Merge branch 'master' into current

This is required for alignment with the tensorflow protobuf version, else
this crashes the interpreter.

nixos/modules/services/networking/hostapd.nix

@@ -1334,26 +1334,21 @@ in
         # we check if wirelessInterfaces is empty as that means all interfaces implicit
         shouldWarn = wirelessEnabled && (wirelessInterfaces == [ ] || hasInterfaceConflict);
       in
-      if shouldWarn then
-        [
-          ''
-            Some wireless interface is configured for both for client and access point mode:
-            this is not allowed. Either specify `networking.wireless.interfaces` and exclude
-            those from `services.hostapd.radios` or make sure to not run the `wpa_supplicant`
-            and `hostapd` services simultaneously.
-          ''
-        ]
-      else
-        [ ];
+      lib.optional shouldWarn ''
+        Some wireless interface is configured for both for client and access point mode:
+        this is not allowed. Either specify `networking.wireless.interfaces` and exclude
+        those from `services.hostapd.radios` or make sure to not run the `wpa_supplicant`
+        and `hostapd` services simultaneously.
+      ''
+      ++ lib.optional config.networking.wireless.iwd.enable ''
+        hostapd and iwd do conflict,
+        use `networking.wireless.enable` in combination with `networking.wireless.interfaces` to avoid it.
+      '';
     assertions = [
       {
         assertion = cfg.radios != { };
         message = "At least one radio must be configured with hostapd!";
       }
-      {
-        assertion = !config.networking.wireless.iwd.enable;
-        message = "hostapd and iwd conflict, use `networking.wireless.enable` in combination with `networking.wireless.interfaces`";
-      }
     ]
     # Radio warnings
     ++ (concatLists (

pkgs/by-name/fr/frigate/package.nix

@@ -10,6 +10,7 @@
   frigate,
   nixosTests,
   fetchpatch,
+  protobuf_21,
 }:
 
 let
@@ -38,6 +39,11 @@ let
           hash = "sha256-95xtUzzIxxvDtpHX/5uCHnTQTB8Fc08DZGUOR/SdKLs=";
         };
       });
+      onnxruntime = super.onnxruntime.override (old: {
+        onnxruntime = old.onnxruntime.override (old: {
+          protobuf = protobuf_21;
+        });
+      });
     };
   };
   python3Packages = python.pkgs;

pkgs/by-name/ke/keyguard/package.nix

@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "keyguard";
-  version = "1.14.1";
+  version = "1.15.0";
 
   src = fetchFromGitHub {
     owner = "AChep";
     repo = "keyguard-app";
-    tag = "r20250830";
-    hash = "sha256-m52oXJ+6tfTP8KE0+g5D67B7C0HVJRg65GWp7Vx2OQc=";
+    tag = "r20250915";
+    hash = "sha256-WAD8cZkaZbv3tyzKYEBH25g7x7xmdIWAnvMxnNKYpME=";
   };
 
   postPatch = ''

pkgs/by-name/la/laszip_2/package.nix

@@ -16,13 +16,19 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-TXzse4oLjNX5R2xDR721iV+gW/rP5z3Zciv4OgxfeqA=";
   };
 
+  # fix build with cmake v4
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail 'cmake_minimum_required(VERSION 2.6.0)' 'cmake_minimum_required(VERSION 3.10)'
+  '';
+
   nativeBuildInputs = [ cmake ];
 
-  meta = with lib; {
+  meta = {
     description = "Turn quickly bulky LAS files into compact LAZ files without information loss";
     homepage = "https://laszip.org";
-    license = licenses.lgpl2;
-    maintainers = [ maintainers.michelk ];
-    platforms = platforms.unix;
+    license = lib.licenses.lgpl2;
+    maintainers = with lib.maintainers; [ michelk ];
+    platforms = lib.platforms.unix;
   };
 })

pkgs/by-name/ne/newsboat/package.nix

@@ -19,16 +19,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "newsboat";
-  version = "2.40";
+  version = "2.41";
 
   src = fetchFromGitHub {
     owner = "newsboat";
     repo = "newsboat";
-    rev = "r${finalAttrs.version}";
-    hash = "sha256-BxZq+y2MIIKAaXi7Z2P8JqTfHtX2BBY/ShUhGk7Cf/8=";
+    tag = "r${finalAttrs.version}";
+    hash = "sha256-LhEhbK66OYwAD/pel81N7Hgh/xEvnFR8GlZzgqZIe5M=";
   };
 
-  cargoHash = "sha256-lIK7F52pxMMhrImtO+bAR/iGOvuhhe/g+oWn6iNA1mY=";
+  cargoHash = "sha256-CyhyzNw2LXwIVf/SX2rQRvEex5LmjZfZKgCe88jthz0=";
 
   # TODO: Check if that's still needed
   postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
@@ -101,7 +101,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   meta = {
     homepage = "https://newsboat.org/";
-    changelog = "https://github.com/newsboat/newsboat/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    changelog = "https://github.com/newsboat/newsboat/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     description = "Fork of Newsbeuter, an RSS/Atom feed reader for the text console";
     maintainers = with lib.maintainers; [
       dotlambda

pkgs/by-name/st/stash/package.nix

@@ -21,117 +21,125 @@ let
     ;
 
   pname = "stash";
+in
+buildGoModule (
+  finalAttrs:
+  let
+    frontend = stdenv.mkDerivation (final: {
+      pname = "${finalAttrs.pname}-ui";
+      inherit (finalAttrs) version gitHash;
+      src = "${finalAttrs.src}/ui/v2.5";
 
-  src = fetchFromGitHub {
-    owner = "stashapp";
-    repo = "stash";
-    tag = "v${version}";
-    hash = srcHash;
-  };
+      yarnOfflineCache = fetchYarnDeps {
+        yarnLock = "${final.src}/yarn.lock";
+        hash = finalAttrs.yarnHash;
+      };
 
-  frontend = stdenv.mkDerivation (final: {
-    inherit version;
-    pname = "${pname}-ui";
-    src = "${src}/ui/v2.5";
+      nativeBuildInputs = [
+        yarnConfigHook
+        yarnBuildHook
+        # Needed for executing package.json scripts
+        nodejs
+      ];
 
-    yarnOfflineCache = fetchYarnDeps {
-      yarnLock = "${final.src}/yarn.lock";
-      hash = yarnHash;
+      postPatch = ''
+        substituteInPlace codegen.ts \
+          --replace-fail "../../graphql/" "${finalAttrs.src}/graphql/"
+      '';
+
+      buildPhase = ''
+        runHook preBuild
+
+        export HOME=$(mktemp -d)
+        export VITE_APP_DATE='1970-01-01 00:00:00'
+        export VITE_APP_GITHASH=${finalAttrs.gitHash}
+        export VITE_APP_STASH_VERSION=v${finalAttrs.version}
+        export VITE_APP_NOLEGACY=true
+
+        yarn --offline run gqlgen
+        yarn --offline build
+
+        mv build $out
+
+        runHook postBuild
+      '';
+
+      dontInstall = true;
+      dontFixup = true;
+    });
+  in
+  {
+    inherit
+      pname
+      version
+      gitHash
+      yarnHash
+      vendorHash
+      ;
+
+    src = fetchFromGitHub {
+      owner = "stashapp";
+      repo = "stash";
+      tag = "v${finalAttrs.version}";
+      hash = srcHash;
     };
 
-    nativeBuildInputs = [
-      yarnConfigHook
-      yarnBuildHook
-      # Needed for executing package.json scripts
-      nodejs
+    ldflags = [
+      "-s"
+      "-w"
+      "-X 'github.com/stashapp/stash/internal/build.buildstamp=1970-01-01 00:00:00'"
+      "-X 'github.com/stashapp/stash/internal/build.githash=${finalAttrs.gitHash}'"
+      "-X 'github.com/stashapp/stash/internal/build.version=v${finalAttrs.version}'"
+      "-X 'github.com/stashapp/stash/internal/build.officialBuild=false'"
     ];
+    tags = [
+      "sqlite_stat4"
+      "sqlite_math_functions"
+    ];
+
+    subPackages = [ "cmd/stash" ];
 
     postPatch = ''
-      substituteInPlace codegen.ts \
-        --replace-fail "../../graphql/" "${src}/graphql/"
+      cp -a ${frontend} ui/v2.5/build
     '';
 
-    buildPhase = ''
-      runHook preBuild
-
-      export HOME=$(mktemp -d)
-      export VITE_APP_DATE='1970-01-01 00:00:00'
-      export VITE_APP_GITHASH=${gitHash}
-      export VITE_APP_STASH_VERSION=v${version}
-      export VITE_APP_NOLEGACY=true
-
-      yarn --offline run gqlgen
-      yarn --offline build
-
-      mv build $out
-
-      runHook postBuild
+    preBuild = ''
+      # `go mod tidy` requires internet access and does nothing
+      echo "skip_mod_tidy: true" >> gqlgen.yml
+      # remove `-trimpath` fron `GOFLAGS` because `gqlgen` does not work with it
+      GOFLAGS="''${GOFLAGS/-trimpath/}" go generate ./cmd/stash
     '';
 
-    dontInstall = true;
-    dontFixup = true;
-  });
-in
-buildGoModule {
-  inherit
-    pname
-    src
-    version
-    vendorHash
-    ;
+    strictDeps = true;
 
-  ldflags = [
-    "-s"
-    "-w"
-    "-X 'github.com/stashapp/stash/internal/build.buildstamp=1970-01-01 00:00:00'"
-    "-X 'github.com/stashapp/stash/internal/build.githash=${gitHash}'"
-    "-X 'github.com/stashapp/stash/internal/build.version=v${version}'"
-    "-X 'github.com/stashapp/stash/internal/build.officialBuild=false'"
-  ];
-  tags = [
-    "sqlite_stat4"
-    "sqlite_math_functions"
-  ];
-
-  subPackages = [ "cmd/stash" ];
-
-  preBuild = ''
-    cp -a ${frontend} ui/v2.5/build
-    # `go mod tidy` requires internet access and does nothing
-    echo "skip_mod_tidy: true" >> gqlgen.yml
-    # remove `-trimpath` fron `GOFLAGS` because `gqlgen` does not work with it
-    GOFLAGS="''${GOFLAGS/-trimpath/}" go generate ./cmd/stash
-  '';
-
-  strictDeps = true;
-
-  passthru = {
-    inherit frontend;
-    updateScript = ./update.py;
-    tests = {
-      inherit (nixosTests) stash;
-      version = testers.testVersion {
-        package = stash;
-        version = "v${version} (${gitHash}) - Unofficial Build - 1970-01-01 00:00:00";
+    passthru = {
+      inherit frontend;
+      updateScript = ./update.py;
+      tests = {
+        inherit (nixosTests) stash;
+        version = testers.testVersion {
+          package = stash;
+          version = "v${finalAttrs.version} (${finalAttrs.gitHash}) - Unofficial Build - 1970-01-01 00:00:00";
+        };
       };
     };
-  };
 
-  meta = {
-    mainProgram = "stash";
-    description = "Organizer for your adult videos/images";
-    license = lib.licenses.agpl3Only;
-    homepage = "https://stashapp.cc/";
-    changelog = "https://github.com/stashapp/stash/blob/v${version}/ui/v2.5/src/docs/en/Changelog/v${lib.versions.major version}${lib.versions.minor version}0.md";
-    maintainers = with lib.maintainers; [
-      Golo300
-      DrakeTDL
-    ];
-    platforms = [
-      "x86_64-linux"
-      "aarch64-linux"
-      "x86_64-darwin"
-      "aarch64-darwin"
-    ];
-  };
-}
+    meta = {
+      mainProgram = "stash";
+      description = "Organizer for your adult videos/images";
+      license = lib.licenses.agpl3Only;
+      homepage = "https://stashapp.cc/";
+      changelog = "https://github.com/stashapp/stash/blob/v${finalAttrs.version}/ui/v2.5/src/docs/en/Changelog/v${lib.versions.major finalAttrs.version}${lib.versions.minor finalAttrs.version}0.md";
+      maintainers = with lib.maintainers; [
+        Golo300
+        DrakeTDL
+      ];
+      platforms = [
+        "x86_64-linux"
+        "aarch64-linux"
+        "x86_64-darwin"
+        "aarch64-darwin"
+      ];
+    };
+  }
+)

pkgs/development/python-modules/avwx-engine/default.nix

@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "avwx-engine";
-  version = "1.9.4";
+  version = "1.9.5";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "avwx-rest";
     repo = "avwx-engine";
     tag = version;
-    hash = "sha256-x8qb9nAAl7F+w0lHHQtLYwMZYdZ9WhAxJ63jdjlyfhQ=";
+    hash = "sha256-zhXUzePbgwmBIP7yMT/FcPYdSZC3qJtwEwkHtlfmv3Q=";
   };
 
   build-system = [ hatchling ];

pkgs/development/python-modules/boto3-stubs/default.nix

@@ -359,7 +359,7 @@
 
 buildPythonPackage rec {
   pname = "boto3-stubs";
-  version = "1.40.36";
+  version = "1.40.37";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -367,7 +367,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit version;
-    hash = "sha256-nYxTZw4Yd8FrvBoa8QcHxBvNLURtKfIV/Z7esfm7+uo=";
+    hash = "sha256-+fjxqvisDPM/59RhG3aZ8Xm63+KwBm1ZrpKPv4SwsrE=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/ghapi/default.nix

@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "ghapi";
-  version = "1.0.7";
+  version = "1.0.8";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "fastai";
     repo = "ghapi";
     tag = version;
-    hash = "sha256-hkaXvCzuZKRCuhCga5qcy8TedTJYytJEA6mzlOc72Hk=";
+    hash = "sha256-ZfOo5Icusj8Fm5i/HWGjjXtNWEB1wgYNzqeLeWbBJ/4=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/llama-cloud/default.nix

@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "llama-cloud";
-  version = "0.1.40";
+  version = "0.1.42";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_cloud";
     inherit version;
-    hash = "sha256-zc5Dyi5AZSXytpTHUbGP7D23PvKx7lLDuuHVUyputpY=";
+    hash = "sha256-SFqg42TqZI46qjssVK97y28iQsULT4bsAi4TdBP/9GQ=";
   };
 
   build-system = [ poetry-core ];

pkgs/development/python-modules/model-checker/default.nix

@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "model-checker";
-  version = "1.2.3";
+  version = "1.2.4";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "model_checker";
     inherit version;
-    hash = "sha256-LB5Smv8m+lWOV+cA7MvRfG8dI9fJgOCK9Rn2GgRYjtQ=";
+    hash = "sha256-afJDpHVQv/pUqlPBT0ucQz2AjrhmVbNlrbVpiXT2w/Y=";
   };
 
   # z3 does not provide a dist-info, so python-runtime-deps-check will fail

pkgs/development/python-modules/mypy-boto3/default.nix

@@ -210,8 +210,8 @@ rec {
       "sha256-HQWGDqUurjpbCTJJ+GDZn/UvVz421D3Ls7EHemTa8uY=";
 
   mypy-boto3-cleanrooms =
-    buildMypyBoto3Package "cleanrooms" "1.40.24"
-      "sha256-iB5nKmHx1fGzMH8oLpeZ+D9GdZchstOUqZW94Xl/SJ4=";
+    buildMypyBoto3Package "cleanrooms" "1.40.37"
+      "sha256-Uam/iXnOhYGUwZVRpyv61asq1dJkKO2Hoce3sIMm3Zo=";
 
   mypy-boto3-cloud9 =
     buildMypyBoto3Package "cloud9" "1.40.20"
@@ -446,8 +446,8 @@ rec {
       "sha256-jtkx0kbI7SB74U5uWyGdVhKMlsy/T82lz3P89k8LMPA=";
 
   mypy-boto3-ec2 =
-    buildMypyBoto3Package "ec2" "1.40.34"
-      "sha256-TA9tus7Ue+rqXXYsk2rogEQQAa2Y+VWml6RscNx6Fgk=";
+    buildMypyBoto3Package "ec2" "1.40.37"
+      "sha256-/fjsvFbryW6xD+B1rQT+XpPmwHS9KlbYogTtxo9tFgM=";
 
   mypy-boto3-ec2-instance-connect =
     buildMypyBoto3Package "ec2-instance-connect" "1.40.20"
@@ -510,8 +510,8 @@ rec {
       "sha256-9Iz9FapUQCWa9bjmH0Ar9O1mtTv+ovWlxikddb5+Wlc=";
 
   mypy-boto3-entityresolution =
-    buildMypyBoto3Package "entityresolution" "1.40.0"
-      "sha256-/Xzo0KU2N14S39gkb1MnJV27anIN92ANcCbKl1b9YVw=";
+    buildMypyBoto3Package "entityresolution" "1.40.37"
+      "sha256-n5aa7oK/37pT1f+xFXu8Sp3LfO1UAcUljCqdtSZ/fPQ=";
 
   mypy-boto3-es =
     buildMypyBoto3Package "es" "1.40.15"
@@ -1293,8 +1293,8 @@ rec {
       "sha256-wR+V7nK924T3/s8wADcuAVR/NnNwZLeF8c80GRuH4D8=";
 
   mypy-boto3-ssm =
-    buildMypyBoto3Package "ssm" "1.40.0"
-      "sha256-SmViQOrSn/z7KOlc58erbJu61xu+fOgfMo/5shT/EUs=";
+    buildMypyBoto3Package "ssm" "1.40.37"
+      "sha256-2cdpa5i6N2lbul6s/gDxMFaL7zQ0QmJC3y1fpiSGtvM=";
 
   mypy-boto3-ssm-contacts =
     buildMypyBoto3Package "ssm-contacts" "1.40.15"
@@ -1313,12 +1313,12 @@ rec {
       "sha256-XlnYeHhZ5IttMBKIa2rsk22QDRp2M72x1nAeJ3CiKa0=";
 
   mypy-boto3-sso-admin =
-    buildMypyBoto3Package "sso-admin" "1.40.7"
-      "sha256-aate7wrDPC/Gvgu1mdFDaVz24QpFMwsThicGf41b7qI=";
+    buildMypyBoto3Package "sso-admin" "1.40.37"
+      "sha256-TiCqp80H4oP2DyyMoKUMqndaePtj5AhzhWck/Vm82AA=";
 
   mypy-boto3-sso-oidc =
-    buildMypyBoto3Package "sso-oidc" "1.40.0"
-      "sha256-lrGga9jxuUUL+71vzkDD0HKVxEu8wIo9YHiF45u8loU=";
+    buildMypyBoto3Package "sso-oidc" "1.40.37"
+      "sha256-HWLKg9KykJJiv/eibjEymSRq4pThP30GKL0KwYJTRyc=";
 
   mypy-boto3-stepfunctions =
     buildMypyBoto3Package "stepfunctions" "1.40.0"

pkgs/development/python-modules/safety-schemas/default.nix

@@ -12,13 +12,13 @@
 
 buildPythonPackage rec {
   pname = "safety-schemas";
-  version = "0.0.14";
+  version = "0.0.16";
   pyproject = true;
 
   src = fetchPypi {
     pname = "safety_schemas";
     inherit version;
-    hash = "sha256-SZU/elnpGVcr4lWVqJRvnLvNIGb+PhYMlGfZ0dbXr2o=";
+    hash = "sha256-O7BNEb1LXMefn6GDxlimqM+CepzuxEOl/6bu04pQok4=";
   };
 
   postPatch = ''

pkgs/development/python-modules/safety/default.nix

@@ -31,14 +31,14 @@
 
 buildPythonPackage rec {
   pname = "safety";
-  version = "3.6.1";
+  version = "3.6.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pyupio";
     repo = "safety";
     tag = version;
-    hash = "sha256-E48iuPZhAttQi4RCJGZikz+/kTXOZbq1zp+4fypTc94=";
+    hash = "sha256-oGz2ZHGYaHi4RusNbZ5iqxuz2JBbchP5ip+uHHV10U0=";
   };
 
   patches = [

pkgs/development/python-modules/subliminal/default.nix

@@ -41,7 +41,7 @@
 
 buildPythonPackage rec {
   pname = "subliminal";
-  version = "2.3.2";
+  version = "2.4.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -50,7 +50,7 @@ buildPythonPackage rec {
     owner = "Diaoul";
     repo = "subliminal";
     tag = version;
-    hash = "sha256-eAXzD6diep28wCZjWLOZpOX1bnakEldhs2LX5CPu5OI=";
+    hash = "sha256-QRxaLJAtI7Xe+3Llp3fJP12KblDJ8+MGNsmKT4t2O0k=";
   };
 
   build-system = [