Merge master into staging-nixos

doc/languages-frameworks/index.md

@@ -60,7 +60,6 @@ android.section.md
 astal.section.md
 beam.section.md
 chicken.section.md
-rocq.section.md
 cosmic.section.md
 crystal.section.md
 cuda.section.md
@@ -96,6 +95,7 @@ pkg-config.section.md
 python.section.md
 qt.section.md
 r.section.md
+rocq.section.md
 ruby.section.md
 rust.section.md
 scheme.section.md

maintainers/maintainer-list.nix

@@ -20404,6 +20404,12 @@
     githubId = 47303199;
     name = "Simon Gutgesell";
   };
+  nonplay = {
+    name = "Artem Ostrasev";
+    email = "nonplay@bxteam.org";
+    github = "NONPLAYT";
+    githubId = 76615486;
+  };
   noodlez1232 = {
     email = "contact@nathanielbarragan.xyz";
     matrix = "@noodlez1232:matrix.org";
@@ -30263,6 +30269,12 @@
     githubId = 36118348;
     keys = [ { fingerprint = "69C9 876B 5797 1B2E 11C5  7C39 80A1 F76F C9F9 54AE"; } ];
   };
+  wiyba = {
+    name = "Dmitry Shmakov";
+    email = "contact@wiyba.org";
+    github = "wiyba";
+    githubId = 81859776;
+  };
   wizardlink = {
     name = "wizardlink";
     email = "contact@thewizard.link";

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -97,6 +97,16 @@
 
 - The `shell_interact()` function on interactive runs of NixOS VM tests has been deprecated. Use the SSH backdoor instead.
 
+- [services.netbox](#opt-services.netbox.enable) has received a number of updates:
+  - Default settings can now be introspected at [](#opt-services.netbox.settings).
+  - Environment files can now be passed at [](#opt-services.netbox.environmentFiles).
+  - When Django [secret key](#opt-services.netbox.secretKeyFile) or [API token peppers](#opt-services.netbox.apiTokenPepperFiles)
+    remain unset, random values will automatically be generated and stored below `/var/lib/netbox`.
+  - Multiple peppers can now be maintained, which allows for pepper rotation.
+  - All options to bind the gunicorn socket have been unified in [](#opt-services.netbox.bind)
+    and the default changed to a UNIX domain socket.
+  - A cookie-cutter nginx vhost can be enabled at [](#opt-services.netbox.nginx.enable).
+
 - `security.run0.enableSudoAlias` now uses the `run0-sudo-shim` instead of a shell-script to improve compatibility.
 
 - With `system.etc.overlay.mutable = false`, NixOS now ships an empty `/etc/machine-id` in the image. Previously the file was absent and systemd logged `System cannot boot: Missing /etc/machine-id and /etc/ is read-only` while `ConditionFirstBoot` fired on every boot. With this change, systemd now overlays a transient ID from `/run/machine-id` for the session, and `systemd-machine-id-commit.service` has `ConditionFirstBoot` so it writes the machine-id through to a persistent backing file when one is bind-mounted over `/etc/machine-id`. To persist the machine-id across reboots, bind-mount a writable file containing `uninitialized` over `/etc/machine-id` from the initrd, or set `systemd.machine_id=` on the kernel command line (use `systemd.machine_id=firmware` to derive a stable ID on hardware that supports it).

nixos/modules/services/matrix/matrix-authentication-service.nix

@@ -45,9 +45,7 @@ let
       pruned;
   configFile = format.generate "config.yaml" finalSettings;
 
-  extraConfigFiles = lib.imap0 (
-    i: _: "$CREDENTIALS_DIRECTORY/config-${toString i}"
-  ) cfg.extraConfigFiles;
+  extraConfigFiles = lib.imap0 (i: _: "%d/config-${toString i}") cfg.extraConfigFiles;
   runtimeConfig = "/run/matrix-authentication-service/config.yaml";
 in
 {

nixos/tests/bentopdf/caddy.nix

@@ -22,7 +22,7 @@ import ../make-test-python.nix (
       machine.wait_for_unit("caddy.service")
       machine.wait_for_open_port(80)
       machine.succeed("curl -vvv --fail --show-error --silent --location --insecure http://localhost/")
-      assert "<title>BentoPDF - The Privacy First PDF Toolkit</title>" in machine.succeed("curl --fail --show-error --silent --location --insecure http://localhost/")
+      assert "<title>PDF Tools</title>" in machine.succeed("curl --fail --show-error --silent --location --insecure http://localhost/")
     '';
   }
 )

nixos/tests/bentopdf/nginx.nix

@@ -18,7 +18,7 @@ import ../make-test-python.nix (
     testScript = ''
       machine.wait_for_unit("nginx.service")
       machine.wait_for_open_port(80)
-      assert "<title>BentoPDF - The Privacy First PDF Toolkit</title>" in machine.succeed("curl --fail --show-error --silent --location --insecure http://localhost:80/")
+      assert "<title>PDF Tools</title>" in machine.succeed("curl --fail --show-error --silent --location --insecure http://localhost:80/")
     '';
   }
 )

nixos/tests/web-apps/netbox-upgrade.nix

@@ -34,23 +34,10 @@ in
         # Pick the NetBox package from this config's "pkgs" argument,
         # so that `nixpkgs.config.permittedInsecurePackages` works
         package = pkgs.${oldNetbox};
-        secretKeyFile = pkgs.writeText "secret" ''
-          abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-        '';
-        apiTokenPeppersFile = pkgs.writeText "pepper" ''
-          kp7ht*76fiQAhUi5dHfASLlYUE_S^gI^(7J^K5M!LfoH@vl&b_
-        '';
-      };
 
-      services.nginx = {
-        enable = true;
-
-        recommendedProxySettings = true;
-
-        virtualHosts.netbox = {
-          default = true;
-          locations."/".proxyPass = "http://localhost:${toString config.services.netbox.port}";
-          locations."/static/".alias = "/var/lib/netbox/static/";
+        nginx = {
+          enable = true;
+          hostname = "localhost";
         };
       };
 
@@ -81,7 +68,7 @@ in
           headers = machine.succeed(
             "curl -sSL http://localhost/api/ --head -H 'Content-Type: application/json'"
           )
-          assert api_version(headers) == version
+          t.assertEqual(api_version(headers), version)
 
       with subtest("NetBox version is the old one"):
           check_api_version("${oldApiVersion}")

nixos/tests/web-apps/netbox/default.nix

@@ -27,23 +27,23 @@ import ../../make-test-python.nix (
 
     skipTypeCheck = true;
 
-    nodes.machine =
+    containers.machine =
       { config, ... }:
       {
-        virtualisation.memorySize = 2048;
+        boot.kernelParams = [
+          # helps debugging seccomp filter issues
+          "audit=1"
+        ];
         services.netbox = {
           enable = true;
           package = netbox;
-          secretKeyFile = pkgs.writeText "secret" ''
-            abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-          '';
-          # Value from https://netbox.readthedocs.io/en/feature/configuration/required-parameters/#api_token_peppers
-          apiTokenPeppersFile = pkgs.writeText "pepper" ''
-            kp7ht*76fiQAhUi5dHfASLlYUE_S^gI^(7J^K5M!LfoH@vl&b_
-          '';
 
-          enableLdap = true;
-          ldapConfigPath = pkgs.writeText "ldap_config.py" ''
+          nginx = {
+            enable = true;
+            hostname = "localhost";
+          };
+
+          ldapConfigFile = pkgs.writeText "ldap_config.py" ''
             import ldap
             from django_auth_ldap.config import LDAPSearch, PosixGroupType
 
@@ -70,18 +70,6 @@ import ../../make-test-python.nix (
           '';
         };
 
-        services.nginx = {
-          enable = true;
-
-          recommendedProxySettings = true;
-
-          virtualHosts.netbox = {
-            default = true;
-            locations."/".proxyPass = "http://localhost:${toString config.services.netbox.port}";
-            locations."/static/".alias = "/var/lib/netbox/static/";
-          };
-        };
-
         # Adapted from the sssd-ldap NixOS test
         services.openldap = {
           enable = true;

nixos/tests/web-apps/netbox/testScript.py

@@ -62,11 +62,11 @@ def compare(a: str, b: str):
 
 with subtest("Home screen loads"):
     machine.wait_until_succeeds(
-        "curl -sSfL http://[::1]:8001 | grep '<title>Home | NetBox</title>'"
+        "curl -sSfL http://[::1]:80 | grep '<title>Home | NetBox</title>'"
     )
 
 with subtest("Staticfiles are generated"):
-    machine.succeed("test -e /var/lib/netbox/static/netbox.js")
+    machine.wait_for_file("/var/lib/netbox/static/netbox.js")
 
 with subtest("Superuser can be created"):
     machine.succeed(
@@ -155,7 +155,7 @@ def patch(uri: str, data: Dict[str, Any]):
     return data_request(uri, "PATCH", data)
 
 with subtest("Can retrieve netbox version"):
-    assert netbox_version == get("/status/")["netbox-version"]
+    t.assertEqual(netbox_version, get("/status/")["netbox-version"])
 
 with subtest("Can create objects"):
     result = post("/dcim/sites/", {"name": "Test site", "slug": "test-site"})
@@ -196,28 +196,28 @@ with subtest("Can create objects"):
 with subtest("Can list objects"):
     result = get("/dcim/sites/")
 
-    assert result["count"] == 1
-    assert result["results"][0]["id"] == site_id
-    assert result["results"][0]["name"] == "Test site"
-    assert result["results"][0]["description"] == ""
+    t.assertEqual(result["count"], 1)
+    t.assertEqual(result["results"][0]["id"], site_id)
+    t.assertEqual(result["results"][0]["name"], "Test site")
+    t.assertEqual(result["results"][0]["description"], "")
 
     result = get("/dcim/device-types/")
-    assert result["count"] == 1
-    assert result["results"][0]["id"] == device_type_id
-    assert result["results"][0]["model"] == "Test device type"
+    t.assertEqual(result["count"], 1)
+    t.assertEqual(result["results"][0]["id"], device_type_id)
+    t.assertEqual(result["results"][0]["model"], "Test device type")
 
 with subtest("Can update objects"):
     new_description = "Test site description"
     patch(f"/dcim/sites/{site_id}/", {"description": new_description})
     result = get(f"/dcim/sites/{site_id}/")
-    assert result["description"] == new_description
+    t.assertEqual(result["description"], new_description)
 
 with subtest("Can delete objects"):
     # Delete a device-type since no object depends on it
     delete(f"/dcim/device-types/{device_type_id}/")
 
     result = get("/dcim/device-types/")
-    assert result["count"] == 0
+    t.assertEqual(result["count"], 0)
 
 def request_graphql(query: str):
     return machine.succeed(
@@ -252,10 +252,10 @@ if compare(netbox_version, '4.2.0') >= 0:
 
         answer = request_graphql(graphql_query)
         result = json.loads(answer)
-        assert len(result["data"]["prefix_list"]) == 3
-        assert test_objects["prefixes"]["v4-with-updated-desc"] in result["data"]["prefix_list"]
-        assert test_objects["prefixes"]["v6-cidr-32"] in result["data"]["prefix_list"]
-        assert test_objects["prefixes"]["v6-cidr-48"] in result["data"]["prefix_list"]
+        t.assertEqual(len(result["data"]["prefix_list"]), 3)
+        t.assertIn(test_objects["prefixes"]["v4-with-updated-desc"], result["data"]["prefix_list"])
+        t.assertIn(test_objects["prefixes"]["v6-cidr-32"], result["data"]["prefix_list"])
+        t.assertIn(test_objects["prefixes"]["v6-cidr-48"], result["data"]["prefix_list"])
 
 if compare(netbox_version, '4.2.0') < 0:
     with subtest("Can use the GraphQL API (Netbox <= 4.2.0)"):
@@ -270,8 +270,8 @@ if compare(netbox_version, '4.2.0') < 0:
         ''')
         result = json.loads(answer)
         print(result["data"]["prefix_list"][0])
-        assert result["data"]["prefix_list"][0]["prefix"] == test_objects["prefixes"]["v4-with-updated-desc"]["prefix"]
-        assert int(result["data"]["prefix_list"][0]["site"]["id"]) == int(test_objects["prefixes"]["v4-with-updated-desc"]["scope"]["id"])
+        t.assertEqual(result["data"]["prefix_list"][0]["prefix"], test_objects["prefixes"]["v4-with-updated-desc"]["prefix"])
+        t.assertEqual(int(result["data"]["prefix_list"][0]["site"]["id"]), int(test_objects["prefixes"]["v4-with-updated-desc"]["scope"]["id"]))
 
 # With 4.5.2 and higher, obtaining a session cookie or token without supplying
 # proper CSRF tokens on the frontend /login/ endpoint is no longer possible
@@ -283,5 +283,8 @@ if compare(netbox_version, '4.5.2') < 0:
     with subtest("Can associate LDAP groups"):
         result = get("/users/users/?username=${testUser}")
 
-        assert result["count"] == 1
-        assert any(group["name"] == "${testGroup}" for group in result["results"][0]["groups"])
+        t.assertEqual(result["count"], 1)
+        t.assertTrue(any(group["name"] == "${testGroup}" for group in result["results"][0]["groups"]))
+
+# Print systemd unit hardening state
+machine.log(machine.execute("systemd-analyze security netbox.service netbox-rq.service netbox-housekeeping.service | grep -v ✓")[1])

nixos/tests/web-apps/pdfding/basic.nix

@@ -17,6 +17,11 @@
           secretKeyFile = pkgs.writeText "secretKeyFile" "test123";
         };
 
+        # NOTE: on aarch64-linux github actions runer due to lack of kvm, we need to delay pdfding start and give it more time to finish
+        systemd.services.pdfding.wantedBy = lib.mkIf pkgs.stdenv.hostPlatform.isAarch64 (lib.mkForce [ ]);
+        systemd.services.pdfding.serviceConfig.TimeoutStartSec =
+          lib.mkIf pkgs.stdenv.hostPlatform.isAarch64 "900";
+
         environment.systemPackages = with pkgs; [
           sqlite
         ];
@@ -60,6 +65,7 @@
 
       # create admin
       machine.wait_for_unit("multi-user.target")
+      machine.succeed("systemctl start pdfding.service")
       machine.wait_for_open_port(${toString port})
       machine.succeed("DJANGO_SUPERUSER_PASSWORD=admin pdfding-manage createsuperuser --no-input --username admin --email admin@localhost")
 

nixos/tests/web-apps/pdfding/postgres.nix

@@ -22,6 +22,14 @@
           installTestHelpers = true;
         };
 
+        # NOTE: on aarch64-linux github actions runer due to lack of kvm, we need to delay pdfding start and give it more time to finish
+        systemd.services.pdfding.wantedBy = lib.mkIf pkgs.stdenv.hostPlatform.isAarch64 (lib.mkForce [ ]);
+        systemd.services.pdfding.serviceConfig.TimeoutStartSec =
+          lib.mkIf pkgs.stdenv.hostPlatform.isAarch64 "900";
+        systemd.services.pdfding-background.wantedBy = lib.mkIf pkgs.stdenv.hostPlatform.isAarch64 (
+          lib.mkForce [ ]
+        );
+
         environment.systemPackages = [
           config.services.postgresql.finalPackage
         ];
@@ -46,6 +54,8 @@
 
       # create admin
       machine.wait_for_unit("multi-user.target")
+      machine.succeed("systemctl start pdfding.service")
+      machine.succeed("systemctl start pdfding-background.service")
       machine.wait_for_open_port(${toString port})
 
       machine.succeed("DJANGO_SUPERUSER_PASSWORD=admin pdfding-manage createsuperuser --no-input --username admin --email admin@localhost")

nixos/tests/web-apps/pdfding/s3-backups.nix

@@ -31,12 +31,20 @@ in
           backup.schedule = "*/1 * * * *";
           backup.endpoint = "[::]:3900";
           extraEnvironment.BACKUP_BUCKET_NAME = "pdfding-bucket";
-          extraEnvironment.BACKUP_REGION = "garage";
+          extraEnvironment.BACKUP_REGION = "us-east-1";
 
           envFiles = [ pdfding-s3-keys ];
           installTestHelpers = true;
         };
 
+        # NOTE: on aarch64-linux github actions runer due to lack of kvm, we need to delay pdfding start and give it more time to finish
+        systemd.services.pdfding.wantedBy = lib.mkIf pkgs.stdenv.hostPlatform.isAarch64 (lib.mkForce [ ]);
+        systemd.services.pdfding.serviceConfig.TimeoutStartSec =
+          lib.mkIf pkgs.stdenv.hostPlatform.isAarch64 "900";
+        systemd.services.pdfding-background.wantedBy = lib.mkIf pkgs.stdenv.hostPlatform.isAarch64 (
+          lib.mkForce [ ]
+        );
+
         # Setup a local garage service for the backup feature
         # taken from garage nixosTest
         services.garage = {
@@ -48,7 +56,7 @@ in
             rpc_secret = "5c1915fa04d0b6739675c61bf5907eb0fe3d9c69850c83820f51b4d25d13868c";
 
             s3_api = {
-              s3_region = "garage";
+              s3_region = "us-east-1";
               api_bind_addr = "[::]:3900";
               root_domain = ".s3.garage";
             };
@@ -113,6 +121,8 @@ in
 
       # create admin
       machine.wait_for_unit("multi-user.target")
+      machine.succeed("systemctl start pdfding.service")
+      machine.succeed("systemctl start pdfding-background.service")
       machine.wait_for_open_port(${toString port})
       machine.succeed("DJANGO_SUPERUSER_PASSWORD=admin pdfding-manage createsuperuser --no-input --username admin --email admin@localhost")
 
@@ -140,7 +150,7 @@ in
           -F "description=" \
           -F "collection=1" \
           -F "use_file_name=on" \
-          -F "name=test-upload" \
+          -F "name=dummy" \
           -F "file=@{test_pdf};type=application/pdf" \
           -F "csrfmiddlewaretoken=$csrf_token" \
           -H "Referer: {endpoint}/pdf/add" \

pkgs/applications/editors/jupyter-kernels/xeus-cling/0001-Fix-bug-in-extract_filename.patch

@@ -1,50 +0,0 @@
-From 8bfa594bc37630956f80496106bb1d6070035570 Mon Sep 17 00:00:00 2001
-From: thomasjm <tom@codedown.io>
-Date: Wed, 2 Aug 2023 18:26:58 -0700
-Subject: [PATCH 1/3] Fix bug in extract_filename
-
----
- src/main.cpp | 12 ++++++------
- 1 file changed, 6 insertions(+), 6 deletions(-)
-
-diff --git a/src/main.cpp b/src/main.cpp
-index 2ee19be..57294b4 100644
---- a/src/main.cpp
-+++ b/src/main.cpp
-@@ -61,19 +61,19 @@ bool should_print_version(int argc, char* argv[])
-     return false;
- }
- 
--std::string extract_filename(int argc, char* argv[])
-+std::string extract_filename(int *argc, char* argv[])
- {
-     std::string res = "";
--    for (int i = 0; i < argc; ++i)
-+    for (int i = 0; i < *argc; ++i)
-     {
--        if ((std::string(argv[i]) == "-f") && (i + 1 < argc))
-+        if ((std::string(argv[i]) == "-f") && (i + 1 < *argc))
-         {
-             res = argv[i + 1];
--            for (int j = i; j < argc - 2; ++j)
-+            for (int j = i; j < *argc - 2; ++j)
-             {
-                 argv[j] = argv[j + 2];
-             }
--            argc -= 2;
-+            *argc -= 2;
-             break;
-         }
-     }
-@@ -128,7 +128,7 @@ int main(int argc, char* argv[])
- #endif
-     signal(SIGINT, stop_handler);
- 
--    std::string file_name = extract_filename(argc, argv);
-+    std::string file_name = extract_filename(&argc, argv);
- 
-     interpreter_ptr interpreter = build_interpreter(argc, argv);
- 
--- 
-2.40.1
-

pkgs/applications/editors/jupyter-kernels/xeus-cling/0002-Don-t-pass-extra-includes-configure-this-with-flags.patch

@@ -1,34 +0,0 @@
-From 9e6a14bb20567071883563dafb5dfaf512df6243 Mon Sep 17 00:00:00 2001
-From: thomasjm <tom@codedown.io>
-Date: Wed, 2 Aug 2023 18:27:16 -0700
-Subject: [PATCH 2/3] Don't pass extra includes; configure this with flags
-
----
- src/main.cpp | 4 +---
- 1 file changed, 1 insertion(+), 3 deletions(-)
-
-diff --git a/src/main.cpp b/src/main.cpp
-index 57294b4..0041a55 100644
---- a/src/main.cpp
-+++ b/src/main.cpp
-@@ -84,7 +84,7 @@ using interpreter_ptr = std::unique_ptr<xcpp::interpreter>;
- 
- interpreter_ptr build_interpreter(int argc, char** argv)
- {
--    int interpreter_argc = argc + 1;
-+    int interpreter_argc = argc;
-     const char** interpreter_argv = new const char*[interpreter_argc];
-     interpreter_argv[0] = "xeus-cling";
-     // Copy all arguments in the new array excepting the process name.
-@@ -92,8 +92,6 @@ interpreter_ptr build_interpreter(int argc, char** argv)
-     {
-         interpreter_argv[i] = argv[i];
-     }
--    std::string include_dir = std::string(LLVM_DIR) + std::string("/include");
--    interpreter_argv[interpreter_argc - 1] = include_dir.c_str();
- 
-     interpreter_ptr interp_ptr = interpreter_ptr(new xcpp::interpreter(interpreter_argc, interpreter_argv));
-     delete[] interpreter_argv;
--- 
-2.40.1
-

pkgs/applications/editors/jupyter-kernels/xeus-cling/0003-Remove-unsupported-src-root-flag.patch

@@ -1,85 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 43718f5..d0d8670 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -63,8 +63,7 @@ if(LLVM_CONFIG)
-         "--bindir"
-         "--libdir"
-         "--includedir"
--        "--prefix"
--        "--src-root")
-+        "--prefix")
-     execute_process(COMMAND ${CONFIG_COMMAND}
-                     RESULT_VARIABLE HAD_ERROR
-                     OUTPUT_VARIABLE CONFIG_OUTPUT)
-diff --git a/src/xmagics/executable.cpp b/src/xmagics/executable.cpp
-index 391c8c9..aba5e03 100644
---- a/src/xmagics/executable.cpp
-+++ b/src/xmagics/executable.cpp
-@@ -12,6 +12,7 @@
- #include <iterator>
- #include <fstream>
- #include <memory>
-+#include <optional>
- #include <string>
- #include <vector>
- 
-@@ -25,7 +26,7 @@
- #include "clang/AST/ASTContext.h"
- #include "clang/AST/DeclGroup.h"
- #include "clang/AST/RecursiveASTVisitor.h"
--#include "clang/Basic/DebugInfoOptions.h"
-+#include "llvm/Frontend/Debug/Options.h"
- #include "clang/Basic/Sanitizers.h"
- #include "clang/Basic/TargetInfo.h"
- #include "clang/CodeGen/BackendUtil.h"
-@@ -115,7 +116,7 @@ namespace xcpp
-             // Filter out functions added by Cling.
-             if (auto Identifier = D->getIdentifier())
-             {
--                if (Identifier->getName().startswith("__cling"))
-+                if (Identifier->getName().starts_with("__cling"))
-                 {
-                     return true;
-                 }
-@@ -153,12 +154,13 @@ namespace xcpp
-         if (EnableDebugInfo)
-         {
-             CodeGenOpts.setDebugInfo(
--                clang::codegenoptions::DebugInfoKind::FullDebugInfo);
-+                llvm::codegenoptions::DebugInfoKind::FullDebugInfo);
-         }
- 
-         std::unique_ptr<clang::CodeGenerator> CG(clang::CreateLLVMCodeGen(
--            CI->getDiagnostics(), "object", HeaderSearchOpts,
--            CI->getPreprocessorOpts(), CodeGenOpts, *Context));
-+            CI->getDiagnostics(), "object", 
-+            llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>(&CI->getVirtualFileSystem()),
-+            HeaderSearchOpts, CI->getPreprocessorOpts(), CodeGenOpts, *Context));
-         CG->Initialize(AST);
- 
-         FindTopLevelDecls Visitor(CG.get());
-@@ -186,7 +188,9 @@ namespace xcpp
-         EmitBackendOutput(CI->getDiagnostics(), HeaderSearchOpts,
-                           CodeGenOpts, CI->getTargetOpts(),
-                           CI->getLangOpts(), DataLayout, CG->GetModule(),
--                          clang::Backend_EmitObj, std::move(OS));
-+                          clang::Backend_EmitObj, 
-+                          llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>(&CI->getVirtualFileSystem()),
-+                          std::move(OS));
-         return true;
-     }
- 
-@@ -222,10 +226,10 @@ namespace xcpp
- 
-         llvm::StringRef OutputFileStr(OutputFile);
-         llvm::StringRef ErrorFileStr(ErrorFile);
--        llvm::SmallVector<llvm::Optional<llvm::StringRef>, 16> Redirects = {llvm::NoneType::None, OutputFileStr, ErrorFileStr};
-+        llvm::SmallVector<std::optional<llvm::StringRef>, 16> Redirects = {std::nullopt, OutputFileStr, ErrorFileStr};
- 
-         // Finally run the linker.
--        int ret = llvm::sys::ExecuteAndWait(Compiler, Args, llvm::NoneType::None,
-+        int ret = llvm::sys::ExecuteAndWait(Compiler, Args, std::nullopt,
-                                             Redirects);
- 
-         // Read back output and error streams.

pkgs/applications/editors/jupyter-kernels/xeus-cling/default.nix

@@ -1,94 +0,0 @@
-{
-  lib,
-  callPackage,
-  cling,
-  fetchurl,
-  jq,
-  makeWrapper,
-  python3,
-  stdenv,
-}:
-
-# Jupyter console:
-# nix run --impure --expr 'with import <nixpkgs> {}; jupyter-console.withSingleKernel cpp17-kernel'
-
-# Jupyter notebook:
-# nix run --impure --expr 'with import <nixpkgs> {}; jupyter.override { definitions = { cpp17 = cpp17-kernel; }; }'
-
-let
-  xeus-cling-unwrapped = callPackage ./xeus-cling.nix { };
-
-  xeus-cling = xeus-cling-unwrapped.overrideAttrs (oldAttrs: {
-    nativeBuildInputs = oldAttrs.nativeBuildInputs ++ [ makeWrapper ];
-
-    # xcpp needs a collection of flags to start up properly, so wrap it by default.
-    # We'll provide the unwrapped version as a passthru
-    flags = cling.flags ++ [
-      "-resource-dir"
-      "${cling.unwrapped}"
-      "-L"
-      "${cling.unwrapped}/lib"
-      "-l"
-      "${cling.unwrapped}/lib/cling.so"
-    ];
-
-    fixupPhase = ''
-      runHook preFixup
-
-      wrapProgram $out/bin/xcpp --add-flags "$flags"
-
-      runHook postFixup
-    '';
-
-    doInstallCheck = true;
-    installCheckPhase = ''
-      runHook preInstallCheck
-
-      # Smoke check: run a test notebook using Papermill by creating a simple kernelspec
-      mkdir -p kernels/cpp17
-      export JUPYTER_PATH="$(pwd)"
-      cat << EOF > kernels/cpp17/kernel.json
-      {
-        "argv": ["$out/bin/xcpp", "-std=c++17", "-f", "{connection_file}"],
-        "language": "cpp17"
-      }
-      EOF
-
-      ${python3.pkgs.papermill}/bin/papermill ${./test.ipynb} out.ipynb
-      result="$(cat out.ipynb | ${jq}/bin/jq -r '.cells[0].outputs[0].text[0]')"
-      if [[ "$result" != "Hello world." ]]; then
-        echo "Kernel test gave '$result'. Expected: 'Hello world.'"
-        exit 1
-      fi
-
-      runHook postInstallCheck
-    '';
-
-    passthru = (oldAttrs.passthru or { }) // {
-      unwrapped = xeus-cling-unwrapped;
-    };
-  });
-
-  mkKernelSpec = std: {
-    displayName = builtins.replaceStrings [ "c++" ] [ "C++ " ] std;
-    argv = [
-      "${xeus-cling}/bin/xcpp"
-      "-std=${std}"
-      "-f"
-      "{connection_file}"
-    ];
-    language = "cpp";
-    logo32 = "${xeus-cling-unwrapped}/share/jupyter/kernels/xcpp17/logo-32x32.png";
-    logo64 = "${xeus-cling-unwrapped}/share/jupyter/kernels/xcpp17/logo-64x64.png";
-  };
-
-in
-
-{
-  cpp11-kernel = mkKernelSpec "c++11";
-  cpp14-kernel = mkKernelSpec "c++14";
-  cpp17-kernel = mkKernelSpec "c++17";
-  cpp2a-kernel = mkKernelSpec "c++2a";
-
-  inherit xeus-cling;
-}

pkgs/applications/editors/jupyter-kernels/xeus-cling/test.ipynb

@@ -1,24 +0,0 @@
-{
- "cells": [
-  {
-   "cell_type": "code",
-   "execution_count": 1,
-   "id": "574ed398-7bfe-4a34-a7dd-9fa85535aed2",
-   "metadata": {},
-   "outputs": [],
-   "source": [
-    "#include <iostream>\n",
-    "std::cout << \"Hello world.\";"
-   ]
-  }
- ],
- "metadata": {
-  "kernelspec": {
-   "display_name": "C++ 17",
-   "language": "cpp",
-   "name": "cpp17"
-  }
- },
- "nbformat": 4,
- "nbformat_minor": 5
-}

pkgs/applications/editors/jupyter-kernels/xeus-cling/xeus-cling.nix

@@ -1,112 +0,0 @@
-{
-  lib,
-  clangStdenv,
-  cmake,
-  fetchFromGitHub,
-  llvmPackages_18,
-  # Libraries
-  argparse,
-  cling,
-  cppzmq,
-  libuuid,
-  ncurses,
-  openssl,
-  pugixml,
-  xeus,
-  xeus-zmq,
-  xtl,
-  zeromq,
-  zlib,
-  # Settings
-  debug ? false,
-}:
-
-let
-  # Nixpkgs moved to argparse 3.x, but we need ~2.9
-  argparse_2_9 = argparse.overrideAttrs (oldAttrs: {
-    version = "2.9";
-
-    src = fetchFromGitHub {
-      owner = "p-ranav";
-      repo = "argparse";
-      rev = "v2.9";
-      sha256 = "sha256-vbf4kePi5gfg9ub4aP1cCK1jtiA65bUS9+5Ghgvxt/E=";
-    };
-  });
-
-  # Nixpkgs moved to xeus 5.2.0, but we need 3.2.0
-  # https://github.com/jupyter-xeus/xeus-cling/issues/523
-  xeus_3_2_0 = xeus.overrideAttrs (oldAttrs: {
-    version = "3.2.0";
-
-    src = fetchFromGitHub {
-      owner = "jupyter-xeus";
-      repo = "xeus";
-      tag = "3.2.0";
-      sha256 = "sha256-D/dJ0SHxTHJw63gHD6FRZS7O2TVZ0voIv2mQASEjLA8=";
-    };
-
-    buildInputs = oldAttrs.buildInputs ++ lib.singleton xtl;
-  });
-
-in
-
-clangStdenv.mkDerivation (finalAttrs: {
-  pname = "xeus-cling";
-  version = "0.15.3";
-
-  src = fetchFromGitHub {
-    owner = "QuantStack";
-    repo = "xeus-cling";
-    rev = "${finalAttrs.version}";
-    hash = "sha256-OfZU+z+p3/a36GntusBfwfFu3ssJW4Fu7SV3SMCoo1I=";
-  };
-
-  patches = [
-    ./0001-Fix-bug-in-extract_filename.patch
-    ./0002-Don-t-pass-extra-includes-configure-this-with-flags.patch
-    ./0003-Remove-unsupported-src-root-flag.patch
-  ];
-
-  nativeBuildInputs = [ cmake ];
-  buildInputs = [
-    argparse_2_9
-    cling.unwrapped
-    cppzmq
-    libuuid
-    llvmPackages_18.llvm
-    ncurses
-    openssl
-    pugixml
-    xeus_3_2_0
-    xeus-zmq
-    xtl
-    zeromq
-    zlib
-  ];
-
-  cmakeBuildType = if debug then "Debug" else "Release";
-
-  postPatch = ''
-    substituteInPlace src/xmagics/executable.cpp \
-      --replace-fail "getDataLayout" "getDataLayoutString"
-    substituteInPlace src/xmagics/execution.cpp \
-      --replace-fail "simplisticCastAs" "castAs"
-    substituteInPlace src/xmime_internal.hpp \
-      --replace-fail "code.str()" "code.str().str()"
-
-    substituteInPlace CMakeLists.txt \
-      --replace-fail "cmake_minimum_required(VERSION 3.4.3)" "cmake_minimum_required(VERSION 3.10)"
-  '';
-
-  dontStrip = debug;
-
-  meta = {
-    description = "Jupyter kernel for the C++ programming language";
-    mainProgram = "xcpp";
-    homepage = "https://github.com/jupyter-xeus/xeus-cling";
-    maintainers = with lib.maintainers; [ thomasjm ];
-    platforms = lib.platforms.unix;
-    license = lib.licenses.mit;
-  };
-})

pkgs/applications/editors/jupyter-kernels/xeus-cpp/default.nix

@@ -0,0 +1,37 @@
+{
+  callPackage,
+}:
+
+# Jupyter console:
+# nix run --impure --expr 'with import <nixpkgs> {}; jupyter-console.withSingleKernel cpp17-kernel'
+
+# Jupyter notebook:
+# nix shell --impure --expr 'with import <nixpkgs> {}; [ (jupyter.override { definitions = { cpp17 = cpp17-kernel; }; }) ]' -c jupyter-notebook
+
+let
+  xeus-cpp = callPackage ./xeus-cpp.nix { };
+
+  mkKernelSpec = std: {
+    displayName = builtins.replaceStrings [ "c++" ] [ "C++ " ] std;
+    argv = [
+      "${xeus-cpp}/bin/xcpp"
+      "-std=${std}"
+      "-f"
+      "{connection_file}"
+    ];
+    language = "cpp";
+    logo32 = "${xeus-cpp}/share/jupyter/kernels/xcpp17/logo-32x32.png";
+    logo64 = "${xeus-cpp}/share/jupyter/kernels/xcpp17/logo-64x64.png";
+  };
+
+in
+
+{
+  cpp11-kernel = mkKernelSpec "c++11";
+  cpp14-kernel = mkKernelSpec "c++14";
+  cpp17-kernel = mkKernelSpec "c++17";
+  cpp20-kernel = mkKernelSpec "c++20";
+  cpp23-kernel = mkKernelSpec "c++23";
+
+  inherit xeus-cpp;
+}

pkgs/applications/editors/jupyter-kernels/xeus-cpp/xeus-cpp.nix

@@ -0,0 +1,183 @@
+{
+  lib,
+  clangStdenv,
+  fetchFromGitHub,
+  cmake,
+  pkg-config,
+
+  cpp-interop,
+  cling,
+
+  # Jupyter / xeus stack
+  xeus,
+  xeus-zmq,
+  nlohmann_json,
+  argparse,
+  pugixml,
+
+  # Runtime libs
+  zeromq,
+  openssl,
+  libuuid,
+  curl,
+  makeWrapper,
+
+  # tests
+  doctest,
+
+  # installCheck
+  python3,
+  jq,
+
+  # "clang-repl" | "cling"
+  backend ? "clang-repl",
+}:
+
+let
+  stdenv = clangStdenv;
+
+  useCling = backend == "cling";
+  cppInterop = cpp-interop.override { inherit backend; };
+
+  # xeus-cpp 0.10.0 needs newer xeus / xeus-zmq than nixpkgs ships by default.
+  xeus_6 = xeus.overrideAttrs (old: {
+    version = "6.0.5";
+    src = fetchFromGitHub {
+      owner = "jupyter-xeus";
+      repo = "xeus";
+      tag = "6.0.5";
+      hash = "sha256-nbjq4dzrukVsZI6X3lWpr9oCZV5IUu/vkqSNKD7o3vo=";
+    };
+    doCheck = false;
+  });
+
+  xeus_zmq_4 = (xeus-zmq.override { xeus = xeus_6; }).overrideAttrs (old: {
+    version = "4.0.0";
+    src = fetchFromGitHub {
+      owner = "jupyter-xeus";
+      repo = "xeus-zmq";
+      tag = "4.0.0";
+      hash = "sha256-Ux8klPh33XWFu9eu+GTk5ZcqIcoP/GM4/J1uaz9xRHI=";
+    };
+  });
+
+  # The interpreter behind CppInterOp must be told where the C/C++ standard
+  # library and Clang builtin headers live: there is no system compiler to detect
+  # at runtime in the Nix sandbox. We pass this set via CppInterOp's runtime
+  # override env var. For the Cling backend cling.flags already carries it; for
+  # clang-repl we reuse the hermetic resource dir and include flags CppInterOp
+  # exposes.
+  resourceDir = if useCling then "${cling.unwrapped}/lib/clang/20" else cppInterop.resourceDir;
+  interpreterArgs = lib.concatStringsSep " " (
+    if useCling then cling.flags else cppInterop.interpreterArgs
+  );
+in
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xeus-cpp";
+  version = "0.10.0";
+
+  src = fetchFromGitHub {
+    owner = "compiler-research";
+    repo = "xeus-cpp";
+    tag = finalAttrs.version;
+    hash = "sha256-r6ojIcebWzpP85Djl36EMucnfQQgjGJUakSbMYW+czs=";
+  };
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    makeWrapper
+  ];
+
+  buildInputs = [
+    cppInterop
+    xeus_6
+    xeus_zmq_4
+    nlohmann_json
+    argparse
+    pugixml
+    zeromq
+    openssl
+    libuuid
+    curl
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "XEUS_CPP_BUILD_TESTS" finalAttrs.finalPackage.doCheck)
+    "-DXEUS_CPP_RESOURCE_DIR=${resourceDir}"
+  ];
+
+  # Make the kernel hermetic: hand the interpreter the include/resource flags it
+  # needs, since it cannot probe a system compiler in the sandbox.
+  postInstall = ''
+    wrapProgram $out/bin/xcpp \
+      --set-default CPPINTEROP_EXTRA_INTERPRETER_ARGS "${interpreterArgs}"
+
+    # xeus-cpp builds the kernelspec argv from CMAKE_INSTALL_PREFIX *and* the
+    # (absolute, under Nix) CMAKE_INSTALL_BINDIR, producing a doubled store path
+    # for xcpp. Point each kernel.json back at the wrapped binary.
+    for k in $out/share/jupyter/kernels/*/kernel.json; do
+      substituteInPlace "$k" --replace-fail "$out/$out/bin/xcpp" "$out/bin/xcpp"
+    done
+  '';
+
+  # Run the upstream doctest suite. Like the wrapped kernel, the test binary
+  # drives CppInterOp directly, so it needs the same hermetic interpreter args.
+  doCheck = true;
+  checkInputs = [ doctest ];
+  checkPhase = ''
+    runHook preCheck
+
+    export CPPINTEROP_EXTRA_INTERPRETER_ARGS="${interpreterArgs}"
+    # The test binary is linked with the install RPATH ($out/lib), which does not
+    # exist yet at check time; point it at the freshly built libxeus-cpp instead.
+    export LD_LIBRARY_PATH="$PWD''${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
+    cmake --build . --target check-xeus-cpp
+
+    runHook postCheck
+  '';
+
+  # Smoke test: drive the installed, wrapped kernel through Papermill and check
+  # it actually compiles and runs C++.
+  doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    export HOME=$(mktemp -d)
+    mkdir -p "$HOME/kernels/xcpp"
+    cat > "$HOME/kernels/xcpp/kernel.json" <<EOF
+    {"argv":["$out/bin/xcpp","-std=c++17","-f","{connection_file}"],"language":"cpp","display_name":"C++"}
+    EOF
+    export JUPYTER_PATH="$HOME"
+
+    cat > "$HOME/test.ipynb" <<'NBEOF'
+    {"cells":[
+      {"cell_type":"code","id":"a","metadata":{},"execution_count":null,"outputs":[],"source":["#include <iostream>"]},
+      {"cell_type":"code","id":"b","metadata":{},"execution_count":null,"outputs":[],"source":["std::cout << \"Hello world.\" << std::endl;"]}
+    ],"metadata":{"kernelspec":{"name":"xcpp","display_name":"C++","language":"cpp"}},"nbformat":4,"nbformat_minor":5}
+    NBEOF
+
+    ${python3.pkgs.papermill}/bin/papermill "$HOME/test.ipynb" "$HOME/out.ipynb" --kernel xcpp
+    ${jq}/bin/jq -e '[.. | .text? // empty | tostring] | add | contains("Hello world.")' "$HOME/out.ipynb"
+
+    runHook postInstallCheck
+  '';
+
+  passthru = {
+    inherit backend;
+    flags = interpreterArgs;
+  };
+
+  meta = {
+    description = "Jupyter kernel for C++ based on CppInterOp (${backend} backend)";
+    mainProgram = "xcpp";
+    homepage = "https://github.com/compiler-research/xeus-cpp";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ thomasjm ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/applications/editors/vscode/extensions/default.nix

@@ -3924,8 +3924,8 @@ let
         mktplcRef = {
           publisher = "redhat";
           name = "vscode-yaml";
-          version = "1.23.0";
-          hash = "sha256-GC7AIQIUw+F5rBscTe+ulKt/97s7p636TLRvmcT9b9c=";
+          version = "1.24.0";
+          hash = "sha256-Bmh1gxKn+mvtolnKWmhJ2QxdUZ32QV7b4kbBNeBtcWg=";
         };
         meta = {
           description = "YAML Language Support by Red Hat, with built-in Kubernetes syntax support";

pkgs/applications/editors/vscode/extensions/tombi-toml.tombi/default.nix

@@ -7,19 +7,19 @@
 let
   supported = {
     x86_64-linux = {
-      hash = "sha256-YLic8tKnb6WSx4rdwTu8B2ybfjoSbXc+QfEZ0Vc4umo=";
+      hash = "sha256-DWrKvjWpUYvyqgZCShqwBKw33MHW31cxb4ERV65O+uc=";
       arch = "linux-x64";
     };
     x86_64-darwin = {
-      hash = "sha256-nbftXgjEAxGfT4sfTjd+bp+Ti/rWJGHLkaSXQWlRGBM=";
+      hash = "sha256-CYDutYtU0+AAn6PYO/EQ/Suv8BNuMtvePpFdKRtiqAs=";
       arch = "darwin-x64";
     };
     aarch64-linux = {
-      hash = "sha256-FG6OIoeeDenMbgwM/ZE8YyTySt/XcoFJj1RxvlrPsXc=";
+      hash = "sha256-iFHeZiTubXA/t2Gib9hP42d7yjq/WRyywp+l8VhGfmo=";
       arch = "linux-arm64";
     };
     aarch64-darwin = {
-      hash = "sha256-FW+pmz8YTw6pYxx1x3UsT3Dtp00GT804MJX4HBarMZo=";
+      hash = "sha256-qe7K3PQIgZztIdOVx37LGXrzBmYui2o2CcmDK+5jaFM=";
       arch = "darwin-arm64";
     };
   };
@@ -34,7 +34,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = base // {
     name = "tombi";
     publisher = "tombi-toml";
-    version = "1.1.5";
+    version = "1.1.7";
   };
   meta = {
     description = "TOML Language Server";

pkgs/applications/emulators/libretro/cores/beetle-saturn.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-saturn";
-  version = "0-unstable-2026-06-29";
+  version = "0-unstable-2026-07-07";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-saturn-libretro";
-    rev = "8299b65134eded90db3fe5edb6aaa98e02bd9cae";
-    hash = "sha256-E83T6TUzy2envOh25xZ/y6kKb+lk67nOHp1dJXK4UK4=";
+    rev = "6f0cb9d1b9689601cd7dbf08e992d232304f50f7";
+    hash = "sha256-Q50CQDLO090csrF73fo2qxzIaV7o3E8YS9MdQZBp/V8=";
   };
 
   makefile = "Makefile";

pkgs/by-name/ap/apfel-llm/package.nix

@@ -8,7 +8,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "apfel-llm";
-  version = "1.7.0";
+  version = "1.8.3";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
   # Building from source requires swift 6.3.0 while nixpkgs only has 5.10.1
   src = fetchurl {
     url = "https://github.com/Arthur-Ficial/apfel/releases/download/v${finalAttrs.version}/apfel-${finalAttrs.version}-arm64-macos.tar.gz";
-    hash = "sha256-q0DvI+D52Rz/LWQDX/oVRWJqeepJY8+CLOWrZT4yInk=";
+    hash = "sha256-1AA86f5+Poo5YCrtxT1rAPGBctQbNa5hdAZmI008/yU=";
   };
 
   sourceRoot = ".";

pkgs/by-name/as/astc-encoder/package.nix

@@ -47,13 +47,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "astc-encoder";
-  version = "5.4.0";
+  version = "5.6.0";
 
   src = fetchFromGitHub {
     owner = "ARM-software";
     repo = "astc-encoder";
     tag = finalAttrs.version;
-    hash = "sha256-mpaLSf1K+SsxkQm/b+QIWU34TzHQ7CAkyDNczBrcmBo=";
+    hash = "sha256-2/3m5G7rMoc/qZ9wPN3kn7O/CdQbWnKyU5OvAIxx97A=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/at/atuin/package.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "atuin";
-  version = "18.16.1";
+  version = "18.17.0";
 
   src = fetchFromGitHub {
     owner = "atuinsh";
     repo = "atuin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-XrJFetPs7TsbX5Cxekj+h3hlmQLoOpB7U+c36NM/jeA=";
+    hash = "sha256-cciogPSlbfiC9U3Dv+IGyuRI9PU9X4LdlequCFiG/a0=";
   };
 
-  cargoHash = "sha256-eqxeE7+UxBTdaYjlonOz6pYQ3mar8lNUd/K0CSuzquc=";
+  cargoHash = "sha256-QX1JupLZafRdMUZjl58iFjiPgLSTYZazRVyU88n5QP8=";
 
   # atuin's default features include 'check-updates', which do not make sense
   # for distribution builds. List all other default features.

pkgs/by-name/aw/aws-cdk-cli/package.nix

@@ -18,19 +18,19 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "aws-cdk-cli";
-  version = "2.1128.1";
+  version = "2.1129.0";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-cdk-cli";
     tag = "cdk@v${finalAttrs.version}";
-    hash = "sha256-F5dlS2xIwVxpgc6v+bP+vI0lP+nttvKamzWz4UEphzc=";
+    hash = "sha256-KXbNrzylyY+RSp4Da9rMSEn7UdPTHU9iDID/qXGL+io=";
   };
 
   missingHashes = ./missing-hashes.json;
   offlineCache = yarn-berry.fetchYarnBerryDeps {
     inherit (finalAttrs) src missingHashes;
-    hash = "sha256-ykFox4QTo0f0urzh1e/65Jh0H3x0wOngmEzWFekCma8=";
+    hash = "sha256-jh/EW+scTCJ698jKr1eRYeckRhgE+SmOjfUUgJ7GbFU=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/az/azahar/package.nix

@@ -61,7 +61,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "azahar";
-  version = "2125.1.2";
+  version = "2125.1.3";
 
   src = fetchFromGitHub {
     owner = "azahar-emu";
@@ -74,7 +74,7 @@ stdenv.mkDerivation (finalAttrs: {
       echo "${finalAttrs.version}" > "$out/GIT-TAG"
       git -C "$out" rev-parse HEAD > "$out/GIT-COMMIT"
     '';
-    hash = "sha256-B3mReLoVqFCqUeunst95AX0veGlZJNyeBBdDIFbf4HI=";
+    hash = "sha256-jn5Ib5jM/6zHuCjWoMkTvs0nR29mAbTlvID5aYZLw5o=";
   };
 
   strictDeps = true;

pkgs/by-name/az/azimuth/package.nix

@@ -3,44 +3,49 @@
   stdenv,
   fetchFromGitHub,
   libGL,
-  SDL,
+  SDL2,
   which,
+  pkg-config,
   installTool ? false,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "azimuth";
-  version = "1.0.3";
+  version = "1.0.4";
 
   src = fetchFromGitHub {
     owner = "mdsteele";
     repo = "azimuth";
-    rev = "v${finalAttrs.version}";
-    sha256 = "1znfvpmqiixd977jv748glk5zc4cmhw5813zp81waj07r9b0828r";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-N5Ahetw/zOXDrEiR1umQNF6i3yeawavoLceiU+xD//g=";
   };
 
-  nativeBuildInputs = [ which ];
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    which
+  ];
+
   buildInputs = [
     libGL
-    SDL
+    SDL2
   ];
 
   env.NIX_CFLAGS_COMPILE = toString [ "-Wno-error=maybe-uninitialized" ];
 
-  preConfigure = ''
-    substituteInPlace data/azimuth.desktop \
-      --replace Exec=azimuth "Exec=$out/bin/azimuth" \
-      --replace "Version=%AZ_VERSION_NUMBER" "Version=${finalAttrs.version}"
-  '';
-
   makeFlags = [
     "BUILDTYPE=release"
-    "INSTALLDIR=$(out)"
-  ]
-  ++ (if installTool then [ "INSTALLTOOL=true" ] else [ "INSTALLTOOL=false" ]);
+    "PREFIX=${placeholder "out"}"
+    "INSTALLTOOL=${if installTool then "true" else "false"}"
+  ];
 
   enableParallelBuilding = true;
 
+  doCheck = true;
+  checkTarget = "test";
+
   meta = {
     description = "Metroidvania game using only vectorial graphic";
     mainProgram = "azimuth";

pkgs/by-name/be/beidconnect/package.nix

@@ -10,13 +10,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "beidconnect";
-  version = "2.11";
+  version = "2.12";
 
   src = fetchFromGitHub {
     owner = "Fedict";
     repo = "fts-beidconnect";
     rev = finalAttrs.version;
-    hash = "sha256-4eKO2yw2Ipfu1PvebgOR+BihsLlnWIJejGWqjztPA2I=";
+    hash = "sha256-ZFxq/rJP0/KSsi2qsXyKY9Fmb+JxeakTdso5FsVu1/c=";
   };
 
   nativeBuildInputs = [ pkg-config ];

pkgs/by-name/be/bentopdf/package.nix

@@ -2,23 +2,22 @@
   lib,
   buildNpmPackage,
   fetchFromGitHub,
+  nix-update-script,
   nixosTests,
   simpleMode ? true,
 }:
 buildNpmPackage (finalAttrs: {
   pname = "bentopdf";
-  # We intentionally don't update the version, due to:
-  # https://github.com/NixOS/nixpkgs/issues/484067
-  # nixpkgs-update: no auto update
-  version = "1.11.2";
+  version = "2.8.6";
 
   src = fetchFromGitHub {
     owner = "alam00000";
     repo = "bentopdf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-br4My0Q4zoA+ZIrXM4o4oQjZ7IpSdwg+iKiAUdc2B/s=";
+    hash = "sha256-rbThEonDXFGcudgdMtDrQHq84Wh4IvOZZBn4kXvrhoI=";
   };
-  npmDepsHash = "sha256-UNNNYO7e7qdumI0/ka2ieFZzKURPl1V3981vHCPcVfY=";
+  npmDepsHash = "sha256-RT6ifx24mNfNS8oO93vyW+zbKQGCx21RqBQrAXK8dAY=";
+  npmDepsFetcherVersion = 2;
 
   npmBuildFlags = [
     "--"
@@ -37,8 +36,11 @@ buildNpmPackage (finalAttrs: {
     runHook postInstall
   '';
 
-  passthru.tests = {
-    inherit (nixosTests.bentopdf) caddy nginx;
+  passthru = {
+    tests = {
+      inherit (nixosTests.bentopdf) caddy nginx;
+    };
+    updateScript = nix-update-script { };
   };
 
   meta = {

pkgs/by-name/bo/borgmatic/package.nix

@@ -15,7 +15,7 @@
 }:
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "borgmatic";
-  version = "2.1.5";
+  version = "2.1.6";
   pyproject = true;
 
   strictDeps = true;
@@ -23,7 +23,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-T0+E6opyfr7zxfP44OlNuhqsdQyi7OdIXiE5r310LaU=";
+    hash = "sha256-Mgx8PnGfTa5j6+53RVntPHa5EDJAY2NQC3fvmyRj24Y=";
   };
 
   passthru.updateScript = nix-update-script { };
@@ -33,13 +33,17 @@ python3Packages.buildPythonApplication (finalAttrs: {
     [
       flexmock
       pytestCheckHook
+      pytest-asyncio
       pytest-cov-stub
       pytest-timeout
     ]
-    ++ finalAttrs.passthru.optional-dependencies.apprise;
+    ++ finalAttrs.passthru.optional-dependencies.apprise
+    ++ finalAttrs.passthru.optional-dependencies.browse;
 
   # - test_borgmatic_version_matches_news_version
-  #   NEWS file not available on the pypi source
+  #   NEWS file is available on the pypi source, but the test requires a
+  #   borgmatic executable. Which it can't find in difference to all the
+  #   other tests.
   # - test_log_outputs_includes_error_output_in_exception
   #   TOCTOU race in log_outputs(): process.poll() returns None in
   #   raise_for_process_errors but non-None in the while-loop exit check,
@@ -51,6 +55,8 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   nativeBuildInputs = [ installShellFiles ];
 
+  build-system = [ python3Packages.setuptools ];
+
   dependencies = with python3Packages; [
     borgbackup
     colorama
@@ -58,11 +64,14 @@ python3Packages.buildPythonApplication (finalAttrs: {
     packaging
     requests
     ruamel-yaml
-    setuptools
   ];
 
   optional-dependencies = {
     apprise = [ python3Packages.apprise ];
+    browse = with python3Packages; [
+      binaryornot
+      textual
+    ];
   };
 
   postInstall =
@@ -93,6 +102,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
   meta = {
     description = "Simple, configuration-driven backup software for servers and workstations";
     homepage = "https://torsion.org/borgmatic/";
+    changelog = "https://projects.torsion.org/borgmatic-collective/borgmatic/src/tag/${finalAttrs.version}/NEWS";
     license = lib.licenses.gpl3Plus;
     platforms = lib.platforms.all;
     mainProgram = "borgmatic";

pkgs/by-name/ce/cemu/package.nix

@@ -181,6 +181,9 @@ stdenv.mkDerivation (finalAttrs: {
       zhaofengli
       baduhai
     ];
-    platforms = [ "x86_64-linux" ];
+    platforms = [
+      "aarch64-linux"
+      "x86_64-linux"
+    ];
   };
 })

pkgs/by-name/ch/charm-freeze/package.nix

@@ -23,6 +23,8 @@ buildGoModule (finalAttrs: {
     "-X=main.Version=${finalAttrs.version}"
   ];
 
+  excludedPackages = [ "test/input" ];
+
   meta = {
     description = "Tool to generate images of code and terminal output";
     mainProgram = "freeze";

pkgs/by-name/ch/chisel/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "chisel";
-  version = "1.11.7";
+  version = "1.11.8";
 
   src = fetchFromGitHub {
     owner = "jpillora";
     repo = "chisel";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VLQsYxd7wMRTrmqO5dGgqmhL/oOQULEIMo4xUaKXG5I=";
+    hash = "sha256-hhkauBn8yEnUmHQjgSF8LMM7zEwhIRRPIkx5VhVZCTI=";
   };
 
-  vendorHash = "sha256-hqHd+62csVjHY2oAvi5fwlI0LbjR/LSDg6b1SMwe8Fw=";
+  vendorHash = "sha256-wt6d6yNi4QRI/RQiemfOAbc6FG8sBexWFT1dKOmFEes=";
 
   ldflags = [
     "-s"

pkgs/by-name/ci/cider-2/package.nix

@@ -18,11 +18,11 @@
 }:
 stdenv.mkDerivation rec {
   pname = "cider-2";
-  version = "4.0.0";
+  version = "4.0.9.1";
 
   src = fetchurl {
     url = "https://repo.cider.sh/apt/pool/main/cider-v${version}-linux-x64.deb";
-    hash = "sha256-Z5B7VQatTEktt4e7aF5EGDTufgwfRHJzCZ1Lia/aIFk=";
+    hash = "sha256-MsA6lK3PsyOEx938FgJFx8l9oqwoM3FzIK5goF73lTs=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/co/codebook/package.nix

@@ -8,17 +8,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "codebook";
-  version = "0.3.41";
+  version = "0.3.42";
 
   src = fetchFromGitHub {
     owner = "blopker";
     repo = "codebook";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QmvkN0e4iwf3gwi/wMnGXlbr9CpG9JvWEuAjlFm50Sk=";
+    hash = "sha256-L+OVR7JHs9qFh48ET2eugl4zZIpbM4DBtoWsHKzKbks=";
   };
 
   buildAndTestSubdir = "crates/codebook-lsp";
-  cargoHash = "sha256-vh4ObFy3pq6e3+DQhYiWNTeaITm+ci/r4CwfAvO3JqU=";
+  cargoHash = "sha256-+OmaZkae5b5TKfMwlYGijJTD5gGS/YuoQOvKKfKuipk=";
 
   env = {
     CARGO_PROFILE_RELEASE_LTO = "fat";

pkgs/by-name/co/coder/package.nix

@@ -15,21 +15,21 @@ let
 
   channels = {
     stable = {
-      version = "2.33.9";
+      version = "2.33.11";
       hash = {
-        x86_64-linux = "sha256-/X1/1xlPV/86MyAXv7MJU8YtEemRNYdasBP6lH586DM=";
-        x86_64-darwin = "sha256-9ns+EzDMgyo+zgfQ3867AhTQ1qENPjtHXCYWtmP00mU=";
-        aarch64-linux = "sha256-4hrV9va+c3VvQXIQ2j6CGZ19ZFCFDEsHhfZu/kQfhwA=";
-        aarch64-darwin = "sha256-5k15Rf09/n/eKvVD0VxDWWWgJK7U0DDNAf0p923BGLs=";
+        x86_64-linux = "sha256-NY9xyLc6Pr1wWPnr4fLo6t+7B7Gin/BlTH3tdxQk30k=";
+        x86_64-darwin = "sha256-yEHu+ekyZSUd66L9sR8ihVLFnDe9N/kFKLGHOFfx9es=";
+        aarch64-linux = "sha256-Wc9hhotJKcb1fdjfh9pWxVs/e4YpBua1PyAhMRJbUAY=";
+        aarch64-darwin = "sha256-7A6BxOg4A3Ua5SXjnh5gtG/LE94iGuRQPe/S9UjX/oc=";
       };
     };
     mainline = {
-      version = "2.34.3";
+      version = "2.34.5";
       hash = {
-        x86_64-linux = "sha256-j7r5qupAsjkA11KJpdTIVtogWvSxz59nMKtTS92NMDk=";
-        x86_64-darwin = "sha256-MJJK0NeXHfd/ipmPUrdhrcCOArafYH3sq+MW7GiLVnY=";
-        aarch64-linux = "sha256-avDUA/3RLcoyt6QZ3CllvjNp8O65g+0CkAJjMOOVKLg=";
-        aarch64-darwin = "sha256-qCHsK0zOqJO/ECb9afaEwNia9R/AJMgtRpIFUfZeY1Y=";
+        x86_64-linux = "sha256-B0roCJqTu6o89nHbVA3b9eHKj/VmJ9i1j4blF1I76yU=";
+        x86_64-darwin = "sha256-+7QhdfwFqh9SZBJOgOqS0Y49dUsWM6PC0/oBhfuAkfM=";
+        aarch64-linux = "sha256-UDyEhBAlvgSHWLPtbNXHj6X2gle1Y3fjQLSKHzwc/XI=";
+        aarch64-darwin = "sha256-VhliikNdqi7AauYlKQvMroEjR3jZZnhNw0HTtJFw5zg=";
       };
     };
   };

pkgs/by-name/co/confluent-cli/package.nix

@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "confluent-cli";
-  version = "4.68.0";
+  version = "4.70.0";
 
   # To get the latest version:
   # curl -L https://cnfl.io/cli | sh -s -- -l | grep -v latest | sort -V | tail -n1
@@ -26,10 +26,10 @@ stdenv.mkDerivation (finalAttrs: {
     fetchurl {
       url = "https://s3-us-west-2.amazonaws.com/confluent.cloud/confluent-cli/archives/${finalAttrs.version}/confluent_${finalAttrs.version}_${system}.tar.gz";
       hash = selectSystem {
-        x86_64-linux = "sha256-MeLvEE4Qqx9OCnljEbCRMhUXksgaf2YYqFiYK9/fsAc=";
-        aarch64-linux = "sha256-HU1V9XKgXOZ5oaszL7A4S4uBFhqVGO4ErTkbfrSjDQU=";
-        x86_64-darwin = "sha256-idXIjruAzuEVTENHpnMQLTdXt0uIYQ3PWKMq3SUAPSY=";
-        aarch64-darwin = "sha256-t/Z+9uHZxKyrgojs8RdiRiLErooVPGYvk0tl1dxyLiA=";
+        x86_64-linux = "sha256-52zPTIuJOS+MMG1+pA+f0HI7VvBHLsRnSq5zWorHsiQ=";
+        aarch64-linux = "sha256-hdhMSZR593rcjch4EVdRshC72aTp1c3dTQBlLCDMsVg=";
+        x86_64-darwin = "sha256-ybzj3fv+7Wdix9ez7cARazhpkxMGi/EO8NbpneWGN4I=";
+        aarch64-darwin = "sha256-YOVGl47XOvvHDtm2/VzzLOeFCA6sw8BuDHQWZgzNNtE=";
       };
     };
 

pkgs/by-name/cp/cpp-interop/package.nix

@@ -0,0 +1,192 @@
+{
+  lib,
+  fetchFromGitHub,
+  cmake,
+  ninja,
+  python3,
+  llvmPackages_21,
+  cling,
+  gcc-unwrapped,
+  libffi,
+  libxml2,
+  ncurses,
+  zlib,
+  zstd,
+
+  # tests
+  gtest,
+
+  # Which interpreter backend to build against. CppInterOp can use either
+  # clang-repl (from upstream LLVM/Clang) or Cling. They are mutually exclusive.
+  backend ? "clang-repl", # "clang-repl" | "cling"
+}:
+
+let
+  llvmPackages = llvmPackages_21;
+  inherit (llvmPackages) stdenv;
+
+  useCling = backend == "cling";
+  llvm = llvmPackages.llvm;
+  clang = llvmPackages.clang-unwrapped;
+
+  # For the cling backend we build against the LLVM/Clang/Cling that ship inside
+  # `cling` itself (its LLVM 20 fork), so the ABI matches libcling. The CMake
+  # config packages (LLVM, Clang, Cling) all live under cling.unwrapped.
+  clingRoot = cling.unwrapped;
+
+  # The Clang resource dir and standard-library include flags the JIT interpreter
+  # needs, since there is no system compiler to probe in the Nix sandbox. Both
+  # this package's own tests and xeus-cpp (via passthru) feed these to CppInterOp
+  # through CPPINTEROP_EXTRA_INTERPRETER_ARGS. The resource dir must match the
+  # Clang that CppInterOp was built against: the cling fork for the cling backend,
+  # upstream LLVM otherwise. -nostdinc(++) makes the search hermetic: only the
+  # -isystem paths below are used, never any stray host include dirs.
+  resourceDir =
+    if useCling then
+      "${clingRoot}/lib/clang/20"
+    else
+      "${lib.getLib clang}/lib/clang/${lib.versions.major llvm.version}";
+  interpreterArgs = [
+    "-nostdinc"
+    "-nostdinc++"
+    "-resource-dir"
+    resourceDir
+    "-isystem"
+    "${resourceDir}/include"
+    "-isystem"
+    "${gcc-unwrapped}/include/c++/${gcc-unwrapped.version}"
+    "-isystem"
+    "${gcc-unwrapped}/include/c++/${gcc-unwrapped.version}/${stdenv.hostPlatform.config}"
+    "-isystem"
+    "${lib.getDev stdenv.cc.libc}/include"
+  ];
+in
+
+assert lib.assertOneOf "backend" backend [
+  "clang-repl"
+  "cling"
+];
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "cpp-interop-${backend}";
+  version = "1.9.0";
+
+  src = fetchFromGitHub {
+    owner = "compiler-research";
+    repo = "CppInterOp";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-am2WObER9dlNQU/VMTY2ScMe/w8c4N8m/DVyNwHiBnw=";
+  };
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [
+    cmake
+    ninja
+    python3
+  ];
+
+  buildInputs = [
+    libffi
+    libxml2
+    ncurses
+    zlib
+    zstd
+  ]
+  ++ (
+    if useCling then
+      [ clingRoot ]
+    else
+      [
+        llvm
+        clang
+      ]
+  );
+
+  # Upstream's unittests/CMakeLists.txt only fetches GoogleTest over the network
+  # (forbidden in the sandbox) when no gtest target exists; point it at the
+  # nixpkgs gtest instead so the tests can build offline.
+  postPatch = ''
+    substituteInPlace unittests/CMakeLists.txt \
+      --replace-fail "include(GoogleTest)" "find_package(GTest REQUIRED)"
+  '';
+
+  cmakeFlags = [
+    (lib.cmakeBool "BUILD_SHARED_LIBS" true)
+    (lib.cmakeBool "CPPINTEROP_USE_CLING" useCling)
+    (lib.cmakeBool "CPPINTEROP_USE_REPL" (!useCling))
+    (lib.cmakeBool "CPPINTEROP_ENABLE_TESTING" finalAttrs.finalPackage.doCheck)
+  ]
+  ++ (
+    if useCling then
+      [
+        "-DCling_DIR=${clingRoot}/lib/cmake/cling"
+        "-DLLVM_DIR=${clingRoot}/lib/cmake/llvm"
+        "-DClang_DIR=${clingRoot}/lib/cmake/clang"
+      ]
+    else
+      [
+        "-DLLVM_DIR=${llvm.dev}/lib/cmake/llvm"
+        "-DClang_DIR=${clang.dev}/lib/cmake/clang"
+      ]
+  );
+
+  # Run the upstream GoogleTest suite. Only the clang-repl backend is exercised;
+  # the Cling backend skips many of these tests upstream.
+  doCheck = !useCling;
+  checkInputs = [ gtest ];
+  checkPhase = ''
+    runHook preCheck
+
+    export CPPINTEROP_EXTRA_INTERPRETER_ARGS="${lib.concatStringsSep " " interpreterArgs}"
+    # Upstream registers the tests only in the unittests subdir; its
+    # check-cppinterop target builds them and runs ctest from the right place.
+    ninja check-cppinterop
+
+    runHook postCheck
+  '';
+
+  # Smoke test: drive the backend to JIT-compile and run a function, proving
+  # the installed library, headers and runtime linking all work together.
+  doInstallCheck = !useCling;
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    cat > smoke.cpp <<'EOF'
+    #include "CppInterOp/CppInterOp.h"
+    #include <cstdio>
+    int main() {
+      Cpp::CreateInterpreter();
+      if (Cpp::Declare("int square(int x) { return x * x; }") != 0) return 1;
+      bool hadError = false;
+      intptr_t result = Cpp::Evaluate("square(7)", &hadError);
+      if (hadError) return 2;
+      if (result != 49) { std::printf("expected 49, got %ld\n", (long)result); return 3; }
+      if (Cpp::GetNamed("square") == nullptr) return 4;
+      return 0;
+    }
+    EOF
+
+    $CXX -std=c++17 smoke.cpp -I$out/include -L$out/lib -lclangCppInterOp -o smoke
+    LD_LIBRARY_PATH=$out/lib ./smoke
+
+    runHook postInstallCheck
+  '';
+
+  passthru = {
+    inherit backend resourceDir interpreterArgs;
+  };
+
+  meta = {
+    description = "Clang-based C++ interoperability library (${backend} backend)";
+    homepage = "https://github.com/compiler-research/CppInterOp";
+    changelog = "https://github.com/compiler-research/CppInterOp/releases/tag/v${finalAttrs.version}";
+    license = with lib.licenses; [
+      asl20
+      llvm-exception
+    ];
+    maintainers = with lib.maintainers; [ thomasjm ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/cr/cri-o-unwrapped/package.nix

@@ -17,13 +17,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "cri-o";
-  version = "1.36.1";
+  version = "1.36.2";
 
   src = fetchFromGitHub {
     owner = "cri-o";
     repo = "cri-o";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QHI90s2LOa0Jenz+Q++nNuyOAxCx3sOcClBaTKeIUbo=";
+    hash = "sha256-mrR0Q23PCe2OMCgH6AgmSzE4zmZzTA6SiMD8OYiWdpE=";
   };
   vendorHash = null;
 

pkgs/by-name/cu/cubeb/package.nix

@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cubeb";
-  version = "0-unstable-2026-06-15";
+  version = "0-unstable-2026-07-03";
 
   src = fetchFromGitHub {
     owner = "mozilla";
     repo = "cubeb";
-    rev = "cdb54bbf405e5d75d42d21947cc717b35b0ccbf4";
-    hash = "sha256-PIzIEFTp+F5fC8aGgwjARhvlxktn60BlgGcRb56ZjIk=";
+    rev = "a665efba31740bd477cf2001a5cb289a63e85336";
+    hash = "sha256-X3lgGFJpTHd9c7t3bP+iohHyQ18+YJFghjLnJyPk6wU=";
   };
 
   outputs = [

pkgs/by-name/dn/dnst/package.nix

@@ -10,14 +10,14 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "dnst";
-  version = "0.2.0-alpha2";
+  version = "0.2.0-alpha3";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "NLnetLabs";
     repo = "dnst";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-OpyOnBddbIdnJLchY5y2oMqK5JSXCTF8cC5KstJ7pnc=";
+    hash = "sha256-6Sgj2OZptG/bMsuYdGfaaY62qh4uUyxdbit6vpWWm9w=";
   };
 
   nativeBuildInputs = [
@@ -27,7 +27,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   ];
   buildInputs = [ openssl ];
 
-  cargoHash = "sha256-y048tMh5wBjAB7I8FK3pETn0j9S/h893JZb9sbOBdbo=";
+  cargoHash = "sha256-8pzf4GeBJbqIZf6KAqROEAvFAqtf6XLODWhS3RVfpAQ=";
 
   postInstall = ''
     mkdir -p $out/libexec
@@ -39,7 +39,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
     installManPage doc/manual/build/man/*.1
   '';
 
-  passthru.updateScript = nix-update-script { };
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=unstable" ];
+  };
 
   meta = {
     description = "Toolset to assist DNS operators with zone and nameserver maintenance";

pkgs/by-name/ef/efm-langserver/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "efm-langserver";
-  version = "0.0.56";
+  version = "0.0.57";
 
   src = fetchFromGitHub {
     owner = "mattn";
     repo = "efm-langserver";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-M2I5UQYCkIVfINWEVa4tOt0Dtl4sBZoHP/q0ia/Bo2Y=";
+    sha256 = "sha256-LWpm5DyHhrSAGxfwEAM0HABPwfsvWEHZ22U93wdldTw=";
   };
 
   vendorHash = "sha256-3Rz/9p1moT3rQPY3/lka9HZ16T00+bAWCc950IBTkFE=";

pkgs/by-name/ei/eigenwallet/package.nix

@@ -4,6 +4,7 @@
   stdenv,
   dpkg,
   autoPatchelfHook,
+  wrapGAppsHook3,
   cairo,
   gdk-pixbuf,
   webkitgtk_4_1,
@@ -22,6 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     dpkg
     autoPatchelfHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [

pkgs/by-name/ev/everdo/package.nix

@@ -5,11 +5,11 @@
 }:
 let
   pname = "everdo";
-  version = "1.9.0";
+  version = "1.11.9";
 
   src = fetchurl {
     url = "https://downloads.everdo.net/electron/Everdo-${version}.AppImage";
-    hash = "sha256-mM2rCjK548kjNR60Mr/YxBiVk+jxuVU01B9GHfIp1Mk=";
+    hash = "sha256-67b0gSoVcCIfkFRUL3afgB6eYj5YEuvDTtQgTIwV9S0=";
   };
 
   appimageContents = appimageTools.extractType2 { inherit pname version src; };

pkgs/by-name/fa/fable/package.nix

@@ -1,14 +1,18 @@
 {
   buildDotnetGlobalTool,
+  dotnetCorePackages,
   lib,
   testers,
 }:
 
 buildDotnetGlobalTool (finalAttrs: {
   pname = "fable";
-  version = "4.29.0";
+  version = "5.0.0";
 
-  nugetHash = "sha256-Eed1bb9heteWOWmv6NnXPzXbf3t218K/eHufwgtRuzI=";
+  nugetHash = "sha256-PSlr4cGZAm/bgAesVn7dYqamvncat8lm1/lJHvYcAwk=";
+
+  dotnet-sdk = dotnetCorePackages.sdk_10_0;
+  dotnet-runtime = dotnetCorePackages.runtime_10_0;
 
   passthru.tests = testers.testVersion {
     package = finalAttrs.finalPackage;

pkgs/by-name/fa/fastmail-desktop/linux.nix

@@ -66,9 +66,18 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   '';
 
   # remove musl-libc dependencies before the autoPatchelfHook
-  preFixup = ''
-    rm -r "$out/opt/fastmail/app.asar.unpacked/node_modules/@img/"{sharp-linuxmusl-x64,sharp-libvips-linuxmusl-x64}
-  '';
+  preFixup =
+    let
+      suffix =
+        {
+          aarch64-linux = "arm64";
+          x86_64-linux = "x64";
+        }
+        .${stdenvNoCC.targetPlatform.system};
+    in
+    ''
+      rm -r "$out/opt/fastmail/app.asar.unpacked/node_modules/@img/"{sharp-linuxmusl-${suffix},sharp-libvips-linuxmusl-${suffix}}
+    '';
 
   meta = meta // {
     mainProgram = "fastmail";

pkgs/by-name/fa/fastmail-desktop/package.nix

@@ -26,6 +26,7 @@ callPackage (if isDarwin then ./darwin.nix else ./linux.nix) {
     ];
     platforms = [
       "aarch64-darwin"
+      "aarch64-linux"
       "x86_64-linux"
     ];
   };

pkgs/by-name/fa/fastmail-desktop/sources.nix

@@ -1,19 +1,26 @@
 # Generated by ./update.sh - do not update manually!
-# Last updated: 2026-03-23
+# Last updated: 2026-07-02
 { fetchurl, fetchzip }:
 {
   aarch64-darwin = {
-    version = "1.2.1";
+    version = "1.3.0";
     src = fetchurl {
-      url = "https://dl.fastmailcdn.com/desktop/production/mac/arm64/Fastmail-1.2.1-arm64-mac.zip";
-      hash = "sha512-bu6IeL8X8ogD1qSlAuApWTBTCYIk5QrjWrzjOv8fel+kqYfCIcDXP1DP1FdJwULe91zoZn4M/uDX8CoOPWa0cA==";
+      url = "https://dl.fastmailcdn.com/desktop/production/mac/arm64/Fastmail-1.3.0-arm64-mac.zip";
+      hash = "sha512-6iRUcoI0dsW5ByaQ7dv7Oki5y0Y1wuMlQjjCpqWaThttsNJ4yYXh812RGsPjJTvcwVNMvPRbmPcbb/y//mXqRg==";
+    };
+  };
+  aarch64-linux = {
+    version = "1.3.0";
+    src = fetchurl {
+      url = "https://dl.fastmailcdn.com/desktop/production/linux/arm64/com.fastmail.Fastmail-1.3.0-arm64.AppImage";
+      hash = "sha512-XJdxJVJ3xdhF04TInc3vmEtcUnzPzwujzTix+t2WbRo9qNEPqxnmN6hurGq0dZO/Dnk7jgOfAkjCpVq/kxWVRQ==";
     };
   };
   x86_64-linux = {
-    version = "1.2.1";
+    version = "1.3.0";
     src = fetchurl {
-      url = "https://dl.fastmailcdn.com/desktop/production/linux/x64/com.fastmail.Fastmail-1.2.1.AppImage";
-      hash = "sha512-xudOPNjOaumYxD7yZyjQnYhuiKqDO10cBwMdFJtVEOfHVia0jJMgdUTJx03otIBn9ijM3/1Qo6wsq1HF0A/zlQ==";
+      url = "https://dl.fastmailcdn.com/desktop/production/linux/x64/com.fastmail.Fastmail-1.3.0.AppImage";
+      hash = "sha512-KnFAmjGQGXfA83JDynSixecoqqZbnC0bYGFQVf8YfP3ITwspHNDj3TIMp2jqXKtl9j4DlH1w8eLwSbKD0En9Wg==";
     };
   };
 }

pkgs/by-name/fa/fastmail-desktop/update.sh

@@ -6,15 +6,19 @@ set -euo pipefail
 cd "$(readlink -e "$(dirname "${BASH_SOURCE[0]}")")"
 
 x86_64_linux_info=$(curl -fsS "https://dl.fastmailcdn.com/desktop/production/linux/x64/latest-linux.yml")
+aarch64_linux_info=$(curl -fsS "https://dl.fastmailcdn.com/desktop/production/linux/arm64/latest-linux-arm64.yml")
 aarch64_darwin_info=$(curl -fsS "https://dl.fastmailcdn.com/desktop/production/mac/arm64/latest-mac.yml")
 
 x86_64_linux_version=$(yq -r '.version' <<<"$x86_64_linux_info")
+aarch64_linux_version=$(yq -r '.version' <<<"$aarch64_linux_info")
 aarch64_darwin_version=$(yq -r '.version' <<<"$aarch64_darwin_info")
 
 x86_64_linux_url="https://dl.fastmailcdn.com/desktop/production/linux/x64/$(yq -r '.path' <<<"$x86_64_linux_info")"
+aarch64_linux_url="https://dl.fastmailcdn.com/desktop/production/linux/arm64/$(yq -r '.path' <<<"$aarch64_linux_info")"
 aarch64_darwin_url="https://dl.fastmailcdn.com/desktop/production/mac/arm64/$(yq -r '.path' <<<"$aarch64_darwin_info")"
 
 x86_64_linux_hash=$(nix-hash --type sha512 --to-sri "$(yq -r '.sha512' <<<"$x86_64_linux_info")")
+aarch64_linux_hash=$(nix-hash --type sha512 --to-sri "$(yq -r '.sha512' <<<"$aarch64_linux_info")")
 aarch64_darwin_hash=$(nix-hash --type sha512 --to-sri "$(yq -r '.sha512' <<<"$aarch64_darwin_info")")
 
 cat >sources.nix <<EOF
@@ -29,6 +33,13 @@ cat >sources.nix <<EOF
       hash = "$aarch64_darwin_hash";
     };
   };
+  aarch64-linux = {
+    version = "$aarch64_linux_version";
+    src = fetchurl {
+      url = "$aarch64_linux_url";
+      hash = "$aarch64_linux_hash";
+    };
+  };
   x86_64-linux = {
     version = "$x86_64_linux_version";
     src = fetchurl {

pkgs/by-name/fe/fence/package.nix

@@ -14,13 +14,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "fence";
-  version = "0.1.61";
+  version = "0.1.62";
 
   src = fetchFromGitHub {
     owner = "fencesandbox";
     repo = "fence";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/IVxTPgAzl+mX85M1IyD+21O8j/tIxt2a18TLtQz/zk=";
+    hash = "sha256-uJfQFOKR3f8OjzA1z18IeKvhAgTmQQ7o4Y7K4CFbwko=";
   };
 
   vendorHash = "sha256-aMxay3dow6mDKyv396R0j1GOKDmhkX4ebGmhca1B4WE=";

pkgs/by-name/fl/flclash/package.nix

@@ -83,6 +83,7 @@ flutter335.buildFlutterApplication {
       genericName = "FlClash";
       desktopName = "FlClash";
       categories = [ "Network" ];
+      startupWMClass = "com.follow.clash";
       keywords = [
         "FlClash"
         "Clash"

pkgs/by-name/fl/fluxcd-operator/package.nix

@@ -9,13 +9,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "fluxcd-operator";
-  version = "0.52.0";
+  version = "0.54.0";
 
   src = fetchFromGitHub {
     owner = "controlplaneio-fluxcd";
     repo = "flux-operator";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-l+IJtFmVR3WZaFW4aaYjirTqj+X1FGLAVgbA21MHO1k=";
+    hash = "sha256-Bxzqm4I+wTj1k8ppa4cohsowmgc7H76EuHCYlCiJ5Qk=";
   };
 
   vendorHash = "sha256-DW+dnakqnpSiV7MlzshGEzoy3Osv93dAsJYe4cR0sJ4=";

pkgs/by-name/fl/flyctl/package.nix

@@ -12,7 +12,7 @@
 
 buildGoModule rec {
   pname = "flyctl";
-  version = "0.4.63";
+  version = "0.4.69";
 
   src = fetchFromGitHub {
     owner = "superfly";
@@ -22,11 +22,11 @@ buildGoModule rec {
       cd "$out"
       git rev-parse HEAD > COMMIT
     '';
-    hash = "sha256-dGqL6lKx67VzlfHvaCpOTpHtFao99zLIYXiORPHP5e8=";
+    hash = "sha256-e06fahSSeKTsWGR4o7XZFzcv2MfUCKLo6PrZg2tgIGU=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-X6cEAaUIHTJoNwoBlGFZUA4M8/AnRY3oTiWW7/03PXY=";
+  vendorHash = "sha256-BLlKOu1q73T2i+B64+sLkCYXaTlHbVJ5moEwqG2JoHo=";
 
   subPackages = [ "." ];
 

pkgs/by-name/fm/fm-tune/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fm-tune";
-  version = "1.1";
+  version = "1.2";
 
   src = fetchFromGitHub {
     owner = "viraptor";
     repo = "fm_tune";
     rev = finalAttrs.version;
-    hash = "sha256-pwL2G1Ni1Ixw/N0diSoGGIoVrtmF92mWZ5i57OOvkX4=";
+    hash = "sha256-kjTcg8nvhPgpsopIjYsaIsEszYPh86ilkSXMMk+z3x0=";
   };
 
   nativeBuildInputs = [ pkg-config ];

pkgs/by-name/fo/forgejo-runner/package.nix

@@ -55,14 +55,14 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "forgejo-runner";
-  version = "12.12.0";
+  version = "12.13.0";
 
   src = fetchFromGitea {
     domain = "code.forgejo.org";
     owner = "forgejo";
     repo = "runner";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-6czLxFgjcrBepoFN4iYDUt8uBkhfC8qx4yqmcfQ8FAg=";
+    hash = "sha256-wrHZ4vgWNw0tbcNpZesU5SoV2gqle1MJcPjj6lNMwOw=";
   };
 
   vendorHash = "sha256-du7fXehcxZ70Lsr5VCkz646G0Us/XwM4Sl98HXimoao=";

pkgs/by-name/fs/fscan/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "fscan";
-  version = "2.1.3";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "shadow1ng";
     repo = "fscan";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ZfzFBOIsuwcfmmyZMPhgP9Oznec+rJs16IuIG7gwZhA=";
+    hash = "sha256-05z5DuW25/hVoTdUtGGuaCBPtO1QyGqgvKWSpO8DBpQ=";
   };
 
-  vendorHash = "sha256-ihaGbm4iLjwvTzM278wuwom8LrmHB3WgmbfcJxtkbYc=";
+  vendorHash = "sha256-IlGHY0KbYsy/5Yz11XhkcS9yS8byY3vhPZiTwnJM6/Q=";
 
   subPackages = [ "." ];
 

pkgs/by-name/gf/gforth/package.nix

@@ -17,13 +17,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gforth";
-  version = "0.7.9_20260610";
+  version = "0.7.9_20260708";
 
   src = fetchFromGitHub {
     owner = "forthy42";
     repo = "gforth";
     rev = finalAttrs.version;
-    hash = "sha256-gaP3Mmcp0NueRfqh62XlvtWuHN6fAnMTa1uSm7Bj+Rk=";
+    hash = "sha256-3lKd50Rlhk9OlKb5ATHH4vTWlo40h3iCz+VQfuo/6ys=";
   };
 
   patches = [ ./use-nproc-instead-of-fhs.patch ];

pkgs/by-name/gg/ggml/package.nix

@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ggml";
-  version = "0.15.3";
+  version = "0.16.0";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "ggml-org";
     repo = "ggml";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-EYy8zfqNgWoT8fJ9OsetOYUNVmOB9HQbuVs/ybzUkL8=";
+    hash = "sha256-0DdBEsnUAEdC+qN5s310Ih+ELyXOjvwrykMFNHLkoO4=";
   };
 
   # The cmake package does not handle absolute CMAKE_INSTALL_LIBDIR and CMAKE_INSTALL_INCLUDEDIR

pkgs/by-name/go/goeland/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "goeland";
-  version = "0.24.0";
+  version = "0.25.0";
 
   src = fetchFromGitHub {
     owner = "slurdge";
     repo = "goeland";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-pUwGdL17/VS9difji4/B1QzG7l6K4igeRxISDKVToE8=";
+    sha256 = "sha256-5pUj7KgjvcA7xuKV7j9nLEih4ecrQjarddRVNszidfE=";
   };
 
-  vendorHash = "sha256-s20LCVih71TR5IYQ26bpF+q4eonpBlGXayCzcFLlb8Y=";
+  vendorHash = "sha256-GOoeyh0ddtYiigavgjMNy8z6suTFtS9oswO9PAdagGE=";
 
   ldflags = [
     "-s"

pkgs/by-name/ha/harbor-cli/package.nix

@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "harbor-cli";
-  version = "0.0.23";
+  version = "0.0.24";
 
   src = fetchFromGitHub {
     owner = "goharbor";
     repo = "harbor-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lh0ZMrjzCiQvpzRddms4uEKlUdxcDdHTfkYdmQ5hc9k=";
+    hash = "sha256-XL9w33ZPmB0imK8dudxj4zoUxDbUdpWaCu8u/1c6wG4=";
   };
 
   vendorHash = "sha256-Iy+Kf0Kf1yuFk+shbomT0Z1zMvAbdWT4vLshAjlqvck=";

pkgs/by-name/hc/hcom/package.nix

@@ -0,0 +1,50 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  writableTmpDirAsHomeHook,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "hcom";
+  version = "0.7.23";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "aannoo";
+    repo = "hcom";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-58AcL/hOi8Fl1Nq6QBOyM7Uf7ZUjBabU4PBzZWo25Vo=";
+  };
+
+  cargoHash = "sha256-cGhssU75BrNmHqxYWvqRcjNxB70rxYHXBz3hZDY+was=";
+
+  doCheck = true;
+  nativeCheckInputs = [ writableTmpDirAsHomeHook ];
+
+  checkFlags = [
+    # tries to read $PATH
+    "--skip=shell_env::tests::resolver_discards_stderr_without_breaking_env_resolution"
+    # tries to read shell pid
+    "--skip=shell_env::tests::timeout_kills_shell_process_group"
+  ];
+
+  # tons of unit tests use local ports
+  __darwinAllowLocalNetworking = true;
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Let AI agents message, watch, and spawn each other across terminals";
+    homepage = "https://github.com/aannoo/hcom";
+    changelog = "https://github.com/aannoo/hcom/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ Br1ght0ne ];
+    mainProgram = "hcom";
+  };
+})

pkgs/by-name/in/infracost/package.nix

@@ -8,15 +8,15 @@
 
 buildGoModule (finalAttrs: {
   pname = "infracost";
-  version = "0.10.44";
+  version = "0.10.45";
 
   src = fetchFromGitHub {
     owner = "infracost";
     rev = "v${finalAttrs.version}";
     repo = "infracost";
-    sha256 = "sha256-7TH7ZWANQMlhfpCP5OdiQCL6OsFP1RK5YGV8hGuouBY=";
+    sha256 = "sha256-ionW8XChMCQxekKqbiNc6wSu5pxdG59WX2CxlCqStXk=";
   };
-  vendorHash = "sha256-ZG6DjYcHvEii55ayx6x168L2v04n/pAZRqqQ7DKvugA=";
+  vendorHash = "sha256-fwMVYzbCHENra1ySNMQnWF/JnYngO/oHgxZvMZ2+3TQ=";
 
   ldflags = [
     "-s"

pkgs/by-name/in/inxi/package.nix

@@ -64,13 +64,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "inxi";
-  version = "3.3.40-1";
+  version = "3.3.41-1";
 
   src = fetchFromCodeberg {
     owner = "smxi";
     repo = "inxi";
     tag = finalAttrs.version;
-    hash = "sha256-GpXfLLJhM4L9TB8Qw38uaCCwtCmBYg9nrVC001kDckc=";
+    hash = "sha256-JIBBYLpWKawmAEOVr7YoC6oBQdtlYuQcLFlt/ltswpc=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ju/just-lsp/package.nix

@@ -8,7 +8,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "just-lsp";
-  version = "0.4.7";
+  version = "0.4.8";
 
   __structuredAttrs = true;
 
@@ -16,10 +16,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "terror";
     repo = "just-lsp";
     tag = finalAttrs.version;
-    hash = "sha256-Z35pRJDDUdyjz9Tw66wgBYjYicJCO87EI/J3Nux8udE=";
+    hash = "sha256-fSr3Nv7KsVMntGpL/uThdY4atCFqbSAS3XsNbdwoCvs=";
   };
 
-  cargoHash = "sha256-qAeUk+1WmQ5TPdfJcoM+mrFVOfhhdVZnyBhxfzyh1Tc=";
+  cargoHash = "sha256-z0Gyh44/9nAz505k4B7sZN8BO3kyUutnfivj3QaTi3c=";
 
   nativeInstallCheckInputs = [
     versionCheckHook

pkgs/by-name/ka/karate/package.nix

@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "karate";
-  version = "1.5.2";
+  version = "2.1.0";
 
   src = fetchurl {
     url = "https://github.com/karatelabs/karate/releases/download/v${version}/karate-${version}.jar";
-    sha256 = "sha256-zPR0DGShVMTCRX1vD9GajzeQLCnTKqxOIwEuCoeGFL4=";
+    sha256 = "sha256-ImFhqjBMYXREOZ+0j0IIARmtNQpCf71m2nUxZQusKKo=";
   };
   dontUnpack = true;
 

pkgs/by-name/ky/kyverno/package.nix

@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "kyverno";
-  version = "1.18.1";
+  version = "1.18.2";
 
   src = fetchFromGitHub {
     owner = "kyverno";
     repo = "kyverno";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-zo02ABieJ+CykuqGJlnthXibgBzNGB3t3UdlKMTIkFo=";
+    hash = "sha256-vcZdrvtM9SnjR9MJOGZ892fXtsMDY7V/1gNqvZmB6To=";
   };
 
   ldflags = [
@@ -27,7 +27,7 @@ buildGoModule (finalAttrs: {
     "-X github.com/kyverno/kyverno/pkg/version.BuildTime=1970-01-01_00:00:00"
   ];
 
-  vendorHash = "sha256-z6kqFBWDWxJB/V+lhcCgataJCQ7NNh08yutdPDgBdkc=";
+  vendorHash = "sha256-xGGpK53FennS28Kw3ZEasr+sN7ZUuL98Bh4KIkr0OOs=";
 
   subPackages = [ "cmd/cli/kubectl-kyverno" ];
 

pkgs/by-name/li/libdwarf/package.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libdwarf";
-  version = "2.3.1";
+  version = "2.3.2";
 
   src = fetchFromGitHub {
     owner = "davea42";
     repo = "libdwarf-code";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-azVCzQt9oA40YACa9PkdNt0D8vWRNHXXGoSFOYNJxgA=";
+    hash = "sha256-65jEnM+eJ7HnZlpEM2D67W0Xgb9B/aa4JhajowG0Z8o=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/lm/lms/package.nix

@@ -17,6 +17,7 @@
   openssl,
   xxhash,
   pugixml,
+  onnxruntime,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -50,6 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
     openssl
     xxhash
     pugixml
+    onnxruntime
   ];
 
   postPatch = ''
@@ -59,8 +61,7 @@ stdenv.mkDerivation (finalAttrs: {
   postInstall = ''
     substituteInPlace $out/share/lms/lms.conf --replace-fail "/usr/bin/ffmpeg" "${lib.getExe ffmpeg}"
     substituteInPlace $out/share/lms/lms.conf --replace-fail "/usr/share/Wt/resources" "${wt}/share/Wt/resources"
-    substituteInPlace $out/share/lms/lms.conf --replace-fail "/usr/share/lms/docroot" "$out/share/lms/docroot"
-    substituteInPlace $out/share/lms/lms.conf --replace-fail "/usr/share/lms/approot" "$out/share/lms/approot"
+    substituteInPlace $out/share/lms/lms.conf --replace-fail "/usr/share/lms" "$out/share/lms"
     substituteInPlace $out/share/lms/default.service --replace-fail "/usr/bin/lms" "$out/bin/lms"
     install -Dm444 $out/share/lms/default.service -T $out/lib/systemd/system/lmsd.service
   '';

pkgs/by-name/lo/lockbook-desktop/package.nix

@@ -18,16 +18,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "lockbook-desktop";
-  version = "26.6.22";
+  version = "26.7.4";
 
   src = fetchFromGitHub {
     owner = "lockbook";
     repo = "lockbook";
     tag = finalAttrs.version;
-    hash = "sha256-OgNscshw445uf2PtiYVlyCfx/l2BNZyZK5QwQSunCQ0=";
+    hash = "sha256-gwpobBTugTTTtd/mWVoyiU0E/NjWCTfMnMF0reWLKrA=";
   };
 
-  cargoHash = "sha256-USdDHcWexjAllH/kOZVc4XMehESoIozkvvOw47ZeBD8=";
+  cargoHash = "sha256-EH3uIjz2M+Ytkx/gD0gwslUrDVPvm5+hwOGoDtAdblg=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/m1/m1n1/package.nix

@@ -102,7 +102,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru = {
     updateScript = nix-update-script { };
-    inherit rustPlatform;
+    inherit rustPlatform rustPackages;
   };
 
   meta = {

pkgs/by-name/me/megasync/package.nix

@@ -34,13 +34,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "megasync";
-  version = "6.1.1.0";
+  version = "6.4.0.2";
 
   src = fetchFromGitHub rec {
     owner = "meganz";
     repo = "MEGAsync";
     tag = "v${finalAttrs.version}_Linux";
-    hash = "sha256-lY8YfBWRYo+Q0ZvsZI2Mo0pgjD7wQvpyybPU+9bWahw=";
+    hash = "sha256-PgIRIr3+XRwv48EpREL56yzuqI8Ws72V4o3pTSR1ZfA=";
     fetchSubmodules = false; # DesignTokensImporter cannot be fetched, see #1010 in github:meganz/megasync
     leaveDotGit = true;
     postFetch = ''

pkgs/by-name/me/meshoptimizer/package.nix

@@ -17,12 +17,12 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "meshoptimizer";
-  version = "1.1.1";
+  version = "1.2";
   src = fetchFromGitHub {
     owner = "zeux";
     repo = "meshoptimizer";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-h5lO3HHPtGYuzAZlRwXugvCsjtSMj9j2Z7xCRHQU8xY=";
+    hash = "sha256-1dHT4+aOwIY3DUrj6JwcDizRPWwL/PWkEcpmA8zD/vE=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/mi/microsoft-gsl/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "microsoft-gsl";
-  version = "4.2.1";
+  version = "4.2.2";
 
   src = fetchFromGitHub {
     owner = "Microsoft";
     repo = "GSL";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-rfSfgyjU1U6gaWzlx2CeaCSb784L29vHDAC/PQl+s6E=";
+    hash = "sha256-nWPjUPDx6Wp2BkREkZV+Nr9AUeUzpKlQ5c1CPp2Ks+M=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/mi/miller/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "miller";
-  version = "6.19.0";
+  version = "6.20.2";
 
   src = fetchFromGitHub {
     owner = "johnkerl";
     repo = "miller";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-kIhJ9wysaWnZNvaWaNE32FQOHFDNBtUl41d1Z45VFac=";
+    sha256 = "sha256-unzjbPuOmppEY56JnV+A3TZuaHMLNeZS3n7tKpudCXk=";
   };
 
   outputs = [
@@ -20,7 +20,7 @@ buildGoModule (finalAttrs: {
     "man"
   ];
 
-  vendorHash = "sha256-PzklwkT2Chs3z1UzLX9g9hpDGTHmyxfiT0igSntXPqo=";
+  vendorHash = "sha256-ZA9ueehDXsRI3eEE44hJziWKAAsZXkF77hBkYvX2k+U=";
 
   postInstall = ''
     mkdir -p $man/share/man/man1

pkgs/by-name/mu/musicpresence/package.nix

@@ -0,0 +1,77 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  autoPatchelfHook,
+  makeWrapper,
+  libGL,
+  libxcb,
+  libx11,
+  wayland,
+  fontconfig,
+  freetype,
+  libgpg-error,
+  e2fsprogs,
+  xkeyboard_config,
+  qt6,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "musicpresence";
+  version = "2.3.6";
+
+  src = fetchurl {
+    url = "https://github.com/ungive/discord-music-presence/releases/download/v${finalAttrs.version}/musicpresence-${finalAttrs.version}-linux-x86_64.tar.gz";
+    hash = "sha256-w3y1I6nnztEMaihbXIfQqB0ng6s07iA8bqC8PDq+E+I=";
+  };
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    makeWrapper
+  ];
+
+  buildInputs = [
+    libGL
+    libxcb
+    libx11
+    wayland
+    fontconfig
+    freetype
+    libgpg-error
+    e2fsprogs
+    stdenv.cc.cc.lib
+  ];
+
+  dontBuild = true;
+  dontConfigure = true;
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp -r usr/share $out/
+
+    makeWrapper $out/share/musicpresence/bin/musicpresence $out/bin/musicpresence \
+      --set XKB_CONFIG_ROOT "${xkeyboard_config}/share/X11/xkb" \
+      --prefix QT_PLUGIN_PATH : "${qt6.qtwayland}/${qt6.qtbase.qtPluginPrefix}" \
+      --unset QT_STYLE_OVERRIDE
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Discord music status that works with any media player";
+    homepage = "https://github.com/ungive/discord-music-presence";
+    license = lib.licenses.unfree;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    platforms = [ "x86_64-linux" ];
+    mainProgram = "musicpresence";
+    maintainers = with lib.maintainers; [
+      wiyba
+      nonplay
+    ];
+  };
+})

pkgs/by-name/na/nagios/package.nix

@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nagios";
-  version = "4.5.11";
+  version = "4.5.13";
 
   src = fetchFromGitHub {
     owner = "NagiosEnterprises";
     repo = "nagioscore";
     tag = "nagios-${finalAttrs.version}";
-    hash = "sha256-RUiEVCOqEo0+oD6GPl9U3Y4C2Fz4uOGgSaBC+WIkxjs=";
+    hash = "sha256-6d49LhnerArXM2tTjyEe0/PU/THqxxptaSaBCKJzkiU=";
   };
 
   patches = [ ./nagios.patch ];

pkgs/by-name/na/nail-parquet/package.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "nail-parquet";
-  version = "1.6.5";
+  version = "1.9.0";
 
   src = fetchFromGitHub {
     owner = "Vitruves";
     repo = "nail-parquet";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CPiOeaESerQj+nV0hQIGv06/MFP8s7p9olpmhnWpAAg=";
+    hash = "sha256-IDGVdC4jvDfFTP0N0LAi8MTGdUOCT6A7mKXIz2au6jY=";
   };
 
-  cargoHash = "sha256-x4BJZcQkisw9hA/TBzSSdkxh7oUNL0OD3H/v67otYj8=";
+  cargoHash = "sha256-c4yuXCQAlwpDlKURwN51d3AI+m7cUNGRdgl29qgWIvA=";
 
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [
     pkg-config

pkgs/by-name/nb/nbfc-linux/package.nix

@@ -3,38 +3,58 @@
   stdenv,
   fetchFromGitHub,
   autoreconfHook,
+  pkg-config,
+  lua5_4,
   curl,
+  libxml2,
+  openssl,
+  nix-update-script,
+  versionCheckHook,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nbfc-linux";
-  version = "0.3.19";
+  version = "0.5.2";
 
   src = fetchFromGitHub {
     owner = "nbfc-linux";
     repo = "nbfc-linux";
     tag = finalAttrs.version;
-    hash = "sha256-ARUhm1K3A0bzVRen6VO3KvomkPl1S7vx2+tmg2ZtL8s=";
+    hash = "sha256-468/dFRjEgyJ0AW98wKq04WKZ4sZyzswBASSF6hyjVY=";
   };
 
-  nativeBuildInputs = [ autoreconfHook ];
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+  ];
 
-  buildInputs = [ curl ];
+  buildInputs = [
+    lua5_4
+    curl
+    libxml2
+    openssl
+  ];
 
   configureFlags = [
-    "--prefix=${placeholder "out"}"
-    "--sysconfdir=${placeholder "out"}/etc"
     "--bindir=${placeholder "out"}/bin"
   ];
 
+  passthru.updateScript = nix-update-script { };
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
   meta = {
     description = "C port of Stefan Hirschmann's NoteBook FanControl";
     longDescription = ''
       nbfc-linux provides fan control service for notebooks
     '';
     homepage = "https://github.com/nbfc-linux/nbfc-linux";
-    license = lib.licenses.gpl3;
-    maintainers = [ lib.maintainers.Celibistrial ];
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [
+      Celibistrial
+      bohanubis
+    ];
     mainProgram = "nbfc";
     platforms = lib.platforms.linux;
   };

pkgs/by-name/no/non/package.nix

@@ -13,23 +13,28 @@
   liblo,
   libsigcxx,
   lrdf,
-  wafHook,
+  waf,
 }:
 
+let
+  wafHook = (waf.override { extraTools = [ "gccdeps" ]; }).hook;
+in
 stdenv.mkDerivation {
   pname = "non";
   version = "unstable-2021-01-28";
+
   src = fetchFromGitHub {
     owner = "linuxaudio";
     repo = "non";
     rev = "cdad26211b301d2fad55a26812169ab905b85bbb";
-    sha256 = "sha256-iMJNMDytNXpEkUhL0RILSd25ixkm8HL/edtOZta0Pf4=";
+    hash = "sha256-iMJNMDytNXpEkUhL0RILSd25ixkm8HL/edtOZta0Pf4=";
   };
 
   nativeBuildInputs = [
     pkg-config
     wafHook
   ];
+
   buildInputs = [
     python3
     cairo

pkgs/by-name/od/odin/package.nix

@@ -13,13 +13,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "odin";
-  version = "dev-2026-05";
+  version = "dev-2026-07";
 
   src = fetchFromGitHub {
     owner = "odin-lang";
     repo = "Odin";
     tag = finalAttrs.version;
-    hash = "sha256-fgN6Lz1CnUPXrmnQr+sPEfwSF/7y0+eZBX6TKFcFA50=";
+    hash = "sha256-pVCZB6YOk73tBGVE1i73JJG3z9SZNakFuMp4Kepqnvc=";
   };
 
   patches = [
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
     substituteInPlace src/build_settings.cpp \
       --replace-fail "arm64-apple-macosx" "arm64-apple-darwin"
 
-    rm -r vendor/raylib/{linux,macos,macos-arm64,wasm,windows}
+    rm -r vendor/raylib/{linux,macos,wasm,windows}
 
     patchShebangs --build build_odin.sh
   '';

pkgs/by-name/od/odin/system-raylib.patch

@@ -1,14 +1,11 @@
 diff --git a/vendor/raylib/raygui.odin b/vendor/raylib/raygui.odin
-index 559437a60..cd31fbe43 100644
+index b02fa4438..23e8704ed 100644
 --- a/vendor/raylib/raygui.odin
 +++ b/vendor/raylib/raygui.odin
-@@ -2,34 +2,7 @@ package raylib
- 
- import "core:c"
- 
--RAYGUI_SHARED :: #config(RAYGUI_SHARED, false)
--RAYGUI_WASM_LIB :: #config(RAYGUI_WASM_LIB, "wasm/libraygui.a")
--
+@@ -5,31 +5,7 @@ import "core:c"
+ RAYGUI_SHARED :: #config(RAYGUI_SHARED, false)
+ RAYGUI_WASM_LIB :: #config(RAYGUI_WASM_LIB, "wasm/libraygui.a")
+
 -when ODIN_OS == .Windows {
 -	foreign import lib {
 -		"windows/rayguidll.lib" when RAYGUI_SHARED else "windows/raygui.lib",
@@ -20,7 +17,7 @@ index 559437a60..cd31fbe43 100644
 -} else when ODIN_OS == .Darwin {
 -	when ODIN_ARCH == .arm64 {
 -		foreign import lib {
--			"macos-arm64/libraygui.dylib" when RAYGUI_SHARED else "macos-arm64/libraygui.a",
+-			"macos/libraygui-arm64.dylib" when RAYGUI_SHARED else "macos/libraygui-arm64.a",
 -		}
 -	} else {
 -		foreign import lib {
@@ -35,20 +32,17 @@ index 559437a60..cd31fbe43 100644
 -	foreign import lib "system:raygui"
 -}
 +foreign import lib "system:raygui"
- 
+
  RAYGUI_VERSION :: "4.0"
- 
+
 diff --git a/vendor/raylib/raylib.odin b/vendor/raylib/raylib.odin
-index b051f1885..9376dcc48 100644
+index 0a30fd72b..91a2b8bac 100644
 --- a/vendor/raylib/raylib.odin
 +++ b/vendor/raylib/raylib.odin
-@@ -97,42 +97,7 @@ MAX_MATERIAL_MAPS      :: #config(RAYLIB_MAX_MATERIAL_MAPS, 12)
- 
- #assert(size_of(rune) == size_of(c.int))
- 
--RAYLIB_SHARED :: #config(RAYLIB_SHARED, false)
--RAYLIB_WASM_LIB :: #config(RAYLIB_WASM_LIB, "wasm/libraylib.a")
--
+@@ -99,53 +99,7 @@ MAX_MATERIAL_MAPS      :: #config(RAYLIB_MAX_MATERIAL_MAPS, 12)
+ RAYLIB_SHARED :: #config(RAYLIB_SHARED, false)
+ RAYLIB_WASM_LIB :: #config(RAYLIB_WASM_LIB, "wasm/libraylib.web.a")
+
 -when ODIN_OS == .Windows {
 -	@(extra_linker_flags="/NODEFAULTLIB:" + ("msvcrt" when RAYLIB_SHARED else "libcmt"))
 -	foreign import lib {
@@ -59,18 +53,32 @@ index b051f1885..9376dcc48 100644
 -		"system:Shell32.lib",
 -	}
 -} else when ODIN_OS == .Linux  {
--	foreign import lib {
--		// Note(bumbread): I'm not sure why in `linux/` folder there are
--		// multiple copies of raylib.so, but since these bindings are for
--		// particular version of the library, I better specify it. Ideally,
--		// though, it's best specified in terms of major (.so.4)
--		"linux/libraylib.so.550" when RAYLIB_SHARED else "linux/libraylib.a",
--		"system:dl",
--		"system:pthread",
+-	when ODIN_ARCH == .arm64 {
+-		foreign import lib {
+-			// Note(bumbread): I'm not sure why in `linux/` folder there are
+-			// multiple copies of raylib.so, but since these bindings are for
+-			// particular version of the library, I better specify it. Ideally,
+-			// though, it's best specified in terms of major (.so.4)
+-			"linux-arm64/libraylib.so.600" when RAYLIB_SHARED else "linux-arm/libraylib.a",
+-			"system:dl",
+-			"system:pthread",
+-			"system:X11",
+-		}
+-	} else {
+-		foreign import lib {
+-			// Note(bumbread): I'm not sure why in `linux/` folder there are
+-			// multiple copies of raylib.so, but since these bindings are for
+-			// particular version of the library, I better specify it. Ideally,
+-			// though, it's best specified in terms of major (.so.4)
+-			"linux/libraylib.so.600" when RAYLIB_SHARED else "linux/libraylib.a",
+-			"system:dl",
+-			"system:pthread",
+-			"system:X11",
+-		}
 -	}
 -} else when ODIN_OS == .Darwin {
 -	foreign import lib {
--		"macos/libraylib.550.dylib" when RAYLIB_SHARED else "macos/libraylib.a",
+-		"macos/libraylib.600.dylib" when RAYLIB_SHARED else "macos/libraylib.a",
 -		"system:Cocoa.framework",
 -		"system:OpenGL.framework",
 -		"system:IOKit.framework",
@@ -83,60 +91,6 @@ index b051f1885..9376dcc48 100644
 -	foreign import lib "system:raylib"
 -}
 +foreign import lib "system:raylib"
- 
- VERSION_MAJOR :: 5
- VERSION_MINOR :: 5
-diff --git a/vendor/raylib/rlgl/rlgl.odin b/vendor/raylib/rlgl/rlgl.odin
-index 14a7cf5b0..a8e641220 100644
---- a/vendor/raylib/rlgl/rlgl.odin
-+++ b/vendor/raylib/rlgl/rlgl.odin
-@@ -112,47 +112,7 @@ import rl "../."
- 
- VERSION :: "5.0"
- 
--RAYLIB_SHARED :: #config(RAYLIB_SHARED, false)
--RAYLIB_WASM_LIB :: #config(RAYLIB_WASM_LIB, "../wasm/libraylib.a")
--
--// Note: We pull in the full raylib library. If you want a truly stand-alone rlgl, then:
--// - Compile a separate rlgl library and use that in the foreign import blocks below.
--// - Remove the `import rl "../."` line
--// - Copy the code from raylib.odin for any types we alias from that package (see PixelFormat etc)
--
--when ODIN_OS == .Windows {
--	@(extra_linker_flags="/NODEFAULTLIB:" + ("msvcrt" when RAYLIB_SHARED else "libcmt"))
--	foreign import lib {
--		"../windows/raylibdll.lib" when RAYLIB_SHARED else "../windows/raylib.lib" ,
--		"system:Winmm.lib",
--		"system:Gdi32.lib",
--		"system:User32.lib",
--		"system:Shell32.lib",
--	}
--} else when ODIN_OS == .Linux  {
--	foreign import lib {
--		// Note(bumbread): I'm not sure why in `linux/` folder there are
--		// multiple copies of raylib.so, but since these bindings are for
--		// particular version of the library, I better specify it. Ideally,
--		// though, it's best specified in terms of major (.so.4)
--		"../linux/libraylib.so.550" when RAYLIB_SHARED else "../linux/libraylib.a",
--		"system:dl",
--		"system:pthread",
--	}
--} else when ODIN_OS == .Darwin {
--	foreign import lib {
--		"../macos/libraylib.550.dylib" when RAYLIB_SHARED else "../macos/libraylib.a",
--		"system:Cocoa.framework",
--		"system:OpenGL.framework",
--		"system:IOKit.framework",
--	} 
--} else when ODIN_ARCH == .wasm32 || ODIN_ARCH == .wasm64p32 {
--	foreign import lib {
--		RAYLIB_WASM_LIB,
--	}
--} else {
--	foreign import lib "system:raylib"
--}
-+foreign import lib "system:raylib"
- 
- GRAPHICS_API_OPENGL_11  :: false
- GRAPHICS_API_OPENGL_21  :: true
 
+ VERSION_MAJOR :: 6
+ VERSION_MINOR :: 0

pkgs/by-name/oe/oelint-adv/package.nix

@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "oelint-adv";
-  version = "9.9.1";
+  version = "9.9.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "priv-kweihmann";
     repo = "oelint-adv";
     tag = finalAttrs.version;
-    hash = "sha256-656OiHkRVP2M9/gR8faR2mEw9EzjHy92JRk82bD+I4k=";
+    hash = "sha256-RHW5GfTtwF7vEvnxTU+OyEMgMm0q3w+IjH0u6A3xQh0=";
   };
 
   postPatch = ''

pkgs/by-name/ol/ols/package.nix

@@ -17,6 +17,12 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-9tQVyauvXGTkKnQUSYKAhjL5ZZbhglqdcxdcs27P2k4=";
   };
 
+  patches = [
+    # Since Odin removed Haiku support in dev-2026-06 and there is still no update
+    # for ols we're removing the haiku parts so that this builds again
+    ./remove-haiku.patch
+  ];
+
   postPatch = ''
     substituteInPlace build.sh \
       --replace-fail "-microarch:native" ""

pkgs/by-name/ol/ols/remove-haiku.patch

@@ -0,0 +1,43 @@
+diff --git a/src/server/build.odin b/src/server/build.odin
+index 1c1f2290..aaf6d2a4 100644
+--- a/src/server/build.odin
++++ b/src/server/build.odin
+@@ -28,7 +28,6 @@ platform_os: map[string]struct{} = {
+ 	"openbsd" = {},
+ 	"wasi"    = {},
+ 	"wasm"    = {},
+-	"haiku"   = {},
+ 	"netbsd"  = {},
+ 	"freebsd" = {},
+ }
+@@ -42,7 +41,6 @@ os_enum_to_string: [runtime.Odin_OS_Type]string = {
+ 	.WASI         = "wasi",
+ 	.JS           = "js",
+ 	.Freestanding = "freestanding",
+-	.Haiku        = "haiku",
+ 	.OpenBSD      = "openbsd",
+ 	.NetBSD       = "netbsd",
+ 	.Orca         = "orca",
+@@ -69,8 +67,6 @@ os_string_to_enum: map[string]runtime.Odin_OS_Type = {
+ 	"freestanding" = .Freestanding,
+ 	"Wasm"         = .JS,
+ 	"wasm"         = .JS,
+-	"Haiku"        = .Haiku,
+-	"haiku"        = .Haiku,
+ 	"Openbsd"      = .OpenBSD,
+ 	"openbsd"      = .OpenBSD,
+ 	"OpenBSD"      = .OpenBSD,
+@@ -125,7 +121,12 @@ skip_file :: proc(filename: string) -> bool {
+
+ // Finds all packages under the provided path by walking the file system
+ // and appends them to the provided dynamic array
+-append_packages :: proc(path: string, pkgs: ^[dynamic]string, skip: map[string]struct{}, allocator := context.temp_allocator) {
++append_packages :: proc(
++	path: string,
++	pkgs: ^[dynamic]string,
++	skip: map[string]struct{},
++	allocator := context.temp_allocator,
++) {
+ 	w := os.walker_create(path)
+ 	defer os.walker_destroy(&w)
+ 	for info in os.walker_walk(&w) {

pkgs/by-name/op/openvino/package.nix

@@ -14,7 +14,6 @@
   patchelf,
   pkg-config,
   python3Packages,
-  shellcheck,
 
   # runtime
   flatbuffers,
@@ -85,7 +84,6 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
     python
     scons'
-    shellcheck
   ]
   ++ lib.optionals cudaSupport [
     cudaPackages.cuda_nvcc

pkgs/by-name/or/orca-slicer/package.nix

@@ -63,13 +63,13 @@ in
 # with --cores 32 on clang).
 clangStdenv.mkDerivation (finalAttrs: {
   pname = "orca-slicer";
-  version = "2.4.1";
+  version = "2.4.2";
 
   src = fetchFromGitHub {
     owner = "OrcaSlicer";
     repo = "OrcaSlicer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-NJvJAQfkacMjMIirAoOND/G1GaXeMcNleiGQKoe+654=";
+    hash = "sha256-gUwLC0XkeohEdL0EScdOrA8MWXGuR8kUfezoQsk9i/A=";
   };
 
   __structuredAttrs = true;
@@ -111,7 +111,7 @@ clangStdenv.mkDerivation (finalAttrs: {
     gst_all_1.gstreamer
     gst_all_1.gst-plugins-base
     gst_all_1.gst-plugins-bad
-    gst_all_1.gst-plugins-good
+    (gst_all_1.gst-plugins-good.override { gtkSupport = true; })
     gtk3
     hicolor-icon-theme
     libsecret
@@ -137,11 +137,11 @@ clangStdenv.mkDerivation (finalAttrs: {
     ./patches/dont-link-opencv-world-orca.patch
     # The changeset from https://github.com/OrcaSlicer/OrcaSlicer/pull/7650, can be removed when that PR gets merged
     # Allows disabling the update nag screen
-    #(fetchpatch {
-    #  name = "pr-7650-configurable-update-check.patch";
-    #  url = "https://github.com/OrcaSlicer/OrcaSlicer/commit/d10a06ae11089cd1f63705e87f558e9392f7a167.patch";
-    #  hash = "sha256-t4own5AwPsLYBsGA15id5IH1ngM0NSuWdFsrxMRXmTk=";
-    #})
+    (fetchpatch {
+      name = "pr-7650-configurable-update-check.patch";
+      url = "https://github.com/OrcaSlicer/OrcaSlicer/commit/300df7c99b0a2173f645c8bf40e8758eb5f2c486.patch";
+      hash = "sha256-hgQeagPhS3aNQoFSq0S+Ch60ygm81uHMIvGopw/AZT8=";
+    })
 
     # Pick https://github.com/prusa3d/PrusaSlicer/pull/14207 to remove unused and insecure ilmbase dependency
     ./patches/no-ilmbase.patch
@@ -238,6 +238,7 @@ clangStdenv.mkDerivation (finalAttrs: {
       ovlach
       pinpox
       liberodark
+      zraexy
     ];
     mainProgram = "orca-slicer";
     platforms = lib.platforms.linux;

pkgs/by-name/ou/oui/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "oui";
-  version = "2.0.7";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "thatmattlove";
     repo = "oui";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-lwjDFd2rxMh7kHOuwgIeA2/gnzHoNkGKTQGd/xqshZY=";
+    hash = "sha256-8hzemGUeUU1QmXJogkr4LLpSgwt1BMqTNTft8PxwmDQ=";
   };
 
   vendorHash = "sha256-EOu9imj0YwYhHX7ZzE9BzhkoDitC5AHjlwoWmQs0Rj4=";

pkgs/by-name/pa/paretosecurity/package.nix

@@ -17,13 +17,13 @@ buildGoModule (finalAttrs: {
     webkitgtk_4_1
   ];
   pname = "paretosecurity";
-  version = "0.3.20";
+  version = "0.3.21";
 
   src = fetchFromGitHub {
     owner = "ParetoSecurity";
     repo = "agent";
     rev = finalAttrs.version;
-    hash = "sha256-7AEWa2D4cTtDRETNo+GQH1VP1Me5jySx9MPCsHf81CY=";
+    hash = "sha256-pQ5p52Tf8MtCasTC4ZyDN3EaJfncCCADmK03+mdOQ2s=";
   };
 
   vendorHash = "sha256-tQkiAVrV1Tjv1VlBJWtfP9vBiiK845EBqM7QvJVsVB8=";

pkgs/by-name/pd/pdfding/frontend.nix

@@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
   npmDeps = fetchNpmDeps {
     inherit (finalAttrs) src;
     name = "pdfding-${finalAttrs.version}-npm-deps";
-    hash = "sha256-fxhDP/kyDfL1uiZCUNr2Cd6vDnyb9V+gTSNPyjSIm18=";
+    hash = "sha256-TDX2xoHj07aUeuLPt/TlgkdRdTiv3fNbriChzEB4EXk=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/pd/pdfding/package.nix

@@ -12,12 +12,12 @@ let
 in
 python.pkgs.buildPythonPackage (finalAttrs: {
   pname = "pdfding";
-  version = "1.9.0";
+  version = "1.10.0";
   src = fetchFromGitHub {
     owner = "mrmn2";
     repo = "PdfDing";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-r3hO92iriQ/0KDl+D/0j5RoneTTCDmt8m4e7ugzyOPs=";
+    hash = "sha256-C1osj8V9+z3ahl4+zUtyI22GMtSgNLzfdGttL7gPDvY=";
   };
   pyproject = true;
 
@@ -132,11 +132,11 @@ python.pkgs.buildPythonPackage (finalAttrs: {
   '';
 
   pythonRelaxDeps = [
+    "django"
     "gunicorn"
     "huey"
     "nh3"
     "psycopg2-binary"
-    "pypdf"
     "pypdfium2"
   ];
 

pkgs/by-name/pd/pdk-ciel/package.nix

@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "ciel";
-  version = "2.6.0";
+  version = "2.6.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "fossi-foundation";
     repo = "ciel";
     tag = finalAttrs.version;
-    hash = "sha256-koN65VQLGXvVmVd8hNJvbDn7R/4EHg/sNaHvWDWW4DM=";
+    hash = "sha256-rPsbit/VQ/bTAuRnuaTKQInztJHFhTBofqnrUzYyDKs=";
   };
 
   build-system = [ python3Packages.poetry-core ];

pkgs/by-name/pr/prismlauncher-unwrapped/package.nix

@@ -42,6 +42,12 @@ stdenv.mkDerivation (finalAttrs: {
     ln -s ${libnbtplusplus} source/libraries/libnbtplusplus
   '';
 
+  # Ensure that instance shortucts point to our final wrapper, rather than this unwrapped version
+  postPatch = ''
+    substituteInPlace launcher/minecraft/ShortcutUtils.cpp \
+      --replace-fail 'QApplication::applicationFilePath()' 'QProcessEnvironment::systemEnvironment().value("NIX_LAUNCHER_WRAPPER", "${placeholder "out"}/bin/prismlauncher")'
+  '';
+
   nativeBuildInputs = [
     cmake
     pkg-config

pkgs/by-name/pr/prismlauncher/package.nix

@@ -122,7 +122,10 @@ symlinkJoin {
       ++ additionalPrograms;
 
     in
-    [ "--prefix PRISMLAUNCHER_JAVA_PATHS : ${lib.makeSearchPath "bin/java" jdks}" ]
+    [
+      "--set NIX_LAUNCHER_WRAPPER ${placeholder "out"}/bin/prismlauncher"
+      "--prefix PRISMLAUNCHER_JAVA_PATHS : ${lib.makeSearchPath "bin/java" jdks}"
+    ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       "--set LD_LIBRARY_PATH ${addDriverRunpath.driverLink}/lib:${lib.makeLibraryPath runtimeLibs}"
       "--prefix PATH : ${lib.makeBinPath runtimePrograms}"

pkgs/by-name/pr/proton-pass-cli/package.nix

@@ -15,7 +15,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "proton-pass-cli";
-  version = "2.2.2";
+  version = "2.2.3";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -57,19 +57,19 @@ stdenv.mkDerivation (finalAttrs: {
     sources = {
       "aarch64-darwin" = fetchurl {
         url = "https://proton.me/download/pass-cli/${finalAttrs.version}/pass-cli-macos-aarch64";
-        hash = "sha256-CdY2oYT7jck81ldf6RNFHsRlOcdFukjVM/2fq0THQPM=";
+        hash = "sha256-gxjlrznYmXgCFOxixtHCz9x2KLsgNtuo9yr3TJpjxzI=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://proton.me/download/pass-cli/${finalAttrs.version}/pass-cli-linux-aarch64";
-        hash = "sha256-oVjbGFgF3wMPJZYfiUfZkRCLzW+QGv44krj/HUACGWE=";
+        hash = "sha256-NdBabzetuIJEbu81Rfg3hUVEw8BJ2A3Who/i08/qwMs=";
       };
       "x86_64-darwin" = fetchurl {
         url = "https://proton.me/download/pass-cli/${finalAttrs.version}/pass-cli-macos-x86_64";
-        hash = "sha256-Gvek5eqz1Sah5Hw4klxiQSQSAW3LOuEPvFUQUmXlwVM=";
+        hash = "sha256-K6vfr0ut8cQo1mrNeEN35akxLIo1sftt6hnn6wUa6Dk=";
       };
       "x86_64-linux" = fetchurl {
         url = "https://proton.me/download/pass-cli/${finalAttrs.version}/pass-cli-linux-x86_64";
-        hash = "sha256-Zb91GVv9D+jZZgFEyDdGa37pGV045W41V9XuZDnF91E=";
+        hash = "sha256-cYjwKnweeahg9xZq0sNPei5slhJltwZ34nBPIW3Rdtk=";
       };
     };
     updateScript = writeShellScript "update-proton-pass-cli" ''

pkgs/by-name/pr/proxytunnel/package.nix

@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "proxytunnel";
-  version = "1.12.3";
+  version = "1.13.0";
 
   src = fetchFromGitHub {
     owner = "proxytunnel";
     repo = "proxytunnel";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+IRbL3VcnW+uYLIkwvaFJ8zBYbQAkqmzVluDsCrdURk=";
+    hash = "sha256-4+EGVtohM0vL/fXHCXohwWqIBTiIUGbt6AZ7JKpRCT8=";
   };
 
   makeFlags = [ "prefix=${placeholder "out"}" ];

pkgs/by-name/qm/qmplay2/package.nix

@@ -18,13 +18,21 @@
   libxcb,
   ninja,
   pkg-config,
+  shaderc,
   qt5,
   qt6,
   taglib,
   vulkan-headers,
   vulkan-tools,
-  rubberband,
   deno,
+  expat,
+  libmpg123,
+  libogg,
+  libopenmpt,
+  libsysprof-capture,
+  libvorbis,
+  pipewire,
+  rubberband,
   # Configurable options
   qtVersion ? "6", # Can be 5 or 6
 }:
@@ -54,6 +62,7 @@ stdenv.mkDerivation (finalAttrs: {
     cmake
     ninja
     pkg-config
+    shaderc
   ]
   ++ lib.optionals (qtVersion == "6") [ qt6.wrapQtAppsHook ]
   ++ lib.optionals (qtVersion == "5") [ qt5.wrapQtAppsHook ];
@@ -76,6 +85,13 @@ stdenv.mkDerivation (finalAttrs: {
     vulkan-headers-qmplay2
     vulkan-tools
     deno
+    expat
+    libmpg123
+    libogg
+    libopenmpt
+    libsysprof-capture
+    libvorbis
+    pipewire
   ]
   ++ lib.optionals (qtVersion == "6") [
     rubberband
@@ -89,6 +105,10 @@ stdenv.mkDerivation (finalAttrs: {
     qt5.qttools
   ];
 
+  cmakeFlags = lib.optionals (qtVersion == "5") [
+    (lib.cmakeBool "BUILD_WITH_QT6" false)
+  ];
+
   strictDeps = true;
 
   # Because we think it is better to use only lowercase letters!

pkgs/by-name/qm/qmplay2/sources.nix

@@ -5,13 +5,13 @@
     let
       self = {
         pname = "qmplay2";
-        version = "25.09.11";
+        version = "26.06.27";
 
         src = fetchFromGitHub {
           owner = "zaps166";
           repo = "QMPlay2";
           tag = self.version;
-          hash = "sha256-1F6VOTMJZ64PlIVSWoYzNz4LVmn5pEcUq+IfstYDwYo=";
+          hash = "sha256-8PY6s74unLgwDFlyiHHCWrsatdI05obbREOICZoI+lU=";
         };
       };
     in
@@ -21,13 +21,13 @@
     let
       self = {
         pname = "vulkan-headers";
-        version = "1.4.317";
+        version = "1.4.350";
 
         src = fetchFromGitHub {
           owner = "KhronosGroup";
           repo = "Vulkan-Headers";
           tag = "v${self.version}";
-          hash = "sha256-ezNthwKsnXehQfrQh0zTk6Zrz3JgdqjYu68abYUWIik=";
+          hash = "sha256-RcUVurC+Rc0MyWpQLaLVmdn7FZO1GWWzTZZAOwvKwb4=";
         };
       };
     in
@@ -35,13 +35,13 @@
 
   qmvk = {
     pname = "qmvk";
-    version = "0-unstable-2025-09-02";
+    version = "0-unstable-2026-06-21";
 
     src = fetchFromGitHub {
       owner = "zaps166";
       repo = "QmVk";
-      rev = "0225dc851afaf39be2b92f91d4316e866f4b6133";
-      hash = "sha256-W2102+X+gE/9ghdAwWBeWYmSkSdp6lLPx4IKaQpLANI=";
+      rev = "26ef419a3b91bc11856c714b3b932c62db098bf9";
+      hash = "sha256-EaOGXYjon1brDQx+l7C2jvUkYgkW+D1qP52JPiMr3H0=";
     };
   };
 }