Merge release-26.05 into staging-next-26.05

2026-08-25 17:55:21 +00:00 · 2026-08-11 00:18:30 +00:00
parent 22c4541363 b7b64e4e5a
commit a2fd2a7c3d
30 changed files with 386 additions and 112 deletions
--- a/.github/actions/checkout/action.yml
+++ b/.github/actions/checkout/action.yml
@@ -13,7 +13,7 @@ inputs:
 runs:
  using: composite
  steps:
-    - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+    - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
      env:
        MERGED_SHA: ${{ inputs.merged-as-untrusted-at }}
        TARGET_SHA: ${{ inputs.target-as-trusted-at }}
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,7 +1,9 @@
 version: 2
 updates:
  - package-ecosystem: "github-actions"
-    directory: "/"
+    directories:
+      - "/"
+      - ".github/actions/*/*"
    schedule:
      interval: "weekly"
    labels: []
--- a/maintainers/github-teams.json
+++ b/maintainers/github-teams.json
@@ -2,11 +2,10 @@
  "acme": {
    "description": "Maintain ACME-related packages and modules.",
    "id": 3806126,
-    "maintainers": {
-      "emilazy": 18535642
-    },
+    "maintainers": {},
    "members": {
      "arianvp": 628387,
+      "emilazy": 18535642,
      "m1cr0man": 3044438
    },
    "name": "ACME"
@@ -60,7 +59,6 @@
      "adamcstephens": 2071575,
      "ankhers": 750786,
      "gleber": 33185,
-      "minijackson": 1200507,
      "yurrriq": 1866448
    },
    "name": "Beam"
@@ -68,11 +66,10 @@
  "boot-security": {
    "description": "Maintain support for boot security technologies like Secure Boot",
    "id": 18686947,
-    "maintainers": {
-      "emilazy": 18535642
-    },
+    "maintainers": {},
    "members": {
-      "ElvishJerricco": 1365692
+      "ElvishJerricco": 1365692,
+      "emilazy": 18535642
    },
    "name": "Boot security"
  },
@@ -98,8 +95,8 @@
      "fgaz": 8182846,
      "natsukium": 25083790,
      "philiptaron": 43863,
-      "pyrotelekinetic": 29682759,
-      "tomodachi94": 68489118
+      "tomodachi94": 68489118,
+      "tr3foil": 29682759
    },
    "members": {},
    "name": "Categorization"
@@ -184,7 +181,6 @@
    "description": "Improve Darwin-support across Nixpkgs and help maintainers without access to Darwin hardware. Apply to join through https://github.com/NixOS/nixpkgs/issues/323144 to keep the process transparent.",
    "id": 2385202,
    "maintainers": {
-      "emilazy": 18535642,
      "toonn": 1486805
    },
    "members": {
@@ -211,10 +207,12 @@
      "cideM": 4246921,
      "cidkidnix": 67574902,
      "copumpkin": 2623,
+      "delafthi": 50531499,
      "devusb": 4951663,
      "domenkozar": 126339,
      "dwt": 57199,
      "eclairevoyant": 848000,
+      "emilazy": 18535642,
      "ethancedwards8": 60861925,
      "fiddlerwoaroof": 808745,
      "fulsomenko": 14945057,
@@ -580,11 +578,11 @@
    "id": 9955829,
    "maintainers": {
      "RossComputerGuy": 19699320,
-      "alyssais": 2768870,
-      "emilazy": 18535642
+      "alyssais": 2768870
    },
    "members": {
      "Ericson2314": 1055245,
+      "emilazy": 18535642,
      "peterwaller-arm": 52030119,
      "rrbutani": 7833358
    },
@@ -756,16 +754,6 @@
    },
    "name": "Nixpkgs CI"
  },
-  "nixpkgs-core": {
-    "description": "Provides leadership for and has authority over Nixpkgs.",
-    "id": 14317027,
-    "maintainers": {
-      "alyssais": 2768870,
-      "emilazy": 18535642
-    },
-    "members": {},
-    "name": "Nixpkgs core"
-  },
  "nixpkgs-merge-bot": {
    "description": "This team exists as a target for triggering the nixpkgs merge bot.",
    "id": 13926892,
@@ -1001,11 +989,11 @@
    "id": 11265412,
    "maintainers": {
      "RossComputerGuy": 19699320,
-      "emilazy": 18535642,
      "philiptaron": 43863
    },
    "members": {
      "Ericson2314": 1055245,
+      "emilazy": 18535642,
      "reckenrode": 7413633
    },
    "name": "stdenv"
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -23364,6 +23364,12 @@
    githubId = 12279531;
    name = "Ricardo Guevara";
  };
+  rharish = {
+    email = "harish.rajagopals@gmail.com";
+    github = "rharish101";
+    githubId = 25344287;
+    name = "Harish Rajagopal";
+  };
  rhelmot = {
    name = "Audrey Dutcher";
    github = "rhelmot";
@@ -28271,6 +28277,12 @@
    githubId = 5623227;
    name = "Quentin Boyer";
  };
+  tree-sapii = {
+    email = "supersapiiiiii@gmail.com";
+    github = "tree-sapii";
+    githubId = 144389458;
+    name = "sapii";
+  };
  treemo = {
    email = "matthieu.chevrier@treemo.fr";
    github = "treemo";
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -24,6 +24,8 @@

 - [Nezha](https://github.com/nezhahq/nezha), a self-hosted, lightweight server and website monitoring and O&M tool. Available as [services.nezha](#opt-services.nezha.enable).

+- [feishin](https://github.com/jeffvli/feishin), a modern self-hosted music player. Available as [services.feishin](#opt-services.feishin.enable).
+
 - [FlapAlerted](https://github.com/Kioubit/FlapAlerted), detects BGP flapping events and provides statistics based on BGP update messages. Available as [services.flap-alerted](#opt-services.flap-alerted.enable).

 ## Backward Incompatibilities {#sec-release-26.11-incompatibilities}
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1651,6 +1651,7 @@
  ./services/web-apps/engelsystem.nix
  ./services/web-apps/ente.nix
  ./services/web-apps/fediwall.nix
+  ./services/web-apps/feishin.nix
  ./services/web-apps/fider.nix
  ./services/web-apps/filebrowser.nix
  ./services/web-apps/firefly-iii-data-importer.nix
--- a/nixos/modules/services/networking/technitium-dns-server.nix
+++ b/nixos/modules/services/networking/technitium-dns-server.nix
@@ -66,6 +66,7 @@ in

        StateDirectory = "technitium-dns-server";
        LogsDirectory = "technitium";
+        WorkingDirectory = "%S/technitium-dns-server";

        Restart = "always";
        RestartSec = 10;
--- a/nixos/modules/services/web-apps/feishin.nix
+++ b/nixos/modules/services/web-apps/feishin.nix
@@ -0,0 +1,156 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.feishin;
+in
+{
+  options.services.feishin = {
+    enable = lib.mkEnableOption "the web version of Feishin";
+
+    package = lib.mkPackageOption pkgs "feishin-web" { };
+
+    domain = lib.mkOption {
+      description = "Domain to use for the virtualhost.";
+      type = lib.types.str;
+    };
+
+    pathbase = lib.mkOption {
+      description = "URL path base to use for the virtualhost.";
+      type = lib.types.str;
+      default = "";
+      example = "/music";
+    };
+
+    settings = lib.mkOption {
+      description = ''
+        Configuration for the web version of Feishin, specified as key-value pairs.
+
+        Refer to <https://github.com/jeffvli/feishin#configuration>, and
+        <https://github.com/jeffvli/feishin/blob/development/settings.js.template>
+        for the template.
+      '';
+      type = lib.types.attrsOf lib.types.str;
+      default = {
+        ANALYTICS_DISABLED = "true";
+      };
+      example = {
+        ANALYTICS_DISABLED = "true";
+        SERVER_NAME = "My Server";
+        SERVER_LOCK = "true";
+      };
+    };
+
+    nginx = {
+      enable = lib.mkEnableOption "a virtualhost to serve Feishin through nginx";
+
+      virtualHost = lib.mkOption {
+        description = "Extra configuration for the nginx virtualhost for Feishin.";
+        type = lib.types.submodule (import ../web-servers/nginx/vhost-options.nix { inherit config lib; });
+        default = { };
+        example = lib.literalExpression ''
+          {
+            serverAliases = [ "feishin.''${config.networking.domain}" ];
+          }
+        '';
+      };
+    };
+
+    caddy = {
+      enable = lib.mkEnableOption "a virtualhost to serve Feishin through Caddy";
+
+      virtualHost = lib.mkOption {
+        description = "Extra configuration for the Caddy virtualhost for Feishin.";
+        type = lib.types.submodule (
+          import ../web-servers/caddy/vhost-options.nix { cfg = config.services.caddy; }
+        );
+        default = { };
+        example = lib.literalExpression ''
+          {
+            serverAliases = [ "feishin.''${config.networking.domain}" ];
+          }
+        '';
+      };
+    };
+  };
+
+  config =
+    let
+      resolvedSettings =
+        cfg.settings // lib.optionalAttrs (cfg.pathbase != "") { PUBLIC_PATH = cfg.pathbase; };
+      settingsJs = ''
+        "use strict";
+        ${lib.concatMapAttrsStringSep "\n" (name: value: ''window.${name} = "${value}";'') resolvedSettings}
+      '';
+      settingsJsDir = pkgs.writeTextDir "settings.js" settingsJs;
+    in
+    lib.mkIf cfg.enable {
+      services.nginx = lib.mkIf cfg.nginx.enable {
+        enable = lib.mkDefault true;
+        virtualHosts."${cfg.domain}" = lib.mkMerge [
+          cfg.nginx.virtualHost
+          {
+            root = lib.mkForce "${cfg.package}";
+            extraConfig = ''
+              gzip on;
+              gzip_vary    on;
+              gzip_proxied any;
+              gzip_types   text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;
+            '';
+            locations."${cfg.pathbase}/" = {
+              tryFiles = "$uri $uri/ /index.html =404";
+            };
+            locations."=${cfg.pathbase}/settings.js" = {
+              alias = settingsJsDir + "/settings.js";
+              extraConfig = ''
+                add_header Cache-Control "no-store";
+              '';
+            };
+          }
+        ];
+      };
+
+      services.caddy = lib.mkIf cfg.caddy.enable {
+        enable = lib.mkDefault true;
+        virtualHosts."${cfg.domain}" = lib.mkMerge [
+          cfg.caddy.virtualHost
+          {
+            hostName = lib.mkForce cfg.domain;
+            extraConfig =
+              let
+                baseConfig = ''
+                  encode
+                  handle /settings.js {
+                    header Cache-Control no-store
+                    root ${settingsJsDir}
+                    file_server
+                  }
+                  handle {
+                    root ${cfg.package}
+                    try_files {path} /index.html
+                    file_server
+                  }
+                '';
+              in
+              if (cfg.pathbase == "") then
+                baseConfig
+              else
+                ''
+                  handle_path ${cfg.pathbase}/* {
+                    ${baseConfig}
+                  }
+                '';
+          }
+        ];
+      };
+    };
+
+  meta.maintainers = with lib.maintainers; [
+    rharish
+    BatteredBunny
+  ];
+}
--- a/nixos/modules/services/web-apps/misskey.nix
+++ b/nixos/modules/services/web-apps/misskey.nix
@@ -231,7 +231,7 @@ in
        webserver = lib.mkOption {
          type = lib.types.attrTag {
            nginx = lib.mkOption {
-              type = lib.types.submodule (import ../web-servers/nginx/vhost-options.nix);
+              type = lib.types.submodule ../web-servers/nginx/vhost-options.nix;
              default = { };
              description = ''
                Extra configuration for the nginx virtual host of Misskey.
@@ -240,7 +240,7 @@ in
            };
            caddy = lib.mkOption {
              type = lib.types.submodule (
-                import ../web-servers/caddy/vhost-options.nix { cfg = config.services.caddy; }
+                lib.modules.importApply ../web-servers/caddy/vhost-options.nix { cfg = config.services.caddy; }
              );
              default = { };
              description = ''
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -560,6 +560,7 @@ in
  fastnetmon-advanced = runTest ./fastnetmon-advanced.nix;
  fcitx5 = runTest ./fcitx5;
  fedimintd = runTest ./fedimintd.nix;
+  feishin = handleTest ./feishin { };
  ferm = runTest ./ferm.nix;
  ferretdb = import ./ferretdb.nix { inherit pkgs runTest; };
  fider = runTest ./fider.nix;
--- a/nixos/tests/feishin/caddy.nix
+++ b/nixos/tests/feishin/caddy.nix
@@ -0,0 +1,36 @@
+import ../make-test-python.nix (
+  { lib, ... }:
+
+  {
+    name = "feishin-caddy";
+    meta.maintainers = with lib.maintainers; [
+      rharish
+      BatteredBunny
+    ];
+
+    nodes.machine =
+      { pkgs, ... }:
+      {
+        services.feishin = {
+          enable = true;
+          domain = "localhost:80";
+          pathbase = "/feishin";
+          settings = {
+            ANALYTICS_DISABLED = "true";
+          };
+          caddy.enable = true;
+          caddy.virtualHost.extraConfig = "tls internal";
+        };
+        # disable letsencrypt cert fetching
+        services.caddy.globalConfig = "auto_https disable_certs";
+      };
+
+    testScript = ''
+      machine.wait_for_unit("caddy.service")
+      machine.wait_for_open_port(80)
+      machine.succeed("curl -vvv --fail --show-error --silent --location --insecure http://localhost/feishin/")
+      assert "<title>Feishin</title>" in machine.succeed("curl --fail --show-error --silent --location --insecure http://localhost/feishin/")
+      assert "window.ANALYTICS_DISABLED = \"true\";" in machine.succeed("curl --fail --show-error --silent --location --insecure http://localhost/feishin/settings.js")
+    '';
+  }
+)
--- a/nixos/tests/feishin/default.nix
+++ b/nixos/tests/feishin/default.nix
@@ -0,0 +1,6 @@
+{ system, pkgs, ... }:
+
+{
+  caddy = import ./caddy.nix { inherit system pkgs; };
+  nginx = import ./nginx.nix { inherit system pkgs; };
+}
--- a/nixos/tests/feishin/nginx.nix
+++ b/nixos/tests/feishin/nginx.nix
@@ -0,0 +1,33 @@
+import ../make-test-python.nix (
+  { lib, ... }:
+
+  {
+    name = "feishin-nginx";
+    meta.maintainers = with lib.maintainers; [
+      rharish
+      BatteredBunny
+    ];
+
+    nodes.machine =
+      { pkgs, ... }:
+      {
+        services.feishin = {
+          enable = true;
+          domain = "localhost";
+          pathbase = "/feishin";
+          settings = {
+            ANALYTICS_DISABLED = "true";
+          };
+          nginx.enable = true;
+        };
+      };
+
+    testScript = ''
+      machine.wait_for_unit("nginx.service")
+      machine.wait_for_open_port(80)
+      machine.succeed("curl -vvv --fail --show-error --silent --location --insecure http://localhost/feishin/")
+      assert "<title>Feishin</title>" in machine.succeed("curl --fail --show-error --silent --location --insecure http://localhost/feishin/")
+      assert "window.ANALYTICS_DISABLED = \"true\";" in machine.succeed("curl --fail --show-error --silent --location --insecure http://localhost/feishin/settings.js")
+    '';
+  }
+)
--- a/pkgs/by-name/bi/bitwarden-desktop/dont-auto-setup-biometrics.patch
+++ b/pkgs/by-name/bi/bitwarden-desktop/dont-auto-setup-biometrics.patch
@@ -1,8 +1,8 @@
-diff --git a/apps/desktop/src/key-management/biometrics/os-biometrics-linux.service.ts b/apps/desktop/src/key-management/biometrics/os-biometrics-linux.service.ts
-index 791b4d6f88..dfee0bbf8d 100644
--- a/apps/desktop/src/key-management/biometrics/os-biometrics-linux.service.ts
-+++ b/apps/desktop/src/key-management/biometrics/os-biometrics-linux.service.ts
-@@ -115,7 +115,7 @@ export default class OsBiometricsServiceLinux implements OsBiometricService {
+diff --git a/apps/desktop/src/key-management/biometrics/native-v2/os-biometrics-linux.service.ts b/apps/desktop/src/key-management/biometrics/native-v2/os-biometrics-linux.service.ts
+index 110db23ec79..dfaf600bcdf 100644
+--- a/apps/desktop/src/key-management/biometrics/native-v2/os-biometrics-linux.service.ts
+++ b/apps/desktop/src/key-management/biometrics/native-v2/os-biometrics-linux.service.ts
+@@ -83,7 +83,7 @@ export default class OsBiometricsServiceLinux implements OsBiometricService {
     // The user needs to manually set up the polkit policy outside of the sandbox
     // since we allow access to polkit via dbus for the sandboxed clients, the authentication works from
     // the sandbox, once the policy is set up outside of the sandbox.
@@ -10,4 +10,4 @@ index 791b4d6f88..dfee0bbf8d 100644
 +    return false;
   }
 
-   async osBiometricsSetup(): Promise<void> {
+   async runSetup(): Promise<void> {
--- a/pkgs/by-name/bi/bitwarden-desktop/package.nix
+++ b/pkgs/by-name/bi/bitwarden-desktop/package.nix
@@ -5,15 +5,14 @@
  copyDesktopItems,
  dart-sass,
  darwin,
-  electron_39,
+  electron_41,
  fetchFromGitHub,
  gnome-keyring,
  jq,
-  llvmPackages_18,
  makeDesktopItem,
  makeWrapper,
  nix-update-script,
-  nodejs_22,
+  nodejs_24,
  pkg-config,
  rustc,
  rustPlatform,
@@ -22,24 +21,18 @@
 }:

 let
-  description = "Secure and free password manager for all of your devices";
  icon = "bitwarden";
-  electron = electron_39;
-
-  # argon2 npm dependency is using `std::basic_string<uint8_t>`, which is no longer allowed in LLVM 19
-  buildNpmPackage' = buildNpmPackage.override {
-    stdenv = if stdenv.hostPlatform.isDarwin then llvmPackages_18.stdenv else stdenv;
-  };
+  electron = electron_41;
 in
-buildNpmPackage' rec {
+buildNpmPackage (finalAttrs: {
  pname = "bitwarden-desktop";
-  version = "2026.5.0";
+  version = "2026.7.0";

  src = fetchFromGitHub {
    owner = "bitwarden";
    repo = "clients";
-    rev = "desktop-v${version}";
-    hash = "sha256-R00wt5W4kKmFIODEaGoUqDwfGyHH/2PpiRaC8Gq3d88=";
+    tag = "desktop-v${finalAttrs.version}";
+    hash = "sha256-E4glf4G70BuT0GYu1kEb5Z9B76ElIlDPe1rdGSdmCzo=";
  };

  patches = [
@@ -55,10 +48,6 @@ buildNpmPackage' rec {
  ];

  postPatch = ''
-    # https://github.com/bitwarden/clients/pull/20480
-    substituteInPlace package-lock.json apps/desktop/desktop_native/napi/package.json \
-      --replace-fail '"@napi-rs/cli": "3.5.1"' '"@napi-rs/cli": "3.2.0"'
-
    # remove code under unfree license
    rm -r bitwarden_license

@@ -75,7 +64,7 @@ buildNpmPackage' rec {
    rm -r apps/cli
  '';

-  nodejs = nodejs_22;
+  nodejs = nodejs_24;

  makeCacheWritable = true;
  npmFlags = [
@@ -85,17 +74,17 @@ buildNpmPackage' rec {

  npmWorkspace = "apps/desktop";
  npmDepsFetcherVersion = 2;
-  npmDepsHash = "sha256-xmb3zwE8/nWpRlUOgTz2UhNRaUA8KW9sHQHA97pjjfg=";
+  npmDepsHash = "sha256-WRxlvkgWboO0ukUHgjC5CrfgfwnmUfDXI4r5dx9CKww=";

  cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit
+    inherit (finalAttrs)
      pname
      version
      src
      cargoRoot
      patches
      ;
-    hash = "sha256-phvk4t1JKfSYGzm/vm1rT8A0fACHJF/C0WiZ2Lk3cV0=";
+    hash = "sha256-PLfR+yS+MtscRRuyLaK/qIWJVDoefhOobev1fpNeHNo=";
  };
  cargoRoot = "apps/desktop/desktop_native";

@@ -175,7 +164,7 @@ buildNpmPackage' rec {
  ];

  preCheck = ''
-    pushd ${cargoRoot}
+    pushd ${finalAttrs.cargoRoot}
    cargoCheckType=release
    HOME=$(mktemp -d)
  '';
@@ -208,7 +197,7 @@ buildNpmPackage' rec {
    # Extract the polkit policy file from the multiline string in the source code.
    # This may break in the future but its better than copy-pasting it manually.
    mkdir -p $out/share/polkit-1/actions/
-    pushd apps/desktop/src/key-management/biometrics
+    pushd apps/desktop/src/key-management/biometrics/native-v2
    awk '/const polkitPolicy = `/{gsub(/^.*`/, ""); print; str=1; next} str{if (/`;/) str=0; gsub(/`;/, ""); print}' os-biometrics-linux.service.ts > $out/share/polkit-1/actions/com.bitwarden.Bitwarden.policy
    popd

@@ -229,7 +218,7 @@ buildNpmPackage' rec {
      name = "bitwarden";
      exec = "bitwarden %U";
      inherit icon;
-      comment = description;
+      comment = finalAttrs.meta.description;
      desktopName = "Bitwarden";
      categories = [ "Utility" ];
      mimeTypes = [ "x-scheme-handler/bitwarden" ];
@@ -246,11 +235,14 @@ buildNpmPackage' rec {
  };

  meta = {
-    changelog = "https://github.com/bitwarden/clients/releases/tag/${src.rev}";
-    inherit description;
+    changelog = "https://github.com/bitwarden/clients/releases/tag/${finalAttrs.src.tag}";
+    description = "Secure and free password manager for all of your devices";
    homepage = "https://bitwarden.com";
    license = lib.licenses.gpl3;
-    maintainers = with lib.maintainers; [ amarshall ];
+    maintainers = with lib.maintainers; [
+      tree-sapii
+      amarshall
+    ];
    platforms = [
      "x86_64-linux"
      "aarch64-linux"
@@ -259,4 +251,4 @@ buildNpmPackage' rec {
    ];
    mainProgram = "bitwarden";
  };
-}
+})
--- a/pkgs/by-name/bl/blackfire/package.nix
+++ b/pkgs/by-name/bl/blackfire/package.nix
@@ -11,7 +11,7 @@

 stdenv.mkDerivation rec {
  pname = "blackfire";
-  version = "2026.7.0";
+  version = "2026.8.0";

  src =
    passthru.sources.${stdenv.hostPlatform.system}
@@ -60,19 +60,19 @@ stdenv.mkDerivation rec {
    sources = {
      "x86_64-linux" = fetchurl {
        url = "https://packages.blackfire.io/debian/pool/any/main/b/blackfire/blackfire_${version}_amd64.deb";
-        hash = "sha256-GzhcK+7NrQEP48XFmOQ9PVrvvsUzrCy/VRcshTSic9E=";
+        hash = "sha256-9hBHQvR4w7AnJGL5FdzfYyxoAOnoFtsOC8Fd+7A+Y0M=";
      };
      "i686-linux" = fetchurl {
        url = "https://packages.blackfire.io/debian/pool/any/main/b/blackfire/blackfire_${version}_i386.deb";
-        hash = "sha256-F6U7YHSBE5Ogie2yBSGGUKt0XsE8jogKi2GP28H1Eeo=";
+        hash = "sha256-HnNgdGVhzX+WIXzgfukPZAKB7jr9PwxOUJ8iMOaMOI8=";
      };
      "aarch64-linux" = fetchurl {
        url = "https://packages.blackfire.io/debian/pool/any/main/b/blackfire/blackfire_${version}_arm64.deb";
-        hash = "sha256-eDJAjd/5omgUJ6sw5kCqxu7Ok2AYei/WGlXV96Ynd/U=";
+        hash = "sha256-Q89i59KSA2oN8PEVScmnf56i6MJZgDbpTNW8Eojd8To=";
      };
      "aarch64-darwin" = fetchurl {
        url = "https://packages.blackfire.io/blackfire/${version}/blackfire-darwin_arm64.pkg.tar.gz";
-        hash = "sha256-xzWw6us+9/r8lMMHZTgE++rX7ZZShAL7L7fOneALA4Q=";
+        hash = "sha256-h3vTwK8/wZLoAsAnFSSiDe6CvZNtPG0TAAt4Vts4GBE=";
      };
      "x86_64-darwin" = fetchurl {
        url = "https://packages.blackfire.io/blackfire/${version}/blackfire-darwin_amd64.pkg.tar.gz";
--- a/pkgs/by-name/fo/forge-mtg/package.nix
+++ b/pkgs/by-name/fo/forge-mtg/package.nix
@@ -16,13 +16,13 @@
 }:

 let
-  version = "2.0.13";
+  version = "2.0.14";

  src = fetchFromGitHub {
    owner = "Card-Forge";
    repo = "forge";
    rev = "forge-${version}";
-    hash = "sha256-BU2RkXE3oMVLlCqebQwidH/ZtHKrrD47PAQhMnF/8pU=";
+    hash = "sha256-q9gGTbt70xogF6C359xSnyuf0gz/OKjONEXkKghzJkc=";
  };

  # launch4j downloads and runs a native binary during the package phase.
--- a/pkgs/by-name/gi/github-runner/package.nix
+++ b/pkgs/by-name/gi/github-runner/package.nix
@@ -35,13 +35,13 @@ assert builtins.all (

 buildDotnetModule (finalAttrs: {
  pname = "github-runner";
-  version = "2.335.1";
+  version = "2.336.0";

  src = fetchFromGitHub {
    owner = "actions";
    repo = "runner";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-mFwWhpFzp0pT7WaMpF/N6PGw0IJt3I6/e7GDgw9wA2U=";
+    hash = "sha256-wzPGtNdKszDT8VMgL13xUUp+IhP8UzpXVHkR0T2Ns1A=";
    leaveDotGit = true;
    postFetch = ''
      git -C $out rev-parse --short HEAD > $out/.git-revision
@@ -374,6 +374,7 @@ buildDotnetModule (finalAttrs: {
      kfollesdal
      aanderse
      zimbatm
+      schmittlauch
    ];
    platforms = [
      "x86_64-linux"
--- a/pkgs/by-name/ja/jackett/package.nix
+++ b/pkgs/by-name/ja/jackett/package.nix
@@ -12,13 +12,13 @@

 buildDotnetModule (finalAttrs: {
  pname = "jackett";
-  version = "0.24.2288";
+  version = "0.24.2335";

  src = fetchFromGitHub {
    owner = "jackett";
    repo = "jackett";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-6K/9napcF5T57ziPhbU5glQAkWCEOzFjn9KToB1vVO4=";
+    hash = "sha256-QDpjw525VHumabdeRwDxvsUxzJXTxQneezR8YDEHdLE=";
  };

  projectFile = "src/Jackett.Server/Jackett.Server.csproj";
--- a/pkgs/by-name/li/linux-firmware/package.nix
+++ b/pkgs/by-name/li/linux-firmware/package.nix
@@ -23,13 +23,13 @@ let
 in
 stdenvNoCC.mkDerivation rec {
  pname = "linux-firmware";
-  version = "20260622";
+  version = "20260810";

  src = fetchFromGitLab {
    owner = "kernel-firmware";
    repo = "linux-firmware";
    tag = version;
-    hash = "sha256-nSoJhgI4hAxtNmnj5M6ticzuBSt9uNAYcmc1VR/yXxE=";
+    hash = "sha256-P/fPpqaatp8Z2GV+I/OChiWGn6AhV+8w1RMFuX/LqHc=";
  };

  postUnpack = ''
--- a/pkgs/by-name/ma/matrix-authentication-service/package.nix
+++ b/pkgs/by-name/ma/matrix-authentication-service/package.nix
@@ -20,16 +20,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "matrix-authentication-service";
-  version = "1.21.0";
+  version = "1.22.0";

  src = fetchFromGitHub {
    owner = "element-hq";
    repo = "matrix-authentication-service";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-4z+u1IM2pclccv9+IH8IWjCodDxWZmffbqWPC726sIg=";
+    hash = "sha256-vy9eZYtlAMPXh+xvgAOEeJd7jZirX5Y4sXmNbYLBYGI=";
  };

-  cargoHash = "sha256-HQU0zaK7rLJnTX5WVZrqNEaT5HfFLDzs+pHRxx5XTaA=";
+  cargoHash = "sha256-3MDbg+vfLIqSDiRqBVZs2zbrg9UUpe4Vx+Ze656yOdE=";

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
--- a/pkgs/by-name/ma/matrix-tuwunel/package.nix
+++ b/pkgs/by-name/ma/matrix-tuwunel/package.nix
@@ -88,16 +88,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "matrix-tuwunel";
-  version = "1.8.2";
+  version = "1.8.3";

  src = fetchFromGitHub {
    owner = "matrix-construct";
    repo = "tuwunel";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-mfdX5HmuXf6s7zyT9AJUoz4v5v9Km+VX8z6KvRGq8F8=";
+    hash = "sha256-Csq8eHV2r28POX+Ce1lZ0ybIw5Wt3ABUbWg2W8p2lOw=";
  };

-  cargoHash = "sha256-jIgL/4i17H216goZ8DiFvIJTCKyjEHGiky3MTO5sQoY=";
+  cargoHash = "sha256-mShVBCwd8cwF7K1ILf1gn7ImaxwF73KP2YiDiAJV0f0=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/ne/necesse-server/package.nix
+++ b/pkgs/by-name/ne/necesse-server/package.nix
@@ -6,7 +6,7 @@
 }:

 let
-  version = "1.3.1-24494674";
+  version = "1.3.2-24574169";
  urlVersion = lib.replaceStrings [ "." ] [ "-" ] version;

 in
@@ -16,7 +16,7 @@ stdenvNoCC.mkDerivation {

  src = fetchzip {
    url = "https://necesse.pwn.sh/server/necesse-server-linux64-${urlVersion}.zip";
-    hash = "sha256-A2mWnIIRGNfbxg7aZDwEk7QvuDUUpr2ARIddasTlvFM=";
+    hash = "sha256-WJY9cTtkZcL55khatPesG1asS06tUnazzP0bp80cfu8=";
  };

  # removing packaged jre since we use our own
--- a/pkgs/by-name/so/sonarr/package.nix
+++ b/pkgs/by-name/so/sonarr/package.nix
@@ -21,7 +21,7 @@
  applyPatches,
 }:
 let
-  version = "4.0.18.2971";
+  version = "4.0.19.2979";
  # The dotnet8 compatibility patches also change `yarn.lock`, so we must pass
  # the already patched lockfile to `fetchYarnDeps`.
  src = applyPatches {
@@ -29,7 +29,7 @@ let
      owner = "Sonarr";
      repo = "Sonarr";
      tag = "v${version}";
-      hash = "sha256-83qbbBNk42KjKZNvYaAINoWZa3uEgaV0eveGl9dKTd8=";
+      hash = "sha256-hYO7I1zaBSYgobd8GvIx/sWyRzflXMFjnnPB21pm4wQ=";
    };
    postPatch = ''
      mv src/NuGet.Config NuGet.Config
@@ -39,6 +39,20 @@ let
        --replace-fail 'IPNetwork' 'Microsoft.AspNetCore.HttpOverrides.IPNetwork'
    '';
    patches = lib.optionals (lib.versionOlder version "5.0") [
+      # Prerequisite for .NET 8 patches, some commits
+      # touching the same files have to be reverted
+      (fetchpatch {
+        name = "revert-ffprobe-bump";
+        url = "https://github.com/Sonarr/Sonarr/commit/34761ca2162eb45d1f207a097f0d546239665bfa.patch";
+        revert = true;
+        hash = "sha256-8DNXrWtaTwNthI4tCXIf9a3xF2dBwo7IPdbtGStFX50=";
+      })
+      (fetchpatch {
+        name = "revert-mailkit-bump";
+        url = "https://github.com/Sonarr/Sonarr/commit/0718ba00041bf2d74749dc246bc02ad0540ec24e.patch";
+        revert = true;
+        hash = "sha256-+S4bt5Ult48nwXXOhZ57UIOYg0sInZDlvBWeySZfGyY=";
+      })
      # See https://github.com/Sonarr/Sonarr/issues/7442 and
      # https://github.com/Sonarr/Sonarr/pull/7443.
      # Unfortunately, the .NET 8 upgrade was only merged into the v5 branch,
--- a/pkgs/development/compilers/zulu/common.nix
+++ b/pkgs/development/compilers/zulu/common.nix
@@ -32,16 +32,14 @@
  ffmpeg,
 }:
 let
-  dist =
-    dists.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+  dist = dists.${stdenv.hostPlatform.system} or (builtins.head (builtins.attrValues dists));

  arch =
    {
      "aarch64" = "aarch64";
      "x86_64" = "x64";
    }
-    .${stdenv.hostPlatform.parsed.cpu.name}
-      or (throw "Unsupported architecture: ${stdenv.hostPlatform.parsed.cpu.name}");
+    .${stdenv.hostPlatform.parsed.cpu.name} or "unsupported";

  platform =
    {
--- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -15,14 +15,14 @@ let
  variants = {
    # ./update-xanmod.sh lts
    lts = {
-      version = "6.18.42";
-      hash = "sha256-yDtXLGdFM4rg8mtxUJbUvCvjs2dvFiSGuCV7seKlWqM=";
+      version = "6.18.44";
+      hash = "sha256-o0uvZj3wJcT8JbR8c42ayN3VUF5Ke6RIQ+igBWZNJmY=";
      isLTS = true;
    };
    # ./update-xanmod.sh main
    main = {
-      version = "7.1.6";
-      hash = "sha256-H+dNmTMCWfJm792HR6lz1wVUD70pyZpn5HlTUXwsnLI=";
+      version = "7.1.8";
+      hash = "sha256-4VqaaQ+BXVUY14W9XTZy7IESmLEB/Rbko4sFl10OmCA=";
    };
  };

--- a/pkgs/servers/nextcloud/packages/32.json
+++ b/pkgs/servers/nextcloud/packages/32.json
@@ -190,9 +190,9 @@
    ]
  },
  "integration_deepl": {
-    "hash": "sha256-RHYxxZw/2/uDdZdf8kGYgGBlBi1rfgXUtTtr9lgr/20=",
-    "url": "https://github.com/nextcloud-releases/integration_deepl/releases/download/v2.2.0/integration_deepl-v2.2.0.tar.gz",
-    "version": "2.2.0",
+    "hash": "sha256-PMK1Z3oFVkN8WtgySidCLnp+SZ3xHkPfzI2xVBfBm/k=",
+    "url": "https://github.com/nextcloud-releases/integration_deepl/releases/download/v2.3.0/integration_deepl-v2.3.0.tar.gz",
+    "version": "2.3.0",
    "description": "Deepl integration providing an translations through deepl.com with Nextcloud\n\nThis app integrates with [Nextcloud Assistant](https://apps.nextcloud.com/apps/assistant) to offer translation services We recommend to install Assistant additionally and activate Deepl as translation provider in the Artifical Intelligence admin settings.\n\nThis app also integrates with the translation API of Nextcloud server to offer translation services without Assistant. Currently this is available in Text and Talk.\n\nTo run translations and any other Task Processing tasks synchronously, run the following command in a background process (10 is the interval in seconds when the process should relaunch to use the latest php changes):\n\n```sh\nset -e; while true; do occ background-job:worker -v -t 10 \"OC\\TaskProcessing\\SynchronousBackgroundJob\"; done\n```\n\n## Ethical AI Rating\n### Rating: 🔴\n\nNegative:\n* the software for training and inferencing of this model is proprietary, limiting running it locally or training by yourself\n* the trained model is not freely available, so the model can not be ran on-premises\n* the training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model’s performance and CO2 usage.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).",
    "homepage": "https://github.com/nextcloud/integration_deepl",
    "licenses": [
@@ -309,10 +309,20 @@
      "agpl"
    ]
  },
+  "pantry": {
+    "hash": "sha256-kPldsAVbpoJ+6kMWmh70j3HBTlzZibtbyr5tvT0ZcaA=",
+    "url": "https://github.com/chenasraf/nextcloud-pantry/releases/download/v0.24.0/pantry-v0.24.0.tar.gz",
+    "version": "0.24.0",
+    "description": "Pantry helps households stay organized in Nextcloud.\n\n- **Houses** group members and their shared data. A person can belong to multiple houses and switch between them freely.\n- **Checklists** support recurring items (e.g. milk every week) that automatically reappear when due. Share lists with the whole household so everyone knows what to pick up.\n- **Photo boards** let you keep shared reference photos organized in folders — the right brand of dog food, a favorite recipe card, a product label, and so on.\n- **Notes wall** gives the household a lightweight shared space for reminders, pinned messages, and quick notes with customizable colors.\n- **Notifications** keep everyone in the loop when photos are uploaded or notes are added or edited.\n\nAll data is scoped to a house; members only see the houses they belong to.\n\nPantry also has companion apps for mobile and desktop that let you manage your lists, photos and notes on the go and keep everything in sync with your Nextcloud instance.\n\n**Companion apps:** Android ([Google Play](https://play.google.com/store/apps/details?id=dev.casraf.pantry), [F-Droid](https://f-droid.org/en/packages/dev.casraf.pantry/)) | iOS/macOS ([App Store](https://apps.apple.com/us/app/pantry-for-nextcloud/id6762161619))",
+    "homepage": "https://github.com/chenasraf/nextcloud-pantry",
+    "licenses": [
+      "agpl"
+    ]
+  },
  "phonetrack": {
-    "hash": "sha256-bt/R1kZiTa9pWruKsAU01ni1d0AIy7vAOvIF8zwRhhw=",
-    "url": "https://github.com/julien-nc/phonetrack/releases/download/v1.3.1/phonetrack-1.3.1.tar.gz",
-    "version": "1.3.1",
+    "hash": "sha256-cinP3WFja6QjJYlQZcTKayHTheLjvnKY9s+CIJWKlcQ=",
+    "url": "https://github.com/julien-nc/phonetrack/releases/download/v1.3.2/phonetrack-1.3.2.tar.gz",
+    "version": "1.3.2",
    "description": "# PhoneTrack Nextcloud application\n\n📱 PhoneTrack is a Nextcloud application to track and store mobile device's locations.\n\n🗺 It receives information from mobile phone's logging apps and displays it dynamically on a map.\n\n🌍 Help us to translate this app on [PhoneTrack Crowdin project](https://crowdin.com/project/phonetrack).\n\n⚒ Check out other ways to help in the [contribution guidelines](https://gitlab.com/eneiluj/phonetrack-oc/blob/master/CONTRIBUTING.md).\n\nHow to use PhoneTrack :\n\n- Create a tracking session.\n- Give the logging link\\* to the mobile devices. Choose the [logging method](https://github.com/julien-nc/phonetrack/blob/main/doc/user.md#logging-methods) you prefer.\n- Watch the session's devices location in real time (or not) in PhoneTrack or share it with public pages.\n\n(\\*) Don't forget to set the device name in the link (rather than in the logging app settings). Replace \"yourname\" with the desired device name.\nSetting the device name in logging app settings only works with Owntracks, Traccar and OpenGTS.\n\nOn PhoneTrack main page, while watching a session, you can :\n\n- 📍 Display location history\n- ⛛ Filter points\n- ✎ Manually edit/add/delete points\n- ✎ Edit devices (rename, change colour/shape, move to another session)\n- ⛶ Define geofencing zones for devices\n- ⚇ Define proximity alerts for device pairs\n- 🖧 Share a session to other Nextcloud users or with a public link (read-only)\n- 🔗 Generate public share links with optional restrictions (filters, device name, last positions only, geofencing simplification)\n- 🖫 Import/export a session in GPX format (one file with one track per device or one file per device)\n- 🗠 Display sessions statistics\n- 🔒 [Reserve a device name](https://github.com/julien-nc/phonetrack/blob/main/doc/user.md#device-name-reservation) to make sure only authorized user can log with this name\n- 🗓 Toggle session auto export and auto purge (daily/weekly/monthly)\n- ◔ Choose what to do when point number quota is reached (block logging or delete oldest point)\n\nPublic page and public filtered page work like main page except there is only one session displayed, everything is read-only and there is no need to be logged in.\n\nThis app is under development.\n\n## Install\n\nSee the [AdminDoc](https://gitlab.com/eneiluj/phonetrack-oc/wikis/admindoc) for installation details.\n\nCheck [CHANGELOG](https://gitlab.com/eneiluj/phonetrack-oc/blob/master/CHANGELOG.md#change-log) file to see what's new and what's coming in next release.\n\nCheck [AUTHORS](https://gitlab.com/eneiluj/phonetrack-oc/blob/master/AUTHORS.md#authors) file to see complete list of authors.\n\n## Known issues\n\n- PhoneTrack **now works** with Nextcloud group restriction activated. See [admindoc](https://github.com/julien-nc/phonetrack/blob/main/doc/admin.md#issue-with-phonetrack-restricted-to-some-groups-in-nextcloud).\n\nAny feedback will be appreciated.\n\n\n\n## Donation\n\nI develop this app during my free time.\n\n* [Donate with Paypal](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=66PALMY8SF5JE) (you don't need a paypal account)\n* [Donate with Liberapay : ![Donate using Liberapay](https://liberapay.com/assets/widgets/donate.svg)](https://liberapay.com/eneiluj/donate)",
    "homepage": "https://github.com/julien-nc/phonetrack",
    "licenses": [
--- a/pkgs/servers/nextcloud/packages/33.json
+++ b/pkgs/servers/nextcloud/packages/33.json
@@ -190,9 +190,9 @@
    ]
  },
  "integration_deepl": {
-    "hash": "sha256-RHYxxZw/2/uDdZdf8kGYgGBlBi1rfgXUtTtr9lgr/20=",
-    "url": "https://github.com/nextcloud-releases/integration_deepl/releases/download/v2.2.0/integration_deepl-v2.2.0.tar.gz",
-    "version": "2.2.0",
+    "hash": "sha256-PMK1Z3oFVkN8WtgySidCLnp+SZ3xHkPfzI2xVBfBm/k=",
+    "url": "https://github.com/nextcloud-releases/integration_deepl/releases/download/v2.3.0/integration_deepl-v2.3.0.tar.gz",
+    "version": "2.3.0",
    "description": "Deepl integration providing an translations through deepl.com with Nextcloud\n\nThis app integrates with [Nextcloud Assistant](https://apps.nextcloud.com/apps/assistant) to offer translation services We recommend to install Assistant additionally and activate Deepl as translation provider in the Artifical Intelligence admin settings.\n\nThis app also integrates with the translation API of Nextcloud server to offer translation services without Assistant. Currently this is available in Text and Talk.\n\nTo run translations and any other Task Processing tasks synchronously, run the following command in a background process (10 is the interval in seconds when the process should relaunch to use the latest php changes):\n\n```sh\nset -e; while true; do occ background-job:worker -v -t 10 \"OC\\TaskProcessing\\SynchronousBackgroundJob\"; done\n```\n\n## Ethical AI Rating\n### Rating: 🔴\n\nNegative:\n* the software for training and inferencing of this model is proprietary, limiting running it locally or training by yourself\n* the trained model is not freely available, so the model can not be ran on-premises\n* the training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model’s performance and CO2 usage.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).",
    "homepage": "https://github.com/nextcloud/integration_deepl",
    "licenses": [
@@ -309,10 +309,20 @@
      "agpl"
    ]
  },
+  "pantry": {
+    "hash": "sha256-kPldsAVbpoJ+6kMWmh70j3HBTlzZibtbyr5tvT0ZcaA=",
+    "url": "https://github.com/chenasraf/nextcloud-pantry/releases/download/v0.24.0/pantry-v0.24.0.tar.gz",
+    "version": "0.24.0",
+    "description": "Pantry helps households stay organized in Nextcloud.\n\n- **Houses** group members and their shared data. A person can belong to multiple houses and switch between them freely.\n- **Checklists** support recurring items (e.g. milk every week) that automatically reappear when due. Share lists with the whole household so everyone knows what to pick up.\n- **Photo boards** let you keep shared reference photos organized in folders — the right brand of dog food, a favorite recipe card, a product label, and so on.\n- **Notes wall** gives the household a lightweight shared space for reminders, pinned messages, and quick notes with customizable colors.\n- **Notifications** keep everyone in the loop when photos are uploaded or notes are added or edited.\n\nAll data is scoped to a house; members only see the houses they belong to.\n\nPantry also has companion apps for mobile and desktop that let you manage your lists, photos and notes on the go and keep everything in sync with your Nextcloud instance.\n\n**Companion apps:** Android ([Google Play](https://play.google.com/store/apps/details?id=dev.casraf.pantry), [F-Droid](https://f-droid.org/en/packages/dev.casraf.pantry/)) | iOS/macOS ([App Store](https://apps.apple.com/us/app/pantry-for-nextcloud/id6762161619))",
+    "homepage": "https://github.com/chenasraf/nextcloud-pantry",
+    "licenses": [
+      "agpl"
+    ]
+  },
  "phonetrack": {
-    "hash": "sha256-bt/R1kZiTa9pWruKsAU01ni1d0AIy7vAOvIF8zwRhhw=",
-    "url": "https://github.com/julien-nc/phonetrack/releases/download/v1.3.1/phonetrack-1.3.1.tar.gz",
-    "version": "1.3.1",
+    "hash": "sha256-cinP3WFja6QjJYlQZcTKayHTheLjvnKY9s+CIJWKlcQ=",
+    "url": "https://github.com/julien-nc/phonetrack/releases/download/v1.3.2/phonetrack-1.3.2.tar.gz",
+    "version": "1.3.2",
    "description": "# PhoneTrack Nextcloud application\n\n📱 PhoneTrack is a Nextcloud application to track and store mobile device's locations.\n\n🗺 It receives information from mobile phone's logging apps and displays it dynamically on a map.\n\n🌍 Help us to translate this app on [PhoneTrack Crowdin project](https://crowdin.com/project/phonetrack).\n\n⚒ Check out other ways to help in the [contribution guidelines](https://gitlab.com/eneiluj/phonetrack-oc/blob/master/CONTRIBUTING.md).\n\nHow to use PhoneTrack :\n\n- Create a tracking session.\n- Give the logging link\\* to the mobile devices. Choose the [logging method](https://github.com/julien-nc/phonetrack/blob/main/doc/user.md#logging-methods) you prefer.\n- Watch the session's devices location in real time (or not) in PhoneTrack or share it with public pages.\n\n(\\*) Don't forget to set the device name in the link (rather than in the logging app settings). Replace \"yourname\" with the desired device name.\nSetting the device name in logging app settings only works with Owntracks, Traccar and OpenGTS.\n\nOn PhoneTrack main page, while watching a session, you can :\n\n- 📍 Display location history\n- ⛛ Filter points\n- ✎ Manually edit/add/delete points\n- ✎ Edit devices (rename, change colour/shape, move to another session)\n- ⛶ Define geofencing zones for devices\n- ⚇ Define proximity alerts for device pairs\n- 🖧 Share a session to other Nextcloud users or with a public link (read-only)\n- 🔗 Generate public share links with optional restrictions (filters, device name, last positions only, geofencing simplification)\n- 🖫 Import/export a session in GPX format (one file with one track per device or one file per device)\n- 🗠 Display sessions statistics\n- 🔒 [Reserve a device name](https://github.com/julien-nc/phonetrack/blob/main/doc/user.md#device-name-reservation) to make sure only authorized user can log with this name\n- 🗓 Toggle session auto export and auto purge (daily/weekly/monthly)\n- ◔ Choose what to do when point number quota is reached (block logging or delete oldest point)\n\nPublic page and public filtered page work like main page except there is only one session displayed, everything is read-only and there is no need to be logged in.\n\nThis app is under development.\n\n## Install\n\nSee the [AdminDoc](https://gitlab.com/eneiluj/phonetrack-oc/wikis/admindoc) for installation details.\n\nCheck [CHANGELOG](https://gitlab.com/eneiluj/phonetrack-oc/blob/master/CHANGELOG.md#change-log) file to see what's new and what's coming in next release.\n\nCheck [AUTHORS](https://gitlab.com/eneiluj/phonetrack-oc/blob/master/AUTHORS.md#authors) file to see complete list of authors.\n\n## Known issues\n\n- PhoneTrack **now works** with Nextcloud group restriction activated. See [admindoc](https://github.com/julien-nc/phonetrack/blob/main/doc/admin.md#issue-with-phonetrack-restricted-to-some-groups-in-nextcloud).\n\nAny feedback will be appreciated.\n\n\n\n## Donation\n\nI develop this app during my free time.\n\n* [Donate with Paypal](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=66PALMY8SF5JE) (you don't need a paypal account)\n* [Donate with Liberapay : ![Donate using Liberapay](https://liberapay.com/assets/widgets/donate.svg)](https://liberapay.com/eneiluj/donate)",
    "homepage": "https://github.com/julien-nc/phonetrack",
    "licenses": [
--- a/pkgs/servers/nextcloud/packages/34.json
+++ b/pkgs/servers/nextcloud/packages/34.json
@@ -190,9 +190,9 @@
    ]
  },
  "integration_deepl": {
-    "hash": "sha256-RHYxxZw/2/uDdZdf8kGYgGBlBi1rfgXUtTtr9lgr/20=",
-    "url": "https://github.com/nextcloud-releases/integration_deepl/releases/download/v2.2.0/integration_deepl-v2.2.0.tar.gz",
-    "version": "2.2.0",
+    "hash": "sha256-PMK1Z3oFVkN8WtgySidCLnp+SZ3xHkPfzI2xVBfBm/k=",
+    "url": "https://github.com/nextcloud-releases/integration_deepl/releases/download/v2.3.0/integration_deepl-v2.3.0.tar.gz",
+    "version": "2.3.0",
    "description": "Deepl integration providing an translations through deepl.com with Nextcloud\n\nThis app integrates with [Nextcloud Assistant](https://apps.nextcloud.com/apps/assistant) to offer translation services We recommend to install Assistant additionally and activate Deepl as translation provider in the Artifical Intelligence admin settings.\n\nThis app also integrates with the translation API of Nextcloud server to offer translation services without Assistant. Currently this is available in Text and Talk.\n\nTo run translations and any other Task Processing tasks synchronously, run the following command in a background process (10 is the interval in seconds when the process should relaunch to use the latest php changes):\n\n```sh\nset -e; while true; do occ background-job:worker -v -t 10 \"OC\\TaskProcessing\\SynchronousBackgroundJob\"; done\n```\n\n## Ethical AI Rating\n### Rating: 🔴\n\nNegative:\n* the software for training and inferencing of this model is proprietary, limiting running it locally or training by yourself\n* the trained model is not freely available, so the model can not be ran on-premises\n* the training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model’s performance and CO2 usage.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).",
    "homepage": "https://github.com/nextcloud/integration_deepl",
    "licenses": [
@@ -309,10 +309,20 @@
      "agpl"
    ]
  },
+  "pantry": {
+    "hash": "sha256-kPldsAVbpoJ+6kMWmh70j3HBTlzZibtbyr5tvT0ZcaA=",
+    "url": "https://github.com/chenasraf/nextcloud-pantry/releases/download/v0.24.0/pantry-v0.24.0.tar.gz",
+    "version": "0.24.0",
+    "description": "Pantry helps households stay organized in Nextcloud.\n\n- **Houses** group members and their shared data. A person can belong to multiple houses and switch between them freely.\n- **Checklists** support recurring items (e.g. milk every week) that automatically reappear when due. Share lists with the whole household so everyone knows what to pick up.\n- **Photo boards** let you keep shared reference photos organized in folders — the right brand of dog food, a favorite recipe card, a product label, and so on.\n- **Notes wall** gives the household a lightweight shared space for reminders, pinned messages, and quick notes with customizable colors.\n- **Notifications** keep everyone in the loop when photos are uploaded or notes are added or edited.\n\nAll data is scoped to a house; members only see the houses they belong to.\n\nPantry also has companion apps for mobile and desktop that let you manage your lists, photos and notes on the go and keep everything in sync with your Nextcloud instance.\n\n**Companion apps:** Android ([Google Play](https://play.google.com/store/apps/details?id=dev.casraf.pantry), [F-Droid](https://f-droid.org/en/packages/dev.casraf.pantry/)) | iOS/macOS ([App Store](https://apps.apple.com/us/app/pantry-for-nextcloud/id6762161619))",
+    "homepage": "https://github.com/chenasraf/nextcloud-pantry",
+    "licenses": [
+      "agpl"
+    ]
+  },
  "phonetrack": {
-    "hash": "sha256-bt/R1kZiTa9pWruKsAU01ni1d0AIy7vAOvIF8zwRhhw=",
-    "url": "https://github.com/julien-nc/phonetrack/releases/download/v1.3.1/phonetrack-1.3.1.tar.gz",
-    "version": "1.3.1",
+    "hash": "sha256-cinP3WFja6QjJYlQZcTKayHTheLjvnKY9s+CIJWKlcQ=",
+    "url": "https://github.com/julien-nc/phonetrack/releases/download/v1.3.2/phonetrack-1.3.2.tar.gz",
+    "version": "1.3.2",
    "description": "# PhoneTrack Nextcloud application\n\n📱 PhoneTrack is a Nextcloud application to track and store mobile device's locations.\n\n🗺 It receives information from mobile phone's logging apps and displays it dynamically on a map.\n\n🌍 Help us to translate this app on [PhoneTrack Crowdin project](https://crowdin.com/project/phonetrack).\n\n⚒ Check out other ways to help in the [contribution guidelines](https://gitlab.com/eneiluj/phonetrack-oc/blob/master/CONTRIBUTING.md).\n\nHow to use PhoneTrack :\n\n- Create a tracking session.\n- Give the logging link\\* to the mobile devices. Choose the [logging method](https://github.com/julien-nc/phonetrack/blob/main/doc/user.md#logging-methods) you prefer.\n- Watch the session's devices location in real time (or not) in PhoneTrack or share it with public pages.\n\n(\\*) Don't forget to set the device name in the link (rather than in the logging app settings). Replace \"yourname\" with the desired device name.\nSetting the device name in logging app settings only works with Owntracks, Traccar and OpenGTS.\n\nOn PhoneTrack main page, while watching a session, you can :\n\n- 📍 Display location history\n- ⛛ Filter points\n- ✎ Manually edit/add/delete points\n- ✎ Edit devices (rename, change colour/shape, move to another session)\n- ⛶ Define geofencing zones for devices\n- ⚇ Define proximity alerts for device pairs\n- 🖧 Share a session to other Nextcloud users or with a public link (read-only)\n- 🔗 Generate public share links with optional restrictions (filters, device name, last positions only, geofencing simplification)\n- 🖫 Import/export a session in GPX format (one file with one track per device or one file per device)\n- 🗠 Display sessions statistics\n- 🔒 [Reserve a device name](https://github.com/julien-nc/phonetrack/blob/main/doc/user.md#device-name-reservation) to make sure only authorized user can log with this name\n- 🗓 Toggle session auto export and auto purge (daily/weekly/monthly)\n- ◔ Choose what to do when point number quota is reached (block logging or delete oldest point)\n\nPublic page and public filtered page work like main page except there is only one session displayed, everything is read-only and there is no need to be logged in.\n\nThis app is under development.\n\n## Install\n\nSee the [AdminDoc](https://gitlab.com/eneiluj/phonetrack-oc/wikis/admindoc) for installation details.\n\nCheck [CHANGELOG](https://gitlab.com/eneiluj/phonetrack-oc/blob/master/CHANGELOG.md#change-log) file to see what's new and what's coming in next release.\n\nCheck [AUTHORS](https://gitlab.com/eneiluj/phonetrack-oc/blob/master/AUTHORS.md#authors) file to see complete list of authors.\n\n## Known issues\n\n- PhoneTrack **now works** with Nextcloud group restriction activated. See [admindoc](https://github.com/julien-nc/phonetrack/blob/main/doc/admin.md#issue-with-phonetrack-restricted-to-some-groups-in-nextcloud).\n\nAny feedback will be appreciated.\n\n\n\n## Donation\n\nI develop this app during my free time.\n\n* [Donate with Paypal](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=66PALMY8SF5JE) (you don't need a paypal account)\n* [Donate with Liberapay : ![Donate using Liberapay](https://liberapay.com/assets/widgets/donate.svg)](https://liberapay.com/eneiluj/donate)",
    "homepage": "https://github.com/julien-nc/phonetrack",
    "licenses": [
--- a/pkgs/servers/nextcloud/packages/nextcloud-apps.json
+++ b/pkgs/servers/nextcloud/packages/nextcloud-apps.json
@@ -35,6 +35,7 @@
 , "oidc_login": "agpl3Only"
 , "onlyoffice": "asl20"
 , "phonetrack": "agpl3Plus"
+, "pantry": "agpl3Plus"
 , "polls": "agpl3Plus"
 , "previewgenerator": "agpl3Plus"
 , "qownnotesapi": "agpl3Plus"