Merge staging-next-26.05 into staging-26.05

maintainers/maintainer-list.nix

@@ -19805,7 +19805,7 @@
     name = "Nindouja";
   };
   ninelore = {
-    email = "9l+nix@9lo.re";
+    email = "9l@9lo.re";
     matrix = "@9lore:tchncs.de";
     github = "ninelore";
     githubId = 21343557;

nixos/tests/all-tests.nix

@@ -329,8 +329,16 @@ in
   };
   castopod = runTest ./castopod.nix;
   centrifugo = runTest ./centrifugo.nix;
-  ceph-multi-node = runTestOn [ "aarch64-linux" "x86_64-linux" ] ./ceph-multi-node.nix;
-  ceph-single-node = runTestOn [ "aarch64-linux" "x86_64-linux" ] ./ceph-single-node.nix;
+  ceph-multi-node-bluestore = runTestOn [ "aarch64-linux" "x86_64-linux" ] (
+    import ./ceph-multi-node-bluestore.nix { }
+  );
+  ceph-multi-node-bluestore-cephfs = runTestOn [ "aarch64-linux" "x86_64-linux" ] (
+    import ./ceph-multi-node-bluestore.nix { withCephfs = true; }
+  );
+  ceph-multi-node-deprecated-filestore = runTestOn [
+    "aarch64-linux"
+    "x86_64-linux"
+  ] ./ceph-multi-node-deprecated-filestore.nix;
   ceph-single-node-bluestore = runTestOn [
     "aarch64-linux"
     "x86_64-linux"
@@ -339,6 +347,10 @@ in
     "aarch64-linux"
     "x86_64-linux"
   ] ./ceph-single-node-bluestore-dmcrypt.nix;
+  ceph-single-node-deprecated-filestore = runTestOn [
+    "aarch64-linux"
+    "x86_64-linux"
+  ] ./ceph-single-node-deprecated-filestore.nix;
   certmgr = import ./certmgr.nix { inherit pkgs runTest; };
   cfssl = runTestOn [ "aarch64-linux" "x86_64-linux" ] ./cfssl.nix;
   cgit = runTest ./cgit.nix;

nixos/tests/ceph-multi-node-bluestore.nix

@@ -0,0 +1,602 @@
+# Multi-node Ceph cluster test using BlueStore OSDs.
+{
+  withCephfs ? false,
+}:
+{ lib, ... }:
+let
+  # Development knobs:
+  # * `defaultTimeout` caps how long every `waitUntilSucceeds` waits before it
+  #   gives up. Lower it for faster feedback while iterating on the test.
+  # * When `investigateFailures` is true, a `waitUntilSucceeds` that times out
+  #   does NOT fail the test; instead it dumps each machine's full (multi-boot)
+  #   journal and `/var/log/ceph` into a `test-failure-investigation/` directory
+  #   inside the test's working/output directory and then lets the test succeed,
+  #   so the collected logs end up in the build's store path for convenient
+  #   reading. Keep this `false` for real CI runs.
+  defaultTimeout = 60;
+  investigateFailures = false;
+
+  cfg = {
+    clusterId = "066ae264-2a5d-4729-8001-6ad265f50b03";
+    monA = {
+      name = "a";
+      ip = "192.168.1.1";
+    };
+    osd0 = {
+      name = "0";
+      ip = "192.168.1.2";
+      key = "AQBCEJNa3s8nHRAANvdsr93KqzBznuIWm2gOGg==";
+      uuid = "55ba2294-3e24-478f-bee0-9dca4c231dd9";
+    };
+    osd1 = {
+      name = "1";
+      ip = "192.168.1.3";
+      key = "AQBEEJNac00kExAAXEgy943BGyOpVH1LLlHafQ==";
+      uuid = "5e97a838-85b6-43b0-8950-cb56d554d1e5";
+    };
+    osd2 = {
+      name = "2";
+      ip = "192.168.1.4";
+      key = "AQAdyhZeIaUlARAAGRoidDAmS6Vkp546UFEf5w==";
+      uuid = "ea999274-13d0-4dd5-9af9-ad25a324f72f";
+    };
+    # Client that mounts CephFS using the in-kernel client.
+    kclient = {
+      ip = "192.168.1.5";
+    };
+    # Client that mounts CephFS using the `ceph-fuse` client.
+    fuseclient = {
+      ip = "192.168.1.6";
+    };
+  };
+  generateCephConfig =
+    { daemonConfig }:
+    {
+      enable = true;
+      global = {
+        fsid = cfg.clusterId;
+        monHost = cfg.monA.ip;
+        monInitialMembers = cfg.monA.name;
+      };
+    }
+    // daemonConfig;
+
+  generateHost =
+    { cephConfig, networkConfig }:
+    { pkgs, ... }:
+    {
+      virtualisation = {
+        # A single raw block device per machine, consumed directly by BlueStore
+        # as `/dev/vdb`. Because BlueStore owns the raw device (there is no
+        # filesystem to mount), the OSD's on-disk state survives a hard
+        # crash/reboot and the OSD comes back automatically.
+        emptyDiskImages = [ 20480 ];
+        vlans = [ 1 ];
+      };
+
+      networking = networkConfig;
+
+      # TODO: Why do we need any of these? Shouldn't Ceph work independent of `systemPackages`? Only `sudo` and `ceph` are used in our own test code.
+      environment.systemPackages = with pkgs; [
+        bash
+        sudo
+        ceph
+        netcat
+      ];
+
+      services.ceph = cephConfig;
+
+      # Restart limits are unsuitable for daemons that must recover from
+      # arbitrary crash/network downtimes.
+      # Ensure all daemons have infinite restart limits.
+      # Otherwise the tests are flaky based on timing.
+      systemd.services =
+        let
+          daemonUnits =
+            lib.concatMap
+              (
+                daemonType:
+                lib.optionals (cephConfig.${daemonType}.enable or false) (
+                  map (daemon: "ceph-${daemonType}-${daemon}") cephConfig.${daemonType}.daemons
+                )
+              )
+              [
+                "mon"
+                "mgr"
+                "osd"
+                "mds"
+              ];
+        in
+        lib.genAttrs daemonUnits (_: {
+          serviceConfig.Restart = lib.mkForce "always";
+          serviceConfig.RestartSec = lib.mkForce "1";
+          unitConfig.StartLimitIntervalSec = lib.mkForce 0; # Ensure Restart=always is always honoured (no start limit)
+        });
+    };
+
+  networkMonA = {
+    dhcpcd.enable = false;
+    interfaces.eth1.ipv4.addresses = lib.mkOverride 0 [
+      {
+        address = cfg.monA.ip;
+        prefixLength = 24;
+      }
+    ];
+    firewall = {
+      allowedTCPPorts = [
+        6789
+        3300
+      ];
+      allowedTCPPortRanges = [
+        {
+          from = 6800;
+          to = 7300;
+        }
+      ];
+    };
+  };
+  cephConfigMonA = generateCephConfig {
+    daemonConfig = {
+      mon = {
+        enable = true;
+        daemons = [ cfg.monA.name ];
+      };
+      mgr = {
+        enable = true;
+        daemons = [ cfg.monA.name ];
+      };
+    }
+    # The MDS daemon (which provides CephFS) is only configured in the CephFS
+    # variant of this test.
+    // lib.optionalAttrs withCephfs {
+      mds = {
+        enable = true;
+        daemons = [ cfg.monA.name ];
+      };
+    };
+  };
+
+  networkOsd = osd: {
+    dhcpcd.enable = false;
+    interfaces.eth1.ipv4.addresses = lib.mkOverride 0 [
+      {
+        address = osd.ip;
+        prefixLength = 24;
+      }
+    ];
+    firewall = {
+      allowedTCPPortRanges = [
+        {
+          from = 6800;
+          to = 7300;
+        }
+      ];
+    };
+  };
+
+  cephConfigOsd =
+    osd:
+    generateCephConfig {
+      daemonConfig = {
+        osd = {
+          enable = true;
+          daemons = [ osd.name ];
+        };
+      };
+    };
+
+  # The CephFS clients only need the ceph client tooling. They do not run any
+  # ceph daemon, so they only get a minimal ceph config pointing at the mon.
+  # The in-kernel ceph filesystem module is part of the default kernel and is
+  # autoloaded by `mount -t ceph`, so no extra modules are needed.
+  networkClient = client: {
+    dhcpcd.enable = false;
+    interfaces.eth1.ipv4.addresses = lib.mkOverride 0 [
+      {
+        address = client.ip;
+        prefixLength = 24;
+      }
+    ];
+  };
+
+  cephConfigClient = generateCephConfig { daemonConfig = { }; };
+
+  generateClientHost =
+    { networkConfig }:
+    { pkgs, ... }:
+    {
+      virtualisation = {
+        vlans = [ 1 ];
+      };
+
+      networking = networkConfig;
+
+      environment.systemPackages = with pkgs; [
+        ceph
+      ];
+
+      services.ceph = cephConfigClient;
+    };
+
+  # Python prelude that must run before any test code.
+  # It replaces every machine's `wait_until_succeeds()` with a wrapper that
+  # implements the "development knobs" above.
+  helperScript = ''
+    import os
+    import shutil
+
+    DEFAULT_TIMEOUT = ${toString defaultTimeout}
+    INVESTIGATE_FAILURES = ${if investigateFailures then "True" else "False"}
+
+    def collect_failure_investigation(failed_machine, command):
+        out_dir = os.path.join(driver.out_dir, "test-failure-investigation")
+        os.makedirs(out_dir, exist_ok=True)
+        with open(os.path.join(out_dir, "README.txt"), "w") as f:
+            f.write(
+                "wait_until_succeeds timed out on machine "
+                f"'{failed_machine.name}' running command:\n{command}\n"
+            )
+        for m in machines:
+            try:
+                m.execute("journalctl --no-pager --boot=all > /tmp/journal.txt 2>&1; true")
+                m.copy_from_machine("/tmp/journal.txt", out_dir)
+                shutil.move(
+                    os.path.join(out_dir, "journal.txt"),
+                    os.path.join(out_dir, f"{m.name}-journal.txt"),
+                )
+            except Exception as e:
+                m.log(f"could not collect journal: {e}")
+            try:
+                m.copy_from_machine("/var/log/ceph", out_dir)
+                shutil.move(
+                    os.path.join(out_dir, "ceph"),
+                    os.path.join(out_dir, f"{m.name}-ceph-logs"),
+                )
+            except Exception as e:
+                m.log(f"could not collect /var/log/ceph: {e}")
+
+    # Replace the test driver's `wait_until_succeeds` with our wrapper.
+    machine_class = machines[0].__class__
+    orig_wait_until_succeeds = machine_class.wait_until_succeeds
+
+    def patched_wait_until_succeeds(self, command: str, timeout: int = DEFAULT_TIMEOUT) -> str:
+        try:
+            return orig_wait_until_succeeds(self, command, timeout=timeout)
+        except Exception:
+            if not INVESTIGATE_FAILURES:
+                raise
+            self.log(
+                "wait_until_succeeds timed out; collecting logs into "
+                "test-failure-investigation/ and ending the test as 'passed' "
+                "(investigateFailures = true)"
+            )
+            collect_failure_investigation(self, command)
+            os._exit(0)
+
+    # Use `setattr` (rather than a plain attribute assignment) so the type
+    # checker does not treat this as implicitly shadowing the driver's
+    # `wait_until_succeeds`; the replacement is intentional.
+    setattr(machine_class, "wait_until_succeeds", patched_wait_until_succeeds)
+  '';
+
+  # Set up the cluster (mon, mgr, BlueStore OSDs) and perform a
+  # hard whole-cluster crash/recovery (failover) test.
+  #
+  # Based on the "manual deployment" approach from:
+  # https://docs.ceph.com/en/tentacle/install/manual-deployment/
+  baseScript = ''
+    start_all()
+
+    monA.wait_for_unit("network.target")
+    osd0.wait_for_unit("network.target")
+    osd1.wait_for_unit("network.target")
+    osd2.wait_for_unit("network.target")
+
+    # Bootstrap ceph-mon daemon
+    monA.succeed(
+        "sudo -u ceph ceph-authtool --create-keyring /tmp/ceph.mon.keyring --gen-key -n mon. --cap mon 'allow *'",
+        "sudo -u ceph ceph-authtool --create-keyring /etc/ceph/ceph.client.admin.keyring --gen-key -n client.admin --cap mon 'allow *' --cap osd 'allow *' --cap mds 'allow *' --cap mgr 'allow *'",
+        "sudo -u ceph ceph-authtool /tmp/ceph.mon.keyring --import-keyring /etc/ceph/ceph.client.admin.keyring",
+        "monmaptool --create --add ${cfg.monA.name} ${cfg.monA.ip} --fsid ${cfg.clusterId} /tmp/monmap",
+        "sudo -u ceph ceph-mon --mkfs -i ${cfg.monA.name} --monmap /tmp/monmap --keyring /tmp/ceph.mon.keyring",
+        "sudo -u ceph mkdir -p /var/lib/ceph/mgr/ceph-${cfg.monA.name}/",
+        "sudo -u ceph touch /var/lib/ceph/mon/ceph-${cfg.monA.name}/done",
+        "systemctl start ceph-mon-${cfg.monA.name}",
+    )
+    monA.wait_for_unit("ceph-mon-${cfg.monA.name}")
+    monA.succeed("ceph mon enable-msgr2")
+    monA.succeed("ceph config set mon auth_allow_insecure_global_id_reclaim false")
+
+    # Can't check ceph status until a mon is up
+    monA.succeed("ceph -s | grep 'mon: 1 daemons'")
+
+    # Start the ceph-mgr daemon, it has no deps and hardly any setup
+    monA.succeed(
+        "ceph auth get-or-create mgr.${cfg.monA.name} mon 'allow profile mgr' osd 'allow *' mds 'allow *' > /var/lib/ceph/mgr/ceph-${cfg.monA.name}/keyring",
+        "sync",  # to ensure shell redirection above is durable
+        "systemctl start ceph-mgr-${cfg.monA.name}",
+    )
+    monA.wait_for_unit("ceph-mgr-a")
+    monA.wait_until_succeeds("ceph -s | grep 'quorum ${cfg.monA.name}'")
+    monA.wait_until_succeeds("ceph -s | grep 'mgr: ${cfg.monA.name}(active,'")
+
+    # Send the admin keyring to the OSD machines.
+    monA.succeed("cp /etc/ceph/ceph.client.admin.keyring /tmp/shared")
+    osd0.succeed("cp /tmp/shared/ceph.client.admin.keyring /etc/ceph")
+    osd1.succeed("cp /tmp/shared/ceph.client.admin.keyring /etc/ceph")
+    osd2.succeed("cp /tmp/shared/ceph.client.admin.keyring /etc/ceph")
+
+    # Bootstrap the BlueStore OSDs.
+    osd0.succeed(
+        "mkdir -p /var/lib/ceph/osd/ceph-${cfg.osd0.name}",
+        "echo bluestore > /var/lib/ceph/osd/ceph-${cfg.osd0.name}/type",
+        "ln -sf /dev/vdb /var/lib/ceph/osd/ceph-${cfg.osd0.name}/block",
+        "ceph-authtool --create-keyring /var/lib/ceph/osd/ceph-${cfg.osd0.name}/keyring --name osd.${cfg.osd0.name} --add-key ${cfg.osd0.key}",
+        'echo \'{"cephx_secret": "${cfg.osd0.key}"}\' | ceph osd new ${cfg.osd0.uuid} -i -',
+    )
+    osd1.succeed(
+        "mkdir -p /var/lib/ceph/osd/ceph-${cfg.osd1.name}",
+        "echo bluestore > /var/lib/ceph/osd/ceph-${cfg.osd1.name}/type",
+        "ln -sf /dev/vdb /var/lib/ceph/osd/ceph-${cfg.osd1.name}/block",
+        "ceph-authtool --create-keyring /var/lib/ceph/osd/ceph-${cfg.osd1.name}/keyring --name osd.${cfg.osd1.name} --add-key ${cfg.osd1.key}",
+        'echo \'{"cephx_secret": "${cfg.osd1.key}"}\' | ceph osd new ${cfg.osd1.uuid} -i -',
+    )
+    osd2.succeed(
+        "mkdir -p /var/lib/ceph/osd/ceph-${cfg.osd2.name}",
+        "echo bluestore > /var/lib/ceph/osd/ceph-${cfg.osd2.name}/type",
+        "ln -sf /dev/vdb /var/lib/ceph/osd/ceph-${cfg.osd2.name}/block",
+        "ceph-authtool --create-keyring /var/lib/ceph/osd/ceph-${cfg.osd2.name}/keyring --name osd.${cfg.osd2.name} --add-key ${cfg.osd2.key}",
+        'echo \'{"cephx_secret": "${cfg.osd2.key}"}\' | ceph osd new ${cfg.osd2.uuid} -i -',
+    )
+
+    # We `sync` so that the config survives the forced crashes below.
+    osd0.succeed(
+        "ceph-osd -i ${cfg.osd0.name} --mkfs --osd-uuid ${cfg.osd0.uuid}",
+        "chown -R ceph:ceph /var/lib/ceph/osd",
+        "sync",
+        "systemctl start ceph-osd-${cfg.osd0.name}",
+    )
+    osd1.succeed(
+        "ceph-osd -i ${cfg.osd1.name} --mkfs --osd-uuid ${cfg.osd1.uuid}",
+        "chown -R ceph:ceph /var/lib/ceph/osd",
+        "sync",
+        "systemctl start ceph-osd-${cfg.osd1.name}",
+    )
+    osd2.succeed(
+        "ceph-osd -i ${cfg.osd2.name} --mkfs --osd-uuid ${cfg.osd2.uuid}",
+        "chown -R ceph:ceph /var/lib/ceph/osd",
+        "sync",
+        "systemctl start ceph-osd-${cfg.osd2.name}",
+    )
+    monA.wait_until_succeeds("ceph osd stat | grep -e '3 osds: 3 up[^,]*, 3 in'")
+    monA.wait_until_succeeds("ceph -s | grep 'mgr: ${cfg.monA.name}(active,'")
+    monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")
+
+    monA.succeed(
+        "ceph osd pool create multi-node-test 32 32",
+        "ceph osd pool ls | grep 'multi-node-test'",
+
+        # A pool that has no application associated with it stays unhealthy in
+        # state POOL_APP_NOT_ENABLED. Ceph only auto-associates an application
+        # for pools it manages itself, such as CephFS data/metadata pools
+        # (application "cephfs") and the pools RGW creates (application "rgw"); see
+        # https://docs.ceph.com/en/tentacle/rados/operations/pools/#associating-a-pool-with-an-application
+        # This is a plain RADOS pool, so we have to associate an application
+        # with it ourselves. We use the custom application name "nixos-test".
+        "ceph osd pool application enable multi-node-test nixos-test",
+
+        "ceph osd pool rename multi-node-test multi-node-other-test",
+        "ceph osd pool ls | grep 'multi-node-other-test'",
+    )
+    monA.succeed("ceph osd pool set multi-node-other-test size 2")
+    monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")
+    monA.wait_until_succeeds("! ceph -s | grep -e 'unknown' -e 'pgs inactive'")
+    monA.fail(
+        "ceph osd pool ls | grep 'multi-node-test'",
+        "ceph osd pool delete multi-node-other-test multi-node-other-test --yes-i-really-really-mean-it",
+    )
+
+    # Shut down ceph on all machines in a very unpolite way
+    monA.crash()
+    osd0.crash()
+    osd1.crash()
+    osd2.crash()
+
+    # Start it up
+    osd0.start()
+    osd1.start()
+    osd2.start()
+    monA.start()
+
+    # Ensure the cluster comes back up again.
+    monA.wait_until_succeeds("ceph -s | grep 'mon: 1 daemons'")
+    monA.wait_until_succeeds("ceph -s | grep 'quorum ${cfg.monA.name}'")
+    monA.wait_until_succeeds("ceph osd stat | grep -e '3 osds: 3 up[^,]*, 3 in'")
+    monA.wait_until_succeeds("ceph -s | grep 'mgr: ${cfg.monA.name}(active,'")
+    monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")
+
+    # Verify the recovery.
+    monA.wait_until_succeeds("! ceph -s | grep -e 'unknown' -e 'pgs inactive'", timeout=60)
+  '';
+
+  # For `withCephfs = true`, after the regular failover, test CephFS and mounts:
+  # * bring up an MDS
+  # * create a CephFS
+  # * mount it via in-kernel ("kclient") and a `ceph-fuse` ("fuseclient")
+  #   from 2 different nodes
+  # * verify bidirectional visibility of file changes
+  # * performs another crash/recovery test (without crashing the clients)
+  # * verifiy the mounts survive and keep working.
+  cephfsScript = ''
+    kclient.wait_for_unit("network.target")
+    fuseclient.wait_for_unit("network.target")
+
+    # Start the ceph-mds daemon (which provides CephFS), after creating
+    # its keyring and data dir.
+    monA.succeed(
+        "sudo -u ceph mkdir -p /var/lib/ceph/mds/ceph-${cfg.monA.name}/",
+        "ceph auth get-or-create mds.${cfg.monA.name} mon 'allow profile mds' mgr 'allow profile mds' osd 'allow rwx' mds 'allow' > /var/lib/ceph/mds/ceph-${cfg.monA.name}/keyring",
+        "chown ceph:ceph /var/lib/ceph/mds/ceph-${cfg.monA.name}/keyring",
+        "sync",  # to ensure config survives the forced crashes below
+        "systemctl start ceph-mds-${cfg.monA.name}",
+    )
+    monA.wait_for_unit("ceph-mds-${cfg.monA.name}")
+
+    # Create a CephFS.
+    monA.succeed(
+        "ceph osd pool create cephfs-data 32 32",
+        "ceph osd pool create cephfs-metadata 32 32",
+        "ceph fs new cephfs cephfs-metadata cephfs-data",
+    )
+    # Wait for the MDS to claim the filesystem and become active.
+    monA.wait_until_succeeds("ceph fs status cephfs | grep -e 'active'", timeout=60)
+
+    # Distribute the admin keyring (and a plain secret file for the kernel
+    # client) to both client machines, so that they can authenticate.
+    monA.succeed(
+        "cp /etc/ceph/ceph.client.admin.keyring /tmp/shared",
+        "ceph-authtool -p /etc/ceph/ceph.client.admin.keyring > /tmp/shared/admin.secret",
+    )
+    kclient.succeed("cp /tmp/shared/ceph.client.admin.keyring /etc/ceph")
+    fuseclient.succeed("cp /tmp/shared/ceph.client.admin.keyring /etc/ceph")
+    kclient.succeed("cp /tmp/shared/admin.secret /etc/ceph/admin.secret")
+
+    # Mount CephFS on the kernel client.
+    # We force the messenger v2 protocol via "ms_mode=secure"; the cluster
+    # has msgr2 enabled (see "ceph mon enable-msgr2" above) and the legacy v1
+    # protocol apparently does not reconnect reliably after the servers are restarted.
+    # The msgr2 monitor listens on port 3300 (instead of legacy v1 port 6789),
+    # so we have to point the device string at that port explicitly.
+    # `recover_session=clean` makes the kernel client automatically reconnect
+    # (discarding its stale session) after the whole cluster has been down,
+    # which would otherwise leave the mount blocklisted and hanging forever.
+    # Real CephFS use may not prefer hanging `recover_session=clean`, and
+    # prefer manual de-blocklisting to avoid any failed OS syscalls,
+    # but for this test, discarding stale sessions is good enough.
+    kclient.succeed("mkdir -p /mnt/cephfs")
+    kclient.wait_until_succeeds(
+        "mount -t ceph ${cfg.monA.ip}:3300:/ /mnt/cephfs -o name=admin,secretfile=/etc/ceph/admin.secret,ms_mode=secure,recover_session=clean"
+    )
+    kclient.succeed("mountpoint /mnt/cephfs")
+
+    # Mount CephFS on the FUSE client using ceph-fuse.
+    fuseclient.succeed("mkdir -p /mnt/cephfs")
+    fuseclient.wait_until_succeeds(
+        "ceph-fuse --id admin -m ${cfg.monA.ip}:6789 /mnt/cephfs"
+    )
+    fuseclient.succeed("mountpoint /mnt/cephfs")
+
+    # Both clients mount the same CephFS, so files written by one must be
+    # visible to the other. Verify this in both directions.
+
+    # Kernel client writes, FUSE client reads.
+    kclient.succeed("echo 'written by kclient' > /mnt/cephfs/from-kclient")
+    fuseclient.wait_until_succeeds(
+        "test \"$(cat /mnt/cephfs/from-kclient)\" = 'written by kclient'"
+    )
+
+    # FUSE client writes, kernel client reads.
+    fuseclient.succeed("echo 'written by fuseclient' > /mnt/cephfs/from-fuseclient")
+    kclient.wait_until_succeeds(
+        "test \"$(cat /mnt/cephfs/from-fuseclient)\" = 'written by fuseclient'"
+    )
+
+    # Crash test with CephFS.
+    # We deliberately do not crash the CephFS clients here: Their mounts must
+    # survive the (temporary) outage of the ceph servers and resume working
+    # once the cluster is healthy again.
+    monA.crash()
+    osd0.crash()
+    osd1.crash()
+    osd2.crash()
+
+    # Start it up
+    osd0.start()
+    osd1.start()
+    osd2.start()
+    monA.start()
+
+    # Ensure the cluster comes back up again.
+    # See the note above on why this uses `wait_until_succeeds`.
+    monA.wait_until_succeeds("ceph -s | grep 'mon: 1 daemons'")
+    monA.wait_until_succeeds("ceph -s | grep 'quorum ${cfg.monA.name}'")
+    monA.wait_until_succeeds("ceph osd stat | grep -e '3 osds: 3 up[^,]*, 3 in'")
+    monA.wait_until_succeeds("ceph -s | grep 'mgr: ${cfg.monA.name}(active,'")
+
+    monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'", timeout=60)
+
+    # Ensure the MDS/CephFS comes back up again, too.
+    monA.wait_for_unit("ceph-mds-${cfg.monA.name}")
+    monA.wait_until_succeeds("ceph fs status cephfs | grep -e 'active'", timeout=60)
+    monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")
+
+    # The clients kept running across the outage, so their CephFS mounts
+    # should still be present and should reconnect automatically.
+    kclient.succeed("mountpoint /mnt/cephfs")
+    fuseclient.succeed("mountpoint /mnt/cephfs")
+
+    # The files written before the crash must still have the correct content.
+    kclient.wait_until_succeeds(
+        "test \"$(cat /mnt/cephfs/from-fuseclient)\" = 'written by fuseclient'"
+    )
+    fuseclient.wait_until_succeeds(
+        "test \"$(cat /mnt/cephfs/from-kclient)\" = 'written by kclient'"
+    )
+
+    # Ensure the mounts are still writable after recovery, in both directions.
+    kclient.succeed("echo 'written by kclient after recovery' > /mnt/cephfs/from-kclient-2")
+    fuseclient.wait_until_succeeds(
+        "test \"$(cat /mnt/cephfs/from-kclient-2)\" = 'written by kclient after recovery'"
+    )
+    fuseclient.succeed("echo 'written by fuseclient after recovery' > /mnt/cephfs/from-fuseclient-2")
+    kclient.wait_until_succeeds(
+        "test \"$(cat /mnt/cephfs/from-fuseclient-2)\" = 'written by fuseclient after recovery'"
+    )
+  '';
+
+in
+{
+  name = "basic-multi-node-ceph-cluster-bluestore" + lib.optionalString withCephfs "-cephfs";
+  meta = {
+    maintainers = with lib.maintainers; [
+      nh2
+      benaryorg
+    ];
+  };
+
+  nodes = {
+    monA = generateHost {
+      cephConfig = cephConfigMonA;
+      networkConfig = networkMonA;
+    };
+    osd0 = generateHost {
+      cephConfig = cephConfigOsd cfg.osd0;
+      networkConfig = networkOsd cfg.osd0;
+    };
+    osd1 = generateHost {
+      cephConfig = cephConfigOsd cfg.osd1;
+      networkConfig = networkOsd cfg.osd1;
+    };
+    osd2 = generateHost {
+      cephConfig = cephConfigOsd cfg.osd2;
+      networkConfig = networkOsd cfg.osd2;
+    };
+  }
+  # CephFS client machines are only needed when testing CephFS.
+  // lib.optionalAttrs withCephfs {
+    kclient = generateClientHost {
+      networkConfig = networkClient cfg.kclient;
+    };
+    fuseclient = generateClientHost {
+      networkConfig = networkClient cfg.fuseclient;
+    };
+  };
+
+  testScript =
+    { ... }:
+    ''
+      ${helperScript}
+      ${baseScript}
+      ${lib.optionalString withCephfs cephfsScript}
+    '';
+}

nixos/tests/ceph-multi-node-deprecated-filestore.nix

@@ -1,3 +1,4 @@
+# Tests the legacy FileStore OSD backend.
 { lib, ... }:
 let
   cfg = {
@@ -159,6 +160,7 @@ let
       # Start the ceph-mgr daemon, it has no deps and hardly any setup
       monA.succeed(
           "ceph auth get-or-create mgr.${cfg.monA.name} mon 'allow profile mgr' osd 'allow *' mds 'allow *' > /var/lib/ceph/mgr/ceph-${cfg.monA.name}/keyring",
+          "sync",  # to ensure shell redirection above is durable
           "systemctl start ceph-mgr-${cfg.monA.name}",
       )
       monA.wait_for_unit("ceph-mgr-a")
@@ -194,20 +196,23 @@ let
           'echo \'{"cephx_secret": "${cfg.osd2.key}"}\' | ceph osd new ${cfg.osd2.uuid} -i -',
       )
 
-      # Initialize the OSDs with regular filestore
+      # We `sync` so that the config survives the forced crashes below.
       osd0.succeed(
           "ceph-osd -i ${cfg.osd0.name} --mkfs --osd-uuid ${cfg.osd0.uuid}",
           "chown -R ceph:ceph /var/lib/ceph/osd",
+          "sync",
           "systemctl start ceph-osd-${cfg.osd0.name}",
       )
       osd1.succeed(
           "ceph-osd -i ${cfg.osd1.name} --mkfs --osd-uuid ${cfg.osd1.uuid}",
           "chown -R ceph:ceph /var/lib/ceph/osd",
+          "sync",
           "systemctl start ceph-osd-${cfg.osd1.name}",
       )
       osd2.succeed(
           "ceph-osd -i ${cfg.osd2.name} --mkfs --osd-uuid ${cfg.osd2.uuid}",
           "chown -R ceph:ceph /var/lib/ceph/osd",
+          "sync",
           "systemctl start ceph-osd-${cfg.osd2.name}",
       )
       monA.wait_until_succeeds("ceph osd stat | grep -e '3 osds: 3 up[^,]*, 3 in'")
@@ -258,7 +263,7 @@ let
     '';
 in
 {
-  name = "basic-multi-node-ceph-cluster";
+  name = "basic-multi-node-ceph-cluster-deprecated-filestore";
   meta = with lib.maintainers; {
     maintainers = [ lejonet ];
   };

nixos/tests/ceph-single-node-deprecated-filestore.nix

@@ -269,7 +269,7 @@ let
   '';
 in
 {
-  name = "basic-single-node-ceph-cluster";
+  name = "basic-single-node-ceph-cluster-deprecated-filestore";
   meta = with lib.maintainers; {
     maintainers = [
       lejonet

pkgs/applications/networking/browsers/firefox/packages/firefox.nix

@@ -9,10 +9,10 @@
 
 buildMozillaMach rec {
   pname = "firefox";
-  version = "152.0.5";
+  version = "152.0.6";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "6cf2dc7f28a6a3430f2866df4ca35063cbadf234c82a34fa651e02d909e5741e50cd986fef1bd97d486b51244cb639b2b103514688347bf7f94fd16d264cc4f2";
+    sha512 = "c4d877837d7007fb611c38d49d9b6dd3bc4c5c9ca900b54e722e140ce7ecd0924f69b5cedc7f8c1fe602e7efe1d7159b019de27999e29235cd631821bb13e6b0";
   };
 
   meta = {

pkgs/by-name/au/autoprefixer/package.nix

@@ -2,7 +2,7 @@
   lib,
   stdenv,
   nodejs,
-  pnpm_9,
+  pnpm_10,
   fetchPnpmDeps,
   pnpmConfigHook,
   fetchFromGitHub,
@@ -11,26 +11,26 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "autoprefixer";
-  version = "10.4.24";
+  version = "10.5.0";
 
   src = fetchFromGitHub {
     owner = "postcss";
     repo = "autoprefixer";
-    rev = finalAttrs.version;
-    hash = "sha256-9XZWkBDqkaBbIHq3wIbo4neToPM+NCxi9c1AyVqmnvc=";
+    tag = finalAttrs.version;
+    hash = "sha256-s152v9sIuQLvhfPsZvQa+O9UhoASgm/e8dnz0t4pP3A=";
   };
 
   nativeBuildInputs = [
     nodejs
     pnpmConfigHook
-    pnpm_9
+    pnpm_10
   ];
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
-    pnpm = pnpm_9;
-    fetcherVersion = 3;
-    hash = "sha256-PPYyEsc0o5ufBexUdiX9EJLEsQZ0wX7saBzxJGsnseU=";
+    pnpm = pnpm_10;
+    fetcherVersion = 4;
+    hash = "sha256-Sxt4vtdlMdXxXqt22hfZJskj8mkB5t85IZ5BsbCoDF4=";
   };
 
   installPhase = ''
@@ -60,9 +60,9 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Parse CSS and add vendor prefixes to CSS rules using values from the Can I Use website";
     homepage = "https://github.com/postcss/autoprefixer";
-    changelog = "https://github.com/postcss/autoprefixer/releases/tag/${finalAttrs.version}";
+    changelog = "https://github.com/postcss/autoprefixer/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     mainProgram = "autoprefixer";
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.skohtv ];
   };
 })

pkgs/by-name/ce/ceph/ceph.nix

@@ -393,10 +393,12 @@ stdenv.mkDerivation {
     pythonEnv = ceph-python-env;
     tests = {
       inherit (nixosTests)
-        ceph-multi-node
-        ceph-single-node
+        ceph-multi-node-bluestore
+        ceph-multi-node-bluestore-cephfs
+        ceph-multi-node-deprecated-filestore
         ceph-single-node-bluestore
         ceph-single-node-bluestore-dmcrypt
+        ceph-single-node-deprecated-filestore
         ;
     };
   };

pkgs/by-name/ce/ceph/src.nix

@@ -6,11 +6,11 @@
 
 applyPatches (final: {
   pname = "ceph-src";
-  version = "20.2.1";
+  version = "20.2.2";
 
   src = fetchurl {
     url = "https://download.ceph.com/tarballs/ceph-${final.version}.tar.gz";
-    hash = "sha256-3neaoBQYOTiLsgHgqdYiuEM5guHE17/DrGEXt2OXJUI=";
+    hash = "sha256-G76ZcCdadt4KP7Ry0yzqPrbi1ydZlrcZb2IhGd2Fd1M=";
   };
 
   patches = [

pkgs/by-name/da/daed/package.nix

@@ -1,9 +1,9 @@
 {
-  pnpm_9,
+  pnpm_10,
   fetchPnpmDeps,
   pnpmConfigHook,
   nodejs,
-  stdenv,
+  stdenvNoCC,
   clang,
   buildGoModule,
   fetchFromGitHub,
@@ -11,39 +11,45 @@
   _experimental-update-script-combinators,
   nix-update-script,
 }:
-
 let
+  pnpm = pnpm_10;
+in
+buildGoModule (finalAttrs: {
   pname = "daed";
-  version = "1.0.0";
-
+  version = "1.27.0";
   src = fetchFromGitHub {
     owner = "daeuniverse";
     repo = "daed";
-    tag = "v${version}";
-    hash = "sha256-WaybToEcFrKOcJ+vfCTc9uyHkTPOrcAEw9lZFEIBPgY=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-CvxCDdOLsdSlFfmoR+C1IUt9HvkAV5JsWGI94DLXB+U=";
     fetchSubmodules = true;
   };
 
-  web = stdenv.mkDerivation {
-    inherit pname version src;
+  sourceRoot = "${finalAttrs.src.name}/wing";
+
+  web = stdenvNoCC.mkDerivation {
+    inherit (finalAttrs) pname version src;
 
     pnpmDeps = fetchPnpmDeps {
-      inherit
+      inherit (finalAttrs)
         pname
         version
         src
         ;
-      pnpm = pnpm_9;
+      inherit pnpm;
       fetcherVersion = 3;
-      hash = "sha256-FBZk7qeYNi7JX99Sk1qe52YUE8GUYINJKid0mEBXMjU=";
+      hash = "sha256-2g/M+4XI1EM+c7W82qyfH8C7sX+Y0QACiSpn65Vei4g=";
     };
 
     nativeBuildInputs = [
       nodejs
       pnpmConfigHook
-      pnpm_9
+      pnpm
     ];
 
+    strictDeps = true;
+    __structuredAttrs = true;
+
     buildPhase = ''
       runHook preBuild
 
@@ -55,25 +61,14 @@ let
     installPhase = ''
       runHook preInstall
 
-      cp -R dist $out
+      mkdir -p $out
+      cp -R apps/web/dist/* $out
 
       runHook postInstall
     '';
   };
-in
-
-buildGoModule rec {
-  inherit
-    pname
-    version
-    src
-    web
-    ;
-
-  sourceRoot = "${src.name}/wing";
-
-  vendorHash = "sha256-+uf8PJQvsJMUyQ6W+nDfdwrxBO2YRUL328ajTJpVDZk=";
 
+  vendorHash = "sha256-l7jgMvrbpOY2+cvnc0e5cvSgKVm4GcWC+bPbff+PE80=";
   proxyVendor = true;
 
   nativeBuildInputs = [ clang ];
@@ -84,9 +79,9 @@ buildGoModule rec {
     substituteInPlace Makefile \
       --replace-fail /bin/bash /bin/sh
 
-    # ${web} does not have write permission
+    # ${finalAttrs.web} does not have write permission
     mkdir dist
-    cp -r ${web}/* dist
+    cp -r ${finalAttrs.web}/* dist
     chmod -R 755 dist
   '';
 
@@ -96,8 +91,8 @@ buildGoModule rec {
     make CFLAGS="-D__REMOVE_BPF_PRINTK -fno-stack-protector -Wno-unused-command-line-argument" \
       NOSTRIP=y \
       WEB_DIST=dist \
-      AppName=${pname} \
-      VERSION=${version} \
+      AppName=daed \
+      VERSION=${finalAttrs.version} \
       OUTPUT=$out/bin/daed \
       bundle
 
@@ -110,21 +105,28 @@ buildGoModule rec {
       --replace-fail /usr/bin $out/bin
   '';
 
-  passthru.updateScript = _experimental-update-script-combinators.sequence [
-    (nix-update-script {
-      attrPath = "daed.web";
-    })
-    (nix-update-script {
-      extraArgs = [ "--version=skip" ];
-    })
-  ];
+  passthru = {
+    inherit (finalAttrs) web;
+    updateScript = _experimental-update-script-combinators.sequence [
+      (nix-update-script {
+        attrPath = "daed.web";
+        extraArgs = [ "--use-github-releases" ];
+      })
+      (nix-update-script {
+        extraArgs = [ "--version=skip" ];
+      })
+    ];
+  };
 
   meta = {
     description = "Modern dashboard with dae";
     homepage = "https://github.com/daeuniverse/daed";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ oluceps ];
+    maintainers = with lib.maintainers; [
+      oluceps
+      ccicnce113424
+    ];
     platforms = lib.platforms.linux;
     mainProgram = "daed";
   };
-}
+})

pkgs/by-name/dr/drawy/package.nix

@@ -12,16 +12,17 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "drawy";
-  version = "1.0.0";
+  version = "1.0.1";
 
   src = fetchFromGitLab {
     domain = "invent.kde.org";
     owner = "graphics";
     repo = "drawy";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-K070SiIf2bj1r44tixUZbsLYDxT65lEW0g68ENg3ZiE=";
+    hash = "sha256-Y6CAdHgcCK9lIae+CwqSGml+FAvVzLzyIAKdw85dKmQ=";
   };
 
+  __structuredAttrs = true;
   strictDeps = true;
 
   nativeBuildInputs = [
@@ -31,32 +32,46 @@ stdenv.mkDerivation (finalAttrs: {
     shared-mime-info
   ];
 
-  buildInputs = [
-    qt6.qtbase
-    qt6.qttools
-
-    kdePackages.extra-cmake-modules
-    kdePackages.kconfig
-    kdePackages.kconfigwidgets
-    kdePackages.kcoreaddons
-    kdePackages.kcrash
-    kdePackages.kdoctools
-    kdePackages.ki18n
-    kdePackages.kiconthemes
-    kdePackages.kwidgetsaddons
-    kdePackages.kxmlgui
-    kdePackages.syntax-highlighting
-  ];
+  buildInputs =
+    (with qt6; [
+      qtbase
+      qttools
+    ])
+    ++ (with kdePackages; [
+      extra-cmake-modules
+      kconfig
+      kconfigwidgets
+      kcoreaddons
+      kcrash
+      kdoctools
+      ki18n
+      kiconthemes
+      kwidgetsaddons
+      kxmlgui
+      syntax-highlighting
+    ]);
 
   passthru.updateScript = nix-update-script { };
 
   meta = {
     description = "Handy and infinite brainstorming tool";
     homepage = "https://apps.kde.org/drawy/";
-    license = lib.licenses.gpl3Only;
+    changelog = "https://invent.kde.org/graphics/drawy/-/blob/v${finalAttrs.version}/CHANGELOG.md";
+    license = with lib.licenses; [
+      bsd2
+      bsd3
+      cc-by-sa-40
+      cc0
+      gpl2Plus
+      gpl3Plus
+      lgpl2Plus
+      mit
+      ofl
+    ];
     maintainers = with lib.maintainers; [
-      yiyu
       quarterstar
+      sigmasquadron
+      yiyu
     ];
     mainProgram = "drawy";
     platforms = lib.platforms.all;

pkgs/by-name/fl/flood/package.nix

@@ -3,7 +3,7 @@
   buildNpmPackage,
   fetchFromGitHub,
   nixosTests,
-  pnpm_9,
+  pnpm_10,
   fetchPnpmDeps,
   pnpmConfigHook,
   nix-update-script,
@@ -19,7 +19,7 @@ buildNpmPackage (finalAttrs: {
     hash = "sha256-gSjkpAGkvgRRh8WDpL/F7fS8KDxHRJUuWVqHGcFEGAc=";
   };
 
-  nativeBuildInputs = [ pnpm_9 ];
+  nativeBuildInputs = [ pnpm_10 ];
   npmConfigHook = pnpmConfigHook;
   npmDeps = finalAttrs.pnpmDeps;
   dontNpmPrune = true;
@@ -29,9 +29,9 @@ buildNpmPackage (finalAttrs: {
       version
       src
       ;
-    pnpm = pnpm_9;
-    fetcherVersion = 3;
-    hash = "sha256-Los6faQJ4it0fVqtRvPvYmyANK4qBcwHxmZBacR7Q6E=";
+    pnpm = pnpm_10;
+    fetcherVersion = 4;
+    hash = "sha256-yNRC5sCBn002gxUfHMUvh3DZeVYOokfz4MTvqXR2MzI=";
   };
 
   passthru = {

pkgs/by-name/ge/gelly/package.nix

@@ -19,16 +19,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "gelly";
-  version = "1.9.0";
+  version = "1.9.2";
 
   src = fetchFromGitHub {
     owner = "Fingel";
     repo = "gelly";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DIE+IjFpDG9kCEwN3XLlxYLWduGZ7G8LXjVDnl6pp1w=";
+    hash = "sha256-WcnPNsFvQ/CqvAYxWeoAWZiJ62bOgLe8fGNeyh2B+8s=";
   };
 
-  cargoHash = "sha256-iOJMUyjqYBl5muWZCnKRRgpAf5lTPgANjohTHa1cfGY=";
+  cargoHash = "sha256-0ZKW2xxjTn84mWBrK6zhw/uiOnd5sD+URu2O0a1TZW8=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/go/google-chrome/package.nix

@@ -179,11 +179,11 @@ let
 
   linux = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "150.0.7871.114";
+    version = "150.0.7871.124";
 
     src = fetchurl {
       url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb";
-      hash = "sha256-DxnmjcpXSEljLiUinxWFPSvqwz+gZJj+7UPzRii8LVM=";
+      hash = "sha256-TGNqvSrB9vMXb1K7QBCqN9ErWsBMQNyp6rEZksHHXNw=";
     };
 
     # With strictDeps on, some shebangs were not being patched correctly
@@ -289,11 +289,11 @@ let
 
   darwin = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "150.0.7871.115";
+    version = "150.0.7871.125";
 
     src = fetchurl {
-      url = "http://dl.google.com/release2/chrome/acd57hhfrcygivr2dnxpq2q56zka_150.0.7871.115/GoogleChrome-150.0.7871.115.dmg";
-      hash = "sha256-AB16I7Tl/E4F4ydXHSLeyoKAWNwP7JSL0wLyrUvn3FE=";
+      url = "http://dl.google.com/release2/chrome/kjpfr4hhda65lyoxi6u4o42bke_150.0.7871.125/GoogleChrome-150.0.7871.125.dmg";
+      hash = "sha256-ulMe+AP65d9VB2O7vhLnSX+dUfC7XqWd4GaOEQXGBac=";
     };
 
     dontPatch = true;

pkgs/by-name/in/incus/lts.nix

@@ -1,155 +1,8 @@
 import ./generic.nix {
-  hash = "sha256-7s2gc+78O8jKypVe1itaUrsLPa2mLjNgUUrR/cv7ITA=";
-  version = "7.0.0";
-  vendorHash = "sha256-6irMB3hpWcxDuMQBxWXnhMLAOwTAl63JX6JJZMQXf5E=";
+  hash = "sha256-Ivj0vWKuhgb4VvyxcuB+CXsJ02zwo65rqxD5/cLUmSk=";
+  version = "7.0.1";
+  vendorHash = "sha256-F3LhWVjckU0ypgOppHztjR6hDB6enHxoDmRWcSDfwQE=";
   lts = true;
-  patches = fetchpatch2: [
-    (fetchpatch2 {
-      name = "doc-devices-disk_Fix-broken-link.patch";
-      url = "https://github.com/lxc/incus/commit/faa636b70c05a5cca0346492a0586d5747e4b117.patch?full_index=1";
-      hash = "sha256-UsfzSeLJq0B9xDmd124ITzFBJzg2w1xXNK6TavQ5iMs=";
-    })
-    (fetchpatch2 {
-      name = "incusd-instance-qemu_Fix-version-detection-for-qemu-kvm.patch";
-      url = "https://github.com/lxc/incus/commit/a5f50d36eaa41580f2233b05936bd29fe1b15100.patch?full_index=1";
-      hash = "sha256-Qwu2oljB7COZB2m3W/9Y5wCCZyxvLj4ZUHcNqtoDGzk=";
-    })
-    (fetchpatch2 {
-      name = "incusd_Re-introduce-core-scheduling-detection.patch";
-      url = "https://github.com/lxc/incus/commit/1e6ce18e8cd92b5b3eb4346e7bd27fd4a7d1fb9b.patch?full_index=1";
-      hash = "sha256-RLy8bcod55g8vtXxChte4oalApw7d/gZg8No6BUZQS0=";
-    })
-    (fetchpatch2 {
-      name = "incusd-instance-lxc_Fix-swap=false-failure.patch";
-      url = "https://github.com/lxc/incus/commit/5f2cdf7545c5398290dc507313de9ee547fe803f.patch?full_index=1";
-      hash = "sha256-Ux6mm8Y4q68fj//hG7k+bXMjqhGDOxGNm64De1pwcYY=";
-    })
-    (fetchpatch2 {
-      name = "incusd-forknet_Persist-DHCPv6-client-DUID-across-restarts.patch";
-      url = "https://github.com/lxc/incus/commit/47377e345930e77d3fbce29d037fc7dbd6823dcf.patch?full_index=1";
-      hash = "sha256-CWaNaDYuBBLahxkqnM0FQZraVkvBSbrx1+8dcB8Vfbg=";
-    })
-    (fetchpatch2 {
-      name = "incusd-forknet_Include-FQDN-in-DHCPv6-INFO-requests.patch";
-      url = "https://github.com/lxc/incus/commit/d7f1c9d75ca33eb2ddb0bf10cec934fd6e352089.patch?full_index=1";
-      hash = "sha256-3zyADLiPUuiGLwdeISj5lUk3tkAayQGaRI+/yBHrvuM=";
-    })
-    (fetchpatch2 {
-      name = "incusd-forknet_Properly-renew-stateful-DHCPv6.patch";
-      url = "https://github.com/lxc/incus/commit/3b127758c17752302b3f4bf907f42e926ab664e4.patch?full_index=1";
-      hash = "sha256-+dcdeZwuyTWH7yfPEDqKOax/lS1Yqvwn9ooqJxKD3jA=";
-    })
-    (fetchpatch2 {
-      name = "incusd-forknet_Add-jitter-to-DHCPv6-renewal.patch";
-      url = "https://github.com/lxc/incus/commit/2b24a260b6177c033047f270286933563f05a999.patch?full_index=1";
-      hash = "sha256-grMspYyqn4Zl1Kn+hFeUfeIevdwszJc0x2YDC2JILKw=";
-    })
-    (fetchpatch2 {
-      name = "incusd-device-nic_bridged_Fix-swapped-IPv4-IPv6-DNS-record.patch";
-      url = "https://github.com/lxc/incus/commit/33ffcf71745e138dd4f3546839115c293e6be083.patch?full_index=1";
-      hash = "sha256-E8Plz9qdoTt3id9I5jbZYMKQt+kUrKmXmtMJ6IXlRJg=";
-    })
-    (fetchpatch2 {
-      name = "doc-authorization_Fix-reference-to-old-manager-relation.patch";
-      url = "https://github.com/lxc/incus/commit/c65ac0f4e6e94859b8565bce41bbf1595f4a8085.patch?full_index=1";
-      hash = "sha256-6wEz3uxWauIibBkH+OdB7+VsFySmugt6wk61qMayzYo=";
-    })
-    (fetchpatch2 {
-      name = "incusd-network-acl_Fix-issue-with-instances-in-different-project-than-ACL.patch";
-      url = "https://github.com/lxc/incus/commit/2a3584b6fccf152be42cf5614e54241bdb13e671.patch?full_index=1";
-      hash = "sha256-CXE5Bowk3ZPup6oVDEJb9ucsJoXhXu/kU7gGCghhtjQ=";
-    })
-    (fetchpatch2 {
-      name = "incusd-projects_Fix-targeting-on-project-delete.patch";
-      url = "https://github.com/lxc/incus/commit/3a104e4dc24897f0d6543136bb1043fcd4a33632.patch?full_index=1";
-      hash = "sha256-kTFkJqbjzdq5jvNxKw8YMPR04WRj4t5IS6ymoGyXDXE=";
-    })
-    (fetchpatch2 {
-      name = "test-network_acl_Add-test-for-ACL-used-by-instance-in-different-project.patch";
-      url = "https://github.com/lxc/incus/commit/41878729f06e9c31df9d4fac20fb8c384608577c.patch?full_index=1";
-      hash = "sha256-YR2Akus4vp3vNvHEmsJUh/3gbEf3R/cFUOVvt9u/wEU=";
-    })
-    (fetchpatch2 {
-      name = "incusd-instance-qemu_Remove-deprecated-QEMU-flag.patch";
-      url = "https://github.com/lxc/incus/commit/c1f18c78fc6bc4850df20574bdcc541e5eefc4ac.patch?full_index=1";
-      hash = "sha256-kbn4Yd/G23FCFA0Ch0+d81HUxCbcoiOzHfZ0MW+VlzE=";
-    })
-    (fetchpatch2 {
-      name = "incusd-cluster_Re-order-evacuations-to-happen-earlier-on-shutdown.patch";
-      url = "https://github.com/lxc/incus/commit/5b29ecc164ef28239d2e2a874a7c871a2e419083.patch?full_index=1";
-      hash = "sha256-jpyJYjiZvRw/aOGsykEx8uotRBF7p1q5O08PVhyQtvk=";
-    })
-    (fetchpatch2 {
-      name = "incusd-storage_Fix-unsafe-access-to-backup-data.patch";
-      url = "https://github.com/lxc/incus/commit/d71c5053a4c8318e6eb07337a7a4a07a6608ef73.patch?full_index=1";
-      hash = "sha256-/mH0/KmX9sG8HZTcdk8MT+QZtNqZa934wcHptvdVtXM=";
-    })
-    (fetchpatch2 {
-      name = "incusd-storage_Guard-nil-ExpiresAt-in-CreateCustomVolumeFromBackup.patch";
-      url = "https://github.com/lxc/incus/commit/ab6b7dff0c770044875d9d26a6254a7075b4d00b.patch?full_index=1";
-      hash = "sha256-d7VUetQzUTBq3GLYM1JKy2KDbBxOW5Lg7Di1/JPNzSE=";
-    })
-    (fetchpatch2 {
-      name = "incusd-storage_Guard-nil-fields-in-createDependentVolumesFromBackup.patch";
-      url = "https://github.com/lxc/incus/commit/98e64f0a6fcfdc9676eea0246418d490c53297bf.patch?full_index=1";
-      hash = "sha256-+lB7eHsGZ/dW7aL4/wIWD4AF6t7s4QYfAld1bQOw2tQ=";
-    })
-    (fetchpatch2 {
-      name = "incusd-storage-s3_Confine-multipart-uploads-with-os.Root.patch";
-      url = "https://github.com/lxc/incus/commit/a6012422b45c86f3b1956788cff5d75c604ad838.patch?full_index=1";
-      hash = "sha256-u3NLKE8Rh8i6HMbJ0KNhH7gbuwIpJ1SPqiyVoiuw9Sc=";
-    })
-    (fetchpatch2 {
-      name = "incusd-instances_Check-source-instance-access-on-copy.patch";
-      url = "https://github.com/lxc/incus/commit/1e3ffc53a10950e55de62ac1e0d612be597b84eb.patch?full_index=1";
-      hash = "sha256-1foxIu1rWcK1QbpmAPoQ46Tl1mrPvoctPnDhKRTWbd0=";
-    })
-    (fetchpatch2 {
-      name = "incusd-storage_Check-source-volume-access-on-copy.patch";
-      url = "https://github.com/lxc/incus/commit/2e01078366e2653712719dec82318e51c6d21b28.patch?full_index=1";
-      hash = "sha256-FP9v/8V0ZFLgy1tODKLJlw5f/6qJ8AMP/yme2YhYSaA=";
-    })
-    (fetchpatch2 {
-      name = "incusd-images_Validate-fingerprint-on-direct-download.patch";
-      url = "https://github.com/lxc/incus/commit/46d6ef232186df5535c49ca9f3597cab381f9b86.patch?full_index=1";
-      hash = "sha256-R8gsvdmb7KVC6W1vFH1CojzhrGNgNiFOOTYbCrDAajg=";
-    })
-    (fetchpatch2 {
-      name = "shared-validate_Reject-compression-algorithm-arguments.patch";
-      url = "https://github.com/lxc/incus/commit/873a032a461df6b09b7586435b592873863a4e88.patch?full_index=1";
-      hash = "sha256-QvxGxwHvswUZFst71zA12ZdxNIErl1LkaNyQdcPiglI=";
-    })
-    (fetchpatch2 {
-      name = "incusd-instance_Confine-template-access-to-instance-root.patch";
-      url = "https://github.com/lxc/incus/commit/cbefa31ae0da8fd96361178aed3a3c631e098fef.patch?full_index=1";
-      hash = "sha256-ZOHqnlIG6LyIUO6WP76SZJKTeqoiw9qj2YByGxqGP+E=";
-    })
-    (fetchpatch2 {
-      name = "incusd-instance_Enforce-project-restrictions-on-snapshot-restore.patch";
-      url = "https://github.com/lxc/incus/commit/3fe3bc99891940fcd3e758d49f65a853104fcd6b.patch?full_index=1";
-      hash = "sha256-j+lTbDaUjnZRY0lmaOSH4oKNAeIe5GXTwd1oM50it+Y=";
-    })
-    (fetchpatch2 {
-      name = "incusd-exec_Reject-exec-output-symlink.patch";
-      url = "https://github.com/lxc/incus/commit/e109655d642c7cb7c9039b7c06323000407f76dd.patch?full_index=1";
-      hash = "sha256-v/H12n8u+aqm9+ZxrarBxQEQSMN1gpX13oyummGWXl8=";
-    })
-    (fetchpatch2 {
-      name = "incusd_Reject-rootfs-symlink-for-instances.patch";
-      url = "https://github.com/lxc/incus/commit/7e58425ca7ffeb21bb116869e71a0d002dae9e72.patch?full_index=1";
-      hash = "sha256-MU+Khx+DhYQWUVs71D05PnJGamrhRXxsahtdXZeSfvU=";
-    })
-    (fetchpatch2 {
-      name = "shared-logger_Add-WarnOnError-helper.patch";
-      url = "https://github.com/lxc/incus/commit/1bc4d3feb8cd3bd005b7406c0d44ad3ea59400bf.patch?full_index=1";
-      hash = "sha256-ima4IGl0CyL30yZVdQ2pmp9SukIzrdBftGkO/GUPB3g=";
-    })
-    (fetchpatch2 {
-      name = "incus-0001-incusd-daemon_images-Add-missing-import.patch";
-      url = "https://raw.githubusercontent.com/zabbly/incus/a7fd42d2f5115c4e6893b23e64209db511fff828/patches/incus-0001-incusd-daemon_images-Add-missing-import.patch";
-      hash = "sha256-xtuuASy9bck+BgXbea9goNhrMV8Yme9cmFp4WNrkIdI=";
-    })
-  ];
   nixUpdateExtraArgs = [
     "--version-regex=^v(7\\.0\\.[0-9]+)$"
     "--override-filename=pkgs/by-name/in/incus/lts.nix"

pkgs/by-name/ko/komikku/package.nix

@@ -24,14 +24,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "komikku";
-  version = "50.8.0";
+  version = "50.9.0";
   pyproject = false;
 
   src = fetchFromCodeberg {
     owner = "valos";
     repo = "Komikku";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-u10O0+Ty73ad4vB8BgQPsV1W8NJYvzU3wyAhqHtW9v0=";
+    hash = "sha256-fjAls3/ikNrQ1AgwUe9hFoQ48zv7UbGCUNB4dlmYM28=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ma/matrix-appservice-irc/package.nix

@@ -5,7 +5,7 @@
   fetchYarnDeps,
   fixup-yarn-lock,
   node-gyp-build,
-  nodejs-slim,
+  nodejs-slim_22,
   matrix-sdk-crypto-nodejs,
   nixosTests,
   nix-update-script,
@@ -42,7 +42,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [
     fixup-yarn-lock
-    nodejs-slim
+    nodejs-slim_22
     yarn
     node-gyp-build
   ];

pkgs/by-name/ma/matrix-authentication-service/package.nix

@@ -2,8 +2,9 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  fetchNpmDeps,
-  npmHooks,
+  fetchPnpmDeps,
+  pnpm,
+  pnpmConfigHook,
   nodejs,
   python3,
   pkg-config,
@@ -19,30 +20,30 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "matrix-authentication-service";
-  version = "1.17.0";
+  version = "1.20.0";
 
   src = fetchFromGitHub {
     owner = "element-hq";
     repo = "matrix-authentication-service";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/3NgMZ0B+B0BHPBi/vuiCS6xi70wgNKCZH0hTpkWi+U=";
+    hash = "sha256-0fvGhBxwXhSzWvNhflreEFoCBycM10vMkMf4sj95vfY=";
   };
 
-  cargoHash = "sha256-aZSnQmOwqo0OG3XXM5eups0cKNs80j/nAsZB5tnWUrY=";
+  cargoHash = "sha256-3V50qNvg24WZvQ9z7IZJAnPXHTibZ6o3EzUoinLU6Gw=";
 
-  npmDeps = fetchNpmDeps {
-    name = "${finalAttrs.pname}-${finalAttrs.version}-npm-deps";
-    src = "${finalAttrs.src}/${finalAttrs.npmRoot}";
-    hash = "sha256-FevzqirT/GyT8urQ79AtJi+q1zcwn73AyiJTf/B9cG0=";
+  pnpmDeps = fetchPnpmDeps {
+    inherit (finalAttrs) pname version src;
+    fetcherVersion = 4;
+    hash = "sha256-j2A2VCKQPfoyrNDtazu8hzUHpS130Ju/Cy3yfu9tC5I=";
   };
 
-  npmRoot = "frontend";
-  npmFlags = [ "--legacy-peer-deps" ];
+  pnpmRoot = "frontend";
 
   nativeBuildInputs = [
     pkg-config
     open-policy-agent
-    npmHooks.npmConfigHook
+    pnpmConfigHook
+    pnpm
     nodejs
     (python3.withPackages (ps: [ ps.setuptools ])) # Used by gyp
   ]
@@ -82,7 +83,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     in
     ''
       make -C policies
-      (cd "$npmRoot" && npm run build)
+      (cd "$pnpmRoot" && npm run build)
 
       # Fix aws-lc-sys cross-compilation
       export CC_${buildTargetUnderscore}=$CC_FOR_BUILD
@@ -92,8 +93,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
   # Adapted from https://github.com/element-hq/matrix-authentication-service/blob/v0.20.0/.github/workflows/build.yaml#L75-L84
   postInstall = ''
     install -Dm444 -t "$out/share/$pname"        "policies/policy.wasm"
-    install -Dm444 -t "$out/share/$pname"        "$npmRoot/dist/manifest.json"
-    install -Dm444 -t "$out/share/$pname/assets" "$npmRoot/dist/"*
+    install -Dm444 -t "$out/share/$pname"        "$pnpmRoot/dist/manifest.json"
+    install -Dm444 -t "$out/share/$pname/assets" "$pnpmRoot/dist/"*
     cp -r templates   "$out/share/$pname/templates"
     cp -r translations   "$out/share/$pname/translations"
   '';

pkgs/by-name/me/meshtastic-web/package.nix

@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  pnpm_9,
+  pnpm_10,
   fetchPnpmDeps,
   pnpmConfigHook,
   nodejs,
@@ -29,19 +29,19 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmWorkspaces = [ "*" ];
   pnpmRoot = "packages/web";
   pnpmDeps = fetchPnpmDeps {
-    pnpm = pnpm_9;
+    pnpm = pnpm_10;
+    fetcherVersion = 4;
     inherit (finalAttrs)
       pname
       version
       src
       pnpmWorkspaces
       ;
-    fetcherVersion = 3;
-    hash = "sha256-yUdPrZAnCsxIiF++SxTm1VuVAEKIzTsp2qd/WcCPOcQ=";
+    hash = "sha256-0o/g5FVzSGX9xtQ8DZGjakwOnPXvlA95tdD/VNymB1M=";
   };
 
   nativeBuildInputs = [
-    pnpm_9
+    pnpm_10
     pnpmConfigHook
     nodejs
   ];

pkgs/by-name/mi/microsoft-edge/package.nix

@@ -164,11 +164,11 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "microsoft-edge";
-  version = "149.0.4022.98";
+  version = "150.0.4078.65";
 
   src = fetchurl {
     url = "https://packages.microsoft.com/repos/edge/pool/main/m/microsoft-edge-stable/microsoft-edge-stable_${finalAttrs.version}-1_amd64.deb";
-    hash = "sha256-tM5RsesBd3CyaCrkXa/wn5OF05k3OlRwzKGzg2lxNtI=";
+    hash = "sha256-mt8fx6gJE5PGFiMLeceJ5rmLmwmQXaxx7VY8yPIQqyE=";
   };
 
   # With strictDeps on, some shebangs were not being patched correctly

pkgs/by-name/ms/msedgedriver/package.nix

@@ -11,11 +11,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "msedgedriver";
-  version = "149.0.4022.98";
+  version = "150.0.4078.65";
 
   src = fetchzip {
     url = "https://msedgedriver.microsoft.com/${finalAttrs.version}/edgedriver_linux64.zip";
-    hash = "sha256-itfjetfyfKayowWickDYVd2drBXWTNIYCdUUKTnnZzM=";
+    hash = "sha256-TwGjt8Hw4rvwW2OwkIcqRzKLXu1dRL7/9n+Zq3VmKag=";
     stripRoot = false;
   };
 

pkgs/by-name/mu/mullvad-browser/package.nix

@@ -97,7 +97,7 @@ let
     ++ lib.optionals mediaSupport [ ffmpeg_7 ]
   );
 
-  version = "15.0.16";
+  version = "15.0.18";
 
   sources = {
     x86_64-linux = fetchurl {
@@ -109,7 +109,7 @@ let
         "https://tor.eff.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"
         "https://tor.calyxinstitute.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"
       ];
-      hash = "sha256-mlQUAdGcOUbqReROqhs4fwSUmTZqQAEhwsg6ulM2hx4=";
+      hash = "sha256-hvLft1HDj/5NgAfQb1igYdhJN5H/jZ2+7s/JKKLf4Gs=";
     };
   };
 

pkgs/by-name/na/navidrome/package.nix

@@ -21,13 +21,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "navidrome";
-  version = "0.63.1";
+  version = "0.63.2";
 
   src = fetchFromGitHub {
     owner = "navidrome";
     repo = "navidrome";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-sqPqcvi1XIjPuo02qxygM3a3/ih5w5vqfz6D8XRTxiA=";
+    hash = "sha256-s0Pd6yT9NX2VFSPbLPX6Zqon8Y3qyDPGCKvqHPxcZ88=";
   };
 
   vendorHash = "sha256-lNjOVrlRD6ptDBpmfGYCN3Vkal9ACciOyS1RANzKYK4=";

pkgs/by-name/na/navidrome/plugins/discord-rich-presence/package.nix

@@ -5,16 +5,16 @@
 }:
 buildNavidromePlugin rec {
   pname = "discord-rich-presence-plugin";
-  version = "1.0.0";
+  version = "2.0.0";
 
   src = pkgs.fetchFromGitHub {
     owner = "navidrome";
     repo = "discord-rich-presence-plugin";
     tag = "v${version}";
-    hash = "sha256-YH1K6uagIloQQ4gdezKMAfx9KbGL9chiTx/i8CiH4io=";
+    hash = "sha256-j4iGymXH9JstPGdpPl5TFLiH8ShfE46U+BZk1n7a2yQ=";
   };
 
-  vendorHash = "sha256-M5dI0gNfy2x9IVN1284pdvUaCui0sgxFCC+9weq2ipM=";
+  vendorHash = "sha256-5ZlqyUa+UcLCBdLQaYAlb818Y8sOENjIFfb2hpRsbpQ=";
 
   meta = {
     description = "Displays your currently playing track in your Discord status";

pkgs/by-name/on/onlyoffice-documentserver/x2t.nix

@@ -12,7 +12,7 @@
   optipng,
   x265,
   libde265,
-  icu,
+  icu78,
   jdk,
   lib,
   nodejs_22,
@@ -30,6 +30,9 @@
 }:
 
 let
+  # default at the time of writing is still 76,
+  # but libv8 from nodejs_22 needs 78
+  icu = icu78;
   openssl' = openssl.override {
     enableMD2 = true;
     static = true;
@@ -41,8 +44,11 @@ let
       $BUILDRT/Common/3dParty/icu/icu.pri \
       --replace-fail "ICU_MAJOR_VER = 74" "ICU_MAJOR_VER = ${lib.versions.major icu.version}"
 
-    mkdir $BUILDRT/Common/3dParty/icu/linux_64
-    ln -s ${icu}/lib $BUILDRT/Common/3dParty/icu/linux_64/build
+    mkdir -p $BUILDRT/Common/3dParty/icu/linux_64/build
+    ln -s ${icu.dev}/include $BUILDRT/Common/3dParty/icu/linux_64/build/include
+    for i in ${icu}/lib/* ; do
+      ln -s $i $BUILDRT/Common/3dParty/icu/linux_64/build/$(basename $i)
+    done
   '';
   icuQmakeFlags = [
     "QMAKE_LFLAGS+=-Wl,--no-undefined"

pkgs/by-name/os/osquery/info.json

@@ -5,9 +5,9 @@
     },
     "osquery": {
         "fetchSubmodules": true,
-        "hash": "sha256-m66JfsC1+YU1k3BKEwHx6jmqpRleaqP6f8M/NXJU8dg=",
+        "hash": "sha256-UeA3xnaNkOLFmNq4mgZM4f2BX0cidtantaSxgy/ahlk=",
         "owner": "osquery",
         "repo": "osquery",
-        "rev": "5.23.0"
+        "rev": "5.23.1"
     }
 }

pkgs/by-name/pi/picocom/package.nix

@@ -61,5 +61,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.unix;
     mainProgram = "picocom";
+    maintainers = [ lib.maintainers.ninelore ];
   };
 })

pkgs/by-name/pi/pihole-ftl/package.nix

@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pihole-ftl";
-  version = "6.6.2";
+  version = "6.7";
 
   src = fetchFromGitHub {
     owner = "pi-hole";
     repo = "FTL";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-dYeW5r96xGt0wkR8CeWJUHEn+BCS8fIBAjSVtRdsDkM=";
+    hash = "sha256-vViQ9ZAhajIfCQvOtKjMO2wj8CRt/1h/dzHHFevbbFU=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/pi/pihole-web/package.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pihole-web";
-  version = "6.5";
+  version = "6.6";
 
   src = fetchFromGitHub {
     owner = "pi-hole";
     repo = "web";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ozMqgxyYBDNeYGnZIhql7hnF8D/PwqAe9ypUkkUfKBc=";
+    hash = "sha256-uGkxCa1ErE0uwFyZKfto0YQIRQMnnNAxGEaM6YB8+Ug=";
   };
 
   propagatedBuildInputs = [

pkgs/by-name/pi/pijul/fix-rand-0.9-sanakirja-imports.patch

@@ -1,19 +0,0 @@
---- a/src/commands/git.rs
-+++ b/src/commands/git.rs
-@@ -1,6 +1,7 @@
- use anyhow::bail;
- use clap::{Parser, ValueHint};
- use libpijul::pristine::*;
-+use ::sanakirja::RootPageMut as _;
- use libpijul::*;
- use log::{debug, error, info, trace};
- use std::collections::{BTreeMap, BTreeSet, HashSet};
-@@ -564,7 +565,7 @@
-                                     tmp_path.pop();
-                                     use rand::Rng;
-                                     let s: String = rand::thread_rng()
--                                        .sample_iter(&rand::distributions::Alphanumeric)
-+                                        .sample_iter(&rand::distr::Alphanumeric)
-                                         .take(30)
-                                         .map(|x| x as char)
-                                         .collect();

pkgs/by-name/pi/pijul/package.nix

@@ -14,18 +14,19 @@
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
+  __structuredAttrs = true;
+
   pname = "pijul";
-  version = "1.0.0-beta.11";
+  version = "1.0.0-beta.18";
 
   src = fetchCrate {
     inherit (finalAttrs) version pname;
-    hash = "sha256-+rMMqo2LBYlCFQJv8WFCSEJgDUbMi8DnVDKXIWm3tIk=";
+    hash = "sha256-vU41JiuxB6Bsi88st/tkt02054oN3HEN52pnLu5hMA4=";
   };
 
-  cargoHash = "sha256-IhArTiReUdj49bA+XseQpOiszK801xX5LdLj8vXD8rs=";
-
-  patches = [ ./fix-rand-0.9-sanakirja-imports.patch ];
+  cargoHash = "sha256-Ach8wLBhZ3pA5+m910Gt+oftEaO3Mu/ii+bxgnla0ak=";
 
+  # Tests require a TTY, which the Nix sandbox does not provide.
   doCheck = false;
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/pi/piped/package.nix

@@ -1,14 +1,14 @@
 {
   lib,
   buildNpmPackage,
-  pnpm_9,
+  pnpm_10,
   fetchPnpmDeps,
   pnpmConfigHook,
   fetchFromGitHub,
   unstableGitUpdater,
 }:
 let
-  pnpm = pnpm_9;
+  pnpm = pnpm_10;
 in
 buildNpmPackage rec {
   pname = "piped";
@@ -21,7 +21,7 @@ buildNpmPackage rec {
     hash = "sha256-o3TwE0s5rim+0VKR+oW9Rv3/eQRf2dgRQK4xjZ9pqCE=";
   };
 
-  nativeBuildInputs = [ pnpm_9 ];
+  nativeBuildInputs = [ pnpm ];
   npmConfigHook = pnpmConfigHook;
 
   installPhase = ''
@@ -36,10 +36,10 @@ buildNpmPackage rec {
       pname
       version
       src
+      pnpm
       ;
-    pnpm = pnpm_9;
-    fetcherVersion = 3;
-    hash = "sha256-IB/suR1I1hNip1qpIcUCP0YyUEDV2EwE5F2WXW8OhmU=";
+    fetcherVersion = 4;
+    hash = "sha256-o5NKMMIVPkKiPx++ALcZ+3oN80DMQHPwQqGT4f4q5P8=";
   };
 
   passthru.updateScript = unstableGitUpdater { };

pkgs/by-name/po/porn-vault/package.nix

@@ -2,7 +2,7 @@
   fetchFromGitLab,
   rustPlatform,
   lib,
-  pnpm_9,
+  pnpm_10,
   fetchPnpmDeps,
   pnpmConfigHook,
   stdenvNoCC,
@@ -38,7 +38,7 @@ let
     };
   };
   nodejs-slim = nodejs-slim_22;
-  pnpm' = pnpm_9.override { inherit nodejs-slim; };
+  pnpm' = pnpm_10.override { inherit nodejs-slim; };
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "porn-vault";
@@ -54,8 +54,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm';
-    fetcherVersion = 3;
-    hash = "sha256-CAsUP+bLrTkbUd3h/FP4gBVwZECyqQg0nnmap4zsRTs=";
+    fetcherVersion = 4;
+    hash = "sha256-5ZMa7/3nbG1xsTfd09oh+NTU+FFhd0lV425pU3s9bZE=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/qe/qemu/package.nix

@@ -140,11 +140,11 @@ stdenv.mkDerivation (finalAttrs: {
     + lib.optionalString nixosTestRunner "-for-vm-tests"
     + lib.optionalString toolsOnly "-utils"
     + lib.optionalString userOnly "-user";
-  version = "10.2.2";
+  version = "10.2.4";
 
   src = fetchurl {
     url = "https://download.qemu.org/qemu-${finalAttrs.version}.tar.xz";
-    hash = "sha256-eEspb/KcFBeqcjI6vLLS6pq5dxck9Xfc14XDsE8h4XY=";
+    hash = "sha256-ghtUW5LxZeV93cysUHfXbU1DaiJllbiBOtWTBrv9B0Y=";
   };
 
   depsBuildBuild = [

pkgs/by-name/sk/sketchybar-app-font/package.nix

@@ -1,7 +1,7 @@
 {
   fetchFromGitHub,
   lib,
-  pnpm_9,
+  pnpm_11,
   fetchPnpmDeps,
   pnpmConfigHook,
   stdenvNoCC,
@@ -21,15 +21,15 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
-    pnpm = pnpm_9;
-    fetcherVersion = 3;
-    hash = "sha256-/nYH3ZgfNv9krvH/ZjCJ2F3aanLZzlkNwOizgTRtqXE=";
+    pnpm = pnpm_11;
+    fetcherVersion = 4;
+    hash = "sha256-zFheFcVSCZWDrThn5PnxhJscRhLG/psSI8Q8g48nXNU=";
   };
 
   nativeBuildInputs = [
     nodejs
     pnpmConfigHook
-    pnpm_9
+    pnpm_11
   ];
 
   buildPhase = ''

pkgs/by-name/st/stremio-linux-shell/out-path.patch

@@ -0,0 +1,42 @@
+diff --git a/build.rs b/build.rs
+index aa2bec5..d512a42 100644
+--- a/build.rs
++++ b/build.rs
+@@ -26,7 +26,7 @@ fn setup_po() -> Result<()> {
+             && extension == "po"
+             && let Some(po_lang) = path.file_stem()
+         {
+-            let mo_dir = po_dir.join(po_lang).join("LC_MESSAGES");
++            let mo_dir = Path::new("@out@/share/locale").join(po_lang).join("LC_MESSAGES");
+ 
+             fs::create_dir_all(&mo_dir)?;
+ 
+@@ -46,7 +46,7 @@ fn setup_po() -> Result<()> {
+ fn setup_schemas(filename: &str) -> Result<()> {
+     println!("cargo:rerun-if-changed={DATA_DIR}");
+ 
+-    let out_dir = dirs::data_dir().expect("Failed to get data dir");
++    let out_dir = Path::new("@out@/share");
+     let out_dir = out_dir.join("glib-2.0/schemas");
+ 
+     fs::create_dir_all(&out_dir)?;
+diff --git a/data/com.stremio.Stremio.service b/data/com.stremio.Stremio.service
+index 7cfb139..7491969 100644
+--- a/data/com.stremio.Stremio.service
++++ b/data/com.stremio.Stremio.service
+@@ -1,3 +1,3 @@
+ [D-BUS Service]
+ Name=com.stremio.Stremio
+-Exec=/app/bin/stremio --gapplication-service
++Exec=@out@/bin/stremio --gapplication-service
+diff --git a/data/stremio.sh b/data/stremio.sh
+index 161bada..37373b0 100644
+--- a/data/stremio.sh
++++ b/data/stremio.sh
+@@ -5,4 +5,4 @@ if ls /dev/nvidia0 &>/dev/null 2>&1; then
+     export GSK_RENDERER=opengl
+ fi
+ 
+-exec /app/libexec/stremio/stremio "$@"
+\ No newline at end of file
++exec @out@/libexec/stremio/stremio "$@"

pkgs/by-name/st/stremio-linux-shell/package.nix

@@ -3,7 +3,7 @@
   rustPlatform,
   fetchFromGitHub,
   versionCheckHook,
-  gitUpdater,
+  nix-update-script,
 
   # nativeBuildInputs
   pkg-config,
@@ -26,7 +26,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "stremio-linux-shell";
-  version = "1.0.2";
+  version = "1.1.2";
 
   strictDeps = true;
   __structuredAttrs = true;
@@ -35,17 +35,18 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "Stremio";
     repo = "stremio-linux-shell";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-NbzUAv/L8xzdepqn677nlROumjlliZIHzPXIToHHeTU=";
+    hash = "sha256-jo+9KDX/a46jPTmYhiFNgp5fDKhoAsML/+m7u3ituEQ=";
   };
 
-  cargoHash = "sha256-yafkD7D0E+lbFV7MlLwQM4iWC8Glo/Tn2F+TFff6GoM=";
+  cargoHash = "sha256-hZ9neZD+aB7bth4UTsWJXIKGSbo/c3wZRtfOIp7LvwY=";
+
+  patches = [
+    ./out-path.patch
+  ];
 
   postPatch = ''
-    substituteInPlace data/com.stremio.Stremio.service \
-      --replace-fail "Exec=/app/bin/stremio" "Exec=$out/bin/stremio"
-
-    substituteInPlace data/stremio.sh \
-      --replace-fail "/app/libexec/stremio/stremio" "$out/libexec/stremio/stremio"
+    substituteInPlace data/com.stremio.Stremio.service data/stremio.sh build.rs \
+      --subst-var out
   '';
 
   nativeBuildInputs = [
@@ -67,9 +68,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
   postInstall = ''
     install -Dm644 data/icons/com.stremio.Stremio.svg $out/share/icons/hicolor/scalable/apps/com.stremio.Stremio.svg
     install -Dm644 data/com.stremio.Stremio.desktop $out/share/applications/com.stremio.Stremio.desktop
+    install -Dm644 data/com.stremio.Stremio.metainfo.xml $out/share/metainfo/com.stremio.Stremio.metainfo.xml
     install -Dm644 data/com.stremio.Stremio.service $out/share/dbus-1/services/com.stremio.Stremio.service
     install -Dm644 data/server.js $out/libexec/stremio/server.js
     install -Dm755 data/stremio.sh $out/bin/stremio
+    install -Dm644 LICENSE $out/share/licenses/stremio/LICENSE
 
     mv $out/bin/stremio-linux-shell $out/libexec/stremio/stremio
   '';
@@ -93,7 +96,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
   doInstallCheck = true;
 
   passthru = {
-    updateScript = gitUpdater { rev-prefix = "v"; };
+    updateScript = nix-update-script {
+      extraArgs = [ "--version-regex=^v([0-9.]+)$" ];
+    };
   };
 
   meta = {
@@ -111,7 +116,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
       fromSource
       obfuscatedCode # server.js
     ];
-    maintainers = with lib.maintainers; [ thunze ];
+    maintainers = with lib.maintainers; [
+      thunze
+      fazzi
+    ];
     platforms = lib.platforms.linux;
     mainProgram = "stremio";
   };

pkgs/by-name/sy/synchrony/package.nix

@@ -3,7 +3,7 @@
   stdenv,
   fetchFromGitHub,
   nodejs,
-  pnpm_9,
+  pnpm_11,
   fetchPnpmDeps,
   pnpmConfigHook,
   nix-update-script,
@@ -12,26 +12,26 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "synchrony";
-  version = "2.4.5";
+  version = "2.4.6";
 
   src = fetchFromGitHub {
     owner = "relative";
     repo = "synchrony";
     rev = finalAttrs.version;
-    hash = "sha256-nJ6H1SZAQCG6U3BPEPmm+BGQa8Af+Vb1E+Lv8lIqDBE=";
+    hash = "sha256-D+XibmfMd3jZUEnHqStOuvcrEhDvodey0GXQ57RvJ38=";
   };
 
   nativeBuildInputs = [
     nodejs
     pnpmConfigHook
-    pnpm_9
+    pnpm_11
   ];
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
-    pnpm = pnpm_9;
+    pnpm = pnpm_11;
     fetcherVersion = 3;
-    hash = "sha256-c6wtu/3tNCobLqJaB3hB9HP34ObijBQ/9ZcIzGetaT0=";
+    hash = "sha256-geA40z7KH4kluCgz1EmmYqeGkBjEXgmrUDsUewpD7Xc=";
   };
 
   buildPhase = ''

pkgs/by-name/ta/tabby-agent/package.nix

@@ -4,25 +4,25 @@
   fetchFromGitHub,
   nix-update-script,
   nodejs,
-  pnpm_9,
+  pnpm_11,
   fetchPnpmDeps,
   pnpmConfigHook,
   wrapGAppsHook3,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "tabby-agent";
-  version = "0.31.2";
+  version = "0.32.0";
 
   src = fetchFromGitHub {
     owner = "TabbyML";
     repo = "tabby";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-dVQ/OLJnXgkzWfX3p6Cplw9hti2jXoMKCvKhm6YNzAI=";
+    hash = "sha256-OeHRJOg7UEOVBG7jTUGCpiuKZI0Jj7Gl7QDKpsjX5Bc=";
   };
 
   nativeBuildInputs = [
     pnpmConfigHook
-    pnpm_9
+    pnpm_11
     wrapGAppsHook3
   ];
 
@@ -51,9 +51,9 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
-    pnpm = pnpm_9;
-    fetcherVersion = 3;
-    hash = "sha256-xx45vudeW6OnUgyH0N+gQI5GPT8k5B4x0HdCvHF+f9A=";
+    pnpm = pnpm_11;
+    fetcherVersion = 4;
+    hash = "sha256-idEByCnQmqpnvni0RahZ7qEa0C/0zVPRFv0jaj3BcnM=";
   };
 
   passthru.updateScript = nix-update-script {
@@ -65,10 +65,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "https://github.com/TabbyML/tabby";
-    changelog = "https://github.com/TabbyML/tabby/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/TabbyML/tabby/releases/tag/v${finalAttrs.src.tag}";
     description = "Language server used to communicate with Tabby server";
     mainProgram = "tabby-agent";
     license = lib.licenses.asl20;
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.skohtv ];
   };
 })

pkgs/by-name/to/tor-browser/package.nix

@@ -102,7 +102,7 @@ let
     ++ lib.optionals mediaSupport [ ffmpeg_7 ]
   );
 
-  version = "15.0.17";
+  version = "15.0.18";
 
   sources = {
     x86_64-linux = fetchurl {
@@ -112,7 +112,7 @@ let
         "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
         "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
       ];
-      hash = "sha256-WJFDd+DVj4oKHjv7py3yVrttrrCHFcHJbyvLNOwCjhs=";
+      hash = "sha256-4e7G8M/iKU65ECMVhxGjaJwHfwVZ49RD7ro6YJT43v0=";
     };
 
     i686-linux = fetchurl {
@@ -122,7 +122,7 @@ let
         "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
         "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
       ];
-      hash = "sha256-pKmAKDWutSp7ptJ66PMiS59aV+pRs3Oz9pV64kRuebI=";
+      hash = "sha256-lLShsQQ2thSSp4PRK9Fhza6e01Myj2mUP4qqCeyilXo=";
     };
   };
 

pkgs/development/libraries/poppler/default.nix

@@ -4,6 +4,7 @@
   fetchurl,
   fetchFromGitLab,
   cairo,
+  clang-tools,
   cmake,
   boost,
   curl,
@@ -81,6 +82,13 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals (!minimal) [
     glib # for glib-mkenums
+  ]
+  ++ lib.optionals stdenv.cc.isClang [
+    # Pick up the `clang-scan-deps` wrapper for CMake; see:
+    #
+    # * <https://github.com/NixOS/nixpkgs/issues/452260>
+    # * <https://github.com/NixOS/nixpkgs/pull/514323>
+    clang-tools
   ];
 
   buildInputs = [

pkgs/development/python-modules/jq/default.nix

@@ -38,6 +38,7 @@ buildPythonPackage rec {
   disabledTests = [
     # tries to match exact error text, fails with jq 1.8
     "test_value_error_is_raised_if_program_is_invalid"
+    "test_value_error_is_raised_if_input_cannot_be_processed_by_program"
   ];
 
   pythonImportsCheck = [ "jq" ];

pkgs/development/python-modules/numexpr/default.nix

@@ -3,6 +3,7 @@
   buildPythonPackage,
   fetchPypi,
   numpy,
+  pytest-run-parallel,
   pytestCheckHook,
   setuptools,
   # sets NUMEXPR_NUM_THREADS and OMP_NUM_THREADS for packages
@@ -34,12 +35,18 @@ buildPythonPackage rec {
     ln -s ${numpy.cfg} site.cfg
   '';
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytest-run-parallel
+    pytestCheckHook
+  ];
 
   propagatedNativeBuildInputs = [
     checkPhaseThreadLimitHook
   ];
 
+  # tests check for OMP_NUM_THREADS application and complete quick enough
+  env.dontLimitCheckPhaseThreads = 1;
+
   preCheck = ''
     pushd $out
   '';

pkgs/development/python-modules/oslo-i18n/default.nix

@@ -41,8 +41,8 @@ buildPythonPackage rec {
     runHook preCheck
 
     stestr run -e <(echo "
-    # test counts warnings which no longer matches in python 3.11
-    oslo_i18n.tests.test_message.MessageTestCase.test_translate_message_bad_translation
+    # list is not deduped
+    oslo_i18n.tests.test_gettextutils.GettextTest.test_get_available_languages
     ")
 
     runHook postCheck

pkgs/kde/gear/calligra/default.nix

@@ -1,7 +1,6 @@
 {
   mkKdeDerivation,
   lib,
-  fetchpatch,
   boost,
   eigen,
   gsl,
@@ -27,14 +26,6 @@
 mkKdeDerivation {
   pname = "calligra";
 
-  patches = [
-    # Fix build with Poppler 26.04
-    (fetchpatch {
-      url = "https://invent.kde.org/office/calligra/-/commit/e9aae90db47ca87d639b8f2b17ec75c1b6093e27.patch";
-      hash = "sha256-V21Bw0xV/E4a9v8Yrt0vZ3AU1LJFHul1k92u+nsp85I=";
-    })
-  ];
-
   extraBuildInputs = [
     boost
     eigen