $downloadedFile -C "$out"
   '';
 
-  url = "https://download.copr.fedorainfracloud.org/results/useidel/signal-desktop/fedora-42-aarch64/09571107-signal-desktop/signal-desktop-7.71.0-1.fc42.aarch64.rpm";
-  hash = "sha256-sNGIkO2HAXl0ykFyZNNV75iVUQ+oRGv6NZW8tVUxfJA=";
+  url = "https://download.copr.fedorainfracloud.org/results/useidel/signal-desktop/fedora-42-aarch64/09751999-signal-desktop/signal-desktop-7.77.1-1.fc42.aarch64.rpm";
+  hash = "sha256-IkAJxq3JK3kKdtLy1lkVUfJNuEStMjn7iQEwsFurwOs=";
 }

pkgs/by-name/si/signal-desktop-bin/signal-desktop-darwin.nix

@@ -6,11 +6,11 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "signal-desktop-bin";
-  version = "7.71.0";
+  version = "7.77.1";
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/signal-desktop-mac-universal-${finalAttrs.version}.dmg";
-    hash = "sha256-G4wCIzKnWwBYSTuXhZ6681Z2+0Rn2bpvb3vhKMAXFc4=";
+    hash = "sha256-vnNR5KTdeTKUMlHnjfB+WkBtpcLP+KEmIPoTfk7Q1+w=";
   };
   sourceRoot = ".";
 

pkgs/by-name/si/signal-desktop-bin/signal-desktop.nix

@@ -1,12 +1,12 @@
 { callPackage, commandLineArgs }:
 callPackage ./generic.nix { inherit commandLineArgs; } rec {
   pname = "signal-desktop-bin";
-  version = "7.71.0";
+  version = "7.77.1";
 
   libdir = "opt/Signal";
   bindir = libdir;
   extractPkg = "dpkg-deb -x $downloadedFile $out";
 
   url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-  hash = "sha256-y7ONN6VBVFH8zyXJNM3+cY4JegSolXfhH3T85WiM2Dk=";
+  hash = "sha256-57sm6wmtp0eXWCv7LviCiBEi5/IysubiuBYSP7eVkkU=";
 }

pkgs/by-name/si/signal-desktop/package.nix

@@ -52,13 +52,13 @@ let
     '';
   });
 
-  version = "7.76.0";
+  version = "7.77.1";
 
   src = fetchFromGitHub {
     owner = "signalapp";
     repo = "Signal-Desktop";
     tag = "v${version}";
-    hash = "sha256-zwywpQ/1LYSofXPMLtYt7c0PLlzgNedRGqslPJur61g=";
+    hash = "sha256-IFMNUuGL3sQVlEJI4N2rXrYStcDEZW/YxmZyPM0hhVU=";
   };
 
   sticker-creator = stdenv.mkDerivation (finalAttrs: {
@@ -69,7 +69,7 @@ let
     pnpmDeps = pnpm.fetchDeps {
       inherit (finalAttrs) pname src version;
       fetcherVersion = 1;
-      hash = "sha256-WUwclz7dJl+s5zRjWu/HTJ5eZroAFA6vR8mZzwib6Po=";
+      hash = "sha256-m/JxsKnVhcya7dUz1MBMQKwEdqoV3xQiGOoT4egh3K4=";
     };
 
     strictDeps = true;
@@ -120,7 +120,7 @@ stdenv.mkDerivation (finalAttrs: {
     # resource if the nixpkgs version is different. To fix this we hardcode
     # the electron version to the declared one here instead of interpolating
     # it at runtime.
-    substituteInPlace app/updateDefaultSession.ts \
+    substituteInPlace app/updateDefaultSession.main.ts \
       --replace-fail "\''${process.versions.electron}" "`jq -r '.devDependencies.electron' < package.json`"
   '';
 
@@ -134,15 +134,15 @@ stdenv.mkDerivation (finalAttrs: {
     fetcherVersion = 1;
     hash =
       if withAppleEmojis then
-        "sha256-b13di3TdaS6CT8gAZfBqlu4WheIHL+X8LvAo148H8kI="
+        "sha256-RquJqKUDdz8QRJXz7eWiAcdUF+WhYEqnyOkhrIw7tgQ="
       else
-        "sha256-/Yy9R+MRN5e5vGU0XgwJa7oFpHn8bi8B0y89aaT2LQI=";
+        "sha256-v1KbjFLo5pD1uoNtDrX2kUbhCgGeEqbuHLZRIJqshHw=";
   };
 
   env = {
     ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
     SIGNAL_ENV = "production";
-    SOURCE_DATE_EPOCH = 1761172657;
+    SOURCE_DATE_EPOCH = 1761859038;
   };
 
   preBuild = ''

pkgs/by-name/si/signal-desktop/replace-apple-emoji-with-noto-emoji.patch

@@ -1,8 +1,8 @@
 diff --git a/ACKNOWLEDGMENTS.md b/ACKNOWLEDGMENTS.md
-index 2c963f1..96edd02 100644
+index 273a9e097..ffb5b6eb6 100644
 --- a/ACKNOWLEDGMENTS.md
 +++ b/ACKNOWLEDGMENTS.md
-@@ -1636,30 +1636,6 @@ Signal Desktop makes use of the following open source projects.
+@@ -3667,30 +3667,6 @@ Signal Desktop makes use of the following open source projects.
      OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
      SOFTWARE.
  
@@ -33,11 +33,11 @@ index 2c963f1..96edd02 100644
  ## emoji-regex
  
      Copyright Mathias Bynens <https://mathiasbynens.be/>
-diff --git a/app/protocol_filter.ts b/app/protocol_filter.ts
-index 68dceea..4b35bb1 100644
---- a/app/protocol_filter.ts
-+++ b/app/protocol_filter.ts
-@@ -59,6 +59,7 @@ function _createFileHandler({
+diff --git a/app/protocol_filter.node.ts b/app/protocol_filter.node.ts
+index 483d1c4e4..66609d9e9 100644
+--- a/app/protocol_filter.node.ts
++++ b/app/protocol_filter.node.ts
+@@ -62,6 +62,7 @@ function _createFileHandler({
    const allowedRoots = [
      userDataPath,
      installPath,
@@ -46,10 +46,10 @@ index 68dceea..4b35bb1 100644
      getBadgesPath(userDataPath),
      getDraftPath(userDataPath),
 diff --git a/package.json b/package.json
-index 5755fec..86125ba 100644
+index 31399e645..05fc46b8b 100644
 --- a/package.json
 +++ b/package.json
-@@ -154,7 +154,6 @@
+@@ -156,7 +156,6 @@
      "dashdash": "2.0.0",
      "direction": "1.0.4",
      "emoji-datasource": "16.0.0",
@@ -57,18 +57,11 @@ index 5755fec..86125ba 100644
      "emoji-regex": "10.4.0",
      "encoding": "0.1.13",
      "fabric": "4.6.0",
-@@ -649,4 +648,4 @@
-       "sticker-creator/dist/**"
-     ]
-   }
--}
-+}
-\ No newline at end of file
-diff --git i/pnpm-lock.yaml w/pnpm-lock.yaml
-index b162101a8..82ee9d67e 100644
---- i/pnpm-lock.yaml
-+++ w/pnpm-lock.yaml
-@@ -197,9 +197,6 @@ importers:
+diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
+index 223557f67..2250b619d 100644
+--- a/pnpm-lock.yaml
++++ b/pnpm-lock.yaml
+@@ -200,9 +200,6 @@ importers:
        emoji-datasource:
          specifier: 16.0.0
          version: 16.0.0
@@ -78,32 +71,32 @@ index b162101a8..82ee9d67e 100644
        emoji-regex:
          specifier: 10.4.0
          version: 10.4.0
-@@ -5814,9 +5811,6 @@ packages:
+@@ -5835,9 +5832,6 @@ packages:
      resolution: {integrity: sha512-DeWwawk6r5yR9jFgnDKYt4sLS0LmHJJi3ZOnb5/JdbYwj3nW+FxQnHIjhBKz8YLC7oRNPVM9NQ47I3CVx34eqQ==}
      engines: {node: '>=12'}
-
+ 
 -  emoji-datasource-apple@16.0.0:
 -    resolution: {integrity: sha512-dVYjsK0FnCry9F+PBtnivhG2K0xdwlmqYaSgiUtztUdAGPYiHYhZcVKvNBqC791g2qyEcFNTBO6utg4eQ3uLTw==}
 -
    emoji-datasource@16.0.0:
      resolution: {integrity: sha512-/qHKqK5Nr3+8zhgO6kHmF43Fm5C8HNn0AaFRIpgw8HF3+uF0Vfc8jgLI1ZQS5ba1vBzksS8NBCjHejwLb2D/Sg==}
-
-@@ -17037,8 +17031,6 @@ snapshots:
-
+ 
+@@ -17062,8 +17056,6 @@ snapshots:
+ 
    emittery@0.13.1: {}
-
+ 
 -  emoji-datasource-apple@16.0.0: {}
 -
    emoji-datasource@16.0.0: {}
-
+ 
    emoji-regex@10.4.0: {}
 diff --git a/stylesheets/components/fun/FunEmoji.scss b/stylesheets/components/fun/FunEmoji.scss
-index ea029fd5b..0e3563b4f 100644
---- i/stylesheets/components/fun/FunEmoji.scss
-+++ w/stylesheets/components/fun/FunEmoji.scss
+index 1cc4bb43c..a6444101a 100644
+--- a/stylesheets/components/fun/FunEmoji.scss
++++ b/stylesheets/components/fun/FunEmoji.scss
 @@ -5,19 +5,9 @@
  $emoji-sprite-sheet-grid-item-count: 62;
-
+ 
  @mixin emoji-sprite($sheet, $margin, $scale) {
 -  $size: calc($sheet * 1px * $scale);
 -  $margin-start: calc($margin * $scale);
@@ -123,11 +116,11 @@ index ea029fd5b..0e3563b4f 100644
 +  background-position: center;
    background-repeat: no-repeat;
  }
-
-diff --git a/ts/components/fun/FunEmoji.tsx b/ts/components/fun/FunEmoji.tsx
-index ddb30bf6d..5fc39339b 100644
---- a/ts/components/fun/FunEmoji.tsx
-+++ b/ts/components/fun/FunEmoji.tsx
+ 
+diff --git a/ts/components/fun/FunEmoji.dom.tsx b/ts/components/fun/FunEmoji.dom.tsx
+index ea031e9a8..3d760a43e 100644
+--- a/ts/components/fun/FunEmoji.dom.tsx
++++ b/ts/components/fun/FunEmoji.dom.tsx
 @@ -20,13 +20,14 @@ function getEmojiJumboBackground(
    emoji: EmojiVariantData,
    size: number | undefined

pkgs/by-name/si/signal-desktop/ringrtc.nix

@@ -19,16 +19,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ringrtc";
-  version = "2.59.0";
+  version = "2.59.2";
 
   src = fetchFromGitHub {
     owner = "signalapp";
     repo = "ringrtc";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zgDXkkKJrcD357DxbPq/sL/c4AG8xyMPY5IpcBtvATY=";
+    hash = "sha256-PpfGjeBSYus4yo6eC1PjRaGRhOOKAg2EgDw3AMEwR1I=";
   };
 
-  cargoHash = "sha256-uwMNJ+PQa/Q7XZ9QONo+vm2wMqGwOEB97Kl/RFQkdhU=";
+  cargoHash = "sha256-ex0/RA5wwSId6Pgi9y62KG42vBs3DxWcGso6Qk9iRlU=";
 
   preConfigure = ''
     # Check for matching webrtc version

pkgs/development/ocaml-modules/ocamlformat/generic.nix

@@ -1,7 +1,7 @@
 {
   lib,
   fetchurl,
-  version ? "0.27.0",
+  version ? "0.28.1",
   astring,
   base,
   camlp-streams,
@@ -48,6 +48,7 @@ rec {
         "0.26.1" = "sha256-2gBuQn8VuexhL7gI1EZZm9m3w+4lq+s9VVdHpw10xtc=";
         "0.26.2" = "sha256-Lk9Za/eqNnqET+g7oPawvxSyplF53cCCNj/peT0DdcU=";
         "0.27.0" = "sha256-3b9ITAdtCPmUAO6Et5DsIx9cj8vV0zJKZADVOI6EbRU=";
+        "0.28.1" = "sha256-cL2gN9C+2WHtkb21GYsu7vVCREdQqLAV2AzLlLP/Qfs=";
       }
       ."${version}";
   };

pkgs/development/ocaml-modules/ocamlformat/ocamlformat.nix

@@ -42,6 +42,7 @@ buildDunePackage {
       lib.versionAtLeast ocaml.version "5.0" && !lib.versionAtLeast version "0.23"
       || lib.versionAtLeast ocaml.version "5.1" && !lib.versionAtLeast version "0.25"
       || lib.versionAtLeast ocaml.version "5.2" && !lib.versionAtLeast version "0.26.2"
-      || lib.versionAtLeast ocaml.version "5.3" && !lib.versionAtLeast version "0.27";
+      || lib.versionAtLeast ocaml.version "5.3" && !lib.versionAtLeast version "0.27"
+      || lib.versionAtLeast ocaml.version "5.4" && !lib.versionAtLeast version "0.28";
   };
 }

pkgs/development/python-modules/pyscard/default.nix

@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "pyscard";
-  version = "2.3.0";
+  version = "2.3.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "LudovicRousseau";
     repo = "pyscard";
     tag = version;
-    hash = "sha256-rz3m8eVbmJUMcQFuEMZwF3k/ES75KcNA8R+xix+Mgq8=";
+    hash = "sha256-MW/Cg7Ta/LdY/pOomsEecVIt62rc5qSAGjpJl4m+ruM=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/torchrl/default.nix

@@ -73,14 +73,14 @@
 
 buildPythonPackage rec {
   pname = "torchrl";
-  version = "0.10.0";
+  version = "0.10.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pytorch";
     repo = "rl";
     tag = "v${version}";
-    hash = "sha256-DqLB1JnQ96cxVEzcXra1hFVfrN7eXTlTwPtlPClnaBA=";
+    hash = "sha256-Vd/w11P4NVrx2xki+VYlXQaM8F+vpdokke8ZAHg6h0Q=";
   };
 
   postPatch = ''

pkgs/top-level/all-packages.nix

@@ -5268,6 +5268,7 @@ with pkgs;
   inherit (ocamlPackages)
     ocamlformat # latest version
     ocamlformat_0_27_0
+    ocamlformat_0_28_1
     ;
 
   inherit (ocamlPackages) odig;

pkgs/top-level/ocaml-packages.nix

@@ -1461,6 +1461,7 @@ let
         ocamlformat_0_26_1 = ocamlformat.override { version = "0.26.1"; };
         ocamlformat_0_26_2 = ocamlformat.override { version = "0.26.2"; };
         ocamlformat_0_27_0 = ocamlformat.override { version = "0.27.0"; };
+        ocamlformat_0_28_1 = ocamlformat.override { version = "0.28.1"; };
 
         ocamlformat = callPackage ../development/ocaml-modules/ocamlformat/ocamlformat.nix { };