Merge staging-next into staging

.github/workflows/check.yml

@@ -92,8 +92,8 @@ jobs:
     if: inputs.baseBranch && inputs.headBranch
     permissions:
       pull-requests: write
-    runs-on: ubuntu-slim
-    timeout-minutes: 3
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 8
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:

.github/workflows/lint.yml

@@ -131,8 +131,8 @@ jobs:
     # Luckily there's no need to lint commit messages in the Merge Queue, because
     # changes to the target branch can't change commit messages on the base branch.
     if: ${{ github.event.pull_request.number }}
-    runs-on: ubuntu-slim
-    timeout-minutes: 5
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 8
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:

doc/languages-frameworks/javascript.section.md

@@ -305,7 +305,7 @@ This package puts the corepack wrappers for pnpm and yarn in your PATH, and they
 
 ### pnpm {#javascript-pnpm}
 
-pnpm is available as the top-level package `pnpm`. Additionally, there are variants pinned to certain major versions, like `pnpm_8`, `pnpm_9`, `pnpm_10`, `pnpm_10_29_2` and `pnpm_11`, which support different sets of lock file versions.
+pnpm is available as the top-level package `pnpm`. Additionally, there are variants pinned to certain major versions, like `pnpm_9`, `pnpm_10`, `pnpm_10_29_2` and `pnpm_11`, which support different sets of lock file versions.
 
 When packaging an application that includes a `pnpm-lock.yaml`, you need to fetch the pnpm store for that project using a fixed-output-derivation. The function `fetchPnpmDeps` can create this pnpm store derivation. In conjunction, the setup hook `pnpmConfigHook` will prepare the build environment to install the pre-fetched dependencies store. Here is an example for a package that contains `package.json` and a `pnpm-lock.yaml` files using the fetcher and setup hook above:
 

doc/style.css

@@ -114,7 +114,7 @@ html {
 body {
   font-size: 1rem;
   font-family: "Roboto", sans-serif;
-  font-weight: 300;
+  font-weight: 400;
   color: var(--main-text-color);
   background-color: var(--background);
   min-height: 100vh;
@@ -184,59 +184,52 @@ hr {
   margin-bottom: 1rem;
 }
 
-h1 {
+h1,
+h2,
+h3,
+h4,
+h5,
+h6 {
   font-weight: 800;
-  line-height: 110%;
-  font-size: 200%;
-  margin-bottom: 1rem;
+  line-height: 1.1;
+  margin: 1.5rem 0 0.5rem;
+}
+
+/*
+  Major-second scale see: https://typescale.com/
+  rounded to .025rem (0.4px)
+*/
+h1 {
+  font-size: 2rem;
   color: var(--heading-color);
 }
 
 h2 {
-  font-weight: 800;
-  line-height: 110%;
-  font-size: 170%;
-  margin-bottom: 0.625rem;
+  font-size: 1.8rem;
   color: var(--heading-color);
 }
 
-h2:not(:first-child) {
-  margin-top: 1rem;
-}
-
 h3 {
-  font-weight: 800;
-  line-height: 110%;
-  margin-bottom: 1rem;
-  font-size: 150%;
+  font-size: 1.6rem;
   color: var(--heading-color);
 }
 
-:is(.note, .tip, .warning, .caution, .important) h3 {
-  font-size: 120%;
-}
-
 h4 {
-  font-weight: 800;
-  line-height: 110%;
-  margin-bottom: 1rem;
-  font-size: 140%;
+  font-size: 1.425rem;
   color: var(--heading-color);
 }
 
 h5 {
-  font-weight: 800;
-  line-height: 110%;
-  margin-bottom: 1rem;
-  font-size: 130%;
+  font-size: 1.275rem;
   color: var(--small-heading-color);
 }
 
 h6 {
-  font-weight: 800;
-  line-height: 110%;
-  margin-bottom: 1rem;
-  font-size: 120%;
+  font-size: 1.125rem;
+}
+
+:is(.note, .tip, .warning, .caution, .important) h3 {
+  font-size: 1.425rem;
 }
 
 strong {
@@ -264,13 +257,9 @@ code {
 }
 
 code {
-  color: #ff8657;
-  background: #f4f4f4;
-  display: inline-block;
-  padding: 0 0.5rem;
-  border: 1px solid #d8d8d8;
-  border-radius: 0.5rem;
-  line-height: 1.57777778;
+  padding: 0.2em 0.4em;
+  background: var(--inline-code-background);
+  border-radius: 0.375rem;
 }
 
 div.book .programlisting,
@@ -330,11 +319,6 @@ div.appendix .programlisting {
   background: var(--caution-background);
 }
 
-div.book .section,
-div.appendix .section {
-  margin-top: 2em;
-}
-
 div.book div.example,
 div.appendix div.example {
   margin-top: 1.5em;
@@ -378,11 +362,6 @@ div.appendix dt {
 
 div.book code,
 div.appendix code {
-  padding: 0;
-  border: 0;
-  background-color: inherit;
-  color: inherit;
-  font-size: 100%;
   -webkit-hyphens: none;
   -moz-hyphens: none;
   hyphens: none;
@@ -441,6 +420,7 @@ div.appendix .variablelist .term {
   --caution-background: #ffebe8;
   --codeblock-background: #f2f8fd;
   --codeblock-text-color: #000;
+  --inline-code-background: #818b981f;
 }
 
 @media (prefers-color-scheme: dark) {
@@ -466,6 +446,7 @@ div.appendix .variablelist .term {
     --caution-background: #422522;
     --codeblock-background: #393939;
     --codeblock-text-color: #fff;
+    --inline-code-background: #656c7633;
   }
 
   :is(.note, .tip, .warning, .caution, .important) {
@@ -476,7 +457,12 @@ div.appendix .variablelist .term {
 
 @font-face {
   font-family: Roboto;
-  src: url(Roboto.ttf);
+  src:
+    url(Roboto.ttf) format("truetype") tech(variations),
+    url(Roboto.ttf) format("truetype-variations");
+  font-weight: 100 900;
+  font-style: normal;
+  font-display: swap;
 }
 
 .chapter {

maintainers/maintainer-list.nix

@@ -7747,6 +7747,7 @@
     name = "EarthGman";
     github = "EarthGman";
     githubId = 117403037;
+    keys = [ { fingerprint = "A06C 1E72 4626 7B4C EE16  CC2E 4862 31CD BCE3 AA32"; } ];
   };
   EBADBEEF = {
     name = "EBADBEEF";
@@ -15386,7 +15387,7 @@
   };
   lactose = {
     name = "lactose";
-    email = "lactose@allthingslinux.com";
+    email = "mail@lactose.dev";
     github = "juuyokka";
     githubId = 15185244;
   };

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -81,6 +81,8 @@
 
 - When Avahi's mDNS resolver is enabled (`services.avahi.nssmdns4` or `services.avahi.nssmdns6`), only the minimal mDNS resolver is enabled by default to avoid adding a 5 second delay to every failed reverse hostname lookup (e.g., delaying ping by 5 seconds). The "full" mDNS resolver now remains disabled unless `services.avahi.nssmdnsFull` is also enabled. Users who have customized [`/etc/mdns.allow`](https://github.com/avahi/nss-mdns/tree/master#etcmdnsallow) to allow mDNS domains not ending `.local` must enable `services.avahi.nssmdnsFull` to continue to resolve such domains.
 
+- String values passed to `services.phpfpm.settings`, `services.phpfpm.pools.<name>.phpEnv`, and `services.phpfpm.pools.<name>.settings` are now properly quoted and escaped, except for the `${}` syntax that is left as-is. If you are manually escaping these values, please adjust accordingly.
+
 - `systemd.user.extraConfig` has been removed in favor of the structured [](#opt-systemd.user.settings.Manager) option. Use `systemd.user.settings.Manager` to set any `systemd-user.conf(5)` option directly. For example, replace `systemd.user.extraConfig = "DefaultTimeoutStartSec=60";` with `systemd.user.settings.Manager.DefaultTimeoutStartSec = 60;`.
 
 - `matrix-appservice-discord` was removed from nixpkgs along with its NixOS module (`services.matrix-appservice-discord`) as it is no longer actively maintained upstream. Use the actively-maintained puppeting bridge [`mautrix-discord`](#opt-services.mautrix-discord.enable) instead.

nixos/modules/module-list.nix

@@ -821,6 +821,7 @@
   ./services/matrix/mautrix-whatsapp.nix
   ./services/matrix/mjolnir.nix
   ./services/matrix/pantalaimon.nix
+  ./services/matrix/rust-federation-tester.nix
   ./services/matrix/synapse-auto-compressor.nix
   ./services/matrix/synapse.nix
   ./services/matrix/tuwunel.nix

nixos/modules/services/matrix/rust-federation-tester.nix

@@ -0,0 +1,153 @@
+{
+  config,
+  lib,
+  pkgs,
+  utils,
+  ...
+}:
+
+let
+  cfg = config.services.rust-federation-tester;
+
+  configFile = "/run/rust-federation-tester/config.yaml";
+  commonServiceConfig = {
+    DynamicUser = true;
+    RuntimeDirectory = "rust-federation-tester";
+    RuntimeDirectoryPreserve = true;
+    StateDirectory = "rust-federation-tester";
+    User = "rust-federation-tester";
+    WorkingDirectory = "%t/rust-federation-tester";
+
+    # Hardening
+    UMask = "0077";
+    CapabilityBoundingSet = [ "" ];
+    DevicePolicy = "closed";
+    PrivateTmp = true;
+    ProtectHome = true;
+    ProtectSystem = "strict";
+    MemoryDenyWriteExecute = true;
+    NoNewPrivileges = true;
+    LockPersonality = true;
+    PrivateDevices = true;
+    PrivateMounts = true;
+    ProcSubset = "pid";
+    ProtectClock = true;
+    ProtectControlGroups = true;
+    ProtectHostname = true;
+    ProtectKernelLogs = true;
+    ProtectKernelModules = true;
+    ProtectKernelTunables = true;
+    ProtectProc = "invisible";
+    RemoveIPC = true;
+    RestrictAddressFamilies = [
+      "AF_INET"
+      "AF_INET6"
+      "AF_UNIX"
+    ];
+    RestrictNamespaces = true;
+    RestrictRealtime = true;
+    RestrictSUIDSGID = true;
+    SystemCallArchitectures = "native";
+    SystemCallFilter = [
+      "@system-service"
+    ];
+  };
+
+  secretsInjection = utils.genJqSecretsReplacement {
+    loadCredential = true;
+  } cfg.settings configFile;
+in
+{
+  options.services.rust-federation-tester = {
+    enable = lib.mkEnableOption "rust-federation-tester";
+
+    settings = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = lib.types.json;
+        options = {
+          frontend_url = lib.mkOption {
+            type = lib.types.str;
+            example = "federation-tester.example.org";
+            description = ''
+              URL of the service's frontend.
+            '';
+          };
+
+          database_url = lib.mkOption {
+            type = lib.types.str;
+            default = "sqlite:///var/lib/rust-federation-tester/db?mode=rwc";
+            example = "postgres://localhost/db?currentSchema=schema";
+            description = ''
+              The database to store accounts and statistics.
+            '';
+          };
+
+          smtp = {
+            enabled = lib.mkEnableOption "mail delivery for configured alerts";
+          };
+
+          listen_addr = lib.mkOption {
+            type = lib.types.str;
+            default = "[::]:8080";
+            example = "unix:/run/rust-federation-tester/rust-federation-tester.sock";
+            description = ''
+              Address the API server should listen on.
+            '';
+          };
+        };
+      };
+
+      description = ''
+        Settings representing the values in {file}`config.yaml` of the service.
+
+        Refer to [`config.yaml.example`] for supported values.
+
+        [`config.yaml.example`]: https://github.com/MTRNord/rust-federation-tester/blob/main/config.yaml.example
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.sockets.rust-federation-tester = {
+      description = "Matrix-Federation-Tester in Rust socket";
+      wantedBy = [ "sockets.target" ];
+      listenStreams = [ (lib.removePrefix "unix:" cfg.settings.listen_addr) ];
+    };
+
+    systemd.services.rust-federation-tester-setup = {
+      description = "Matrix-Federation-Tester in Rust";
+      path = [ pkgs.rust-federation-tester ];
+
+      serviceConfig = lib.mkMerge [
+        commonServiceConfig
+        {
+          Type = "oneshot";
+          RemainAfterExit = true;
+          LoadCredential = secretsInjection.credentials;
+          ExecStart = "${pkgs.writeShellScript "rust-federation-tester-setup" ''
+            ${secretsInjection.script}
+
+            migration up
+          ''}";
+        }
+      ];
+    };
+
+    systemd.services.rust-federation-tester = {
+      description = "Matrix-Federation-Tester in Rust";
+      wantedBy = [ "multi-user.target" ];
+      documentation = [ "https://github.com/MTRNord/rust-federation-tester" ];
+      after = [ "rust-federation-tester-setup.service" ];
+      requires = [ "rust-federation-tester-setup.service" ];
+
+      serviceConfig = lib.mkMerge [
+        commonServiceConfig
+        {
+          ExecSearchPath = lib.makeBinPath [ pkgs.rust-federation-tester ];
+          ExecStart = "rust-federation-tester";
+          Restart = "on-failure";
+        }
+      ];
+    };
+  };
+}

nixos/modules/services/network-filesystems/nfsd.nix

@@ -6,6 +6,14 @@
 }:
 let
 
+  attrsToExports = lib.concatMapAttrsStringSep "\n" (
+    exportPoint: clientsAndOptions:
+    exportPoint
+    + lib.concatMapAttrsStringSep "" (
+      client: options: " ${client}(${lib.concatStringsSep "," options})"
+    ) clientsAndOptions
+  );
+
   cfg = config.services.nfs.server;
 
   exports = pkgs.writeText "exports" cfg.exports;
@@ -48,12 +56,26 @@ in
         };
 
         exports = lib.mkOption {
-          type = lib.types.lines;
+          type = with lib.types; coercedTo (attrsOf (attrsOf (listOf str))) attrsToExports lines;
           default = "";
           description = ''
             Contents of the /etc/exports file.  See
             {manpage}`exports(5)` for the format.
           '';
+          example = {
+            "/usr" = {
+              "*.local.domain" = [ "ro" ];
+              "@trusted" = [ "rw" ];
+            };
+            "/home/joe" = {
+              "pc001" = [
+                "rw"
+                "all_squash"
+                "anonuid=150"
+                "anongid=100"
+              ];
+            };
+          };
         };
 
         hostName = lib.mkOption {

nixos/modules/services/ttys/getty.nix

@@ -76,6 +76,24 @@ in
         '';
       };
 
+      enable = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Include getty in the system.
+
+          getty is quiescent until called into action and does not have
+          runtime costs if it is not used. The benefit of disabling it is
+          in reducing closure size.
+
+          Disabling getty means that console login may not be possible,
+          `machinectl shell` and `login` may not work, and other ills.
+          It is only recommended for lights-out, headless containers,
+          appliances, and similar configurations not meant for any human
+          interaction ever.
+        '';
+      };
+
       loginProgram = mkOption {
         type = types.path;
         default = "${pkgs.shadow}/bin/login";
@@ -133,7 +151,7 @@ in
 
   ###### implementation
 
-  config = {
+  config = mkIf cfg.enable {
     # Note: this is set here rather than up there so that changing
     # nixos.label would not rebuild manual pages
     services.getty.greetingLine = mkDefault ''<<< Welcome to ${config.system.nixos.distroName} ${config.system.nixos.label} (\m) - \l >>>'';

nixos/modules/services/web-servers/phpfpm/default.nix

@@ -18,6 +18,15 @@ let
       "yes"
     else if false == value then
       "no"
+    else if isString value then
+      # Escape according to https://www.php.net/manual/en/function.parse-ini-file.php
+      # Not escaping `$` since users might want to use that to interpolate environment variables.
+      # Additionally, php-fpm applies post-processing to env values that start with `$` and replaces
+      # them with the respective env variable, with no way to escape: https://github.com/php/php-src/blob/631c366f9f58c8ba4078a48d1f56187cfbf8e549/sapi/fpm/fpm/fpm_env.c#L171-L180
+      # In all platforms except for Windows, PHP_EOL is the line feed `\n` character,
+      # which we use here as an escape value since php-fpm parses the config line-by-line.
+      # See https://github.com/NixOS/nixpkgs/pull/516530#issuecomment-4878738511 for more information.
+      ''"${replaceString "\n" ''" PHP_EOL "'' (escape [ "\"" "\\" ] value)}"''
     else
       toString value;
 

nixos/tests/all-tests.nix

@@ -1005,7 +1005,6 @@ in
   matrix-conduit = runTest ./matrix/conduit.nix;
   matrix-continuwuity = runTest ./matrix/continuwuity.nix;
   matrix-synapse = runTest ./matrix/synapse.nix;
-  matrix-synapse-workers = runTest ./matrix/synapse-workers.nix;
   matrix-tuwunel = runTest ./matrix/tuwunel.nix;
   matter-server = runTest ./matter-server.nix;
   matterjs-server = runTest ./matterjs-server.nix;

nixos/tests/matrix/synapse-workers.nix

@@ -1,53 +0,0 @@
-{ pkgs, ... }:
-{
-  name = "matrix-synapse-workers";
-  meta = {
-    inherit (pkgs.matrix-synapse.meta) maintainers;
-  };
-
-  nodes = {
-    homeserver =
-      {
-        pkgs,
-        nodes,
-        ...
-      }:
-      {
-        services.postgresql = {
-          enable = true;
-          initialScript = pkgs.writeText "synapse-init.sql" ''
-            CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD 'synapse';
-            CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
-            TEMPLATE template0
-            LC_COLLATE = "C"
-            LC_CTYPE = "C";
-          '';
-        };
-
-        services.matrix-synapse = {
-          enable = true;
-          settings = {
-            database = {
-              name = "psycopg2";
-              args.password = "synapse";
-            };
-            enable_registration = true;
-            enable_registration_without_verification = true;
-
-            federation_sender_instances = [ "federation_sender" ];
-          };
-          configureRedisLocally = true;
-          workers = {
-            "federation_sender" = { };
-          };
-        };
-      };
-  };
-
-  testScript = ''
-    start_all()
-
-    homeserver.wait_for_unit("matrix-synapse.service");
-    homeserver.wait_for_unit("matrix-synapse-worker-federation_sender.service");
-  '';
-}

nixos/tests/matrix/synapse.nix

@@ -1,101 +1,194 @@
 { pkgs, ... }:
 let
-
   ca_key = mailerCerts.ca.key;
   ca_pem = mailerCerts.ca.cert;
 
-  bundle =
-    pkgs.runCommand "bundle"
+  aliceName = "alice";
+  alicePassword = "alicealice";
+  aliceEmail = "alice@example.com";
+
+  bobName = "bob";
+  bobPassword = "hunter2";
+
+  mkBundle =
+    domain:
+    pkgs.runCommand "bundle-${domain}"
       {
         nativeBuildInputs = [ pkgs.minica ];
       }
       ''
         minica -ca-cert ${ca_pem} -ca-key ${ca_key} \
-          -domains localhost
-        install -Dm444 -t $out localhost/{key,cert}.pem
+          -domains ${domain}
+        install -Dm444 -t $out ${domain}/{key,cert}.pem
       '';
 
   mailerCerts = import ../common/acme/server/snakeoil-certs.nix;
   mailerDomain = mailerCerts.domain;
   registrationSharedSecret = "unsecure123";
-  testUser = "alice";
-  testPassword = "alicealice";
-  testEmail = "alice@example.com";
 
-  listeners = [
+  anonHash = "hunter2hunter2hunter2";
+  anonHashF = pkgs.writeText "hash" anonHash;
+
+  mkHomeserverBase =
+    domain: nodes:
+    let
+      bundle = mkBundle domain;
+    in
+    { lib, ... }:
     {
-      port = 8448;
-      bind_addresses = [
-        "127.0.0.1"
-        "::1"
+      security.pki.certificateFiles = [
+        mailerCerts.ca.cert
       ];
-      type = "http";
-      tls = true;
-      x_forwarded = false;
-      resources = [
-        {
-          names = [
-            "client"
-          ];
-          compress = true;
-        }
-        {
-          names = [
-            "federation"
-          ];
-          compress = false;
-        }
-      ];
-    }
-  ];
 
+      networking = {
+        hostName = lib.head (lib.strings.splitString "." domain);
+        domain = lib.last (lib.strings.splitString "." domain);
+        firewall.allowedTCPPorts = [
+          80
+          443
+          8448
+        ];
+      };
+
+      services.nginx = {
+        enable = true;
+        virtualHosts."${domain}" = {
+          sslCertificate = "${bundle}/cert.pem";
+          sslCertificateKey = "${bundle}/key.pem";
+          addSSL = true;
+          locations."/.well-known/matrix/server".extraConfig = ''
+            default_type application/json;
+            return 200 '${
+              builtins.toJSON {
+                "m.server" = "${domain}:8448";
+              }
+            }';
+          '';
+        };
+      };
+    };
+
+  mkSynapseConfig =
+    domain: primaryIP:
+    let
+      bundle = mkBundle domain;
+    in
+    {
+      enable = true;
+      settings = {
+        # We're in a test environment with local machines, so
+        # we actually _want_ to use RFC1918 addresses.
+        ip_range_blacklist = [ ];
+
+        trusted_key_servers = [
+          { server_name = "hs1.test"; }
+          { server_name = "hs2.test"; }
+        ];
+
+        registration_shared_secret = registrationSharedSecret;
+        public_baseurl = "https://${domain}";
+        tls_certificate_path = "${bundle}/cert.pem";
+        tls_private_key_path = "${bundle}/key.pem";
+        listeners = [
+          # Using a local listener, otherwise matrix-synapse-register_new_matrix_user will
+          # fail because it'll try to connect to the first bind address, but via TLS resulting
+          # in a signature verification failure.
+          {
+            port = 8008;
+            type = "http";
+            tls = false;
+            resources = [
+              {
+                names = [ "client" ];
+                compress = true;
+              }
+            ];
+            bind_addresses = [ "::1" ];
+          }
+          {
+            port = 8448;
+            bind_addresses = [
+              primaryIP
+            ];
+            type = "http";
+            tls = true;
+            x_forwarded = false;
+            resources = [
+              {
+                names = [
+                  "client"
+                ];
+                compress = true;
+              }
+              {
+                names = [
+                  "federation"
+                ];
+                compress = false;
+              }
+            ];
+          }
+        ];
+      };
+    };
 in
 {
-
   name = "matrix-synapse";
   meta = {
     inherit (pkgs.matrix-synapse.meta) maintainers;
   };
 
   nodes = {
-    # Since 0.33.0, matrix-synapse doesn't allow underscores in server names
-    serverpostgres =
+    synapse-with-workers =
       {
+        lib,
+        config,
         pkgs,
         nodes,
-        config,
         ...
       }:
-      let
-        mailserverIP = nodes.mailserver.networking.primaryIPAddress;
-      in
       {
-        services.matrix-synapse = {
-          enable = true;
-          settings = {
-            inherit listeners;
-            database = {
-              name = "psycopg2";
-              args.password = "synapse";
+        imports = [
+          (mkHomeserverBase "hs1.test" nodes)
+        ];
+
+        services.matrix-synapse = lib.mkMerge [
+          (mkSynapseConfig "hs1.test" config.networking.primaryIPAddress)
+          {
+            settings = {
+              server_name = "hs1.test";
+              email = {
+                smtp_host = mailerDomain;
+                smtp_port = 25;
+                require_transport_security = true;
+                notif_from = "matrix <matrix@${mailerDomain}>";
+                app_name = "Matrix";
+              };
+              listeners = [
+                {
+                  path = "/run/matrix-synapse/main_replication.sock";
+                  type = "http";
+                  resources = [
+                    {
+                      names = [ "replication" ];
+                      compress = false;
+                    }
+                  ];
+                }
+              ];
+              database = {
+                name = "psycopg2";
+                args.password = "synapse";
+              };
+              federation_sender_instances = [ "federation_sender" ];
             };
-            redis = {
-              enabled = true;
-              host = "localhost";
-              port = config.services.redis.servers.matrix-synapse.port;
+            configureRedisLocally = true;
+            workers = {
+              "federation_sender" = { };
             };
-            tls_certificate_path = "${bundle}/cert.pem";
-            tls_private_key_path = "${bundle}/key.pem";
-            registration_shared_secret = registrationSharedSecret;
-            public_baseurl = "https://example.com";
-            email = {
-              smtp_host = mailerDomain;
-              smtp_port = 25;
-              require_transport_security = true;
-              notif_from = "matrix <matrix@${mailerDomain}>";
-              app_name = "Matrix";
-            };
-          };
-        };
+          }
+        ];
+
         services.postgresql = {
           enable = true;
 
@@ -113,20 +206,6 @@ in
           '';
         };
 
-        services.redis.servers.matrix-synapse = {
-          enable = true;
-          port = 6380;
-        };
-
-        networking.extraHosts = ''
-          ${mailserverIP} ${mailerDomain}
-        '';
-
-        security.pki.certificateFiles = [
-          mailerCerts.ca.cert
-          ca_pem
-        ];
-
         environment.systemPackages =
           let
             sendTestMailStarttls = pkgs.writeScriptBin "send-testmail-starttls" ''
@@ -140,7 +219,7 @@ in
                 smtp.ehlo()
                 smtp.starttls(context=ctx)
                 smtp.ehlo()
-                smtp.sendmail('matrix@${mailerDomain}', '${testEmail}', 'Subject: Test STARTTLS\n\nTest data.')
+                smtp.sendmail('matrix@${mailerDomain}', '${aliceEmail}', 'Subject: Test STARTTLS\n\nTest data.')
                 smtp.quit()
             '';
 
@@ -149,16 +228,14 @@ in
                 # adding the email through the API is quite complicated as it involves more than one step and some
                 # client-side calculation
                 insertEmailForAlice = pkgs.writeText "alice-email.sql" ''
-                  INSERT INTO user_threepids (user_id, medium, address, validated_at, added_at) VALUES ('${testUser}@serverpostgres', 'email', '${testEmail}', '1629149927271', '1629149927270');
+                  INSERT INTO user_threepids (user_id, medium, address, validated_at, added_at) VALUES ('${aliceName}@serverpostgres', 'email', '${aliceEmail}', '1629149927271', '1629149927270');
                 '';
               in
               pkgs.writeScriptBin "obtain-token-and-register-email" ''
                 #!${pkgs.runtimeShell}
-                set -o errexit
-                set -o pipefail
-                set -o nounset
+                set -euxo pipefail
                 su postgres -c "psql -d matrix-synapse -f ${insertEmailForAlice}"
-                curl --fail -XPOST 'https://localhost:8448/_matrix/client/r0/account/password/email/requestToken' -d '{"email":"${testEmail}","client_secret":"foobar","send_attempt":1}' -v
+                curl --fail -XPOST 'https://hs1.test:8448/_matrix/client/r0/account/password/email/requestToken' -d '{"email":"${aliceEmail}","client_secret":"foobar","send_attempt":1}' -v
               '';
           in
           [
@@ -168,74 +245,189 @@ in
           ];
       };
 
-    # test mail delivery
-    mailserver = args: {
-      security.pki.certificateFiles = [
-        mailerCerts.ca.cert
-      ];
+    mailserver =
+      { lib, ... }:
+      {
+        security.pki.certificateFiles = [
+          mailerCerts.ca.cert
+        ];
 
-      networking.firewall.enable = false;
+        networking = {
+          hostName = lib.head (lib.strings.splitString "." mailerDomain);
+          domain = lib.last (lib.strings.splitString "." mailerDomain);
+          firewall.enable = false;
+        };
 
-      services.postfix = {
-        enable = true;
-        enableSubmission = true;
+        services.postfix = {
+          enable = true;
+          enableSubmission = true;
 
-        # blackhole transport
-        transport = "example.com discard:silently";
+          # blackhole transport
+          transport = "example.com discard:silently";
 
-        settings.main = {
-          myhostname = "${mailerDomain}";
-          # open relay for subnet
-          mynetworks_style = "subnet";
-          debug_peer_level = "10";
-          smtpd_relay_restrictions = [
-            "permit_mynetworks"
-            "reject_unauth_destination"
-          ];
+          settings.main = {
+            myhostname = "${mailerDomain}";
+            # open relay for subnet
+            mynetworks_style = "subnet";
+            debug_peer_level = "10";
+            smtpd_relay_restrictions = [
+              "permit_mynetworks"
+              "reject_unauth_destination"
+            ];
 
-          # disable obsolete protocols, something old versions of twisted are still using
-          smtpd_tls_protocols = "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";
-          smtpd_tls_mandatory_protocols = "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";
-          smtpd_tls_chain_files = [
-            "${mailerCerts.${mailerDomain}.key}"
-            "${mailerCerts.${mailerDomain}.cert}"
-          ];
+            # disable obsolete protocols, something old versions of twisted are still using
+            smtpd_tls_protocols = "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";
+            smtpd_tls_mandatory_protocols = "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";
+            smtpd_tls_chain_files = [
+              "${mailerCerts.${mailerDomain}.key}"
+              "${mailerCerts.${mailerDomain}.cert}"
+            ];
+          };
         };
       };
-    };
 
-    serversqlite = args: {
-      services.matrix-synapse = {
-        enable = true;
-        settings = {
-          inherit listeners;
-          database.name = "sqlite3";
-          tls_certificate_path = "${bundle}/cert.pem";
-          tls_private_key_path = "${bundle}/key.pem";
+    synapse-minimal =
+      {
+        nodes,
+        config,
+        lib,
+        ...
+      }:
+      {
+        imports = [
+          (mkHomeserverBase "hs2.test" nodes)
+        ];
+
+        services.matrix-synapse = lib.mkMerge [
+          (mkSynapseConfig "hs2.test" config.networking.primaryIPAddress)
+          {
+            settings = {
+              database.name = "sqlite3";
+              server_name = "hs2.test";
+            };
+          }
+        ];
+      };
+
+    client =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = [
+          # `pkgs.olm` is cached on c.n.o, even if this test isn't built due
+          # to it being allow-listed in `pkgs/top-level/release.nix`.
+          (import pkgs.path {
+            config = pkgs.config // {
+              permittedInsecurePackages = [ "olm-3.2.16" ];
+            };
+          }).matrix-commander
+          pkgs.jq
+        ];
+
+        security.pki.certificateFiles = [ mailerCerts.ca.cert ];
+
+        users.users = {
+          alice.isNormalUser = true;
+          bob.isNormalUser = true;
+        };
+
+        networking.useNetworkd = true;
+        services.rust-federation-tester = {
+          enable = true;
+          settings = {
+            listen_addr = "unix:/run/rust-federation-tester/rust-federation-tester.sock";
+            frontend_url = "http://localhost:8080";
+            database_url = "sqlite:///var/lib/rust-federation-tester/db?mode=rwc";
+            magic_token_secret = "foobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobar";
+            statistics = {
+              enabled = true;
+              prometheus_enabled = true;
+              anonymization_salt._secret = "${anonHashF}";
+              raw_retention_days = 30;
+            };
+          };
         };
       };
-    };
   };
 
   testScript = ''
+    import json
+    from pprint import pprint
+
     start_all()
-    mailserver.wait_for_unit("postfix.service")
-    serverpostgres.succeed("send-testmail-starttls")
-    serverpostgres.wait_for_unit("matrix-synapse.service")
-    serverpostgres.wait_until_succeeds(
-        "curl --fail -L --cacert ${ca_pem} https://localhost:8448/"
-    )
-    serverpostgres.wait_until_succeeds(
+
+    synapse_with_workers.wait_for_unit("multi-user.target")
+    synapse_minimal.wait_for_unit("multi-user.target")
+    mailserver.wait_for_unit("multi-user.target")
+
+    synapse_with_workers.wait_until_succeeds(
         "journalctl -u matrix-synapse.service | grep -q 'Connected to redis'"
     )
-    serverpostgres.require_unit_state("postgresql.target")
-    serverpostgres.succeed("REQUESTS_CA_BUNDLE=${ca_pem} register_new_matrix_user -u ${testUser} -p ${testPassword} -a -k ${registrationSharedSecret} https://localhost:8448/")
-    serverpostgres.succeed("obtain-token-and-register-email")
-    serversqlite.wait_for_unit("matrix-synapse.service")
-    serversqlite.wait_until_succeeds(
-        "curl --fail -L --cacert ${ca_pem} https://localhost:8448/"
-    )
-    serversqlite.succeed("[ -e /var/lib/matrix-synapse/homeserver.db ]")
-  '';
+    synapse_with_workers.wait_for_unit("matrix-synapse-worker-federation_sender.service");
 
+    with subtest("register user with email confirmation"):
+        synapse_with_workers.succeed("send-testmail-starttls")
+        synapse_with_workers.succeed("REQUESTS_CA_BUNDLE=${mailerCerts.ca.cert} register_new_matrix_user -u ${aliceName} -p ${alicePassword} -a -k ${registrationSharedSecret} https://hs1.test:8448/")
+        synapse_with_workers.succeed("obtain-token-and-register-email")
+
+    with subtest("matrix-synapse-register_new_matrix_user"):
+        synapse_minimal.succeed("matrix-synapse-register_new_matrix_user -u ${bobName} -p ${bobPassword} --no-admin")
+        synapse_minimal.succeed("[ -e /var/lib/matrix-synapse/homeserver.db ]")
+
+    with subtest("Federation tester"):
+        expected_anonymization_hashes = {
+            "hs1.test": "0558582846d6e2d90612900d449871dfcbf9878ba78de4a8469d8aba2d9c037b",
+            "hs2.test": "d3d88c2033c03b74ec1e086e15c0251514de060de5e51cb381e896f892a5b0cd",
+        }
+
+        # /metrics are cached for up to 30 seconds
+        for n, domain in enumerate(["hs2.test", "hs1.test"], start=3):
+            result = json.loads(
+                client.succeed(
+                    f"curl --fail --unix-socket /run/rust-federation-tester/rust-federation-tester.sock 'http://localhost:8080/api/federation/report?server_name={domain}&stats_opt_in=true'"
+                )
+            )
+            pprint(result)
+            t.assertTrue(result["FederationOK"])
+            t.assertTrue(result["ConnectionReports"][f"192.168.1.{n}:8448"]["Checks"]["AllChecksOK"])
+            t.assertEqual(f"{domain}:8448", result["WellKnownResult"][f"192.168.1.{n}:443"]["m.server"])
+
+        client.sleep(30)
+        # /metrics are cached for up to 30 seconds
+        for domain in ["hs2.test", "hs1.test"]:
+            metrics = client.succeed("curl --unix-socket /run/rust-federation-tester/rust-federation-tester.sock http://localhost:8080/metrics --fail")
+            t.assertRegex(
+                metrics,
+                f'federation_request_total\\{{server=\\"{expected_anonymization_hashes[domain]}\\",result=\\"success\\",[^}}]+\\}} 1'
+            )
+
+    def run_as_alice(cmd):
+        return client.succeed(f"sudo -u alice matrix-commander -c /home/alice/credentials.json -s /home/alice/matrix {cmd}")
+
+    def run_as_bob(cmd):
+        return client.succeed(f"sudo -u bob matrix-commander -c /home/bob/credentials.json -s /home/bob/matrix {cmd}")
+
+    with subtest("Login"):
+        run_as_alice("--login password --homeserver https://hs1.test:8448 --user-login @${aliceName}:hs1.test --password ${alicePassword} --device commander --room-default '#welcome:hs1.test'")
+        run_as_bob("--login password --homeserver https://hs2.test:8448 --user-login @${bobName}:hs2.test --password ${bobPassword} --device commander --room-default '#welcome:hs1.test'")
+
+    with subtest("Create/Invite/Join"):
+        run_as_alice("--room-create '#welcome:hs1.test'")
+
+        run_as_alice("--room-invite '#welcome:hs1.test' -u @${bobName}:hs2.test")
+        run_as_bob("--listen once --room-invites 'list+join'")
+
+    with subtest("Send/receive messages"):
+        senders = {
+            "alice": ("hs1", run_as_alice),
+            "bob": ("hs2", run_as_bob),
+        }
+
+        for name, (hs, fn) in senders.items():
+            fn(f"-m 'hello, I am {name}'")
+            for _, run in senders.values():
+                msg_data = json.loads(run("--listen once --listen-self --output json"))
+                pprint(msg_data)
+                t.assertEqual(msg_data["source"]["content"]["body"], f"hello, I am {name}")
+                t.assertEqual(msg_data["source"]["sender"], f"@{name}:{hs}.test")
+  '';
 }

nixos/tests/nfs/kerberos.nix

@@ -83,9 +83,16 @@ import ../make-test-python.nix (
 
           services.nfs.server.enable = true;
           services.nfs.server.createMountPoints = true;
-          services.nfs.server.exports = ''
-            /data *(rw,no_root_squash,fsid=0,sec=krb5p)
-          '';
+          services.nfs.server.exports = {
+            "/data" = {
+              "*" = [
+                "rw"
+                "no_root_squash"
+                "fsid=0"
+                "sec=krb5p"
+              ];
+            };
+          };
         };
     };
 

nixos/tests/nfs/simple.nix

@@ -37,9 +37,16 @@ import ../make-test-python.nix (
         { ... }:
         {
           services.nfs.server.enable = true;
-          services.nfs.server.exports = ''
-            /data 192.168.1.0/255.255.255.0(rw,no_root_squash,no_subtree_check,fsid=0)
-          '';
+          services.nfs.server.exports = {
+            "/data" = {
+              "192.168.1.0/255.255.255.0" = [
+                "rw"
+                "no_root_squash"
+                "no_subtree_check"
+                "fsid=0"
+              ];
+            };
+          };
           services.nfs.server.createMountPoints = true;
           networking.firewall.enable = false; # FIXME: figure out what ports need to be allowed
         };

nixos/tests/php/fpm.nix

@@ -44,6 +44,13 @@
           "pm.min_spare_servers" = 1;
           "pm.start_servers" = 2;
         };
+        phpEnv = {
+          # check that keywords and special characters are escaped properly
+          keyword = "false";
+          characters = "^ = \\";
+          quoted = "\"'";
+          newline = "hello\nworld";
+        };
       };
     };
   testScript =
@@ -56,6 +63,15 @@
       response = machine.wait_until_succeeds("curl -fvvv -s http://127.0.0.1:80/")
       t.assertIn("PHP Version ${php.version}", response, "PHP version not detected")
 
+      expected_env = {
+        "keyword": "false",
+        "characters": "^ = \\",
+        "quoted": ""'",
+        "newline": "hello\nworld",
+      }
+      for env, value in expected_env.items():
+        assert f'<tr><td class="e">{env} </td><td class="v">{value} </td></tr>' in response, f"phpEnv.{env} not detected"
+
       # Check so we have database and some other extensions loaded
       for ext in ["json", "opcache", "pdo_mysql", "pdo_pgsql", "pdo_sqlite", "apcu"]:
           assert ext in response, f"Missing {ext} extension"

pkgs/applications/editors/vscode/extensions/default.nix

@@ -1950,8 +1950,8 @@ let
         mktplcRef = {
           publisher = "github";
           name = "codespaces";
-          version = "1.18.14";
-          hash = "sha256-i/J5inu6iJ3CPgoBf+pMFuM33Ex/0KqhfzfRl/BIe7Y=";
+          version = "1.18.15";
+          hash = "sha256-NcW2XVQ6F7s6k4mIesEXhCkVVRfudwFr3glqB+TjrqM=";
         };
 
         meta = {

pkgs/applications/emulators/libretro/cores/flycast.nix

@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
   core = "flycast";
-  version = "0-unstable-2026-06-26";
+  version = "0-unstable-2026-07-10";
 
   src = fetchFromGitHub {
     owner = "flyinghead";
     repo = "flycast";
-    rev = "7ec978e8521f75427ad38eb8f8f4f3cabaa891d0";
-    hash = "sha256-3ChQnJP6xI/Wd3BOlkauTYCNQz1MjSHk0lDmjX+Iugg=";
+    rev = "f09d1f22ef8d199b8b7a2395d0b46774e08a58c2";
+    hash = "sha256-labl5MPpBNkg/M95WzJgiKVdvHJDN6jeFSLsHg5+G78=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/an/angle/package.nix

@@ -27,6 +27,7 @@ let
   triplet = lib.getAttr arch {
     "x86_64" = "x86_64-unknown-linux-gnu";
     "aarch64" = "aarch64-unknown-linux-gnu";
+    "riscv64" = "riscv64-unknown-linux-gnu";
   };
 
   clang = symlinkJoin {
@@ -100,6 +101,10 @@ stdenv.mkDerivation (finalAttrs: {
     # On darwin during linking:
     # clang++: error: argument unused during compilation: '-stdlib=libc++'
     "treat_warnings_as_errors=false"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isRiscV64 [
+    # Force clang on riscv64 because default gcc toolchain is unavailable.
+    "is_clang=true"
   ];
 
   env.NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-headerpad_max_install_names";

pkgs/by-name/ar/archon-lite/package.nix

@@ -6,10 +6,10 @@
 }:
 let
   pname = "archon-lite";
-  version = "9.3.85";
+  version = "9.3.172";
   src = fetchurl {
     url = "https://github.com/RPGLogs/Uploaders-archon-lite/releases/download/v${version}/archon-lite-v${version}.AppImage";
-    hash = "sha256-ooNvgbtV6HKgzRLgHZul92NLnEB8oX6fHL6iwfHajVA=";
+    hash = "sha256-Jl1/40jtdG9acb2SSef4G91hs/b1UdOp6gPnoGPnQ60=";
   };
 
   extracted = appimageTools.extractType2 { inherit pname version src; };

pkgs/by-name/ca/catppuccin-gtk/package.nix

@@ -75,7 +75,10 @@ lib.checkListOfEnum "${pname}: theme accent" validAccents accents lib.checkListO
       hash = "sha256-q5/VcFsm3vNEw55zq/vcM11eo456SYE5TQA3g2VQjGc=";
     };
 
-    patches = [ ./fix-inconsistent-theme-name.patch ];
+    patches = [
+      ./fix-inconsistent-theme-name.patch
+      ./python-3.14.patch # Fix build with python 3.14+
+    ];
 
     nativeBuildInputs = [
       gtk3

pkgs/by-name/ca/catppuccin-gtk/python-3.14.patch

@@ -0,0 +1,20 @@
+diff --git a/sources/build/args.py b/sources/build/args.py
+index 38a0a12..9221dec 100644
+--- a/sources/build/args.py
++++ b/sources/build/args.py
+@@ -84,7 +84,6 @@ def parse_args():
+     parser.add_argument(
+         "--zip",
+         help="Whether to bundle the theme into a zip",
+-        type=bool,
+         default=False,
+         action=argparse.BooleanOptionalAction,
+     )
+@@ -92,7 +91,6 @@ def parse_args():
+     parser.add_argument(
+         "--patch",
+         help="Whether to patch the colloid submodule",
+-        type=bool,
+         default=True,
+         action=argparse.BooleanOptionalAction,
+     )

pkgs/by-name/cl/cliamp/package.nix

@@ -41,6 +41,11 @@ buildGoModule (finalAttrs: {
     alsa-lib
   ];
 
+  # macOS limits Unix socket paths to 104 bytes; use a shorter TMPDIR.
+  preCheck = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    export TMPDIR="$(mktemp -d /tmp/cliamp-XXXXXX)"
+  '';
+
   postInstall = ''
     wrapProgram $out/bin/cliamp \
       --prefix PATH : ${
@@ -60,6 +65,7 @@ buildGoModule (finalAttrs: {
     description = "Terminal Winamp - a retro terminal music player inspired by Winamp 2.x";
     homepage = "https://github.com/bjarneo/cliamp";
     license = lib.licenses.mit;
+    platforms = with lib.platforms; darwin ++ linux;
     maintainers = with lib.maintainers; [ supermarin ];
     mainProgram = "cliamp";
   };

pkgs/by-name/en/enzyme/package.nix

@@ -7,13 +7,13 @@
 }:
 llvmPackages.stdenv.mkDerivation rec {
   pname = "enzyme";
-  version = "0.0.277";
+  version = "0.0.280";
 
   src = fetchFromGitHub {
     owner = "EnzymeAD";
     repo = "Enzyme";
     rev = "v${version}";
-    hash = "sha256-GAICiChPRRFBsZsQtCpPBzNvjWpx5YSAlwYL0/fEe5A=";
+    hash = "sha256-EVs7gBEDFINdbob51AlUsgH21sR/V/5/Cc+ADnOwDgM=";
   };
 
   postPatch = ''

pkgs/by-name/ez/eza/package.nix

@@ -16,7 +16,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "eza";
-  version = "0.23.4";
+  version = "0.23.5";
 
   __structuredAttrs = true;
 
@@ -24,10 +24,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "eza-community";
     repo = "eza";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zLb2VPfmv9J9UdPAXS+QPHI+hvDRl5UBcvW84J6nUK8=";
+    hash = "sha256-4XgPePl90mnQxmTUJfOvIsCcTRSYNBuRUNOb/3kmO1k=";
   };
 
-  cargoHash = "sha256-3KLjlEZhGEyOcaiBnfIafR509oRbsWllqf1e6Z0M8Sg=";
+  cargoHash = "sha256-IRG+mVgU8ZZ8PsxZWqmf3ZjW8fGL0RD0CwIrjsL366I=";
 
   nativeBuildInputs = [
     cmake

pkgs/by-name/fe/feishin/package.nix

@@ -14,6 +14,7 @@
   copyDesktopItems,
   makeDesktopItem,
   nix-update-script,
+  webVersion ? false,
 }:
 let
   pname = "feishin";
@@ -33,7 +34,10 @@ buildNpmPackage {
 
   inherit src;
 
+  __structuredAttrs = true;
+
   npmConfigHook = pnpmConfigHook;
+  npmBuildScript = if webVersion then "build:web" else "build";
 
   npmDeps = null;
   pnpmDeps = fetchPnpmDeps {
@@ -52,8 +56,8 @@ buildNpmPackage {
   nativeBuildInputs = [
     pnpm_10
   ]
-  ++ lib.optionals (stdenv.hostPlatform.isLinux) [ copyDesktopItems ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+  ++ lib.optionals (stdenv.hostPlatform.isLinux && !webVersion) [ copyDesktopItems ]
+  ++ lib.optionals (stdenv.hostPlatform.isDarwin && !webVersion) [
     darwin.autoSignDarwinBinariesHook
     actool
   ];
@@ -73,7 +77,7 @@ buildNpmPackage {
     ln -s ${dart-sass}/bin/dart-sass "$dir"/sass
   '';
 
-  postBuild = ''
+  postBuild = lib.optionalString (!webVersion) ''
     cp -r ${electron.dist} electron-dist
     chmod -R u+w electron-dist
 
@@ -88,14 +92,18 @@ buildNpmPackage {
   installPhase = ''
     runHook preInstall
   ''
-  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+  + lib.optionalString webVersion ''
+    mkdir -p $out
+    cp -r out/web/* $out
+  ''
+  + lib.optionalString (stdenv.hostPlatform.isDarwin && !webVersion) ''
     mkdir -p $out/{Applications,bin}
     cp -r dist/**/Feishin.app $out/Applications/
     makeWrapper $out/Applications/Feishin.app/Contents/MacOS/Feishin $out/bin/feishin \
       --prefix PATH : "${lib.makeBinPath [ mpv-unwrapped ]}" \
       --set DISABLE_AUTO_UPDATES 1
   ''
-  + lib.optionalString stdenv.hostPlatform.isLinux ''
+  + lib.optionalString (stdenv.hostPlatform.isLinux && !webVersion) ''
     mkdir -p $out/share/feishin
 
     pushd dist/*-unpacked/
@@ -126,7 +134,7 @@ buildNpmPackage {
     runHook postInstall
   '';
 
-  desktopItems = [
+  desktopItems = lib.optionals (!webVersion) [
     (makeDesktopItem {
       name = "feishin";
       desktopName = "Feishin";
@@ -152,11 +160,11 @@ buildNpmPackage {
     sourceProvenance = with lib.sourceTypes; [ fromSource ];
     license = lib.licenses.gpl3Plus;
     platforms = lib.platforms.unix;
-    mainProgram = "feishin";
     maintainers = with lib.maintainers; [
       BatteredBunny
       onny
       jlbribeiro
     ];
-  };
+  }
+  // lib.optionalAttrs (!webVersion) { mainProgram = "feishin"; };
 }

pkgs/by-name/fi/firezone-gui-client/package.nix

@@ -19,7 +19,7 @@
   libayatana-appindicator,
   webkitgtk_4_1,
   wrapGAppsHook3,
-  pnpm_9,
+  pnpm_10,
   fetchPnpmDeps,
   pnpmConfigHook,
   nodejs,
@@ -27,12 +27,12 @@
   copyDesktopItems,
 }:
 let
-  version = "1.5.1";
+  version = "1.5.2";
   src = fetchFromGitHub {
     owner = "firezone";
     repo = "firezone";
     tag = "gui-client-${version}";
-    hash = "sha256-KozSy44Opx6cukA0QTXeMpI3fP49iyabFzPLIJckOZ4=";
+    hash = "sha256-Ew6oLVL7u9RtidHNsz29lzH9WPxKNneEoVACuLdP7yo=";
   };
 
   frontend = stdenvNoCC.mkDerivation rec {
@@ -41,10 +41,10 @@ let
 
     pnpmDeps = fetchPnpmDeps {
       inherit pname version;
-      pnpm = pnpm_9;
+      pnpm = pnpm_10;
       src = "${src}/rust/gui-client";
-      fetcherVersion = 3;
-      hash = "sha256-akanXiWehhQRx6WHN75PjYvFxFiSsJ5dJaguJBTM9J0=";
+      fetcherVersion = 4;
+      hash = "sha256-770+06rpf/P9hOFLgEWc0/BKjIxHyCWB2E3tqdEskAA=";
     };
     pnpmRoot = "rust/gui-client";
 
@@ -52,7 +52,7 @@ let
 
     nativeBuildInputs = [
       pnpmConfigHook
-      pnpm_9
+      pnpm_10
       nodejs
     ];
 
@@ -79,7 +79,7 @@ rustPlatform.buildRustPackage rec {
   pname = "firezone-gui-client";
   inherit version src;
 
-  cargoHash = "sha256-TDP1Z4MeQaSER8MGnCEQfIhRsakaSCeJ7boUMBYkkI0=";
+  cargoHash = "sha256-LHHaklGIMuDuZwikXiQzLPbmkUbPyYR04UBQTBxq2ps=";
   sourceRoot = "${src.name}/rust";
   buildAndTestSubdir = "gui-client";
   env.RUSTFLAGS = "--cfg system_certs";

pkgs/by-name/ft/ft2-clone/package.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ft2-clone";
-  version = "2.20";
+  version = "2.21";
 
   src = fetchFromGitHub {
     owner = "8bitbubsy";
     repo = "ft2-clone";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-e0oIn/g5bWYMFhvd54reacGI8/s7pMfujnEPzYnUbF4=";
+    hash = "sha256-H8vU4ipNKVS7hB26o57incA7I8k8byuwqQXplel2mOE=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/gi/git-lfs/package.nix

@@ -21,7 +21,8 @@ buildGoModule (finalAttrs: {
     hash = "sha256-N5ckTnyA3mueZre+rMhFZBiAFgEu4pmtzkiUidXnan8=";
   };
 
-  vendorHash = "sha256-6H0KpLin+DqwEg5bdzaxj2CoNSneZ/ET43MTrrdF3h8=";
+  proxyVendor = true;
+  vendorHash = "sha256-SUnZ9uN43CAw/iHC8cPBm3nYD03d3Pg2pYS2PwjDCnE=";
 
   nativeBuildInputs = [
     asciidoctor
@@ -37,7 +38,7 @@ buildGoModule (finalAttrs: {
   subPackages = [ "." ];
 
   preBuild = ''
-    GOARCH= go generate ./commands
+    CC= GOOS= GOARCH= go generate ./commands
   '';
 
   postBuild = ''

pkgs/by-name/in/innernet/package.nix

@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "innernet";
-  version = "1.7.1";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "tonarino";
     repo = "innernet";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wGxTdoWMHVUldW+bjli+5zqo3PRU/8tn7fxAeVrynjs=";
+    hash = "sha256-7pvQFxXf1MCmnNNQIGGkI2jhL9jC/ZLZqwiJPSFC1b8=";
   };
 
-  cargoHash = "sha256-vDPs+EEl/ZbKxOrNHc86N7+5ij+4YmsZRo5/Sxja6ms=";
+  cargoHash = "sha256-CaE2VH5CuOuEATcYrt7p7yQFQ5s0tZZomvy9VltRpRI=";
 
   nativeBuildInputs = [
     rustPlatform.bindgenHook

pkgs/by-name/ip/ipxe/package.nix

@@ -2,6 +2,7 @@
   stdenv,
   lib,
   fetchFromGitHub,
+  fetchpatch,
   nix-update-script,
   buildPackages,
   mtools,
@@ -105,6 +106,31 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-O7jUpnP+wa9zBIEqYa7FQ9Zo1Ii1oVH10nlk+c4iHwg=";
   };
 
+  patches = [
+    # GCC 16 gains stronger analysis for unused variables and emits a warning
+    # (made fatal by -Werror), so the usage of this variable is made
+    # unconditional.
+    (fetchpatch {
+      name = "w89c840-unused-variable.patch";
+      url = "https://github.com/ipxe/ipxe/commit/2d28657ef63217b9a1774605267d84f89d751441.patch";
+      hash = "sha256-p1r1iDOJbss458LlmfpuIkk+6VqthDl0mcK/EfcCqS4=";
+    })
+
+    # GCC 16 adds a warning (made fatal by -Werror) for attributes that do not
+    # apply. Since the regparm attribute only applies for i386, it is dropped
+    # for x86_64.
+    (fetchpatch {
+      name = "x86_64-drop-regparm-attribute.patch";
+      url = "https://github.com/ipxe/ipxe/commit/c18d0a23b634ae001ea877020c0236bfca1468e5.patch";
+      hash = "sha256-spEIdyw30zYiYmhnvYQEVUrr/uMnFqJO/yLWnPb+QMc=";
+    })
+    (fetchpatch {
+      name = "librm-regparm-attribute-only-for-i386.patch";
+      url = "https://github.com/ipxe/ipxe/commit/be35d67a029485f461ce83cbeda15056a52cb069.patch";
+      hash = "sha256-ki6gUPC6njGvu27RsD3f1L0m82NOKj9es0/o0jXCpqk=";
+    })
+  ];
+
   enableParallelBuilding = true;
   strictDeps = true;
 

pkgs/by-name/li/libuv/package.nix

@@ -129,6 +129,10 @@ stdenv.mkDerivation (finalAttrs: {
         # https://github.com/libuv/libuv/issues/1871
         "shutdown_close_pipe"
       ]
+      ++ lib.optionals stdenv.hostPlatform.isRiscV64 [
+        # Aborts (SIGABRT, exit 134)
+        "poll_nested_epoll"
+      ]
       ++ lib.optionals stdenv.hostPlatform.isFreeBSD [
         # ENETUNREACH when performed in jailed build env
         "tcp_connect"

pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix

@@ -157,7 +157,7 @@ python3Packages.buildPythonApplication rec {
   '';
 
   passthru = {
-    tests = { inherit (nixosTests) matrix-synapse matrix-synapse-workers; };
+    tests = { inherit (nixosTests) matrix-synapse; };
     plugins = python3Packages.callPackage ./plugins { };
     inherit (python3Packages) python;
     updateScript = nix-update-script { };

pkgs/by-name/mu/music-assistant-desktop/package.nix

@@ -8,6 +8,8 @@
 
   # nativeBuildInputs
   cargo-tauri,
+  jq,
+  moreutils,
   nodejs,
   pkg-config,
   yarnBuildHook,
@@ -30,13 +32,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "music-assistant-desktop";
-  version = "0.5.0";
+  version = "0.5.7";
 
   src = fetchFromGitHub {
     owner = "music-assistant";
     repo = "desktop-app";
     tag = finalAttrs.version;
-    hash = "sha256-UfHodoDGsBQUcTaQ5x04jf0nG4jX47TzXXPJzAwYbEQ=";
+    hash = "sha256-KKyIYSSIC134t46H7YOFNCdj4M/VoBrX9jN5aX/kSlc=";
   };
 
   patches = [
@@ -47,12 +49,16 @@ rustPlatform.buildRustPackage (finalAttrs: {
     # set version
     substituteInPlace package.json src-tauri/tauri.conf.json \
       --replace-fail "0.0.0" "${finalAttrs.version}"
+
+    # disable upstream updater
+    jq '.plugins.updater.endpoints = [ ] | .bundle.createUpdaterArtifacts = false' src-tauri/tauri.conf.json \
+      | sponge src-tauri/tauri.conf.json
   '';
 
   cargoRoot = "src-tauri";
   buildAndTestSubdir = finalAttrs.cargoRoot;
 
-  cargoHash = "sha256-xc1eT9TKAqREC2fMi4eFR9Ag1c8Ksq4mGoRnO9WZggI=";
+  cargoHash = "sha256-AFn2m8eO+U86s6g2LlzBuAsJBesrm3Gncihf+zbPDeE=";
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/yarn.lock";
@@ -61,6 +67,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   nativeBuildInputs = [
     cargo-tauri.hook
+    jq
+    moreutils
     nodejs
     pkg-config
     yarnBuildHook

pkgs/by-name/nd/ndstrim-rs/package.nix

@@ -5,12 +5,14 @@
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
-  pname = "ndstrim";
+  pname = "ndstrim-rs";
   version = "0.2.1";
 
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "Nemris";
-    repo = "ndstrim";
+    repo = "ndstrim-rs";
     rev = "v${finalAttrs.version}";
     hash = "sha256-KgtejBbFg6+klc8OpCs1CIb+7uVPCtP0/EM671vxauk=";
   };
@@ -19,8 +21,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   meta = {
     description = "Trim the excess padding found in Nintendo DS(i) ROMs";
-    homepage = "https://github.com/Nemris/ndstrim";
-    changelog = "https://github.com/Nemris/ndstrim/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    homepage = "https://github.com/Nemris/ndstrim-rs";
+    changelog = "https://github.com/Nemris/ndstrim-rs/blob/${finalAttrs.src.rev}/CHANGELOG.md";
     license = lib.licenses.mit;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ thiagokokada ];

pkgs/by-name/ok/oklch-color-picker/package.nix

@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "oklch-color-picker";
-  version = "2.3.3";
+  version = "2.3.4";
 
   src = fetchFromGitHub {
     owner = "eero-lehtinen";
     repo = "oklch-color-picker";
     tag = finalAttrs.version;
-    hash = "sha256-IwG3oUYArr6cHSa3fNukQ7CjasUMaVWX9JXChSHTnEs=";
+    hash = "sha256-AdLpP01VeeAAOBEeX/dxLPdAqTfgH9X+NDCmFgqA3hs=";
   };
 
-  cargoHash = "sha256-Vs6bMHHHRdqSYjOzJuq2agmuXSjGRagIATVzQa3Z/M8=";
+  cargoHash = "sha256-FB8zvWhO+ZbzWjkQCnf3ghgM+IL4px7QNO4dLPcczec=";
 
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ autoPatchelfHook ];
 

pkgs/by-name/op/openlinkhub/package.nix

@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "openlinkhub";
-  version = "0.8.8";
+  version = "0.8.9";
 
   src = fetchFromGitHub {
     owner = "jurkovic-nikola";
     repo = "OpenLinkHub";
     tag = finalAttrs.version;
-    hash = "sha256-uYuhmvdHNVs19egakwDOvIJ2IEAeZEAV6qgMYEl+Ie4=";
+    hash = "sha256-g8ZdiBaEelS+LhnOA23mMR+irN1wKD6Rp66sCnSD2tU=";
   };
 
   proxyVendor = true;

pkgs/by-name/op/openmw/package.nix

@@ -3,6 +3,7 @@
   stdenv,
   fetchFromGitLab,
   fetchpatch,
+  nix-update-script,
 
   SDL2,
   boost,
@@ -35,7 +36,7 @@ assert lib.assertOneOf "GLPreference" GLPreference [
 ];
 stdenv.mkDerivation (finalAttrs: {
   pname = "openmw";
-  version = "0.50.0";
+  version = "0.51.0";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -82,7 +83,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "OpenMW";
     repo = "openmw";
     tag = "openmw-${finalAttrs.version}";
-    hash = "sha256-mPwNyKKqPSZJtcIyx3IhLe3iHOpx6p4+l1wJZqyDMqg=";
+    hash = "sha256-D+2nEQRkAjmDvRoas9bYPmdygQYT3MAv46n73OonE0o=";
   };
 
   postPatch = ''
@@ -133,6 +134,15 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "OPENMW_OSX_DEPLOYMENT" isDarwin)
   ];
 
+  env.LANG = "C.UTF-8";
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "openmw-(.*)"
+    ];
+  };
+
   meta = {
     description = "Unofficial open source engine reimplementation of the game Morrowind";
     changelog = "https://gitlab.com/OpenMW/openmw/-/blob/${finalAttrs.src.tag}/CHANGELOG.md";

pkgs/by-name/pa/parla/package.nix

@@ -16,7 +16,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "parla";
-  version = "0.6.0";
+  version = "0.6.4";
   __structuredAttrs = true;
   strictDeps = true;
 
@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "trufae";
     repo = "parla";
     tag = finalAttrs.version;
-    hash = "sha256-UnLZQ71M1yMpoYNbMdoRq+dmMFr2A/pk7GjMXtSChkY=";
+    hash = "sha256-tlqrUxzQS+u4DlSIKAp9oR69KRW2gTgwBoroUJzvsaY=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/pi/pimsync/package.nix

@@ -7,22 +7,23 @@
   installShellFiles,
   makeWrapper,
   xandikos,
+  cacert,
   versionCheckHook,
   nix-update-script,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "pimsync";
-  version = "0.5.9";
+  version = "0.5.10";
 
   src = fetchFromSourcehut {
     owner = "~whynothugo";
     repo = "pimsync";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-bNE0YY7bws8lEGoVg/sXuepBU1/oJPWBdn1wBGzF8s8=";
+    hash = "sha256-YqLOkv0I+1HOlWNA8HoKB6/3ccYbV8u/0BJ/+4xvde4=";
   };
 
-  cargoHash = "sha256-w3o3qxe/EADeH6LDwBxm0kvdYuwEcuj8GcoVPtBqylA=";
+  cargoHash = "sha256-9sEYeKZDMsbEUQc5V8xJzcKIzF6ugGsk3d5bTOCtYnw=";
 
   env.PIMSYNC_VERSION = finalAttrs.version;
 
@@ -38,6 +39,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   nativeCheckInputs = [
     xandikos
+    cacert
   ];
 
   postInstall = ''
@@ -61,7 +63,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     }";
     license = lib.licenses.eupl12;
     platforms = lib.platforms.unix;
-    maintainers = [ lib.maintainers.qxrein ];
+    maintainers = [
+      lib.maintainers.qxrein
+      lib.maintainers.antonmosich
+    ];
     mainProgram = "pimsync";
   };
 })

pkgs/by-name/pr/protols/package.nix

@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "protols";
-  version = "0.14.0";
+  version = "0.14.1";
 
   src = fetchFromGitHub {
     owner = "coder3101";
     repo = "protols";
     tag = finalAttrs.version;
-    hash = "sha256-VB7Zs1Zo+hn+M4vhBmOZNod3Q9dbwcMNwRvTIIP+Gk4=";
+    hash = "sha256-DdSuEWIo0AbCCV3LPTBC2Ql1NSg2vgnCBNzOgFL8/B0=";
   };
 
-  cargoHash = "sha256-qfNWZmJYVKDKZ8/JIXtSWYnq4pZXmU7rXQDV117j/a0=";
+  cargoHash = "sha256-R7OgjUEx2Q0rWTIO1CIXS3ogeC9G/RoxvGQBL1Xh/8k=";
 
   env.FALLBACK_INCLUDE_PATH = "${protobuf}/include";
 

pkgs/by-name/pr/proton-vpn/darwin.nix

@@ -4,15 +4,19 @@
   stdenvNoCC,
   _7zz,
   fetchurl,
-  nix-update-script,
+  writeShellScript,
+  coreutils,
+  curl,
+  xmlstarlet,
+  common-updater-scripts,
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "proton-vpn";
-  version = "6.5.0";
+  version = "6.5.1";
 
   src = fetchurl {
-    url = "https://github.com/ProtonVPN/ios-mac-app/releases/download/mac%2F${finalAttrs.version}/ProtonVPN_mac_v${finalAttrs.version}.dmg";
-    hash = "sha256-lB44pIA5AxdcYQ/iccWcqJDOrQkVLRVl0vy1HuPPl8o=";
+    url = "https://protonvpn.com/download/macos/${finalAttrs.version}/ProtonVPN_mac_v${finalAttrs.version}.dmg";
+    hash = "sha256-1QpJ8UxQsO+K1oqJ/JaF1WmbotT5LLTDQxcpG0JUNfg=";
   };
 
   __structuredAttrs = true;
@@ -31,15 +35,25 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
-  passthru.updateScript = nix-update-script {
-    extraArgs = [
-      "--version-regex"
-      "mac/(.*)"
-    ];
-  };
+  passthru.updateScript = writeShellScript "proton-vpn-update-script" ''
+    set -euo pipefail
+    export PATH="${
+      lib.makeBinPath [
+        curl
+        xmlstarlet
+        common-updater-scripts
+        coreutils
+      ]
+    }"
+
+    xml=$(curl -s "https://protonvpn.com/download/macos/updates/v5/sparkle.xml")
+
+    version=$(echo "$xml" | xmlstarlet sel -t -v '//enclosure/@sparkle:shortVersionString' | head -1)
+
+    update-source-version proton-vpn "$version" --file=./pkgs/by-name/pr/proton-vpn/darwin.nix
+  '';
 
   meta = meta // {
-    changelog = "https://github.com/ProtonVPN/ios-mac-app/releases/tag/mac%2F${finalAttrs.version}";
     platforms = [
       "x86_64-darwin"
       "aarch64-darwin"

pkgs/by-name/re/redmine/Gemfile

@@ -1,34 +1,35 @@
 source 'https://rubygems.org'
 
-ruby '>= 3.2.0', '< 3.5.0'
+ruby '>= 3.2.0', '< 4.1.0'
 
-gem 'rails', '7.2.3.1'
-gem 'rouge', '~> 4.5'
+gem 'rails', '8.1.3'
+gem 'rouge', '~> 5.0'
 gem 'mini_mime', '~> 1.1.0'
 gem "actionpack-xml_parser"
-gem 'roadie-rails', '~> 3.3.0'
+gem 'roadie-rails', '~> 3.4.0'
 gem 'marcel'
-gem 'mail', '~> 2.8.1'
+gem 'mail', '~> 2.9.0'
 gem 'nokogiri', '~> 1.19.1'
-gem 'i18n', '~> 1.14.1'
+gem 'i18n', '~> 1.15.2'
 gem 'rbpdf', '~> 1.21.4'
 gem 'addressable'
-gem 'rubyzip', '~> 2.4.0'
-gem 'propshaft', '~> 1.1.0'
+gem 'rubyzip', '~> 3.4.0'
+gem 'propshaft', '~> 1.3.0'
 gem 'rack', '>= 3.1.3'
 gem "stimulus-rails", "~> 1.3"
 gem "importmap-rails", "~> 2.0"
-gem 'commonmarker', '~> 2.3.0'
+gem 'commonmarker', '~> 2.8.2'
 gem "doorkeeper", "~> 5.8.2"
 gem "bcrypt", require: false
 gem "doorkeeper-i18n", "~> 5.2"
 gem "requestjs-rails", "~> 0.0.13"
 
 #  Ruby Standard Gems
-gem 'csv', '~> 3.3.2'
-gem 'net-imap', '~> 0.5.7'
+gem 'csv', '~> 3.3.5'
+gem 'net-imap', '~> 0.6.1'
 gem 'net-pop', '~> 0.1.2'
-gem 'net-smtp', '~> 0.5.0'
+gem 'net-smtp', '~> 0.5.1'
+gem 'ostruct'
 
 # Windows does not include zoneinfo files, so bundle the tzinfo-data gem
 gem 'tzinfo-data', platforms: [:mingw, :x64_mingw, :mswin]
@@ -37,13 +38,12 @@ gem 'tzinfo-data', platforms: [:mingw, :x64_mingw, :mswin]
 gem 'rotp', '>= 5.0.0'
 gem 'rqrcode'
 
-# HTML pipeline and sanitization
-gem "html-pipeline", "~> 2.13.2"
-gem "sanitize", "~> 6.0"
+# HTML sanitization
+gem "sanitize", "~> 7.0"
 
 # Optional gem for LDAP authentication
 group :ldap do
-  gem 'net-ldap', '~> 0.17.0'
+  gem 'net-ldap', '~> 0.20.0'
 end
 
 # Optional gem for exporting the gantt to a PNG file
@@ -54,10 +54,10 @@ end
 # Include database gems for the database adapters NixOS supports
 gem 'mysql2', '~> 0.5.0'
 gem "with_advisory_lock"
-gem 'trilogy', '~> 2.9.0'
+gem 'trilogy', '~> 2.12.4'
 gem "with_advisory_lock"
-gem 'pg', '~> 1.5.3'
-gem 'sqlite3', '~> 2.5.0'
+gem 'pg', '~> 1.6.2'
+gem 'sqlite3', '~> 2.9.4'
 
 group :development, :test do
   gem 'debug'
@@ -80,15 +80,13 @@ group :test do
   gem "capybara", ">= 3.39"
   gem 'selenium-webdriver', '>= 4.11.0'
   # RuboCop
-  gem 'rubocop', '~> 1.76.0', require: false
-  gem 'rubocop-performance', '~> 1.25.0', require: false
-  gem 'rubocop-rails', '~> 2.32.0', require: false
+  gem 'rubocop', '~> 1.88.0', require: false
+  gem 'rubocop-performance', '~> 1.26.0', require: false
+  gem 'rubocop-rails', '~> 2.34.3', require: false
   gem 'bundle-audit', require: false
   # for testing oauth provider capabilities
   gem 'oauth2'
-  gem 'rest-client'
-  # Lock minitest to 5.x until a Rails release includes support for minitest 6.0
-  gem 'minitest', '~> 5.27'
+  gem 'webrick'
 end
 
 gem "webrick"

pkgs/by-name/re/redmine/Gemfile.lock

@@ -1,33 +1,33 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    actioncable (7.2.3.1)
-      actionpack (= 7.2.3.1)
-      activesupport (= 7.2.3.1)
+    action_text-trix (2.1.19)
+      railties
+    actioncable (8.1.3)
+      actionpack (= 8.1.3)
+      activesupport (= 8.1.3)
       nio4r (~> 2.0)
       websocket-driver (>= 0.6.1)
       zeitwerk (~> 2.6)
-    actionmailbox (7.2.3.1)
-      actionpack (= 7.2.3.1)
-      activejob (= 7.2.3.1)
-      activerecord (= 7.2.3.1)
-      activestorage (= 7.2.3.1)
-      activesupport (= 7.2.3.1)
+    actionmailbox (8.1.3)
+      actionpack (= 8.1.3)
+      activejob (= 8.1.3)
+      activerecord (= 8.1.3)
+      activestorage (= 8.1.3)
+      activesupport (= 8.1.3)
       mail (>= 2.8.0)
-    actionmailer (7.2.3.1)
-      actionpack (= 7.2.3.1)
-      actionview (= 7.2.3.1)
-      activejob (= 7.2.3.1)
-      activesupport (= 7.2.3.1)
+    actionmailer (8.1.3)
+      actionpack (= 8.1.3)
+      actionview (= 8.1.3)
+      activejob (= 8.1.3)
+      activesupport (= 8.1.3)
       mail (>= 2.8.0)
       rails-dom-testing (~> 2.2)
-    actionpack (7.2.3.1)
-      actionview (= 7.2.3.1)
-      activesupport (= 7.2.3.1)
-      cgi
+    actionpack (8.1.3)
+      actionview (= 8.1.3)
+      activesupport (= 8.1.3)
       nokogiri (>= 1.8.5)
-      racc
-      rack (>= 2.2.4, < 3.3)
+      rack (>= 2.2.4)
       rack-session (>= 1.0.1)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.2)
@@ -36,51 +36,54 @@ GEM
     actionpack-xml_parser (2.0.1)
       actionpack (>= 5.0)
       railties (>= 5.0)
-    actiontext (7.2.3.1)
-      actionpack (= 7.2.3.1)
-      activerecord (= 7.2.3.1)
-      activestorage (= 7.2.3.1)
-      activesupport (= 7.2.3.1)
+    actiontext (8.1.3)
+      action_text-trix (~> 2.1.15)
+      actionpack (= 8.1.3)
+      activerecord (= 8.1.3)
+      activestorage (= 8.1.3)
+      activesupport (= 8.1.3)
       globalid (>= 0.6.0)
       nokogiri (>= 1.8.5)
-    actionview (7.2.3.1)
-      activesupport (= 7.2.3.1)
+    actionview (8.1.3)
+      activesupport (= 8.1.3)
       builder (~> 3.1)
-      cgi
       erubi (~> 1.11)
       rails-dom-testing (~> 2.2)
       rails-html-sanitizer (~> 1.6)
-    activejob (7.2.3.1)
-      activesupport (= 7.2.3.1)
+    activejob (8.1.3)
+      activesupport (= 8.1.3)
       globalid (>= 0.3.6)
-    activemodel (7.2.3.1)
-      activesupport (= 7.2.3.1)
-    activerecord (7.2.3.1)
-      activemodel (= 7.2.3.1)
-      activesupport (= 7.2.3.1)
+    activemodel (8.1.3)
+      activesupport (= 8.1.3)
+    activerecord (8.1.3)
+      activemodel (= 8.1.3)
+      activesupport (= 8.1.3)
       timeout (>= 0.4.0)
-    activestorage (7.2.3.1)
-      actionpack (= 7.2.3.1)
-      activejob (= 7.2.3.1)
-      activerecord (= 7.2.3.1)
-      activesupport (= 7.2.3.1)
+    activestorage (8.1.3)
+      actionpack (= 8.1.3)
+      activejob (= 8.1.3)
+      activerecord (= 8.1.3)
+      activesupport (= 8.1.3)
       marcel (~> 1.0)
-    activesupport (7.2.3.1)
+    activesupport (8.1.3)
       base64
-      benchmark (>= 0.3)
       bigdecimal
       concurrent-ruby (~> 1.0, >= 1.3.1)
       connection_pool (>= 2.2.5)
       drb
       i18n (>= 1.6, < 2)
+      json
       logger (>= 1.4.2)
-      minitest (>= 5.1, < 6)
+      minitest (>= 5.1)
       securerandom (>= 0.3)
       tzinfo (~> 2.0, >= 2.0.5)
+      uri (>= 0.13.1)
     addressable (2.9.0)
       public_suffix (>= 2.0.2, < 8.0)
+    anonymous_loader (0.1.2)
+      version_gem (~> 1.1, >= 1.1.13)
     ast (2.4.3)
-    auth-sanitizer (0.2.1)
+    auth-sanitizer (0.2.2)
       version_gem (~> 1.1, >= 1.1.10)
     base64 (0.3.0)
     bcrypt (3.1.22)
@@ -104,13 +107,12 @@ GEM
       rack-test (>= 0.6.3)
       regexp_parser (>= 1.5, < 3.0)
       xpath (~> 3.2)
-    cgi (0.5.1)
     chunky_png (1.4.0)
-    commonmarker (2.3.2)
+    commonmarker (2.8.3)
       rb_sys (~> 0.9)
     concurrent-ruby (1.3.7)
     connection_pool (3.0.2)
-    crass (1.0.6)
+    crass (1.0.7)
     css_parser (2.2.0)
       addressable
     csv (3.3.5)
@@ -119,7 +121,6 @@ GEM
       irb (~> 1.10)
       reline (>= 0.3.8)
     docile (1.4.1)
-    domain_name (0.6.20240107)
     doorkeeper (5.8.2)
       railties (>= 5)
     doorkeeper-i18n (5.2.9)
@@ -134,18 +135,12 @@ GEM
     faraday-net_http (3.4.4)
       net-http (~> 0.5)
     ffi (1.17.4)
-    globalid (1.3.0)
+    globalid (1.4.0)
       activesupport (>= 6.1)
     hashie (5.1.0)
       logger
-    html-pipeline (2.13.2)
-      activesupport (>= 2)
-      nokogiri (>= 1.4)
     htmlentities (4.4.2)
-    http-accept (1.7.0)
-    http-cookie (1.1.6)
-      domain_name (~> 0.5)
-    i18n (1.14.8)
+    i18n (1.15.2)
       concurrent-ruby (~> 1.0)
     importmap-rails (2.2.3)
       actionpack (>= 6.0.0)
@@ -157,10 +152,10 @@ GEM
       prism (>= 1.3.0)
       rdoc (>= 4.0.0)
       reline (>= 0.4.2)
-    json (2.19.9)
+    json (2.20.0)
     jwt (3.2.0)
       base64
-    language_server-protocol (3.17.0.5)
+    language_server-protocol (3.17.0.6)
     lint_roller (1.1.0)
     listen (3.10.0)
       logger
@@ -170,23 +165,22 @@ GEM
     loofah (2.25.1)
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
-    mail (2.8.1)
+    mail (2.9.1)
+      logger
       mini_mime (>= 0.1.1)
       net-imap
       net-pop
       net-smtp
     marcel (1.2.1)
     matrix (0.4.3)
-    mime-types (3.7.0)
-      logger
-      mime-types-data (~> 3.2025, >= 3.2025.0507)
-    mime-types-data (3.2026.0414)
     mini_magick (5.2.0)
       benchmark
       logger
     mini_mime (1.1.5)
     mini_portile2 (2.8.9)
-    minitest (5.27.0)
+    minitest (6.0.6)
+      drb (~> 2.0)
+      prism (~> 1.5)
     mocha (3.1.0)
       ruby2_keywords (>= 0.0.5)
     multi_xml (0.9.1)
@@ -195,47 +189,46 @@ GEM
       bigdecimal
     net-http (0.9.1)
       uri (>= 0.11.1)
-    net-imap (0.5.15)
+    net-imap (0.6.4.1)
       date
       net-protocol
-    net-ldap (0.17.1)
+    net-ldap (0.20.0)
+      base64
+      ostruct
     net-pop (0.1.2)
       net-protocol
     net-protocol (0.2.2)
       timeout
     net-smtp (0.5.1)
       net-protocol
-    netrc (0.11.0)
     nio4r (2.7.5)
-    nokogiri (1.19.3)
+    nokogiri (1.19.4)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
-    oauth2 (2.0.23)
-      auth-sanitizer (~> 0.2, >= 0.2.1)
+    oauth2 (2.0.24)
+      anonymous_loader (~> 0.1, >= 0.1.1)
+      auth-sanitizer (~> 0.2, >= 0.2.2)
       faraday (>= 0.17.3, < 4.0)
       jwt (>= 1.0, < 4.0)
       logger (~> 1.2)
       multi_xml (~> 0.5)
       rack (>= 1.2, < 4)
       snaky_hash (~> 2.0, >= 2.0.6)
-      version_gem (~> 1.1, >= 1.1.11)
-    parallel (1.28.0)
+      version_gem (~> 1.1, >= 1.1.12)
+    ostruct (0.6.3)
+    parallel (2.1.0)
     parser (3.3.11.1)
       ast (~> 2.4.1)
       racc
-    pg (1.5.9)
-    pp (0.6.3)
+    pg (1.6.3)
+    pp (0.6.4)
       prettyprint
     prettyprint (0.2.0)
     prism (1.9.0)
-    propshaft (1.1.0)
+    propshaft (1.3.2)
       actionpack (>= 7.0.0)
       activesupport (>= 7.0.0)
       rack
-      railties (>= 7.0.0)
-    psych (5.4.0)
-      date
-      stringio
     public_suffix (7.0.5)
     puma (8.0.2)
       nio4r (~> 2.0)
@@ -248,20 +241,20 @@ GEM
       rack (>= 1.3)
     rackup (2.3.1)
       rack (>= 3)
-    rails (7.2.3.1)
-      actioncable (= 7.2.3.1)
-      actionmailbox (= 7.2.3.1)
-      actionmailer (= 7.2.3.1)
-      actionpack (= 7.2.3.1)
-      actiontext (= 7.2.3.1)
-      actionview (= 7.2.3.1)
-      activejob (= 7.2.3.1)
-      activemodel (= 7.2.3.1)
-      activerecord (= 7.2.3.1)
-      activestorage (= 7.2.3.1)
-      activesupport (= 7.2.3.1)
+    rails (8.1.3)
+      actioncable (= 8.1.3)
+      actionmailbox (= 8.1.3)
+      actionmailer (= 8.1.3)
+      actionpack (= 8.1.3)
+      actiontext (= 8.1.3)
+      actionview (= 8.1.3)
+      activejob (= 8.1.3)
+      activemodel (= 8.1.3)
+      activerecord (= 8.1.3)
+      activestorage (= 8.1.3)
+      activesupport (= 8.1.3)
       bundler (>= 1.15.0)
-      railties (= 7.2.3.1)
+      railties (= 8.1.3)
     rails-dom-testing (2.3.0)
       activesupport (>= 5.0.0)
       minitest
@@ -269,10 +262,9 @@ GEM
     rails-html-sanitizer (1.7.0)
       loofah (~> 2.25)
       nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
-    railties (7.2.3.1)
-      actionpack (= 7.2.3.1)
-      activesupport (= 7.2.3.1)
-      cgi
+    railties (8.1.3)
+      actionpack (= 8.1.3)
+      activesupport (= 8.1.3)
       irb (~> 1.13)
       rackup (>= 1.0.0)
       rake (>= 12.2)
@@ -291,52 +283,53 @@ GEM
       htmlentities
       rbpdf-font (~> 1.19.0)
     rbpdf-font (1.19.1)
-    rdoc (7.2.0)
+    rbs (4.0.3)
+      logger
+      prism (>= 1.6.0)
+      tsort
+    rdoc (8.0.0)
       erb
-      psych (>= 4.0.0)
+      prism (>= 1.6.0)
+      rbs (>= 4.0.0)
       tsort
     regexp_parser (2.12.0)
     reline (0.6.3)
       io-console (~> 0.5)
     requestjs-rails (0.0.14)
       railties (>= 7.1.0)
-    rest-client (2.1.0)
-      http-accept (>= 1.7.0, < 2.0)
-      http-cookie (>= 1.0.2, < 2.0)
-      mime-types (>= 1.16, < 4.0)
-      netrc (~> 0.8)
     rexml (3.4.4)
     roadie (5.3.0)
       css_parser (>= 1.4, < 3.0)
       nokogiri (~> 1.15)
-    roadie-rails (3.3.0)
-      railties (>= 5.1, < 8.1)
+    roadie-rails (3.4.0)
+      railties (>= 5.1, < 8.2)
       roadie (~> 5.0)
     rotp (6.3.0)
-    rouge (4.7.0)
+    rouge (5.0.0)
+      strscan (~> 3.1)
     rqrcode (3.2.0)
       chunky_png (~> 1.0)
       rqrcode_core (~> 2.0)
     rqrcode_core (2.1.0)
-    rubocop (1.76.2)
+    rubocop (1.88.2)
       json (~> 2.3)
       language_server-protocol (~> 3.17.0.2)
       lint_roller (~> 1.1.0)
-      parallel (~> 1.10)
+      parallel (>= 1.10)
       parser (>= 3.3.0.2)
       rainbow (>= 2.2.2, < 4.0)
       regexp_parser (>= 2.9.3, < 3.0)
-      rubocop-ast (>= 1.45.1, < 2.0)
+      rubocop-ast (>= 1.49.0, < 2.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 2.4.0, < 4.0)
-    rubocop-ast (1.49.1)
+    rubocop-ast (1.50.0)
       parser (>= 3.3.7.2)
       prism (~> 1.7)
-    rubocop-performance (1.25.0)
+    rubocop-performance (1.26.1)
       lint_roller (~> 1.1)
       rubocop (>= 1.75.0, < 2.0)
-      rubocop-ast (>= 1.38.0, < 2.0)
-    rubocop-rails (2.32.0)
+      rubocop-ast (>= 1.47.1, < 2.0)
+    rubocop-rails (2.34.3)
       activesupport (>= 4.2.0)
       lint_roller (~> 1.1)
       rack (>= 1.1)
@@ -344,10 +337,10 @@ GEM
       rubocop-ast (>= 1.44.0, < 2.0)
     ruby-progressbar (1.13.0)
     ruby2_keywords (0.0.5)
-    rubyzip (2.4.1)
-    sanitize (6.1.3)
+    rubyzip (3.4.1)
+    sanitize (7.0.0)
       crass (~> 1.0.2)
-      nokogiri (>= 1.12.0)
+      nokogiri (>= 1.16.8)
     securerandom (0.4.1)
     selenium-webdriver (4.45.0)
       base64 (~> 0.2)
@@ -364,11 +357,11 @@ GEM
     snaky_hash (2.0.6)
       hashie (>= 0.1.0, < 6)
       version_gem (>= 1.1.8, < 3)
-    sqlite3 (2.5.0)
+    sqlite3 (2.9.5)
       mini_portile2 (~> 2.8.0)
     stimulus-rails (1.3.4)
       railties (>= 6.0.0)
-    stringio (3.2.0)
+    strscan (3.1.8)
     svg_optimizer (0.3.0)
       nokogiri
     svg_sprite (1.0.3)
@@ -377,7 +370,8 @@ GEM
       thor
     thor (1.5.0)
     timeout (0.6.1)
-    trilogy (2.9.0)
+    trilogy (2.12.6)
+      bigdecimal
     tsort (0.2.0)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
@@ -387,10 +381,10 @@ GEM
     uniform_notifier (1.18.0)
     uri (1.1.1)
     useragent (0.16.11)
-    version_gem (1.1.12)
+    version_gem (1.1.13)
     webrick (1.9.2)
     websocket (1.2.11)
-    websocket-driver (0.8.1)
+    websocket-driver (0.8.2)
       base64
       websocket-extensions (>= 0.1.0)
     websocket-extensions (0.1.5)
@@ -412,53 +406,51 @@ DEPENDENCIES
   bullet
   bundle-audit
   capybara (>= 3.39)
-  commonmarker (~> 2.3.0)
-  csv (~> 3.3.2)
+  commonmarker (~> 2.8.2)
+  csv (~> 3.3.5)
   debug
   doorkeeper (~> 5.8.2)
   doorkeeper-i18n (~> 5.2)
   ffi
-  html-pipeline (~> 2.13.2)
-  i18n (~> 1.14.1)
+  i18n (~> 1.15.2)
   importmap-rails (~> 2.0)
   listen (~> 3.3)
-  mail (~> 2.8.1)
+  mail (~> 2.9.0)
   marcel
   mini_magick (~> 5.2.0)
   mini_mime (~> 1.1.0)
-  minitest (~> 5.27)
   mocha (>= 2.0.1)
   mysql2 (~> 0.5.0)
-  net-imap (~> 0.5.7)
-  net-ldap (~> 0.17.0)
+  net-imap (~> 0.6.1)
+  net-ldap (~> 0.20.0)
   net-pop (~> 0.1.2)
-  net-smtp (~> 0.5.0)
+  net-smtp (~> 0.5.1)
   nokogiri (~> 1.19.1)
   oauth2
-  pg (~> 1.5.3)
-  propshaft (~> 1.1.0)
+  ostruct
+  pg (~> 1.6.2)
+  propshaft (~> 1.3.0)
   puma
   rack (>= 3.1.3)
-  rails (= 7.2.3.1)
+  rails (= 8.1.3)
   rails-dom-testing (>= 2.3.0)
   rbpdf (~> 1.21.4)
   requestjs-rails (~> 0.0.13)
-  rest-client
-  roadie-rails (~> 3.3.0)
+  roadie-rails (~> 3.4.0)
   rotp (>= 5.0.0)
-  rouge (~> 4.5)
+  rouge (~> 5.0)
   rqrcode
-  rubocop (~> 1.76.0)
-  rubocop-performance (~> 1.25.0)
-  rubocop-rails (~> 2.32.0)
-  rubyzip (~> 2.4.0)
-  sanitize (~> 6.0)
+  rubocop (~> 1.88.0)
+  rubocop-performance (~> 1.26.0)
+  rubocop-rails (~> 2.34.3)
+  rubyzip (~> 3.4.0)
+  sanitize (~> 7.0)
   selenium-webdriver (>= 4.11.0)
   simplecov (~> 0.22.0)
-  sqlite3 (~> 2.5.0)
+  sqlite3 (~> 2.9.4)
   stimulus-rails (~> 1.3)
   svg_sprite
-  trilogy (~> 2.9.0)
+  trilogy (~> 2.12.4)
   tzinfo-data
   webrick
   with_advisory_lock

pkgs/by-name/re/redmine/gemset.nix

@@ -1,4 +1,15 @@
 {
+  action_text-trix = {
+    dependencies = [ "railties" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "02a0yz97d12cf6wcj5r43ak57mhlcj4r84k5ma2g570046aga4kh";
+      type = "gem";
+    };
+    version = "2.1.19";
+  };
   actioncable = {
     dependencies = [
       "actionpack"
@@ -11,10 +22,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0g5kbrqvhwlliyrzd2bhc3kdiqm58df0x3w716bs0ygwyjil1gyk";
+      sha256 = "1w40bbkjd0lds57bfr24hbj9qfkwj9v33x6457g24sjfwispzg75";
       type = "gem";
     };
-    version = "7.2.3.1";
+    version = "8.1.3";
   };
   actionmailbox = {
     dependencies = [
@@ -29,10 +40,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0hf59r6sk0qb5va0ga549rbadcb5n1a2ry8nlkszzcksr6039rx4";
+      sha256 = "0ndf98dpzmz8xs6m253zpwnhyfrvxdkfyvssxps0vrx0x9sa8zfz";
       type = "gem";
     };
-    version = "7.2.3.1";
+    version = "8.1.3";
   };
   actionmailer = {
     dependencies = [
@@ -47,18 +58,16 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0rq4aan18y6gwziabnj1q1486349k1v1i5m7ysv206pqqpavcy7m";
+      sha256 = "13a4329lgrda8s9mqrfbaakvc90i6ak82rfpljmd0w5vj54747w3";
       type = "gem";
     };
-    version = "7.2.3.1";
+    version = "8.1.3";
   };
   actionpack = {
     dependencies = [
       "actionview"
       "activesupport"
-      "cgi"
       "nokogiri"
-      "racc"
       "rack"
       "rack-session"
       "rack-test"
@@ -70,10 +79,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1jp4w493wvfh9246wxk7g00m1a3vmzkvs0rznq62fwvjjdzzwsmn";
+      sha256 = "18r93ii2ayw8n60qsx259dy8nwgbfxf3ndncla0xbia79np8r6dg";
       type = "gem";
     };
-    version = "7.2.3.1";
+    version = "8.1.3";
   };
   actionpack-xml_parser = {
     dependencies = [
@@ -91,6 +100,7 @@
   };
   actiontext = {
     dependencies = [
+      "action_text-trix"
       "actionpack"
       "activerecord"
       "activestorage"
@@ -102,16 +112,15 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1qs350j3zm7sd6xxn61d93mv3lx1ravbjqja12c7nd7a0zs1h52v";
+      sha256 = "1ln7mwflqf7nsgkj9lm1p7bmc6h8yqaa47q1cdj9xsp102f034fj";
       type = "gem";
     };
-    version = "7.2.3.1";
+    version = "8.1.3";
   };
   actionview = {
     dependencies = [
       "activesupport"
       "builder"
-      "cgi"
       "erubi"
       "rails-dom-testing"
       "rails-html-sanitizer"
@@ -120,10 +129,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0z7zy6ibfpsdj9jbdm54bx3ws4dszcq7qa564jn645rr8dlbh6fy";
+      sha256 = "0pgxl9p2q2zbwb6626yw7rgpbmv2bvxykq2w1h83inrygy6chiqk";
       type = "gem";
     };
-    version = "7.2.3.1";
+    version = "8.1.3";
   };
   activejob = {
     dependencies = [
@@ -134,10 +143,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1n3fiwm1x3dxwj36n9pspd2bgffyw28ys9yd36hjvf3iwdy25i0b";
+      sha256 = "1lz8bxb6pcf9yvxwyj6355aws3ylxi5rwc577ly4q858d9vb2jd1";
       type = "gem";
     };
-    version = "7.2.3.1";
+    version = "8.1.3";
   };
   activemodel = {
     dependencies = [ "activesupport" ];
@@ -145,10 +154,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1l60a6mqx1wgp15ki1cp68djci0czgrikpydii5bd877hndqdq9r";
+      sha256 = "06c23jww82grgvxw19g4bi9c957aj5hh24wzyyw4jdpg9jz5rh4h";
       type = "gem";
     };
-    version = "7.2.3.1";
+    version = "8.1.3";
   };
   activerecord = {
     dependencies = [
@@ -160,10 +169,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0pd0f1hy6rvyanmrklqir33xq0jb2my4jajz7hc38nysfpi175dq";
+      sha256 = "1avhmih54xqyj14zrv6ciw2ndpb11bmkwq0fcwm0mfk64ixvw0w0";
       type = "gem";
     };
-    version = "7.2.3.1";
+    version = "8.1.3";
   };
   activestorage = {
     dependencies = [
@@ -177,24 +186,25 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1azzbpfp726yigwzmj8g2jji149wisnwrgb86zix6mk25sj4w8hb";
+      sha256 = "0k9q8sdlf576r8rp2hgdxy5lpr8f157bpq8mfsk52f8l169wwr05";
       type = "gem";
     };
-    version = "7.2.3.1";
+    version = "8.1.3";
   };
   activesupport = {
     dependencies = [
       "base64"
-      "benchmark"
       "bigdecimal"
       "concurrent-ruby"
       "connection_pool"
       "drb"
       "i18n"
+      "json"
       "logger"
       "minitest"
       "securerandom"
       "tzinfo"
+      "uri"
     ];
     groups = [
       "default"
@@ -204,10 +214,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0d6bhg9cim83g8cypjd7cms45ng4p9ga69v26i3vp823d98yvsqi";
+      sha256 = "03m2vjhq3nmc8c3hpivxhvkjd8igg16nmv0p2fgdsgacppgy1991";
       type = "gem";
     };
-    version = "7.2.3.1";
+    version = "8.1.3";
   };
   addressable = {
     dependencies = [ "public_suffix" ];
@@ -223,6 +233,20 @@
     };
     version = "2.9.0";
   };
+  anonymous_loader = {
+    dependencies = [ "version_gem" ];
+    groups = [
+      "default"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1hpghmcr15x53i1v2g2fhqskhjil61pxsvwm8wyvjbw1y31pgkwc";
+      type = "gem";
+    };
+    version = "0.1.2";
+  };
   ast = {
     groups = [
       "default"
@@ -245,15 +269,16 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0xy5gjb12kv6zjn4zyd16yfv4bygd02ykbr6cz10d6sqyw0wyzci";
+      sha256 = "1bkvybb3ahhzzdd785p8f14p82ga1iwrg9k79xx5xzk7pgg1409h";
       type = "gem";
     };
-    version = "0.2.1";
+    version = "0.2.2";
   };
   base64 = {
     groups = [
       "default"
       "development"
+      "ldap"
       "test"
     ];
     platforms = [ ];
@@ -277,9 +302,7 @@
   benchmark = {
     groups = [
       "default"
-      "development"
       "minimagick"
-      "test"
     ];
     platforms = [ ];
     source = {
@@ -372,16 +395,6 @@
     };
     version = "3.40.0";
   };
-  cgi = {
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1s8qdw1nfh3njd47q154njlfyc2llcgi4ik13vz39adqd7yclgz9";
-      type = "gem";
-    };
-    version = "0.5.1";
-  };
   chunky_png = {
     groups = [ "default" ];
     platforms = [ ];
@@ -398,10 +411,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "04g73hpmrn92jcj1cfblg4aq2k6sijd6i4xa4n0y0p2fbxry715z";
+      sha256 = "0yldrij8c0fpdjz9aic2in4jqkyifzfxlklan9bzd2aj07jvs6ki";
       type = "gem";
     };
-    version = "2.3.2";
+    version = "2.8.3";
   };
   concurrent-ruby = {
     groups = [
@@ -436,10 +449,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0pfl5c0pyqaparxaqxi6s4gfl21bdldwiawrc0aknyvflli60lfw";
+      sha256 = "15djj19ynz3sbw54fsf8n7y3sha8a333f2mgvjfwhr46jhcqg1ll";
       type = "gem";
     };
-    version = "1.0.6";
+    version = "1.0.7";
   };
   css_parser = {
     dependencies = [ "addressable" ];
@@ -463,11 +476,7 @@
     version = "3.3.5";
   };
   date = {
-    groups = [
-      "default"
-      "development"
-      "test"
-    ];
+    groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
@@ -506,19 +515,6 @@
     };
     version = "1.4.1";
   };
-  domain_name = {
-    groups = [
-      "default"
-      "test"
-    ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0cyr2xm576gqhqicsyqnhanni47408w2pgvrfi8pd13h2li3nsaz";
-      type = "gem";
-    };
-    version = "0.6.20240107";
-  };
   doorkeeper = {
     dependencies = [ "railties" ];
     groups = [ "default" ];
@@ -647,10 +643,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "04gzhqvsm4z4l12r9dkac9a75ah45w186ydhl0i4andldsnkkih5";
+      sha256 = "09zl0rkskfq0cwfrk9ypjvflvzanfg3xbhh1slaa1myry7xi4zq3";
       type = "gem";
     };
-    version = "1.3.0";
+    version = "1.4.0";
   };
   hashie = {
     dependencies = [ "logger" ];
@@ -666,20 +662,6 @@
     };
     version = "5.1.0";
   };
-  html-pipeline = {
-    dependencies = [
-      "activesupport"
-      "nokogiri"
-    ];
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "00xqmlny1b4ixff8sk0rkl4wcgwqc6v93qv8l3rn8d1dppvq7pm1";
-      type = "gem";
-    };
-    version = "2.13.2";
-  };
   htmlentities = {
     groups = [ "default" ];
     platforms = [ ];
@@ -690,33 +672,6 @@
     };
     version = "4.4.2";
   };
-  http-accept = {
-    groups = [
-      "default"
-      "test"
-    ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "09m1facypsdjynfwrcv19xcb1mqg8z6kk31g8r33pfxzh838c9n6";
-      type = "gem";
-    };
-    version = "1.7.0";
-  };
-  http-cookie = {
-    dependencies = [ "domain_name" ];
-    groups = [
-      "default"
-      "test"
-    ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1aga7z4p0dka4zcqw9i05wa4ab1q7h7cgnj328ldqqfycjz84jxs";
-      type = "gem";
-    };
-    version = "1.1.6";
-  };
   i18n = {
     dependencies = [ "concurrent-ruby" ];
     groups = [
@@ -727,10 +682,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1994i044vdmzzkyr76g8rpl1fq1532wf0sb21xg5r1ilj5iphmr8";
+      sha256 = "1dfikmmd9dllirsfq0kjiyxpmlq0afkxm5sslsr97r9g85ifpy80";
       type = "gem";
     };
-    version = "1.14.8";
+    version = "1.15.2";
   };
   importmap-rails = {
     dependencies = [
@@ -784,15 +739,16 @@
   json = {
     groups = [
       "default"
+      "development"
       "test"
     ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "16mp8vzgxa8nsa81np042za453j8b0ihpjkf666s7byxrnvjb44v";
+      sha256 = "0ay31y1yl208xrpcsw6b0k4q309magq7q5prmdbb0lm9ampbqqlk";
       type = "gem";
     };
-    version = "2.19.9";
+    version = "2.20.0";
   };
   jwt = {
     dependencies = [ "base64" ];
@@ -816,10 +772,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1k0311vah76kg5m6zr7wmkwyk5p2f9d9hyckjpn3xgr83ajkj7px";
+      sha256 = "1w5p8c2145lmqzr25bxh4ikzjm6k8y1k5lriqqdpw9pq730w1wjy";
       type = "gem";
     };
-    version = "3.17.0.5";
+    version = "3.17.0.6";
   };
   lint_roller = {
     groups = [
@@ -880,6 +836,7 @@
   };
   mail = {
     dependencies = [
+      "logger"
       "mini_mime"
       "net-imap"
       "net-pop"
@@ -889,10 +846,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1bf9pysw1jfgynv692hhaycfxa8ckay1gjw5hz3madrbrynryfzc";
+      sha256 = "1s30l5z7jkazgi4m6l6mh80rgsyhh2pp1pa5h70xclsj8z54wmq6";
       type = "gem";
     };
-    version = "2.8.1";
+    version = "2.9.1";
   };
   marcel = {
     groups = [ "default" ];
@@ -917,36 +874,6 @@
     };
     version = "0.4.3";
   };
-  mime-types = {
-    dependencies = [
-      "logger"
-      "mime-types-data"
-    ];
-    groups = [
-      "default"
-      "test"
-    ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0mjyxl7c0xzyqdqa8r45hqg7jcw2prp3hkp39mdf223g4hfgdsyw";
-      type = "gem";
-    };
-    version = "3.7.0";
-  };
-  mime-types-data = {
-    groups = [
-      "default"
-      "test"
-    ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1k28j6ww8rf43r5i8278jvm2cq3pnzsvqm7yqpb4p93kadjlq726";
-      type = "gem";
-    };
-    version = "3.2026.0414";
-  };
   mini_magick = {
     dependencies = [
       "benchmark"
@@ -989,6 +916,10 @@
     version = "2.8.9";
   };
   minitest = {
+    dependencies = [
+      "drb"
+      "prism"
+    ];
     groups = [
       "default"
       "development"
@@ -997,10 +928,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1mbpz92ml19rcxxfjrj91gmkif9khb1xpzyw38f81rvglgw1ffrd";
+      sha256 = "1wfnqyfayx9n9j7x871v2ars4hjhfisi1dl24fa64ylq3mns6ghm";
       type = "gem";
     };
-    version = "5.27.0";
+    version = "6.0.6";
   };
   mocha = {
     dependencies = [ "ruby2_keywords" ];
@@ -1061,20 +992,24 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0506bhwr62szwcagcvxayhwz0d20k5ax1sh742va3mjnnkqcfkgn";
+      sha256 = "03ga2h4i5hsk8pdlicyfvqfsbh55vrbikb0nkx9x7vx7fl6kdw19";
       type = "gem";
     };
-    version = "0.5.15";
+    version = "0.6.4.1";
   };
   net-ldap = {
+    dependencies = [
+      "base64"
+      "ostruct"
+    ];
     groups = [ "ldap" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1ycw0qsw3hap8svakl0i30jkj0ffd4lpyrn17a1j0w8mz5ainmsj";
+      sha256 = "0wjkrvcwnxa6ggq0nfz004f1blm1c67fv7c6614sraak0wshn25j";
       type = "gem";
     };
-    version = "0.17.1";
+    version = "0.20.0";
   };
   net-pop = {
     dependencies = [ "net-protocol" ];
@@ -1109,19 +1044,6 @@
     };
     version = "0.5.1";
   };
-  netrc = {
-    groups = [
-      "default"
-      "test"
-    ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0gzfmcywp1da8nzfqsql2zqi648mfnx6qwkig3cv36n9m0yy676y";
-      type = "gem";
-    };
-    version = "0.11.0";
-  };
   nio4r = {
     groups = [
       "default"
@@ -1148,13 +1070,14 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1s30b7h7qpyim30m8060xs415mbr3ci7i5hdg09chh1aqfx2qcbq";
+      sha256 = "1d9safb4dly6qmc2g06444l0zifby52yy6j1a5fa1g4j3ihm3jah";
       type = "gem";
     };
-    version = "1.19.3";
+    version = "1.19.4";
   };
   oauth2 = {
     dependencies = [
+      "anonymous_loader"
       "auth-sanitizer"
       "faraday"
       "jwt"
@@ -1168,10 +1091,23 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0k428i1mlk6g7c054iks86g2h4h2p1y0mg2l3g6w84gd9l8604g6";
+      sha256 = "11n1hbn40gbrv7y91a4gj4qpcd3vxwsrdjkbhcy7vyxr7ac68j1x";
       type = "gem";
     };
-    version = "2.0.23";
+    version = "2.0.24";
+  };
+  ostruct = {
+    groups = [
+      "default"
+      "ldap"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "04nrir9wdpc4izqwqbysxyly8y7hsfr4fsv69rw91lfi9d5fv8lm";
+      type = "gem";
+    };
+    version = "0.6.3";
   };
   parallel = {
     groups = [
@@ -1181,10 +1117,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0w697335hi5dk5ay9kyn53399sy87y8v0y6ij93m5wmshhadxrik";
+      sha256 = "0mlkn1vhh9lr7vljibpgspwsswk7mzm8nw6bbr616c9fbj35hlmk";
       type = "gem";
     };
-    version = "1.28.0";
+    version = "2.1.0";
   };
   parser = {
     dependencies = [
@@ -1208,10 +1144,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1p2gqqrm895fzr9vi8d118zhql67bm8ydjvgqbq1crdnfggzn7kn";
+      sha256 = "16caca7lcz5pwl82snarqrayjj9j7abmxqw92267blhk7rbd120k";
       type = "gem";
     };
-    version = "1.5.9";
+    version = "1.6.3";
   };
   pp = {
     dependencies = [ "prettyprint" ];
@@ -1223,10 +1159,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1xlxmg86k5kifci1xvlmgw56x88dmqf04zfzn7zcr4qb8ladal99";
+      sha256 = "0w5mha75hs8gdj75g8vl0sxpyp8rzvwq8a4jcmi4ah8cf370zjyz";
       type = "gem";
     };
-    version = "0.6.3";
+    version = "0.6.4";
   };
   prettyprint = {
     groups = [
@@ -1261,34 +1197,15 @@
       "actionpack"
       "activesupport"
       "rack"
-      "railties"
     ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0sqg0xf46xd47zdpm8d12kfnwl0y5jb2hj10imzb3bk6mwgkd2fk";
+      sha256 = "17iqn4sa59c9z5y3bpvxqka00srqnl379w6a57y1phljdbjs6mhx";
       type = "gem";
     };
-    version = "1.1.0";
-  };
-  psych = {
-    dependencies = [
-      "date"
-      "stringio"
-    ];
-    groups = [
-      "default"
-      "development"
-      "test"
-    ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1dx5bc3s1mb1i53np4cdkypg7ccygnvagr3hglyndbqilrljvxql";
-      type = "gem";
-    };
-    version = "5.4.0";
+    version = "1.3.2";
   };
   public_suffix = {
     groups = [
@@ -1399,10 +1316,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "155skqkjrckvzj1qy37lrnafrillc47qhf3l80g3zvw100ba1h4n";
+      sha256 = "1lww7i686rm9s50d34hb596y2kfl46dida2kjy8gr64c6jjpn0bd";
       type = "gem";
     };
-    version = "7.2.3.1";
+    version = "8.1.3";
   };
   rails-dom-testing = {
     dependencies = [
@@ -1437,7 +1354,6 @@
     dependencies = [
       "actionpack"
       "activesupport"
-      "cgi"
       "irb"
       "rackup"
       "rake"
@@ -1449,10 +1365,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0np1m8xqb4wbzwpg66yjnqjban0di92lbjzcrgnwwhq2w4z3k8xf";
+      sha256 = "08nyhsigcvjpj9i3r0s73yi8zm16sxmr2x7xgxlaq2jjrghb0gli";
       type = "gem";
     };
-    version = "7.2.3.1";
+    version = "8.1.3";
   };
   rainbow = {
     groups = [
@@ -1549,10 +1465,10 @@
     };
     version = "1.19.1";
   };
-  rdoc = {
+  rbs = {
     dependencies = [
-      "erb"
-      "psych"
+      "logger"
+      "prism"
       "tsort"
     ];
     groups = [
@@ -1563,10 +1479,30 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "14iiyb4yi1chdzrynrk74xbhmikml3ixgdayjma3p700singfl46";
+      sha256 = "050f0b6bv94k4vszy366m5l5krfgn93y9sj43yd9sm184q7gfyss";
       type = "gem";
     };
-    version = "7.2.0";
+    version = "4.0.3";
+  };
+  rdoc = {
+    dependencies = [
+      "erb"
+      "prism"
+      "rbs"
+      "tsort"
+    ];
+    groups = [
+      "default"
+      "development"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0sf4909q2mr9z0rpygv94z12b0yamg07gz8cba2mi5k3m448rgq3";
+      type = "gem";
+    };
+    version = "8.0.0";
   };
   regexp_parser = {
     groups = [
@@ -1607,22 +1543,6 @@
     };
     version = "0.0.14";
   };
-  rest-client = {
-    dependencies = [
-      "http-accept"
-      "http-cookie"
-      "mime-types"
-      "netrc"
-    ];
-    groups = [ "test" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1qs74yzl58agzx9dgjhcpgmzfn61fqkk33k1js2y5yhlvc5l19im";
-      type = "gem";
-    };
-    version = "2.1.0";
-  };
   rexml = {
     groups = [
       "default"
@@ -1659,10 +1579,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0phadjq9xyx91535y2xn09jywhgzj8ljpm3yywyznqjrcdxgd020";
+      sha256 = "1acs3ynpiyx5qnplw8v85b7m9z69qi4n0qxv3sjylla0nz9jpc7p";
       type = "gem";
     };
-    version = "3.3.0";
+    version = "3.4.0";
   };
   rotp = {
     groups = [ "default" ];
@@ -1675,14 +1595,15 @@
     version = "6.3.0";
   };
   rouge = {
+    dependencies = [ "strscan" ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0fd77qcz603mli4lyi97cjzkv02hsfk60m495qv5qcn02mkqk9fv";
+      sha256 = "1g2y2z07niw4ylbgf6zr6a7kjaqbaqxn98xwff58zf4w5yx9ppp2";
       type = "gem";
     };
-    version = "4.7.0";
+    version = "5.0.0";
   };
   rqrcode = {
     dependencies = [
@@ -1725,10 +1646,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0csnyhcjrxjiiz849rc8rjdqg9w5ixwi2wcj7ii3vghbp9rg2i5f";
+      sha256 = "1gwvjfd3zh40dhggh3p99h62b4v8nl5dqgma9pmmz5fdj0f2bvwd";
       type = "gem";
     };
-    version = "1.76.2";
+    version = "1.88.2";
   };
   rubocop-ast = {
     dependencies = [
@@ -1742,10 +1663,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0dahfpnzz63hyqxa03x8rypnrxzwyvh4i5a8ri34bzpnf3pg64j4";
+      sha256 = "1nw84xk6vc2ls8sxqvyhxs2agh4l0jrws85d4bi3x0501lq8ijmr";
       type = "gem";
     };
-    version = "1.49.1";
+    version = "1.50.0";
   };
   rubocop-performance = {
     dependencies = [
@@ -1757,10 +1678,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1h9flnqk2f3llwf8g0mk0fvzzznfj7hsil3qg88m803pi9b06zbg";
+      sha256 = "0d0qyyw1332afi9glwfjkb4bd62gzlibar6j55cghv8rzwvbj6fd";
       type = "gem";
     };
-    version = "1.25.0";
+    version = "1.26.1";
   };
   rubocop-rails = {
     dependencies = [
@@ -1774,10 +1695,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1404nfa0gw3p0xzmv4b9zg9v1da0nwc4m7796pl73zi2hwy65k4z";
+      sha256 = "1llsxc8wm2pq8glpv5mczd1h36fazbri3wwrh7dfqra80a4pklqh";
       type = "gem";
     };
-    version = "2.32.0";
+    version = "2.34.3";
   };
   ruby-progressbar = {
     groups = [
@@ -1813,10 +1734,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "05an0wz87vkmqwcwyh5rjiaavydfn5f4q1lixcsqkphzvj7chxw5";
+      sha256 = "00nafgqjhwa504xrjv32v0757a2xcvspsia8s7mp4n62nm2yfy8a";
       type = "gem";
     };
-    version = "2.4.1";
+    version = "3.4.1";
   };
   sanitize = {
     dependencies = [
@@ -1827,10 +1748,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0lj1jjxn1znxmaf6jnngfrz26rw85smxb69m4jl6a9yq6gwyab54";
+      sha256 = "111r4xdcf6ihdnrs6wkfc6nqdzrjq0z69x9sf83r7ri6fffip796";
       type = "gem";
     };
-    version = "6.1.3";
+    version = "7.0.0";
   };
   securerandom = {
     groups = [
@@ -1927,10 +1848,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0sqshkafxa1r34yj4yxisd4kddmjq9jrhx6azqy3z71nwqv01yl7";
+      sha256 = "01i6k25fv3w3f5ph5cix9ipg19ajsy6zrzxdm18ashzrldrjjmq4";
       type = "gem";
     };
-    version = "2.5.0";
+    version = "2.9.5";
   };
   stimulus-rails = {
     dependencies = [ "railties" ];
@@ -1943,19 +1864,15 @@
     };
     version = "1.3.4";
   };
-  stringio = {
-    groups = [
-      "default"
-      "development"
-      "test"
-    ];
+  strscan = {
+    groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1q92y9627yisykyscv0bdsrrgyaajc2qr56dwlzx7ysgigjv4z63";
+      sha256 = "17k75zrwf4ag9yl9wjjkcb90zrm4r5jigdzv3zr5jm9239hxpqma";
       type = "gem";
     };
-    version = "3.2.0";
+    version = "3.1.8";
   };
   svg_optimizer = {
     dependencies = [ "nokogiri" ];
@@ -2011,14 +1928,15 @@
     version = "0.6.1";
   };
   trilogy = {
+    dependencies = [ "bigdecimal" ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0zq6yrp1074yd5lflz7yqzpicpcg4bxrl7sxw5c4g2m67dk3pmm2";
+      sha256 = "1xww2n01yl2g7q3i3sz1k3mgalmdhb1h9hxc87n2zjah444rf3rf";
       type = "gem";
     };
-    version = "2.9.0";
+    version = "2.12.6";
   };
   tsort = {
     groups = [
@@ -2092,6 +2010,7 @@
   uri = {
     groups = [
       "default"
+      "development"
       "test"
     ];
     platforms = [ ];
@@ -2120,10 +2039,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0gfv1qxfn202xffasw2mrrrf2jkdp6hsps0177k9fyc0fwb6k3xp";
+      sha256 = "0q3jb2cal9c8b0xgdz1xl47w3n1vsb1gwj06c4acsxsqqid07wvp";
       type = "gem";
     };
-    version = "1.1.12";
+    version = "1.1.13";
   };
   webrick = {
     groups = [ "default" ];
@@ -2157,10 +2076,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "15idgibqpdaj97f734drx8a7k1jcc8wvxlk2nbafac72ihikicjs";
+      sha256 = "0ij19k6034x0c4hw0ywa7wnk5s912r8aq0hhjss10d5z36q5dicp";
       type = "gem";
     };
-    version = "0.8.1";
+    version = "0.8.2";
   };
   websocket-extensions = {
     groups = [ "default" ];

pkgs/by-name/re/redmine/package.nix

@@ -4,7 +4,7 @@
   stdenvNoCC,
   fetchurl,
   bundlerEnv,
-  ruby_3_4,
+  ruby_4_0,
   makeWrapper,
   nixosTests,
   openssl,
@@ -15,11 +15,11 @@
 }:
 
 let
-  version = "6.1.3";
+  version = "7.0.0";
   rubyEnv = bundlerEnv {
     name = "redmine-env-${version}";
 
-    ruby = ruby_3_4;
+    ruby = ruby_4_0;
     gemdir = ./.;
     groups = [
       "development"
@@ -41,7 +41,7 @@ let
             unpackPhase
             nativeBuildInputs
             ;
-          hash = "sha256-rUNsf7DUVueD9revOR6Mab36XnVEmjL4bVv6TIMMqjM=";
+          hash = "sha256-Xw0VWl3qZLvNNmRFHuWkltC1XfoIaHJKWM8Po4FSmoQ=";
         };
         dontBuild = false;
         nativeBuildInputs = [
@@ -69,7 +69,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://www.redmine.org/releases/redmine-${finalAttrs.version}.tar.gz";
-    hash = "sha256-YdswCMf9GKOvxVntZW/Tj9+N+CIKxpWYsxkJUYMZC3o=";
+    hash = "sha256-hX6fiGDDHkxTE4nl2T7qJkiNummDBISjsKqQS+YV6Qo=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/by-name/re/redmine/update.sh

@@ -15,6 +15,10 @@ for file in "gemset.nix" "Gemfile.lock"; do
 done
 
 bundle lock --add-platform ruby
+bundle lock --remove-platform mingw
+bundle lock --remove-platform x64_mingw
+bundle lock --remove-platform mswin
+bundle lock --remove-platform windows
 bundle lock --remove-platform aarch64-linux
 bundle lock --remove-platform aarch64-linux-gnu
 bundle lock --remove-platform aarch64-linux-musl

pkgs/by-name/re/remark42/package.nix

@@ -3,14 +3,15 @@
   stdenv,
   fetchFromGitHub,
   buildGoModule,
-  nodejs_22,
-  pnpm_8,
+  nodejs-slim_22,
+  pnpm_9,
   fetchPnpmDeps,
   pnpmConfigHook,
   testers,
 }:
 
 let
+  pnpm = pnpm_9.override { nodejs-slim = nodejs-slim_22; };
   version = "1.15.0";
 
   src = fetchFromGitHub {
@@ -26,34 +27,49 @@ let
 
     strictDeps = true;
 
-    pnpmRoot = "frontend";
+    sourceRoot = "${src.name}/frontend";
 
     nativeBuildInputs = [
-      nodejs_22
-      pnpm_8
+      nodejs-slim_22
+      pnpm
       pnpmConfigHook
     ];
 
     pnpmDeps = fetchPnpmDeps {
-      inherit (finalAttrs) pname version src;
-      sourceRoot = "${finalAttrs.src.name}/frontend";
-      pnpm = pnpm_8;
-      fetcherVersion = 3;
-      hash = "sha256-E2tUZXhcufuztXS+Z//uZk9omvaPrevNbGqVd41Lwhw=";
+      inherit (finalAttrs)
+        pname
+        version
+        src
+        sourceRoot
+        postPatch
+        ;
+      inherit pnpm;
+      fetcherVersion = 4;
+      hash = "sha256-wFrMoSeD87H1yfMD0jBcw60DKDeh4yjka5aWyHuQssA=";
     };
 
+    postPatch = ''
+      substituteInPlace "package.json" "apps/remark42/package.json" \
+        --replace-fail "pnpm@8.15.9" "pnpm@${pnpm.version}"
+
+      substituteInPlace "apps/remark42/package.json" \
+        --replace-fail '"pnpm": "8.*"' '"pnpm": "9.*"'
+    '';
+
     buildPhase = ''
       runHook preBuild
-      pushd "$pnpmRoot"
+
       pnpm --filter ./apps/remark42 --fail-if-no-match run build
-      popd
+
       runHook postBuild
     '';
 
     installPhase = ''
       runHook preInstall
+
       mkdir -p $out/web
-      cp -r "$pnpmRoot/apps/remark42/public/." $out/web/
+      cp -r "apps/remark42/public/." $out/web/
+
       runHook postInstall
     '';
   });

pkgs/by-name/ru/rust-federation-tester/package.nix

@@ -0,0 +1,66 @@
+{
+  rustPlatform,
+  fetchFromGitHub,
+  lib,
+  nixosTests,
+  cacert,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "rust-federation-tester";
+  version = "0.5.2";
+
+  src = fetchFromGitHub {
+    owner = "MTRNord";
+    repo = "rust-federation-tester";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-KHRG+5AeK7h7k7LoTtcIjGmPYlVcV2ZwpJN8iDsBfHg=";
+  };
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  cargoHash = "sha256-nTcE8eqQO0CFdeH0jjT6m1fd4qhG7e/CDpdZHkBq9f8=";
+  cargoTestFlags = finalAttrs.cargoBuildFlags;
+  cargoBuildFlags = [
+    "-p"
+    "rust-federation-tester"
+    "-p"
+    "migration"
+  ];
+
+  nativeCheckInputs = [ cacert ];
+
+  checkFlags = map (test: "--skip=${test}") [
+    # Tests depending on network access
+    "test_generate_json_report_ipv4_only_server"
+    "test_generate_json_report_known_bad_servers"
+    "test_generate_json_report_known_good_servers"
+    "test_generate_json_report_valid_domain"
+    "test_generate_json_report_with_port"
+    "test_lookup_server_well_known_valid"
+    "test_matrix_fed_srv_resolution_4msc4040"
+    "test_matrix_srv_resolution_4s"
+    "test_step2_explicit_port"
+    "test_step3b_wellknown_explicit_port"
+    "test_step3c_wellknown_matrix_fed_srv"
+    "test_step3c_wellknown_matrix_srv"
+    "test_step3d_wellknown_default_port"
+    "test_step6_wellknown_fails_default_port"
+    "test_generate_report"
+    "test_concurrent_requests"
+  ];
+
+  passthru.tests = {
+    inherit (nixosTests) matrix-synapse;
+  };
+
+  meta = {
+    description = "Matrix-Federation-Tester in Rust";
+    homepage = "https://connectivity-tester.mtrnord.blog/";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ ma27 ];
+    platforms = lib.platforms.linux;
+    mainProgram = "rust-federation-tester";
+  };
+})

pkgs/by-name/se/searxng/package.nix

@@ -13,14 +13,14 @@ in
 python.pkgs.toPythonModule (
   python.pkgs.buildPythonApplication rec {
     pname = "searxng";
-    version = "0-unstable-2026-06-20";
+    version = "0-unstable-2026-07-08";
     pyproject = true;
 
     src = fetchFromGitHub {
       owner = "searxng";
       repo = "searxng";
-      rev = "fd42d4fda142901416038f4748ca8222d2ff7822";
-      hash = "sha256-x88O+TuPi/BjZug0NAHLbD5jaVK4/NDoxhVkSvRXkA4=";
+      rev = "1412926f5c80ffabc90719450578eb98fda9e161";
+      hash = "sha256-w3nXXI2qVFqIsnaYgzsyjDdvQ0nQmQdVMClw2fG2Zmg=";
     };
 
     nativeBuildInputs = with python.pkgs; [ pythonRelaxDepsHook ];

pkgs/by-name/sh/shopware-cli/package.nix

@@ -11,12 +11,12 @@
 
 buildGoModule (finalAttrs: {
   pname = "shopware-cli";
-  version = "0.15.11";
+  version = "0.15.12";
   src = fetchFromGitHub {
     repo = "shopware-cli";
     owner = "shopware";
     tag = finalAttrs.version;
-    hash = "sha256-N+V1ta+NM2PpS2BS7wSpS8JaZFRMdVy6fM8HtGh7PjA=";
+    hash = "sha256-9T04G88OPjdgHKWpuRAma5HGudVfep0cN5tR+MHL28Q=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/st/steamguard-cli/package.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "steamguard-cli";
-  version = "0.18.1";
+  version = "0.18.2";
 
   src = fetchFromGitHub {
     owner = "dyc3";
     repo = "steamguard-cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Y2o9xJP7ENXXcoPJiuFOstPnzGFQo0LFmr7ss66ojAM";
+    hash = "sha256-+WqqByn15UBcZzNqNNxt1NjTH6cCeCIpaCOeTFR1XB0=";
   };
 
-  cargoHash = "sha256-V5VCHMqvGU0m+xbDoQqEEgeBtX5H4A1Mc11SDTB3a1w=";
+  cargoHash = "sha256-AKkMx0FzNGPHPTja1Hll1+qvHtCzSUI44sGpU3OEkpc=";
 
   # disable update check
   buildNoDefaultFeatures = true;

pkgs/by-name/sy/syncthing/package.nix

@@ -22,16 +22,16 @@ assert builtins.elem target [
 
 buildGoModule (finalAttrs: {
   pname = "syncthing";
-  version = "2.1.1";
+  version = "2.1.2";
 
   src = fetchFromGitHub {
     owner = "syncthing";
     repo = "syncthing";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-OwR1OiwtlJSRnFXFEyyHcL3q6NdDUQd4JEy0YSQ18fg=";
+    hash = "sha256-tR4yXoEYbCi8Uh3wCyATc+J4+cGvD7k0d9egjHS5H4k=";
   };
 
-  vendorHash = "sha256-gfGuXBvGdQr+o8zV4MM1FYnOy2fpytIIEdQ9waGNSW4=";
+  vendorHash = "sha256-t2wjl4eWvcUHMaBS7KEPzZejqrlI+7c5fRqWqxuCZy8=";
 
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     # Recent versions of macOS seem to require binaries to be signed when

pkgs/by-name/te/terraform-config-inspect/package.nix

@@ -7,13 +7,13 @@
 }:
 buildGoModule {
   pname = "terraform-config-inspect";
-  version = "0-unstable-2026-02-24";
+  version = "0-unstable-2026-07-09";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = "terraform-config-inspect";
-    rev = "813a9753022088a8e29290e3ba8806131a3329c2";
-    hash = "sha256-kjX7tSU5p5kssqIDnxuLyfmUul8UH83Aeq7ftN0HJCM=";
+    rev = "2fb54c236733ee65ee877105d595c124c993c64d";
+    hash = "sha256-f8DyPP0XhOlgVdp0yjjFVyjaO2+ypfMfEEv6lwA8u3M=";
   };
 
   vendorHash = "sha256-iYrSk9JqxvhYSJuSv/nhZep41gRr644ZzGFWXMGQgyc=";

pkgs/by-name/te/tev/package.nix

@@ -24,14 +24,14 @@
 
 stdenv.mkDerivation rec {
   pname = "tev";
-  version = "2.13.0";
+  version = "2.13.1";
 
   src = fetchFromGitHub {
     owner = "Tom94";
     repo = "tev";
     tag = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-4rWItev1/oOevWdo7QWlZWN0Va6d6tQc6tjm+zTLFp0=";
+    hash = "sha256-+11GpyUCtVvIeSTEJx6WTvN6aUcvuF/lDlA/+6IduKQ=";
   };
 
   postPatch = lib.optionalString stdenv.hostPlatform.isLinux (

pkgs/by-name/to/topgrade/package.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "topgrade";
-  version = "17.6.2";
+  version = "17.7.0";
 
   src = fetchFromGitHub {
     owner = "topgrade-rs";
     repo = "topgrade";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6WdHfIMuwlJ4QWAfIjX3XmZuFVCeGC2/VsV9lz2dgRY=";
+    hash = "sha256-2oydjlPZLWlGNvahsRK7kG5gxEKEHMDNxteaOeYupPA=";
   };
 
-  cargoHash = "sha256-2lj6hAFA41BT5xWG3/i3iMLzbM+zam7/ZMrmE4uvDCg=";
+  cargoHash = "sha256-8pK6ZUlMNcczbmMJvQUsJKp0RoXnimnkbAc7SzrIcJQ=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/vi/vivaldi-ffmpeg-codecs/package.nix

@@ -11,19 +11,19 @@
 let
   sources = {
     x86_64-linux = fetchurl {
-      url = "https://api.snapcraft.io/api/v1/snaps/download/XXzVIXswXKHqlUATPqGCj2w2l7BxosS8_82.snap";
-      hash = "sha256-G9RcOuFjkLDJUNlw2G8GiONpWHYvyTnv3Nr0JSdW0As=";
+      url = "https://api.snapcraft.io/api/v1/snaps/download/XXzVIXswXKHqlUATPqGCj2w2l7BxosS8_117.snap";
+      hash = "sha256-YEE7oF8NLGDCQ3gpY5z6B+7xDxcOumjOzwUztJUM+/s=";
     };
     aarch64-linux = fetchurl {
-      url = "https://api.snapcraft.io/api/v1/snaps/download/XXzVIXswXKHqlUATPqGCj2w2l7BxosS8_83.snap";
-      hash = "sha256-6XMdH4dnvYB1FaJLMi/MFnTzkelmOHMedVcIg/Fh7h4=";
+      url = "https://api.snapcraft.io/api/v1/snaps/download/XXzVIXswXKHqlUATPqGCj2w2l7BxosS8_116.snap";
+      hash = "sha256-4RmVOQ9emlRyzAGxeiSLwvkGv+7R/mKLVYm5IWXqLpo=";
     };
   };
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "chromium-codecs-ffmpeg-extra";
 
-  version = "120726";
+  version = "2026-05-18";
 
   src = sources."${stdenv.hostPlatform.system}";
 
@@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   installPhase = ''
-    install -vD chromium-ffmpeg-${finalAttrs.version}/chromium-ffmpeg/libffmpeg.so $out/lib/libffmpeg.so
+    install -vD chromium-ffmpeg-git-${finalAttrs.version}/chromium-ffmpeg/libffmpeg.so $out/lib/libffmpeg.so
   '';
 
   passthru = {

pkgs/by-name/vi/vivaldi/package.nix

@@ -67,7 +67,7 @@
 
 stdenv.mkDerivation rec {
   pname = "vivaldi";
-  version = "8.0.4033.54";
+  version = "8.1.4087.48";
 
   suffix =
     {
@@ -80,8 +80,8 @@ stdenv.mkDerivation rec {
     url = "https://downloads.vivaldi.com/stable/vivaldi-stable_${version}-1_${suffix}.deb";
     hash =
       {
-        aarch64-linux = "sha256-i2FAMp3MFsnXTjQoF4Y/BuB6j+x3ugfsu0ePGI/h5Po=";
-        x86_64-linux = "sha256-a4ZLX/DpygZgPPjt4BQxTuRbFoPmNuRgdZFiI6UclQI=";
+        aarch64-linux = "sha256-T6mBi4FpHz2iGXeF91giTbuVp4KjFG1DUnPNpKEV06c=";
+        x86_64-linux = "sha256-/Bgh+Y6DHWe7al9vLsWWH1HM5JQGwv91KUxQ9TNkqjs=";
       }
       .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };

pkgs/by-name/wg/wget/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
 
   gettext,
   pkg-config,
@@ -32,6 +33,29 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-GSJcx1awoIj8gRSNxqQKDI8ymvf9hIPxx7L+UPTgih8=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "fix-cve-2026-58471";
+      url = "https://gitlab.com/gnuwget/wget/-/commit/c2640fe5171c59f87c58dc9fcb195b2d18b010ee.patch";
+      hash = "sha256-ZnCLK9ILpHMqpmI39sBl3Q3NRNc/H8jukvBrECqJ6OI=";
+    })
+    (fetchpatch {
+      name = "fix-cve-2026-58470";
+      url = "https://gitlab.com/gnuwget/wget/-/commit/43d3ba9336bc94937e6fae2365c6ffd30c34ffcf.patch";
+      hash = "sha256-aR5lW8t6ME2Os/NPXjFaUbNr3QuiUSQKsa2Zk292mrk=";
+    })
+    (fetchpatch {
+      name = "fix-cve-2026-58469";
+      url = "https://gitlab.com/gnuwget/wget/-/commit/37a40fcb450153f69537c7cbc2a7a4fb0b6f7826.patch";
+      hash = "sha256-lkHQufl8XFZ1Ig8EoRUw3JuCgDPQod9PKAIsTBWzvm4=";
+    })
+    (fetchpatch {
+      name = "fix-cve-2026-58472";
+      url = "https://gitlab.com/gnuwget/wget/-/commit/dd692d9cea5335b181d877ae917fe6e75587a812.patch";
+      hash = "sha256-FAlglKTZili9Y4ivSRLOEaOgektFmq4u6yyH+8WzQao=";
+    })
+  ];
+
   preConfigure = ''
     patchShebangs doc
   '';

pkgs/by-name/xl/xla/package.nix

@@ -235,6 +235,9 @@ in
       runHook postInstall
     '';
   };
+
+  requiredSystemFeatures = [ "big-parallel" ];
+
   meta = {
     description = "Machine learning compiler for GPUs, CPUs, and ML accelerators";
     homepage = "https://github.com/openxla/xla";

pkgs/development/python-modules/aioruckus/default.nix

@@ -5,25 +5,29 @@
   buildPythonPackage,
   cryptography,
   fetchFromGitHub,
+  hatch-vcs,
+  hatchling,
   pytest-asyncio,
   pytestCheckHook,
-  setuptools,
   xmltodict,
 }:
 
 buildPythonPackage rec {
   pname = "aioruckus";
-  version = "0.42";
+  version = "0.46.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ms264556";
     repo = "aioruckus";
     tag = "v${version}";
-    hash = "sha256-UfyB3qGEDOQ39YA1AueCBXeoJhGH+XDCLZSFA+kpT2k=";
+    hash = "sha256-17vcYdggtoeAtGShshseBMB4PSiIOf00nRNIHOAP9Jw=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [
+    hatch-vcs
+    hatchling
+  ];
 
   dependencies = [
     aiohttp

pkgs/development/python-modules/axis/default.nix

@@ -4,18 +4,19 @@
   buildPythonPackage,
   faust-cchardet,
   fetchFromGitHub,
-  httpx,
   orjson,
   packaging,
   pythonOlder,
   setuptools,
-  typing-extensions,
+  tomli,
+  tomli-w,
   xmltodict,
+  zeroconf,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "axis";
-  version = "72";
+  version = "74";
   pyproject = true;
 
   disabled = pythonOlder "3.14";
@@ -24,7 +25,7 @@ buildPythonPackage (finalAttrs: {
     owner = "Kane610";
     repo = "axis";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xNqV3j7fQ+FmOZavVdV907m1ndAhk5HWIV5xE/a8hFI=";
+    hash = "sha256-fWhQe4NklAva4znXUwYhrMdC/VCu4oZgwsyGuGd9csk=";
   };
 
   postPatch = ''
@@ -38,11 +39,12 @@ buildPythonPackage (finalAttrs: {
   dependencies = [
     aiohttp
     faust-cchardet
-    httpx
     orjson
     packaging
-    typing-extensions
+    tomli
+    tomli-w
     xmltodict
+    zeroconf
   ];
 
   # Tests requires a server on localhost

pkgs/development/python-modules/bleak-esphome/bluetooth-adapters-2.4.0-compat.patch

@@ -1,21 +0,0 @@
-diff --git a/tests/conftest.py b/tests/conftest.py
-index 55defbe..551d19e 100644
---- a/tests/conftest.py
-+++ b/tests/conftest.py
-@@ -9,7 +9,7 @@ from aioesphomeapi import (
-     ReconnectLogic,
- )
- from bleak_retry_connector import BleakSlotManager
--from bluetooth_adapters import BluetoothAdapters
-+from bluetooth_adapters import get_adapters
- from habluetooth import (
-     BluetoothManager,
-     set_manager,
-@@ -20,7 +20,7 @@ from zeroconf import Zeroconf
- @pytest.fixture(scope="session", autouse=True)
- def manager():
-     slot_manager = BleakSlotManager()
--    bluetooth_adapters = BluetoothAdapters()
-+    bluetooth_adapters = get_adapters()
-     set_manager(BluetoothManager(bluetooth_adapters, slot_manager))
- 

pkgs/development/python-modules/bleak-esphome/default.nix

@@ -19,20 +19,16 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "bleak-esphome";
-  version = "3.9.5";
+  version = "3.9.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bluetooth-devices";
     repo = "bleak-esphome";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-S4tYL/fq7wMjq81WRftZ1A+RVxs7kGpaM/TfVBNBgaI=";
+    hash = "sha256-MimbUCaGbzAs1qom2ET9dGn1WHjcoaWBWGcoqWVuaF8=";
   };
 
-  patches = [
-    ./bluetooth-adapters-2.4.0-compat.patch
-  ];
-
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace-fail "setuptools>=75.8.2" setuptools

pkgs/development/python-modules/bumble/default.nix

@@ -28,14 +28,14 @@
 
 buildPythonPackage rec {
   pname = "bumble";
-  version = "0.0.229";
+  version = "0.0.232";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "bumble";
     tag = "v${version}";
-    hash = "sha256-sc4cUYfhHLc4sHGVfLkn1Zqmu0Tlpytkbit9ieQjNHE=";
+    hash = "sha256-NT8WNfkYHorjNfsZWry63Uuxk7zyOQDOHTqxZxJNypI=";
   };
 
   build-system = [

pkgs/development/python-modules/catppuccin/default.nix

@@ -22,6 +22,11 @@ buildPythonPackage (finalAttrs: {
     hash = "sha256-wumJ8kpr+C2pdw8jYf+IqYTdSB6Iy37yZqPKycYmOSs=";
   };
 
+  patches = [
+    # https://github.com/catppuccin/python/pull/130
+    ./matplotlib-3.11.patch
+  ];
+
   build-system = [ hatchling ];
 
   optional-dependencies = {

pkgs/development/python-modules/catppuccin/matplotlib-3.11.patch

@@ -0,0 +1,37 @@
+From 11ab7be947064f11453f1063f63455b343b7253d Mon Sep 17 00:00:00 2001
+From: Raziman T V <razimantv@gmail.com>
+Date: Fri, 3 Jul 2026 13:36:29 +0100
+Subject: [PATCH] Fix #129 (caused by matplotlib 3.11 deprecating
+ mpl.style.core) by direct implementation
+
+---
+ catppuccin/extras/matplotlib.py | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/catppuccin/extras/matplotlib.py b/catppuccin/extras/matplotlib.py
+index 52934d1..f0ffafb 100644
+--- a/catppuccin/extras/matplotlib.py
++++ b/catppuccin/extras/matplotlib.py
+@@ -72,6 +72,7 @@
+ import matplotlib as mpl
+ import matplotlib.colors
+ import matplotlib.style
++from matplotlib import rc_params_from_file
+ 
+ from catppuccin.palette import PALETTE
+ 
+@@ -84,10 +85,10 @@
+ 
+ def _register_styles() -> None:
+     """Register the included stylesheets in the mpl style library."""
+-    catppuccin_stylesheets = mpl.style.core.read_style_directory(  # type: ignore [attr-defined]
+-        CATPPUCCIN_STYLE_DIRECTORY
+-    )
+-    mpl.style.core.update_nested_dict(mpl.style.library, catppuccin_stylesheets)  # type: ignore [attr-defined]
++    for path in Path(CATPPUCCIN_STYLE_DIRECTORY).glob(f"*.mplstyle"):
++        stylename = path.stem
++        style = rc_params_from_file(path, use_default_template=False)
++        mpl.style.library.setdefault(stylename, {}).update(style)
+ 
+ 
+ def _register_colormap_list() -> None:

pkgs/development/python-modules/dsmr-parser/default.nix

@@ -12,14 +12,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "dsmr-parser";
-  version = "1.11.0";
+  version = "1.11.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ndokter";
     repo = "dsmr_parser";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-utpirGJ9M+2HAOcTAE325hIHOHgHrsBYisDGGQ1PKWY=";
+    hash = "sha256-2q2e1/xt8a24QmACZUc9zWOnAiFhEYMg+44kOlx1JAk=";
   };
 
   pythonRelaxDeps = [ "dlms_cosem" ];

pkgs/development/python-modules/langchain-anthropic/default.nix

@@ -74,6 +74,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "langchain-anthropic==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

pkgs/development/python-modules/langchain-aws/default.nix

@@ -91,6 +91,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "langchain-aws==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

pkgs/development/python-modules/langchain-azure-dynamic-sessions/default.nix

@@ -79,6 +79,7 @@ buildPythonPackage rec {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "langchain-azure-dynamic-sessions==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

pkgs/development/python-modules/langchain-chroma/default.nix

@@ -62,6 +62,7 @@ buildPythonPackage rec {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "langchain-chroma==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

pkgs/development/python-modules/langchain-classic/default.nix

@@ -106,6 +106,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "langchain-classic==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

pkgs/development/python-modules/langchain-community/default.nix

@@ -129,6 +129,7 @@ buildPythonPackage rec {
 
   passthru.updateScript = gitUpdater {
     rev-prefix = "libs/community/v";
+    ignoredVersions = "a|b|dev|rc";
   };
 
   meta = {

pkgs/development/python-modules/langchain-core/default.nix

@@ -92,6 +92,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "langchain-core==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

pkgs/development/python-modules/langchain-deepseek/default.nix

@@ -65,6 +65,7 @@ buildPythonPackage rec {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "langchain-deepseek==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

pkgs/development/python-modules/langchain-fireworks/default.nix

@@ -73,6 +73,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "langchain-fireworks==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

pkgs/development/python-modules/langchain-google-genai/default.nix

@@ -87,6 +87,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "libs/genai/v";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

pkgs/development/python-modules/langchain-groq/default.nix

@@ -68,6 +68,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "langchain-groq==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

pkgs/development/python-modules/langchain-huggingface/default.nix

@@ -87,6 +87,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "langchain-huggingface==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

pkgs/development/python-modules/langchain-mistralai/default.nix

@@ -72,6 +72,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "langchain-mistralai==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

pkgs/development/python-modules/langchain-mongodb/default.nix

@@ -100,6 +100,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "libs/langchain-mongodb/v";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

pkgs/development/python-modules/langchain-ollama/default.nix

@@ -69,6 +69,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "langchain-ollama==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

pkgs/development/python-modules/langchain-openai/default.nix

@@ -98,6 +98,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "langchain-openai==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

pkgs/development/python-modules/langchain-perplexity/default.nix

@@ -68,6 +68,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "langchain-perplexity==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

pkgs/development/python-modules/langchain-tests/default.nix

@@ -81,6 +81,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "langchain-tests==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

pkgs/development/python-modules/langchain-text-splitters/default.nix

@@ -53,6 +53,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "langchain-text-splitters==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

pkgs/development/python-modules/langchain-xai/default.nix

@@ -67,6 +67,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "langchain-xai==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

pkgs/development/python-modules/langchain/default.nix

@@ -144,6 +144,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "langchain==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

pkgs/development/python-modules/langgraph-checkpoint-mongodb/default.nix

@@ -51,6 +51,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "libs/langgraph-checkpoint-mongodb/v";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

pkgs/development/python-modules/langgraph-checkpoint-postgres/default.nix

@@ -97,6 +97,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "checkpointpostgres==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

pkgs/development/python-modules/langgraph-checkpoint-sqlite/default.nix

@@ -80,6 +80,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "checkpointsqlite==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

pkgs/development/python-modules/langgraph-checkpoint/default.nix

@@ -66,6 +66,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "checkpoint==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

pkgs/development/python-modules/langgraph-cli/default.nix

@@ -93,6 +93,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "cli==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

pkgs/development/python-modules/langgraph-prebuilt/default.nix

@@ -97,6 +97,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "prebuilt==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

pkgs/development/python-modules/langgraph-sdk/default.nix

@@ -57,6 +57,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "sdk==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

pkgs/development/python-modules/onvif-zeep-async/default.nix

@@ -11,14 +11,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "onvif-zeep-async";
-  version = "4.2.0";
+  version = "4.2.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "openvideolibs";
     repo = "python-onvif-zeep-async";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GmrXU+aGjllrZ6MEaACTEXBQTd0UU45eD0yoMIn1dUI=";
+    hash = "sha256-7o9rzpXLNX5Ibaj74bNbFZ6v55SMDyzYjutvimOxbYk=";
   };
 
   postPatch = ''

pkgs/development/python-modules/py-synologydsm-api/default.nix

@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "py-synologydsm-api";
-  version = "2.10.2";
+  version = "2.10.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mib1185";
     repo = "py-synologydsm-api";
     tag = "v${version}";
-    hash = "sha256-LILtlgUCSL+107axBZOIjqbS4kAXWLxt9936tpvW3XA=";
+    hash = "sha256-r2f/fVcDg9zDjTBKupkNQD4zQbeTKvZB7AWyncrRKH8=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/pycaption/default.nix

@@ -13,14 +13,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pycaption";
-  version = "2.2.26";
+  version = "2.2.28";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pbs";
     repo = "pycaption";
     tag = finalAttrs.version;
-    hash = "sha256-6y8c/FT4POM1xKnH3+M4MkvCiysNqVLEb650G3F3NGw=";
+    hash = "sha256-BXDCjUqJVuVCehusrk5j4+yZTimnmOcHMWheWJJoJOo=";
   };
 
   build-system = [ setuptools ];