Merge release-25.05 into staging-next-25.05

ci/eval/default.nix

@@ -95,6 +95,10 @@ let
         system=$3
         outputDir=$4
 
+        # Default is 5, higher values effectively disable the warning.
+        # This randomly breaks Eval.
+        export GC_LARGE_ALLOC_WARN_INTERVAL=1000
+
         export NIX_SHOW_STATS=1
         export NIX_SHOW_STATS_PATH="$outputDir/stats/$myChunk"
         echo "Chunk $myChunk on $system start"

ci/github-script/labels.js

@@ -20,6 +20,46 @@ module.exports = async ({ github, context, core, dry }) => {
       })
     ).data
 
+    // When the same change has already been merged to the target branch, a PR will still be
+    // open and display the same changes - but will not actually have any effect. This causes
+    // strange CI behavior, because the diff of the merge-commit is empty, no rebuilds will
+    // be detected, no maintainers pinged.
+    // We can just check the temporary merge commit, and if it's empty the PR can safely be
+    // closed - there are no further changes.
+    if (pull_request.merge_commit_sha) {
+      const commit = (
+        await github.rest.repos.getCommit({
+          ...context.repo,
+          ref: pull_request.merge_commit_sha,
+        })
+      ).data
+
+      if (commit.files.length === 0) {
+        const body = [
+          `The diff for the temporary merge commit ${pull_request.merge_commit_sha} is empty.`,
+          'The changes in this PR have almost certainly already been merged to the target branch.',
+        ].join('\n')
+
+        core.info(`PR #${item.number}: closed`)
+
+        if (!dry) {
+          await github.rest.issues.createComment({
+            ...context.repo,
+            issue_number: pull_number,
+            body,
+          })
+
+          await github.rest.pulls.update({
+            ...context.repo,
+            pull_number,
+            state: 'closed',
+          })
+        }
+
+        return {}
+      }
+    }
+
     const reviews = await github.paginate(github.rest.pulls.listReviews, {
       ...context.repo,
       pull_number,

ci/nixpkgs-vet.nix

@@ -32,6 +32,7 @@ runCommand "nixpkgs-vet"
   }
   ''
     export NIX_STATE_DIR=$(mktemp -d)
+    $NIXPKGS_VET_NIX_PACKAGE/bin/nix-store --init
 
     nixpkgs-vet --base ${filteredBase} ${filteredHead}
 

ci/parse.nix

@@ -20,24 +20,15 @@ runCommand "nix-parse-${nix.name}"
   ''
     export NIX_STORE_DIR=$TMPDIR/store
     export NIX_STATE_DIR=$TMPDIR/state
+    nix-store --init
 
     cd "${nixpkgs}"
 
-    # Passes all files to nix-instantiate at once.
-    # Much faster, but will only show first error.
-    parse-all() {
-      find . -type f -iname '*.nix' | xargs -P $(nproc) nix-instantiate --parse >/dev/null 2>/dev/null
-    }
-
-    # Passes each file separately to nix-instantiate with -n1.
-    # Much slower, but will show all errors.
-    parse-each() {
-      find . -type f -iname '*.nix' | xargs -n1 -P $(nproc) nix-instantiate --parse >/dev/null
-    }
-
-    if ! parse-all; then
-      parse-each
-    fi
+    # This will only show the first parse error, not all of them. That's fine, because
+    # the other CI jobs will report in more detail. This job is about checking parsing
+    # across different implementations / versions, not about providing the best DX.
+    # Returning all parse errors requires significantly more resources.
+    find . -type f -iname '*.nix' | xargs -P $(nproc) nix-instantiate --parse >/dev/null
 
     touch $out
   ''

pkgs/by-name/en/envoy-bin/package.nix

@@ -8,7 +8,7 @@
   versionCheckHook,
 }:
 let
-  version = "1.34.9";
+  version = "1.34.10";
   inherit (stdenv.hostPlatform) system;
   throwSystem = throw "envoy-bin is not available for ${system}.";
 
@@ -21,8 +21,8 @@ let
 
   hash =
     {
-      aarch64-linux = "sha256-PsQg9snRRSjOh9z78wKT1Kk5Ye/fgxLYuOmNX9mxrLA=";
-      x86_64-linux = "sha256-NBSRNabbpzkl5iafMunx8MuqbCznu+28XwXr5jwyelM=";
+      aarch64-linux = "sha256-YhScxKWQxjZDiefW2TF5duFUEl7V01XuKpTnnQYuUYM=";
+      x86_64-linux = "sha256-zPNYT1PvHno+Va5VDURimcwdRl+kpLc2DbTqefk70yM=";
     }
     .${system} or throwSystem;
 in

pkgs/by-name/fr/freetube/package.nix

@@ -20,13 +20,13 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "freetube";
-  version = "0.23.11";
+  version = "0.23.12";
 
   src = fetchFromGitHub {
     owner = "FreeTubeApp";
     repo = "FreeTube";
     tag = "v${finalAttrs.version}-beta";
-    hash = "sha256-AmT0zNqFJEG1qjMBgMTUKmEsZrJqocxRzPkTl25HiUs=";
+    hash = "sha256-DH5uT3dPDFZnFYoiMjxpNouNDRbWDctVqvDwHpUlnkY=";
   };
 
   # Darwin requires writable Electron dist

pkgs/by-name/pr/proton-ge-bin/package.nix

@@ -9,11 +9,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "proton-ge-bin";
-  version = "GE-Proton10-17";
+  version = "GE-Proton10-19";
 
   src = fetchzip {
     url = "https://github.com/GloriousEggroll/proton-ge-custom/releases/download/${finalAttrs.version}/${finalAttrs.version}.tar.gz";
-    hash = "sha256-GMwAAKuaBhDv1TvAuW9DVcXSYPRM87NP6NnJfk8O8ZU=";
+    hash = "sha256-vV009ZlYFEAI1jkfMql46QnJXekRup5TqajVSc57f3U=";
   };
 
   dontUnpack = true;

pkgs/by-name/ve/vencord/fix-deps.patch

@@ -0,0 +1,13 @@
+diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
+index 2ba2d317..9758074b 100644
+--- a/pnpm-lock.yaml
++++ b/pnpm-lock.yaml
+@@ -162,7 +162,7 @@ importers:
+         specifier: ^22.13.4
+         version: 22.13.13
+       '@types/react':
+-        specifier: 18.3.1
++        specifier: 19.0.12
+         version: 19.0.12
+       '@types/react-dom':
+         specifier: 18.3.1

pkgs/by-name/ve/vencord/package.nix

@@ -14,20 +14,29 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vencord";
-  version = "1.13.0";
+  version = "1.13.4";
 
   src = fetchFromGitHub {
     owner = "Vendicated";
     repo = "Vencord";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-MdbO74vAbsZyB6seOqxHvQL0HT4IdVnDjd+N3a9XAns=";
+    hash = "sha256-NZuZ3WRHsM94PaGfikwB0Y7RRRPe+64FAfx80kRrQ1U=";
   };
 
-  pnpmDeps = pnpm_10.fetchDeps {
-    inherit (finalAttrs) pname src;
-    fetcherVersion = 2;
-    hash = "sha256-JP9HOaP3DG+2F89tC77JZFD0ls35u/MzxNmvMCbBo9Y=";
-  };
+  patches = [ ./fix-deps.patch ];
+
+  postPatch = ''
+    substituteInPlace packages/vencord-types/package.json \
+      --replace-fail '"@types/react": "18.3.1"' '"@types/react": "19.0.12"'
+  '';
+
+  pnpmDeps =
+    (pnpm_10.fetchDeps {
+      inherit (finalAttrs) pname src;
+      fetcherVersion = 2;
+      hash = "sha256-5MjxEs+jbowJJbJ9+Z+vppFImpB+PZzEhntwRAgv+xM=";
+    }).overrideAttrs
+      { inherit (finalAttrs) patches postPatch; };
 
   nativeBuildInputs = [
     git
@@ -86,6 +95,7 @@ stdenv.mkDerivation (finalAttrs: {
       Gliczy
       NotAShelf
       Scrumplex
+      ryand56
     ];
   };
 })

pkgs/development/libraries/webkitgtk/default.nix

@@ -81,7 +81,7 @@
 # https://webkitgtk.org/2024/10/04/webkitgtk-2.46.html recommends building with clang.
 clangStdenv.mkDerivation (finalAttrs: {
   pname = "webkitgtk";
-  version = "2.50.0";
+  version = "2.50.1";
   name = "${finalAttrs.pname}-${finalAttrs.version}+abi=${
     if lib.versionAtLeast gtk3.version "4.0" then
       "6.0"
@@ -101,7 +101,7 @@ clangStdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://webkitgtk.org/releases/webkitgtk-${finalAttrs.version}.tar.xz";
-    hash = "sha256-5WS4CZ+aOuMkCVObKQu9KtCE6ZttItSqxeUeRVTfi8I=";
+    hash = "sha256-M+kS7m4820uYA3FfUGhq+Fpgr0fxz3KmrMai2xuz2f4=";
   };
 
   patches = lib.optionals clangStdenv.hostPlatform.isLinux [