Merge master into staging-nixos

2026-09-30 03:39:59 +00:00 · 2026-09-29 18:13:19 +00:00
parent 11dac38567 3a3470d694
commit 9c081a1eb6
38 changed files with 359 additions and 139 deletions
--- a/nixos/modules/services/web-apps/akkoma.nix
+++ b/nixos/modules/services/web-apps/akkoma.nix
@@ -1167,17 +1167,16 @@ in
  };

  config = mkIf cfg.enable {
-    assertions =
-      optionals
-        (
+    assertions = [
+      {
+        assertion =
          cfg.config.":pleroma".":media_proxy".enabled
-          && cfg.config.":pleroma".":media_proxy".base_url == null
-        )
-        [
-          ''
-            `services.akkoma.config.":pleroma".":media_proxy".base_url` must be set when the media proxy is enabled.
-          ''
-        ];
+          -> cfg.config.":pleroma".":media_proxy".base_url != null;
+        message = ''
+          `services.akkoma.config.":pleroma".":media_proxy".base_url` must be set to a URL with a different host component (domain name) than the web endpoint when the media proxy is enabled.
+        '';
+      }
+    ];
    warnings =
      optionals (with config.security; cfg.installWrapper && (!sudo.enable) && (!sudo-rs.enable))
        [
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -5334,6 +5334,20 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  direnv-nvim = buildVimPlugin {
+    pname = "direnv.nvim";
+    version = "0-unstable-2026-06-28";
+    src = fetchFromGitHub {
+      owner = "NotAShelf";
+      repo = "direnv.nvim";
+      rev = "9258f9f10c4c729d8296fce0e3ecb12543daad06";
+      hash = "sha256-b5PpmkYWaDGLNcu+36tRR5ycATHYBjs9WrV8/jfmooQ=";
+    };
+    meta.homepage = "https://github.com/NotAShelf/direnv.nvim/";
+    meta.license = getLicenseFromSpdxId "MPL-2.0";
+    meta.hydraPlatforms = [ ];
+  };
+
  direnv-vim = buildVimPlugin {
    pname = "direnv.vim";
    version = "0-unstable-2023-12-02";
@@ -8323,12 +8337,13 @@ final: prev: {
  jsonfly-nvim = buildVimPlugin {
    pname = "jsonfly.nvim";
    version = "0-unstable-2025-11-02";
-    src = fetchgit {
-      url = "https://git.myzel394.app/Myzel394/jsonfly.nvim";
+    src = fetchFromGitHub {
+      owner = "Myzel394";
+      repo = "jsonfly.nvim";
      rev = "3d58635cb195a5435743e7882c6ac7cff710204f";
-      hash = "sha256-bTh/6zmYQ+XqBsccKo8i149nU5bBfFv+8UKMayHIoo4=";
+      hash = "sha256-qTxLDQKqmsf/DrgzhfrmtY2LUVhPcGNFU/Iq4ew29lA=";
    };
-    meta.homepage = "https://git.myzel394.app/Myzel394/jsonfly.nvim";
+    meta.homepage = "https://github.com/Myzel394/jsonfly.nvim";
    meta.license = unfree;
    meta.hydraPlatforms = [ ];
  };
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -379,6 +379,7 @@ https://github.com/barrettruth/diffs.nvim/,,
 https://github.com/dlyongemallo/diffview-plus.nvim/,,
 https://github.com/sindrets/diffview.nvim/,,
 https://github.com/elihunter173/dirbuf.nvim/,,
+https://github.com/NotAShelf/direnv.nvim/,,
 https://github.com/direnv/direnv.vim/,,
 https://github.com/chipsenkbeil/distant.nvim/,,
 https://github.com/doki-theme/doki-theme-vim/,,
@@ -592,7 +593,7 @@ https://github.com/HiPhish/jinja.vim/,,
 https://github.com/NicolasGB/jj.nvim/,,
 https://github.com/vito-c/jq.vim/,,
 https://github.com/neoclide/jsonc.vim/,,
-https://git.myzel394.app/Myzel394/jsonfly.nvim,,
+https://github.com/Myzel394/jsonfly.nvim/,,
 https://github.com/yannvanhalewyn/jujutsu.nvim/,,
 https://github.com/julelang/jule.nvim/,,
 https://github.com/JuliaEditorSupport/julia-vim/,,
--- a/pkgs/by-name/as/aseprite/package.nix
+++ b/pkgs/by-name/as/aseprite/package.nix
@@ -34,21 +34,21 @@

 clangStdenv.mkDerivation (finalAttrs: {
  pname = "aseprite";
-  version = "1.3.18.5";
+  version = "1.3.18.6";

  src = fetchFromGitHub {
    owner = "aseprite";
    repo = "aseprite";
    tag = "v${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-8BLbAX+wif4vJySv11/NGzGrwRIsK3tvKhpkX2Zoci0=";
+    hash = "sha256-oeTO93T/BQcM0PkrFVMw+kLDG6w3uT2798Kzgua4gsE=";
  };

  asepriteStrings = fetchFromGitHub {
    owner = "aseprite";
    repo = "strings";
-    rev = "b43be33343efa40c1c4bda00f985b8cd83bddf2a";
-    hash = "sha256-JxNEtWnP3RtntXM3CmJLXyByW6dri98COp2O0A6ZwBA=";
+    rev = "c6a218e3629ab5c0924682425091be6dec87f489";
+    hash = "sha256-JAKKxkWXJGchPYyr504vQs7QqF4c2Q7RYqFJ/AhOw9A=";
  };

  # Translation files are copied without overwriting existing ones to preserve
--- a/pkgs/by-name/ca/capa/package.nix
+++ b/pkgs/by-name/ca/capa/package.nix
@@ -1 +1 @@
-{ python3Packages }: with python3Packages; toPythonApplication capa
+{ python3Packages }: with python3Packages; toPythonApplication flare-capa
--- a/pkgs/by-name/ci/circup/package.nix
+++ b/pkgs/by-name/ci/circup/package.nix
@@ -6,14 +6,14 @@

 python3.pkgs.buildPythonApplication (finalAttrs: {
  pname = "circup";
-  version = "3.0.4";
+  version = "3.1.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "adafruit";
    repo = "circup";
    tag = finalAttrs.version;
-    hash = "sha256-sv+ixo5S9JRuVu8JkKt29Kpn1ioRIwGW4Ss/A77YiFU=";
+    hash = "sha256-+/1lL5mVeVPFFLitLYIGzSxmnoizNxjb6+MYWreSijw=";
  };

  pythonRelaxDeps = [ "semver" ];
--- a/pkgs/by-name/cl/cloudfoundry-cli/package.nix
+++ b/pkgs/by-name/cl/cloudfoundry-cli/package.nix
@@ -4,6 +4,8 @@
  fetchFromGitHub,
  fetchurl,
  installShellFiles,
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
 }:

 buildGoModule (finalAttrs: {
@@ -32,8 +34,9 @@ buildGoModule (finalAttrs: {
  ldflags = [
    "-s"
    "-w"
-    "-X code.cloudfoundry.org/cli/version.binaryBuildDate=1970-01-01"
-    "-X code.cloudfoundry.org/cli/version.binaryVersion=${finalAttrs.version}"
+    "-X code.cloudfoundry.org/cli/v8/version.binaryBuildDate=1970-01-01"
+    "-X code.cloudfoundry.org/cli/v8/version.binaryVersion=${finalAttrs.version}"
+    "-X code.cloudfoundry.org/cli/v8/version.binarySHA=${finalAttrs.src.rev}"
  ];

  postInstall = ''
@@ -41,6 +44,15 @@ buildGoModule (finalAttrs: {
    installShellCompletion --bash $bashCompletionScript
  '';

+  doInstallCheck = true;
+
+  versionCheckKeepEnvironment = [ "HOME" ];
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
+  ];
+
  meta = {
    description = "Official command line client for Cloud Foundry";
    homepage = "https://github.com/cloudfoundry/cli";
--- a/pkgs/by-name/co/cook-cli/package.nix
+++ b/pkgs/by-name/co/cook-cli/package.nix
@@ -11,16 +11,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cook-cli";
-  version = "0.36.0";
+  version = "0.37.0";

  src = fetchFromGitHub {
    owner = "cooklang";
    repo = "cookcli";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-ihsVvlyp//A4pNlt1+DlYWyz52enHVeU6uST7bxcwqw=";
+    hash = "sha256-tHPVKigUqHZo84E+2wnky21UQfE7bQ1ZB1vZZNPlm7E=";
  };

-  cargoHash = "sha256-e47x9XzABpXO+qvTydrBOPU9KTZTYJkbJvWvpUUh7Bo=";
+  cargoHash = "sha256-DOXHQMYWyuArVwS+odyjImGCfzS4flNZM7NRSnLkLfc=";

  # Build without the self-updating feature
  buildNoDefaultFeatures = true;
--- a/pkgs/by-name/co/copilot-language-server/package.nix
+++ b/pkgs/by-name/co/copilot-language-server/package.nix
@@ -13,14 +13,14 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "copilot-language-server";
-  version = "1.547.0";
+  version = "1.551.2";

  strictDeps = true;
  __structuredAttrs = true;

  src = fetchzip {
    url = "https://github.com/github/copilot-language-server-release/releases/download/${finalAttrs.version}/copilot-language-server-js-${finalAttrs.version}.zip";
-    hash = "sha256-JFAv+Trz8XUuk9x9ZXWINdfrZ8Mglwjy8ay/EX0gOPo=";
+    hash = "sha256-wDV1F8rzO49sp2XxcZdvwyWKSzu+2CWahZ2kLoVoGRE=";
    stripRoot = false;
  };

--- a/pkgs/by-name/db/dbcsr/package.nix
+++ b/pkgs/by-name/db/dbcsr/package.nix
@@ -1,41 +1,69 @@
 {
-  stdenv,
  lib,
+  stdenv,
  fetchFromGitHub,
+  fetchpatch,
+
+  # nativeBuildInputs
  cmake,
-  mpiCheckPhaseHook,
-  pkg-config,
  fypp,
  gfortran,
+  mpi,
+  pkg-config,
+  python3,
+
+  # buildInputs
  blas,
  lapack,
-  python3,
  libxsmm,
-  mpi,
+
+  # nativeCheckInputs
+  mpiCheckPhaseHook,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "dbcsr";
  version = "2.10.0";

+  __structuredAttrs = true;
+  strictDeps = true;
+
  src = fetchFromGitHub {
    owner = "cp2k";
    repo = "dbcsr";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-BgZmc81TzgU3ifv4RHh2pfjbkUyxMIIpBrHCtnLF3p0=";
  };

+  patches = [
+    # Explicitly export the C API symbols, otherwise hidden with GCC 16
+    # https://github.com/cp2k/dbcsr/pull/1027
+    (fetchpatch {
+      name = "expose-c-api-procedures.patch";
+      url = "https://github.com/cp2k/dbcsr/commit/a5d9bcfcd487e3181b981687334da1b89bc61dce.patch";
+      hash = "sha256-a4glOtMx1EUzYdoQb66bZaRnCgatVFWTqvcQlvU3oIc=";
+    })
+  ];
+
  postPatch = ''
    patchShebangs .
-
-    # Force build of shared library, otherwise just static.
+  ''
+  # Force build of shared library, otherwise just static.
+  + ''
    substituteInPlace src/CMakeLists.txt \
-      --replace 'add_library(dbcsr ''${DBCSR_SRCS})' 'add_library(dbcsr SHARED ''${DBCSR_SRCS})' \
-      --replace 'add_library(dbcsr_c ''${DBCSR_C_SRCS})' 'add_library(dbcsr_c SHARED ''${DBCSR_C_SRCS})'
-
-    # Avoid calling the fypp wrapper script with python again. The nix wrapper took care of that.
+      --replace-fail \
+        'add_library(dbcsr ''${DBCSR_SRCS})' \
+        'add_library(dbcsr SHARED ''${DBCSR_SRCS})' \
+      --replace-fail \
+        'add_library(dbcsr_c ''${DBCSR_C_SRCS})' \
+        'add_library(dbcsr_c SHARED ''${DBCSR_C_SRCS})'
+  ''
+  # Avoid calling the fypp wrapper script with python again. The nix wrapper took care of that.
+  + ''
    substituteInPlace cmake/fypp-sources.cmake \
-      --replace 'COMMAND ''${Python_EXECUTABLE} ''${FYPP_EXECUTABLE}' 'COMMAND ''${FYPP_EXECUTABLE}'
+      --replace-fail \
+        'COMMAND ''${Python_EXECUTABLE} ''${FYPP_EXECUTABLE}' \
+        'COMMAND ''${FYPP_EXECUTABLE}'
  '';

  outputs = [
@@ -44,11 +72,12 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  nativeBuildInputs = [
-    gfortran
-    python3
    cmake
-    pkg-config
    fypp
+    gfortran
+    mpi
+    pkg-config
+    python3
  ];

  buildInputs = [
@@ -60,17 +89,17 @@ stdenv.mkDerivation (finalAttrs: {
  propagatedBuildInputs = [ mpi ];

  cmakeFlags = [
-    "-DUSE_OPENMP=ON"
-    "-DUSE_SMM=libxsmm"
-    "-DWITH_C_API=ON"
-    "-DBUILD_TESTING=ON"
-    "-DTEST_OMP_THREADS=2"
-    "-DTEST_MPI_RANKS=2"
-    "-DENABLE_SHARED=ON"
-    "-DUSE_MPI=ON"
+    (lib.cmakeBool "USE_OPENMP" true)
+    (lib.cmakeFeature "USE_SMM" "libxsmm")
+    (lib.cmakeBool "WITH_C_API" true)
+    (lib.cmakeBool "BUILD_TESTING" true)
+    (lib.cmakeFeature "TEST_OMP_THREADS" "2")
+    (lib.cmakeFeature "TEST_MPI_RANKS" "2")
+    (lib.cmakeBool "ENABLE_SHARED" true)
+    (lib.cmakeBool "USE_MPI" true)
  ];

-  checkInputs = [
+  nativeCheckInputs = [
    mpiCheckPhaseHook
  ];

@@ -80,6 +109,7 @@ stdenv.mkDerivation (finalAttrs: {
    description = "Distributed Block Compressed Sparse Row matrix library";
    license = lib.licenses.gpl2Only;
    homepage = "https://github.com/cp2k/dbcsr";
+    changelog = "https://github.com/cp2k/dbcsr/releases/tag/${finalAttrs.src.tag}";
    maintainers = [ lib.maintainers.sheepforce ];
  };
 })
--- a/pkgs/by-name/db/dbeaver-bin/package.nix
+++ b/pkgs/by-name/db/dbeaver-bin/package.nix
@@ -19,7 +19,7 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "dbeaver-bin";
-  version = "26.2.0";
+  version = "26.2.1";

  src =
    let
@@ -31,9 +31,9 @@ stdenvNoCC.mkDerivation (finalAttrs: {
        aarch64-darwin = "macos-aarch64.dmg";
      };
      hash = selectSystem {
-        x86_64-linux = "sha256-9QTnCnR2OqAuC2PWhCuFymRSb2gr5Fez8w4zDMEHSO0=";
-        aarch64-linux = "sha256-atqAOjnAcvyPHHdwZpKY6So1AXRKbh/5GXlKDe35WWM=";
-        aarch64-darwin = "sha256-YqA6qIQp1O7zV2VQOXquddJXagEt7aDIPUtE9fvNSj8=";
+        x86_64-linux = "sha256-Fte9AehPjNj0bWl2rBJ/olZ47AEJU8m03OQZM68gZ+g=";
+        aarch64-linux = "sha256-dvrR2QZNDtra33rIEbM7Z17KeXoQjcRqjjgtoiOZzI4=";
+        aarch64-darwin = "sha256-K/9ehDV8pe4mY/SEI9o52zg9EZbAhvl6oiYYj0qiwKA=";
      };
    in
    fetchurl {
--- a/pkgs/by-name/de/deno/package.nix
+++ b/pkgs/by-name/de/deno/package.nix
@@ -36,7 +36,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "deno";
-  version = "2.9.6";
+  version = "2.9.7";

  __structuredAttrs = true;

@@ -51,10 +51,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    repo = "deno";
    tag = "v${finalAttrs.version}";
    fetchSubmodules = true; # required for tests
-    hash = "sha256-4X7IfQk9NJizhZKqH2EuDnSfk8axkKFyiZEv1FOfWTM=";
+    hash = "sha256-GOhud8uXlsDdyAN84WscakxK2qCFTEYSUwR5Wt2QPAs=";
  };

-  cargoHash = "sha256-EKRC+wqIos9O0GHaxjmb/ghyzV6oCi1qwhO2tjszWR4=";
+  cargoHash = "sha256-VSWkdTJiSX8O3+Kpu7RKnydxB3OcbwG9+NJCvLdFl68=";

  patches = [
    ./patches/0002-tests-replace-hardcoded-paths.patch
--- a/pkgs/by-name/fr/frigate/package.nix
+++ b/pkgs/by-name/fr/frigate/package.nix
@@ -141,7 +141,9 @@ python3Packages.buildPythonApplication (finalAttrs: {
      --replace-fail "/labelmap.txt" "${placeholder "out"}/share/frigate/labelmap.txt"

    substituteInPlace frigate/events/audio.py \
-      --replace-fail "/cpu_audio_model.tflite" "${frigate.models.tflite.yamnet_classification_v1.model}" \
+      --replace-fail "/cpu_audio_model.tflite" "${frigate.models.tflite.yamnet_classification_v1.model}"
+
+    substituteInPlace frigate/events/audio.py frigate/api/app.py \
      --replace-fail "/audio-labelmap.txt" "${placeholder "out"}/share/frigate/audio-labelmap.txt"
  '';

--- a/pkgs/by-name/im/immich/package.nix
+++ b/pkgs/by-name/im/immich/package.nix
@@ -110,7 +110,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "immich";
-  version = "3.2.2";
+  version = "3.2.4";

  __structuredAttrs = true;
  strictDeps = true;
@@ -119,7 +119,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "immich-app";
    repo = "immich";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-napG+EMZbbbeq7R8FtnuDsDwdpxItkwTVWztnw07DfA=";
+    hash = "sha256-/wWep6A/ryocuGMOElcD1lOEwT6tJDdwa5HAcCZUXSs=";
  };

  pnpmDeps = fetchPnpmDeps {
--- a/pkgs/by-name/ma/matrix-conduit/package.nix
+++ b/pkgs/by-name/ma/matrix-conduit/package.nix
@@ -12,16 +12,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "matrix-conduit";
-  version = "0.10.13";
+  version = "0.10.14";

  src = fetchFromGitLab {
    owner = "famedly";
    repo = "conduit";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-1j3q/n6sC3bIVwbcZfegJQO9WaLPfJWqgibO/XNmj6s=";
+    hash = "sha256-A7Gryk1ZWDu751n3rBfv9HUTiokoGhBol/ve9mWwRjA=";
  };

-  cargoHash = "sha256-YfgvcY1yYwlQuoEl21XEAxDR/SDce+OHhZOzp6tkzR0=";
+  cargoHash = "sha256-afYD2cR6VyFSa1M33ktuNcg2/r/Ag3HNKSz95gRCwuE=";

  # Conduit enables rusqlite's bundled feature by default, but we'd rather use our copy of SQLite.
  preBuild = ''
--- a/pkgs/by-name/ni/nix-fast-build/package.nix
+++ b/pkgs/by-name/ni/nix-fast-build/package.nix
@@ -9,7 +9,7 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "nix-fast-build";
-  version = "2.0.3";
+  version = "2.0.4";
  pyproject = true;
  __structuredAttrs = true;

@@ -17,7 +17,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
    owner = "Mic92";
    repo = "nix-fast-build";
    tag = finalAttrs.version;
-    hash = "sha256-L4HfADUq4Imq1LnvmjBPFBEAZAIKD9Pnj6ExRkVqHC4=";
+    hash = "sha256-sc/NZIHkRhgyAzK8Xn6G++vGrl/Uf7QHh+J5fnZ/o4s=";
  };

  build-system = [ python3Packages.setuptools ];
--- a/pkgs/by-name/op/openvino/package.nix
+++ b/pkgs/by-name/op/openvino/package.nix
@@ -5,7 +5,6 @@
  cudaSupport ? opencv.cudaSupport or false,

  # build
-  scons,
  addDriverRunpath,
  autoPatchelfHook,
  cmake,
@@ -37,9 +36,6 @@ let
    getLib
    ;

-  # prevent scons from leaking in the default python version
-  scons' = scons.override { inherit python3Packages; };
-
  python = python3Packages.python.withPackages (
    ps: with ps; [
      cython
@@ -83,7 +79,6 @@ stdenv.mkDerivation (finalAttrs: {
    patchelf
    pkg-config
    python
-    scons'
  ]
  ++ lib.optionals cudaSupport [
    cudaPackages.cuda_nvcc
@@ -98,21 +93,6 @@ stdenv.mkDerivation (finalAttrs: {
    ./gcc-16-fix.patch
  ];

-  # Fix arm computelib ar/ranlib toolchain paths for LTO awareness
-  postPatch = ''
-    substituteInPlace src/plugins/intel_cpu/thirdparty/ComputeLibrary/SConstruct \
-      --replace-fail \
-        "env['AR'] = toolchain_prefix + \"ar\"" \
-        "env['AR'] = \"${lib.getExe' stdenv.cc.cc "gcc-ar"}\"" \
-      --replace-fail \
-        "env['RANLIB'] = toolchain_prefix + \"ranlib\"" \
-        "env['RANLIB'] = \"${lib.getExe' stdenv.cc.cc "gcc-ranlib"}\""
-  '';
-
-  dontUseSconsCheck = true;
-  dontUseSconsBuild = true;
-  dontUseSconsInstall = true;
-
  cmakeFlags = [
    "-Wno-dev"
    "-DCMAKE_MODULE_PATH:PATH=${placeholder "out"}/lib/cmake"
@@ -159,6 +139,7 @@ stdenv.mkDerivation (finalAttrs: {
    (cmakeBool "ENABLE_SYSTEM_PUGIXML" true)
    (cmakeBool "ENABLE_SYSTEM_SNAPPY" true)
    (cmakeBool "ENABLE_SYSTEM_TBB" true)
+    (cmakeBool "ENABLE_ARM_COMPUTE_CMAKE" true)
  ];

  # src/graph/src/plugins/intel_gpu/src/graph/include/reorder_inst.h:24:8: error: type 'struct typed_program_node' violates the C++ One Definition Rule [-Werror=odr]
@@ -193,6 +174,10 @@ stdenv.mkDerivation (finalAttrs: {
      --replace-fail "exec_prefix=\''${prefix}/" "exec_prefix="
  '';

+  disallowedRequisites = [
+    stdenv.cc.cc
+  ];
+
  meta = {
    changelog = "https://github.com/openvinotoolkit/openvino/releases/tag/${finalAttrs.src.tag}";
    description = "Open-source toolkit for optimizing and deploying AI inference";
--- a/pkgs/by-name/ph/phpunit/package.nix
+++ b/pkgs/by-name/ph/phpunit/package.nix
@@ -8,16 +8,16 @@

 php.buildComposerProject2 (finalAttrs: {
  pname = "phpunit";
-  version = "13.3.2";
+  version = "13.3.5";

  src = fetchFromGitHub {
    owner = "sebastianbergmann";
    repo = "phpunit";
    tag = finalAttrs.version;
-    hash = "sha256-pqLjCE7tW7NOAzgFe5grPlRfXTrEXqx1OcFOBCJuO7M=";
+    hash = "sha256-3tbre+82kk8ngpN4JfMEe36YQQZDtY6PgFBUECmUa8o=";
  };

-  vendorHash = "sha256-jxV72scmud977MHDItY7wSmZ5j9fUEafty4foSiGH4Y=";
+  vendorHash = "sha256-Pv5O63wsTaQX5owW0XpyQbcSajaGmesorIatfrgZKJk=";

  passthru = {
    updateScript = nix-update-script { };
--- a/pkgs/by-name/pl/plumed/package.nix
+++ b/pkgs/by-name/pl/plumed/package.nix
@@ -3,6 +3,10 @@
  lib,
  fetchFromGitHub,
  blas,
+
+  # passthru
+  python3Packages,
+  nix-update-script,
 }:

 assert !blas.isILP64;
@@ -11,6 +15,9 @@ stdenv.mkDerivation (finalAttrs: {
  pname = "plumed";
  version = "2.10.1";

+  __structuredAttrs = true;
+  strictDeps = true;
+
  src = fetchFromGitHub {
    owner = "plumed";
    repo = "plumed2";
@@ -26,10 +33,19 @@ stdenv.mkDerivation (finalAttrs: {

  enableParallelBuilding = true;

+  passthru = {
+    tests = {
+      pythonPackage = python3Packages.plumed;
+    };
+
+    updateScript = nix-update-script { };
+  };
+
  meta = {
    description = "Molecular metadynamics library";
    homepage = "https://github.com/plumed/plumed2";
    license = lib.licenses.lgpl3Only;
    maintainers = [ lib.maintainers.sheepforce ];
+    mainProgram = "plumed";
  };
 })
--- a/pkgs/by-name/ri/ripwire/package.nix
+++ b/pkgs/by-name/ri/ripwire/package.nix
@@ -10,7 +10,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ripwire";
-  version = "0.6.1";
+  version = "0.6.5";
  __structuredAttrs = true;
  strictDeps = true;

@@ -18,7 +18,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "redhat-et";
    repo = "ripwire";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-2a4J9lS0rdJyhkXkpQSkFrSf+NsMyeI2mJJNIYvgA8Y=";
+    hash = "sha256-6TeiT79KcEMhJI0HJIDTIOtrjmWgUxz8t8mkLpa2InQ=";
  };

  # Unvendor tree-sitter
--- a/pkgs/by-name/si/simplebluez/package.nix
+++ b/pkgs/by-name/si/simplebluez/package.nix
@@ -10,13 +10,13 @@
 stdenv.mkDerivation (finalAttrs: {
  pname = "simplebluez";

-  version = "1.1.0";
+  version = "1.2.0";

  src = fetchFromGitHub {
    owner = "simpleble";
    repo = "SimpleBLE";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-GNLD62w5zTfW7CaknaZmU0jBro92HFw3gA29KJqOHGA=";
+    hash = "sha256-yA/InInNmK77/VxIX8CH0Nkqy9MJZr0Ci6xrVo76DK4=";
  };

  outputs = [
--- a/pkgs/by-name/ta/tailcat/network-up-before-first-netcheck.patch
+++ b/pkgs/by-name/ta/tailcat/network-up-before-first-netcheck.patch
@@ -0,0 +1,29 @@
+Mark magicsock's network up before SetPrivateKey starts the first netcheck.
+
+With no non-loopback interface (e.g. the Nix build sandbox) the engine
+starts with magicsock's network down. SetPrivateKey and SetDERPMap kick
+off endpoint updates in the background, and if one of them runs before
+the later SetNetworkUp(true), updateNetInfo bails out on networkDown()
+without ever picking a home DERP. A server then is not reachable over
+DERP until the periodic re-STUN 20-26s later, and clients give up after
+10s with "tailcat Ping: context deadline exceeded".
+
+diff --git a/tailcat.go b/tailcat.go
+--- a/tailcat.go
+++ b/tailcat.go
+@@ -1577,6 +1577,7 @@ func (lb *locoBackend) Start() error {
+ 	mc := lb.sys.MagicSock.Get()
+ 	lb.logf("disco pub key: %v", mc.DiscoPublicKey())
+ 
+	mc.SetNetworkUp(true)
+ 	mc.SetPrivateKey(lb.priv)
+ 	mc.SetDERPMap(lb.dm)
+ 
+@@ -1632,7 +1633,6 @@ func (lb *locoBackend) Start() error {
+ 	mc.SetNetworkMap(nm.SelfNode, nm.Peers)
+ 	e.SetSelfNode(nm.SelfNode)
+ 	lb.sys.Netstack.Get().UpdateNetstackIPs(nm)
+-	mc.SetNetworkUp(true)
+ 	lb.logf("NetworkMap: %v", logger.AsJSON(nm))
+ 
+ 	// Install the live per-peer config sources. WireGuard peers are
--- a/pkgs/by-name/ta/tailcat/package.nix
+++ b/pkgs/by-name/ta/tailcat/package.nix
@@ -8,7 +8,7 @@

 buildGo127Module (finalAttrs: {
  pname = "tailcat";
-  version = "0.6.0";
+  version = "0.7.0";

  __structuredAttrs = true;

@@ -16,10 +16,18 @@ buildGo127Module (finalAttrs: {
    owner = "tailscale";
    repo = "tailcat";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-TwrEezNpn9ylDl7+Vo4XS/SaVOgU6h6PO1UWSrXnBWk=";
+    hash = "sha256-Hue5NZAmAf8mxFqgoDcjt7YHiROeudpAoanxSFnZkTk=";
  };

-  vendorHash = "sha256-hpFVgsUKswE7g69EieoeKGPR1nVkcRmBhDKbnB2CDBg=";
+  patches = [
+    # The sandbox has no non-loopback interface, so magicsock starts with
+    # its network down. The server's first netcheck can then run before
+    # SetNetworkUp(true) and it never picks a home DERP, which makes the
+    # e2e tests time out on "tailcat Ping: context deadline exceeded".
+    ./network-up-before-first-netcheck.patch
+  ];
+
+  vendorHash = "sha256-yfOl/gWIijLlqchXFiTRZ7vlgS/kn0xOmv52TFMYs+E=";

  subPackages = [ "cmd/tailcat" ];

--- a/pkgs/by-name/tr/tree-sitter/package.nix
+++ b/pkgs/by-name/tr/tree-sitter/package.nix
@@ -193,6 +193,13 @@ rustPlatform.buildRustPackage (finalAttrs: {
      substituteInPlace ./Makefile \
          --replace-fail 'all: libtree-sitter.a libtree-sitter.$(SOEXT) tree-sitter.pc' 'all: libtree-sitter.a tree-sitter.pc'
      sed -i '/^install:/,/^[^[:space:]]/ { /$(SOEXT/d; }' ./Makefile
+    ''
+    # rquickjs-sys passes the raw rust target to clang, which does not know riscv64gc
+    + lib.optionalString stdenv.hostPlatform.isRiscV64 ''
+      substituteInPlace $cargoDepsCopy/source-*/rquickjs-sys-*/build.rs \
+        --replace-fail \
+          'let mut cflags = vec![format!("--target={}", target)];' \
+          'let mut cflags = vec![format!("--target={}", target.replace("riscv64gc", "riscv64"))];'
    '';

  # The Makefile install can't enable the wasm feature.
--- a/pkgs/by-name/we/wesnoth/package.nix
+++ b/pkgs/by-name/we/wesnoth/package.nix
@@ -10,6 +10,9 @@
  SDL2_net,
  makeBinaryWrapper,
  SDL2_ttf,
+  sdl3,
+  sdl3-image,
+  sdl3-mixer,
  pango,
  gettext,
  boost186,
@@ -22,12 +25,30 @@
  lua5_4,
  curl,
  nix-update-script,
+  versionCheckHook,
  enableDevel ? false,
 }:

 let
  boost = boost186;
  suffix = lib.optionalString enableDevel "-devel";
+
+  sdl =
+    if enableDevel then
+      [
+        sdl3
+        sdl3-image
+        sdl3-mixer
+      ]
+    else
+      [
+        SDL2
+        SDL2_image
+        SDL2_mixer
+        SDL2_net
+        SDL2_ttf
+      ];
+
  # wesnoth requires lua built with c++, see https://github.com/wesnoth/wesnoth/pull/8234
  lua = lua5_4.override {
    postConfigure = ''
@@ -38,7 +59,7 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "wesnoth${suffix}";
-  version = if enableDevel then "1.19.24" else "1.18.8";
+  version = if enableDevel then "1.19.28" else "1.18.8";

  src = fetchFromGitHub {
    owner = "wesnoth";
@@ -46,11 +67,17 @@ stdenv.mkDerivation (finalAttrs: {
    tag = finalAttrs.version;
    hash =
      if enableDevel then
-        "sha256-q6gdzHDPkG/RqpJxIHqWsxD0n8dzKajDhAT49bjmq78="
+        "sha256-5S2kgqn+HZIPguQP+FYaK79Cvx0IRnmcGSeWPQflt/g="
      else
        "sha256-Tgp3y120j5nqoBrDo7D9C0FcVO3TH5lf+/SoCjR+ikc=";
  };

+  strictDeps = true;
+  doInstallCheck = true;
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgram = "${placeholder "out"}/bin/wesnothd${suffix}";
+
  nativeBuildInputs = [
    cmake
    pkg-config
@@ -58,11 +85,6 @@ stdenv.mkDerivation (finalAttrs: {
  ++ lib.optionals stdenv.hostPlatform.isDarwin [ makeBinaryWrapper ];

  buildInputs = [
-    SDL2
-    SDL2_image
-    SDL2_mixer
-    SDL2_net
-    SDL2_ttf
    pango
    gettext
    boost
@@ -74,7 +96,8 @@ stdenv.mkDerivation (finalAttrs: {
    icu
    lua
    curl
-  ];
+  ]
+  ++ sdl;

  cmakeFlags = [
    (lib.cmakeBool "ENABLE_SYSTEM_LUA" true)
--- a/pkgs/by-name/wl/wlc/package.nix
+++ b/pkgs/by-name/wl/wlc/package.nix
@@ -6,12 +6,12 @@

 python3.pkgs.buildPythonPackage rec {
  pname = "wlc";
-  version = "2.1.1";
+  version = "2.2.1";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-z0Ig+SuJ5XdZkDb3I5AXziVFjMAMCIly2vcQRqx62sw=";
+    hash = "sha256-8d5KOfHDY+4gUOc9lGNAayn8IBD5p706lGXpSuskKOU=";
  };

  build-system = with python3.pkgs; [ setuptools ];
--- a/pkgs/by-name/ze/zennotes-desktop/package.nix
+++ b/pkgs/by-name/ze/zennotes-desktop/package.nix
@@ -13,14 +13,14 @@

 buildNpmPackage (finalAttrs: {
  pname = "zennotes-desktop";
-  version = "2.45.0";
-  npmDepsHash = "sha256-+5eIwbSTpRupYj4gR33MDeJEEDBlt+K4idnlZFWG4Z4=";
+  version = "2.57.0";
+  npmDepsHash = "sha256-mblscdXgrIV2D3MjIqR+uqHh304mGnEKDDqsiFZZrB4=";

  src = fetchFromGitHub {
    owner = "ZenNotes";
    repo = "zennotes";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-/HoSAgt7INT5Hharc+ltb2ya8InAuZmhS8Tmftl0VOo=";
+    hash = "sha256-ECRkAs8QhwCp2wEyqGzZ6F9sG9hXaomVEShKXO34tEg=";
  };

  npmWorkspace = "apps/desktop";
--- a/pkgs/development/beam-modules/hooks/mix-release-setup-hook.sh
+++ b/pkgs/development/beam-modules/hooks/mix-release-setup-hook.sh
@@ -54,6 +54,7 @@ mixReleaseRemoveErlangReferences() {
    # use bbe to substitute strings in binary files, because using substituteInPlace
    # on binaries will raise errors
    bbe -e "s|${erlang}/lib/erlang|$out|" -o "$file".tmp "$file"
+    chmod --reference="$file" "$file".tmp
    rm -f "$file"
    mv "$file".tmp "$file"
  done
@@ -75,11 +76,11 @@ mixReleaseStripDebugHook() {
 }

 if [ -z "${dontMixReleaseFixup-}" ]; then
-  preFixupHooks+=(mixReleaseFixupHook)
+  postFixupHooks+=(mixReleaseFixupHook)
 fi

 if [ -n "${removeCookie-1}" ]; then
-  preFixupHooks+=(mixReleaseRemoveCookieHook)
+  postFixupHooks+=(mixReleaseRemoveCookieHook)
 fi

 if [ -n "${stripDebug-}" ]; then
--- a/pkgs/development/cuda-modules/buildRedist/buildRedistHook.bash
+++ b/pkgs/development/cuda-modules/buildRedist/buildRedistHook.bash
@@ -24,9 +24,6 @@ buildRedistHookRegistration() {
  postInstallCheckHooks+=(checkCudaNonEmptyOutputs)
  nixLog "added checkCudaNonEmptyOutputs to postInstallCheckHooks"

-  preFixupHooks+=(fixupPropagatedBuildOutputsForMultipleOutputs)
-  nixLog "added fixupPropagatedBuildOutputsForMultipleOutputs to preFixupHooks"
-
  postFixupHooks+=(fixupCudaPropagatedBuildOutputsToOut)
  nixLog "added fixupCudaPropagatedBuildOutputsToOut to postFixupHooks"

@@ -193,16 +190,6 @@ checkCudaHasStubsIffIncludeRemoveStubsFromRunpathHook() {
  return 0
 }

-# TODO(@connorbaker): https://github.com/NixOS/nixpkgs/issues/323126.
-# _multioutPropagateDev() currently expects a space-separated string rather than an array.
-# NOTE: Because _multioutPropagateDev is a postFixup hook, we correct it in preFixup.
-fixupPropagatedBuildOutputsForMultipleOutputs() {
-  nixLog "converting propagatedBuildOutputs to a space-separated string"
-  # shellcheck disable=SC2124
-  export propagatedBuildOutputs="${propagatedBuildOutputs[@]}"
-  return 0
-}
-
 # The multiple outputs setup hook only propagates build outputs to dev.
 # We want to propagate them to out as well, in case the user interpolates
 # the package into a string -- in such a case, the dev output is not selected
@@ -217,7 +204,7 @@ fixupCudaPropagatedBuildOutputsToOut() {
  mkdir -p "${out:?}/nix-support"

  # NOTE: We must use printWords to ensure the output is a single line.
-  for output in $propagatedBuildOutputs; do
+  for output in "${propagatedBuildOutputs[@]}"; do
    # Propagate the other components to the out output
    nixLog "adding ${!output:?} to propagatedBuildInputs of ${out:?}"
    printWords "${!output:?}" >>"${out:?}/nix-support/propagated-build-inputs"
--- a/pkgs/development/interpreters/lua-5/default.nix
+++ b/pkgs/development/interpreters/lua-5/default.nix
@@ -4,6 +4,8 @@
  lib,
  callPackage,
  fetchFromGitHub,
+  fetchpatch2,
+  applyPatches,
  makeBinaryWrapper,
 }:

@@ -199,6 +201,13 @@ rec {

  luajit_openresty = import ../luajit/openresty.nix {
    self = luajit_openresty;
-    inherit callPackage fetchFromGitHub passthruFun;
+    inherit
+      callPackage
+      fetchFromGitHub
+      fetchpatch2
+      applyPatches
+      stdenv
+      passthruFun
+      ;
  };
 }
--- a/pkgs/development/interpreters/luajit/openresty.nix
+++ b/pkgs/development/interpreters/luajit/openresty.nix
@@ -2,23 +2,45 @@
  self,
  callPackage,
  fetchFromGitHub,
+  fetchpatch2,
+  applyPatches,
+  stdenv,
  passthruFun,
 }:

-callPackage ./default.nix rec {
-  version = "2.1-20260724";
+let
+  version = "2.1-20260824";

  src = fetchFromGitHub {
    owner = "openresty";
    repo = "luajit2";
-    rev = "v${version}";
-    hash = "sha256-cvy9FgHWFuacCFl7/conLwNuMgaol1LnIUiqcnXy9H8=";
+    tag = "v${version}";
+    hash = "sha256-IynlDQOyjCr1C3qibLg3OJ9Qd/Rb5jzjy30ETKdKvFM=";
  };

+  # upstream LuaJIT has no riscv64.
+  # port submitted at https://github.com/openresty/luajit2/pull/236 same as Debian
+  srcWithRiscv64Port = applyPatches {
+    inherit src;
+    patches = [
+      (fetchpatch2 {
+        url = "https://github.com/openresty/luajit2/compare/v2.1-20260824...ce14aff834d8d62220fc730a16042c52451f41cc.diff";
+        hash = "sha256-VHDTUr7PWpthmhO3BokCbdL1cricAnX6BjZGTi1wr3Q=";
+      })
+    ];
+  };
+in
+callPackage ./default.nix {
+  inherit version;
+
+  # default luaAttr would be luajit_2_1, the wrong interpreter for the lua package set
+  luaAttr = "luajit_openresty";
+
+  src = if stdenv.hostPlatform.isRiscV64 then srcWithRiscv64Port else src;
+
  extraMeta = {
    badPlatforms = [
      "loongarch64-linux" # See https://github.com/LuaJIT/LuaJIT/issues/1278
-      "riscv64-linux" # See https://github.com/LuaJIT/LuaJIT/issues/628
      # 64-bit POWER (LE and BE, either ELF ABI version on the latter) *is* supported, but ELFv1 powerpc64-linux has an
      # issue with memory allocation
      # https://github.com/openresty/luajit2/issues/258
--- a/pkgs/development/python-modules/argos-translate-files/default.nix
+++ b/pkgs/development/python-modules/argos-translate-files/default.nix
@@ -62,7 +62,7 @@ buildPythonPackage (finalAttrs: {
  meta = {
    description = "Translate files using Argos Translate";
    homepage = "https://www.argosopentech.com";
-    license = lib.licenses.mit;
+    license = lib.licenses.agpl3Only;
    maintainers = with lib.maintainers; [ misuzu ];
  };
 })
--- a/pkgs/development/python-modules/flare-capa/default.nix
+++ b/pkgs/development/python-modules/flare-capa/default.nix
@@ -1,5 +1,6 @@
 {
  lib,
+  stdenv,
  buildPythonPackage,
  colorama,
  deptry,
@@ -45,7 +46,7 @@
 }:

 buildPythonPackage (finalAttrs: {
-  pname = "capa";
+  pname = "flare-capa";
  version = "9.4.0";
  pyproject = true;

@@ -127,5 +128,8 @@ buildPythonPackage (finalAttrs: {
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ fab ];
    mainProgram = "capa";
+    # Never built on darwin since first introduction in nixpkgs
+    # see https://hydra.nixos.org/build/345235630
+    broken = stdenv.hostPlatform.isDarwin;
  };
 })
--- a/pkgs/development/python-modules/plumed/default.nix
+++ b/pkgs/development/python-modules/plumed/default.nix
@@ -0,0 +1,58 @@
+{
+  lib,
+  stdenv,
+  buildPythonPackage,
+  plumed,
+
+  # build-system
+  cython,
+  setuptools,
+
+  # tests
+  numpy,
+  pandas,
+  pytestCheckHook,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "plumed";
+  inherit (plumed) version src;
+  pyproject = true;
+  __structuredAttrs = true;
+
+  sourceRoot = "${finalAttrs.src.name}/python";
+
+  env = {
+    plumed_version = finalAttrs.version;
+    plumed_include_dir = "${lib.getDev plumed}/include/plumed/wrapper";
+
+    # Hardcode the path to the kernel so that PLUMED_KERNEL does not need to be set at runtime
+    plumed_default_kernel = "${lib.getLib plumed}/lib/libplumedKernel${stdenv.hostPlatform.extensions.sharedLibrary}";
+  };
+
+  build-system = [
+    cython
+    setuptools
+  ];
+
+  buildInputs = [
+    plumed
+  ];
+
+  pythonImportsCheck = [ "plumed" ];
+
+  nativeCheckInputs = [
+    numpy
+    pandas
+    pytestCheckHook
+  ];
+
+  enabledTestPaths = [ "test" ];
+
+  meta = {
+    description = "Python wrappers for plumed";
+    homepage = "https://github.com/plumed/plumed2/tree/master/python";
+    license = lib.licenses.lgpl3Plus;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+  };
+})
--- a/pkgs/misc/uboot/default.nix
+++ b/pkgs/misc/uboot/default.nix
@@ -82,6 +82,13 @@ let
          '') (builtins.attrNames pythonScriptsToInstall)}
          patchShebangs tools
          patchShebangs scripts
+        ''
+        # This warning got removed in
+        # https://git.kernel.org/pub/scm/utils/dtc/dtc.git/commit/?id=cba90ce82064ad1e6d25f20d8eaa940bd2fc97ed
+        + ''
+          for f in scripts/Makefile.lib dts/upstream/Makefile; do
+            substituteInPlace "$f" --replace-fail -Wno-graph_child_address ""
+          done
        '';

        nativeBuildInputs = [
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4395,7 +4395,7 @@ with pkgs;

  luaPackages = lua52Packages;

-  luajit = luajit_2_1;
+  luajit = if stdenv.hostPlatform.isRiscV64 then luajit_openresty else luajit_2_1;

  luarocks = luaPackages.luarocks;
  luarocks-nix = luaPackages.luarocks-nix;
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -156,6 +156,7 @@ mapAliases {
  bz2file = throw "'bz2file' has beem removed, as it was not longed maintained upstream since 2020"; # added 2025-08-26
  calysto-scheme = throw "'calysto-scheme' has been removed as it is no longer maintained upstream"; # Added 2026-01-31
  can = throw "'can' has been renamed to/replaced by 'python-can'"; # Converted to throw 2025-10-29
+  capa = flare-capa; # added 2026-09-29
  casbin = pycasbin; # added 2025-06-12
  cchardet = throw "'cchardet' has been renamed to/replaced by 'faust-cchardet'"; # Converted to throw 2025-10-29
  chai = throw "'chai' has been removed as it is no longer maintained upstream and the repository was archived"; # Added 2026-06-08
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2877,8 +2877,6 @@ self: super: with self; {

  cantools = callPackage ../development/python-modules/cantools { };

-  capa = callPackage ../development/python-modules/capa { };
-
  capstone = callPackage ../development/python-modules/capstone { inherit (pkgs) capstone; };

  capstone_4 = callPackage ../development/python-modules/capstone/4.nix {
@@ -6201,6 +6199,8 @@ self: super: with self; {

  flammkuchen = callPackage ../development/python-modules/flammkuchen { };

+  flare-capa = callPackage ../development/python-modules/flare-capa { };
+
  flasgger = callPackage ../development/python-modules/flasgger { };

  flash-attn = callPackage ../development/python-modules/flash-attn { };
@@ -13804,6 +13804,10 @@ self: super: with self; {

  plumbum = callPackage ../development/python-modules/plumbum { };

+  plumed = callPackage ../development/python-modules/plumed {
+    inherit (pkgs) plumed;
+  };
+
  pluralizer = callPackage ../development/python-modules/pluralizer { };

  pluthon = callPackage ../development/python-modules/pluthon { };