Merge staging-next into staging

ci/github-script/get-pr-commit-details.js

@@ -76,7 +76,7 @@ async function getCommitDetailsForPR({ core, pr, repoPath }) {
 
   return Promise.all(
     shas.map(async (sha) => {
-      // Subject, author name, author email, committer name, committer email (all tab-seperated)
+      // Subject, author name, author email, committer name, committer email (all tab-separated)
       // then a blank line, then filenames.
       const result = (
         await runGit({

doc/release-notes/rl-2611.section.md

@@ -78,6 +78,8 @@
 
 - `himalaya` has been updated from `v1.2.0` to `v2.0.0`, which introduces breaking changes. See the [release notes](https://github.com/pimalaya/himalaya/releases/tag/v2.0.0) and the [migration guide](https://github.com/pimalaya/himalaya/blob/master/MIGRATION.md).
 
+- `tengine` has been removed as it has seen seriously delayed responses to security vulnerabilities.
+
 - `nix-serve-ng` (and `haskellPackages.nix-serve-ng`) is now built against Lix instead of CppNix, following upstream which has switched to Lix as its supported Nix implementation.
 
 - Linux kernel configuration has been moved out of the `linux-kernel` field of the platform structure into the kernel builders:

maintainers/scripts/dep-licenses.sh

@@ -36,7 +36,7 @@ sed '
 
 if test $(wc -l "$tmp/filter.sed" | sed 's/ .*//') == 0; then
   echo 1>&2 "
-No derivation mentionned in the stack trace.  Either your derivation does
+No derivation mentioned in the stack trace.  Either your derivation does
 not use stdenv.mkDerivation or you forgot to use the stdenv adapter named
 traceDrvLicenses.
 

maintainers/scripts/haskell/update-stackage.sh

@@ -34,7 +34,7 @@ fi
 # Stackage solver to use, LTS or Nightly
 # (should be capitalized like the display name)
 SOLVER=LTS
-# Stackage solver verson, if any. Use latest if empty
+# Stackage solver version, if any. Use latest if empty
 VERSION=
 TMP_TEMPLATE=update-stackage.XXXXXXX
 readonly SOLVER

maintainers/scripts/sha-to-sri.py

@@ -166,7 +166,7 @@ def atomicFileUpdate(target: Path):
 
     Yields a pair `(original, new)` of open files.
     `original` is the pre-existing file at `target`, open for reading;
-    `new` is an empty, temporary file in the same filder, open for writing.
+    `new` is an empty, temporary file in the same folder, open for writing.
 
     Upon exiting the context, the files are closed; if no exception was
     raised, `new` (atomically) replaces the `target`, otherwise it is deleted.

maintainers/scripts/update-octave-packages

@@ -30,7 +30,7 @@ INDEX = "https://raw.githubusercontent.com/gnu-octave/packages/main/packages"
 """url of Octave packages' source on GitHub"""
 
 EXTENSIONS = ['tar.gz', 'tar.bz2', 'tar', 'zip']
-"""Permitted file extensions. These are evaluated from left to right and the first occurance is returned."""
+"""Permitted file extensions. These are evaluated from left to right and the first occurrence is returned."""
 
 PRERELEASES = False
 

nixos/modules/services/web-apps/akkoma.md

@@ -83,9 +83,6 @@ locally, and clients have to fetch them directly from the source server.
 
 ```nix
 {
-  # Enable nginx slice module distributed with Tengine
-  services.nginx.package = pkgs.tengine;
-
   # Enable media proxy
   services.akkoma.config.":pleroma".":media_proxy" = {
     enabled = true;

nixos/modules/services/web-servers/nginx/default.nix

@@ -805,7 +805,7 @@ in
           Nginx package to use. This defaults to the stable version. Note
           that the nginx team recommends to use the mainline version which
           available in nixpkgs as `nginxMainline`.
-          Supported Nginx forks include `angie`, `openresty` and `tengine`.
+          Supported Nginx forks include `angie` and `openresty`.
         '';
       };
 

nixos/tests/nginx-variants.nix

@@ -29,6 +29,5 @@ builtins.listToAttrs (
       "nginxMainline"
       "nginxShibboleth"
       "openresty"
-      "tengine"
     ]
 )

pkgs/applications/editors/jetbrains/plugins/default.nix

@@ -16,7 +16,7 @@
     let
       processPlugin =
         plugin:
-        # We can remove this check and just asume plugins to be derivations starting with 26.11.
+        # We can remove this check and just assume plugins to be derivations starting with 26.11.
         lib.throwIfNot (lib.isDerivation plugin)
           "addPlugins no longer supports resolving plugins by name or id strings. Please supply a derivation instead"
           plugin;

pkgs/applications/editors/neovim/wrapper.nix

@@ -46,7 +46,7 @@ let
       withPerl ? false,
       withRuby ? false,
 
-      # wether to create symlinks in $out/bin/vi(m) -> $out/bin/nvim
+      # whether to create symlinks in $out/bin/vi(m) -> $out/bin/nvim
       vimAlias ? false,
       viAlias ? false,
 

pkgs/applications/editors/vscode/extensions/default.nix

@@ -1117,7 +1117,7 @@ let
           hash = "sha256-aSyTgGZt9AMZopmPLHb3Mc2RxUGZH87eMtOPX8DlgWQ=";
         };
         meta = {
-          description = "The offical CUE extension for VS Code, providing syntax highlighting and language server integration (LSP)";
+          description = "The official CUE extension for VS Code, providing syntax highlighting and language server integration (LSP)";
           downloadPage = "https://marketplace.visualstudio.com/items?itemName=cuelangorg.vscode-cue";
           homepage = "https://github.com/cue-lang/vscode-cue";
           license = lib.licenses.mit;
@@ -1380,7 +1380,7 @@ let
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/DivyanshuAgrawal.competitive-programming-helper/changelog";
-          description = "Makes judging, compiling, and downloading problems for competitve programming easy. Also supports auto-submit for a few sites";
+          description = "Makes judging, compiling, and downloading problems for competitive programming easy. Also supports auto-submit for a few sites";
           downloadPage = "https://marketplace.visualstudio.com/items?itemName=DivyanshuAgrawal.competitive-programming-helper";
           homepage = "https://github.com/agrawal-d/cph";
           license = lib.licenses.gpl3;
@@ -1553,7 +1553,7 @@ let
           hash = "sha256-6xooF8petGLn8Zlh8rCXG2RJdAcdt8t8GPwhfgc5Gxs=";
         };
         meta = {
-          description = "Adwaita VS Code theme with Github syntax highlighting";
+          description = "Adwaita VS Code theme with GitHub syntax highlighting";
           downloadPage = "https://marketplace.visualstudio.com/items?itemName=egirlcatnip.adwaita-github-theme";
           homepage = "https://github.com/egirlcatnip/adwaita-github-theme";
           license = lib.licenses.gpl3;
@@ -1664,7 +1664,7 @@ let
           hash = "sha256-caNcbDTB/F2mdlGpfIfJv13lzY5Wwj7p7r8dAte9+3A=";
         };
         meta = {
-          description = "Visual Studio Code extension of using chinese-english dictonary in right-click menu";
+          description = "Visual Studio Code extension of using chinese-english dictionary in right-click menu";
           homepage = "https://github.com/exiahuang/fanyi-vscode";
           changelog = "https://marketplace.visualstudio.com/items/ExiaHuang.dictionary/changelog";
           license = lib.licenses.gpl3Only;
@@ -3039,7 +3039,7 @@ let
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/mechatroner.rainbow-csv/changelog";
-          description = "Rainbow syntax higlighting for CSV and TSV files in Visual Studio Code";
+          description = "Rainbow syntax highlighting for CSV and TSV files in Visual Studio Code";
           downloadPage = "https://marketplace.visualstudio.com/items?itemname=mechatroner.rainbow-csv";
           homepage = "https://github.com/mechatroner/vscode_rainbow_csv";
           license = lib.licenses.mit;
@@ -3138,7 +3138,7 @@ let
 
         meta = {
           changelog = "https://github.com/moshfeu/vscode-compare-folders/releases";
-          description = "Extension allows you to compare folders, show the diffs in a list and present diff in a splitted view side by side";
+          description = "Extension allows you to compare folders, show the diffs in a list and present diff in a split view side by side";
           downloadPage = "https://marketplace.visualstudio.com/items?itemName=moshfeu.compare-folders";
           homepage = "https://github.com/moshfeu/vscode-compare-folders";
           license = lib.licenses.mit;
@@ -5468,7 +5468,7 @@ let
           hash = "sha256-sin2kTx7aXFPhtraKUjsowuV8Z2z237RIePL4F/JiPM=";
         };
         meta = {
-          description = "Visual Studio Code extension to help user easyly finish long words ";
+          description = "Visual Studio Code extension to help user easily finish long words ";
           longDescription = ''
             Dictionary completion allows user to get a list of keywords, based off of the current word at the cursor.
             This is useful if you are typing a long word (e.g. acknowledgeable) and don't want to finish typing or don't remember the Spelling

pkgs/applications/editors/vscode/extensions/ms-vscode.cpptools/default.nix

@@ -24,7 +24,7 @@
   So, in order for debugging to work properly, you merely need to create symlinks
   to one of these terminals at the appropriate location.
 
-  The good news is the the utility library is open source and with some effort
+  The good news is the utility library is open source and with some effort
   we could build a patched version ourselves. See:
 
   <https://github.com/Microsoft/MIEngine/blob/2885386dc7f35e0f1e44827269341e786361f28e/src/MICore/TerminalLauncher.cs#L156>

pkgs/applications/editors/vscode/vscode.nix

@@ -10,7 +10,7 @@
   # sourceExecutableName is the name of the binary in the source archive over
   # which we have no control and it is needed to run the insider version as
   # documented in https://wiki.nixos.org/wiki/Visual_Studio_Code#Insiders_Build
-  # On MacOS the insider binary is still called code instead of code-insiders as
+  # On macOS the insider binary is still called code instead of code-insiders as
   # of 2023-08-06.
   sourceExecutableName ?
     "code" + lib.optionalString (isInsiders && stdenv.hostPlatform.isLinux) "-insiders",

pkgs/applications/emulators/libretro/cores/beetle-vb.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-vb";
-  version = "0-unstable-2026-07-22";
+  version = "0-unstable-2026-07-29";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-vb-libretro";
-    rev = "7cc663e9044459b3dab1790bdce8f48dc7358ed6";
-    hash = "sha256-ntw8SXzyu0PTDQgaLmT5Wy172A8TI3JLN6A5WQ2T/OI=";
+    rev = "3f53a40bf8aa18777514fd4b220960427e312a3f";
+    hash = "sha256-mIgLMgJnoGmlWSS6Z4x5GfJGV5fZxqFtLT5BdI+rgaI=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/pcsx-rearmed.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "pcsx-rearmed";
-  version = "0-unstable-2026-06-28";
+  version = "0-unstable-2026-08-02";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "pcsx_rearmed";
-    rev = "050981b6eeb715f142854f57c68086f62921f027";
-    hash = "sha256-MFNA3YPhLKa5q9hYM11O5/BIrj5xOsiNXkFLnCzugzo=";
+    rev = "da2cb8ecd17fd0932ab6d94774c0522beebce6e3";
+    hash = "sha256-WQexwG8KXsN2ZEs2a6x9yyN7a3jU6F5mqj226h6SFqw=";
   };
 
   dontConfigure = true;

pkgs/applications/emulators/libretro/cores/thepowdertoy.nix

@@ -6,13 +6,13 @@
 }:
 mkLibretroCore {
   core = "thepowdertoy";
-  version = "0-unstable-2026-04-20";
+  version = "0-unstable-2026-07-25";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "ThePowderToy";
-    rev = "dcb5e41f1f9800192ea07ea43459413c5a065d9f";
-    hash = "sha256-FDotG/ngmrxgyN7YQ8SK/ZQHKWkwZ5hhg0qsNNXmaNc=";
+    rev = "bb2d9f6623d2ccf25a0021045af9591c8a0bbaff";
+    hash = "sha256-iYGIDpum2x3sE8dBsZQOVv70C20Ras2CTlam0AldeLM=";
   };
 
   extraNativeBuildInputs = [ cmake ];

pkgs/applications/graphics/sane/frontends.nix

@@ -20,7 +20,7 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "1ad4zr7rcxpda8yzvfkq1rfjgx9nl6lan5a628wvpdbh3fn9v0z7";
   };
 
-  # add all fedora patchs. fix gcc-14 build among other things
+  # add all fedora patches. fix gcc-14 build among other things
   # https://src.fedoraproject.org/rpms/sane-frontends/tree/main
   patches =
     let

pkgs/applications/misc/cubocore-packages/corefm/default.nix

@@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   meta = {
-    description = "Lightwight filemanager from the C Suite";
+    description = "Lightweight filemanager from the C Suite";
     mainProgram = "corefm";
     homepage = "https://gitlab.com/cubocore/coreapps/corefm";
     license = lib.licenses.gpl3Plus;

pkgs/applications/misc/cubocore-packages/libcprime/default.nix

@@ -45,7 +45,7 @@ stdenv.mkDerivation (finalAttrs: {
   dontWrapQtApps = true;
 
   meta = {
-    description = "Library for bookmarking, saving recent activites, managing settings of C-Suite";
+    description = "Library for bookmarking, saving recent activities, managing settings of C-Suite";
     homepage = "https://gitlab.com/cubocore/libcprime";
     license = lib.licenses.gpl3Plus;
     maintainers = [ ];

pkgs/applications/misc/inochi2d/default.nix

@@ -8,7 +8,7 @@
 
 # Note for maintainers:
 #
-# These packages are only allowed to be packaged under the the condition that we
+# These packages are only allowed to be packaged under the condition that we
 # - patch source/creator/config.d to not point to upstream's bug tracker
 # - use the "barebones" configuration to remove the mascot and logo from the build
 #

pkgs/applications/networking/browsers/firefox/wrapper.nix

@@ -12,6 +12,7 @@
 
   ## various stuff that can be plugged in
   ffmpeg_7,
+  ffmpeg_8,
   libxxf86vm,
   libxxf86dga,
   libxt,
@@ -88,6 +89,11 @@ let
 
     let
       ffmpegSupport = browser.ffmpegSupport or false;
+      # Firefox dlopens libavcodec by hardcoded soname, so each ffmpeg major needs
+      # explicit browser support; keep versioned pins here (never the ffmpeg alias)
+      # and add a tier when a release gains the next ABI. 146 added libavcodec 62
+      # (https://bugzilla.mozilla.org/show_bug.cgi?id=1962139), not uplifted to ESR 140.
+      ffmpegPackage = if lib.versionAtLeast browser.version "146" then ffmpeg_8 else ffmpeg_7;
       gssSupport = browser.gssSupport or false;
       alsaSupport = browser.alsaSupport or false;
       pipewireSupport = browser.pipewireSupport or false;
@@ -113,7 +119,7 @@ let
           ++ lib.optional (cfg.speechSynthesisSupport or true) speechd-minimal
         )
         ++ lib.optional pipewireSupport pipewire
-        ++ lib.optional ffmpegSupport ffmpeg_7
+        ++ lib.optional ffmpegSupport ffmpegPackage
         ++ lib.optional gssSupport libkrb5
         ++ lib.optional useGlvnd libglvnd
         ++ lib.optionals (cfg.enableQuakeLive or false) [

pkgs/applications/networking/cluster/hadoop/default.nix

@@ -155,9 +155,9 @@ let
           computers using a simple programming model. It is designed to
           scale up from single servers to thousands of machines, each
           offering local computation and storage. Rather than rely on
-          hardware to deliver high-avaiability, the library itself is
+          hardware to deliver high-availability, the library itself is
           designed to detect and handle failures at the application layer,
-          so delivering a highly-availabile service on top of a cluster of
+          so delivering a highly-available service on top of a cluster of
           computers, each of which may be prone to failures.
         '';
         maintainers = with lib.maintainers; [ illustris ];

pkgs/applications/networking/cluster/helm/plugins/helm-dt.nix

@@ -40,7 +40,7 @@ buildGoModule rec {
   '';
 
   meta = {
-    description = "Helm Distribution plugin is is a set of utilities and Helm Plugin for making offline work with Helm Charts easier";
+    description = "Helm Distribution plugin is a set of utilities and Helm Plugin for making offline work with Helm Charts easier";
     homepage = "https://github.com/vmware-labs/distribution-tooling-for-helm";
     maintainers = with lib.maintainers; [ ascii17 ];
     license = lib.licenses.mit;

pkgs/applications/networking/cluster/spark/default.nix

@@ -8,7 +8,7 @@
   RSupport ? true,
   R,
   nixosTests,
-  # needeed in situations where hadoop's jdk version is too old
+  # needed in situations where hadoop's jdk version is too old
   jdk21_headless,
 }:
 

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -724,11 +724,11 @@
     "vendorHash": "sha256-s9tdthUzIdisP0XB9V+HGlWgZCXnOodz9Atu/XyDKf4="
   },
   "huaweicloud_huaweicloud": {
-    "hash": "sha256-1WVZ5NOvVFuRIWJQpFy9lRvlt5GbOHINFISABexcb/M=",
+    "hash": "sha256-TiupRu1Aj750do194qYyWlJJAaT1cwyy/oc3WyqtJdM=",
     "homepage": "https://registry.terraform.io/providers/huaweicloud/huaweicloud",
     "owner": "huaweicloud",
     "repo": "terraform-provider-huaweicloud",
-    "rev": "v1.95.0",
+    "rev": "v1.96.1",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1166,13 +1166,13 @@
     "vendorHash": "sha256-zklw0YajAZZLkosLxZCsWtAbvmHuGEI8OGpVykp1Xw4="
   },
   "sap-cloud-infrastructure_sci": {
-    "hash": "sha256-eQA4mY+Rx5PLbTgGqfefYFc5gZKIvt1w2eag8ipE0PI=",
+    "hash": "sha256-S0E8vZpJaJvch8Riy1hO5ChegTyq0NYdEfjS290h1G4=",
     "homepage": "https://registry.terraform.io/providers/sap-cloud-infrastructure/sci",
     "owner": "SAP-cloud-infrastructure",
     "repo": "terraform-provider-sci",
-    "rev": "v2.3.0",
+    "rev": "v2.5.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-InCRL4k6v0avmnNja+b6Ozg5+injxa8EmrRHIWrq4Ag="
+    "vendorHash": "sha256-22bOJyR+ERVu8eTX3iT838q6mxViGt5Fd6MVFB49JZY="
   },
   "sap_btp": {
     "hash": "sha256-fRg83kdeHizOi8riLFU0NKWmeQSAbG0xJUtkdMcvWp0=",

pkgs/applications/radio/gnuradio/wrapper.nix

@@ -27,7 +27,7 @@
   atk,
   # For Adding additional GRC blocks
   extraPackages ? [ ],
-  # For Adding additional python packaages
+  # For Adding additional python packages
   extraPythonPackages ? [ ],
   soapysdr, # For it's passthru.searchPath
   # soapysdr plugins we add by default. Ideally, we should have a

pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix

@@ -21,7 +21,7 @@
   libusb1,
   pkg-config,
   # #FIXME: Could not get cmake to pick up on these dependencies
-  # Ommiting them prevents cmake from building the OCR video capabilities
+  # Omitting them prevents cmake from building the OCR video capabilities
   # Everything else should work it's just missing this one plugin
   # tesseract,
   # leptonica,

pkgs/applications/virtualization/singularity/generic.nix

@@ -1,4 +1,4 @@
-# Configurations that should only be overrided by
+# Configurations that should only be overridden by
 # overrideAttrs
 {
   pname,

pkgs/applications/virtualization/singularity/packages.nix

@@ -98,7 +98,7 @@ let
           description = "";
           longDescription = ''
             This package produces identical store derivations to `pkgs.${packageName}`
-            overriden and installed by the NixOS module `programs.singularity`
+            overridden and installed by the NixOS module `programs.singularity`
             with default configuration.
 
             This is for binary substitutes only. Use pkgs.${packageName} instead.

pkgs/build-support/build-fhsenv-bubblewrap/buildFHSEnv.nix

@@ -64,7 +64,7 @@ let
 
   # base packages of the fhsenv
   # these match the host's architecture, glibc_multi is used for multilib
-  # builds. glibcLocales must be before glibc or glibc_multi as otherwiese
+  # builds. glibcLocales must be before glibc or glibc_multi as otherwise
   # the wrong LOCALE_ARCHIVE will be used where only C.UTF-8 is available.
   baseTargetPaths = with pkgs; [
     glibcLocales

pkgs/build-support/dotnet/add-nuget-deps/default.nix

@@ -96,7 +96,7 @@ attrs
 
           defaultDepsFile =
             # Wire in the depsFile such that running the script with no args
-            # runs it agains the correct deps file by default.
+            # runs it against the correct deps file by default.
             # Note that toString is necessary here as it results in the path at
             # eval time (i.e. to the file in your local Nixpkgs checkout) rather
             # than the Nix store path of the path after it's been imported.

pkgs/build-support/make-hardcode-gsettings-patch/default.nix

@@ -11,7 +11,7 @@
 
   This is useful so that libraries can find schemas even though Nix lacks
   a standard location like /usr/share, where GSettings system could look for schemas.
-  The derivation is is somewhat dependency-heavy so it is best used as part of an update script.
+  The derivation is somewhat dependency-heavy so it is best used as part of an update script.
 
   For each schema id referenced in the source code (e.g. org.gnome.evolution),
   a variable name such as `EVOLUTION` must be provided.

pkgs/by-name/al/alpine/package.nix

@@ -15,12 +15,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "alpine";
-  version = "2.29.9";
+  version = "2.29.99";
 
   src = fetchgit {
     url = "https://repo.or.cz/alpine.git";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-uAPQlF2IQPSZ0QoK9bwh6RBGsb1X0ktP1eVhs3RO44I=";
+    hash = "sha256-h/6HSqEmMZAjVtDJ+9MqM1WYBalthl0mfsC1/f4OmOw=";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];

pkgs/by-name/ap/apache-jena/package.nix

@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "apache-jena";
-  version = "6.1.0";
+  version = "6.2.0";
 
   src = fetchurl {
     url = "mirror://apache/jena/binaries/apache-jena-${finalAttrs.version}.tar.gz";
-    hash = "sha256-ZTEIqR/Zswmom8dWJYuuC8oBWHzvR1lC0RhS4766KuM=";
+    hash = "sha256-FMEu9KovAHikc75LELAV4OC4XnZ9aGfoWBZ53o/sP24=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/at/atop/package.nix

@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "atop";
-  version = "2.12.1";
+  version = "2.13.0";
 
   src = fetchurl {
     url = "https://www.atoptool.nl/download/atop-${finalAttrs.version}.tar.gz";
-    hash = "sha256-T9vmfF36+JQFY54YWZ9OrneXgHP/pU88eMNoq1S9EvY=";
+    hash = "sha256-6hgvhMn1LKki5a9PF9/5f/QkQApPL5I5Mxemr2bmqHQ=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/au/authentik/package.nix

@@ -25,7 +25,7 @@
 let
   nodejs = nodejs_24;
 
-  version = "2026.5.3";
+  version = "2026.5.6";
 
   cargoPackageFlags = [
     "--package"
@@ -36,7 +36,7 @@ let
     owner = "goauthentik";
     repo = "authentik";
     tag = "version/${version}";
-    hash = "sha256-nmAX8nwZpdDcFAPvC9hAEp0x43RnFtGLUTAm7NcvNZo=";
+    hash = "sha256-/HdXzjjvuSW7zjbCNJKm3Fj8gvIwfrDf8mOYev0yuIg=";
   };
 
   meta = {
@@ -129,7 +129,7 @@ let
     sourceRoot = "${src.name}/website";
 
     inherit nodejs;
-    npmDepsHash = "sha256-SkIZF+wQPgoZOGJc0YR8Ot07KCsAdA1985SLQaoibfA=";
+    npmDepsHash = "sha256-5zAsS+Jw/hcBOws+MvFGZMMSn+NNKcpUmmkd9NO9fTY=";
     npmDepsFetcherVersion = 2;
     makeCacheWritable = true;
     npmInstallFlags = [ "--legacy-peer-deps" ];
@@ -189,7 +189,7 @@ let
 
     outputHash =
       {
-        "aarch64-linux" = "sha256-41xZEfLul92vJATZqyVnd7Pp++NzLL/u8NeJJPHpXrw=";
+        "aarch64-linux" = "sha256-ZdfDKrrcVpNImY8cYa9CPEwI7tuaoPn3kM6MXGGio2U=";
         "x86_64-linux" = "sha256-p6xjAinU2Isl/uYgoJuacqHN7jBnbWam40J6AQudbtQ=";
       }
       .${stdenvNoCC.hostPlatform.system} or (throw "authentik-webui-deps: unsupported host platform");
@@ -292,6 +292,8 @@ let
 
         build-system = with final; [ hatchling ];
 
+        nativeBuildInputs = with final; [ pyprojectVersionPatchHook ];
+
         propagatedBuildInputs = with final; [
           django
           typing-extensions
@@ -307,6 +309,8 @@ let
 
         build-system = with final; [ hatchling ];
 
+        nativeBuildInputs = with final; [ pyprojectVersionPatchHook ];
+
         pythonRelaxDeps = [
           "structlog"
         ];
@@ -333,6 +337,8 @@ let
 
         build-system = with final; [ hatchling ];
 
+        nativeBuildInputs = with final; [ pyprojectVersionPatchHook ];
+
         pythonRelaxDeps = [
           "structlog"
         ];
@@ -360,6 +366,8 @@ let
 
         build-system = with final; [ hatchling ];
 
+        nativeBuildInputs = with final; [ pyprojectVersionPatchHook ];
+
         propagatedBuildInputs = with final; [
           django
           django-postgres-extra
@@ -367,7 +375,7 @@ let
       };
 
       authentik-django = final.buildPythonPackage {
-        pname = "authentik-django";
+        pname = "authentik";
         inherit version src meta;
         pyproject = true;
 
@@ -383,9 +391,7 @@ let
             --replace-fail "and (self._base_dir.is_mount() or (self._base_dir / self.usage.value).is_mount())" ""
         '';
 
-        build-system = [
-          final.hatchling
-        ];
+        build-system = with final; [ hatchling ];
 
         pythonRemoveDeps = [ "dumb-init" ];
 
@@ -486,7 +492,7 @@ let
     pname = "authentik-worker";
     inherit version src meta;
 
-    cargoHash = "sha256-KExlNyT9G3R5rnt99beT2pYrWxezMLhGw+Q9T1X2kj4=";
+    cargoHash = "sha256-bpS1cXIG8srVE4tTS1rXL6R+ZBE65BZTlMghSPiAJy4=";
 
     nativeBuildInputs = [
       cmake

pkgs/by-name/ba/baresip/package.nix

@@ -31,14 +31,14 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "4.9.0";
+  version = "4.10.0";
   pname = "baresip";
 
   src = fetchFromGitHub {
     owner = "baresip";
     repo = "baresip";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-eEDiv/yBKWVvKTAeelqVSAQp2xHhXRJVkK2x0FZ9tOE=";
+    hash = "sha256-EUnMcRvSvQoCgVmDVPjtfeppUiheVU2xD49D9hZbGb4=";
   };
 
   patches = [

pkgs/by-name/be/bento/package.nix

@@ -8,17 +8,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "bento";
-  version = "1.19.0";
+  version = "1.20.0";
 
   src = fetchFromGitHub {
     owner = "warpstreamlabs";
     repo = "bento";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3ZISLZzh8FYAE9riZ5Ya5h3LhwzHK4a5jJl8jeHiNoA=";
+    hash = "sha256-cWQvCTN9G4M0DTLFyGusgpgM7g24C5STP4Pb/T8pyYI=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-h9bH5aewbDAuOVAps3TMihjCITFiBT/bbqNJCUT0NN8=";
+  vendorHash = "sha256-sX5I4TssmlRnkOc3XAtaoKLppla56AQi+vypGMLf0i8=";
 
   subPackages = [
     "cmd/bento"

pkgs/by-name/bi/biome/package.nix

@@ -11,16 +11,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "biome";
-  version = "2.5.5";
+  version = "2.5.6";
 
   src = fetchFromGitHub {
     owner = "biomejs";
     repo = "biome";
     rev = "@biomejs/biome@${finalAttrs.version}";
-    hash = "sha256-mTkW+ni52TybEw+j9v/WcxoZhLelrjO7vAf/MMd7NOc=";
+    hash = "sha256-jutNefPBi39eM/Db04IHA6RId+Un7xLBv/L7tMaC3iI=";
   };
 
-  cargoHash = "sha256-sbh5WpBTcFNlKxf62adCZ6g8Ch+MapJ8wbRRT8+R7XA=";
+  cargoHash = "sha256-pPX9sbVYfN9k3LeTBY1SMXU1xOFlYmQCkvSg8U9dL+w=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/bl/blitz/package.nix

@@ -22,7 +22,7 @@
 }:
 
 let
-  inherit (lib) optional optionals;
+  inherit (lib) optional;
 in
 stdenv.mkDerivation rec {
   pname = "blitz++";

pkgs/by-name/da/dataform/package.nix

@@ -0,0 +1,135 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchurl,
+  nix-update-script,
+  nodejs,
+  makeWrapper,
+  testers,
+  runCommand,
+  writableTmpDirAsHomeHook,
+  cacert,
+}:
+
+buildNpmPackage (finalAttrs: {
+  pname = "dataform";
+  version = "3.0.63";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  inherit nodejs;
+
+  src = fetchurl {
+    url = "https://registry.npmjs.org/@dataform/cli/-/cli-${finalAttrs.version}.tgz";
+    hash = "sha256-WAVTcWCZ99y+i7KTKWaqE5oMG+Uc/4d5h3Y6k9Bqhuo=";
+  };
+
+  # Inject the locally committed lockfile into the extracted source
+  postPatch = ''
+    cp ${./package-lock.json} package-lock.json
+  '';
+
+  npmDepsHash = "sha256-GLzkgs8ohGcWlNf55ktW4N1Q6HRJ+rse7wzBXC/xBno=";
+
+  dontNpmBuild = true;
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  postInstall = ''
+    wrapProgram $out/bin/dataform \
+      --prefix PATH : ${lib.makeBinPath [ nodejs ]}
+  '';
+
+  passthru = {
+    updateScript = nix-update-script {
+      extraArgs = [ "--generate-lockfile" ];
+    };
+
+    tests = {
+      version = testers.testVersion {
+        package = finalAttrs.finalPackage;
+      };
+
+      help = testers.runCommand {
+        name = "${finalAttrs.pname}-help-test";
+        nativeBuildInputs = [ finalAttrs.finalPackage ];
+        script = ''
+          dataform --help | grep -F "dataform [command]"
+          touch $out
+        '';
+      };
+
+      # `dataform install` should refuse to run against a workflow_settings.yaml
+      # project -- this is expected behavior, not a bug: packages for these
+      # projects are resolved at runtime instead.
+      install-refuses = testers.testBuildFailure' {
+        name = "${finalAttrs.pname}-install-refuses-test";
+        drv =
+          runCommand "${finalAttrs.pname}-install-refuses-test"
+            {
+              nativeBuildInputs = [ finalAttrs.finalPackage ];
+            }
+            ''
+              dataform init test-project my-test-db US
+              cd test-project
+              dataform install .
+            '';
+        expectedBuilderLogEntries = [
+          "No installation is needed when using workflow_settings.yaml"
+        ];
+      };
+
+      # `dataform compile` on a freshly-initialized workflow_settings.yaml
+      # project lazily fetches @dataform/core from the npm registry the
+      # first time it's needed -- this is the "packages are installed at
+      # runtime" behavior from the `install` refusal message actually
+      # happening. Needs network + a CA bundle, unlike the other tests here.
+      workflow = testers.runCommand {
+        name = "${finalAttrs.pname}-workflow-test";
+        nativeBuildInputs = [
+          finalAttrs.finalPackage
+          writableTmpDirAsHomeHook
+          cacert
+        ];
+        script = ''
+          dataform init test-project my-test-db US
+          test -d test-project/definitions
+          test -d test-project/includes
+          test -f test-project/workflow_settings.yaml
+          grep -F "my-test-db" test-project/workflow_settings.yaml
+          grep -F "US" test-project/workflow_settings.yaml
+
+          cd test-project
+          dataform compile . | grep -F "Compiled 0 action(s)."
+
+          touch $out
+        '';
+      };
+    };
+  };
+
+  meta = {
+    mainProgram = "dataform";
+    description = "Dataform CLI";
+    longDescription = ''
+      Dataform is a framework for managing SQL based data operations in BigQuery
+      Dataform CLI is an open-source command-line tool that allows developers to locally build,
+      compile, test, and execute SQLX data transformation pipelines for BigQuery.
+    '';
+    homepage = "https://github.com/dataform-co/dataform";
+    downloadPage = "https://www.npmjs.com/package/@dataform/cli";
+    changelog = "https://github.com/dataform-co/dataform/releases#release-${finalAttrs.version}";
+    license = lib.licenses.asl20;
+    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
+    identifiers = {
+      cpeParts = lib.meta.cpeFullVersionWithVendor "dataform-co" finalAttrs.version;
+      purlParts = {
+        type = "npm";
+        spec = "%40dataform/cli@${finalAttrs.version}";
+      };
+    };
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ KristijanZic ];
+  };
+})

pkgs/by-name/gl/glaze/package.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "glaze";
-  version = "7.9.1";
+  version = "8.0.0";
 
   src = fetchFromGitHub {
     owner = "stephenberry";
     repo = "glaze";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-NRRq5MGF2f5PW0teYnq58ELzson+U6KHVPaY6r30KLA=";
+    hash = "sha256-UQsR+b7FHGcC/nNpc7ffRurIyN3xM12PwN2UkrV1dRo=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/go/gobgp/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "gobgp";
-  version = "4.7.0";
+  version = "4.8.0";
 
   src = fetchFromGitHub {
     owner = "osrg";
     repo = "gobgp";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-crruhk4Jo1TdmGWvtdJKCBucjYNEwEMbNkJ3r5hxoQA=";
+    sha256 = "sha256-nU/HjHi0nKQy8SelwKSHneRjaRVNfvif4dljhPpUZrI=";
   };
 
-  vendorHash = "sha256-fGDjeWmIe0GNZTDCXDBU4b286rMdCnPgRBInLZsFWxQ=";
+  vendorHash = "sha256-9r8LZlCF4sr8VTyJfDktjhk32afc8ep7GXtqxUnAleE=";
 
   postConfigure = ''
     export CGO_ENABLED=0

pkgs/by-name/go/gobgpd/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "gobgpd";
-  version = "4.7.0";
+  version = "4.8.0";
 
   src = fetchFromGitHub {
     owner = "osrg";
     repo = "gobgp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-crruhk4Jo1TdmGWvtdJKCBucjYNEwEMbNkJ3r5hxoQA=";
+    hash = "sha256-nU/HjHi0nKQy8SelwKSHneRjaRVNfvif4dljhPpUZrI=";
   };
 
-  vendorHash = "sha256-fGDjeWmIe0GNZTDCXDBU4b286rMdCnPgRBInLZsFWxQ=";
+  vendorHash = "sha256-9r8LZlCF4sr8VTyJfDktjhk32afc8ep7GXtqxUnAleE=";
 
   postConfigure = ''
     export CGO_ENABLED=0

pkgs/by-name/gs/gsm/package.nix

@@ -8,7 +8,7 @@
 
 let
   inherit (stdenv.hostPlatform) isDarwin;
-  inherit (lib) optional optionalString;
+  inherit (lib) optionalString;
 in
 
 stdenv.mkDerivation rec {

pkgs/by-name/je/jetbrains-toolbox/package.nix

@@ -10,7 +10,7 @@
 
 let
   pname = "jetbrains-toolbox";
-  version = "3.6.2.85969";
+  version = "3.6.3.86383";
 
   updateScript = ./update.sh;
 
@@ -57,9 +57,9 @@ let
         aarch64 = "-arm64";
       };
       hash = selectSystem {
-        x86_64-linux = "sha256-2XvsZ5WrdmDGTigKWJCUJB2VkHj+Z3M8QClp6YoIIRw=";
-        aarch64-linux = "sha256-/8j7vJGTCvj57I1kqUCyBSDoJA8Tr0MUaomhb0Um7vA=";
-        aarch64-darwin = "sha256-esf/AfRDGoWV05KWb7CfJBRQvkcs3bG5/IldcTuNZOA=";
+        x86_64-linux = "sha256-RhBZK/86wMqgtFAolk5xubGAaqCewyEUlWjB+HAGEDg=";
+        aarch64-linux = "sha256-qhheArqQpElRoZGHmrl2W4+llDWEq+m4PXfG2XM6uYQ=";
+        aarch64-darwin = "sha256-mvfy8B2sOumvWiUmG8BtHvyZdcBs90BG8bEn21sPs5E=";
       };
     in
     selectKernel {

pkgs/by-name/li/libmikmod/package.nix

@@ -8,7 +8,7 @@
 }:
 
 let
-  inherit (lib) optional optionalString;
+  inherit (lib) optional;
 
 in
 stdenv.mkDerivation (finalAttrs: {

pkgs/by-name/li/libosip/package.nix

@@ -4,10 +4,10 @@
   fetchurl,
 }:
 stdenv.mkDerivation (finalAttrs: {
-  version = "5.3.1";
+  version = "5.3.2";
   src = fetchurl {
     url = "mirror://gnu/osip/libosip2-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-/oL+hBYIJmrBWlwRGCFtoAxVTVAG4odaisN1Kx5q3Hk=";
+    sha256 = "sha256-Fhhvb1VAk2tiw6rKboQJ4a8lzSKrw4grOTviFfSdOwA=";
   };
   pname = "libosip2";
 

pkgs/by-name/li/libtorrent-rakshasa/package.nix

@@ -14,7 +14,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libtorrent-rakshasa";
-  version = "0.16.17";
+  version = "0.16.19";
 
   __structuredAttrs = true;
 
@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "rakshasa";
     repo = "libtorrent";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gwEbaAe1A5bPBrrQDBeKraAwdzgbcUYVZYt8Gjtugi8=";
+    hash = "sha256-D+RPDp8r2ZKhNpiLKpm269h/5MBN+QhHf/qeXEzM92M=";
   };
 
   strictDeps = true;

pkgs/by-name/li/lincity-ng/package.nix

@@ -1,9 +1,9 @@
 {
   stdenv,
-  SDL2,
-  SDL2_image,
-  SDL2_mixer,
-  SDL2_ttf,
+  sdl3,
+  sdl3-image,
+  sdl3-mixer,
+  sdl3-ttf,
   cmake,
   fetchFromGitHub,
   fmt,
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lincity-ng";
-  version = "2.14.2";
+  version = "2.15.0";
 
   src = fetchFromGitHub {
     owner = "lincity-ng";
     repo = "lincity-ng";
     tag = "lincity-ng-${finalAttrs.version}";
-    hash = "sha256-HW+bB9xnrok8tWKIJJUt3Qgo5e9HmI6NZORG4PazmEM=";
+    hash = "sha256-NgOMbFsK/8njP3hOT9N9E9TRipSW+7CAw1oVDW1F5QU=";
   };
 
   hardeningDisable = [ "format" ];
@@ -47,10 +47,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     fmt
-    SDL2
-    SDL2_image
-    SDL2_mixer
-    SDL2_ttf
+    sdl3
+    sdl3-image
+    sdl3-mixer
+    sdl3-ttf
     libx11
     libwebp
     libtiff
@@ -68,8 +68,8 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   env.NIX_CFLAGS_COMPILE = "
-    -I${lib.getDev SDL2_image}/include/SDL2
-    -I${lib.getDev SDL2_mixer}/include/SDL2
+    -I${lib.getDev sdl3-image}/include/SDL3
+    -I${lib.getDev sdl3-mixer}/include/SDL3
   ";
 
   meta = {

pkgs/by-name/mo/monotone/package.nix

@@ -22,7 +22,6 @@
 }:
 
 let
-  version = "1.1-unstable-2021-05-01";
   perlVersion = lib.getVersion perl;
 
   botan = callPackage ./botan2.nix { enableForMonotone = true; };
@@ -30,13 +29,16 @@ in
 
 assert perlVersion != "";
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "monotone";
-  inherit version;
+  version = "1.1-unstable-2021-05-01";
+
+  strictDeps = true;
+  __structuredAttrs = true;
 
   #  src = fetchurl {
   #    url = "http://monotone.ca/downloads/${version}/monotone-${version}.tar.bz2";
-  #    sha256 = "124cwgi2q86hagslbk5idxbs9j896rfjzryhr6z63r6l485gcp7r";
+  #    hash = "sha256-+Vz2CiLU5GG+ydDnL102CcmkV2+xzEX1U9AgLOLjjIg=";
   #  };
 
   # My mirror of upstream Monotone repository
@@ -46,7 +48,7 @@ stdenv.mkDerivation rec {
     owner = "7c6f434c";
     repo = "monotone-mirror";
     rev = "b30b0e1c16def043d2dad57d1467d5bfdecdb070";
-    hash = "sha256:1hfy8vaap3184cd7h3qhz0da7c992idkc6q2nz9frhma45c5vgmd";
+    hash = "sha256-rb5dWCGqwuzStwIbNlsUKbGjGvgQD3gaIyiMq9RG3sE=";
   };
 
   patches = [
@@ -56,7 +58,7 @@ stdenv.mkDerivation rec {
       name = "rm-clang-float128-hack.patch";
       url = "https://github.com/7c6f434c/monotone-mirror/commit/5f01a3a9326a8dbdae7fc911b208b7c319e5f456.patch";
       revert = true;
-      sha256 = "0fzjdv49dx5lzvqhkvk50lkccagwx8h0bfha4a0k6l4qh36f9j7c";
+      hash = "sha256-7MjkzICYUDOBIgq6BSDq/CnGJgVl7gnx/rT0lshu8js=";
     })
     ./monotone-1.1-gcc-14.patch
   ];
@@ -94,15 +96,15 @@ stdenv.mkDerivation rec {
   ];
 
   postInstall = ''
-    mkdir -p $out/share/${pname}-${version}
-    cp -rv contrib/ $out/share/${pname}-${version}/contrib
+    mkdir -p $out/share/monotone-${finalAttrs.version}
+    cp -rv contrib/ $out/share/monotone-${finalAttrs.version}/contrib
     mkdir -p $out/${perl.libPrefix}/${perlVersion}
     cp -v contrib/Monotone.pm $out/${perl.libPrefix}/${perlVersion}
 
     patchShebangs "$out/share/monotone"
-    patchShebangs "$out/share/${pname}-${version}"
+    patchShebangs "$out/share/monotone-${finalAttrs.version}"
 
-    find "$out"/share/{doc/monotone,${pname}-${version}}/contrib/ -type f | xargs sed -e 's@! */usr/bin/@!/usr/bin/env @; s@! */bin/bash@!/usr/bin/env bash@' -i
+    find "$out"/share/{doc/monotone,monotone-${finalAttrs.version}}/contrib/ -type f | xargs sed -e 's@! */usr/bin/@!/usr/bin/env @; s@! */bin/bash@!/usr/bin/env bash@' -i
   '';
 
   #doCheck = true; # some tests fail (and they take VERY long)
@@ -114,4 +116,4 @@ stdenv.mkDerivation rec {
     platforms = lib.platforms.unix;
     license = lib.licenses.gpl2Plus;
   };
-}
+})

pkgs/by-name/or/oracle-instantclient/package.nix

@@ -15,7 +15,7 @@
 assert odbcSupport -> unixodbc != null;
 
 let
-  inherit (lib) optional optionals optionalString;
+  inherit (lib) optional optionalString;
 
   throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";
 

pkgs/by-name/re/reqable/package.nix

@@ -28,11 +28,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "reqable";
-  version = "3.2.10";
+  version = "3.2.16";
 
   src = fetchurl {
     url = "https://github.com/reqable/reqable-app/releases/download/${finalAttrs.version}/reqable-app-linux-x86_64.deb";
-    hash = "sha256-IojbkSAQK7eL2dR6ZqXXBCs/TWpEeB/SGYbuN70Ecnw=";
+    hash = "sha256-E9bVx3BcHOY9Vq7ZyH3UsIRG3NWWXkRIbW9Zvy9lTQo=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/rt/rtorrent/package.nix

@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rtorrent";
-  version = "0.16.17";
+  version = "0.16.19";
 
   __structuredAttrs = true;
 
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "rakshasa";
     repo = "rtorrent";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pFEUbxrruP4Zq9WdlnBSmE6Fe95jpZ88x3md5jzytO4=";
+    hash = "sha256-oMErraDUyCiuRxFZ5CoBvoW9vXHG+eLHnAKzm6kWt2Y=";
   };
 
   outputs = [

pkgs/by-name/sq/squeezelite/package.nix

@@ -28,7 +28,7 @@
 }:
 
 let
-  inherit (lib) optional optionals optionalString;
+  inherit (lib) optional optionalString;
 
   pulseSupport = audioBackend == "pulse";
 

pkgs/by-name/st/stable-diffusion-cpp/package.nix

@@ -35,7 +35,6 @@ let
     cmakeBool
     cmakeFeature
     optionals
-    optionalString
     ;
 
   effectiveStdenv = if cudaSupport then cudaPackages.backendStdenv else stdenv;

pkgs/by-name/ta/tailscale/package.nix

@@ -24,7 +24,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "tailscale";
-  version = "1.98.10";
+  version = "1.102.1";
 
   outputs = [
     "out"
@@ -35,10 +35,10 @@ buildGoModule (finalAttrs: {
     owner = "tailscale";
     repo = "tailscale";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-RHnHMS5xHQ2BDn6SiHkmwwwzvHjye7OrB+QRqu3gIU8=";
+    hash = "sha256-zsYFnk6QI1MAc8ROL3RPSoQTKtmINYWAbAsaDwom0WI=";
   };
 
-  vendorHash = "sha256-oORTAfLmCGhIxgn3lapgvQLmdqxcOMhsdXbzxYeoR0o=";
+  vendorHash = "sha256-amKkUPszyhG4N5ZtrB01swBACYq76raSS+SQRneLmwc=";
 
   nativeBuildInputs = [
     makeWrapper
@@ -176,6 +176,10 @@ buildGoModule (finalAttrs: {
         # Fails because we vendor dependencies
         "TestLicenseHeaders"
 
+        # Runs `go test -race`, which requires cgo, but we build with CGO_ENABLED=0
+        "TestRaceAttributedToPassingTest" # cmd/testwrapper
+        "TestRaceSuppressesFlakyRetry" # cmd/testwrapper
+
         # Uses testing/synctest which spawns goroutines that block on syscalls
         # incompatible with synctest's bubble mechanism
         "TestDNSTrampleRecovery"

pkgs/by-name/tb/tbox/package.nix

@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tbox";
-  version = "1.8.1";
+  version = "1.8.2";
 
   src = fetchFromGitHub {
     owner = "tboox";
     repo = "tbox";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-tUN9H6TejbFbJR4Lr0N8HoYkRAo8a/Rh4HEMOG1aPoE=";
+    hash = "sha256-qrmlS2ympche4o0EquQWcy9+tP+WdqOhyRkN6SsSJLk=";
   };
 
   configureFlags = [

pkgs/by-name/vu/vulnix/package.nix

@@ -8,14 +8,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "vulnix";
-  version = "1.12.4";
+  version = "1.12.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "vulnix";
     tag = finalAttrs.version;
-    hash = "sha256-4aaYSOBuZHW/FZ8c+REjwr6X2S4KsP9Czk5jGTQfqDI=";
+    hash = "sha256-uz8vHabk5UTnSj969VQ9EZrha/rOQ9vxuQxfJcmx/v0=";
   };
 
   __darwinAllowLocalNetworking = true;

pkgs/by-name/xe/xen/package.nix

@@ -173,7 +173,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xen";
-  version = "4.20.3";
+  version = "4.20.4";
 
   # This attribute can be overriden to correct the file paths in
   # `passthru` when building an unstable Xen.
@@ -185,242 +185,9 @@ stdenv.mkDerivation (finalAttrs: {
     ./0001-makefile-efi-output-directory.patch
 
     (replaceVars ./0002-scripts-external-executable-calls.patch scriptDeps)
-
-    # XSA #483
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa483.patch";
-      hash = "sha256-pZkSQKAjEIa/EHlCa2hD+3kofzpVHtFxcdp/TiWu9i8=";
-    })
-
-    # XSA #484
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa484.patch";
-      hash = "sha256-6zkTBHKfpAK2poSycEFSb3pE9pDpZwBxAe5Jf862j+U=";
-    })
-
-    # XSA #486
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa486.patch";
-      hash = "sha256-8EC1lv2JAYqchX5sHbO3NbP7haEyu1V0/72KwALG+BA=";
-    })
-
-    # XSA #488
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa488-4.20.patch";
-      hash = "sha256-QttKWdmWC6Zn5k2hd6RIMCpLWv71HB/A9mCbDP+i8to=";
-    })
-
-    # XSA #490
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa490-4.21.patch";
-      hash = "sha256-PF4zNeaS8aXHBNKLcgjVBUqmREg+nvdyHyLlhX2YBiw=";
-    })
-
-    # XSA #491
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa491-4.21.patch";
-      hash = "sha256-I21YIcaK1v7BfBJi/aiVACgR3QyN+/gXnB4YMprT4zA=";
-    })
-
-    # XSA #492
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-01.patch";
-      hash = "sha256-U3nE7jgTKh2HmS9tMVQG+TIGvgU5B1aikC3NSER0CaY=";
-    })
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-02.patch";
-      hash = "sha256-Y3k9ICThfnIcu59F2pFDbFWD5DL6siPJmINmC7nT2uY=";
-    })
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-03.patch";
-      hash = "sha256-k4nPft59/MQwYKcdrzj5d80+LDhp05e86iJWzabjkQc=";
-    })
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-04.patch";
-      hash = "sha256-Mn+8q9zsstXbmrS/rkDdtwWEiD3EGNlmpa+eB1wESA4=";
-    })
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-05.patch";
-      hash = "sha256-csf9nf6cz3skhq1ph8HIs2AEVgBkw29hP39zwqy2vwM=";
-    })
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-06.patch";
-      hash = "sha256-urY9bjqqzKSGqGqEhDnagLUrzDsKkARMERT7vmukeUU=";
-    })
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-07.patch";
-      hash = "sha256-OyUC9bJevxiMuJuyJO9Z3ScXebe7lZM95HkK5YxGino=";
-    })
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-08.patch";
-      hash = "sha256-g3zV+r9LKjuMbkl4gprhWqClOgDU/Kbesr39LQiM+Aw=";
-    })
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-09.patch";
-      hash = "sha256-Wuc5dqwm+zwlYOzDXpRgyQH584sKwETi+xcE7HASHyI=";
-    })
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-10.patch";
-      hash = "sha256-ggln1O+epVOErBSUhIxX7xhwBy808vnQtcae3KYoQdo=";
-    })
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-11.patch";
-      hash = "sha256-/Yb1i/ms8MaVsEa/nK84CTFclOKcJoWMjjQJQab7l40=";
-    })
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-12.patch";
-      hash = "sha256-IpUeM+t7AZ8IVlzake+PiFAe0FCeFzChy+eaN9MAiSM=";
-    })
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-13.patch";
-      hash = "sha256-3vZj9VrDcFtlKrlMy1OD//F+6O252m23jJ0BRShQ6wA=";
-    })
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-14.patch";
-      hash = "sha256-LiBavW+FTfXdELs8Fm79KeOvskRqDXytv/e7eYRgSvY=";
-    })
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-15.patch";
-      hash = "sha256-0eK2hIFPNDIfv2W0ivkGL8Z3F+NpN4p2X0JVKjeBYWE=";
-    })
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-16.patch";
-      hash = "sha256-iEEkPC9mIuSF6Swt3/myUizsc8DubSPEkLkf1zm0/NE=";
-    })
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-17.patch";
-      hash = "sha256-YNo1wr+fRKk8+78Jf/zqJ7q9ugbzg7gyiyJ3zU+nB60=";
-    })
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-18.patch";
-      hash = "sha256-qNWe3iw+bYDtvBZ2KVfcy4VKu/waOyhoKZ0L8bqLdNc=";
-    })
-
-    # XSA #493
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa493/xsa493-4.20-01.patch";
-      hash = "sha256-SvAj+9CIyedpFENCB/lQTJUB4kpVkGh+z+NNk82lQqM=";
-    })
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa493/xsa493-4.20-02.patch";
-      hash = "sha256-4fajBBBKMnMTy7mvFSUghwkRbYo833s3jATeGfiOrjc=";
-    })
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa493/xsa493-4.20-03.patch";
-      hash = "sha256-/AI9gtd60UWf89NNd7+Zx1g+KyAIM2wCih/07LN5zt4=";
-    })
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa493/xsa493-4.20-04.patch";
-      hash = "sha256-qvXQG9VZkgca/za3bx1zTDkmRz5lFT3JPkbdI1mlBGY=";
-    })
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa493/xsa493-4.20-05.patch";
-      hash = "sha256-6pGjjPjalw6TY0n9TInE3nCXNmt6BUxwy1r1xf55U7k=";
-    })
-
-    # XSA #494
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa494-4.20.patch";
-      hash = "sha256-ns0s++J2adUD/HWuMiYad/g3MITs+twlMnkpFnP7T0w=";
-    })
-
-    # XSA #495
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa495-4.20.patch";
-      hash = "sha256-SAMu8r0yyPvD3zLCaQL53oNs+ZhV3puKUq4cCofkut8=";
-    })
-
-    # XSA #497
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa497.patch";
-      hash = "sha256-xftChrVcwMJYgkH22HUlUQXSTPee0ghPRnPVymWJr3o=";
-    })
-
-    # XSA #499
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa499/xsa499-4.20-1.patch";
-      hash = "sha256-Xk8+g/mEAtf3HIWqHL2+0iYSihtWy/tohaP6DcLo1+s=";
-    })
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa499/xsa499-4.20-2.patch";
-      hash = "sha256-YiDERwBeOvXtgsKjLbpCoLrfYQ1aw/QnXv9i4lKMrDs=";
-    })
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa499/xsa499-4.20-3.patch";
-      hash = "sha256-wyEc7GW83Vf++J10s/pqJTghXgqQhwUymPjpryuq8Wg=";
-    })
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa499/xsa499-4.20-4.patch";
-      hash = "sha256-bK6VYiMorwGHi25q9tPu5r/YQCMPc6NWBirLAx6oCPg=";
-    })
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa499/xsa499-4.20-5.patch";
-      hash = "sha256-Vj5vcpVvuuExK2NvDBP6vrIRjTPsgx8Yv4zVt0ftUnk=";
-    })
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa499/xsa499-4.20-6.patch";
-      hash = "sha256-uTBGP6WMfE5FipQ7rzOKY7FxCztQUV6jqbROtHZozoY=";
-    })
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa499/xsa499-4.20-7.patch";
-      hash = "sha256-UsAx2ouUB/BNpCQCObvcjj+DLPuRBqyxlI6QQsPXtWM=";
-    })
-
-    # XSA #500
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa500.patch";
-      hash = "sha256-cQc/wkaP1wK7dzbdFHmvghK6BcokWrTAtxk0gtIDQ1E=";
-    })
-
-    # XSA #501
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa501.patch";
-      hash = "sha256-RvdzD/ZCpC7VT0/zzksse/dN5FBl8W/Gul04XQ5EyRg=";
-    })
-
-    # XSA #502
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa502-4.21.patch";
-      hash = "sha256-hSmNtFwYValGoTwYgoz0uXhQiQV/pZ4rsYRNLAY5Ak8=";
-    })
-
-    # XSA #503
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa503.patch";
-      hash = "sha256-l64K1LetmngV1V8Vy9fH4dEvUdlAH6ukXwuEMetg83A=";
-    })
-
-    # XSA #504
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa504.patch";
-      hash = "sha256-uMygMaI824GW0L4obYXfaRIiohiBZpwAvoEO6slOZCE=";
-    })
-
-    # XSA #505
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa505.patch";
-      hash = "sha256-eZ8CdfzU5Ylyi6BpB4fOJh0VHfHeWa2JsRyhH+sh400=";
-    })
-
-    # XSA #506
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa506.patch";
-      hash = "sha256-8unTCZE3Kh2JfqDSG5KrgRx9zL9J9pcVzeXnO5vUM0Y=";
-    })
-
-    # XSA #507
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa507.patch";
-      hash = "sha256-3d5h0evLsFzTAyEDYstvPFcqYLirIZxMWPSY5L868ng=";
-    })
-
-    # XSA #508
-    (fetchpatch {
-      url = "https://xenbits.xenproject.org/xsa/xsa508.patch";
-      hash = "sha256-KhNGfEsVxlxFbnlO+yeeIj8Eo75NE9QOPmg0xlt8U6U=";
-    })
-
-    # patch `libxl` to search for `qemu-system-i386` properly. (Before 4.21)
+  ]
+  ++ optionals (versionOlder finalAttrs.version "4.21") [
+    # Patch `libxl` to search for `qemu-system-i386` properly.
     (fetchpatch {
       url = "https://github.com/xen-project/xen/commit/f6281291704aa356489f4bd927cc7348a920bd01.diff?full_index=1";
       hash = "sha256-LH+68kxH/gxdyh45kYCPxKwk+9cztLrScpC2pCNQV2M=";
@@ -438,8 +205,8 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "xen-project";
     repo = "xen";
-    tag = "RELEASE-4.20.3";
-    hash = "sha256-+qTHIsDD2A5lVwmpJ7artnzdviT1XN05CYeu7JFxfqc=";
+    tag = "RELEASE-${finalAttrs.version}";
+    hash = "sha256-dO9Y7W6NIVbXwWdlnQawpmV6MtemczwgbZdi9gGu190=";
   };
 
   strictDeps = true;

pkgs/by-name/xm/xmoto/package.nix

@@ -40,6 +40,7 @@ stdenv.mkDerivation rec {
     cmake
     gettext
     makeWrapper
+    pkg-config
   ];
 
   buildInputs = [

pkgs/by-name/xs/xscreensaver/package.nix

@@ -35,11 +35,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xscreensaver";
-  version = "6.13";
+  version = "6.15";
 
   src = fetchurl {
     url = "https://www.jwz.org/xscreensaver/xscreensaver-${finalAttrs.version}.tar.gz";
-    hash = "sha256-pzFI3SFifP8udRMcjgwbCV8zTGiyLgnzbTfMJ5YRZ7c=";
+    hash = "sha256-0uaH5WJj+/2Pyh+5zHyTMf1PCWq1fT90glZf4BLDYtM=";
   };
 
   outputs = [
@@ -93,6 +93,8 @@ stdenv.mkDerivation (finalAttrs: {
     # Fix installation paths for GTK resources.
     sed -e 's%@GTK_DATADIR@%@datadir@% ; s%@PO_DATADIR@%@datadir@%' \
       -i driver/Makefile.in po/Makefile.in.in
+    # Fix installation path for PAM.
+    sed -e 's%PAM_ROOT	= /etc%PAM_ROOT	= @sysconfdir@%' -i driver/Makefile.in
   '';
 
   configureFlags = [

pkgs/data/fonts/gdouros/default.nix

@@ -2,6 +2,7 @@
   lib,
   stdenvNoCC,
   fetchzip,
+  installFonts,
 }:
 
 let
@@ -70,7 +71,7 @@ let
       hash,
       description,
     }:
-    stdenvNoCC.mkDerivation rec {
+    stdenvNoCC.mkDerivation {
       inherit pname version;
 
       src = fetchzip {
@@ -79,14 +80,10 @@ let
         inherit hash;
       };
 
-      installPhase = ''
-        runHook preInstall
+      nativeBuildInputs = [ installFonts ];
 
-        mkdir -p $out/share/{fonts/opentype,doc/${pname}}
-        mv *.otf                -t "$out/share/fonts/opentype"
-        mv *.{odt,ods,pdf,xlsx}       -t "$out/share/doc/${pname}"  || true  # install docs if any
-
-        runHook postInstall
+      postInstall = ''
+        install -Dm644 *.{odt,ods,pdf,xlsx} -t "$out/share/doc/${pname}" || true  # install docs if any
       '';
 
       meta = {

pkgs/data/fonts/liberation-fonts/default.nix

@@ -3,6 +3,7 @@
   stdenv,
   fetchFromGitHub,
   fontforge,
+  installFonts,
   python3,
 }:
 let
@@ -10,6 +11,7 @@ let
 
   commonNativeBuildInputs = [
     fontforge
+    installFonts
     python3
   ];
   common =
@@ -34,12 +36,14 @@ let
       inherit nativeBuildInputs postPatch;
 
       installPhase = ''
-        find . -name '*.ttf' -exec install -m444 -Dt $out/share/fonts/truetype {} \;
+        runHook preInstall
 
         for i in ${toString docsToInstall}; do
           # not all docs exist in all versions
           install -m444 -Dt $out/share/doc/${pname}-${version} $i || true
         done
+
+        runHook postInstall
       '';
 
       meta = {

pkgs/data/fonts/lohit-fonts/default.nix

@@ -2,6 +2,7 @@
   lib,
   stdenvNoCC,
   fetchurl,
+  installFonts,
 }:
 let
   fonts = {
@@ -110,19 +111,13 @@ let
         inherit hash;
       };
 
-      installPhase = ''
-        runHook preInstall
+      nativeBuildInputs = [
+        installFonts
+      ];
 
-        mkdir -p $out/share/fonts/truetype
-        cp -v *.ttf $out/share/fonts/truetype/
-
-        mkdir -p $out/etc/fonts/conf.d
-        cp -v *.conf $out/etc/fonts/conf.d
-
-        mkdir -p "$out/share/doc/lohit-${pname}"
-        cp -v ChangeLog* COPYRIGHT* "$out/share/doc/lohit-${pname}/"
-
-        runHook postInstall
+      postInstall = ''
+        install -Dm644 *.conf -t $out/etc/fonts/conf.d
+        install -Dm644 ChangeLog* COPYRIGHT* -t "$out/share/doc/lohit-${pname}/"
       '';
 
       meta = {

pkgs/data/fonts/mplus-outline-fonts/default.nix

@@ -3,6 +3,7 @@
   stdenvNoCC,
   fetchurl,
   fetchFromGitHub,
+  installFonts,
 }:
 
 let
@@ -18,13 +19,7 @@ in
       hash = "sha256-ROuXO0tq/1dN5FTbEF3cI+Z0nCKUc0vZyx4Nc05M3Xk=";
     };
 
-    installPhase = ''
-      runHook preInstall
-
-      install -m444 -Dt $out/share/fonts/truetype/${pname} *.ttf
-
-      runHook postInstall
-    '';
+    nativeBuildInputs = [ installFonts ];
 
     meta = {
       description = "M+ Outline Fonts (legacy OSDN release)";
@@ -46,15 +41,7 @@ in
       hash = "sha256-jzDDUs1dKjqNjsMeTA2/4vm+akIisnOuE2mPQS7IDSA=";
     };
 
-    installPhase = ''
-      runHook preInstall
-
-      mkdir -p $out/share/fonts/{truetype,opentype}/${pname}
-      mv fonts/ttf/* $out/share/fonts/truetype/${pname}
-      mv fonts/otf/* $out/share/fonts/opentype/${pname}
-
-      runHook postInstall
-    '';
+    nativeBuildInputs = [ installFonts ];
 
     meta = {
       description = "M+ Outline Fonts (GitHub release)";

pkgs/data/fonts/open-relay/default.nix

@@ -2,6 +2,7 @@
   lib,
   stdenvNoCC,
   fetchFromGitHub,
+  installFonts,
 }:
 
 let
@@ -19,14 +20,11 @@ let
         hash = "sha256-UI3JP/5Os7xWB07dwlEpWuDMG1awpsOr0itmZpxGtyg=";
       };
 
-      installPhase = ''
-        runHook preInstall
+      sourceRoot = "${finalAttrs.src.name}/${directory}";
+      nativeBuildInputs = [ installFonts ];
 
-
-        install -D -m444 -t "$out/share/fonts/truetype" "${directory}/"*.ttf
-        install -D -m644 -t "$out/share/doc/${finalAttrs.pname}-${finalAttrs.version}" "${directory}/OFL.txt"
-
-        runHook postInstall
+      postInstall = ''
+        install -D -m644 -t "$out/share/doc/${finalAttrs.pname}-${finalAttrs.version}" OFL.txt
       '';
 
       meta = {
@@ -67,7 +65,7 @@ lib.mapAttrs mkOpenRelayTypeface {
         supports many scripts and a large number of Unicode blocks as well as
         constructed scripts as encoded in the Under-ConScript Unicode Registry,
         pseudographics and semigraphics, and tons of private use characters. It
-        has been superceded by Fairfax HD but is still maintained.
+        has been superseded by Fairfax HD but is still maintained.
       '';
     };
   };

pkgs/desktops/gnome/extensions/update-extensions.py

@@ -340,7 +340,7 @@ def serialize_extensions(processed_extensions: list[dict[str, Any]]) -> None:
                 out.write("[ ")
             else:
                 out.write(", ")
-            # Dump each extension into a single-line string forst
+            # Dump each extension into a single-line string first
             serialized_extension = json.dumps(extension, ensure_ascii=False)
             # Inject line breaks for each supported version
             for version in supported_versions:

pkgs/development/ocaml-modules/ppx_import/default.nix

@@ -1,6 +1,7 @@
 {
   lib,
   fetchurl,
+  fetchpatch,
   ocaml,
   buildDunePackage,
   ounit,
@@ -38,6 +39,14 @@ buildDunePackage {
       ."${version}";
   };
 
+  patches =
+    # Compatibility with OCaml 5.5
+    # See https://github.com/ocaml-ppx/ppx_import/pull/107
+    lib.optional (lib.versionAtLeast ocaml.version "5.5") (fetchpatch {
+      url = "https://github.com/ocaml-ppx/ppx_import/commit/ddff918dc86f3d336af60ea67de4a0b5373b7409.patch";
+      hash = "sha256-PenEGKPltvzJY//YoU5iNqZIYGz3vBGXZONBcwgQgjY=";
+    });
+
   propagatedBuildInputs = [
     ppxlib
   ];
@@ -54,6 +63,5 @@ buildDunePackage {
     description = "Syntax extension for importing declarations from interface files";
     license = lib.licenses.mit;
     homepage = "https://github.com/ocaml-ppx/ppx_import";
-    broken = lib.versionAtLeast ocaml.version "5.5";
   };
 }

pkgs/development/python-modules/django-phonenumber-field/default.nix

@@ -9,56 +9,61 @@
   phonenumbers,
   phonenumberslite,
   python,
+  pytestCheckHook,
+  pytest-django,
   setuptools-scm,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "django-phonenumber-field";
-  version = "8.4.0";
+  version = "8.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
-    owner = "stefanfoulis";
+    owner = "django-phonenumber-field";
     repo = "django-phonenumber-field";
-    tag = version;
-    hash = "sha256-k6r+yy1o7pFJx/9yxI5AbsfRPIhycAc0oXBHyV0GHec=";
+    tag = finalAttrs.version;
+    hash = "sha256-hTrW7QeZPBsln9iHh9sV7JMQxdJ9cFcAq4ETyhxFGv0=";
   };
 
+  nativeBuildInputs = [ gettext ];
+
   build-system = [ setuptools-scm ];
 
   # Upstream doesn't put phonenumbers in dependencies but the package doesn't
   # make sense without either of the two optional dependencies. Since, in
   # Nixpkgs, phonenumberslite depends on phonenumbers, add the latter
   # unconditionally.
-  dependencies = [ django ] ++ optional-dependencies.phonenumbers;
+  dependencies = [ django ] ++ finalAttrs.passthru.optional-dependencies.phonenumbers;
 
-  nativeCheckInputs = [
-    babel
-    djangorestframework
-  ];
-
-  nativeBuildInputs = [ gettext ];
-
-  pythonImportsCheck = [ "phonenumber_field" ];
-
-  checkPhase = ''
-    ${python.interpreter} -m django test --settings tests.settings
-  '';
+  optional-dependencies = {
+    babel = [ babel ];
+    phonenumbers = [ phonenumbers ];
+    phonenumberslite = [ phonenumberslite ];
+  };
 
   preBuild = ''
     ${python.interpreter} -m django compilemessages
   '';
 
-  optional-dependencies = {
-    phonenumbers = [ phonenumbers ];
-    phonenumberslite = [ phonenumberslite ];
-  };
+  nativeCheckInputs = [
+    djangorestframework
+    pytestCheckHook
+    pytest-django
+  ]
+  ++ lib.concatAttrValues finalAttrs.passthru.optional-dependencies;
+
+  preCheck = ''
+    export DJANGO_SETTINGS_MODULE=tests.settings
+  '';
+
+  pythonImportsCheck = [ "phonenumber_field" ];
 
   meta = {
     description = "Django model and form field for normalised phone numbers using python-phonenumbers";
-    homepage = "https://github.com/stefanfoulis/django-phonenumber-field/";
-    changelog = "https://github.com/stefanfoulis/django-phonenumber-field/releases/tag/${src.tag}";
+    homepage = "https://github.com/django-phonenumber-field/django-phonenumber-field";
+    changelog = "https://github.com/django-phonenumber-field/django-phonenumber-field/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ sephi ];
   };
-}
+})

pkgs/development/python-modules/elevenlabs/default.nix

@@ -14,14 +14,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "elevenlabs";
-  version = "2.59.0";
+  version = "2.60.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "elevenlabs";
     repo = "elevenlabs-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TDBCwKpyPmpdTcsq2UTwsE4qsVVHJMchh+gSChHjiZU=";
+    hash = "sha256-Foe5icwDNVD/g/tss1UG9wzrzXmECzXr/3Ql6yA4YHY=";
   };
 
   build-system = [ poetry-core ];

pkgs/development/python-modules/strawberry-graphql-django/default.nix

@@ -35,14 +35,14 @@
 
 buildPythonPackage rec {
   pname = "strawberry-graphql-django";
-  version = "0.86.0";
+  version = "0.86.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "strawberry-graphql";
     repo = "strawberry-django";
     tag = version;
-    hash = "sha256-pWhYJsfUxfK8FH9jSPWhd2P89AVYM5Z3wA2OlU6XLRo=";
+    hash = "sha256-eksnTz6o9bj6LcmflwVEnnBkjLj3GyNG9NAX/IietmI=";
   };
 
   postPatch = ''

pkgs/games/quake3/content/hires.nix

@@ -40,7 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
   # According to the @diegoulloao (see https://github.com/diegoulloao/ioquake3-mac-install/issues/23#issuecomment-2817031996)
   # quake3-live-sounds.pk3 is likely a custom repack from https://www.moddb.com/addons/quake-live-announcers-pack
   # zpack-weapons.pk3 is an amalgamation of multiple mods, where he can't recall which ones he used exactly.
-  # It still makes him the authorative source for these file.
+  # It still makes him the authoritative source for these file.
   ioquake3_mac = fetchFromGitHub {
     owner = "diegoulloao";
     repo = "ioquake3-mac-install";

pkgs/misc/barebox/default.nix

@@ -93,7 +93,7 @@ let
         with lib;
         {
           homepage = "https://www.barebox.org";
-          description = "Swiss Army Knive for bare metal";
+          description = "Swiss Army Knife for bare metal";
           license = licenses.gpl2Only;
           maintainers = with maintainers; [ emantor ];
         }

pkgs/os-specific/bsd/freebsd/pkgs/pciconf.nix

@@ -28,6 +28,6 @@ mkDerivation {
     cp "${pciutils}/share/pci.ids" "$out/share/pci.ids"
   '';
 
-  meta.platorms = lib.platforms.freebsd;
+  meta.platforms = lib.platforms.freebsd;
   meta.mainProgram = "pciconf";
 }

pkgs/os-specific/bsd/freebsd/pkgs/vidcontrol.nix

@@ -6,5 +6,5 @@ mkDerivation {
   path = "usr.sbin/vidcontrol";
 
   meta.mainProgram = "vidcontrol";
-  meta.platorms = lib.platforms.freebsd;
+  meta.platforms = lib.platforms.freebsd;
 }

pkgs/os-specific/cygwin/newlib-cygwin/default.nix

@@ -154,7 +154,7 @@
           "--enable-static"
           "--disable-dumper"
           "--with-cross-bootstrap"
-          # if gm4 or gnum4 are in PATH, they would be be preferred to nixpkgs m4
+          # if gm4 or gnum4 are in PATH, they would be preferred to nixpkgs m4
           "M4=m4"
         ];
 

pkgs/os-specific/darwin/sourceRelease/update-source-releases.sh

@@ -104,7 +104,7 @@ git clone --branch "$tag" https://github.com/apple-oss-distributions/distributio
 cd distribution-macOS
 
 for package in "${packages[@]}"; do
-    # If the tag exists in `release.json`, use that as an optimization to avoid downloading unnecessarily from Github.
+    # If the tag exists in `release.json`, use that as an optimization to avoid downloading unnecessarily from GitHub.
     packageTag=$(jq -r --arg package "$package" '.projects[] | select(.project == $package) | .tag' release.json)
     packageCommit=$(git ls-tree -d HEAD "$package" | awk '{print $3}')
 

pkgs/os-specific/linux/kernel/common-config.nix

@@ -670,7 +670,7 @@ let
 
       USB_EHCI_ROOT_HUB_TT = yes; # Root Hub Transaction Translators
       USB_EHCI_TT_NEWSCHED = yes; # Improved transaction translator scheduling
-      USB_HIDDEV = yes; # USB Raw HID Devices (like monitor controls and Uninterruptable Power Supplies)
+      USB_HIDDEV = yes; # USB Raw HID Devices (like monitor controls and Uninterruptible Power Supplies)
 
       # default to dual role mode
       USB_DWC2_DUAL_ROLE = yes;
@@ -1393,7 +1393,7 @@ let
         HOTPLUG_PCI_ACPI = yes; # PCI hotplug using ACPI
         HOTPLUG_PCI_PCIE = yes; # PCI-Expresscard hotplug support
 
-        # Allos PCIe devices report errors with Advanced Error Reporting (AER).
+        # Allows PCIe devices to report errors with Advanced Error Reporting (AER).
         PCIEAER = yes;
         ACPI_APEI_PCIEAER = yes;
 

pkgs/os-specific/linux/lvm2/common.nix

@@ -17,7 +17,7 @@
   udev,
   udevCheckHook,
   onlyLib ? stdenv.hostPlatform.isStatic,
-  # Otherwise we have a infinity recursion during static compilation
+  # Otherwise we have an infinite recursion during static compilation
   enableUtilLinux ? !stdenv.hostPlatform.isStatic,
   util-linux,
   enableVDO ? false,

pkgs/os-specific/linux/nvidia-x11/fabricmanager.nix

@@ -76,7 +76,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     homepage = "https://www.nvidia.com/object/unix.html";
-    description = "Fabricmanager daemon for NVLink intialization and control";
+    description = "Fabricmanager daemon for NVLink initialization and control";
     license = lib.licenses.unfreeRedistributable;
     platforms = nvidia_x11.meta.platforms;
     mainProgram = "nv-fabricmanager";

pkgs/os-specific/linux/trelay/default.nix

@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   meta = {
-    description = "For relaying IP packets between two devices to build a IP bridge between them";
+    description = "For relaying IP packets between two devices to build an IP bridge between them";
     longDescription = ''
       A kernel module that relays ethernet packets between two devices (similar to a bridge),
       but without any MAC address checks.

pkgs/servers/home-assistant/custom-components/README.md

@@ -12,7 +12,7 @@ function arguments. Pass them into `dependencies` for them to
 be available to Home Assistant.
 
 Out-of-tree components need to use Python packages from
-`home-assistant.python3Pacakges` as to not introduce conflicting package
+`home-assistant.python3Packages` as to not introduce conflicting package
 versions into the Python environment.
 
 

pkgs/servers/home-assistant/custom-components/cover_time_based/package.nix

@@ -9,13 +9,13 @@
 buildHomeAssistantComponent (finalAttrs: {
   owner = "Sese-Schneider";
   domain = "cover_time_based";
-  version = "4.9.0";
+  version = "4.10.0";
 
   src = fetchFromGitHub {
     inherit (finalAttrs) owner;
     repo = "ha-cover-time-based";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-NVws0FAB88PfgyfrCymyeHVSMzBc/KyILmVOyUQ8T7g=";
+    hash = "sha256-FF4adRPojKOaA8SkWvFtz5Qem/rmz+5ZTAoT+o60aPg=";
   };
 
   nativeCheckInputs = [

pkgs/servers/home-assistant/update-component-packages.py

@@ -148,7 +148,7 @@ def repository_root() -> str:
     return os.path.abspath(sys.argv[0] + "/../../../..")
 
 
-# For a package attribute and and an extra, check if the package exposes it via passthru.optional-dependencies
+# For a package attribute and an extra, check if the package exposes it via passthru.optional-dependencies
 def has_extra(package: str, extra: str):
     cmd = [
         "nix-instantiate",

pkgs/servers/http/tengine/default.nix

@@ -1,159 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  openssl,
-  zlib,
-  pcre2,
-  libxcrypt,
-  libxml2,
-  libxslt,
-  replaceVars,
-  gd,
-  geoip,
-  gperftools,
-  jemalloc,
-  nixosTests,
-  withDebug ? false,
-  withMail ? false,
-  withStream ? false,
-  modules ? [ ],
-  ...
-}:
-
-let
-  inherit (lib) optional optionals optionalString;
-in
-stdenv.mkDerivation rec {
-  version = "3.1.0";
-  pname = "tengine";
-
-  src = fetchFromGitHub {
-    owner = "alibaba";
-    repo = pname;
-    rev = version;
-    hash = "sha256-cClSNBlresMHqJrqSFWvUo589TlwJ2tL5FWJG9QBuis=";
-  };
-
-  buildInputs = [
-    openssl
-    zlib
-    pcre2
-    libxcrypt
-    libxml2
-    libxslt
-    gd
-    geoip
-    gperftools
-    jemalloc
-  ]
-  ++ lib.concatMap (mod: mod.buildInputs or [ ]) modules;
-
-  patches = [
-    ../nginx/nix-etag-1.15.4.patch
-    ./check-resolv-conf.patch
-    ../nginx/nix-skip-check-logs-path.patch
-  ];
-
-  postPatch = ''
-    substituteInPlace src/http/ngx_http_core_module.c \
-      --replace-fail '@nixStoreDir@' "$NIX_STORE" \
-      --replace-fail '@nixStoreDirLen@' "''${#NIX_STORE}"
-  '';
-
-  configureFlags = [
-    "--with-http_ssl_module"
-    "--with-http_v2_module"
-    "--with-http_realip_module"
-    "--with-http_addition_module"
-    "--with-http_xslt_module"
-    "--with-http_geoip_module"
-    "--with-http_sub_module"
-    "--with-http_dav_module"
-    "--with-http_flv_module"
-    "--with-http_mp4_module"
-    "--with-http_gunzip_module"
-    "--with-http_gzip_static_module"
-    "--with-http_auth_request_module"
-    "--with-http_random_index_module"
-    "--with-http_secure_link_module"
-    "--with-http_degradation_module"
-    "--with-http_stub_status_module"
-    "--with-threads"
-    "--with-pcre-jit"
-    "--with-http_slice_module"
-    "--with-select_module"
-    "--with-poll_module"
-    "--with-google_perftools_module"
-    "--with-jemalloc"
-    "--http-log-path=/var/log/nginx/access.log"
-    "--error-log-path=/var/log/nginx/error.log"
-    "--pid-path=/var/log/nginx/nginx.pid"
-    "--http-client-body-temp-path=/var/cache/nginx/client_body"
-    "--http-proxy-temp-path=/var/cache/nginx/proxy"
-    "--http-fastcgi-temp-path=/var/cache/nginx/fastcgi"
-    "--http-uwsgi-temp-path=/var/cache/nginx/uwsgi"
-    "--http-scgi-temp-path=/var/cache/nginx/scgi"
-  ]
-  ++ optionals withDebug [
-    "--with-debug"
-  ]
-  ++ optionals withMail [
-    "--with-mail"
-    "--with-mail_ssl_module"
-  ]
-  ++ optionals (!withMail) [
-    "--without-mail_pop3_module"
-    "--without-mail_imap_module"
-    "--without-mail_smtp_module"
-  ]
-  ++ optionals withStream [
-    "--with-stream"
-    "--with-stream_ssl_module"
-    "--with-stream_realip_module"
-    "--with-stream_geoip_module"
-    "--with-stream_ssl_preread_module"
-    "--with-stream_sni"
-  ]
-  ++ optionals (!withStream) [
-    "--without-stream_limit_conn_module"
-    "--without-stream_access_module"
-    "--without-stream_geo_module"
-    "--without-stream_map_module"
-    "--without-stream_split_clients_module"
-    "--without-stream_return_module"
-    "--without-stream_upstream_hash_module"
-    "--without-stream_upstream_least_conn_module"
-    "--without-stream_upstream_random_module"
-    "--without-stream_upstream_zone_module"
-  ]
-  ++ optional (gd != null) "--with-http_image_filter_module"
-  ++ optional (with stdenv.hostPlatform; isLinux || isFreeBSD) "--with-file-aio"
-  ++ map (mod: "--add-module=${mod}") modules;
-
-  env.NIX_CFLAGS_COMPILE =
-    "-I${libxml2.dev}/include/libxml2 -Wno-error=implicit-fallthrough -Wno-unterminated-string-initialization"
-    + optionalString stdenv.hostPlatform.isDarwin " -Wno-error=deprecated-declarations -Wno-unused-but-set-variable";
-
-  preConfigure = (lib.concatMapStringsSep "\n" (mod: mod.preConfigure or "") modules);
-
-  enableParallelBuilding = true;
-
-  postInstall = ''
-    mv $out/sbin $out/bin
-  '';
-
-  passthru = {
-    inherit modules;
-    tests = nixosTests.nginx-variants.tengine;
-  };
-
-  meta = {
-    description = "Web server based on Nginx and has many advanced features, originated by Taobao";
-    mainProgram = "nginx";
-    homepage = "https://tengine.taobao.org";
-    license = lib.licenses.bsd2;
-    platforms = lib.platforms.all;
-    maintainers = with lib.maintainers; [ izorkin ];
-  };
-}

pkgs/servers/icingaweb2/theme-lsd/default.nix

@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = {
-    description = "Psychadelic theme for IcingaWeb 2";
+    description = "Psychedelic theme for IcingaWeb 2";
     homepage = "https://github.com/Mikesch-mp/icingaweb2-theme-lsd";
     license = lib.licenses.publicDomain;
     platforms = lib.platforms.all;

pkgs/servers/monitoring/nagios-plugins/check_wmi_plus/default.nix

@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   pname = "check-wmi-plus";
   version = "1.65";
 
-  # Upstream has been moved from Github to tarballs on the author's website.
+  # Upstream has been moved from GitHub to tarballs on the author's website.
   # See https://edcint.co.nz/checkwmiplus/releases/
   src = fetchFromGitHub {
     owner = "speartail";

pkgs/servers/sql/postgresql/ext/smlar.nix

@@ -18,7 +18,7 @@ postgresqlBuildExtension {
   makeFlags = [ "USE_PGXS=1" ];
 
   meta = {
-    description = "Compute similary of any one-dimensional arrays";
+    description = "Compute similarity of any one-dimensional arrays";
     homepage = "http://sigaev.ru/git/gitweb.cgi?p=smlar.git";
     platforms = postgresql.meta.platforms;
     license = lib.licenses.bsd2;

pkgs/servers/web-apps/wordpress/packages/default.nix

@@ -116,7 +116,7 @@ let
         }
       ) { };
 
-      # Filter out all characters that might occur in a version string but that that are not allowed
+      # Filter out all characters that might occur in a version string but that are not allowed
       # in store paths.
       filterWPString =
         builtins.replaceStrings

pkgs/stdenv/darwin/default.nix

@@ -339,7 +339,7 @@ assert bootstrapTools.passthru.isFromBootstrapFiles or false; # sanity check
   # Create a stage with the bootstrap tools. This will be used to build the subsequent stages and
   # build up the standard environment.
   #
-  # Note: Each stage depends only on the the packages in `prevStage`. If a package is not to be
+  # Note: Each stage depends only on the packages in `prevStage`. If a package is not to be
   # rebuilt, it should be passed through by inheriting it.
   (
     prevStage:

pkgs/stdenv/tests/inputDerivationRequiredSystemFeatures.nix

@@ -31,7 +31,7 @@ stdenv.mkDerivation {
       to a lack of system features, then that builder would also not be able to
       build `<originalDerivation>.inputDerivation`.
 
-      That was an aribtrary (and probably accidental) limitation. Building
+      That was an arbitrary (and probably accidental) limitation. Building
       input derivations never requires any system features. This test checks to
       make sure that that limitation no longer exists.
     '';

pkgs/tools/package-management/nix/modular/packaging/everything.nix

@@ -126,7 +126,7 @@ stdenv.mkDerivation (finalAttrs: {
   dontBuild = true;
 
   /**
-    `doCheck` controles whether tests are added as build gate for the combined package.
+    `doCheck` controls whether tests are added as build gate for the combined package.
     This includes both the unit tests and the functional tests, but not the
     integration tests that run in CI (the flake's `hydraJobs` and some of the `checks`).
   */

pkgs/tools/text/multitran/libfacet/default.nix

@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     homepage = "https://multitran.sourceforge.net/";
-    description = "Multitran lib: enchanced locale facets";
+    description = "Multitran lib: enhanced locale facets";
     license = lib.licenses.gpl2Only;
     platforms = lib.platforms.linux;
   };