Merge master into staging-next

2026-07-22 00:20:58 +00:00 · 2026-07-19 00:32:07 +00:00
parent d133e7e82f 2a83e50fab
commit 6ceeb3d4ea
72 changed files with 7671 additions and 3154 deletions
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -59,7 +59,7 @@ jobs:
          merged-as-untrusted-at: ${{ inputs.mergedSha }}
          target-as-trusted-at: ${{ inputs.targetSha }}

-      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
        with:
          # Sandbox is disabled on MacOS by default.
          extra_nix_config: sandbox = true
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -147,7 +147,7 @@ jobs:
          merged-as-untrusted-at: ${{ inputs.mergedSha }}
          target-as-trusted-at: ${{ inputs.targetSha }}

-      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0

      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        continue-on-error: true
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -139,7 +139,7 @@ jobs:
            core.info(`Found pinned.json commit: ${ciPinBumpCommit}`)

      - name: Install Nix
-        uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0

      - name: Load supported versions
        id: versions
@@ -187,7 +187,7 @@ jobs:
          target-as-trusted-at: ${{ inputs.targetSha }}

      - name: Install Nix
-        uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0

      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        continue-on-error: true
@@ -277,7 +277,7 @@ jobs:
          merge-multiple: true

      - name: Install Nix
-        uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0

      - name: Combine all output paths and eval stats
        run: |
@@ -486,7 +486,7 @@ jobs:
          merged-as-untrusted-at: ${{ inputs.mergedSha }}

      - name: Install Nix
-        uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0

      - name: Ensure flake outputs on all systems still evaluate
        run: nix flake check --all-systems --no-build './nixpkgs/untrusted?shallow=1'
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -35,7 +35,7 @@ jobs:
        with:
          merged-as-untrusted-at: ${{ inputs.mergedSha }}

-      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0

      # TODO: Figure out how to best enable caching for the treefmt job. Cachix won't work well,
      # because the cache would be invalidated on every commit - treefmt checks every file.
@@ -70,7 +70,7 @@ jobs:
        with:
          merged-as-untrusted-at: ${{ inputs.mergedSha }}

-      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0

      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        continue-on-error: true
@@ -100,7 +100,7 @@ jobs:
          merged-as-untrusted-at: ${{ inputs.mergedSha }}
          target-as-trusted-at: ${{ inputs.targetSha }}

-      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0

      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        continue-on-error: true
--- a/doc/release-notes/rl-2611.section.md
+++ b/doc/release-notes/rl-2611.section.md
@@ -45,6 +45,8 @@

 - `python3Packages.django-health-check` has been updated to major version 4. See its [migration guide](https://codingjoe.dev/django-health-check/migrate-to-v4/) and [changelog](https://github.com/codingjoe/django-health-check/releases/tag/4.0.0) for breaking changes.

+- `jmtpfs` has been removed due to lack of maintenance and fuse3 support.
+
 - `libgdata` has been removed, as it was archived upstream and relied on the insecure libsoup 2.4.

 - `mcphost` has been removed, as it was archived upstream and declared unmaintained.
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -6380,6 +6380,12 @@
    github = "David-Kopczynski";
    githubId = 53194670;
  };
+  David-Moody = {
+    name = "David Moody";
+    email = "david.moody@scot.me.uk";
+    github = "David-Moody";
+    githubId = 63956662;
+  };
  david-sawatzke = {
    email = "d-nix@sawatzke.dev";
    github = "david-sawatzke";
@@ -20175,6 +20181,12 @@
    github = "nigelgbanks";
    githubId = 487373;
  };
+  nightconcept = {
+    email = "dark@nightconcept.net";
+    github = "nightconcept";
+    githubId = 486025;
+    name = "Danny Solivan";
+  };
  nikhilmaddirala = {
    name = "Nikhil Maddirala";
    github = "nikhilmaddirala";
@@ -27254,6 +27266,13 @@
    githubId = 36695359;
    name = "Vasyl Solovei";
  };
+  swaggeroo = {
+    email = "swaggerooo@pm.me";
+    github = "swaggeroo";
+    githubId = 57057662;
+    name = "Swaggeroo";
+    keys = [ { fingerprint = "D221 99EC 4FFF EF4D F29D  2435 5208 74E7 3291 4E0B"; } ];
+  };
  swarren83 = {
    email = "shawn.w.warren@gmail.com";
    github = "swarren83";
--- a/nixos/modules/services/monitoring/prometheus/exporters/imap-mailstat.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/imap-mailstat.nix
@@ -94,8 +94,8 @@ in
    serviceConfig = {
      ExecStart = ''
        ${pkgs.prometheus-imap-mailstat-exporter}/bin/imap-mailstat-exporter \
-          -config ${createConfigFile cfg.accounts} \
-          ${optionalString cfg.oldestUnseenDate "-oldestunseendate"} \
+          --config.file="${createConfigFile cfg.accounts}" \
+          ${optionalString cfg.oldestUnseenDate "--oldestunseen.feature"} \
          ${concatStringsSep " \\\n  " cfg.extraFlags}
      '';
    };
--- a/nixos/tests/cockpit.nix
+++ b/nixos/tests/cockpit.nix
@@ -102,7 +102,6 @@ in
                  from selenium.webdriver.firefox.options import Options
                  from selenium.webdriver.support.ui import WebDriverWait
                  from selenium.webdriver.support import expected_conditions as EC
-                  from time import sleep


                  def log(msg):
@@ -129,7 +128,7 @@ in
                      wait.until(EC.presence_of_element_located((by, query)))


-                  def wait_title_contains(title, timeout=10):
+                  def wait_title_contains(title, timeout=30):
                      wait = WebDriverWait(driver, timeout)
                      wait.until(EC.title_contains(title))

@@ -138,11 +137,6 @@ in
                      return driver.find_element(by, query)


-                  def set_value(elem, value):
-                      script = 'arguments[0].value = arguments[1]'
-                      return driver.execute_script(script, elem, value)
-
-
                  log("Waiting for the homepage to load")

                  # cockpit sets initial title as hostname
@@ -151,36 +145,45 @@ in

                  log("Homepage loaded!")

+                  # Prefer send_keys over setting .value via JS: Cockpit's login
+                  # form (and PatternFly widgets) do not always react to the latter.
                  log("Filling out username")
                  login_input = find_element(By.CSS_SELECTOR, 'input#login-user-input')
-                  set_value(login_input, "${user}")
+                  login_input.clear()
+                  login_input.send_keys("${user}")

                  log("Filling out password")
-                  password_input = find_element(By.CSS_SELECTOR, 'input#login-password-input')
-                  set_value(password_input, "${password}")
+                  password_input = find_element(
+                      By.CSS_SELECTOR, 'input#login-password-input'
+                  )
+                  password_input.clear()
+                  password_input.send_keys("${password}")

                  log("Submitting credentials for login")
                  driver.find_element(By.CSS_SELECTOR, 'button#login-button').click()

-                  # driver.implicitly_wait(1)
-                  # driver.get("https://server:7890/system")
-
                  log("Waiting dashboard to load")
                  wait_title_contains("${user}@server")

-                  log("Waiting for the frontend to initialize")
-                  sleep(1)
-
                  log("Looking for that banner that tells about limited access")
-                  container_iframe = find_element(By.CSS_SELECTOR, 'iframe.container-frame')
+                  wait_elem(By.CSS_SELECTOR, 'iframe.container-frame', timeout=30)
+                  container_iframe = find_element(
+                      By.CSS_SELECTOR, 'iframe.container-frame'
+                  )
                  driver.switch_to.frame(container_iframe)
-
-                  assert "Web console is running in limited access mode" in driver.page_source
+                  # Wait for the overview iframe to render the limited-access alert.
+                  # Fixed sleeps were flaky after Cockpit 364 (slower SPA init).
+                  phrase = "Web console is running in limited access mode"
+                  WebDriverWait(driver, 30).until(
+                      lambda d: phrase in d.page_source
+                  )

                  log("Clicking the sudo button")
+                  # Button label is "Turn on administrative access"
                  for button in driver.find_elements(By.TAG_NAME, "button"):
-                      if 'admin' in button.text:
+                      if 'admin' in button.text.casefold():
                          button.click()
+                          break
                  driver.switch_to.default_content()

                  log("Checking that /nonexistent is not a thing")
@@ -189,13 +192,17 @@ in

                  log("Checking plugin path")
                  driver.get("https://server:7890/hello-test")
-                  sleep(2)
+                  wait_elem(By.CSS_SELECTOR, 'iframe.container-frame', timeout=30)
                  for iframe in driver.find_elements(By.TAG_NAME, "iframe"):
                      if "hello-test" in (iframe.get_attribute("src") or ""):
                          driver.switch_to.frame(iframe)
                          break
-                  text = driver.find_element(By.ID, "output").text
-                  sleep(1)
+                  output = find_element(By.ID, "output")
+                  WebDriverWait(driver, 30).until(
+                      lambda d: "SUCCESS: Hello, world!" in output.text
+                      or output.text.startswith("FAILED:")
+                  )
+                  text = output.text
                  assert "SUCCESS: Hello, world!" in text, f"Plugin failed: {text}"

                  driver.close()
@@ -215,8 +222,10 @@ in

    server.wait_for_unit("sockets.target")
    server.wait_for_open_port(7890)
+    # Port open is not enough: cockpit-ws may still be finishing startup.
+    server.wait_until_succeeds("curl -k https://127.0.0.1:7890 -o /dev/null")

-    client.succeed("curl -k https://server:7890 -o /dev/stderr")
+    client.wait_until_succeeds("curl -k https://server:7890 -o /dev/stderr")
    print(client.succeed("whoami"))
    client.succeed('PYTHONUNBUFFERED=1 selenium-script')
  '';
--- a/nixos/tests/mtp.nix
+++ b/nixos/tests/mtp.nix
@@ -23,7 +23,6 @@
        environment.systemPackages = with pkgs; [
          usbutils
          glib
-          jmtpfs
          tree
        ];
        services.gvfs.enable = true;
@@ -88,22 +87,6 @@
          ${unmountAllMtpDevices}
        '';
      };
-      jmtpfs = {
-        # jmtpfsTest:
-        # 1. Mounts the device on a dir named `phone` using jmtpfs
-        # 2. Puts the current Nixpkgs libmtp version into a file
-        # 3. Checks for corruption with `diff`
-        # 4. Prints the directory tree
-        jmtpfsTest = pkgs.writeScript "jmtpfsTest.sh" ''
-          set -e
-          mkdir phone
-          jmtpfs phone
-          echo "${pkgs.libmtp.version}" > phone/tmp/testFile
-          echo "${pkgs.libmtp.version}" > testFile
-          diff phone/tmp/testFile testFile
-          tree phone
-        '';
-      };
    in
    # Using >&2 allows the results of the scripts to be printed to the terminal
    # when building this test with Nix. Scripts would otherwise complete
@@ -113,6 +96,5 @@
      client.wait_for_unit("multi-user.target")
      client.wait_for_unit("dbus.service")
      client.succeed("${gvfs.gvfsTest} >&2")
-      client.succeed("${jmtpfs.jmtpfsTest} >&2")
    '';
 }
--- a/pkgs/applications/editors/vscode/with-extensions.nix
+++ b/pkgs/applications/editors/vscode/with-extensions.nix
@@ -92,12 +92,14 @@ runCommand "${wrappedPkgName}-with-extensions-${wrappedPkgVersion}"
        mkdir -p $out/bin/
        mkdir -p "$out/Applications/${longName}.app/Contents/MacOS"

+        binary_name="$(awk -F'[<>]' '/CFBundleExecutable/{getline; print $3}' '${vscode}/Applications/${longName}.app/Contents/Info.plist')"
+
        for path in PkgInfo Frameworks Resources _CodeSignature Info.plist; do
          ln -s "${vscode}/Applications/${longName}.app/Contents/$path" "$out/Applications/${longName}.app/Contents/"
        done

        makeWrapper "${vscode}/bin/${executableName}" "$out/bin/${executableName}" ${extensionsFlag}
-        makeWrapper "${vscode}/Applications/${longName}.app/Contents/MacOS/Electron" "$out/Applications/${longName}.app/Contents/MacOS/Electron" ${extensionsFlag}
+        makeWrapper "${vscode}/Applications/${longName}.app/Contents/MacOS/$binary_name" "$out/Applications/${longName}.app/Contents/MacOS/$binary_name" ${extensionsFlag}
      ''
    else
      ''
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -73,13 +73,13 @@
    "vendorHash": "sha256-FHBpTYSmVivoqz+Eaa/r5y1f/saIx4l6mjOtZhxZVRw="
  },
  "auth0_auth0": {
-    "hash": "sha256-qN4nGtvncIYeNhwrITNniZWIA8wzRwsnssXsMqg6X+o=",
+    "hash": "sha256-c/pgoD8aNcYQUjrPz4SobpJ+C8d4me5K6HKsAZPYdTg=",
    "homepage": "https://registry.terraform.io/providers/auth0/auth0",
    "owner": "auth0",
    "repo": "terraform-provider-auth0",
-    "rev": "v1.52.0",
+    "rev": "v1.53.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-DCze5QxfJL4cZjTBzOil+PFQ2QA7OI5gZCEchu+kcK4="
+    "vendorHash": "sha256-Lv01jBbXTQOFQ4ljhqpx/n2fvvMNfGUHXfYDMlLDkdM="
  },
  "aviatrixsystems_aviatrix": {
    "hash": "sha256-46djOfAj/5kfeoKLQHbeKefzdGbmlBATR+uN/IaAn8I=",
@@ -391,11 +391,11 @@
    "vendorHash": "sha256-WFlKj1IO9ylXn5frdnLcctQawjUXBTqcoMhQUQTU06A="
  },
  "exoscale_exoscale": {
-    "hash": "sha256-JSDlAtLvbk36OBUV22JoSrxV7nRegDirdyOUobUwrWg=",
+    "hash": "sha256-QIYIqJI/xznbkqR8E8R2LwF15M6ZdEntQ8JtdIwZypM=",
    "homepage": "https://registry.terraform.io/providers/exoscale/exoscale",
    "owner": "exoscale",
    "repo": "terraform-provider-exoscale",
-    "rev": "v0.69.3",
+    "rev": "v0.70.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@@ -481,11 +481,11 @@
    "vendorHash": "sha256-N0AYv7XGmo7D1gcDGsmO9JoBGRiJWj10OZptWgO7NPs="
  },
  "grafana_grafana": {
-    "hash": "sha256-UE18qAYXDChi/uvTwUtSfBfS0izcLA+kBvSKm5pnx7A=",
+    "hash": "sha256-ZZpk0I9MIiGpS354rER+HZNsB5S0U+fQaaCu5Lu5BL4=",
    "homepage": "https://registry.terraform.io/providers/grafana/grafana",
    "owner": "grafana",
    "repo": "terraform-provider-grafana",
-    "rev": "v4.40.1",
+    "rev": "v4.41.0",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-AyVCuqbVPoEMgcDmJsyJDstYFkukoDq7iIkfbvlAiE0="
  },
@@ -517,13 +517,13 @@
    "vendorHash": "sha256-lxxSwaBXrl2xrZJ+OHrCBvHKmsq3D9Om7/Y0zPaYIQg="
  },
  "hashicorp_awscc": {
-    "hash": "sha256-z1wns0zuanfoeIb7CDRBtt4CoRQ4+b5PNKpmDbfyHd0=",
+    "hash": "sha256-SziDO4K6qv62zolBKdrhXIyaEOMM5hJ0h6ros1wC2l0=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/awscc",
    "owner": "hashicorp",
    "repo": "terraform-provider-awscc",
-    "rev": "v1.92.0",
+    "rev": "v1.93.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-/kcUQo6hd1TxP6rEoTsll0ZRL2BXdRg8vxIoJ9VmzTs="
+    "vendorHash": "sha256-dGxUV7gK4Af4O6FnZ2Pm6OKX0/xVU9+8nfUd0R/ot+Y="
  },
  "hashicorp_azuread": {
    "hash": "sha256-mEYEZIztDjyqWSJFoJPXtV0E9YikumtwGVtZA4Jfw3U=",
@@ -968,13 +968,13 @@
    "vendorHash": "sha256-OAd8SeTqTrH0kMoM2LsK3vM2PI23b3gl57FaJYM9hM0="
  },
  "newrelic_newrelic": {
-    "hash": "sha256-yUrsJS/ff7Ie3xExtPw+Gtxh0S3Cyif5DKL0Q8D9qGU=",
+    "hash": "sha256-qElRjPX7275o7HxTXzwNNJbh3Wjn1EJ6NnHq17Ant4o=",
    "homepage": "https://registry.terraform.io/providers/newrelic/newrelic",
    "owner": "newrelic",
    "repo": "terraform-provider-newrelic",
-    "rev": "v3.94.3",
+    "rev": "v3.95.2",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-2A5YwkS2nVGO61Y8jXIGdAUHJP+/3RoY40720uiTwHk="
+    "vendorHash": "sha256-NS/TY/GJIEBszm4pwy0Z7aj3pFIozenGvRp0+v07Zfw="
  },
  "ns1-terraform_ns1": {
    "hash": "sha256-6w0r6QXm16h4I4PFj80dJhTDbF4FPMjJalO0TfXGBEA=",
@@ -1463,13 +1463,13 @@
    "vendorHash": "sha256-WXw9H/BQj0ZEW5YLRHWTiXF4VyaVpwlxWO4Hfy4/NdM="
  },
  "vmware_vcd": {
-    "hash": "sha256-W+ffIT70IaePg3xfOaQgCjPTWTN3iSAYwkf+s+zkB84=",
+    "hash": "sha256-/o1bINYaSJXqFkda3N2iRwno2QVCE+KaLLGjvlllMEw=",
    "homepage": "https://registry.terraform.io/providers/vmware/vcd",
    "owner": "vmware",
    "repo": "terraform-provider-vcd",
-    "rev": "v3.14.1",
+    "rev": "v3.14.2",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-eCIJ2w8DjmUCGp0VbliLaQ6C29mJhl6Spya06Xyiqd4="
+    "vendorHash": "sha256-CnYLJAvhyx0NS+ng4qLCu/ZR774dMmw3iJjWt78FVHE="
  },
  "vmware_wavefront": {
    "hash": "sha256-yNNtOkodzwxKvHQq9GZlUicezGW6u2ih6ry/cOtJQGM=",
--- a/pkgs/by-name/am/amphetype/package.nix
+++ b/pkgs/by-name/am/amphetype/package.nix
@@ -1,5 +1,6 @@
 {
  lib,
+  stdenv,
  copyDesktopItems,
  fetchFromGitLab,
  makeDesktopItem,
@@ -28,7 +29,8 @@ python3Packages.buildPythonApplication {
    qt5.wrapQtAppsHook
  ];

-  buildInputs = [
+  # qtwayland is a Linux-only Qt platform plugin; it is unsupported on Darwin.
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
    qt5.qtwayland
  ];

--- a/pkgs/by-name/bf/bfetch/package.nix
+++ b/pkgs/by-name/bf/bfetch/package.nix
@@ -7,7 +7,7 @@

 stdenvNoCC.mkDerivation {
  pname = "bfetch";
-  version = "unstable-2021-05-21";
+  version = "1.0.1-unstable-2021-05-21";

  src = fetchFromGitHub {
    owner = "NNBnh";
--- a/pkgs/by-name/ch/chez-racket/package.nix
+++ b/pkgs/by-name/ch/chez-racket/package.nix
@@ -15,7 +15,7 @@ let
    else if stdenv.hostPlatform.isPower then
      "ppc${toString stdenv.hostPlatform.parsed.cpu.bits}"
    else
-      throw "Add ${stdenv.hostPlatform.parsed.cpu.arch} to chezArch to enable building chez-racket";
+      throw "Add ${stdenv.hostPlatform.parsed.cpu.name} to chezArch to enable building chez-racket";

  chezOs =
    if stdenv.hostPlatform.isDarwin then
--- a/pkgs/by-name/ch/chez-racket/shared.nix
+++ b/pkgs/by-name/ch/chez-racket/shared.nix
@@ -56,7 +56,9 @@ stdenv.mkDerivation (
      homepage = "https://github.com/racket/ChezScheme";
      license = lib.licenses.asl20;
      maintainers = [ ];
-      platforms = lib.platforms.unix;
+      platforms = lib.intersectLists lib.platforms.unix (
+        lib.platforms.x86 ++ lib.platforms.aarch64 ++ lib.platforms.arm ++ lib.platforms.power
+      );
    };
  }
 )
--- a/pkgs/by-name/cq/cqlsh-rs/Cargo.lock
+++ b/pkgs/by-name/cq/cqlsh-rs/Cargo.lock
--- a/pkgs/by-name/cq/cqlsh-rs/package.nix
+++ b/pkgs/by-name/cq/cqlsh-rs/package.nix
@@ -0,0 +1,78 @@
+{
+  lib,
+  stdenv,
+  rustPlatform,
+  fetchFromGitHub,
+  testers,
+  installShellFiles,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "cqlsh-rs";
+  version = "0.5.12";
+
+  src = fetchFromGitHub {
+    owner = "scylladb";
+    repo = "cqlsh-rs";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-0lxhO5mAcmF8lKzHUzUERjvvJVaPJ0VvZCu0ROPBRBY=";
+  };
+
+  # Upstream does not commit Cargo.lock.
+  # See https://github.com/scylladb/cqlsh-rs/issues/172
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+  };
+
+  postPatch = ''
+    ln -sf ${./Cargo.lock} Cargo.lock
+  '';
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    # Ensure deterministic Mach-O UUID on Darwin.
+    SOURCE_DATE_EPOCH = 1;
+  };
+
+  preBuild = ''
+    # Remap build directory paths for deterministic output.
+    # Must be set in preBuild (not env) because $NIX_BUILD_TOP is a runtime
+    # bash variable that cannot be expanded in Nix string literals, and
+    # __structuredAttrs re-applies env vars between phases.
+    export RUSTFLAGS="--remap-path-prefix=$NIX_BUILD_TOP=/build ''${RUSTFLAGS:-}"
+  '';
+
+  # Only compile and run lib tests; skip integration tests and their heavy
+  # dev-deps (testcontainers, criterion, etc.) which require Docker/network.
+  cargoTestFlags = [ "--lib" ];
+
+  # Pager tests use std::env::set_var("PAGER", ...) which is not thread-safe;
+  # running tests serially avoids intermittent failures from env var races.
+  dontUseCargoParallelTests = true;
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installManPage --name cqlsh-rs.1 <($out/bin/cqlsh-rs --generate-man)
+
+    installShellCompletion --cmd cqlsh-rs \
+      --bash <($out/bin/cqlsh-rs --completions bash) \
+      --fish <($out/bin/cqlsh-rs --completions fish) \
+      --zsh <($out/bin/cqlsh-rs --completions zsh)
+  '';
+
+  passthru.tests.version = testers.testVersion {
+    package = finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "Rust re-implementation of the Apache Cassandra cqlsh shell";
+    homepage = "https://scylladb.github.io/cqlsh-rs/";
+    changelog = "https://github.com/scylladb/cqlsh-rs/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ aaronjheng ];
+    mainProgram = "cqlsh-rs";
+  };
+})
--- a/pkgs/by-name/cu/cubeb/package.nix
+++ b/pkgs/by-name/cu/cubeb/package.nix
@@ -24,13 +24,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "cubeb";
-  version = "0-unstable-2026-07-03";
+  version = "0-unstable-2026-07-16";

  src = fetchFromGitHub {
    owner = "mozilla";
    repo = "cubeb";
-    rev = "a665efba31740bd477cf2001a5cb289a63e85336";
-    hash = "sha256-X3lgGFJpTHd9c7t3bP+iohHyQ18+YJFghjLnJyPk6wU=";
+    rev = "0942f635f78049fc8af24939effed255ae0d0044";
+    hash = "sha256-RQqmrRXRABsNDjGztsLLjsZlZFBEeAAc/ysoDj6CT1A=";
  };

  outputs = [
--- a/pkgs/by-name/de/deej/package.nix
+++ b/pkgs/by-name/de/deej/package.nix
@@ -0,0 +1,60 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  pkg-config,
+  gtk3,
+  libappindicator-gtk3,
+  webkitgtk_4_1,
+}:
+
+buildGoModule {
+  pname = "deej";
+  version = "0.9.10";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "omriharel";
+    repo = "deej";
+    rev = "v0.9.10";
+    hash = "sha256-T6S3FQ9vxl4R3D+uiJ83z1ueK+3pfASEjpRI+HjIV0M=";
+  };
+
+  vendorHash = "sha256-1gjFPD7YV2MTp+kyC+hsj+NThmYG3hlt6AlOzXmEKyA=";
+
+  subPackages = [ "cmd" ];
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    gtk3
+    libappindicator-gtk3
+    webkitgtk_4_1
+  ];
+
+  preBuild = ''
+    # getlantern/systray hardcodes webkit2gtk-4.0
+    for file in $(grep -rl "webkit2gtk-4.0" .); do
+      substituteInPlace "$file" --replace-fail "webkit2gtk-4.0" "webkit2gtk-4.1"
+    done
+  '';
+
+  postInstall = ''
+    mv $out/bin/cmd $out/bin/deej
+  '';
+
+  meta = with lib; {
+    description = "Open-source hardware volume mixer for Windows and Linux";
+    longDescription = ''
+      deej is an open-source hardware volume mixer for Windows and Linux.
+      It lets you use real-world sliders (potentiometers) to control the
+      volume of individual apps (like Discord, Spotify and Games) independently.
+    '';
+    homepage = "https://github.com/omriharel/deej";
+    license = lib.licenses.mit;
+    maintainers = with maintainers; [ swaggeroo ];
+    platforms = platforms.linux;
+    mainProgram = "deej";
+  };
+}
--- a/pkgs/by-name/de/delta/package.nix
+++ b/pkgs/by-name/de/delta/package.nix
@@ -1,6 +1,7 @@
 {
  lib,
  rustPlatform,
+  buildPackages,
  fetchFromGitHub,
  installShellFiles,
  pkg-config,
@@ -42,12 +43,17 @@ rustPlatform.buildRustPackage (finalAttrs: {
    RUSTONIG_SYSTEM_LIBONIG = true;
  };

-  postInstall = ''
-    installShellCompletion --cmd delta \
-      --bash <($out/bin/delta --generate-completion bash) \
-      --fish <($out/bin/delta --generate-completion fish) \
-      --zsh <($out/bin/delta --generate-completion zsh)
-  '';
+  postInstall = lib.optionalString (stdenv.hostPlatform.emulatorAvailable buildPackages) (
+    let
+      emulator = stdenv.hostPlatform.emulator buildPackages;
+    in
+    ''
+      installShellCompletion --cmd delta \
+        --bash <(${emulator} $out/bin/delta --generate-completion bash) \
+        --fish <(${emulator} $out/bin/delta --generate-completion fish) \
+        --zsh <(${emulator} $out/bin/delta --generate-completion zsh)
+    ''
+  );

  # test_env_parsing_with_pager_set_to_bat sets environment variables,
  # which can be flaky with multiple threads:
--- a/pkgs/by-name/do/dotenvx/package.nix
+++ b/pkgs/by-name/do/dotenvx/package.nix
@@ -7,16 +7,16 @@

 buildNpmPackage (finalAttrs: {
  pname = "dotenvx";
-  version = "2.3.2";
+  version = "2.14.0";

  src = fetchFromGitHub {
    owner = "dotenvx";
    repo = "dotenvx";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-eDwnuwL+rJiUGV8+Q6zm7ADnSF9WKquu55GJDocDLRA=";
+    hash = "sha256-lFAnH1BcVRTvFyP5gOteNfokU0zYaoIY45df9fQ9cuA=";
  };

-  npmDepsHash = "sha256-MpGKkyj0UdvyjImH04NhNWgZ2POFIf7pzSkxkgglrp4=";
+  npmDepsHash = "sha256-7EvZ3QOAiu2GPvDbHVfrbaF/0lAscH9lfsukv4WtBK0=";

  dontNpmBuild = true;

--- a/pkgs/by-name/en/endless-sky/package.nix
+++ b/pkgs/by-name/en/endless-sky/package.nix
@@ -7,7 +7,9 @@
  libpng,
  libjpeg,
  libogg,
+  libsm,
  libx11,
+  libxext,
  flac,
  glew,
  openal,
@@ -23,13 +25,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "endless-sky";
-  version = "0.11.1";
+  version = "0.11.2";

  src = fetchFromGitHub {
    owner = "endless-sky";
    repo = "endless-sky";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-QXLIHAAdpK6lvKv0471KsiB+B06RKUfYoUNYKi8NAlg=";
+    hash = "sha256-v+0RrZqIkF849D8rmOhYS1kqeeCPRcBED+3VPSuhGF0=";
  };

  patches = lib.optionals stdenv.hostPlatform.isLinux [
@@ -78,6 +80,8 @@ stdenv.mkDerivation (finalAttrs: {
    libpng
    libjpeg
    libogg
+    libsm
+    libxext
    flac
    openal
    libmad
--- a/pkgs/by-name/en/ente-web/package.nix
+++ b/pkgs/by-name/en/ente-web/package.nix
@@ -1,18 +1,15 @@
 {
  lib,
-  stdenv,
+  buildNpmPackage,
  binaryen,
  cargo,
  fetchFromGitHub,
-  fetchYarnDeps,
  nodejs,
  rustPlatform,
  rustc,
  sd,
-  wasm-bindgen-cli_0_2_108,
+  wasm-bindgen-cli_0_2_125,
  wasm-pack,
-  yarnConfigHook,
-  yarnBuildHook,
  writeScript,
  extraBuildEnv ? { },
  # This package contains serveral sub-applications. This specifies which of them you want to build.
@@ -25,9 +22,9 @@
  nixosTests,
 }:

-stdenv.mkDerivation (finalAttrs: {
+buildNpmPackage (finalAttrs: {
  pname = "ente-web-${enteApp}";
-  version = "1.3.36";
+  version = "1.3.58";

  src = fetchFromGitHub {
    owner = "ente";
@@ -38,7 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
    ];
    tag = "photos-v${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-o75r8LFgG3BT3IIPiD9x6gY3fRDoxJ3ZTBPAYr3hLWI=";
+    hash = "sha256-44iid/vsx3rKt/NGCgdZweJHW24ysQ7qSRq8Hayng9c=";
  };
  sourceRoot = "${finalAttrs.src.name}/web";

@@ -50,25 +47,20 @@ stdenv.mkDerivation (finalAttrs: {
      sourceRoot
      cargoRoot
      ;
-    hash = "sha256-NYPxaVYEaJVcsRX6wLVJd+/UUJrNel0zTPYGdEv8a+U=";
+    hash = "sha256-dyDNhDNbcssV4mTzGZkysTftgFfKXNLX2S0jmkX5JR4=";
  };
-  cargoRoot = "packages/wasm";
+  cargoRoot = "../rust";

-  offlineCache = fetchYarnDeps {
-    yarnLock = "${finalAttrs.src}/web/yarn.lock";
-    hash = "sha256-eGu+s8g0nGijYfjo8RkT5/iBfbwk5cBMacbe/gO03NI=";
-  };
+  npmDepsHash = "sha256-JZnF6MfEkm4HCslEgpAuCrSYQYnt8tNPUTFRb1CIVe4=";

  nativeBuildInputs = [
-    yarnConfigHook
-    yarnBuildHook
    binaryen
    cargo
    rustPlatform.cargoSetupHook
    rustc
    rustc.llvmPackages.lld
    nodejs
-    wasm-bindgen-cli_0_2_108
+    wasm-bindgen-cli_0_2_125
    wasm-pack
  ];

@@ -76,9 +68,15 @@ stdenv.mkDerivation (finalAttrs: {
  env = extraBuildEnv;

  postPatch =
+    # The Rust workspace lives in `../rust`, outside the `web` sourceRoot, so it
+    # is not made writable during unpacking. `wasm-pack` needs to create a cargo
+    # target directory there, so make it writable.
+    ''
+      chmod -R u+w ../rust
+    ''
    # Use our `wasm-pack` binary, rather than the Node version, which is
    # just a wrapper that tries to download the actual binary
-    ''
+    + ''
      substituteInPlace \
        packages/wasm/package.json \
        --replace-fail "wasm-pack " ${lib.escapeShellArg "${wasm-pack}/bin/wasm-pack "}
@@ -92,7 +90,7 @@ stdenv.mkDerivation (finalAttrs: {
      done
    '';

-  yarnBuildScript = "build:${enteApp}";
+  npmBuildScript = "build:${enteApp}";
  installPhase =
    let
      distName = if enteApp == "payments" then "dist" else "out";
@@ -139,7 +137,7 @@ stdenv.mkDerivation (finalAttrs: {
      echo "Updated to version $new_version, checking wasm-bindgen..."

      # Fetch Cargo.lock from GitHub instead of cloning repository
-      cargo_lock_url="https://raw.githubusercontent.com/ente-io/ente/photos-v$new_version/web/packages/wasm/Cargo.lock"
+      cargo_lock_url="https://raw.githubusercontent.com/ente-io/ente/photos-v$new_version/rust/Cargo.lock"

      wasm_bindgen_version=$(curl -s "$cargo_lock_url" | tr -d '\r' | grep -A1 '^name = "wasm-bindgen"$' | grep -oP 'version = "\K[^"]+' | head -n1)

--- a/pkgs/by-name/eq/equibop/package.nix
+++ b/pkgs/by-name/eq/equibop/package.nix
@@ -128,6 +128,8 @@ stdenv.mkDerivation (finalAttrs: {
  '';

  postFixup = ''
+    # NOTE: LD_LIBRARY_PATH is needed, because equibop raises a warning at the start
+    # and it fixes a couple of bugs
    makeWrapper ${electron}/bin/electron $out/bin/equibop \
      --add-flags $out/opt/Equibop/resources/app.asar \
      ${lib.optionalString withTTS ''
@@ -135,7 +137,8 @@ stdenv.mkDerivation (finalAttrs: {
        --add-flags "\''${NIXOS_SPEECH:+--enable-speech-dispatcher}" \
      ''} \
      ${lib.optionalString withMiddleClickScroll "--add-flags \"--enable-blink-features=MiddleClickAutoscroll\""} \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}"
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}" \
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ (lib.getLib stdenv.cc.cc) ]}"
  '';

  desktopItems = makeDesktopItem {
--- a/pkgs/by-name/ex/exegol/package.nix
+++ b/pkgs/by-name/ex/exegol/package.nix
@@ -22,6 +22,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
  pythonRelaxDeps = [
    "argcomplete"
    "cryptography"
+    "pydantic"
    "requests"
    "rich"
    "supabase"
--- a/pkgs/by-name/fr/freedoom/package.nix
+++ b/pkgs/by-name/fr/freedoom/package.nix
@@ -20,6 +20,12 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    hash = "sha256-uOLyh/epVxv3/N+6P1glBX1ZkGWzHWGaERYZRSL/3AU=";
  };

+  postPatch = ''
+    substituteInPlace dist/freedoom \
+      --replace-fail 'DOOMWADPATH="$(echo "''${PATHS[@]}" | tr '"' '"' :)"' \
+                     "DOOMWADPATH=$out/share/games/doom"
+  '';
+
  strictDeps = true;

  nativeBuildInputs = [
--- a/pkgs/by-name/gp/gpu-screen-recorder/package.nix
+++ b/pkgs/by-name/gp/gpu-screen-recorder/package.nix
@@ -82,6 +82,8 @@ stdenv.mkDerivation (finalAttrs: {
      }" \
      --prefix PATH : "${wrapperDir}" \
      --suffix PATH : "$out/bin"
+    substituteInPlace $out/lib/systemd/user/gpu-screen-recorder.service \
+      --replace-fail "ExecStart=gpu-screen-recorder" "ExecStart=$out/bin/gpu-screen-recorder"
  '';

  passthru.updateScript = gitUpdater { };
--- a/pkgs/by-name/hy/hydrus/package.nix
+++ b/pkgs/by-name/hy/hydrus/package.nix
@@ -16,14 +16,14 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "hydrus";
-  version = "675";
+  version = "679";
  pyproject = false;

  src = fetchFromGitHub {
    owner = "hydrusnetwork";
    repo = "hydrus";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-c/jt7CnGCbyTEtR/OW0IkRp9OeUnypfuS+yUZR6Nshs=";
+    hash = "sha256-NIELa4E7l8T1oeF6V0kr1fhS4nj9TSSHAHo0Q3v0GTY=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/hy/hyprlock/package.nix
+++ b/pkgs/by-name/hy/hyprlock/package.nix
@@ -28,13 +28,13 @@

 gcc15Stdenv.mkDerivation (finalAttrs: {
  pname = "hyprlock";
-  version = "0.9.5";
+  version = "0.9.6";

  src = fetchFromGitHub {
    owner = "hyprwm";
    repo = "hyprlock";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-VFlM1cN4jmUAbfmZbeg7vL+AN9miXEUqqpk5EkHNq2c=";
+    hash = "sha256-JNDoV4tUGL6mXfXMqOjBwUl3Cg1YNIBbAPbpTYY/BpI=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ic/icloudpd/package.nix
+++ b/pkgs/by-name/ic/icloudpd/package.nix
@@ -1,13 +1,13 @@
 {
  lib,
-  python3Packages,
+  python313Packages,
  fetchFromGitHub,
  nix-update-script,
  testers,
  icloudpd,
 }:

-python3Packages.buildPythonApplication (finalAttrs: {
+python313Packages.buildPythonApplication (finalAttrs: {
  pname = "icloudpd";
  version = "1.32.3";
  pyproject = true;
@@ -21,7 +21,7 @@ python3Packages.buildPythonApplication (finalAttrs: {

  pythonRelaxDeps = true;

-  dependencies = with python3Packages; [
+  dependencies = with python313Packages; [
    certifi
    click
    flask
@@ -42,9 +42,9 @@ python3Packages.buildPythonApplication (finalAttrs: {
    wheel
  ];

-  build-system = with python3Packages; [ setuptools ];
+  build-system = with python313Packages; [ setuptools ];

-  nativeCheckInputs = with python3Packages; [
+  nativeCheckInputs = with python313Packages; [
    freezegun
    mock
    pytest-timeout
--- a/pkgs/by-name/jm/jmtpfs/package.nix
+++ b/pkgs/by-name/jm/jmtpfs/package.nix
@@ -1,46 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  fetchpatch,
-  pkg-config,
-  file,
-  fuse,
-  libmtp,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "jmtpfs";
-  version = "0.5";
-
-  src = fetchFromGitHub {
-    sha256 = "1pm68agkhrwgrplrfrnbwdcvx5lrivdmqw8pb5gdmm3xppnryji1";
-    rev = "v${finalAttrs.version}";
-    repo = "jmtpfs";
-    owner = "JasonFerrara";
-  };
-
-  patches = [
-    # Fix Darwin build (https://github.com/JasonFerrara/jmtpfs/pull/12)
-    (fetchpatch {
-      url = "https://github.com/JasonFerrara/jmtpfs/commit/b89084303477d1bc4dc9a887ba9cdd75221f497d.patch";
-      sha256 = "0s7x3jfk8i86rd5bwhj7mb1lffcdlpj9bd7b41s1768ady91rb29";
-    })
-  ];
-
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [
-    file
-    fuse
-    libmtp
-  ];
-
-  meta = {
-    description = "FUSE filesystem for MTP devices like Android phones";
-    homepage = "https://github.com/JasonFerrara/jmtpfs";
-    license = lib.licenses.gpl3Only;
-    platforms = lib.platforms.unix;
-    maintainers = [ lib.maintainers.coconnor ];
-    mainProgram = "jmtpfs";
-  };
-})
--- a/pkgs/by-name/ki/kimai/package.nix
+++ b/pkgs/by-name/ki/kimai/package.nix
@@ -7,13 +7,13 @@

 php.buildComposerProject2 (finalAttrs: {
  pname = "kimai";
-  version = "2.61.0";
+  version = "2.62.0";

  src = fetchFromGitHub {
    owner = "kimai";
    repo = "kimai";
    tag = finalAttrs.version;
-    hash = "sha256-T/eHJeEosRRWPSxvDpBkeGEx8zwqFz/v2CflhjLqpO4=";
+    hash = "sha256-IN9AnyN04inRK43YbMas6rUtDhSXCtbEkP6vv+yZREc=";
  };

  php = php.buildEnv {
@@ -38,7 +38,7 @@ php.buildComposerProject2 (finalAttrs: {
    '';
  };

-  vendorHash = "sha256-rwCLPLJwVaykWimmuZ7wM2KLZqDE1YIhMbD7q86w0OE=";
+  vendorHash = "sha256-MkQlK3DUbLBkkwZkxzGdR98NTHx/o5KD9D194Dg2F38=";

  composerNoPlugins = false;
  postInstall = ''
--- a/pkgs/by-name/ki/kitty-themes/package.nix
+++ b/pkgs/by-name/ki/kitty-themes/package.nix
@@ -7,13 +7,13 @@

 stdenvNoCC.mkDerivation {
  pname = "kitty-themes";
-  version = "0-unstable-2026-06-29";
+  version = "0-unstable-2026-07-10";

  src = fetchFromGitHub {
    owner = "kovidgoyal";
    repo = "kitty-themes";
-    rev = "f54e894cce7c2232c8af9a82f85dca874e496da1";
-    hash = "sha256-XYL/7Sr3Ct1n4lnji06I2EM4EQU3cNJuWbAadSz8PAE=";
+    rev = "e144651f75891cf4795ef1e7c24bb3e27c47aa06";
+    hash = "sha256-cl79/m3tGZzGXBuwcIIBxsewrcgaFK0R0VRlRiiw5yk=";
  };

  dontConfigure = true;
--- a/pkgs/by-name/le/lefthook/package.nix
+++ b/pkgs/by-name/le/lefthook/package.nix
@@ -41,6 +41,6 @@ buildGoModule (finalAttrs: {
    changelog = "https://github.com/evilmartians/lefthook/raw/v${finalAttrs.version}/CHANGELOG.md";
    license = lib.licenses.mit;
    mainProgram = "lefthook";
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ nightconcept ];
  };
 })
--- a/pkgs/by-name/lu/lubelogger/package.nix
+++ b/pkgs/by-name/lu/lubelogger/package.nix
@@ -8,13 +8,13 @@

 buildDotnetModule rec {
  pname = "lubelogger";
-  version = "1.6.8";
+  version = "1.7.0";

  src = fetchFromGitHub {
    owner = "hargata";
    repo = "lubelog";
    rev = "v${version}";
-    hash = "sha256-ePzR6TmByUBWGuOEg8WKMpvQT7qHGkZuBF8CkTwMtuY=";
+    hash = "sha256-I4GGlkEirqxiwIqczsCe9ns0ImOOalqg+pWKXx3o1Fo=";
  };

  projectFile = "CarCareTracker.sln";
--- a/pkgs/by-name/mi/mitm6/package.nix
+++ b/pkgs/by-name/mi/mitm6/package.nix
@@ -4,20 +4,19 @@
  python3,
 }:

-python3.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication (finalAttrs: {
  pname = "mitm6";
  version = "0.3.0";
  pyproject = true;

  src = fetchPypi {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
    hash = "sha256-g+eFcJdgP7CQ6ntN17guJa4LdkGIb91mr/NKRPIukP8=";
  };

  build-system = with python3.pkgs; [ setuptools ];

  dependencies = with python3.pkgs; [
-    future
    netifaces
    scapy
    twisted
@@ -35,4 +34,4 @@ python3.pkgs.buildPythonApplication rec {
    maintainers = with lib.maintainers; [ fab ];
    mainProgram = "mitm6";
  };
-}
+})
--- a/pkgs/by-name/mo/modal/package.nix
+++ b/pkgs/by-name/mo/modal/package.nix
@@ -0,0 +1 @@
+{ python3Packages }: with python3Packages; toPythonApplication modal
--- a/pkgs/by-name/ne/networkmanager-vpnc/export_nm_vpn_editor_factory_vpnc.patch
+++ b/pkgs/by-name/ne/networkmanager-vpnc/export_nm_vpn_editor_factory_vpnc.patch
@@ -0,0 +1,46 @@
+commit 4c9e26cdc9f58f0e35aa345ae3bb643bea139608
+Author: Christian Krause <chkr@plauener.de>
+Date:   Tue May 6 00:33:39 2025 +0200
+
+    Export nm_vpn_editor_factory_vpnc properly
+    
+    - commit e2fc231149165cb37a25362b85cbcd58b15a2a11 removed
+      libnm-glib version
+    - after that commit, nm_vpn_editor_factory_vpnc was not correctly
+      exported anymore which caused the settings editor be missing
+      when adding or editing a vnpc connection in gnome-control-center
+    - this commit re-adds the removed G_MODULE_EXPORT declaration
+
+diff --git a/properties/nm-vpnc-editor.c b/properties/nm-vpnc-editor.c
+index a06807d..0c8081d 100644
+--- a/properties/nm-vpnc-editor.c
+++ b/properties/nm-vpnc-editor.c
+@@ -27,7 +27,6 @@
+ #include "nm-default.h"
+ 
+ #include "nm-vpnc-editor.h"
+-#include "nm-vpnc-editor-plugin.h"
+ 
+ #include <nma-cert-chooser.h>
+ #include <netinet/in.h>
+@@ -1130,3 +1129,20 @@ vpnc_editor_interface_init (NMVpnEditorInterface *iface)
+ 	iface->get_widget = get_widget;
+ 	iface->update_connection = update_connection;
+ }
+
+/*****************************************************************************/
+
+#ifndef NM_VPN_OLD
+
+#include "nm-vpnc-editor-plugin.h"
+
+G_MODULE_EXPORT NMVpnEditor *
+nm_vpn_editor_factory_vpnc (NMVpnEditorPlugin *editor_plugin,
+                            NMConnection *connection,
+                            GError **error)
+{
+       g_return_val_if_fail (!error || !*error, NULL);
+
+       return nm_vpnc_editor_new (connection, error);
+}
+#endif
--- a/pkgs/by-name/ne/networkmanager-vpnc/package.nix
+++ b/pkgs/by-name/ne/networkmanager-vpnc/package.nix
@@ -1,6 +1,7 @@
 {
  stdenv,
  lib,
+  fetchpatch,
  fetchurl,
  replaceVars,
  vpnc,
@@ -31,6 +32,8 @@ stdenv.mkDerivation rec {
    (replaceVars ./fix-paths.patch {
      inherit vpnc kmod;
    })
+    # https://gitlab.gnome.org/GNOME/NetworkManager-vpnc/-/merge_requests/19
+    ./export_nm_vpn_editor_factory_vpnc.patch
  ];

  nativeBuildInputs = [
--- a/pkgs/by-name/ne/nextflow/deps.json
+++ b/pkgs/by-name/ne/nextflow/deps.json
--- a/pkgs/by-name/ne/nextflow/package.nix
+++ b/pkgs/by-name/ne/nextflow/package.nix
@@ -20,15 +20,24 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "nextflow";
-  version = "25.10.2";
+  version = "26.04.4";
+
+  __structuredAttrs = true;
+
+  # Suggested as an improvement, but currently breaks nix-build -A nextflow.tests
+  # strictDeps = true;

  src = fetchFromGitHub {
    owner = "nextflow-io";
    repo = "nextflow";
-    rev = "c03082c9b816774c799660d22c2b56d72218fddc";
-    hash = "sha256-k8B393GOsU1gs+ZS5x3VZUmz+n8lH8/cmXkpzU301lY=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-U0QHIzIbNe9dxqxhGAxJuskR9183UgGgLZQAGB7TKmo=";
  };

+  buildInputs = [
+    bash
+  ];
+
  nativeBuildInputs = [
    makeWrapper
    gradle
@@ -124,6 +133,7 @@ stdenv.mkDerivation (finalAttrs: {
    maintainers = with lib.maintainers; [
      Etjean
      mulatta
+      David-Moody
    ];
    mainProgram = "nextflow";
    platforms = lib.platforms.unix;
--- a/pkgs/by-name/ph/photoprism/backend.nix
+++ b/pkgs/by-name/ph/photoprism/backend.nix
@@ -2,7 +2,7 @@
  lib,
  buildGoModule,
  coreutils,
-  python3,
+  python313,
  src,
  version,
  pkg-config,
@@ -11,6 +11,9 @@
 }:

 let
+  # tensorflow does not yet support python314: https://github.com/tensorflow/tensorflow/issues/102890
+  python3 = python313;
+
  # we need to copy these, to add the symlinks, so the linker actually finds these libraries
  libtensorflow = symlinkJoin {
    name = "libtensorflow";
--- a/pkgs/by-name/pl/plasma-panel-colorizer/package.nix
+++ b/pkgs/by-name/pl/plasma-panel-colorizer/package.nix
@@ -5,7 +5,16 @@
  cmake,
  kdePackages,
  nix-update-script,
+  makeWrapper,
+  python3,
+  glib,
 }:
+let
+  pythonEnv = python3.withPackages (p: [
+    p.dbus-python
+    p.pygobject3
+  ]);
+in

 stdenv.mkDerivation (finalAttrs: {
  pname = "plasma-panel-colorizer";
@@ -21,12 +30,15 @@ stdenv.mkDerivation (finalAttrs: {
  nativeBuildInputs = [
    cmake
    kdePackages.extra-cmake-modules
+    makeWrapper
  ];

  buildInputs = [
    kdePackages.plasma-desktop
  ];

+  propagatedUserEnvPkgs = [ glib ];
+
  strictDeps = true;

  cmakeFlags = [
@@ -39,12 +51,27 @@ stdenv.mkDerivation (finalAttrs: {

  passthru.updateScript = nix-update-script { };

+  patches = [ ./use-dbus-service-directly.patch ];
+
+  postPatch = ''
+    substituteInPlace package/contents/ui/tools/service.py \
+      --replace-fail '#!/usr/bin/env python' '#!${lib.getExe pythonEnv}'
+  '';
+
+  postInstall = ''
+    chmod 755 $out/share/plasma/plasmoids/luisbocanegra.panel.colorizer/contents/ui/tools/{list_presets.sh,service.py}
+
+    wrapProgram $out/share/plasma/plasmoids/luisbocanegra.panel.colorizer/contents/ui/tools/service.py \
+      --prefix GI_TYPELIB_PATH : "${glib.out}/lib/girepository-1.0"
+  '';
+
  meta = {
    description = "Fully-featured widget to bring Latte-Dock and WM status bar customization features to the default KDE Plasma panel";
    homepage = "https://github.com/luisbocanegra/plasma-panel-colorizer";
    changelog = "https://github.com/luisbocanegra/plasma-panel-colorizer/blob/main/CHANGELOG.md";
    license = lib.licenses.gpl3Only;
    maintainers = with lib.maintainers; [ HeitorAugustoLN ];
+    sourceProvenance = [ lib.sourceTypes.fromSource ];
    inherit (kdePackages.kwindowsystem.meta) platforms;
  };
 })
--- a/pkgs/by-name/pl/plasma-panel-colorizer/use-dbus-service-directly.patch
+++ b/pkgs/by-name/pl/plasma-panel-colorizer/use-dbus-service-directly.patch
@@ -0,0 +1,11 @@
+--- a/package/contents/ui/DBusServiceModel.qml
+++ b/package/contents/ui/DBusServiceModel.qml
+@@ -8,7 +8,7 @@ Item {
+     property string toolsDir: Qt.resolvedUrl("./tools").toString().substring(7) + "/"
+     property string serviceUtil: toolsDir + "service.py"
+     property string pythonExecutable: plasmoid.configuration.pythonExecutable
+-    property string serviceCmd: pythonExecutable + " '" + serviceUtil + "' " + Plasmoid.containment.id + " " + Plasmoid.id
+    property string serviceCmd: serviceUtil + " " + Plasmoid.containment.id + " " + Plasmoid.id
+     readonly property string service: Plasmoid.metaData.pluginId + ".c" + Plasmoid.containment.id + ".w" + Plasmoid.id
+     readonly property string path: "/preset"
+ 
--- a/pkgs/by-name/po/pod2mdoc/package.nix
+++ b/pkgs/by-name/po/pod2mdoc/package.nix
@@ -2,6 +2,7 @@
  lib,
  stdenv,
  fetchurl,
+  installShellFiles,
 }:

 stdenv.mkDerivation (finalAttrs: {
@@ -18,18 +19,25 @@ stdenv.mkDerivation (finalAttrs: {
    substituteInPlace Makefile --replace-fail "-DHAVE_OHASH=1" "-DHAVE_OHASH=0"
  '';

+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
  installPhase = ''
-    mkdir -p $out/bin
-    mkdir -p $out/share/man/man1
-    install -m 0755 pod2mdoc $out/bin
-    install -m 0444 pod2mdoc.1 $out/share/man/man1
+    runHook preInstall
+    installBin pod2mdoc
+    installManPage pod2mdoc.1
+    runHook postInstall
  '';

-  enableParallelBuild = true;
+  enableParallelBuilding = true;
+  strictDeps = true;
+  __structuredAttrs = true;

  meta = {
    homepage = "https://mandoc.bsd.lv/pod2mdoc/";
    description = "Converter from POD into mdoc";
+    changelog = "https://mandoc.bsd.lv/pod2mdoc/ChangeLog";
    license = lib.licenses.isc;
    platforms = lib.platforms.all;
    maintainers = with lib.maintainers; [ ramkromberg ];
--- a/pkgs/by-name/po/postfix-tlspol/package.nix
+++ b/pkgs/by-name/po/postfix-tlspol/package.nix
@@ -7,13 +7,13 @@

 buildGoModule (finalAttrs: {
  pname = "postfix-tlspol";
-  version = "1.11.0";
+  version = "1.12.1";

  src = fetchFromGitHub {
    owner = "Zuplu";
    repo = "postfix-tlspol";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-mdnCa0xrexkKWHdtCeSXxwMnx9xNKAdkZlHIhqxD/P4=";
+    hash = "sha256-K2vByo2QtSfDjywTHQxYRidWosWMkIiFiLd4bjMoccY=";
  };

  vendorHash = null;
--- a/pkgs/by-name/pr/principia/package.nix
+++ b/pkgs/by-name/pr/principia/package.nix
@@ -17,13 +17,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "principia";
-  version = "2026.07.09";
+  version = "2026.07.15";

  src = fetchFromGitHub {
    owner = "Bithack";
    repo = "principia";
    tag = finalAttrs.version;
-    hash = "sha256-DlAhlbJjVCWpcwa6WDRU3Vms3AgDZdjZjBuBy9MOPh4=";
+    hash = "sha256-kIUi5vXXI3R2P4ZsbfLdfmRexfpk0zWZAMhUjreZPuA=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/pr/prometheus-imap-mailstat-exporter/package.nix
+++ b/pkgs/by-name/pr/prometheus-imap-mailstat-exporter/package.nix
@@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "imap-mailstat-exporter";
-  version = "0.0.1";
+  version = "0.7.1";

  src = fetchFromGitHub {
    owner = "bt909";
    repo = "imap-mailstat-exporter";
-    tag = "v${version}";
-    hash = "sha256-aR/94C9SI+FPs3zg3bpexmgGYrhxghyHwpXj25x0yuw=";
+    tag = "${version}";
+    hash = "sha256-dinHRHoTVc/0Lu+TzzmfoCyoDZQQhXw8AOlgbH46hm0=";
  };

-  vendorHash = "sha256-M5Ho4CiO5DC6mWzenXEo2pu0WLHj5S8AV3oEFwD31Sw=";
+  vendorHash = "sha256-k3FjfIaNm6408I4uqmJpZsGgMiHel+NUtBclbGKTtZ4=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/ri/river-classic/package.nix
+++ b/pkgs/by-name/ri/river-classic/package.nix
@@ -104,5 +104,9 @@ stdenv.mkDerivation (finalAttrs: {
      rodrgz
    ];
    platforms = lib.platforms.linux;
+    badPlatforms = [
+      # Runs out of memory (using > 100GiB) while building
+      "aarch64-linux"
+    ];
  };
 })
--- a/pkgs/by-name/ri/river/package.nix
+++ b/pkgs/by-name/ri/river/package.nix
@@ -109,5 +109,9 @@ stdenv.mkDerivation (finalAttrs: {
    ];
    mainProgram = "river";
    platforms = lib.platforms.linux;
+    badPlatforms = [
+      # Runs out of memory (using > 100GiB) while building
+      "aarch64-linux"
+    ];
  };
 })
--- a/pkgs/by-name/tm/tmuxinator/package.nix
+++ b/pkgs/by-name/tm/tmuxinator/package.nix
@@ -13,8 +13,8 @@ buildRubyGem rec {
  inherit ruby;
  name = "${gemName}-${version}";
  gemName = "tmuxinator";
-  version = "3.3.7";
-  source.sha256 = "sha256-z0E/zS6o8MXW4Gi6KqtusRtPpUBa5XhGMAsNJGZxL7I=";
+  version = "3.4.1";
+  source.sha256 = "sha256-2BZgu3vybhpoScScq42yr80DYI343vqlQVQv2AOG48I=";

  erubi = buildRubyGem rec {
    inherit ruby;
--- a/pkgs/by-name/va/vacuum-go/package.nix
+++ b/pkgs/by-name/va/vacuum-go/package.nix
@@ -7,16 +7,16 @@

 buildGoModule (finalAttrs: {
  pname = "vacuum-go";
-  version = "0.29.9";
+  version = "0.29.10";

  src = fetchFromGitHub {
    owner = "daveshanley";
    repo = "vacuum";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-dcc29hbllJqEI9Qv3UnLVEHfzWF0CQYalKCyUlCBsEA=";
+    hash = "sha256-LhPHHtQSIOeRsS/Mx3xIOyP2tMV6avR3cR3uQoX76RU=";
  };

-  vendorHash = "sha256-/0dAwcg3s5dTu97msrnwuOWjeCbmYJqxcldC2xLm3y0=";
+  vendorHash = "sha256-dexp++8oB8zIxkD5Evf02qaehiLxCy/4oVnU3ndn+FA=";

  env.CGO_ENABLED = 0;
  ldflags = [
--- a/pkgs/by-name/wa/wasm-bindgen-cli_0_2_125/package.nix
+++ b/pkgs/by-name/wa/wasm-bindgen-cli_0_2_125/package.nix
@@ -0,0 +1,19 @@
+{
+  buildWasmBindgenCli,
+  fetchCrate,
+  rustPlatform,
+}:
+
+buildWasmBindgenCli rec {
+  src = fetchCrate {
+    pname = "wasm-bindgen-cli";
+    version = "0.2.125";
+    hash = "sha256-zRawtjxMOdTMX+mZaiNR3YYfTiZJhf9qj7kXSSeMxrc=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit src;
+    inherit (src) pname version;
+    hash = "sha256-aZCfgR23Qb0Pn4Mm4ToMtuuRQqSJjXCR9li/VvP5CTM=";
+  };
+}
--- a/pkgs/by-name/wr/writefreely/package.nix
+++ b/pkgs/by-name/wr/writefreely/package.nix
@@ -7,16 +7,16 @@

 buildGoModule (finalAttrs: {
  pname = "writefreely";
-  version = "0.16.0";
+  version = "0.17.0";

  src = fetchFromGitHub {
    owner = "writefreely";
    repo = "writefreely";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-VM5TkQAohxGmtbQs9ZWxCqF4kJ/9wtihz+p1twd+W9E=";
+    sha256 = "sha256-sGCOFydegbD7m9OXNv3xsWFHy6kSZrIikGpci9y5nAw=";
  };

-  vendorHash = "sha256-5X+EYV1RFbzB26gi7IYcNpWtNlkTaK2SnDxYJL1AlaA=";
+  vendorHash = "sha256-e9usNyJHwmRNMjovhuL7Z4Ll7f58DgA1v1/hfJTZ4pg=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/xd/xd/package.nix
+++ b/pkgs/by-name/xd/xd/package.nix
@@ -20,6 +20,14 @@ buildGoModule (finalAttrs: {

  nativeCheckInputs = [ perl ];

+  preBuild = ''
+    make webui
+  '';
+
+  tags = [
+    "webui"
+  ];
+
  postInstall = ''
    ln -s $out/bin/XD $out/bin/XD-CLI
  '';
--- a/pkgs/development/python-modules/aioghost/default.nix
+++ b/pkgs/development/python-modules/aioghost/default.nix
@@ -13,14 +13,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "aioghost";
-  version = "0.4.18";
+  version = "0.4.19";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "TryGhost";
    repo = "aioghost";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-4YmIsXegv23ZVpvewixJVR6IY8YqQzeLKDAjHTp937k=";
+    hash = "sha256-bjdBaTPyNBRbBkmFTNlcBlXsWYBbDSq1PUXMvYvzkjM=";
  };

  build-system = [ hatchling ];
--- a/pkgs/development/python-modules/albucore/default.nix
+++ b/pkgs/development/python-modules/albucore/default.nix
@@ -22,6 +22,13 @@ buildPythonPackage rec {
    hash = "sha256-frVMPW3au/6vPRY89GIt7chCPkUMl13DpPqCPqIjz/o=";
  };

+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace-fail \
+        'from pkg_resources import DistributionNotFound, get_distribution' \
+        'from importlib.metadata import PackageNotFoundError as DistributionNotFound, distribution as get_distribution'
+  '';
+
  pythonRelaxDeps = [ "opencv-python" ];

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/albumentations/default.nix
+++ b/pkgs/development/python-modules/albumentations/default.nix
@@ -44,6 +44,17 @@ buildPythonPackage rec {
    ./dont-check-for-updates.patch
  ];

+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace-fail \
+        'from pkg_resources import DistributionNotFound, get_distribution' \
+        'from importlib.metadata import PackageNotFoundError as DistributionNotFound, distribution as get_distribution'
+    substituteInPlace tests/test_blur.py \
+      --replace-fail \
+        '(ImageFilter.GaussianBlur(radius=sigma))' \
+        '(ImageFilter.GaussianBlur(radius=float(sigma)))'
+  '';
+
  pythonRelaxDeps = [ "opencv-python" ];

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/ghrepo-stats/default.nix
+++ b/pkgs/development/python-modules/ghrepo-stats/default.nix
@@ -5,27 +5,24 @@
  fetchFromGitHub,
  matplotlib,
  pygithub,
+  setuptools,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "ghrepo-stats";
  version = "0.5.5";
-  format = "setuptools";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "mrbean-bremen";
    repo = "ghrepo-stats";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-zdBIX/uetkOAalg4uJPWXRL9WUgNN+hmqUwQDTdzrzA=";
  };

-  postPatch = ''
-    # https://github.com/mrbean-bremen/ghrepo-stats/pull/1
-    substituteInPlace setup.py \
-      --replace "bs4" "beautifulsoup4"
-  '';
+  build-system = [ setuptools ];

-  propagatedBuildInputs = [
+  dependencies = [
    beautifulsoup4
    matplotlib
    pygithub
@@ -38,10 +35,10 @@ buildPythonPackage rec {

  meta = {
    description = "Python module and CLI tool for GitHub repo statistics";
-    mainProgram = "show-ghstats";
    homepage = "https://github.com/mrbean-bremen/ghrepo-stats";
-    changelog = "https://github.com/mrbean-bremen/ghrepo-stats/blob/v${version}/CHANGES.md";
+    changelog = "https://github.com/mrbean-bremen/ghrepo-stats/blob/${finalAttrs.src.tag}/CHANGES.md";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "show-ghstats";
  };
-}
+})
--- a/pkgs/development/python-modules/logfire/default.nix
+++ b/pkgs/development/python-modules/logfire/default.nix
@@ -3,6 +3,7 @@
  callPackage,
  fetchFromGitHub,
  lib,
+  fetchpatch2,

  # build-system
  hatchling,
@@ -25,10 +26,13 @@
  opentelemetry-instrumentation-fastapi,
  opentelemetry-instrumentation-flask,
  opentelemetry-instrumentation-httpx,
+  opentelemetry-instrumentation-psycopg,
  opentelemetry-instrumentation-psycopg2,
  opentelemetry-instrumentation-redis,
  opentelemetry-instrumentation-requests,
  opentelemetry-instrumentation-sqlalchemy,
+  opentelemetry-instrumentation-sqlite3,
+  opentelemetry-instrumentation-system-metrics,
  opentelemetry-instrumentation-wsgi,
  packaging,

@@ -40,12 +44,12 @@
  dirty-equals,
  google-genai,
  inline-snapshot,
+  litellm,
  logfire-api,
  loguru,
  mysql-connector-python,
  openai-agents,
  pandas,
-  psycopg,
  pymongo,
  pymysql,
  pytest-django,
@@ -61,16 +65,28 @@

 buildPythonPackage (finalAttrs: {
  pname = "logfire";
-  version = "4.6.0";
+  version = "4.37.0";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "pydantic";
    repo = "logfire";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-dAkT3xh0RsGTnW7Mqml2wV16VHJGUUkjjxiFLg9bUKc=";
+    hash = "sha256-o6qtMiwXcfUuYkUrM+Iy6WhtwBOLK3q/nqPDC5QMmg0=";
  };

+  patches = [
+    # https://github.com/pydantic/logfire/pull/2042
+    (fetchpatch2 {
+      url = "https://github.com/pydantic/logfire/commit/c7ff8beec3a674a2b096fcd9395159723de4cc67.patch";
+      hash = "sha256-HdPT1cYOUiyjJBUYC5yoVRjC+gWyCMvo1MpOSL32lPM=";
+      excludes = [
+        "uv.lock"
+      ];
+    })
+  ];
+
  build-system = [ hatchling ];

  dependencies = [
@@ -106,7 +122,7 @@ buildPythonPackage (finalAttrs: {
    # litellm = [ opentelemetry-instrumentation-litellm ];
    # mysql = [ opentelemetry-instrumentation-mysql ];
    psycopg = [
-      # opentelemetry-instrumentation-psycopg
+      opentelemetry-instrumentation-psycopg
      packaging
    ];
    psycopg2 = [
@@ -117,9 +133,9 @@ buildPythonPackage (finalAttrs: {
    redis = [ opentelemetry-instrumentation-redis ];
    requests = [ opentelemetry-instrumentation-requests ];
    sqlalchemy = [ opentelemetry-instrumentation-sqlalchemy ];
-    # sqlite3 = [ opentelemetry-instrumentation-sqlite3 ];
+    sqlite3 = [ opentelemetry-instrumentation-sqlite3 ];
    # starlette = [ opentelemetry-instrumentation-starlette ];
-    # system-metrics = [ opentelemetry-instrumentation-system-metrics ];
+    system-metrics = [ opentelemetry-instrumentation-system-metrics ];
    wsgi = [ opentelemetry-instrumentation-wsgi ];
  };

@@ -136,12 +152,12 @@ buildPythonPackage (finalAttrs: {
    dirty-equals
    google-genai
    inline-snapshot
+    litellm
    logfire-api
    loguru
    mysql-connector-python
    openai-agents
    pandas
-    psycopg
    pymongo
    pymysql
    pytest-django
@@ -163,15 +179,8 @@ buildPythonPackage (finalAttrs: {
    "tests/otel_integrations/test_aws_lambda.py"
    "tests/otel_integrations/test_google_genai.py"
    "tests/otel_integrations/test_mysql.py"
-    "tests/otel_integrations/test_psycopg.py"
    "tests/otel_integrations/test_pymongo.py"
-    "tests/otel_integrations/test_sqlalchemy.py"
-    "tests/otel_integrations/test_sqlite3.py"
    "tests/otel_integrations/test_starlette.py"
-    "tests/otel_integrations/test_system_metrics.py"
-
-    # No module named 'litellm'
-    "tests/otel_integrations/test_litellm.py::test_litellm_instrumentation"

    # No module named 'pydantic_ai'
    "tests/otel_integrations/test_pydantic_ai.py"
--- a/pkgs/development/python-modules/minify-html/default.nix
+++ b/pkgs/development/python-modules/minify-html/default.nix
@@ -23,6 +23,12 @@ buildPythonPackage rec {
    hash = "sha256-K0m+rM0dcosAOl5jYdh9CSRrL/Vuk1ATWHPQJbLxvRw=";
  };

+  # The sdist's nested .cargo/config makes maturin >= 1.13.0 skip adding
+  # `-undefined dynamic_lookup` but cargo never reads it, dropping the flag
+  postPatch = ''
+    rm -r minify-html-python/.cargo
+  '';
+
  nativeBuildInputs = with rustPlatform; [
    cargoSetupHook
    maturinBuildHook
--- a/pkgs/development/python-modules/modal/default.nix
+++ b/pkgs/development/python-modules/modal/default.nix
@@ -34,18 +34,21 @@
  types-toml,
  typing-extensions,
  watchfiles,
+  versionCheckHook,
 }:

 buildPythonPackage (finalAttrs: {
  pname = "modal";
-  version = "1.4.2";
+  version = "1.5.2";
  pyproject = true;

+  __structuredAttrs = true;
+
  src = fetchFromGitHub {
    owner = "modal-labs";
    repo = "modal-client";
    tag = "py/v${finalAttrs.version}";
-    hash = "sha256-MXaiei2hUBwI9qlB7HZtWbnrsZq/iLnZgqIejn2ZgX8=";
+    hash = "sha256-YWSf5xsap5zfy1KbAyamFmjEIe7qpRcj6TfuWf/Tu68=";
  };
  sourceRoot = "${finalAttrs.src.name}/py";

@@ -105,6 +108,7 @@ buildPythonPackage (finalAttrs: {
    pytestCheckHook
    python-dotenv
    six
+    versionCheckHook
  ];

  disabledTestPaths = [
@@ -127,6 +131,15 @@ buildPythonPackage (finalAttrs: {
  disabledTests = [
    # Non-deterministic
    "test_queue_blocking_put"
+
+    # try to hit modal servers
+    "test_blob_upload_uses_proxy"
+    "test_grpc_control_plane_uses_prox"
+    "test_grpc_task_command_router_uses_proxy"
+    "test_socks5_proxy_via_all_proxy"
+
+    # flaky
+    "test_process_fork"
  ];

  __darwinAllowLocalNetworking = true;
--- a/pkgs/development/python-modules/pydantic-ai-slim/default.nix
+++ b/pkgs/development/python-modules/pydantic-ai-slim/default.nix
@@ -20,14 +20,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "pydantic-ai-slim";
-  version = "2.11.0";
+  version = "2.13.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "pydantic";
    repo = "pydantic-ai";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-nt51tvNcB01i6Z1+8ueIW6ffIiS3Jh9MC2hSNgzN+90=";
+    hash = "sha256-mp0LYmqh2AsXXCXkDFDv+eIEaPFqvtwsK2DZ2N3RMTs=";
  };

  sourceRoot = "${finalAttrs.src.name}/pydantic_ai_slim";
--- a/pkgs/development/python-modules/pydantic-graph/default.nix
+++ b/pkgs/development/python-modules/pydantic-graph/default.nix
@@ -16,14 +16,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "pydantic-graph";
-  version = "2.11.0";
+  version = "2.13.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "pydantic";
    repo = "pydantic-ai";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-nt51tvNcB01i6Z1+8ueIW6ffIiS3Jh9MC2hSNgzN+90=";
+    hash = "sha256-mp0LYmqh2AsXXCXkDFDv+eIEaPFqvtwsK2DZ2N3RMTs=";
  };

  sourceRoot = "${finalAttrs.src.name}/pydantic_graph";
--- a/pkgs/development/python-modules/pyiceberg/default.nix
+++ b/pkgs/development/python-modules/pyiceberg/default.nix
@@ -79,6 +79,11 @@ buildPythonPackage (finalAttrs: {
  # Prevents the cython build to fail silently
  env.CIBUILDWHEEL = "1";

+  pythonRelaxDeps = [
+    # rich<15.0.0,>=10.11.0 not satisfied by version 15.0.0
+    "rich"
+  ];
+
  dependencies = [
    cachetools
    click
@@ -289,6 +294,10 @@ buildPythonPackage (finalAttrs: {
    # Timing sensitive
    # AssertionError: assert 8 == 5
    "test_hive_wait_for_lock"
+
+    # Schema comparison faildue to `string` becoming `large_string`
+    "test_read_map "
+    "test_projection_maps_of_structs"
  ]
  ++ lib.optionals stdenv.hostPlatform.isDarwin [
    # ImportError: The pyarrow installation is not built with support for 'GcsFileSystem'
--- a/pkgs/development/python-modules/skops/default.nix
+++ b/pkgs/development/python-modules/skops/default.nix
@@ -61,6 +61,14 @@ buildPythonPackage (finalAttrs: {
  };

  enabledTestPaths = [ "skops" ];
+  # Override the overly strict pyproject.toml:tool.pytest.ini_options.filterwarnings
+  # https://github.com/skops-dev/skops/issues/523
+  pytestFlags = [
+    "-W"
+    "ignore::FutureWarning"
+    "-W"
+    "ignore::DeprecationWarning"
+  ];

  disabledTests = [
    # fairlearn is not available in nixpkgs
--- a/pkgs/development/python-modules/wandb/default.nix
+++ b/pkgs/development/python-modules/wandb/default.nix
@@ -15,14 +15,13 @@

  ## wandb
  buildPythonPackage,
-  replaceVars,

  # build-system
  hatchling,

  # dependencies
  click,
-  gitpython,
+  packaging,
  platformdirs,
  protobuf,
  pydantic,
@@ -30,14 +29,12 @@
  requests,
  sentry-sdk,
  setproctitle,
-  setuptools,
  pythonOlder,
  typing-extensions,

  # tests
-  pytestCheckHook,
-  azure-core,
  azure-containerregistry,
+  azure-core,
  azure-identity,
  azure-storage-blob,
  bokeh,
@@ -54,6 +51,7 @@
  kubernetes-asyncio,
  looptime,
  matplotlib,
+  moto,
  moviepy,
  pandas,
  parameterized,
@@ -66,6 +64,7 @@
  pytest-mock,
  pytest-timeout,
  pytest-xdist,
+  pytestCheckHook,
  rdkit,
  responses,
  scikit-learn,
@@ -77,12 +76,12 @@
 }:

 let
-  version = "0.28.0";
+  version = "0.28.1";
  src = fetchFromGitHub {
    owner = "wandb";
    repo = "wandb";
    tag = "v${version}";
-    hash = "sha256-YdM/LrrWQFup/1Fkv49//eOFfYFCRgpuuH7+DZIOT1M=";
+    hash = "sha256-yXsSHyPOh3QXRRkTL4Rj8lLuFjp1LIKfPiacy4+obAk=";
  };

  wandb-xpu = rustPlatform.buildRustPackage {
@@ -198,13 +197,6 @@ buildPythonPackage (finalAttrs: {

  inherit src version;

-  patches = [
-    # Replace git paths
-    (replaceVars ./hardcode-git-path.patch {
-      git = lib.getExe gitMinimal;
-    })
-  ];
-
  postPatch =
    # Prevent hatch from building wandb-core and arrow-rs-wrapper
    ''
@@ -218,6 +210,13 @@ buildPythonPackage (finalAttrs: {
        --replace-fail \
          'bin_path = pathlib.Path(__file__).parent / "bin" / "wandb-core"' \
          'bin_path = pathlib.Path("${lib.getExe wandb-core}")'
+    ''
+    # Hard-code the path to git in the python code
+    + ''
+      substituteInPlace wandb/cli/cli.py \
+        --replace-fail \
+          '["git", "apply",' \
+          '["${lib.getExe gitMinimal}", "apply",' \
    '';

  env = {
@@ -235,7 +234,7 @@ buildPythonPackage (finalAttrs: {

  dependencies = [
    click
-    gitpython
+    packaging
    platformdirs
    protobuf
    pydantic
@@ -243,8 +242,6 @@ buildPythonPackage (finalAttrs: {
    requests
    sentry-sdk
    setproctitle
-    # setuptools is necessary since pkg_resources is required at runtime.
-    setuptools
  ]
  ++ lib.optionals (pythonOlder "3.12") [
    typing-extensions
@@ -253,9 +250,8 @@ buildPythonPackage (finalAttrs: {
  __darwinAllowLocalNetworking = true;

  nativeCheckInputs = [
-    pytestCheckHook
-    azure-core
    azure-containerregistry
+    azure-core
    azure-identity
    azure-storage-blob
    bokeh
@@ -263,6 +259,7 @@ buildPythonPackage (finalAttrs: {
    cloudpickle
    cwsandbox
    flask
+    gitMinimal
    google-cloud-artifact-registry
    google-cloud-compute
    google-cloud-storage
@@ -272,6 +269,7 @@ buildPythonPackage (finalAttrs: {
    kubernetes-asyncio
    looptime
    matplotlib
+    moto
    moviepy
    pandas
    parameterized
@@ -284,11 +282,13 @@ buildPythonPackage (finalAttrs: {
    pytest-mock
    pytest-timeout
    pytest-xdist
+    pytestCheckHook
    rdkit
    responses
    scikit-learn
    soundfile
    tenacity
+    versionCheckHook
    torch
    torchvision
    tqdm
@@ -448,6 +448,7 @@ buildPythonPackage (finalAttrs: {
    changelog = "https://github.com/wandb/wandb/blob/${finalAttrs.src.tag}/CHANGELOG.md";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ samuela ];
+    mainProgram = "wandb";
    broken = wandb-xpu.meta.broken || wandb-core.meta.broken;
  };
 })
--- a/pkgs/development/python-modules/wandb/hardcode-git-path.patch
+++ b/pkgs/development/python-modules/wandb/hardcode-git-path.patch
@@ -1,62 +0,0 @@
-diff --git a/tests/unit_tests/test_wandb_settings.py b/tests/unit_tests/test_wandb_settings.py
-index 4089d0719..694715290 100644
--- a/tests/unit_tests/test_wandb_settings.py
-+++ b/tests/unit_tests/test_wandb_settings.py
-@@ -698,7 +698,7 @@ def test_reports_invalid_system_settings(
- def test_infer_git_root_finds_repo(tmp_path):
-     git_root = tmp_path / "repo"
-     git_root.mkdir()
-    subprocess.run(["git", "init", str(git_root)], check=True, capture_output=True)
-+    subprocess.run(["@git@", "init", str(git_root)], check=True, capture_output=True)
-     subdir = git_root / "subdir"
-     subdir.mkdir()
- 
-@@ -718,7 +718,7 @@ def test_infer_git_root_no_repo(tmp_path):
- def test_infer_git_root_skips_if_already_set(tmp_path):
-     git_root = tmp_path / "repo"
-     git_root.mkdir()
-    subprocess.run(["git", "init", str(git_root)], check=True, capture_output=True)
-+    subprocess.run(["@git@", "init", str(git_root)], check=True, capture_output=True)
- 
-     preset = "/some/other/path"
-     s = Settings(root_dir=str(git_root), git_root=preset)
-@@ -730,7 +730,7 @@ def test_infer_git_root_skips_if_already_set(tmp_path):
- def test_infer_git_root_skips_if_disable_git(tmp_path):
-     git_root = tmp_path / "repo"
-     git_root.mkdir()
-    subprocess.run(["git", "init", str(git_root)], check=True, capture_output=True)
-+    subprocess.run(["@git@", "init", str(git_root)], check=True, capture_output=True)
- 
-     s = Settings(root_dir=str(git_root), disable_git=True)
-     s.infer_git_root()
-diff --git a/wandb/cli/cli.py b/wandb/cli/cli.py
-index 0ec7996cc..973b10643 100644
--- a/wandb/cli/cli.py
-+++ b/wandb/cli/cli.py
-@@ -3265,7 +3265,7 @@ def restore(ctx, run, no_git, branch, project, entity):
-     commit, json_config, patch_content, metadata = api.run_config(
-         project, run=run, entity=entity
-     )
-    repo = metadata.get("git", {}).get("repo")
-+    repo = metadata.get("@git@", {}).get("repo")
-     image = metadata.get("docker")
-     restore_message = f"""`wandb restore` needs to be run from the same git repository as the original run.
- Run `git clone {repo}` and restore from there or pass the --no-git flag."""
-@@ -3284,7 +3284,7 @@ Run `git clone {repo}` and restore from there or pass the --no-git flag."""
- 
-     if commit and git.enabled:
-         wandb.termlog(f"Fetching origin and finding commit: {commit}")
-        subprocess.check_call(["git", "fetch", "--all"])
-+        subprocess.check_call(["@git@", "fetch", "--all"])
-         try:
-             git.repo.commit(commit)
-         except ValueError:
-@@ -3337,7 +3337,7 @@ Run `git clone {repo}` and restore from there or pass the --no-git flag."""
-             # --reject is necessary or else this fails any time a binary file
-             # occurs in the diff
-             exit_code = subprocess.call(
-                ["git", "apply", "--reject", patch_rel_path], cwd=root
-+                ["@git@", "apply", "--reject", patch_rel_path], cwd=root
-             )
-             if exit_code == 0:
-                 wandb.termlog("Applied patch")
--- a/pkgs/development/python-modules/yaswfp/default.nix
+++ b/pkgs/development/python-modules/yaswfp/default.nix
@@ -8,7 +8,7 @@

 buildPythonPackage (finalAttrs: {
  pname = "yaswfp";
-  version = "0.9.3-unstable-20210331";
+  version = "0.9.3-unstable-2014-09-11";
  pyproject = true;

  __structuredAttrs = true;
--- a/pkgs/misc/tmux-plugins/default.nix
+++ b/pkgs/misc/tmux-plugins/default.nix
@@ -1162,12 +1162,12 @@ in

  tmux-sm = mkTmuxPlugin {
    pluginName = "tmux-sm";
-    version = "0-unstable-2026-05-14";
+    version = "0-unstable-2026-06-06";
    src = fetchFromGitHub {
      owner = "vimlinuz";
      repo = "tmux-sm";
-      rev = "97d411a11d124443c982d17fde03c1e09809d7b1";
-      hash = "sha256-7HW/TLP/yyQp4j0/utA0tibTv+suV1B2K56pUS3Z004=";
+      rev = "33b4841531eefcc30ebaa52438d7073b0066164b";
+      hash = "sha256-6zEx5X7j7Pm4Vn8edFtbaCkE8cDtN2rOQYVYJ/Vo5Qs=";
    };
    nativeBuildInputs = [ pkgs.makeWrapper ];
    rtpFilePath = "main.tmux";
--- a/pkgs/os-specific/linux/zenpower/default.nix
+++ b/pkgs/os-specific/linux/zenpower/default.nix
@@ -3,17 +3,18 @@
  stdenv,
  kernel,
  fetchFromGitHub,
+  nix-update-script,
 }:

 stdenv.mkDerivation rec {
  pname = "zenpower";
-  version = "unstable-2025-12-20";
+  version = "0.2.0";

  src = fetchFromGitHub {
    owner = "AliEmreSenel";
    repo = "zenpower3";
-    rev = "dc4f1e2d2f5e26ad5b314497485419cb240e7134";
-    hash = "sha256-NvCBog1rAAjbhT9dMOjsmio6lVZ9h36XvOiE7znJdTo=";
+    tag = "v${version}";
+    hash = "sha256-ro40bIMPkM3rLraZaKqzB8a14zgldMIW4jSUr5GbELo=";
  };

  hardeningDisable = [ "pic" ];
@@ -26,6 +27,8 @@ stdenv.mkDerivation rec {
    install -D zenpower.ko -t "$out/lib/modules/${kernel.modDirVersion}/kernel/drivers/hwmon/zenpower/"
  '';

+  passthru.updateScript = nix-update-script { };
+
  meta = {
    inherit (src.meta) homepage;
    description = "Linux kernel driver for reading temperature, voltage(SVI2), current(SVI2) and power(SVI2) for AMD Zen family CPUs";
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1104,6 +1104,7 @@ mapAliases {
  jhentai = throw "'jhentai' has been removed, as it is unmaintained"; # Added 2026-01-25
  jikespg = throw "'jikespg' has been removed due to lack of maintenance upstream."; # Added 2025-06-10
  jing = jing-trang; # Added 2025-09-18
+  jmtpfs = throw "'jmtpfs' has been removed, as it is unmaintained"; # Added 2026-06-06
  joplin = joplin-cli; # Added 2025-11-03
  jscoverage = throw "jscoverage has been removed, as it was broken"; # Added 2025-08-25
  jsduck = throw "jsduck has been removed, as it was broken and and unmaintained upstream."; # Added 2025-12-02
				`@@ -0,0 +1 @@`
				`{ python3Packages }: with python3Packages; toPythonApplication modal`