Merge master into staging-next

doc/release-notes/rl-2605.section.md

@@ -264,6 +264,9 @@
 
 - `python3packages.pillow-avif-plugin` has been removed as the functionality is included in `python3packages.pillow` directly since version 11.3.
 
+- `wasistlos` (previously known as `whatsapp-for-linux`) has been removed because it was unmaintained and archived upstream.
+  Multiple alternatives exist: `karere`, `whatsie` and `zapzap` among others.
+
 - `light` has been removed because it was unmaintained.
   `brightnessctl` and `acpilight` provide similar functionality.
 

maintainers/maintainer-list.nix

@@ -3964,6 +3964,12 @@
     name = "Joseph Madden";
     keys = [ { fingerprint = "3CF8 E983 2219 AB4B 0E19  158E 6112 1921 C9F8 117C"; } ];
   };
+  brett = {
+    email = "brett@librum.org";
+    github = "brett";
+    githubId = 523;
+    name = "Brett Eisenberg";
+  };
   brettlyons = {
     email = "blyons@fastmail.com";
     github = "brettlyons";
@@ -13879,6 +13885,13 @@
     matrix = "@katexochen:matrix.org";
     name = "Paul Meyer";
   };
+  katok = {
+    name = "katok";
+    email = "kat.ok.timofey@gmail.com";
+    matrix = "@kat.ok:matrix.org";
+    github = "Hi-Timofey";
+    githubId = 43324422;
+  };
   katrinafyi = {
     name = "katrinafyi";
     github = "katrinafyi";

nixos/modules/module-list.nix

@@ -1322,6 +1322,7 @@
   ./services/networking/nix-store-gcs-proxy.nix
   ./services/networking/nixops-dns.nix
   ./services/networking/nm-file-secret-agent.nix
+  ./services/networking/nmtrust.nix
   ./services/networking/nncp.nix
   ./services/networking/nntp-proxy.nix
   ./services/networking/nomad.nix

nixos/modules/programs/fish.nix

@@ -302,7 +302,9 @@ in
                   fi
                 '';
             packages =
-              if config.documentation.nixos.enable && config.documentation.man.enable then
+              if
+                config.documentation.enable && config.documentation.nixos.enable && config.documentation.man.enable
+              then
                 builtins.filter (pkg: pkg != config.system.build.manual.nixos-configuration-reference-manpage) (
                   cfge.systemPackages ++ cfg.extraCompletionPackages
                 )

nixos/modules/services/networking/nmtrust.nix

@@ -0,0 +1,389 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.nmtrust;
+
+  # Resolve trusted UUIDs from ensureProfiles + extra
+  profileUUIDs = map (
+    name: config.networking.networkmanager.ensureProfiles.profiles.${name}.connection.uuid
+  ) cfg.trustedConnections;
+
+  trustedUUIDs = profileUUIDs ++ cfg.trustedUUIDsExtra;
+
+  userNames = builtins.attrNames cfg.userUnits;
+
+  # The package reads config from /etc/nmtrust/config at runtime
+  trustHelper = pkgs.nmtrust;
+
+  # Trust target names
+  trustTargets = [
+    "nmtrust-trusted"
+    "nmtrust-untrusted"
+    "nmtrust-offline"
+  ];
+
+  # Generate Conflicts= for a target (all other trust targets)
+  conflictsFor = target: map (t: "${t}.target") (builtins.filter (t: t != target) trustTargets);
+
+  # Generate systemd unit overrides for a system unit.
+  # Uses StopWhenUnneeded instead of PartOf to avoid same-transaction
+  # issues: when transitioning between targets that both want a unit
+  # (e.g. offline -> trusted for allowOffline units), PartOf on the
+  # old target would stop the unit before WantedBy on the new target
+  # can restart it. StopWhenUnneeded only stops the unit when NO
+  # active target wants it.
+  mkSystemUnitOverrides =
+    unitName: unitCfg:
+    let
+      targets = [
+        "nmtrust-trusted.target"
+      ]
+      ++ lib.optional unitCfg.allowOffline "nmtrust-offline.target";
+    in
+    {
+      unitConfig.StopWhenUnneeded = true;
+      wantedBy = targets;
+    };
+
+  # Generate user unit overrides
+  mkUserUnitOverrides =
+    unitName: unitCfg:
+    let
+      targets = [
+        "nmtrust-trusted.target"
+      ]
+      ++ lib.optional unitCfg.allowOffline "nmtrust-offline.target";
+    in
+    {
+      unitConfig.StopWhenUnneeded = true;
+      wantedBy = targets;
+    };
+
+  # NM dispatcher script
+  dispatcherScript = pkgs.writeShellScript "nmtrust-dispatcher" ''
+    case "$2" in
+      up|down|vpn-up|vpn-down|connectivity-change)
+        ${config.systemd.package}/bin/systemd-run \
+          --no-block \
+          --on-active=1s \
+          --unit=nmtrust-apply-debounce \
+          ${config.systemd.package}/bin/systemctl start nmtrust-apply.service \
+          2>/dev/null || true
+        ;;
+    esac
+  '';
+
+in
+{
+
+  #
+  # Options
+  #
+
+  options.services.nmtrust = {
+
+    enable = lib.mkEnableOption "network trust management";
+
+    trustedConnections = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      description = ''
+        List of NetworkManager profile names from
+        {option}`networking.networkmanager.ensureProfiles`.
+        UUIDs are resolved at evaluation time.
+      '';
+    };
+
+    trustedUUIDsExtra = lib.mkOption {
+      type = lib.types.listOf (
+        lib.types.strMatching "[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}"
+      );
+      default = [ ];
+      description = ''
+        Additional trusted connection UUIDs not managed via
+        {option}`networking.networkmanager.ensureProfiles`.
+        Must be valid UUID format.
+      '';
+    };
+
+    excludedConnectionPatterns = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      description = ''
+        Glob patterns matched against connection names at runtime using
+        fnmatch(3) with FNM_NOESCAPE. Connection names are treated as
+        literal strings (no backslash interpretation).
+        Matching connections are ignored when computing trust state.
+      '';
+    };
+
+    mixedPolicy = lib.mkOption {
+      type = lib.types.enum [
+        "trusted"
+        "untrusted"
+      ];
+      default = "untrusted";
+      description = ''
+        How to treat mixed trust state (some connections trusted,
+        some untrusted).
+      '';
+    };
+
+    evalFailurePolicy = lib.mkOption {
+      type = lib.types.enum [
+        "untrusted"
+        "offline"
+      ];
+      default = "untrusted";
+      description = ''
+        How to handle trust evaluation failures (D-Bus errors, NM
+        unavailable). `"untrusted"` (default) is fail-closed: trusted-only
+        units stop. `"offline"` allows units with
+        {option}`allowOffline` to run.
+      '';
+    };
+
+    systemUnits = lib.mkOption {
+      type = lib.types.attrsOf (
+        lib.types.submodule {
+          options.allowOffline = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+            description = "Whether this unit should also run when offline.";
+          };
+        }
+      );
+      default = { };
+      description = ''
+        System units to bind to the trusted network target.
+        Keys are systemd unit names.
+      '';
+    };
+
+    userUnits = lib.mkOption {
+      type = lib.types.attrsOf (
+        lib.types.attrsOf (
+          lib.types.submodule {
+            options.allowOffline = lib.mkOption {
+              type = lib.types.bool;
+              default = false;
+              description = "Whether this unit should also run when offline.";
+            };
+          }
+        )
+      );
+      default = { };
+      example = lib.literalExpression ''
+        {
+          alice = {
+            "etesync-dav.service" = { };
+            "syncthing.service" = { allowOffline = true; };
+          };
+        }
+      '';
+      description = ''
+        Per-user units to bind to the trusted network target.
+        Outer keys are usernames, inner keys are systemd unit names.
+        Users must have linger enabled
+        ({option}`users.users.<name>.linger`).
+      '';
+    };
+  };
+
+  #
+  # Config
+  #
+
+  config = lib.mkIf cfg.enable {
+
+    # --- Assertions ---
+
+    assertions =
+      # NetworkManager is required
+      [
+        {
+          assertion = config.networking.networkmanager.enable;
+          message = "services.nmtrust requires networking.networkmanager.enable = true.";
+        }
+      ]
+      ++
+        # trustedConnections -> ensureProfiles UUID resolution
+        (map (name: {
+          assertion =
+            config.networking.networkmanager.ensureProfiles.profiles ? ${name}
+            && config.networking.networkmanager.ensureProfiles.profiles.${name}.connection ? uuid;
+          message =
+            "services.nmtrust.trustedConnections references '${name}' "
+            + "but no matching networking.networkmanager.ensureProfiles entry with a UUID exists.";
+        }) cfg.trustedConnections)
+      ++
+        # userUnits -> user existence
+        (map (username: {
+          assertion = config.users.users ? ${username};
+          message =
+            "services.nmtrust.userUnits references user '${username}' "
+            + "but no matching users.users entry exists.";
+        }) userNames)
+      ++
+        # userUnits -> linger enabled
+        (map (username: {
+          assertion =
+            let
+              l = config.users.users.${username}.linger;
+            in
+            l != null && l;
+          message =
+            "services.nmtrust.userUnits references user '${username}' but "
+            + "linger is not enabled. Set users.users.${username}.linger = true to "
+            + "ensure the user's systemd instance is running for trust-based unit management. "
+            + "Note: enabling linger causes ALL of this user's enabled user services to run "
+            + "persistently, not just trust-managed units.";
+        }) (builtins.filter (u: config.users.users ? ${u}) userNames));
+
+    # --- Helper package on PATH ---
+
+    environment.systemPackages = [ trustHelper ];
+
+    # --- Runtime config file ---
+
+    environment.etc."nmtrust/config" = {
+      text =
+        let
+          toBashArray = xs: "(" + lib.concatMapStringsSep " " (x: lib.escapeShellArg x) xs + ")";
+        in
+        ''
+          # Generated by NixOS module — do not edit
+          TRUSTED_UUIDS=${toBashArray trustedUUIDs}
+          EXCLUDED_PATTERNS=${toBashArray (cfg.excludedConnectionPatterns)}
+          MIXED_POLICY=${lib.escapeShellArg cfg.mixedPolicy}
+          EVAL_FAILURE_POLICY=${lib.escapeShellArg cfg.evalFailurePolicy}
+          MANAGED_USERS=${toBashArray userNames}
+        '';
+    };
+
+    # --- tmpfiles.d ---
+
+    systemd.tmpfiles.rules = [
+      "d /run/nmtrust 0700 root root -"
+    ];
+
+    # --- System trust targets ---
+
+    systemd.targets = lib.listToAttrs (
+      map (target: {
+        name = target;
+        value = {
+          description = "Network Trust State: ${
+            if target == "nmtrust-trusted" then
+              "Trusted"
+            else if target == "nmtrust-untrusted" then
+              "Untrusted"
+            else
+              "Offline"
+          }";
+          unitConfig.Conflicts = conflictsFor target;
+        };
+      }) trustTargets
+    );
+
+    # --- User trust targets ---
+
+    systemd.user.targets = lib.listToAttrs (
+      map (target: {
+        name = target;
+        value = {
+          description = "Network Trust State: ${
+            if target == "nmtrust-trusted" then
+              "Trusted (User)"
+            else if target == "nmtrust-untrusted" then
+              "Untrusted (User)"
+            else
+              "Offline (User)"
+          }";
+          unitConfig.Conflicts = conflictsFor target;
+        };
+      }) trustTargets
+    );
+
+    # --- System unit overrides + services ---
+
+    # Strip .service/.timer/.socket suffixes — NixOS appends them automatically
+    systemd.services =
+      lib.mapAttrs' (name: value: {
+        name = lib.removeSuffix ".service" (lib.removeSuffix ".timer" (lib.removeSuffix ".socket" name));
+        value = mkSystemUnitOverrides name value;
+      }) cfg.systemUnits
+      // {
+        nmtrust-apply = {
+          description = "Evaluate and apply network trust state";
+          after = [ "NetworkManager.service" ];
+          serviceConfig = {
+            Type = "oneshot";
+            ExecStart = "${trustHelper}/bin/nmtrust apply";
+            ProtectSystem = "strict";
+            ReadWritePaths = [ "/run/nmtrust" ];
+            ProtectHome = true;
+            NoNewPrivileges = true;
+            PrivateTmp = true;
+          };
+        };
+        nmtrust-eval = {
+          description = "Evaluate network trust state on boot";
+          wantedBy = [ "network-online.target" ];
+          wants = [ "network-online.target" ];
+          after = [
+            "NetworkManager.service"
+            "network-online.target"
+          ];
+          restartTriggers = [
+            config.environment.etc."nmtrust/config".source
+          ];
+          serviceConfig = {
+            Type = "oneshot";
+            RemainAfterExit = true;
+            ExecStart = "${trustHelper}/bin/nmtrust apply";
+            ProtectSystem = "strict";
+            ReadWritePaths = [ "/run/nmtrust" ];
+            ProtectHome = true;
+            NoNewPrivileges = true;
+            PrivateTmp = true;
+          };
+        };
+      };
+
+    # --- User unit overrides ---
+
+    systemd.user.services = lib.foldl' (
+      acc: username:
+      lib.foldl' (
+        acc': unitName:
+        let
+          strippedName = lib.removeSuffix ".service" (
+            lib.removeSuffix ".timer" (lib.removeSuffix ".socket" unitName)
+          );
+        in
+        acc'
+        // {
+          ${strippedName} = mkUserUnitOverrides unitName cfg.userUnits.${username}.${unitName};
+        }
+      ) acc (builtins.attrNames cfg.userUnits.${username})
+    ) { } userNames;
+
+    # --- NM dispatcher ---
+
+    networking.networkmanager.dispatcherScripts = [
+      {
+        source = dispatcherScript;
+        type = "basic";
+      }
+    ];
+  };
+
+  meta.maintainers = [ lib.maintainers.brett ];
+
+}

nixos/modules/virtualisation/incus.nix

@@ -54,8 +54,6 @@ let
       lvm2
       lz4
       lxcfs
-      minio
-      minio-client
       nftables
       qemu-utils
       qemu_kvm
@@ -99,6 +97,10 @@ let
     ]
     ++ lib.optionals nvidiaEnabled [
       libnvidia-container
+    ]
+    ++ lib.optionals cfg.bucketSupport [
+      minio
+      minio-client
     ];
 
   # https://github.com/lxc/incus/blob/cff35a29ee3d7a2af1f937cbb6cf23776941854b/internal/server/instance/drivers/driver_qemu.go#L123
@@ -211,6 +213,13 @@ in
         description = "The incus client package to use. This package is added to PATH.";
       };
 
+      bucketSupport = lib.mkOption {
+        type = lib.types.bool;
+        description = "Enable bucket support using minio, which is an insecure and unmaintained S3 provider.";
+        default = if lib.versionAtLeast config.system.stateVersion "26.11" then false else null;
+        defaultText = lib.literalExpression ''if lib.versionAtLeast config.system.stateVersion "26.11" then false else null;'';
+      };
+
       softDaemonRestart = lib.mkOption {
         type = lib.types.bool;
         default = true;

nixos/tests/all-tests.nix

@@ -1141,6 +1141,7 @@ in
     pkgs.callPackage ../../pkgs/stdenv/generic/check-meta-test.nix
       { };
   nixseparatedebuginfod2 = runTest ./nixseparatedebuginfod2.nix;
+  nmtrust = runTest ./nmtrust.nix;
   node-red = runTest ./node-red.nix;
   nohang = runTest ./nohang.nix;
   nomad = runTest ./nomad.nix;

nixos/tests/incus/incus-tests.nix

@@ -51,6 +51,7 @@ in
       incus = {
         enable = true;
         package = cfg.package;
+        bucketSupport = false;
 
         preseed = {
           networks = [

nixos/tests/nmtrust.nix

@@ -0,0 +1,92 @@
+{ lib, pkgs, ... }:
+{
+  name = "nmtrust";
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      networking.networkmanager.enable = true;
+
+      # Prevent the VM's built-in interfaces from polluting trust state.
+      networking.networkmanager.unmanaged = [
+        "eth0"
+        "eth1"
+        "lo"
+      ];
+
+      networking.networkmanager.ensureProfiles.profiles = {
+        trusted-net = {
+          connection = {
+            id = "trusted-net";
+            uuid = "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee";
+            type = "dummy";
+            interface-name = "dummy-trusted";
+            autoconnect = "false";
+          };
+          ipv4.method = "manual";
+          ipv4.addresses = "10.99.1.1/24";
+        };
+        untrusted-net = {
+          connection = {
+            id = "untrusted-net";
+            uuid = "11111111-2222-3333-4444-555555555555";
+            type = "dummy";
+            interface-name = "dummy-untrusted";
+            autoconnect = "false";
+          };
+          ipv4.method = "manual";
+          ipv4.addresses = "10.99.2.1/24";
+        };
+      };
+
+      services.nmtrust = {
+        enable = true;
+        trustedConnections = [ "trusted-net" ];
+        systemUnits."trust-canary.service" = { };
+      };
+
+      # Canary service: runs only while the trusted target is active.
+      systemd.services.trust-canary = {
+        description = "nmtrust test canary";
+        serviceConfig = {
+          Type = "simple";
+          ExecStart = "${pkgs.coreutils}/bin/sleep infinity";
+        };
+      };
+    };
+
+  testScript = ''
+    import time
+
+    def apply(machine):
+        """Trigger nmtrust-apply and wait for it to finish."""
+        time.sleep(1)
+        machine.succeed("systemctl start nmtrust-apply.service")
+        machine.wait_until_succeeds(
+            "systemctl show nmtrust-apply.service -p ActiveState --value | grep -q inactive",
+            timeout=10,
+        )
+
+    machine.wait_for_unit("multi-user.target")
+
+    with subtest("offline on boot with no connections active"):
+        apply(machine)
+        machine.succeed("systemctl is-active nmtrust-offline.target")
+        machine.fail("systemctl is-active trust-canary.service")
+
+    with subtest("trusted when trusted connection is up"):
+        machine.succeed("nmcli connection up trusted-net")
+        apply(machine)
+        machine.succeed("systemctl is-active nmtrust-trusted.target")
+        machine.succeed("systemctl is-active trust-canary.service")
+
+    with subtest("untrusted when untrusted connection replaces trusted"):
+        machine.succeed("nmcli connection down trusted-net")
+        machine.succeed("nmcli connection up untrusted-net")
+        apply(machine)
+        machine.succeed("systemctl is-active nmtrust-untrusted.target")
+        machine.fail("systemctl is-active trust-canary.service")
+  '';
+
+  meta.maintainers = with lib.maintainers; [ brett ];
+}

pkgs/applications/editors/jetbrains/source/build.nix

@@ -45,7 +45,7 @@ let
     };
   });
 
-  jbr = jetbrains.jdk-no-jcef;
+  jbr = jetbrains.jdk-no-jcef-21;
 
   ideaSrc = fetchFromGitHub {
     owner = "jetbrains";

pkgs/applications/editors/vscode/extensions/default.nix

@@ -85,7 +85,7 @@ let
         };
       };
 
-      "42crunch".vscode-openapi = buildVscodeMarketplaceExtension {
+      "42crunch".vscode-openapi = buildVscodeMarketplaceExtension rec {
         mktplcRef = {
           publisher = "42Crunch";
           name = "vscode-openapi";
@@ -93,7 +93,7 @@ let
           hash = "sha256-nV7RZpDd+15YmINKrFSIlFurC955bnE4A8esrKWYVnE=";
         };
         meta = {
-          changelog = "https://marketplace.visualstudio.com/items/42Crunch.vscode-openapi/changelog";
+          changelog = "https://github.com/42Crunch/vscode-openapi/blob/v${mktplcRef.version}/CHANGELOG.md";
           description = "Visual Studio Code extension with rich support for the OpenAPI Specification (OAS)";
           downloadPage = "https://marketplace.visualstudio.com/items?itemName=42Crunch.vscode-openapi";
           homepage = "https://github.com/42Crunch/vscode-openapi";
@@ -1174,8 +1174,8 @@ let
         mktplcRef = {
           publisher = "DanielSanMedium";
           name = "dscodegpt";
-          version = "3.17.20";
-          hash = "sha256-7nJlPP1Xap0lSJz+HQmKKC9OZ5UfMCq8nf1B/bkyNXU=";
+          version = "3.17.36";
+          hash = "sha256-7+Ja5/zeGq+W1aCIzZu0x+CU1ERwZhwvOaZKaGSWK4c=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/DanielSanMedium.dscodegpt/changelog";

pkgs/applications/emulators/libretro/cores/dolphin.nix

@@ -26,13 +26,14 @@
 }:
 mkLibretroCore {
   core = "dolphin";
-  version = "0-unstable-2025-08-05";
+  version = "0-unstable-2026-04-08";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "dolphin";
-    rev = "83438f9b1a2c832319876a1fda130a5e33d4ef87";
-    hash = "sha256-q4y+3uJ1tQ2OvlEvi/JNyIO/RfuWNIEKfVZ6xEWKFCg=";
+    rev = "0cd3bb89c29535db9b7552fc86871867ccf5b471";
+    hash = "sha256-cSiJO/EvspNvHopo/RLfuz8ONpbXk2NrrSDhkiAm7/s=";
+    fetchSubmodules = true;
   };
 
   extraNativeBuildInputs = [
@@ -82,8 +83,6 @@ mkLibretroCore {
     (cmakeFeature "CMAKE_POLICY_VERSION_MINIMUM" "3.5")
   ];
 
-  dontUseCmakeBuildDir = true;
-
   meta = {
     description = "Port of Dolphin to libretro";
     homepage = "https://github.com/libretro/dolphin";

pkgs/applications/emulators/libretro/cores/mesen-s.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mesen-s";
-  version = "0-unstable-2024-10-21";
+  version = "0-unstable-2026-04-20";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "mesen-s";
-    rev = "d4fca31a6004041d99b02199688f84c009c55967";
-    hash = "sha256-mGGTLBRJCsNJg57LWSFndIv/LLzEmVRnv6gNbllkV/Y=";
+    rev = "1d475abd174d16ecb1fb030961ff26076ab51ee6";
+    hash = "sha256-JSXkh6OyclYl3X/sJLRZsb5sdbSfanbJAKlhaFFjSrI=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/prosystem.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "prosystem";
-  version = "0-unstable-2026-03-31";
+  version = "0-unstable-2026-04-20";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "prosystem-libretro";
-    rev = "980edb381b0bf9ea7992caab24039a537aeb510e";
-    hash = "sha256-uuh5YLKHW5aVe01GH12TqAlSp83s/PF/8Mlw105HIJg=";
+    rev = "3f465db9c82fc6764cd90c53fc66eb630e0b3710";
+    hash = "sha256-uamxOzJt5NbMGxDqyGk/8XJbN/fiFoB81DNeULIfL1U=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/thepowdertoy.nix

@@ -6,13 +6,13 @@
 }:
 mkLibretroCore {
   core = "thepowdertoy";
-  version = "0-unstable-2025-09-16";
+  version = "0-unstable-2026-04-20";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "ThePowderToy";
-    rev = "cb3cd4c2e5beddb98b34e6b800fa24e8f96322d9";
-    hash = "sha256-k3XWkkSuQC3IBhhI96qkTrlGH/oJu941HaAvR28V5i0=";
+    rev = "dcb5e41f1f9800192ea07ea43459413c5a065d9f";
+    hash = "sha256-FDotG/ngmrxgyN7YQ8SK/ZQHKWkwZ5hhg0qsNNXmaNc=";
   };
 
   extraNativeBuildInputs = [ cmake ];

pkgs/applications/networking/cluster/terraform/default.nix

@@ -200,9 +200,9 @@ rec {
   mkTerraform = attrs: pluggable (generic attrs);
 
   terraform_1 = mkTerraform {
-    version = "1.14.9";
-    hash = "sha256-OvKc+71DxbYgdOs06RkM4doF4OTkY0NI/LR0Wgpr7tA=";
-    vendorHash = "sha256-Ajjh8k2lOKf+BGIk3Vyp8H2unljeOMUN0vXwGjs7ZHc=";
+    version = "1.15.0";
+    hash = "sha256-cKgZFCPLusXXSjcff/PmKGIdSm3wRY1DpduXBRrgcDc=";
+    vendorHash = "sha256-Gv6V5aXqTuQoG1StbD/7Ln2QrLpMsW6fbUJUkyZMkvk=";
     patches = [ ./provider-path-0_15.patch ];
     passthru = {
       inherit plugins;

pkgs/by-name/al/aliyun-cli/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "aliyun-cli";
-  version = "3.3.8";
+  version = "3.3.11";
 
   src = fetchFromGitHub {
     owner = "aliyun";
     repo = "aliyun-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5RFGpfeW3nLubN920hrBVyEdJEPa/V3Dz2YdxCh9YLU=";
+    hash = "sha256-jksC63DFSbZcBjQvV7BBMSMbPMeSqUQMWN9HcIcFZSU=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/an/animeko/package.nix

@@ -142,12 +142,12 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   env = {
-    JAVA_HOME = jetbrains.jdk;
+    JAVA_HOME = jetbrains.jdk-21;
     ANDROID_SDK_HOME = "$(pwd)";
   };
 
   gradleFlags = [
-    "-Dorg.gradle.java.home=${jetbrains.jdk}"
+    "-Dorg.gradle.java.home=${jetbrains.jdk-21}"
   ];
 
   nativeBuildInputs = [
@@ -282,5 +282,8 @@ stdenv.mkDerivation (finalAttrs: {
     platforms = [
       "x86_64-linux"
     ];
+    # Mark broken due to a breaking change in JetBrains JCEF
+    # https://github.com/NixOS/nixpkgs/pull/485812#issuecomment-4211365591
+    broken = true;
   };
 })

pkgs/by-name/ap/apt-swarm/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "apt-swarm";
-  version = "0.5.1";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "kpcyrd";
     repo = "apt-swarm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zb0X6vIRKeI5Ysc88sTCJBlr9r8hrsTq5YR7YCg1L30=";
+    hash = "sha256-tDIwx+Eb/5EH9p407+FfKAwU6ZjNxyKtfFe5h7eTnHg=";
   };
 
-  cargoHash = "sha256-PELTEzhsFa1nl7iqrjnuXEI0U7L8rL9XW9XqQ04rz/s=";
+  cargoHash = "sha256-43TFrddQvmzUzk2JnggKKWljBNzO+7IYF8HsTwez7a4=";
 
   meta = {
     description = "Experimental p2p gossip network for OpenPGP signature transparency";

pkgs/by-name/bo/boinc/package.nix

@@ -28,14 +28,14 @@
 
 stdenv.mkDerivation rec {
   pname = "boinc";
-  version = "8.2.10";
+  version = "8.2.11";
 
   src = fetchFromGitHub {
     name = "${pname}-${version}-src";
     owner = "BOINC";
     repo = "boinc";
     rev = "client_release/${lib.versions.majorMinor version}/${version}";
-    hash = "sha256-+/EuGJluTXhEWZT97P60vE6e8uX3+GdCyJwf9nzsh4E=";
+    hash = "sha256-xWEAjTWEUCTTtxfCFFMcrJD0DRVmUAgi2vE0GifTX2Q=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ca/calcurse/package.nix

@@ -44,7 +44,6 @@ stdenv.mkDerivation (finalAttrs: {
       be used to filter and format appointments, making it suitable for use in scripts.
     '';
     homepage = "https://calcurse.org/";
-    changelog = "https://git.calcurse.org/calcurse.git/plain/CHANGES.md?h=v${finalAttrs.version}";
     license = lib.licenses.bsd2;
     platforms = lib.platforms.unix;
     maintainers = [ lib.maintainers.matthiasbeyer ];

pkgs/by-name/ca/cantus/package.nix

@@ -12,16 +12,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cantus";
-  version = "0.6.5";
+  version = "0.6.6";
 
   src = fetchFromGitHub {
     owner = "CodedNil";
     repo = "cantus";
     tag = finalAttrs.version;
-    hash = "sha256-pnc/fjmi932tZQsAfvvAoZ1PXEP8gckGuauR+5btei8=";
+    hash = "sha256-4bnIYOHVOPawDg4s5mPKYXURpDSVgyTmoh1WiGj/Zl8=";
   };
 
-  cargoHash = "sha256-sDZF5cWlhsBblAe0sreGbfgXKIip5raM0r9ZeJrLrLQ=";
+  cargoHash = "sha256-TbbXZGToQTH0k6KxpCsjcG/kOFY0c4L/P8QUpDyQ+2E=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/ca/cargo-info/package.nix

@@ -31,7 +31,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     description = "Cargo subcommand to show crates info from crates.io";
     mainProgram = "cargo-info";
     homepage = "https://gitlab.com/imp/cargo-info";
-    changelog = "https://gitlab.com/imp/cargo-info/-/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    changelog = "https://gitlab.com/imp/cargo-info/-/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = with lib.licenses; [
       mit
       asl20

pkgs/by-name/ca/cargo-mobile2/package.nix

@@ -10,20 +10,20 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-mobile2";
-  version = "0.22.3";
+  version = "0.22.4";
 
   src = fetchFromGitHub {
     owner = "tauri-apps";
     repo = "cargo-mobile2";
     rev = "cargo-mobile2-v${finalAttrs.version}";
-    hash = "sha256-rPLGh7/lGsmoidtr+UNrxzUgqtiHvkqZs2/la4L6zQM=";
+    hash = "sha256-DjoWjdgfNHLZkaWUjPq4tNrmHsifKKhBaRjK25WRdiE=";
   };
 
   # Manually specify the sourceRoot since this crate depends on other crates in the workspace. Relevant info at
   # https://discourse.nixos.org/t/difficulty-using-buildrustpackage-with-a-src-containing-multiple-cargo-workspaces/10202
   # sourceRoot = "${src.name}/tooling/cli";
 
-  cargoHash = "sha256-ht9ofFa4H/Ux6a31vMNdKNhrX48yoYM1qAPoxCjude0=";
+  cargoHash = "sha256-m+9wPfheH9t7zxTsW7vHe4td/gyeC/nXFDHRGjK5XBg=";
 
   buildInputs = [ openssl ];
   nativeBuildInputs = [

pkgs/by-name/ca/cargo-public-api/package.nix

@@ -31,8 +31,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
   meta = {
     description = "List and diff the public API of Rust library crates between releases and commits. Detect breaking API changes and semver violations";
     mainProgram = "cargo-public-api";
-    homepage = "https://github.com/Enselic/cargo-public-api";
-    changelog = "https://github.com/Enselic/cargo-public-api/releases/tag/v${finalAttrs.version}";
+    homepage = "https://github.com/cargo-public-api/cargo-public-api";
+    changelog = "https://github.com/cargo-public-api/cargo-public-api/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ matthiasbeyer ];
   };

pkgs/by-name/cl/cloudprober/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "cloudprober";
-  version = "0.14.1";
+  version = "0.14.3";
 
   src = fetchFromGitHub {
     owner = "cloudprober";
     repo = "cloudprober";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-XFMjUwsRfWAnrNsegUPqWz8Bcc/naEBhytqq/o21ras=";
+    hash = "sha256-dMogW0NQAMiSBC7//7gGmadvK5vS2H+170aW0RK58fU=";
   };
 
-  vendorHash = "sha256-+EVcYFnWPSNfxUzxuL3tAHjCCDad/7K11y3dk2CUtrU=";
+  vendorHash = "sha256-YEueI/Ms350bNkKPmLNzLljr9FDL0R7zACF4HQwHLdk=";
 
   checkFlags =
     let

pkgs/by-name/cl/clusterlint/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "clusterlint";
-  version = "0.14.0";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "digitalocean";
     repo = "clusterlint";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-iOd0mjVJDtALxdsmG6+ruJ8CxoNe17D9grkjRW+N34A=";
+    hash = "sha256-6QgWWSiwVZv8rYJNvfzxNsrxCqJbR/MBcCr3ESrO6Fc=";
   };
 
   vendorHash = null;

pkgs/by-name/co/coldsnap/package.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "coldsnap";
-  version = "0.9.0";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "coldsnap";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-8+YPKjHi3VURzSOflIa0x4uBkoDMYGFJiFcNJ+8NJ7Q=";
+    hash = "sha256-QQWH8cWBskXOmiZygvkNDyBX4WdsgnA0/ec6/UnmwIA=";
   };
 
-  cargoHash = "sha256-4w79zZcgIulLIArY2ErOHwaWA8g/mA2cSKCzJx4X9vM=";
+  cargoHash = "sha256-U5MinzKQYTHRXM3WndkMEbvoT9tPwIIB3QxEOwWA3zE=";
 
   buildInputs = [ openssl ];
   nativeBuildInputs = [ pkg-config ];

pkgs/by-name/co/cosmic-ext-applet-weather/package.nix

@@ -9,13 +9,13 @@
 }:
 rustPlatform.buildRustPackage {
   pname = "cosmic-ext-applet-weather";
-  version = "0-unstable-2026-03-23";
+  version = "0-unstable-2026-04-27";
 
   src = fetchFromGitHub {
     owner = "cosmic-utils";
     repo = "cosmic-ext-applet-weather";
-    rev = "e98c57c586180df0abf6efbe3ee479fc4849f4f7";
-    hash = "sha256-8m1L98wt0uf1vnZ7z4meb/9hU+k5bqe7x7Pidf1lBGM=";
+    rev = "943041c6e1e49d4a6ae267350d7818213e197bc5";
+    hash = "sha256-ZTZ3IjEte3Knkm77i/C0Qq5lx8g3je6GsRlSSrWpFRQ=";
   };
 
   cargoHash = "sha256-DmPUA9qRgCMqVqBNVfyQg4UZkqnZXZvokoSAqPxg0Zc=";

pkgs/by-name/di/di-tui/package.nix

@@ -6,13 +6,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "di-tui";
-  version = "1.13.3";
+  version = "1.13.4";
 
   src = fetchFromGitHub {
     owner = "acaloiaro";
     repo = "di-tui";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-rT9iH9kkkWtg4H7YJUD2ElvWLUIzFHGSlH31A68pDDo=";
+    hash = "sha256-0PIKPprAqGbVFiGFxwzgmS4fYKTHfpdpWWUMuxK67tQ=";
   };
 
   vendorHash = "sha256-b7dG0nSjPQpjWUbOlIxWudPZWKqtq96sQaJxKvsQT9I=";

pkgs/by-name/do/dotenvx/package.nix

@@ -7,16 +7,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "dotenvx";
-  version = "1.61.5";
+  version = "1.64.0";
 
   src = fetchFromGitHub {
     owner = "dotenvx";
     repo = "dotenvx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yyAlEgIbPQocPnZvDbmK2MIYpglESkQGMYE7PmJDdEM=";
+    hash = "sha256-Xa3xtDzvSbgba083R2g3vV8Jtv86NMEbZ/EhYxmGsKA=";
   };
 
-  npmDepsHash = "sha256-YQ3b7Fm33Mfp2l2LQ/+iYal+iBTZn5v7lUyZ2geY46A=";
+  npmDepsHash = "sha256-WeqODrueKqDFvIsXHlzWhHSdqPY/uS+VM+wCp69LN9M=";
 
   dontNpmBuild = true;
 

pkgs/by-name/fl/flyctl/package.nix

@@ -12,7 +12,7 @@
 
 buildGoModule rec {
   pname = "flyctl";
-  version = "0.4.36";
+  version = "0.4.42";
 
   src = fetchFromGitHub {
     owner = "superfly";
@@ -22,11 +22,11 @@ buildGoModule rec {
       cd "$out"
       git rev-parse HEAD > COMMIT
     '';
-    hash = "sha256-WMENTGVwMICIrgMbl31cEaBpznyv3+XFtAhP8AajWyo=";
+    hash = "sha256-yAzd7bytBKxOBGs8ja48QPVdmJSvRfIzi8K2DoC0O+Y=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-qGG+xOBe8JLt+F4iTNMEC1XTs5H/rfLtUZO7QXYAaZg=";
+  vendorHash = "sha256-TUlOdRfexuxC2Of6ZHPYChCr3i1IGapLZz1/lAhnUxk=";
 
   subPackages = [ "." ];
 

pkgs/by-name/fo/fosrl-newt/package.nix

@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "newt";
-  version = "1.12.0";
+  version = "1.12.2";
 
   src = fetchFromGitHub {
     owner = "fosrl";
     repo = "newt";
     tag = finalAttrs.version;
-    hash = "sha256-csD7QcSQE4/eRw3EHX0m2nI3JjglFxXlnyuS4xpCmRY=";
+    hash = "sha256-5+B1sderUwy6hJPKFRK8fV0bX2+rgHh3WmAjgQqVsR4=";
   };
 
   vendorHash = "sha256-+zMSzNbqmWm/DXL2xMUd5uPP5tSIybsRokwJ2zd0pf0=";

pkgs/by-name/ga/gaphor/package.nix

@@ -13,14 +13,14 @@
 }:
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "gaphor";
-  version = "3.3.0";
+  version = "3.3.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "gaphor";
     repo = "gaphor";
     tag = finalAttrs.version;
-    hash = "sha256-bgcri0mgFKz4jtGJSWtlStS3f4FzYH+ZPE1BsK+S1DI=";
+    hash = "sha256-oGOi1vyLOrElj/kbqHgPEyAwtVvVA3a1j9VSWMts/bM=";
   };
 
   pythonRelaxDeps = [

pkgs/by-name/gh/gh-cherry-pick/package.nix

@@ -5,14 +5,14 @@
 }:
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "gh-cherry-pick";
-  version = "1.4.0";
+  version = "1.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "PerchunPak";
     repo = "gh-cherry-pick";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ec9q+3nd1zJ2K3dyWqLsdTH5GBJ4B1b8D/4Wd6d8PcA=";
+    hash = "sha256-a2vhQ9upJYc+t4Juq+eukNc7dzq6MafNxDUULPZs9sQ=";
   };
 
   build-system = with python3Packages; [
@@ -25,10 +25,18 @@ python3Packages.buildPythonApplication (finalAttrs: {
     httpx
   ];
 
+  # upstream has strict dependency pins, but it doesn't break with slightly
+  # newer/older versions
+  #   (c) upstream maintainer
+  pythonRelaxDeps = true;
+
   nativeCheckInputs = with python3Packages; [
-    pytestCheckHook
+    faker
+    pytest-asyncio
     pytest-cov-stub
+    pytest-httpx
     pytest-mock
+    pytestCheckHook
   ];
 
   pythonImportsCheck = [ "gh_cherry_pick" ];

pkgs/by-name/gi/git-gone/package.nix

@@ -1,6 +1,6 @@
 {
   lib,
-  fetchFromGitHub,
+  fetchFromCodeberg,
   rustPlatform,
 }:
 
@@ -8,7 +8,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   pname = "git-gone";
   version = "1.3.1";
 
-  src = fetchFromGitHub {
+  src = fetchFromCodeberg {
     owner = "swsnr";
     repo = "git-gone";
     tag = "v${finalAttrs.version}";
@@ -19,8 +19,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   meta = {
     description = "Cleanup stale Git branches of merge requests";
-    homepage = "https://github.com/swsnr/git-gone";
-    changelog = "https://github.com/swsnr/git-gone/raw/v${finalAttrs.version}/CHANGELOG.md";
+    homepage = "https://codeberg.org/swsnr/git-gone";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [
       cafkafk

pkgs/by-name/gi/gitnr/package.nix

@@ -40,7 +40,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
   meta = {
     description = "Create `.gitignore` files using one or more templates from TopTal, GitHub or your own collection";
     homepage = "https://github.com/reemus-dev/gitnr";
-    changelog = "https://github.com/reemus-dev/gitnr/blob/${finalAttrs.src.rev}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       matthiasbeyer

pkgs/by-name/go/google-chrome/package.nix

@@ -184,11 +184,11 @@ let
 
   linux = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "147.0.7727.116";
+    version = "147.0.7727.137";
 
     src = fetchurl {
       url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb";
-      hash = "sha256-f4lIdknIXTTv3yxvs754n6/a01h5xxWWOvnjwQcIPnw=";
+      hash = "sha256-2QKA8nk+O10cGr0gGOMSlLkxpO+WHFG1yul9a3VGq64=";
     };
 
     # With strictDeps on, some shebangs were not being patched correctly
@@ -302,11 +302,11 @@ let
 
   darwin = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "147.0.7727.117";
+    version = "147.0.7727.138";
 
     src = fetchurl {
-      url = "http://dl.google.com/release2/chrome/hlfggraqploqe3bea7acbi5wei_147.0.7727.117/GoogleChrome-147.0.7727.117.dmg";
-      hash = "sha256-GCdZAiqNSDcC6qgsJGS5renRrl3kLoH4X9VHX7aLXTw=";
+      url = "http://dl.google.com/release2/chrome/ackheqvxll25dzx6s76qfgpa4oxa_147.0.7727.138/GoogleChrome-147.0.7727.138.dmg";
+      hash = "sha256-1WOkBxAs79ByJ3quXgh+ZR64ysIE2/2wMeIhl3sYh5o=";
     };
 
     dontPatch = true;

pkgs/by-name/gr/groff/package.nix

@@ -34,6 +34,10 @@ let
     tag = "20200910";
     hash = "sha256-YQl5IDtodcbTV3D6vtJi7CwxVtHHl58fG6qCAoSaP4U=";
   };
+  nativeGroffBinPath = lib.makeBinPath [
+    buildPackages.groff
+    (lib.getOutput "perl" buildPackages.groff)
+  ];
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "groff";
@@ -125,13 +129,18 @@ stdenv.mkDerivation (finalAttrs: {
     # Move mom docs instead of linking them to avoid dangling symlinks
     substituteInPlace Makefile \
       --replace-fail '$(LN_S) $(exampledir)' 'mv $(exampledir)'
+  ''
+  + lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
+    # pdfmom uses GROFF_COMMAND to find the groff executable internally.
+    substituteInPlace Makefile \
+      --replace-fail 'GROFF_COMMAND=test-groff \' 'GROFF_COMMAND=$(GROFFBIN) \'
   '';
 
   makeFlags = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
     # Trick to get the build system find the proper 'native' groff
     # http://www.mail-archive.com/bug-groff@gnu.org/msg01335.html
-    "GROFF_BIN_PATH=${lib.getBin buildPackages.groff}/bin"
-    "GROFFBIN=${lib.getExe buildPackages.groff}"
+    "GROFF_BIN_PATH=${nativeGroffBinPath}"
+    "GROFFBIN=${lib.getExe' buildPackages.groff "groff"}"
   ];
 
   doCheck = true;

pkgs/by-name/ha/ha-mcp/package.nix

@@ -7,27 +7,28 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "ha-mcp";
-  version = "6.7.1";
+  version = "7.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "homeassistant-ai";
     repo = "ha-mcp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CQbjPEtCos0Fi6aAaIWSRMCUQKmjYviYkvJZzbCZg6Y=";
+    hash = "sha256-boWqv8lSN/UiqSRhVBgbucX+RC6q14Oa4WzkJPeZzVw=";
   };
 
   build-system = with python3Packages; [
     setuptools
   ];
 
+  pythonRelaxDeps = true;
+
   dependencies =
     with python3Packages;
     [
       cryptography
       fastmcp
       httpx
-      jq
       pydantic
       python-dotenv
       truststore
@@ -39,7 +40,10 @@ python3Packages.buildPythonApplication (finalAttrs: {
   doCheck = false;
 
   passthru.updateScript = nix-update-script {
-    extraArgs = [ "--version-regex=^v([0-9]+\\.[0-9]+\\.[0-9]+)$" ];
+    extraArgs = [
+      "--use-github-releases"
+      "--version-regex=^v([0-9]+\\.[0-9]+\\.[0-9]+)$"
+    ];
   };
 
   pythonImportsCheck = [ "ha_mcp" ];

pkgs/by-name/he/hebbot/package.nix

@@ -51,7 +51,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   meta = {
     description = "Matrix bot which can generate \"This Week in X\" like blog posts ";
     homepage = "https://github.com/haecker-felix/hebbot";
-    changelog = "https://github.com/haecker-felix/hebbot/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/haecker-felix/hebbot/releases/tag/v2.1";
     license = with lib.licenses; [ agpl3Only ];
     mainProgram = "hebbot";
     maintainers = with lib.maintainers; [ a-kenji ];

pkgs/by-name/jx/jxscout/package.nix

@@ -0,0 +1,50 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  makeWrapper,
+  prettier,
+  bun,
+  nodejs,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "jxscout";
+  version = "0.9.4";
+
+  src = fetchFromGitHub {
+    owner = "francisconeves97";
+    repo = "jxscout";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-DvvhcnjBHRHUEW5mWHLa7ufC+7yzYwKKOV79Syk5zME=";
+  };
+
+  subPackages = [ "cmd/jxscout" ];
+
+  vendorHash = null;
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  doCheck = true;
+
+  postInstall = ''
+    wrapProgram $out/bin/jxscout --prefix PATH : ${
+      lib.makeBinPath [
+        prettier
+        bun
+        nodejs
+      ]
+    }
+  '';
+
+  meta = {
+    description = "jxscout superpowers JavaScript analysis for security researchers (free version)";
+    homepage = "https://jxscout.app/";
+    downloadPage = "https://github.com/francisconeves97/jxscout";
+    changelog = "https://github.com/francisconeves97/jxscout/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.gpl3Plus;
+    mainProgram = "jxscout";
+    maintainers = with lib.maintainers; [ katok ];
+    platforms = lib.platforms.linux ++ lib.platforms.darwin ++ lib.platforms.windows;
+  };
+})

pkgs/by-name/li/libretro-shaders-slang/package.nix

@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "libretro-shaders-slang";
-  version = "0-unstable-2026-04-17";
+  version = "0-unstable-2026-04-26";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "slang-shaders";
-    rev = "12b0869495c1ea8238b53179ec33888205f6800f";
-    hash = "sha256-9b/c+DCmy61Wsy70MU5efNhPKQa5C03P1eZZPwJDNvA=";
+    rev = "cc71b5eff24a962bd055a92d2032f806635fdf97";
+    hash = "sha256-PeG6H5XArKdptbSicMgXPFtnrkglmkwZieGKSr0aPaQ=";
   };
 
   dontConfigure = true;

pkgs/by-name/li/liteparse/package.nix

@@ -10,16 +10,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "liteparse";
-  version = "1.4.6";
+  version = "1.5.2";
 
   src = fetchFromGitHub {
     owner = "run-llama";
     repo = "liteparse";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GUtqJsmAOrbxLc/aAIre95QD6aaFsj5ClqZfo7jdwB4=";
+    hash = "sha256-e3c8ak4kww8vQDfYT8S9m7Tv7vnBiox2qaI73yUb23U=";
   };
 
-  npmDepsHash = "sha256-Wz46n7BbubC3Cq1CHOHM2q/dVOvOVNQTloHZfkAwzpg=";
+  npmDepsHash = "sha256-KhtwPl1J9ZZMT9xT5bQJjPa3fYTvi9oRnxijCm0o+2c=";
   npmBuildScript = "build";
 
   nativeBuildInputs = [ makeBinaryWrapper ];

pkgs/by-name/ll/llmfit/package.nix

@@ -20,7 +20,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   meta = {
     description = "Find what runs on your hardware";
     homepage = "https://github.com/AlexsJones/llmfit";
-    changelog = "https://github.com/AlexsJones/llmfit/releases/tag/v${finalAttrs.src.rev}";
+    changelog = "https://github.com/AlexsJones/llmfit/blob/v${finalAttrs.src.rev}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       matthiasbeyer

pkgs/by-name/ma/maelstrom-clj/package.nix

@@ -48,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Workbench for writing toy implementations of distributed systems";
     homepage = "https://github.com/jepsen-io/maelstrom";
-    changelog = "https://github.com/jepsen-io/maelstrom/releases/tag/${finalAttrs.version}";
+    changelog = "https://github.com/jepsen-io/maelstrom/releases/tag/v${finalAttrs.version}";
     mainProgram = "maelstrom";
     sourceProvenance = [ lib.sourceTypes.binaryBytecode ];
     license = lib.licenses.epl10;

pkgs/by-name/ma/markitdown-mcp/package.nix

@@ -36,7 +36,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     "markitdown_mcp"
   ];
 
-  passthru.updateScripts = gitUpdater { };
+  passthru.updateScript = gitUpdater { };
 
   meta = {
     description = "MCP server for the markitdown library";

pkgs/by-name/mc/mcp-nixos/package.nix

@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "mcp-nixos";
-  version = "2.3.1";
+  version = "2.4.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "utensils";
     repo = "mcp-nixos";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-A7KhRVOqLmtta507DPZoKbO8D1AlMMDWLMfHEBhEAxY=";
+    hash = "sha256-mWq9nnL4IGhUFkXJr8+t6BresOTDFS1caG8NuFqjrJg=";
   };
 
   build-system = [ python3Packages.hatchling ];

pkgs/by-name/mk/mklittlefs/package.nix

@@ -69,7 +69,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Tool to build and unpack littlefs images";
     homepage = "https://github.com/earlephilhower/mklittlefs";
-    changelog = "https://github.com/earlephilhower/mklittlefs/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/earlephilhower/mklittlefs/releases/tag/${finalAttrs.version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ liberodark ];
     mainProgram = "mklittlefs";

pkgs/by-name/mo/mongodb-atlas-cli/package.nix

@@ -11,16 +11,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "mongodb-atlas-cli";
-  version = "1.53.3";
+  version = "1.54.0";
 
   src = fetchFromGitHub {
     owner = "mongodb";
     repo = "mongodb-atlas-cli";
     tag = "atlascli/v${finalAttrs.version}";
-    hash = "sha256-+/B2lr8R+6UKObm4e0jqIZ+yJEtLvxuN+21cHKNBq3E=";
+    hash = "sha256-OZiumnbWNOaH++1u7ZFkpi2xPQ8PG0TI63dXZxX4GOM=";
   };
 
-  vendorHash = "sha256-OsEGK0KqucRIDH6tmz8y1vpU2GjOR1mWpsyeb/6IN84=";
+  vendorHash = "sha256-k7hLJ4bk3IAI/m//MIqp+YVMa3bbADnDiLsuEmz1suI=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/ni/ni/package.nix

@@ -12,13 +12,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "ni";
-  version = "30.0.0";
+  version = "30.1.0";
 
   src = fetchFromGitHub {
     owner = "antfu-collective";
     repo = "ni";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CCegG/ClJV4SsuCztUbUy6fw0nFod8FLpIXvftPA9cg=";
+    hash = "sha256-mBKSnnmvlZOwU+6MQrg8S8iCea2PGAsHa+A4lseLYyw=";
   };
 
   pnpmDeps = fetchPnpmDeps {

pkgs/by-name/nm/nmtrust/package.nix

@@ -0,0 +1,70 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  makeWrapper,
+  shellcheck,
+  bash,
+  systemd,
+  coreutils,
+  gawk,
+  util-linux,
+}:
+
+stdenv.mkDerivation {
+  pname = "nmtrust";
+  version = "0.1.0";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "brett";
+    repo = "nmtrust-nix";
+    rev = "v0.1.0";
+    hash = "sha256-7Cs00mCzByTKe7w5pnkkgqtZyUSaPa2r/5Uv133eZy0=";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+  nativeCheckInputs = [ shellcheck ];
+
+  doCheck = true;
+  checkPhase = ''
+    runHook preCheck
+    shellcheck nmtrust.sh
+    runHook postCheck
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 nmtrust.sh $out/bin/nmtrust
+    wrapProgram $out/bin/nmtrust \
+      --prefix PATH : ${
+        lib.makeBinPath [
+          bash
+          systemd
+          coreutils
+          gawk
+          util-linux
+        ]
+      }
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Declarative network trust management for NixOS";
+    longDescription = ''
+      nmtrust evaluates the trust state of active NetworkManager connections
+      and activates corresponding systemd targets. Services bound to these
+      targets start and stop automatically as you move between trusted,
+      untrusted, and offline networks.
+
+      A NixOS-native reimplementation of nmtrust by Peter Hogg (pigmonkey).
+    '';
+    homepage = "https://github.com/brett/nmtrust-nix";
+    license = lib.licenses.unlicense;
+    maintainers = [ lib.maintainers.brett ];
+    mainProgram = "nmtrust";
+    platforms = lib.platforms.linux;
+  };
+}

pkgs/by-name/nu/nu_scripts/package.nix

@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "nu_scripts";
-  version = "0-unstable-2026-04-18";
+  version = "0-unstable-2026-04-27";
 
   src = fetchFromGitHub {
     owner = "nushell";
     repo = "nu_scripts";
-    rev = "c5387bd60ca63d26885ee73ceb8a84160bc6ca6b";
-    hash = "sha256-QPKgVj5tWwgwspCQYwjPBJZLTHm2e3AuneOK+hI6qUg=";
+    rev = "32cd1d53649bc024edd65326a5b988cd7bcf4810";
+    hash = "sha256-t8OCSDI7MqA9Q9Tv4mjd/yRac2SZvhX2x8rfcbIUT9o=";
   };
 
   installPhase = ''

pkgs/by-name/oa/oauth2c/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "oauth2c";
-  version = "1.19.0";
+  version = "1.20.0";
 
   src = fetchFromGitHub {
     owner = "cloudentity";
     repo = "oauth2c";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Bh4gWskmY2nWTckUT1FX7vRDz/gg670A77CQTZhz3mg=";
+    hash = "sha256-l/fXorXE4+6n7qQM2c2pJssNq3DKaxOjapdfNlXuAWg=";
   };
 
-  vendorHash = "sha256-I2pOyjKghvHHGEuVqODhysD++f2hD+BF7WJxWbrLcWA=";
+  vendorHash = "sha256-+Y8AStkbaecVdosfWlEmO53Y5aC13zfzlDOeMO91Lw0=";
 
   doCheck = false; # tests want to talk to oauth2c.us.authz.cloudentity.io
 

pkgs/by-name/ob/obconf/package.nix

@@ -48,8 +48,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "GUI configuration tool for openbox";
-    homepage = "http://openbox.org/wiki/ObConf";
-    changelog = "http://openbox.org/wiki/ObConf:Changelog";
+    homepage = "https://openbox.org/obconf";
+    changelog = "https://openbox.org/obconf_changelog";
     license = lib.licenses.gpl2Plus;
     maintainers = [ lib.maintainers.sfrijters ];
     platforms = lib.platforms.linux;

pkgs/by-name/pb/pbgopy/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "pbgopy";
-  version = "0.3.0";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "nakabonne";
     repo = "pbgopy";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-P/MFDFMsqSTVErTM9izJJSMIbiOcbQ9Ya10/w6NRcYw=";
+    sha256 = "sha256-rm4fopreiYBwcFbtuo0B6FalveFft8hrNVf7JpvyNKE=";
   };
 
-  vendorHash = "sha256-S2X74My6wyDZOsEYTDilCFaYgV2vQzU0jOAY9cEkJ6A=";
+  vendorHash = "sha256-qxdylBQiUlHOkzaxV+P9m3tnkFqUdZTdF31LD0IWyuI=";
 
   meta = {
     description = "Copy and paste between devices";

pkgs/by-name/pr/prometheus-tibber-exporter/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "prometheus-tibber-exporter";
-  version = "3.10.0";
+  version = "3.10.2";
 
   src = fetchFromGitHub {
     owner = "terjesannum";
     repo = "tibber-exporter";
     tag = "tibber-exporter-${finalAttrs.version}";
-    hash = "sha256-Ndg2BxWdL5DKa2eHjY0rIdrfJ+SJlzvOUZDtWUBSR6g=";
+    hash = "sha256-by7/c2a/8jM4ShoeQnYC+L+EVLk2NwQoRTAMiZZcMn0=";
     leaveDotGit = true;
     postFetch = ''
       cd "$out"
@@ -37,9 +37,14 @@ buildGoModule (finalAttrs: {
     "-X github.com/prometheus/common/version.BuildUser=nix@nixpkgs"
   ];
 
-  vendorHash = "sha256-JTJTapsqBj0FO2Gcx8O1eWJf9hMbeWzjtO0HYcDdzQo=";
+  vendorHash = "sha256-rjM2M9auiyFvGcq/D8N5YPoFOPeC9r1Y1JPssT7nvew=";
 
-  passthru.updateScript = nix-update-script { };
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "tibber-exporter-(.*)"
+    ];
+  };
 
   nativeInstallCheckInputs = [
     versionCheckHook

pkgs/by-name/pu/pure-ftpd/package.nix

@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pure-ftpd";
-  version = "1.0.53";
+  version = "1.0.54";
 
   src = fetchurl {
     url = "https://download.pureftpd.org/pub/pure-ftpd/releases/pure-ftpd-${finalAttrs.version}.tar.gz";
-    hash = "sha256-s/KwGUIjseiL+LDfnpH/tdG5gSNW6d1GXy+XtyshJl8=";
+    hash = "sha256-3JFAQg7ET3gpV5WR/zeKpjlrRgS5xq6uhHNo4PNb17I=";
   };
 
   buildInputs = [

pkgs/by-name/pv/pvz-portable-unwrapped/package.nix

@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pvz-portable-unwrapped";
-  version = "0.1.21";
+  version = "0.1.22";
 
   src = fetchFromGitHub {
     owner = "wszqkzqk";
     repo = "PvZ-Portable";
     tag = finalAttrs.version;
-    hash = "sha256-4CtO62cwNzQ32DE70F8kKFHy7tOsRLpDsgyrBS00C/g=";
+    hash = "sha256-H+YY2jTnsbnPzRhiOBqzzkVNJsFzoT6hMZpOTnB5mtA=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/pv/pvzge/package.nix

@@ -14,13 +14,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "pvzge";
-  version = "0.8.1";
+  version = "0.8.2";
 
   src = fetchFromGitHub {
     owner = "Gzh0821";
     repo = "pvzge_web";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-juo+kM7IK+e3qPHH+V+/1D0NqQiZfXYEtvX940dLarQ=";
+    hash = "sha256-lCYkkFIis6roWicsU7SN1YzHFQbAdLkkRl6JHasQa8E=";
   };
 
   iconSrc = fetchurl {

pkgs/by-name/py/pyenv/package.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pyenv";
-  version = "2.6.27";
+  version = "2.6.28";
 
   src = fetchFromGitHub {
     owner = "pyenv";
     repo = "pyenv";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-EWpVkVTYI8Rvt7OZ3mdm/EEIcGHkD4LfHdAmhwgesLw=";
+    hash = "sha256-1jbpelEVcm+HqjsT8yaQPTaoOhEBCSq64LzTzr0X93I=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/qg/qgroundcontrol/package.nix

@@ -101,7 +101,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Provides full ground station support and configuration for the PX4 and APM Flight Stacks";
     homepage = "https://qgroundcontrol.com/";
-    changelog = "https://github.com/mavlink/qgroundcontrol/blob/master/ChangeLog.md";
+    changelog = "https://github.com/mavlink/qgroundcontrol/blob/master/CHANGELOG.md";
     license = lib.licenses.gpl3Plus;
     platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [

pkgs/by-name/ro/roc/package.nix

@@ -99,7 +99,7 @@ rustPlatform.buildRustPackage {
     description = "Fast, friendly, functional programming language";
     mainProgram = "roc";
     homepage = "https://www.roc-lang.org/";
-    changelog = "https://github.com/roc-lang/roc/releases/tag/${rocVersion}";
+    changelog = "https://github.com/roc-lang/roc/releases/tag/alpha4-rolling";
     license = lib.licenses.upl;
     maintainers = [
       lib.maintainers.anton-4

pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix

@@ -13,15 +13,15 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rust-analyzer-unwrapped";
-  version = "2026-04-13";
+  version = "2026-04-27";
 
-  cargoHash = "sha256-qpe40NUQ9ux8fQmjcC63VP8g2NKoLkdqQIVfFFRTq5I=";
+  cargoHash = "sha256-QXEJhBzKof1UONW2FwQUeO6UAo1Xfm2nPpOo1uNiRM8=";
 
   src = fetchFromGitHub {
     owner = "rust-lang";
     repo = "rust-analyzer";
     rev = finalAttrs.version;
-    hash = "sha256-LryjOOjPsZ6Hs3RlVHla6MV8uxO2GoZolF0I/eB5zFM=";
+    hash = "sha256-f8YJfwAOsLFpIoqZuX3yF69UvMLrkx7iVzMH1pJU7cM=";
   };
 
   cargoBuildFlags = [

pkgs/by-name/sa/sail/package.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "sail";
-  version = "0.6.0";
+  version = "0.6.1";
 
   src = fetchFromGitHub {
     owner = "lakehq";
     repo = "sail";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ISTZwWDQ5DjNa5TC77Xea3zuhp2sSnp/NwD3ytYbjLc=";
+    hash = "sha256-QHlfK9gTTRObFJSPQFe8tQZRa8mRIA87TFZIwJV0nWs=";
   };
 
-  cargoHash = "sha256-njc4c/xN9uWvNgOvswx1fwwynFrM9eHw4LUOFVYJ4ls=";
+  cargoHash = "sha256-XMEyfLB/O7MA1dNY40UDv4OOyMKiJwgUm93XhxDyz4k=";
 
   cargoBuildFlags = [
     "-p"

pkgs/by-name/sd/sdl3-shadercross/package.nix

@@ -13,7 +13,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sdl3-shadercross";
-  version = "0-unstable-2026-04-11";
+  version = "0-unstable-2026-04-24";
 
   outputs = [
     "out"
@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "libsdl-org";
     repo = "SDL_shadercross";
-    rev = "f5c01f451e835f6b38e151e064a32999a0985563";
+    rev = "6b06e55c7c5d7e7a09a8a14f76e866dcfad5ab99";
     hash = "sha256-DvgMnE0QedInYRdcZQuVOlasri79kVl0ACGvNC1cq8o=";
   };
 

pkgs/by-name/si/signal-desktop/package.nix

@@ -106,6 +106,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   strictDeps = true;
   nativeBuildInputs = [
+    node-gyp
     nodejs
     pnpmConfigHook
     pnpm
@@ -241,7 +242,7 @@ stdenv.mkDerivation (finalAttrs: {
     # Build it explicitly against Electron headers ahead of packaging.
     export npm_config_nodedir=${electron.headers}
     pushd node_modules/fs-xattr
-    ${lib.getExe node-gyp} rebuild
+    node-gyp rebuild
     popd
     test -f node_modules/fs-xattr/build/Release/xattr.node
   '';

pkgs/by-name/sp/spacectl/package.nix

@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "spacectl";
-  version = "1.21.0";
+  version = "1.21.1";
 
   src = fetchFromGitHub {
     owner = "spacelift-io";
     repo = "spacectl";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-GW8jeET8MBvyFbGZWblU2mj9kWSK9cfhdYj+UXxbt5s=";
+    hash = "sha256-YXPiB/RZsilteKzoOAsQ2aJ1qIlKIicToSVpS8pUWd4=";
   };
 
   vendorHash = "sha256-wc6pRnCdIL7Se98eDfyU5OMOghJ2VrR1POM7lHo3Af8=";

pkgs/by-name/sp/spirv-cross/package.nix

@@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Tool designed for parsing and converting SPIR-V to other shader languages";
     homepage = "https://github.com/KhronosGroup/SPIRV-Cross";
-    changelog = "https://github.com/KhronosGroup/SPIRV-Cross/releases/tag/${finalAttrs.version}";
+    changelog = "https://github.com/KhronosGroup/SPIRV-Cross/releases/tag/vulkan-sdk-${finalAttrs.version}";
     platforms = lib.platforms.all;
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ Flakebi ];

pkgs/by-name/sp/spotatui/package.nix

@@ -12,16 +12,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "spotatui";
-  version = "0.38.0";
+  version = "0.38.1";
 
   src = fetchFromGitHub {
     owner = "LargeModGames";
     repo = "spotatui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6XsKlM4KLwRZk+uJY60a0rKHIEv1ieZPZoBZpRG1sQ0=";
+    hash = "sha256-cHuqSnNLnR8LLYjjlrgJTEb/MJe4lBJP7GY3D7/AUqE=";
   };
 
-  cargoHash = "sha256-5aj35NGRFb1DiEPU1RGKkvz/wMOIjO1HzkX45GEFbPs=";
+  cargoHash = "sha256-dlEsghdnNVbi086WgNImUcM+OO7vuBaNit3Wcaw5/mA=";
 
   nativeBuildInputs = [ pkg-config ] ++ lib.optional withPipewireVisualizer rustPlatform.bindgenHook;
 

pkgs/by-name/sq/sqlc/package.nix

@@ -9,17 +9,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "sqlc";
-  version = "1.31.0";
+  version = "1.31.1";
 
   src = fetchFromGitHub {
     owner = "sqlc-dev";
     repo = "sqlc";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1HQXj3rmfPyOw3Cex3jRByEwzXhcYpWpj8w4Z2Cylp8=";
+    hash = "sha256-/skb7p3s9TaQE699UCprk1D6S+G/T8Ek9/ADOtS/n44=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-SVc7XZERh47hhfTr9bExjZcZrNz0FO/OVEQYbPVqSWM=";
+  vendorHash = "sha256-+kSAupLQwTzJdgnhlqulEtRcDj9gqSq8uTnWNyDLZew=";
 
   subPackages = [ "cmd/sqlc" ];
 

pkgs/by-name/ss/ssh-agent-switcher/package.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ssh-agent-switcher";
-  version = "1.0.1";
+  version = "1.0.2";
 
   src = fetchFromGitHub {
     owner = "jmmv";
     repo = "ssh-agent-switcher";
     tag = "ssh-agent-switcher-${finalAttrs.version}";
-    hash = "sha256-p9W0H25pWDB+GCrwLwuVruX9p8b8kICpp+6I11ym1aw=";
+    hash = "sha256-XAIupGVU8D4tmZXZ3/5lKiHbvBlxgNQXL0T9Htp7Zmo=";
   };
 
-  cargoHash = "sha256-WioA/RjXOAHM9QWl/lxnb7gqzcp76rus7Rv+IfCYceg=";
+  cargoHash = "sha256-dbeUye20E2nQcJPyUCpZT68T95dopgoIlBm8rOoaZ6Y=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/te/tenv/package.nix

@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "tenv";
-  version = "4.11.1";
+  version = "4.12.0";
 
   src = fetchFromGitHub {
     owner = "tofuutils";
     repo = "tenv";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3KSJG2gKnyu0Kxhbjemw4y8OvmXUNrqzlKcU9CCIqEo=";
+    hash = "sha256-Ph44Iy/yUdtSi3zkCeDZyWeSa+0l6nr34Co1JupD2eY=";
   };
 
-  vendorHash = "sha256-9A51pB94+PQP0SaT7LW78bwndGa5gOZOFkDEz2VzHl8=";
+  vendorHash = "sha256-CBAjiUMnyA7yq08Z1fOSOAeSy/8uSCra6l63C8fn6tU=";
 
   excludedPackages = [ "tools" ];
 

pkgs/by-name/to/tor-browser/package.nix

@@ -102,7 +102,7 @@ let
     ++ lib.optionals mediaSupport [ ffmpeg_7 ]
   );
 
-  version = "15.0.10";
+  version = "15.0.11";
 
   sources = {
     x86_64-linux = fetchurl {
@@ -112,7 +112,7 @@ let
         "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
         "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
       ];
-      hash = "sha256-PlGjkyO2MoLWo7eAgoNMfd52dM7v9VKyfCxXbj3qqu4=";
+      hash = "sha256-+1ZpJcVkqqP2WE3kyAJ7Ip3CmM2JIpUos1wgvLjND24=";
     };
 
     i686-linux = fetchurl {
@@ -122,7 +122,7 @@ let
         "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
         "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
       ];
-      hash = "sha256-rangtzd7oee+2b7zdmKYJD8al4G3FYo+bdq8JgBn5oE=";
+      hash = "sha256-dZeTAkmvI5+mu7u9DrUj/JTvLHE4hiNVqd5AyVbZptg=";
     };
   };
 
@@ -347,7 +347,7 @@ stdenv.mkDerivation rec {
     description = "Privacy-focused browser routing traffic through the Tor network";
     mainProgram = "tor-browser";
     homepage = "https://www.torproject.org/";
-    changelog = "https://gitweb.torproject.org/builders/tor-browser-build.git/plain/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt?h=maint-${version}";
+    changelog = "https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/raw/maint-${lib.versions.majorMinor version}/projects/browser/Bundle-Data/Docs-TBB/ChangeLog.txt";
     platforms = lib.attrNames sources;
     maintainers = with lib.maintainers; [
       c4patino

pkgs/by-name/tu/tutanota-desktop/package.nix

@@ -8,11 +8,11 @@
 
 appimageTools.wrapType2 rec {
   pname = "tutanota-desktop";
-  version = "340.260326.1";
+  version = "345.260424.1";
 
   src = fetchurl {
     url = "https://github.com/tutao/tutanota/releases/download/tutanota-desktop-release-${version}/tutanota-desktop-linux.AppImage";
-    hash = "sha256-9QtiB4VyktUgItJkOIdeGYthFxGt8RsNlAFf9ERoAEg=";
+    hash = "sha256-B0YXpJ75b6N2UNJSOwDd0bgsM4qzJGfYX/ELQk+IQO4=";
   };
 
   extraPkgs = pkgs: [ pkgs.libsecret ];

pkgs/by-name/tx/txtpbfmt/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule {
   pname = "txtpbfmt";
-  version = "0-unstable-2026-02-17";
+  version = "0-unstable-2026-04-20";
 
   src = fetchFromGitHub {
     owner = "protocolbuffers";
     repo = "txtpbfmt";
-    rev = "a481f6a22f9426d6c2cc3d4be185b28d156886e4";
-    hash = "sha256-5dX1hEq1VzzZdXaoxkyy/gCbB8u/wlwy8g9kScVmJZs=";
+    rev = "c39628bde8b5d6b6e8f67f46580b5c1dd491b1fd";
+    hash = "sha256-D3yONCvyynXKVyeRypllKNMgPgo1w1ObPcra3r7aSF0=";
   };
 
   vendorHash = "sha256-aeYa7a/oKH2dxXHRkkqyh7f04citRDGQxAaKQTJst4o=";

pkgs/by-name/wa/wasistlos/package.nix

@@ -1,84 +0,0 @@
-{
-  fetchFromGitHub,
-  lib,
-  stdenv,
-  cmake,
-  glib-networking,
-  gst_all_1,
-  gtkmm3,
-  libayatana-appindicator,
-  libcanberra,
-  libepoxy,
-  libpsl,
-  libdatrie,
-  libdeflate,
-  libselinux,
-  libsepol,
-  libsysprof-capture,
-  libthai,
-  libxkbcommon,
-  sqlite,
-  pcre,
-  pcre2,
-  pkg-config,
-  webkitgtk_4_1,
-  wrapGAppsHook3,
-  libxtst,
-  libxdmcp,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "wasistlos";
-  version = "1.7.0";
-
-  src = fetchFromGitHub {
-    owner = "xeco23";
-    repo = "WasIstLos";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-h07Qf34unwtyc1VDtCCkukgBDJIvYNgESwAylbsjVsQ=";
-  };
-
-  nativeBuildInputs = [
-    cmake
-    pkg-config
-    wrapGAppsHook3
-  ];
-
-  buildInputs = [
-    glib-networking
-    gst_all_1.gst-libav
-    gst_all_1.gst-plugins-bad
-    gst_all_1.gst-plugins-base
-    gst_all_1.gst-plugins-good
-    gtkmm3
-    libayatana-appindicator
-    libcanberra
-    libdatrie
-    libdeflate
-    libepoxy
-    libpsl
-    libselinux
-    libsepol
-    libsysprof-capture
-    libthai
-    libxkbcommon
-    pcre
-    pcre2
-    sqlite
-    webkitgtk_4_1
-    libxdmcp
-    libxtst
-  ];
-
-  meta = {
-    homepage = "https://github.com/xeco23/WasIstLos";
-    description = "Unofficial WhatsApp desktop application";
-    mainProgram = "wasistlos";
-    license = lib.licenses.gpl3Only;
-    maintainers = with lib.maintainers; [ bartuka ];
-    platforms = [
-      "x86_64-linux"
-      "aarch64-linux"
-    ];
-  };
-})

pkgs/by-name/ze/zed-editor/package.nix

@@ -97,7 +97,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "0.233.10";
+  version = "1.0.0";
 
   outputs = [
     "out"
@@ -110,7 +110,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ftbrApKQhSn6SNs7ysgBot9XctuVtAskBTnm2hmCBaA=";
+    hash = "sha256-D5V0pvL3WCwhcC8dnNKTXRdnFq8LMZZ0/GDjw8xf95g=";
   };
 
   postPatch = ''
@@ -139,7 +139,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rm -r $out/git/*/candle-book/
   '';
 
-  cargoHash = "sha256-9r0jaT+ETAkGGHYDL1KFmq3M+apaLsRpORk7OOz4s5Q=";
+  cargoHash = "sha256-xtw7r7VluCEqXWKnxpVk8BPqr+mJV5rB3Eq/PvsKPBk=";
 
   __structuredAttrs = true;
 

pkgs/development/compilers/jetbrains-jdk/21.nix

@@ -0,0 +1,26 @@
+{
+  callPackage,
+  jetbrains,
+  jdk,
+  debugBuild ? false,
+  withJcef ? true,
+}:
+
+callPackage ./common.nix
+  {
+    inherit jdk debugBuild withJcef;
+  }
+  {
+    # To get the new tag:
+    # git clone https://github.com/jetbrains/jetbrainsruntime
+    # cd jetbrainsruntime
+    # git tag --points-at [revision]
+    # Look for the line that starts with jbr-
+    javaVersion = "21.0.10";
+    build = "1163.110";
+    # run `git log -1 --pretty=%ct` in jdk repo for new value on update
+    sourceDateEpoch = 1765114563;
+    srcHash = "sha256-Qmffu7p6frBoH2Zh+EiqvEoMNNBE79qfkgLSC3+XuI0=";
+    homePath = "${jetbrains.jdk-21}/lib/openjdk";
+    jcefPackage = jetbrains.jcef-21;
+  }

pkgs/development/compilers/jetbrains-jdk/common.nix

@@ -0,0 +1,236 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  jdk,
+  git,
+  autoconf,
+  unzip,
+  rsync,
+  shaderc,
+  vulkan-headers,
+  libxdamage,
+  libxxf86vm,
+  libxrandr,
+  libxi,
+  libxcursor,
+  libxrender,
+  libx11,
+  libxext,
+  libxkbcommon,
+  libxcb,
+  nss,
+  nspr,
+  libdrm,
+  libgbm,
+  wayland,
+  udev,
+  fontconfig,
+  debugBuild ? false,
+  withJcef ? true,
+}:
+
+{
+  javaVersion,
+  build,
+  sourceDateEpoch,
+  srcHash,
+  homePath,
+  jcefPackage ? null,
+  extraBuildPhase ? "",
+  vendorVersionString ? null,
+  extraConfigureFlags ? [ ],
+  extraNativeBuildInputs ? [ ],
+  extraBuildInputs ? [ ],
+}:
+
+assert debugBuild -> withJcef;
+
+let
+  arch =
+    {
+      "aarch64-linux" = "aarch64";
+      "x86_64-linux" = "x64";
+    }
+    .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+  cpu = stdenv.hostPlatform.parsed.cpu.name;
+  version = "${javaVersion}-b${build}";
+  openjdkTag = "jbr-release-${javaVersion}b${build}";
+in
+jdk.overrideAttrs (oldAttrs: {
+  pname = "jetbrains-jdk" + lib.optionalString withJcef "-jcef";
+  inherit
+    javaVersion
+    build
+    version
+    openjdkTag
+    ;
+
+  src = fetchFromGitHub {
+    owner = "JetBrains";
+    repo = "JetBrainsRuntime";
+    rev = "jb${version}";
+    hash = srcHash;
+  };
+
+  env = (oldAttrs.env or { }) // {
+    BOOT_JDK = jdk.home;
+    # run `git log -1 --pretty=%ct` in jdk repo for new value on update
+    SOURCE_DATE_EPOCH = sourceDateEpoch;
+  };
+
+  patches = [ ];
+
+  dontConfigure = true;
+
+  buildPhase = ''
+    runHook preBuild
+
+    ${lib.optionalString withJcef "cp -r ${jcefPackage} jcef_linux_${arch}"}
+    ${extraBuildPhase}
+
+    sed \
+        -e "s/OPENJDK_TAG=.*/OPENJDK_TAG=${openjdkTag}/" \
+        -e "s/SOURCE_DATE_EPOCH=.*//" \
+        -e "s/export SOURCE_DATE_EPOCH//" \
+        -i jb/project/tools/common/scripts/common.sh
+
+    declare -a realConfigureFlags
+
+    for configureFlag in "''${configureFlags[@]}"; do
+      case "$configureFlag" in
+        --host=*)
+          # intentionally omit flag
+          ;;
+        ${lib.optionalString (vendorVersionString != null) ''
+          --with-vendor-version-string=*)
+            # Replace the flag from the JDK to include that it is JBR and the package version, so it passes the installation tests
+            realConfigureFlags+=('--with-vendor-version-string="${vendorVersionString}"')
+            ;;
+        ''}
+        *)
+          realConfigureFlags+=("$configureFlag")
+          ;;
+      esac
+    done
+
+    ${lib.concatMapStringsSep "\n" (flag: ''realConfigureFlags+=("${flag}")'') extraConfigureFlags}
+
+    echo "computed configure flags: ''${realConfigureFlags[*]}"
+    substituteInPlace jb/project/tools/linux/scripts/mkimages_${arch}.sh --replace-fail "STATIC_CONF_ARGS" "STATIC_CONF_ARGS ''${realConfigureFlags[*]}"
+
+    sed \
+        -e "s/create_image_bundle \"jb/#/" \
+        -e "s/echo Creating /exit 0 #/" \
+        -i jb/project/tools/linux/scripts/mkimages_${arch}.sh
+
+    patchShebangs .
+    ./jb/project/tools/linux/scripts/mkimages_${arch}.sh ${build} ${
+      if debugBuild then "fd" else (if withJcef then "jcef" else "nomod")
+    }
+
+    runHook postBuild
+  '';
+
+  installPhase =
+    let
+      buildType = if debugBuild then "fastdebug" else "release";
+      debugSuffix = if debugBuild then "-fastdebug" else "";
+      jcefSuffix = if debugBuild || !withJcef then "" else "_jcef";
+      jbrsdkDir = "jbrsdk${jcefSuffix}-${javaVersion}-linux-${arch}${debugSuffix}-b${build}";
+    in
+    ''
+      runHook preInstall
+
+      mv build/linux-${cpu}-server-${buildType}/images/jdk/man build/linux-${cpu}-server-${buildType}/images/${jbrsdkDir}
+      rm -rf build/linux-${cpu}-server-${buildType}/images/jdk
+      mv build/linux-${cpu}-server-${buildType}/images/${jbrsdkDir} build/linux-${cpu}-server-${buildType}/images/jdk
+    ''
+    + oldAttrs.installPhase
+    + "runHook postInstall";
+
+  postInstall = lib.optionalString withJcef ''
+    chmod +x $out/lib/openjdk/lib/chrome-sandbox
+  '';
+
+  dontStrip = debugBuild;
+
+  postFixup = ''
+    # Build the set of output library directories to rpath against
+    LIBDIRS="${
+      lib.makeLibraryPath [
+        libxdamage
+        libxxf86vm
+        libxrandr
+        libxi
+        libxcursor
+        libxrender
+        libx11
+        libxext
+        libxkbcommon
+        libxcb
+        nss
+        nspr
+        libdrm
+        libgbm
+        wayland
+        udev
+        fontconfig
+      ]
+    }"
+    for output in ${lib.concatStringsSep " " oldAttrs.outputs}; do
+      if [ "$output" = debug ]; then continue; fi
+      LIBDIRS="$(find $(eval echo \$$output) -name \*.so\* -exec dirname {} \+ | sort -u | tr '\n' ':'):$LIBDIRS"
+    done
+    # Add the local library paths to remove dependencies on the bootstrap
+    for output in ${lib.concatStringsSep " " oldAttrs.outputs}; do
+      if [ "$output" = debug ]; then continue; fi
+      OUTPUTDIR=$(eval echo \$$output)
+      BINLIBS=$(find $OUTPUTDIR/bin/ -type f; find $OUTPUTDIR -name \*.so\*)
+      echo "$BINLIBS" | while read i; do
+        patchelf --set-rpath "$LIBDIRS:$(patchelf --print-rpath "$i")" "$i" || true
+      done
+    done
+  '';
+
+  nativeBuildInputs = [
+    git
+    autoconf
+    unzip
+    rsync
+    shaderc # glslc
+  ]
+  ++ extraNativeBuildInputs
+  ++ oldAttrs.nativeBuildInputs;
+
+  buildInputs = [
+    vulkan-headers
+  ]
+  ++ extraBuildInputs
+  ++ oldAttrs.buildInputs or [ ];
+
+  meta = {
+    description = "OpenJDK fork to better support Jetbrains's products";
+    longDescription = ''
+      JetBrains Runtime is a runtime environment for running IntelliJ Platform
+      based products on Windows, Mac OS X, and Linux. JetBrains Runtime is
+      based on OpenJDK project with some modifications. These modifications
+      include: Subpixel Anti-Aliasing, enhanced font rendering on Linux, HiDPI
+      support, ligatures, some fixes for native crashes not presented in
+      official build, and other small enhancements.
+      JetBrains Runtime is not a certified build of OpenJDK. Please, use at
+      your own risk.
+    '';
+    homepage = "https://confluence.jetbrains.com/display/JBR/JetBrains+Runtime";
+    inherit (jdk.meta) license platforms mainProgram;
+    maintainers = with lib.maintainers; [
+      aoli-al
+    ];
+
+    broken = stdenv.hostPlatform.isDarwin;
+  };
+
+  passthru = oldAttrs.passthru // {
+    home = homePath;
+  };
+})

pkgs/development/compilers/jetbrains-jdk/default.nix

@@ -1,210 +1,53 @@
 {
-  lib,
-  stdenv,
-  fetchFromGitHub,
+  callPackage,
+  fetchurl,
   jetbrains,
   jdk,
-  git,
-  autoconf,
-  unzip,
-  rsync,
   debugBuild ? false,
   withJcef ? true,
-
-  libxdamage,
-  libxxf86vm,
-  libxrandr,
-  libxi,
-  libxcursor,
-  libxrender,
-  libx11,
-  libxext,
+  wayland-scanner,
+  wayland-protocols,
   libxkbcommon,
-  libxcb,
-  nss,
-  nspr,
-  libdrm,
-  libgbm,
-  wayland,
-  udev,
-  fontconfig,
-  shaderc,
-  vulkan-headers,
 }:
 
-assert debugBuild -> withJcef;
-
 let
-  arch =
-    {
-      "aarch64-linux" = "aarch64";
-      "x86_64-linux" = "x64";
-    }
-    .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-  cpu = stdenv.hostPlatform.parsed.cpu.name;
-in
-jdk.overrideAttrs (oldAttrs: rec {
-  pname = "jetbrains-jdk" + lib.optionalString withJcef "-jcef";
-  javaVersion = "21.0.9";
-  build = "1163.86";
-  # To get the new tag:
-  # git clone https://github.com/jetbrains/jetbrainsruntime
-  # cd jetbrainsruntime
-  # git tag --points-at [revision]
-  # Look for the line that starts with jbr-
-  openjdkTag = "jbr-release-21.0.9b1163.86";
-  version = "${javaVersion}-b${build}";
-
-  src = fetchFromGitHub {
-    owner = "JetBrains";
-    repo = "JetBrainsRuntime";
-    rev = "jb${version}";
-    hash = "sha256-P2boCbGB66X8LB4sZHGFO8lqHbv6F4kqGVMGBd9yKu0=";
-  };
-
-  env = (oldAttrs.env or { }) // {
-    BOOT_JDK = jdk.home;
-    # run `git log -1 --pretty=%ct` in jdk repo for new value on update
-    SOURCE_DATE_EPOCH = 1765114563;
-  };
-
-  patches = [ ];
-
-  dontConfigure = true;
-
-  buildPhase = ''
-    runHook preBuild
-
-    ${lib.optionalString withJcef "cp -r ${jetbrains.jcef} jcef_linux_${arch}"}
-
-    sed \
-        -e "s/OPENJDK_TAG=.*/OPENJDK_TAG=${openjdkTag}/" \
-        -e "s/SOURCE_DATE_EPOCH=.*//" \
-        -e "s/export SOURCE_DATE_EPOCH//" \
-        -i jb/project/tools/common/scripts/common.sh
-    declare -a realConfigureFlags
-    for configureFlag in "''${configureFlags[@]}"; do
-      case "$configureFlag" in
-        --host=*)
-          # intentionally omit flag
-          ;;
-        *)
-          realConfigureFlags+=("$configureFlag")
-          ;;
-      esac
-    done
-    echo "computed configure flags: ''${realConfigureFlags[*]}"
-    substituteInPlace jb/project/tools/linux/scripts/mkimages_${arch}.sh --replace-fail "STATIC_CONF_ARGS" "STATIC_CONF_ARGS ''${realConfigureFlags[*]}"
-    sed \
-        -e "s/create_image_bundle \"jb/#/" \
-        -e "s/echo Creating /exit 0 #/" \
-        -i jb/project/tools/linux/scripts/mkimages_${arch}.sh
-
-    patchShebangs .
-    ./jb/project/tools/linux/scripts/mkimages_${arch}.sh ${build} ${
-      if debugBuild then "fd" else (if withJcef then "jcef" else "nomod")
-    }
-
-    runHook postBuild
-  '';
-
-  installPhase =
+  gtk-protocols =
     let
-      buildType = if debugBuild then "fastdebug" else "release";
-      debugSuffix = if debugBuild then "-fastdebug" else "";
-      jcefSuffix = if debugBuild || !withJcef then "" else "_jcef";
-      jbrsdkDir = "jbrsdk${jcefSuffix}-${javaVersion}-linux-${arch}${debugSuffix}-b${build}";
+      rev = "refs/tags/4.22.1";
+      hash = "sha256-zCcXuiEYL2N4Q+WT96ouVDwdZVSohgU/QA2BkGlnZZ0=";
     in
-    ''
-      runHook preInstall
-
-      mv build/linux-${cpu}-server-${buildType}/images/jdk/man build/linux-${cpu}-server-${buildType}/images/${jbrsdkDir}
-      rm -rf build/linux-${cpu}-server-${buildType}/images/jdk
-      mv build/linux-${cpu}-server-${buildType}/images/${jbrsdkDir} build/linux-${cpu}-server-${buildType}/images/jdk
-    ''
-    + oldAttrs.installPhase
-    + "runHook postInstall";
-
-  postInstall = lib.optionalString withJcef ''
-    chmod +x $out/lib/openjdk/lib/chrome-sandbox
-  '';
-
-  dontStrip = debugBuild;
-
-  postFixup = ''
-    # Build the set of output library directories to rpath against
-    LIBDIRS="${
-      lib.makeLibraryPath [
-        libxdamage
-        libxxf86vm
-        libxrandr
-        libxi
-        libxcursor
-        libxrender
-        libx11
-        libxext
-        libxkbcommon
-        libxcb
-        nss
-        nspr
-        libdrm
-        libgbm
-        wayland
-        udev
-        fontconfig
-      ]
-    }"
-    for output in ${lib.concatStringsSep " " oldAttrs.outputs}; do
-      if [ "$output" = debug ]; then continue; fi
-      LIBDIRS="$(find $(eval echo \$$output) -name \*.so\* -exec dirname {} \+ | sort -u | tr '\n' ':'):$LIBDIRS"
-    done
-    # Add the local library paths to remove dependencies on the bootstrap
-    for output in ${lib.concatStringsSep " " oldAttrs.outputs}; do
-      if [ "$output" = debug ]; then continue; fi
-      OUTPUTDIR=$(eval echo \$$output)
-      BINLIBS=$(find $OUTPUTDIR/bin/ -type f; find $OUTPUTDIR -name \*.so\*)
-      echo "$BINLIBS" | while read i; do
-        patchelf --set-rpath "$LIBDIRS:$(patchelf --print-rpath "$i")" "$i" || true
-      done
-    done
-  '';
-
-  nativeBuildInputs = [
-    git
-    autoconf
-    unzip
-    rsync
-    shaderc # glslc
-  ]
-  ++ oldAttrs.nativeBuildInputs;
-
-  buildInputs = [
-    vulkan-headers
-  ]
-  ++ oldAttrs.buildInputs or [ ];
-
-  meta = {
-    description = "OpenJDK fork to better support Jetbrains's products";
-    longDescription = ''
-      JetBrains Runtime is a runtime environment for running IntelliJ Platform
-      based products on Windows, Mac OS X, and Linux. JetBrains Runtime is
-      based on OpenJDK project with some modifications. These modifications
-      include: Subpixel Anti-Aliasing, enhanced font rendering on Linux, HiDPI
-      support, ligatures, some fixes for native crashes not presented in
-      official build, and other small enhancements.
-      JetBrains Runtime is not a certified build of OpenJDK. Please, use at
-      your own risk.
+    fetchurl {
+      # We only need the wayland protocols file
+      url = "https://raw.githubusercontent.com/GNOME/gtk/${rev}/gdk/wayland/protocol/gtk-shell.xml";
+      hash = hash;
+    };
+in
+callPackage ./common.nix
+  {
+    inherit jdk debugBuild withJcef;
+  }
+  {
+    # To get the new tag:
+    # git clone https://github.com/jetbrains/jetbrainsruntime
+    # cd jetbrainsruntime
+    # git tag --points-at [revision]
+    # Look for the line that starts with jbr-
+    javaVersion = "25.0.2";
+    build = "329.72";
+    # run `git log -1 --pretty=%ct` in jdk repo for new value on update
+    sourceDateEpoch = 1769205294;
+    srcHash = "sha256-K4Izbij+1YO4UERHS0mwGKZX/VtIaxyNPZD068Vf99Q=";
+    homePath = "${jetbrains.jdk}/lib/openjdk";
+    jcefPackage = jetbrains.jcef;
+    extraBuildPhase = ''
+      cp -r ${gtk-protocols.out} gtk-shell.xml
     '';
-    homepage = "https://confluence.jetbrains.com/display/JBR/JetBrains+Runtime";
-    inherit (jdk.meta) license platforms mainProgram;
-    maintainers = with lib.maintainers; [
-      aoli-al
+    vendorVersionString = "nix/JBR-25.0.2-b329.72${if withJcef then "-jcef" else ""}";
+    extraConfigureFlags = [
+      "--with-wayland-protocols=${wayland-protocols.out}/share/wayland-protocols"
     ];
-
-    broken = stdenv.hostPlatform.isDarwin;
-  };
-
-  passthru = oldAttrs.passthru // {
-    home = "${jetbrains.jdk}/lib/openjdk";
-  };
-})
+    extraNativeBuildInputs = [
+      wayland-scanner
+      libxkbcommon
+    ];
+  }

pkgs/development/compilers/jetbrains-jdk/jcef.nix

@@ -9,6 +9,7 @@
   jdk,
   git,
   rsync,
+  which,
   lib,
   ant,
   ninja,
@@ -91,11 +92,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "jcef-jetbrains";
-  rev = "6f9ab690b28a1262f82e6f869c310bdf1d0697ac";
+  rev = "a492f5c1bbe877d2f58d4b066d0a1c89ab579b84";
   # This is the commit number
-  # Currently from the branch: https://github.com/JetBrains/jcef/tree/251
+  # Currently from the branch: https://github.com/JetBrains/jcef/tree/261
   # Run `git rev-list --count HEAD`
-  version = "1086";
+  version = "1131";
 
   nativeBuildInputs = [
     cmake
@@ -103,12 +104,14 @@ stdenv.mkDerivation rec {
     jdk
     git
     rsync
+    which
     ant
     ninja
     strip-nondeterminism
     stripJavaArchivesHook
     autoPatchelfHook
   ];
+
   buildInputs = [
     boost
     libGL
@@ -123,7 +126,7 @@ stdenv.mkDerivation rec {
     owner = "jetbrains";
     repo = "jcef";
     inherit rev;
-    hash = "sha256-w5t1M66KW5cUbNTpAc4ksGd+414EJsXwbq1UP1COFsw=";
+    hash = "sha256-c1gJu6gogALx3viLi9saLvqOn+zS9jCpWizB2g1Xa/g=";
   };
 
   # Find the hash in tools/buildtools/linux64/clang-format.sha1
@@ -172,6 +175,13 @@ stdenv.mkDerivation rec {
 
   postBuild = ''
     export JCEF_ROOT_DIR=$(realpath ..)
+
+    # Apply https://github.com/JetBrains/jcef/pull/42
+    substituteInPlace ../build.xml \
+      --replace-fail \
+        '<matches pattern="17*.*" string="''${java.version}"/>' \
+        '<javaversion atLeast="17"/>'
+
     ../tools/compile.sh ${platform} Release
   '';
 

pkgs/development/interpreters/python/python2/mk-python-derivation.nix

@@ -27,278 +27,298 @@
   eggBuildHook,
   eggInstallHook,
 }:
+lib.extendMkDerivation {
+  constructDrv = stdenv.mkDerivation;
 
-{
-  name ? "${attrs.pname}-${attrs.version}",
-
-  # Build-time dependencies for the package
-  nativeBuildInputs ? [ ],
-
-  # Run-time dependencies for the package
-  buildInputs ? [ ],
-
-  # Dependencies needed for running the checkPhase.
-  # These are added to buildInputs when doCheck = true.
-  checkInputs ? [ ],
-  nativeCheckInputs ? [ ],
-
-  # propagate build dependencies so in case we have A -> B -> C,
-  # C can import package A propagated by B
-  propagatedBuildInputs ? [ ],
-
-  # DEPRECATED: use propagatedBuildInputs
-  pythonPath ? [ ],
-
-  # Enabled to detect some (native)BuildInputs mistakes
-  strictDeps ? true,
-
-  outputs ? [ "out" ],
-
-  # used to disable derivation, useful for specific python versions
-  disabled ? false,
-
-  # Raise an error if two packages are installed with the same name
-  # TODO: For cross we probably need a different PYTHONPATH, or not
-  # add the runtime deps until after buildPhase.
-  catchConflicts ? (python.stdenv.hostPlatform == python.stdenv.buildPlatform),
-
-  # Additional arguments to pass to the makeWrapper function, which wraps
-  # generated binaries.
-  makeWrapperArgs ? [ ],
-
-  # Skip wrapping of python programs altogether
-  dontWrapPythonPrograms ? false,
-
-  # Don't use Pip to install a wheel
-  # Note this is actually a variable for the pipInstallPhase in pip's setupHook.
-  # It's included here to prevent an infinite recursion.
-  dontUsePipInstall ? false,
-
-  # Skip setting the PYTHONNOUSERSITE environment variable in wrapped programs
-  permitUserSite ? false,
-
-  # Remove bytecode from bin folder.
-  # When a Python script has the extension `.py`, bytecode is generated
-  # Typically, executables in bin have no extension, so no bytecode is generated.
-  # However, some packages do provide executables with extensions, and thus bytecode is generated.
-  removeBinBytecode ? true,
-
-  # Several package formats are supported.
-  # "setuptools" : Install a common setuptools/distutils based package. This builds a wheel.
-  # "wheel" : Install from a pre-compiled wheel.
-  # "pyproject": Install a package using a ``pyproject.toml`` file (PEP517). This builds a wheel.
-  # "egg": Install a package from an egg.
-  # "other" : Provide your own buildPhase and installPhase.
-  format ? "setuptools",
-
-  meta ? { },
-
-  passthru ? { },
-
-  doCheck ? true,
-
-  disabledTestPaths ? [ ],
-
-  ...
-}@attrs:
-
-let
-  withDistOutput = lib.elem format [
-    "pyproject"
-    "setuptools"
-    "wheel"
+  excludeDrvArgNames = [
+    "disabled"
+    "checkPhase"
+    "checkInputs"
+    "nativeCheckInputs"
+    "doCheck"
+    "doInstallCheck"
+    "dontWrapPythonPrograms"
+    "catchConflicts"
+    "format"
+    "disabledTestPaths"
   ];
 
-  name_ = name;
+  extendDrvArgs =
+    finalAttrs:
+    {
+      name ? "${attrs.pname}-${attrs.version}",
+
+      # Build-time dependencies for the package
+      nativeBuildInputs ? [ ],
+
+      # Run-time dependencies for the package
+      buildInputs ? [ ],
+
+      # Dependencies needed for running the checkPhase.
+      # These are added to buildInputs when doCheck = true.
+      checkInputs ? [ ],
+      nativeCheckInputs ? [ ],
+
+      # propagate build dependencies so in case we have A -> B -> C,
+      # C can import package A propagated by B
+      propagatedBuildInputs ? [ ],
+
+      # DEPRECATED: use propagatedBuildInputs
+      pythonPath ? [ ],
+
+      # Enabled to detect some (native)BuildInputs mistakes
+      strictDeps ? true,
+
+      outputs ? [ "out" ],
+
+      # used to disable derivation, useful for specific python versions
+      disabled ? false,
+
+      # Raise an error if two packages are installed with the same name
+      # TODO: For cross we probably need a different PYTHONPATH, or not
+      # add the runtime deps until after buildPhase.
+      catchConflicts ? (python.stdenv.hostPlatform == python.stdenv.buildPlatform),
+
+      # Additional arguments to pass to the makeWrapper function, which wraps
+      # generated binaries.
+      makeWrapperArgs ? [ ],
+
+      # Skip wrapping of python programs altogether
+      dontWrapPythonPrograms ? false,
+
+      # Don't use Pip to install a wheel
+      # Note this is actually a variable for the pipInstallPhase in pip's setupHook.
+      # It's included here to prevent an infinite recursion.
+      dontUsePipInstall ? false,
+
+      # Skip setting the PYTHONNOUSERSITE environment variable in wrapped programs
+      permitUserSite ? false,
+
+      # Remove bytecode from bin folder.
+      # When a Python script has the extension `.py`, bytecode is generated
+      # Typically, executables in bin have no extension, so no bytecode is generated.
+      # However, some packages do provide executables with extensions, and thus bytecode is generated.
+      removeBinBytecode ? true,
+
+      # Several package formats are supported.
+      # "setuptools" : Install a common setuptools/distutils based package. This builds a wheel.
+      # "wheel" : Install from a pre-compiled wheel.
+      # "pyproject": Install a package using a ``pyproject.toml`` file (PEP517). This builds a wheel.
+      # "egg": Install a package from an egg.
+      # "other" : Provide your own buildPhase and installPhase.
+      format ? "setuptools",
+
+      meta ? { },
+
+      passthru ? { },
+
+      doCheck ? true,
+
+      disabledTestPaths ? [ ],
+
+      ...
+    }@attrs:
 
-  validatePythonMatches =
-    attrName:
     let
-      isPythonModule =
-        drv:
-        # all pythonModules have the pythonModule attribute
-        (drv ? "pythonModule")
-        # Some pythonModules are turned in to a pythonApplication by setting the field to false
-        && (!builtins.isBool drv.pythonModule);
-      isMismatchedPython = drv: drv.pythonModule != python;
+      withDistOutput = lib.elem format [
+        "pyproject"
+        "setuptools"
+        "wheel"
+      ];
 
-      optionalLocation =
+      name_ = name;
+
+      validatePythonMatches =
+        attrName:
         let
-          pos = builtins.unsafeGetAttrPos (if attrs ? "pname" then "pname" else "name") attrs;
+          isPythonModule =
+            drv:
+            # all pythonModules have the pythonModule attribute
+            (drv ? "pythonModule")
+            # Some pythonModules are turned in to a pythonApplication by setting the field to false
+            && (!builtins.isBool drv.pythonModule);
+          isMismatchedPython = drv: drv.pythonModule != python;
+
+          optionalLocation =
+            let
+              pos = builtins.unsafeGetAttrPos (if attrs ? "pname" then "pname" else "name") attrs;
+            in
+            lib.optionalString (pos != null) " at ${pos.file}:${toString pos.line}:${toString pos.column}";
+
+          leftPadName =
+            name: against:
+            let
+              len = lib.max (lib.stringLength name) (lib.stringLength against);
+            in
+            lib.strings.fixedWidthString len " " name;
+
+          throwMismatch =
+            drv:
+            let
+              myName = "'${namePrefix}${name}'";
+              theirName = "'${drv.name}'";
+            in
+            throw ''
+              Python version mismatch in ${myName}:
+
+              The Python derivation ${myName} depends on a Python derivation
+              named ${theirName}, but the two derivations use different versions
+              of Python:
+
+                  ${leftPadName myName theirName} uses ${python}
+                  ${leftPadName theirName myName} uses ${toString drv.pythonModule}
+
+              Possible solutions:
+
+                * If ${theirName} is a Python library, change the reference to ${theirName}
+                  in the ${attrName} of ${myName} to use a ${theirName} built from the same
+                  version of Python
+
+                * If ${theirName} is used as a tool during the build, move the reference to
+                  ${theirName} in ${myName} from ${attrName} to nativeBuildInputs
+
+                * If ${theirName} provides executables that are called at run time, pass its
+                  bin path to makeWrapperArgs:
+
+                      makeWrapperArgs = [ "--prefix PATH : ''${lib.makeBinPath [ ${lib.getName drv} ] }" ];
+
+              ${optionalLocation}
+            '';
+
+          checkDrv = drv: if (isPythonModule drv) && (isMismatchedPython drv) then throwMismatch drv else drv;
+
         in
-        lib.optionalString (pos != null) " at ${pos.file}:${toString pos.line}:${toString pos.column}";
-
-      leftPadName =
-        name: against:
-        let
-          len = lib.max (lib.stringLength name) (lib.stringLength against);
-        in
-        lib.strings.fixedWidthString len " " name;
-
-      throwMismatch =
-        drv:
-        let
-          myName = "'${namePrefix}${name}'";
-          theirName = "'${drv.name}'";
-        in
-        throw ''
-          Python version mismatch in ${myName}:
-
-          The Python derivation ${myName} depends on a Python derivation
-          named ${theirName}, but the two derivations use different versions
-          of Python:
-
-              ${leftPadName myName theirName} uses ${python}
-              ${leftPadName theirName myName} uses ${toString drv.pythonModule}
-
-          Possible solutions:
-
-            * If ${theirName} is a Python library, change the reference to ${theirName}
-              in the ${attrName} of ${myName} to use a ${theirName} built from the same
-              version of Python
-
-            * If ${theirName} is used as a tool during the build, move the reference to
-              ${theirName} in ${myName} from ${attrName} to nativeBuildInputs
-
-            * If ${theirName} provides executables that are called at run time, pass its
-              bin path to makeWrapperArgs:
-
-                  makeWrapperArgs = [ "--prefix PATH : ''${lib.makeBinPath [ ${lib.getName drv} ] }" ];
-
-          ${optionalLocation}
-        '';
-
-      checkDrv = drv: if (isPythonModule drv) && (isMismatchedPython drv) then throwMismatch drv else drv;
+        inputs: map checkDrv inputs;
 
     in
-    inputs: map checkDrv inputs;
+    {
 
-  # Keep extra attributes from `attrs`, e.g., `patchPhase', etc.
-  self = toPythonModule (
-    stdenv.mkDerivation (
-      (removeAttrs attrs [
-        "disabled"
-        "checkPhase"
-        "checkInputs"
-        "nativeCheckInputs"
-        "doCheck"
-        "doInstallCheck"
-        "dontWrapPythonPrograms"
-        "catchConflicts"
-        "format"
-        "disabledTestPaths"
-        "outputs"
-      ])
-      // {
+      name = namePrefix + name_;
 
-        name = namePrefix + name_;
+      nativeBuildInputs = [
+        python
+        wrapPython
+        ensureNewerSourcesForZipFilesHook # move to wheel installer (pip) or builder (setuptools, ...)?
+        pythonRemoveTestsDirHook
+      ]
+      ++ lib.optionals catchConflicts [
+        pythonCatchConflictsHook
+      ]
+      ++ lib.optionals removeBinBytecode [
+        pythonRemoveBinBytecodeHook
+      ]
+      ++ lib.optionals (lib.hasSuffix "zip" (attrs.src.name or "")) [
+        unzip
+      ]
+      ++ lib.optionals (format == "setuptools") [
+        setuptoolsBuildHook
+      ]
+      ++ lib.optionals (format == "pyproject") [
+        pipBuildHook
+      ]
+      ++ lib.optionals (format == "wheel") [
+        wheelUnpackHook
+      ]
+      ++ lib.optionals (format == "egg") [
+        eggUnpackHook
+        eggBuildHook
+        eggInstallHook
+      ]
+      ++ lib.optionals (format != "other") [
+        pipInstallHook
+      ]
+      ++ lib.optionals (stdenv.buildPlatform == stdenv.hostPlatform) [
+        # This is a test, however, it should be ran independent of the checkPhase and checkInputs
+        pythonImportsCheckHook
+      ]
+      ++ lib.optionals withDistOutput [
+        pythonOutputDistHook
+      ]
+      ++ nativeBuildInputs;
 
-        nativeBuildInputs = [
+      buildInputs = validatePythonMatches "buildInputs" (buildInputs ++ pythonPath);
+
+      propagatedBuildInputs = validatePythonMatches "propagatedBuildInputs" (
+        propagatedBuildInputs
+        ++ [
+          # we propagate python even for packages transformed with 'toPythonApplication'
+          # this pollutes the PATH but avoids rebuilds
+          # see https://github.com/NixOS/nixpkgs/issues/170887 for more context
           python
-          wrapPython
-          ensureNewerSourcesForZipFilesHook # move to wheel installer (pip) or builder (setuptools, ...)?
-          pythonRemoveTestsDirHook
         ]
-        ++ lib.optionals catchConflicts [
-          pythonCatchConflictsHook
-        ]
-        ++ lib.optionals removeBinBytecode [
-          pythonRemoveBinBytecodeHook
-        ]
-        ++ lib.optionals (lib.hasSuffix "zip" (attrs.src.name or "")) [
-          unzip
-        ]
-        ++ lib.optionals (format == "setuptools") [
-          setuptoolsBuildHook
-        ]
-        ++ lib.optionals (format == "pyproject") [
-          pipBuildHook
-        ]
-        ++ lib.optionals (format == "wheel") [
-          wheelUnpackHook
-        ]
-        ++ lib.optionals (format == "egg") [
-          eggUnpackHook
-          eggBuildHook
-          eggInstallHook
-        ]
-        ++ lib.optionals (format != "other") [
-          pipInstallHook
-        ]
-        ++ lib.optionals (stdenv.buildPlatform == stdenv.hostPlatform) [
-          # This is a test, however, it should be ran independent of the checkPhase and checkInputs
-          pythonImportsCheckHook
-        ]
-        ++ lib.optionals withDistOutput [
-          pythonOutputDistHook
-        ]
-        ++ nativeBuildInputs;
+      );
 
-        buildInputs = validatePythonMatches "buildInputs" (buildInputs ++ pythonPath);
+      inherit strictDeps;
 
-        propagatedBuildInputs = validatePythonMatches "propagatedBuildInputs" (
-          propagatedBuildInputs
-          ++ [
-            # we propagate python even for packages transformed with 'toPythonApplication'
-            # this pollutes the PATH but avoids rebuilds
-            # see https://github.com/NixOS/nixpkgs/issues/170887 for more context
-            python
-          ]
-        );
-
-        inherit strictDeps;
-
-        env = {
-          LANG = "${if python.stdenv.hostPlatform.isDarwin then "en_US" else "C"}.UTF-8";
-        }
-        // (attrs.env or { });
-
-        # Python packages don't have a checkPhase, only an installCheckPhase
-        doCheck = false;
-        doInstallCheck = attrs.doCheck or true;
-        nativeInstallCheckInputs = nativeCheckInputs;
-        installCheckInputs = checkInputs;
-
-        postFixup =
-          lib.optionalString (!dontWrapPythonPrograms) ''
-            wrapPythonPrograms
-          ''
-          + attrs.postFixup or "";
-
-        # Python packages built through cross-compilation are always for the host platform.
-        disallowedReferences = lib.optionals (python.stdenv.hostPlatform != python.stdenv.buildPlatform) [
-          python.pythonOnBuildForHost
-        ];
-
-        outputs = outputs ++ lib.optional withDistOutput "dist";
-
-        meta = {
-          # default to python's platforms
-          platforms = python.meta.platforms;
-          isBuildPythonPackage = python.meta.platforms;
-        }
-        // meta;
+      env = {
+        LANG = "${if python.stdenv.hostPlatform.isDarwin then "en_US" else "C"}.UTF-8";
       }
-      // lib.optionalAttrs (attrs ? checkPhase) {
-        # If given use the specified checkPhase, otherwise use the setup hook.
-        # Longer-term we should get rid of `checkPhase` and use `installCheckPhase`.
-        installCheckPhase = attrs.checkPhase;
-      }
-      // lib.optionalAttrs (disabledTestPaths != [ ]) {
-        disabledTestPaths = lib.escapeShellArgs disabledTestPaths;
-      }
-    )
-  );
+      // (attrs.env or { });
 
-  passthru.updateScript =
+      # Python packages don't have a checkPhase, only an installCheckPhase
+      doCheck = false;
+      doInstallCheck = attrs.doCheck or true;
+      nativeInstallCheckInputs = nativeCheckInputs;
+      installCheckInputs = checkInputs;
+
+      postFixup =
+        lib.optionalString (!dontWrapPythonPrograms) ''
+          wrapPythonPrograms
+        ''
+        + attrs.postFixup or "";
+
+      # Python packages built through cross-compilation are always for the host platform.
+      disallowedReferences = lib.optionals (python.stdenv.hostPlatform != python.stdenv.buildPlatform) [
+        python.pythonOnBuildForHost
+      ];
+
+      outputs = outputs ++ lib.optional withDistOutput "dist";
+
+      passthru = {
+        inherit
+          disabled
+          ;
+        updateScript =
+          let
+            filename = builtins.head (lib.splitString ":" finalAttrs.finalPackage.meta.position);
+          in
+          [
+            update-python-libraries
+            filename
+          ];
+      }
+      // passthru;
+
+      meta = {
+        # default to python's platforms
+        platforms = python.meta.platforms;
+        isBuildPythonPackage = python.meta.platforms;
+      }
+      // meta;
+    }
+    // lib.optionalAttrs (attrs ? checkPhase) {
+      # If given use the specified checkPhase, otherwise use the setup hook.
+      # Longer-term we should get rid of `checkPhase` and use `installCheckPhase`.
+      installCheckPhase = attrs.checkPhase;
+    }
+    // lib.optionalAttrs (disabledTestPaths != [ ]) {
+      disabledTestPaths = lib.escapeShellArgs disabledTestPaths;
+    };
+
+  transformDrv =
     let
-      filename = builtins.head (lib.splitString ":" self.meta.position);
+      # Workaround to make the `lib.extendDerivation`-based disabled functionality
+      # respect `<pkg>.overrideAttrs`
+      # It doesn't cover `<pkg>.<output>.overrideAttrs`.
+      disablePythonPackage =
+        drv:
+        lib.extendDerivation (
+          drv.disabled
+          -> throw "${lib.removePrefix namePrefix drv.name} not supported for interpreter ${python.executable}"
+        ) { } drv
+        // {
+          overrideAttrs = fdrv: disablePythonPackage (drv.overrideAttrs fdrv);
+        };
     in
-    attrs.passthru.updateScript or [
-      update-python-libraries
-      filename
-    ];
-in
-lib.extendDerivation (
-  disabled -> throw "${name} not supported for interpreter ${python.executable}"
-) passthru self
+    drv: disablePythonPackage (toPythonModule drv);
+}

pkgs/development/ocaml-modules/bos/default.nix

@@ -15,11 +15,16 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ocaml${ocaml.version}-bos";
-  version = "0.2.1";
+  version = if lib.versionAtLeast ocaml.version "4.14" then "0.3.0" else "0.2.1";
 
   src = fetchurl {
     url = "https://erratique.ch/software/bos/releases/bos-${finalAttrs.version}.tbz";
-    sha256 = "sha256-2NYueGsQ1pfgRXIFqO7eqifrzJDxhV8Y3xkMrC49jzc=";
+    hash =
+      {
+        "0.3.0" = "sha256-CJ82ntAJZ+kticxfzYSMVr2rXAJzfaTUg1UL9Wtaebw=";
+        "0.2.1" = "sha256-2NYueGsQ1pfgRXIFqO7eqifrzJDxhV8Y3xkMrC49jzc=";
+      }
+      ."${finalAttrs.version}";
   };
 
   nativeBuildInputs = [

pkgs/development/ocaml-modules/digestif/default.nix

@@ -5,19 +5,13 @@
   buildDunePackage,
   eqaf,
   alcotest,
-  astring,
-  bos,
   crowbar,
-  findlib,
-  fpath,
 }:
 
 buildDunePackage (finalAttrs: {
   pname = "digestif";
   version = "1.3.0";
 
-  minimalOCamlVersion = "4.08";
-
   src = fetchurl {
     url = "https://github.com/mirage/digestif/releases/download/v${finalAttrs.version}/digestif-${finalAttrs.version}.tbz";
     hash = "sha256-mmzcszJTnIf0cj/DvXNiayZ1p7EWH98P7TCRhs4Y9Cc=";
@@ -27,17 +21,10 @@ buildDunePackage (finalAttrs: {
 
   checkInputs = [
     alcotest
-    astring
-    bos
     crowbar
-    fpath
   ];
   doCheck = true;
 
-  postCheck = ''
-    ocaml -I ${findlib}/lib/ocaml/${ocaml.version}/site-lib/ test/test_runes.ml
-  '';
-
   meta = {
     description = "Simple hash algorithms in OCaml";
     homepage = "https://github.com/mirage/digestif";

pkgs/development/ocaml-modules/httpcats/default.nix

@@ -1,4 +1,5 @@
 {
+  fetchpatch,
   fetchFromGitHub,
   buildDunePackage,
   lib,
@@ -28,6 +29,13 @@ buildDunePackage (finalAttrs: {
     hash = "sha256-I7u/n49WOnpc0EaagsjC4Ts/kz0Xj6YHZv6+QZKLrC4=";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/robur-coop/httpcats/commit/d8787555d4831e0488780d42bd2c65de662d1d38.patch";
+      hash = "sha256-Mqam6Sxd2kkkHDm459u9uerifuHbvZUVy2khQffvvCE=";
+    })
+  ];
+
   propagatedBuildInputs = [
     h2
     h1

pkgs/development/ocaml-modules/lwt/default.nix

@@ -7,7 +7,7 @@
   dune-configurator,
   ocplib-endian,
   ppxlib,
-  version ? if lib.versionAtLeast ppxlib.version "0.36" then "6.1.1" else "5.9.1",
+  version ? if lib.versionAtLeast ppxlib.version "0.36" then "6.1.2" else "5.9.1",
 }:
 
 buildDunePackage {
@@ -22,7 +22,7 @@ buildDunePackage {
       {
         "5.9.1" = "sha256-oPYLFugMTI3a+hmnwgUcoMgn5l88NP1Roq0agLhH/vI=";
         "5.9.2" = "sha256-pzowRN1wwaF2iMfMPE7RCtA2XjlaXC3xD0yznriVfu8=";
-        "6.1.1" = "sha256-EMlA+mh66bfVNqDcmuaW7GoEEu6xQhCRjZx7t7pHuGo=";
+        "6.1.2" = "sha256-9Uxo1ekB3VcvdR4FCVdVWzvPHuVwflYIdD/fWvg0/kc=";
       }
       ."${version}";
   };

pkgs/development/perl-modules/Plack-xsendfile-disable-by-default-CVE-2026-7381.patch

@@ -0,0 +1,31 @@
+diff --git a/lib/Plack/Middleware/XSendfile.pm b/lib/Plack/Middleware/XSendfile.pm
+index f2cd859..f96ccb5 100644
+--- a/lib/Plack/Middleware/XSendfile.pm
++++ b/lib/Plack/Middleware/XSendfile.pm
+@@ -10,7 +10,11 @@ use Plack::Util::Accessor qw( variation );
+ 
+ sub new {
+     my $class = shift;
+-    Carp::carp("Plack::Middleware::XSendfile is deprecated and will be removed in a future release");
++    unless (($ENV{PLACK_ENABLE_INSECURE_XSENDFILE} // '') eq '1') {
++        Carp::croak(
++          "CVE-2026-7381: Plack::Middleware::XSendfile is disabled by default. Set PLACK_ENABLE_INSECURE_XSENDFILE=1 to enable"
++        );
++    }
+     $class->SUPER::new(@_);
+ }
+ 
+diff --git a/t/Plack-Middleware/xsendfile.t b/t/Plack-Middleware/xsendfile.t
+index f1a02fa..248815e 100644
+--- a/t/Plack-Middleware/xsendfile.t
++++ b/t/Plack-Middleware/xsendfile.t
+@@ -6,6 +6,9 @@ use Plack::Builder;
+ use Plack::Test;
+ use Cwd;
+ 
++# CVE-2026-7381: Insecure feature disabled by default, but enable for tests
++$ENV{PLACK_ENABLE_INSECURE_XSENDFILE} = 1;
++
+ sub is_wo_case($$;$) {
+     is lc $_[0], lc $_[1], $_[2];
+ }

pkgs/development/python-modules/aioshelly/default.nix

@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "aioshelly";
-  version = "13.23.1";
+  version = "13.24.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "home-assistant-libs";
     repo = "aioshelly";
     tag = version;
-    hash = "sha256-vAYhOBfwDKWO0K4pHVf3qqpXTztb5Qzn8TEzk6ecbw0=";
+    hash = "sha256-yb6oZlrB3MBafKoga9vRrcixXlZeknVRsMztX4hV3PA=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/allure-python-commons-test/default.nix

@@ -12,13 +12,13 @@
 
 buildPythonPackage rec {
   pname = "allure-python-commons-test";
-  version = "2.15.3";
+  version = "2.16.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "allure_python_commons_test";
     inherit version;
-    hash = "sha256-eRjjsxiXm/7nMyaJS5pXhpNmrjOhnd1o7+F9ZwGzI/I=";
+    hash = "sha256-otfGxWNnbMUGuQcqsroOOfiqhCQqe25c39Ur57ek2og=";
   };
 
   build-system = [ setuptools-scm ];

pkgs/development/python-modules/apprise/default.nix

@@ -23,12 +23,12 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "apprise";
-  version = "1.9.9";
+  version = "1.10.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-/WIsDfFr3HntOFU5c1VzSIyv4kBdJXR+h+69awmyYBI=";
+    hash = "sha256-t2jzLZnkXtX0w+7x9nkD6APJf5e6YaUxpdCkXUDfkKg=";
   };
 
   postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''

pkgs/development/python-modules/bdffont/default.nix

@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "bdffont";
-  version = "0.0.35";
+  version = "0.0.36";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TakWolf";
     repo = "bdffont";
     tag = finalAttrs.version;
-    hash = "sha256-a93l7iX2/Htigs36zCv1x8SAGzycGU2y/stN0j794fw=";
+    hash = "sha256-PCx1uMjCa5d8odDGRi4BRaf1E1AP0oZUv0QYr24E6Yo=";
   };
 
   build-system = [ uv-build ];

pkgs/development/python-modules/cobble/default.nix

@@ -40,7 +40,7 @@ buildPythonPackage rec {
     "test_sub_sub_classes_are_included_in_abc"
   ];
 
-  passthru.updateScripts = gitUpdater { };
+  passthru.updateScript = gitUpdater { };
 
   meta = {
     description = "Create Python data objects";

pkgs/development/python-modules/cssutils/default.nix

@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "cssutils";
-  version = "2.14.0";
+  version = "2.15.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jaraco";
     repo = "cssutils";
     tag = "v${version}";
-    hash = "sha256-kuqHfwJn+GT1VIC2PWu5Oj1X6SGn/bi2QPN8kfposVs=";
+    hash = "sha256-K9jbuX7AueSB3AB7PAVjpQhzb3Umn9OoHaL4RrMzKEs=";
   };
 
   postPatch = ''
@@ -54,7 +54,7 @@ buildPythonPackage rec {
   meta = {
     description = "CSS Cascading Style Sheets library for Python";
     homepage = "https://github.com/jaraco/cssutils";
-    changelog = "https://github.com/jaraco/cssutils/blob/${src.rev}/NEWS.rst";
+    changelog = "https://github.com/jaraco/cssutils/blob/${src.tag}/NEWS.rst";
     license = lib.licenses.lgpl3Plus;
     maintainers = with lib.maintainers; [ dotlambda ];
   };

pkgs/development/python-modules/curio/default.nix

@@ -53,7 +53,7 @@ buildPythonPackage rec {
   meta = {
     description = "Library for performing concurrent I/O with coroutines in Python";
     homepage = "https://github.com/dabeaz/curio";
-    changelog = "https://github.com/dabeaz/curio/raw/${version}/CHANGES";
+    changelog = "https://github.com/dabeaz/curio/raw/${src.rev}/CHANGES";
     license = lib.licenses.bsd3;
     maintainers = [ lib.maintainers.pbsds ];
   };

pkgs/development/python-modules/datashader/default.nix

@@ -71,7 +71,7 @@ buildPythonPackage rec {
     description = "Data visualization toolchain based on aggregating into a grid";
     mainProgram = "datashader";
     homepage = "https://datashader.org";
-    changelog = "https://github.com/holoviz/datashader/blob/${src.tag}/CHANGELOG.rst";
+    changelog = "https://github.com/holoviz/datashader/blob/${src.tag}/CHANGELOG.md";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [
       nickcao

pkgs/development/python-modules/fastmcp/default.nix

@@ -12,23 +12,32 @@
   # dependencies
   anthropic,
   authlib,
+  azure-identity,
   cyclopts,
   exceptiongroup,
   httpx,
   jsonref,
   jsonschema-path,
   mcp,
+  fakeredis,
+  google-genai,
   openai,
   openapi-pydantic,
+  opentelemetry-api,
   packaging,
   platformdirs,
   py-key-value-aio,
   pydantic,
+  pydantic-monty,
   pydocket,
+  pyjwt,
   pyperclip,
   python-dotenv,
+  pyyaml,
   rich,
+  uncalled-for,
   uvicorn,
+  watchfiles,
   websockets,
 
   # tests
@@ -37,6 +46,7 @@
   fastapi,
   inline-snapshot,
   lupa,
+  opentelemetry-sdk,
   psutil,
   pytest-asyncio,
   pytest-httpx,
@@ -45,14 +55,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "fastmcp";
-  version = "2.14.5";
+  version = "3.2.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jlowin";
     repo = "fastmcp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-j3aUvAKm0rW5X/l1VXoSBc5fCjSLxnyznwzj1D3E7Ck=";
+    hash = "sha256-YfFAJvfKLOgfGFWyQmR4FGHrRc066Y0mAYhXJqJ9vyw=";
   };
 
   build-system = [
@@ -61,6 +71,7 @@ buildPythonPackage (finalAttrs: {
   ];
 
   pythonRelaxDeps = [
+    "py-key-value-aio"
     "pydocket"
   ];
   dependencies = [
@@ -72,25 +83,39 @@ buildPythonPackage (finalAttrs: {
     jsonschema-path
     mcp
     openapi-pydantic
+    opentelemetry-api
     packaging
     platformdirs
     py-key-value-aio
     pydantic
-    pydocket
     pyperclip
     python-dotenv
+    pyyaml
     rich
+    uncalled-for
     uvicorn
+    watchfiles
     websockets
   ]
-  ++ py-key-value-aio.optional-dependencies.disk
+  ++ py-key-value-aio.optional-dependencies.filetree
   ++ py-key-value-aio.optional-dependencies.keyring
   ++ py-key-value-aio.optional-dependencies.memory
   ++ pydantic.optional-dependencies.email;
 
   optional-dependencies = {
     anthropic = [ anthropic ];
+    azure = [
+      azure-identity
+      pyjwt
+    ];
+    code-mode = [ pydantic-monty ];
+    gemini = [ google-genai ];
     openai = [ openai ];
+    tasks = [
+      pydocket
+      fakeredis
+    ]
+    ++ fakeredis.optional-dependencies.lua;
   };
 
   pythonImportsCheck = [ "fastmcp" ];
@@ -101,31 +126,21 @@ buildPythonPackage (finalAttrs: {
     fastapi
     inline-snapshot
     lupa
+    opentelemetry-sdk
     psutil
     pytest-asyncio
     pytest-httpx
     pytestCheckHook
     writableTmpDirAsHomeHook
   ]
-  ++ lib.concatAttrValues finalAttrs.passthru.optional-dependencies
+  ++ finalAttrs.passthru.optional-dependencies.anthropic
+  ++ finalAttrs.passthru.optional-dependencies.azure
+  ++ finalAttrs.passthru.optional-dependencies.code-mode
+  ++ finalAttrs.passthru.optional-dependencies.gemini
+  ++ finalAttrs.passthru.optional-dependencies.openai
   ++ inline-snapshot.optional-dependencies.dirty-equals;
 
   disabledTests = [
-    # redis.exceptions.ResponseError: unknown command `evalsha`, with args beginning with:
-    "test_get_prompt_as_task_returns_prompt_task"
-    "test_prompt_task_server_generated_id"
-
-    "test_logging_middleware_with_payloads"
-    "test_structured_logging_middleware_produces_json"
-
-    # AssertionError: assert 'INFO' == 'DEBUG'
-    "test_temporary_settings"
-
-    # mcp.shared.exceptions.McpError: Connection closed
-    "test_log_file_captures_stderr_output_with_path"
-    "test_log_file_captures_stderr_output_with_textio"
-    "test_log_file_none_uses_default_behavior"
-
     # RuntimeError: Client failed to connect: Connection closed
     "test_keep_alive_maintains_session_across_multiple_calls"
     "test_keep_alive_false_starts_new_session_across_multiple_calls"
@@ -148,32 +163,55 @@ buildPythonPackage (finalAttrs: {
     "test_timeout"
     "test_timeout_tool_call_overrides_client_timeout_even_if_lower"
 
-    # assert 0 == 2
+    # Requires prefab-ui (optional dependency)
+    "test_auto_registers_renderer_resource"
+    "test_equivalent_to_app_true"
+
+    # Requires pydocket (tasks optional dependency, not in test inputs)
+    "test_mounted_server_does_not_have_docket"
+    "test_get_tasks_returns_task_eligible_tools"
+    "test_task_teardown_does_not_hang"
+    "test_background_task_can_read_snapshotted_request_headers"
+    "test_background_task_current_http_dependencies_restore_headers"
+    "test_task_execution_auto_populated_for_task_enabled_tool"
+    "test_function_tool_task_config_still_works"
+    "test_async_partial_with_task_true_does_not_raise"
+    "test_sync_partial_with_task_true_raises"
+    "test_is_docket_available"
+    "test_require_docket_passes_when_installed"
+
+    # Shared dependency caching differs in sandbox
+    "TestSharedDependencies"
+
+    # AssertionError: assert 'INFO' == 'DEBUG'
+    "test_temporary_settings"
+
+    # Subprocess-based multi-client tests fail in sandbox
     "test_multi_client"
+    "test_multi_server"
+    "test_single_server_config_include_tags_filtering"
+    "test_server_starts_without_auth"
     "test_canonical_multi_client_with_transforms"
-
-    # AssertionError: assert {'annotations...object'}, ...} == {'annotations...sers']}}, ...}
-    "test_list_tools"
-
-    # AssertionError: assert len(caplog.records) == 1
-    "test_log"
-
-    #  assert [TextContent(...e, meta=None)] == [TextContent(...e, meta=None)]
-    "test_read_resource_tool_works"
-
-    # fastmcp.exceptions.ToolError: Unknown tool
-    "test_multi_client_with_logging"
-    "test_multi_client_with_elicitation"
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     # RuntimeError: Server failed to start after 10 attempts
     "test_unauthorized_access"
-
-    # Failed: DID NOT RAISE <class 'fastmcp.exceptions.ToolError'>
     "test_stateless_proxy"
   ];
 
-  disabledTestPaths = lib.optionals stdenv.hostPlatform.isDarwin [
+  disabledTestPaths = [
+    # Requires prefab-ui (optional dependency)
+    "tests/apps"
+    "tests/test_apps_prefab.py"
+    "tests/test_fastmcp_app.py"
+    # Subprocess crash recovery tests are flaky in sandbox
+    "tests/client/test_stdio.py"
+    # Requires pydocket/fakeredis (tasks optional dependency, not in test inputs)
+    "tests/server/tasks"
+    "tests/server/test_server_docket.py"
+    "tests/client/tasks"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
     # RuntimeError: Server failed to start after 10 attempts
     "tests/client/auth/test_oauth_client.py"
     "tests/client/test_sse.py"

pkgs/development/python-modules/fastremap/default.nix

@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "fastremap";
-  version = "1.18.1";
+  version = "1.19.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "seung-lab";
     repo = "fastremap";
     tag = version;
-    hash = "sha256-nVnOdxDSVM7Qe/peALgV035OknOUm0B1dzpTIq3HEMs=";
+    hash = "sha256-fPDgCpCJrMomxr0dicM9NBqzH4s+/Ux37hTsnsGts2g=";
   };
 
   build-system = [

pkgs/development/python-modules/funk/default.nix

@@ -28,7 +28,7 @@ buildPythonPackage rec {
   # Disabling tests, they rely on Nose which is outdated and not supported
   doCheck = false;
 
-  passthru.updateScripts = gitUpdater { };
+  passthru.updateScript = gitUpdater { };
 
   meta = {
     description = "Mocking framework for Python, influenced by JMock";

pkgs/development/python-modules/google-cloud-asset/default.nix

@@ -83,7 +83,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Python Client for Google Cloud Asset API";
     homepage = "https://github.com/googleapis/google-cloud-python/tree/main/packages/google-cloud-asset";
-    changelog = "https://github.com/googleapis/google-cloud-python/blob/google-cloud-asset-${finalAttrs.src.tag}/packages/google-cloud-asset/CHANGELOG.md";
+    changelog = "https://github.com/googleapis/google-cloud-python/blob/${finalAttrs.src.tag}/packages/google-cloud-asset/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = [ lib.maintainers.sarahec ];
   };