Merge master into staging-nixos

maintainers/maintainer-list.nix

@@ -20948,6 +20948,12 @@
     githubId = 41154684;
     name = "nokazn";
   };
+  nolight132 = {
+    email = "contact@nolight.dev";
+    github = "nolight132";
+    githubId = 71591964;
+    name = "Pavel Olizko";
+  };
   nolith = {
     github = "nolith";
     githubId = 78752;

nixos/modules/services/networking/syncthing.nix

@@ -1049,7 +1049,7 @@ in
       };
       syncthing-init = lib.mkIf (cleanedConfig != { }) {
         description = "Syncthing configuration updater";
-        requisite = [ "syncthing.service" ];
+        requires = [ "syncthing.service" ];
         after = [ "syncthing.service" ];
         wantedBy = [ "multi-user.target" ];
 

nixos/tests/all-tests.nix

@@ -694,7 +694,10 @@ in
   ghostunnel = runTest ./ghostunnel.nix;
   ghostunnel-modular = runTest ./ghostunnel-modular.nix;
   gitdaemon = runTest ./gitdaemon.nix;
-  gitea = handleTest ./gitea.nix { giteaPackage = pkgs.gitea; };
+  gitea = import ./gitea.nix {
+    inherit pkgs runTest;
+    inherit (pkgs) lib;
+  };
   github-runner = runTest ./github-runner.nix;
   gitlab = import ./gitlab {
     inherit runTest;
@@ -810,7 +813,10 @@ in
   homer = handleTest ./homer { };
   honk = runTest ./honk.nix;
   hoogle = runTest ./hoogle.nix;
-  hostname = handleTest ./hostname.nix { };
+  hostname = import ./hostname.nix {
+    inherit pkgs runTest;
+    inherit (pkgs) lib;
+  };
   hound = runTest ./hound.nix;
   hub = runTest ./git/hub.nix;
   hydra = runTest ./hydra;

nixos/tests/gitea.nix

@@ -1,12 +1,11 @@
 {
-  system ? builtins.currentSystem,
-  config ? { },
-  giteaPackage ? pkgs.gitea,
-  pkgs ? import ../.. { inherit system config; },
+  pkgs,
+  lib,
+  runTest,
+  ...
 }:
 
-with import ../lib/testing-python.nix { inherit system pkgs; };
-with pkgs.lib;
+with lib;
 
 let
   ## gpg --faked-system-time='20230301T010000!' --quick-generate-key snakeoil ed25519 sign
@@ -31,8 +30,8 @@ let
   ];
   makeGiteaTest =
     type:
-    nameValuePair type (makeTest {
-      name = "${giteaPackage.pname}-${type}";
+    nameValuePair type (runTest {
+      name = "${pkgs.gitea.pname}-${type}";
       meta.maintainers = with maintainers; [
         aanderse
         kolaente
@@ -46,7 +45,7 @@ let
             services.gitea = {
               enable = true;
               database = { inherit type; };
-              package = giteaPackage;
+              package = pkgs.gitea;
               metricsTokenFile = (pkgs.writeText "metrics_secret" "fakesecret").outPath;
               settings.service.DISABLE_REGISTRATION = true;
               settings."repository.signing".SIGNING_KEY = signingPrivateKeyId;
@@ -54,7 +53,7 @@ let
               settings.metrics.ENABLED = true;
             };
             environment.systemPackages = [
-              giteaPackage
+              pkgs.gitea
               pkgs.gnupg
               pkgs.jq
             ];

nixos/tests/hostname.nix

@@ -1,11 +1,10 @@
 {
-  system ? builtins.currentSystem,
-  config ? { },
-  pkgs ? import ../.. { inherit system config; },
+  pkgs,
+  runTest,
+  lib,
 }:
 
-with import ../lib/testing-python.nix { inherit system pkgs; };
-with pkgs.lib;
+with lib;
 
 let
   makeHostNameTest =
@@ -19,7 +18,7 @@ let
         in
         if (res.success && res.value != null) then res.value else "null";
     in
-    makeTest {
+    runTest {
       name = "hostname-${fqdn}";
       meta = with pkgs.lib.maintainers; {
         maintainers = [

nixos/tests/systemd-coredump.nix

@@ -4,15 +4,6 @@ let
 
   crasher = pkgs.writeCBin "crasher" "int main;";
 
-  commonConfig = {
-    systemd.services.crasher.serviceConfig = {
-      ExecStart = "${crasher}/bin/crasher";
-      StateDirectory = "crasher";
-      WorkingDirectory = "%S/crasher";
-      Restart = "no";
-    };
-  };
-
 in
 
 {
@@ -21,40 +12,33 @@ in
     maintainers = [ ];
   };
 
-  nodes.machine1 =
-    { pkgs, lib, ... }:
-    {
-      imports = [ commonConfig ];
-      systemd.coredump.settings.Coredump = {
+  nodes.machine = {
+    systemd = {
+      services.crasher.serviceConfig = {
+        ExecStart = "${crasher}/bin/crasher";
+        StateDirectory = "crasher";
+        WorkingDirectory = "%S/crasher";
+        Restart = "no";
+      };
+
+      coredump.settings.Coredump = {
         Storage = "journal";
         ProcessSizeMax = "0";
       };
     };
-  nodes.machine2 =
-    { pkgs, lib, ... }:
-    {
-      imports = [ commonConfig ];
-      systemd.coredump.enable = false;
-      systemd.package = pkgs.systemd.override {
-        withCoredump = false;
-      };
-    };
+  };
 
   testScript = ''
     with subtest("systemd-coredump enabled"):
-      machine1.wait_for_unit("multi-user.target")
-      machine1.wait_for_unit("systemd-coredump.socket")
-      machine1.systemctl("start crasher");
-      machine1.wait_until_succeeds("coredumpctl list | grep crasher", timeout=10)
-      machine1.fail("stat /var/lib/crasher/core*")
+      machine.wait_for_unit("multi-user.target")
+      machine.wait_for_unit("systemd-coredump.socket")
+      machine.systemctl("start crasher");
+      machine.wait_until_succeeds("coredumpctl list | grep crasher", timeout=10)
+      machine.fail("stat /var/lib/crasher/core*")
 
     with subtest("settings.Coredump renders coredump.conf"):
-      machine1.succeed("grep -F '[Coredump]' /etc/systemd/coredump.conf")
-      machine1.succeed("grep -F 'Storage=journal' /etc/systemd/coredump.conf")
-      machine1.succeed("grep -F 'ProcessSizeMax=0' /etc/systemd/coredump.conf")
-
-    with subtest("systemd-coredump disabled"):
-      machine2.systemctl("start crasher");
-      machine2.wait_until_succeeds("stat /var/lib/crasher/core*", timeout=10)
+      machine.succeed("grep -F '[Coredump]' /etc/systemd/coredump.conf")
+      machine.succeed("grep -F 'Storage=journal' /etc/systemd/coredump.conf")
+      machine.succeed("grep -F 'ProcessSizeMax=0' /etc/systemd/coredump.conf")
   '';
 }

pkgs/applications/editors/emacs/elisp-packages/manual-packages/ghostel/package.nix

@@ -58,13 +58,13 @@ in
 melpaBuild (finalAttrs: {
   pname = "ghostel";
 
-  version = "0.50.0";
+  version = "0.51.0";
 
   src = fetchFromGitHub {
     owner = "dakra";
     repo = "ghostel";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-oRd5PEqMJWsnpcd5sE5Kd+ZPcyzfyT/wm4RP3/654mE=";
+    hash = "sha256-a1SY54yo2BIuSA6a6UTwrb+hcV/9IMKZrCrVVgBAsxo=";
   };
 
   # these can be put into mkModule, but we put them here to ease user overrideAttrs

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -643,13 +643,13 @@
     "vendorHash": "sha256-xjOOvg1gUxQHUuIHGR0ltsvIpRAPq4PW0XPYUjIGvpE="
   },
   "hashicorp_null": {
-    "hash": "sha256-4fykdwledpBBrvfXtHlX1Nvd9L2LwHSYReFTAejqp84=",
+    "hash": "sha256-VzElfl/zIUa38HZfOC+EOsFUygrZwC2K7mMSJ7TBZMU=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/null",
     "owner": "hashicorp",
     "repo": "terraform-provider-null",
-    "rev": "v3.3.0",
+    "rev": "v3.3.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-eomOKb1chviENE53S3L+MOGqqWg0ByTei5Q2xqn8Nko="
+    "vendorHash": "sha256-STiMgzJWnWfUz2Y+O/6QfTxZ3hClHOa+guJer33dEDg="
   },
   "hashicorp_random": {
     "hash": "sha256-Y5p9/H3g85AYr/FVWO6zLaeHIGo7iGvMV6eHTGO0ehI=",

pkgs/by-name/al/alterx/package.nix

@@ -2,12 +2,17 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  nix-update-script,
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "alterx";
   version = "0.1.0";
 
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "alterx";
@@ -17,6 +22,19 @@ buildGoModule (finalAttrs: {
 
   vendorHash = "sha256-13ODJNo6xbQkubaGJT3svFbOLbdsHluTCp1Gom+jYeU=";
 
+  nativeInstallCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
+  ];
+
+  ldflags = [ "-s" ];
+
+  doInstallCheck = true;
+
+  versionCheckKeepEnvironment = [ "HOME" ];
+
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Fast and customizable subdomain wordlist generator using DSL";
     homepage = "https://github.com/projectdiscovery/alterx";

pkgs/by-name/as/asnmap/package.nix

@@ -2,12 +2,17 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  nix-update-script,
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "asnmap";
   version = "1.1.1";
 
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "asnmap";
@@ -17,18 +22,26 @@ buildGoModule (finalAttrs: {
 
   vendorHash = "sha256-bSpMYQvrlR9T06dYF8gaTZmMAp6Gnb2cfsYCUes7i2s=";
 
-  ldflags = [
-    "-w"
-    "-s"
+  nativeInstallCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
   ];
 
+  ldflags = [ "-s" ];
+
   # Tests require network access
   doCheck = false;
 
+  doInstallCheck = true;
+
+  versionCheckKeepEnvironment = [ "HOME" ];
+
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Tool to gather network ranges using ASN information";
     homepage = "https://github.com/projectdiscovery/asnmap";
-    changelog = "https://github.com/projectdiscovery/asnmap/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/projectdiscovery/asnmap/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "asnmap";

pkgs/by-name/ch/chaos/package.nix

@@ -2,6 +2,7 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  nix-update-script,
   versionCheckHook,
 }:
 
@@ -9,6 +10,8 @@ buildGoModule (finalAttrs: {
   pname = "chaos";
   version = "0.5.2";
 
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "chaos-client";
@@ -20,19 +23,18 @@ buildGoModule (finalAttrs: {
 
   subPackages = [ "cmd/chaos/" ];
 
-  ldflags = [
-    "-s"
-    "-w"
-  ];
+  ldflags = [ "-s" ];
 
   nativeInstallCheckInputs = [ versionCheckHook ];
 
   doInstallCheck = true;
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Tool to communicate with Chaos DNS API";
     homepage = "https://github.com/projectdiscovery/chaos-client";
-    changelog = "https://github.com/projectdiscovery/chaos-client/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/projectdiscovery/chaos-client/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "chaos";

pkgs/by-name/cl/cloudlist/package.nix

@@ -20,10 +20,7 @@ buildGoModule (finalAttrs: {
 
   subPackages = [ "cmd/cloudlist/" ];
 
-  ldflags = [
-    "-w"
-    "-s"
-  ];
+  ldflags = [ "-s" ];
 
   nativeInstallCheckInputs = [ versionCheckHook ];
 
@@ -32,7 +29,7 @@ buildGoModule (finalAttrs: {
   meta = {
     description = "Tool for listing assets from multiple cloud providers";
     homepage = "https://github.com/projectdiscovery/cloudlist";
-    changelog = "https://github.com/projectdiscovery/cloudlist/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/projectdiscovery/cloudlist/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "cloudlist";

pkgs/by-name/di/diskwatch/package.nix

@@ -11,18 +11,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "diskwatch";
-  version = "0.3.2";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "matthart1983";
     repo = "diskwatch";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/wR+tUQPV6EnWcZvOdZY9di9Eu07NSnAn25du/KMlfw=";
+    hash = "sha256-pKo4zXyoX2OiOIwirCdzQuuFW1dMye/AA4MNVYgki3A=";
   };
 
   __structuredAttrs = true;
 
-  cargoHash = "sha256-UTO7jkO+a1n9HcVYrw1m4EAMaiXk4z3TlOa/JtlpFV8=";
+  cargoHash = "sha256-Nr01CMCsh3llYAlVS0O0F+/rmopTywxw9itISYoyQRI=";
 
   nativeCheckInputs = [ versionCheckHook ];
 

pkgs/by-name/du/dusklight/package.nix

@@ -200,7 +200,10 @@ stdenv.mkDerivation (finalAttrs: {
     changelog = "https://github.com/TwilitRealm/dusklight/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.cc0;
     mainProgram = "dusklight";
-    platforms = lib.platforms.linux;
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+    ];
     maintainers = with lib.maintainers; [ liberodark ];
   };
 })

pkgs/by-name/gc/gcx/package.nix

@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "gcx";
-  version = "1.0.0";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "gcx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VBYYlPzuZ9iQMXUJdxu9YBPs2Ize6vWBzhMK94E3beY=";
+    hash = "sha256-RbXa5ZCGOy9TQ/Cm/21JES4C0vl0owsFfLiMlEQ2MfQ=";
   };
 
-  vendorHash = "sha256-PevzovryzpNap8dzruYWdk07M5g9jlA8QPQcrXnO7xk=";
+  vendorHash = "sha256-OvIK8sgWUo3t0+oure7+PpU7SFzbLyppyeaWQtKyZXg=";
 
   subPackages = [ "cmd/gcx" ];
 

pkgs/by-name/gn/gnome-desktop/package.nix

@@ -18,14 +18,14 @@
   meson,
   wayland,
   libseccomp,
-  systemd,
+  systemdLibs,
   udev,
   bubblewrap,
   gobject-introspection,
   gtk-doc,
   docbook-xsl-nons,
   gsettings-desktop-schemas,
-  withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
+  withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemdLibs,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -72,7 +72,7 @@ stdenv.mkDerivation (finalAttrs: {
     glib
   ]
   ++ lib.optionals withSystemd [
-    systemd
+    systemdLibs
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     bubblewrap

pkgs/by-name/ht/httpx/package.nix

@@ -2,6 +2,7 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  nix-update-script,
   versionCheckHook,
 }:
 
@@ -9,6 +10,8 @@ buildGoModule (finalAttrs: {
   pname = "httpx";
   version = "1.10.0";
 
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "httpx";
@@ -22,10 +25,7 @@ buildGoModule (finalAttrs: {
 
   nativeInstallCheckInputs = [ versionCheckHook ];
 
-  ldflags = [
-    "-s"
-    "-w"
-  ];
+  ldflags = [ "-s" ];
 
   # Tests require network access
   doCheck = false;
@@ -34,6 +34,8 @@ buildGoModule (finalAttrs: {
 
   versionCheckProgramArg = "-version";
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Fast and multi-purpose HTTP toolkit";
     longDescription = ''

pkgs/by-name/in/infisicalsdk/package.nix

@@ -1,38 +0,0 @@
-{
-  lib,
-  python3Packages,
-  fetchFromGitHub,
-}:
-
-python3Packages.buildPythonPackage rec {
-  pname = "infisicalsdk";
-  version = "1.0.16";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "Infisical";
-    repo = "python-sdk-official";
-    tag = "v${version}";
-    hash = "sha256-2bfT99ynl14CSbqIOG2SMQb3oW+uAWD+iJifdMQG8CE=";
-  };
-
-  build-system = [ python3Packages.setuptools ];
-
-  dependencies = with python3Packages; [
-    python-dateutil
-    aenum
-    requests
-    boto3
-    botocore
-  ];
-
-  doCheck = false;
-  pythonImportsCheck = [ "infisical_sdk" ];
-
-  meta = {
-    homepage = "https://github.com/Infisical/python-sdk-official";
-    description = "Infisical Python SDK";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ artur-sannikov ];
-  };
-}

pkgs/by-name/js/jsonschema-cli/package.nix

@@ -9,15 +9,15 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "jsonschema-cli";
-  version = "0.49.9";
+  version = "0.50.1";
 
   src = fetchCrate {
     pname = "jsonschema-cli";
     inherit (finalAttrs) version;
-    hash = "sha256-6uyWY7eO5DUtIm1MGvltARIykD8kXuujiCv32UJkiLE=";
+    hash = "sha256-SjFGHgqsJgITANMgaThhqZ3UJ7PR1Dw8eL4V+UyZ8LM=";
   };
 
-  cargoHash = "sha256-kBK7GgVNrPAxnBs76NqMTW2RT1kemr9UCDO7q+pZW30=";
+  cargoHash = "sha256-FrUAgVef0WTZ35+Y9hgQF/a04ilRdie+2SeZPDh7W4I=";
 
   preCheck = ''
     export SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt

pkgs/by-name/ka/katana/package.nix

@@ -2,12 +2,17 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  nix-update-script,
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "katana";
   version = "1.7.0";
 
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "katana";
@@ -19,10 +24,19 @@ buildGoModule (finalAttrs: {
 
   subPackages = [ "cmd/katana" ];
 
-  ldflags = [
-    "-s"
+  ldflags = [ "-s" ];
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
   ];
 
+  versionCheckKeepEnvironment = [ "HOME" ];
+
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Next-generation crawling and spidering framework";
     homepage = "https://github.com/projectdiscovery/katana";

pkgs/by-name/ma/mapcidr/package.nix

@@ -2,12 +2,17 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  nix-update-script,
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "mapcidr";
   version = "1.1.97";
 
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "mapcidr";
@@ -18,10 +23,24 @@ buildGoModule (finalAttrs: {
   vendorHash = "sha256-4gzxKmnl8MOPcdzkwhReZ/cfbjfICY9kxousveoHYR0=";
 
   modRoot = ".";
+
   subPackages = [
     "cmd/mapcidr"
   ];
 
+  ldflags = [ "-s" ];
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
+  ];
+
+  versionCheckKeepEnvironment = [ "HOME" ];
+
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Small utility program to perform multiple operations for a given subnet/CIDR ranges";
     longDescription = ''
@@ -29,7 +48,7 @@ buildGoModule (finalAttrs: {
       operations, it can be used both as a library and as independent CLI tool.
     '';
     homepage = "https://github.com/projectdiscovery/mapcidr";
-    changelog = "https://github.com/projectdiscovery/mapcidr/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/projectdiscovery/mapcidr/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ hanemile ];
     mainProgram = "mapcidr";

pkgs/by-name/na/naabu/package.nix

@@ -3,6 +3,7 @@
   buildGoModule,
   fetchFromGitHub,
   libpcap,
+  nix-update-script,
   versionCheckHook,
 }:
 
@@ -10,6 +11,8 @@ buildGoModule (finalAttrs: {
   pname = "naabu";
   version = "2.6.1";
 
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "naabu";
@@ -25,15 +28,14 @@ buildGoModule (finalAttrs: {
 
   subPackages = [ "cmd/naabu/" ];
 
-  ldflags = [
-    "-w"
-    "-s"
-  ];
+  ldflags = [ "-s" ];
 
   doInstallCheck = true;
 
   versionCheckProgramArg = "-version";
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Fast SYN/CONNECT port scanner";
     longDescription = ''
@@ -43,7 +45,7 @@ buildGoModule (finalAttrs: {
       all ports that return a reply.
     '';
     homepage = "https://github.com/projectdiscovery/naabu";
-    changelog = "https://github.com/projectdiscovery/naabu/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/projectdiscovery/naabu/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "naabu";

pkgs/by-name/nu/nuclei/package.nix

@@ -2,6 +2,7 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  nix-update-script,
   versionCheckHook,
 }:
 
@@ -9,6 +10,8 @@ buildGoModule (finalAttrs: {
   pname = "nuclei";
   version = "3.11.1";
 
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "nuclei";
@@ -24,10 +27,7 @@ buildGoModule (finalAttrs: {
 
   nativeInstallCheckInputs = [ versionCheckHook ];
 
-  ldflags = [
-    "-w"
-    "-s"
-  ];
+  ldflags = [ "-s" ];
 
   # Test files are not part of the release tarball
   doCheck = false;
@@ -36,6 +36,8 @@ buildGoModule (finalAttrs: {
 
   versionCheckProgramArg = "-version";
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Tool for configurable targeted scanning";
     longDescription = ''

pkgs/by-name/op/openrisk/package.nix

@@ -2,6 +2,7 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  nix-update-script,
   versionCheckHook,
 }:
 
@@ -9,6 +10,8 @@ buildGoModule (finalAttrs: {
   pname = "openrisk";
   version = "0.0.1";
 
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "openrisk";
@@ -18,19 +21,18 @@ buildGoModule (finalAttrs: {
 
   vendorHash = "sha256-BLowqqlMLDtsthS4uKeycmtG7vASG25CARGpUcuibcw=";
 
-  ldflags = [
-    "-w"
-    "-s"
-  ];
+  ldflags = [ "-s" ];
 
   nativeInstallCheckInputs = [ versionCheckHook ];
 
   doInstallCheck = true;
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Tool that generates an AI-based risk score";
     homepage = "https://github.com/projectdiscovery/openrisk";
-    changelog = "https://github.com/projectdiscovery/openrisk/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/projectdiscovery/openrisk/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "openrisk";

pkgs/by-name/pr/proxify/package.nix

@@ -2,12 +2,17 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  nix-update-script,
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "proxify";
   version = "0.0.16";
 
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "proxify";
@@ -17,6 +22,19 @@ buildGoModule (finalAttrs: {
 
   vendorHash = "sha256-7bOnLv2IJ9tysvZm33wBeMHvdSBDg1ii/QXv2n1wqxw=";
 
+  nativeInstallCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
+  ];
+
+  ldflags = [ "-s" ];
+
+  doInstallCheck = true;
+
+  versionCheckKeepEnvironment = [ "HOME" ];
+
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Proxy tool for HTTP/HTTPS traffic capture";
     longDescription = ''
@@ -26,7 +44,7 @@ buildGoModule (finalAttrs: {
       domain name) into other tools by simply setting the upstream proxy to proxify.
     '';
     homepage = "https://github.com/projectdiscovery/proxify";
-    changelog = "https://github.com/projectdiscovery/proxify/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/projectdiscovery/proxify/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };

pkgs/by-name/qu/quill-log/package.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "quill-log";
-  version = "12.1.0";
+  version = "12.2.0";
 
   src = fetchFromGitHub {
     owner = "odygrd";
     repo = "quill";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1CL5twjO0uInbdjTF6VRMugoeBABiDjPGagf5HdW57E=";
+    hash = "sha256-4UewMz4IKTlX8m0DvqTKV9YYfqgs2w2JaUdiEw/djEQ=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/sh/shairport-sync/package.nix

@@ -56,13 +56,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "shairport-sync";
-  version = "5.2.1";
+  version = "5.2.2";
 
   src = fetchFromGitHub {
     repo = "shairport-sync";
     owner = "mikebrady";
     tag = finalAttrs.version;
-    hash = "sha256-nPf4DDK5fRU+jrWqWIqf3ZHSXZFmGNJ29Zp3Nff+NKE=";
+    hash = "sha256-hwm1B4Q85hF61hzv579L+VTEfE4gvEhsGvh9Xq7XCNE=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/su/subfinder/package.nix

@@ -2,20 +2,25 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  nix-update-script,
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "subfinder";
-  version = "2.15.0";
+  version = "2.16.0";
+
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "subfinder";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-J/sSTpVfEDJQldbyVEPQ0I+j2JfGXaRKIV8Lli/Lsh0=";
+    hash = "sha256-eBRi33UbaK5vLvt/ag7g0aN4v5rAS6aeNq1cgfr9qsc=";
   };
 
-  vendorHash = "sha256-WGOP7gQnHeqUzdF7oBHhHuNINeoMVaGKoQpSLTVq8ho=";
+  vendorHash = "sha256-VAnRGCiqmqEilWGuMtHTQg3hh38inPXJW3ImZrIE1+Y=";
 
   patches = [
     # Disable automatic version check
@@ -26,11 +31,19 @@ buildGoModule (finalAttrs: {
     "cmd/subfinder/"
   ];
 
-  ldflags = [
-    "-w"
-    "-s"
+  ldflags = [ "-s" ];
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
   ];
 
+  versionCheckKeepEnvironment = [ "HOME" ];
+
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Subdomain discovery tool";
     longDescription = ''

pkgs/by-name/ti/tidal-hifi/package.nix

@@ -92,13 +92,13 @@ let
 in
 buildNpmPackage (finalAttrs: {
   pname = "tidal-hifi";
-  version = "8.1.1";
+  version = "8.1.2";
 
   src = fetchFromGitHub {
     owner = "Mastermindzh";
     repo = "tidal-hifi";
     tag = finalAttrs.version;
-    hash = "sha256-Y5tpnHXEjfaOTarzXitJvWxukxPvUYLzTZq13li5ckw=";
+    hash = "sha256-2IJTzzvQvyMEsDIRuH2JK1ixCg31nuuPjhKgRNmrcBA=";
   };
 
   nativeBuildInputs = [
@@ -107,7 +107,7 @@ buildNpmPackage (finalAttrs: {
     copyDesktopItems
   ];
 
-  npmDepsHash = "sha256-J+8JD4Y3giWX8ridtH3N9lobZV/8zgEPoUjuOksq+bs=";
+  npmDepsHash = "sha256-L5KR/H7/JokoCmVcZte1froAmCCYiq55fW4tvb8rqeQ=";
   forceGitDeps = true;
   makeCacheWritable = true;
 

pkgs/by-name/tl/tldfinder/package.nix

@@ -4,11 +4,13 @@
   fetchFromGitHub,
   nix-update-script,
   versionCheckHook,
+  writableTmpDirAsHomeHook,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "tldfinder";
   version = "0.0.2";
+
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
@@ -22,6 +24,15 @@ buildGoModule (finalAttrs: {
 
   ldflags = [ "-s" ];
 
+  nativeInstallCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
+  ];
+
+  doInstallCheck = true;
+
+  versionCheckKeepEnvironment = [ "HOME" ];
+
   passthru.updateScript = nix-update-script { };
 
   meta = {

pkgs/by-name/tl/tlsx/package.nix

@@ -2,12 +2,17 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  nix-update-script,
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "tlsx";
   version = "1.3.0";
 
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "tlsx";
@@ -17,14 +22,22 @@ buildGoModule (finalAttrs: {
 
   vendorHash = "sha256-5zqiA4Aoc5qjxXf8q+IzJqycSv49hJfynAVQ5Yomrro=";
 
-  ldflags = [
-    "-s"
-    "-w"
+  nativeInstallCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
   ];
 
+  ldflags = [ "-s" ];
+
   # Tests require network access
   doCheck = false;
 
+  doInstallCheck = true;
+
+  versionCheckKeepEnvironment = [ "HOME" ];
+
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "TLS grabber focused on TLS based data collection";
     longDescription = ''
@@ -32,7 +45,7 @@ buildGoModule (finalAttrs: {
       collection and analysis.
     '';
     homepage = "https://github.com/projectdiscovery/tlsx";
-    changelog = "https://github.com/projectdiscovery/tlsx/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/projectdiscovery/tlsx/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };

pkgs/by-name/tm/tmux/package.nix

@@ -28,6 +28,9 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "tmux";
   version = "3.7c";
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   outputs = [
     "out"
     "man"

pkgs/by-name/tr/trilium-desktop/package.nix

@@ -5,7 +5,7 @@
   fetchurl,
   makeBinaryWrapper,
   # use specific electron since it has to load a compiled module
-  electron_42,
+  electron_43,
   autoPatchelfHook,
   makeDesktopItem,
   copyDesktopItems,
@@ -15,7 +15,7 @@
 
 let
   pname = "trilium-desktop";
-  version = "0.104.1";
+  version = "0.105.0";
 
   triliumSource = os: arch: hash: {
     url = "https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-v${version}-${os}-${arch}.zip";
@@ -26,9 +26,9 @@ let
   darwinSource = triliumSource "macos";
 
   # exposed like this for update.sh
-  x86_64-linux.hash = "sha256-eMdpceoPqOrvCJ9BmEQG8+x9k+ZdKZcMJvwFK3hY3T0=";
-  aarch64-linux.hash = "sha256-n7lPyQvLsxJYGZ1g6d+XywwFCKYrfuxJ9CmBnbi17HY=";
-  aarch64-darwin.hash = "sha256-yajz0431QR+59KlI8d8m56nJAyx/l5yfW8cRuDASoYA=";
+  x86_64-linux.hash = "sha256-ojET/RnZYzAAHVMHSfxGtv7Ot4cujjYUSzKU7FkT+5U=";
+  aarch64-linux.hash = "sha256-iMExDPhzBnLvdTMofuhvhTNT+z3np/p+i70VK6D5sDE=";
+  aarch64-darwin.hash = "sha256-RBkByCAhRYDBCbHm7I5OllGGPn4OVAH4gqe/Eg20PCs=";
 
   sources = {
     x86_64-linux = linuxSource "x64" x86_64-linux.hash;
@@ -109,7 +109,7 @@ let
       asar pack $tmp/ $out/share/trilium/resources/app.asar
       rm -rf $tmp
 
-      makeWrapper ${lib.getExe electron_42} $out/bin/trilium \
+      makeWrapper ${lib.getExe electron_43} $out/bin/trilium \
         "''${gappsWrapperArgs[@]}" \
         --set-default ELECTRON_IS_DEV 0 \
         --add-flags $out/share/trilium/resources/app.asar

pkgs/by-name/tr/trilium-server/package.nix

@@ -7,12 +7,12 @@
 }:
 
 let
-  version = "0.104.1";
+  version = "0.105.0";
 
   serverSource_x64.url = "https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-Server-v${version}-linux-x64.tar.xz";
-  serverSource_x64.hash = "sha256-Ym8gcD0Rsp7rw5S5CHHW/Sh69JiyEOo3+U22nEs6yHg=";
+  serverSource_x64.hash = "sha256-lTJIEGCXcrbzPLCtSbDyGmUuI6WHUmj9DrQP+RbB9e8=";
   serverSource_arm64.url = "https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-Server-v${version}-linux-arm64.tar.xz";
-  serverSource_arm64.hash = "sha256-yIcM9BzrNT5gLbb+DaiJINQyIuygdmDJloHQ424OTxI=";
+  serverSource_arm64.hash = "sha256-2241mNg4WCgJEbWbfSERZfKg2gmHuA/0RhJReXvOXok=";
 
   serverSource =
     if stdenv.hostPlatform.isx86_64 then
@@ -46,6 +46,8 @@ stdenv.mkDerivation {
 
     cp -r ./* "$out/share/trilium-server/"
 
+    rm $out/share/trilium-server/node_modules/better-sqlite3/prebuilds/linuxmusl-x64.node
+
     makeWrapper "$out/share/trilium-server/node/bin/node" "$out/bin/trilium-server" \
       --chdir "$out/share/trilium-server" \
       --add-flags "main.cjs"

pkgs/by-name/un/uncover/package.nix

@@ -2,6 +2,7 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  nix-update-script,
   versionCheckHook,
 }:
 
@@ -24,20 +25,19 @@ buildGoModule (finalAttrs: {
 
   nativeInstallCheckInputs = [ versionCheckHook ];
 
-  ldflags = [
-    "-s"
-    "-w"
-  ];
+  ldflags = [ "-s" ];
 
   doInstallCheck = true;
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "API wrapper to search for exposed hosts";
     longDescription = ''
       uncover is a go wrapper using APIs of well known search engines to quickly
       discover exposed hosts on the internet. It is built with automation in mind,
       so you can query it and utilize the results with your current pipeline tools.
-      Currently, it supports shodan,shodan-internetdb, censys, and fofa search API.
+      Currently, it supports shodan, shodan-internetdb, censys, and fofa search API.
     '';
     homepage = "https://github.com/projectdiscovery/uncover";
     changelog = "https://github.com/projectdiscovery/uncover/releases/tag/${finalAttrs.src.tag}";

pkgs/by-name/ur/urlfinder/package.nix

@@ -2,12 +2,17 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  nix-update-script,
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "urlfinder";
   version = "0.0.3";
 
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "urlfinder";
@@ -17,15 +22,23 @@ buildGoModule (finalAttrs: {
 
   vendorHash = "sha256-9sIBj1K4N+HTd0OWnhP8+T1pPG9un8+FlpbPFwsV8P8=";
 
-  ldflags = [
-    "-s"
-    "-w"
+  nativeInstallCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
   ];
 
+  ldflags = [ "-s" ];
+
+  doInstallCheck = true;
+
+  versionCheckKeepEnvironment = [ "HOME" ];
+
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Tool for passively gathering URLs without active scanning";
     homepage = "https://github.com/projectdiscovery/urlfinder";
-    changelog = "https://github.com/projectdiscovery/urlfinder/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/projectdiscovery/urlfinder/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "urlfinder";

pkgs/by-name/vi/vicinae/package.nix

@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vicinae";
-  version = "0.23.2";
+  version = "0.26.3";
 
   src = fetchFromGitHub {
     owner = "vicinaehq";
     repo = "vicinae";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/5fGvMWlLlyd5ibK7y1dqIK1MTpLABj3v1M0r/VArww=";
+    hash = "sha256-Of1YU59mj9BZwQi7lbj/+XGaCs+MTGFCZ12bgcNbEu0=";
   };
 
   apiDeps = fetchNpmDeps {
@@ -66,10 +66,10 @@ stdenv.mkDerivation (finalAttrs: {
     ninja
     nodejs
     pkg-config
+    qt6.qttools
     qt6.wrapQtAppsHook
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    qt6.qttools
     swift
   ];
 
@@ -146,7 +146,10 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Native, fast, extensible launcher for the desktop";
     homepage = "https://github.com/vicinaehq/vicinae";
     license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [ zstg ];
+    maintainers = with lib.maintainers; [
+      zstg
+      nolight132
+    ];
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
     mainProgram = "vicinae";
   };

pkgs/by-name/vo/vopono/package.nix

@@ -6,14 +6,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "vopono";
-  version = "0.10.19";
+  version = "0.10.21";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-ZaDdW9V6SfALBVEg4UkXxpSL1bx6Zo5GJBaU9PhZqpc=";
+    hash = "sha256-JGzTebfh1cFPSy4+pkQRFop7wIxsogHVUAG7M7sHvOs=";
   };
 
-  cargoHash = "sha256-ezAmpzNZ8R6bDQxrzHsnjlXlKtJNPCRGF/yZJ/4dYyg=";
+  cargoHash = "sha256-I9pQ6hktej+zc4cKFfkxBQewUljG/g1/B8RkMuCTsjM=";
 
   meta = {
     description = "Run applications through VPN connections in network namespaces";

pkgs/by-name/vu/vulkan-caps-viewer/package.nix

@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vulkan-caps-viewer";
-  version = "4.12";
+  version = "4.13";
 
   src = fetchFromGitHub {
     owner = "SaschaWillems";
     repo = "VulkanCapsViewer";
     tag = finalAttrs.version;
-    hash = "sha256-sQnqUbpq7AQJBG19aYQy224Kztzm6X3tDr3+SufJNPo=";
+    hash = "sha256-PXJACyEIv9stechF8QiNOEMN1vA8QZPZ7K3bsyWFgaI=";
     # Note: this derivation strictly requires vulkan-header to be the same it was developed against.
     # To help us, they've put it in a git-submodule.
     # The result will work with any vulkan-loader version.

pkgs/by-name/vu/vulnx/package.nix

@@ -2,6 +2,7 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  nix-update-script,
   versionCheckHook,
 }:
 
@@ -9,6 +10,8 @@ buildGoModule (finalAttrs: {
   pname = "vulnx";
   version = "2.0.2";
 
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "vulnx";
@@ -22,14 +25,15 @@ buildGoModule (finalAttrs: {
 
   ldflags = [ "-s" ];
 
-  __structuredAttrs = true;
-
   strictDeps = true;
 
-  # Issue with updater and version check
-  # nativeInstallCheckInputs = [ versionCheckHook ];
-  # doInstallCheck = true;
-  # versionCheckProgramArg = [ "version" ];
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  doInstallCheck = true;
+
+  versionCheckProgramArg = "version";
+
+  passthru.updateScript = nix-update-script { };
 
   meta = {
     description = "Tool to work with CVEs";

pkgs/by-name/zi/zipline/package.nix

@@ -36,13 +36,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zipline";
-  version = "4.6.5";
+  version = "4.7.0";
 
   src = fetchFromGitHub {
     owner = "diced";
     repo = "zipline";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ghliiEg6ZDpT3VRUx3fFgiTrkdweVYH5V6yug9oxnQ8=";
+    hash = "sha256-/ISegKJ6NyyLYMoovqWLzJCP9JKsPW76Lm6hTU4NTmU=";
     leaveDotGit = true;
     postFetch = ''
       git -C $out rev-parse --short HEAD > $out/.git_head

pkgs/desktops/pantheon/artwork/elementary-icon-theme/default.nix

@@ -12,15 +12,15 @@
   librsvg,
 }:
 
-stdenvNoCC.mkDerivation {
+stdenvNoCC.mkDerivation rec {
   pname = "elementary-icon-theme";
-  version = "8.2.0-unstable-2026-07-06"; # nixpkgs-update: no auto update
+  version = "9.0.0";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = "icons";
-    rev = "82b7dac6d3661d35fe3e4b32594dc7c7918028e9";
-    hash = "sha256-KoMisPzS/LJVjh1TyyzB8RI+A6dtD+K5+WwhC5jOOnQ=";
+    tag = version;
+    hash = "sha256-WrZxhr7ybIx9CK5zG5Fq6udPt+0HRQIPSwxkCF2tPps=";
   };
 
   nativeBuildInputs = [
@@ -43,6 +43,14 @@ stdenvNoCC.mkDerivation {
     "-Dpalettes=false" # Don't install gimp and inkscape palette files
   ];
 
+  postPatch = ''
+    # Upstream removed the non-fd.o office-calendar icons but left these
+    # alias symlinks dangling (elementary/icons#1435).
+    rm -f apps/16/calendar.svg \
+      mimes/symbolic/text-calendar-symbolic.svg \
+      mimes/symbolic/vcalendar-symbolic.svg
+  '';
+
   postFixup = "gtk-update-icon-cache $out/share/icons/elementary";
 
   passthru = {

pkgs/development/haskell-modules/generic-builder.nix

@@ -23,7 +23,8 @@ let
   crossSupport = rec {
     emulator = stdenv.hostPlatform.emulator buildPackages;
 
-    needsExternalInterpreterSetup = !stdenv.hostPlatform.isGhcjs; # JS backend already handles this
+    # Both backends provide their own interpreter.
+    needsExternalInterpreterSetup = !stdenv.hostPlatform.isGhcjs && !stdenv.hostPlatform.isWasm;
 
     canProxyTH =
       # Using iserv-proxy with 9.4 yields
@@ -121,7 +122,8 @@ in
   doHaddockQuickjump ? doHoogle,
   doInstallIntermediates ? false,
   editedCabalFile ? null,
-  enableLibraryProfiling ? !stdenv.hostPlatform.isGhcjs,
+  # Cabal does not build the profiled dynamic objects required by wasm TH.
+  enableLibraryProfiling ? !stdenv.hostPlatform.isGhcjs && !stdenv.hostPlatform.isWasm,
   enableExecutableProfiling ? false,
   profilingDetail ? "exported-functions",
   # TODO enable shared libs for cross-compiling
@@ -349,6 +351,7 @@ let
     "--with-hsc2hs=${ghc.targetPrefix}hsc2hs"
     "--with-strip=${stdenv.cc.bintools.targetPrefix}strip"
   ]
+  ++ optional doHaddock "--with-haddock=${ghc.targetPrefix}haddock"
   ++ optionals (!isHaLVM) [
     "--hsc2hs-option=--cross-compile"
     (optionalString enableHsc2hsViaAsm "--hsc2hs-option=--via-asm")
@@ -524,7 +527,7 @@ let
   )
   ++ setupHaskellDepends
   ++ collectedToolDepends
-  ++ optional stdenv.hostPlatform.isGhcjs nodejs;
+  ++ optional (stdenv.hostPlatform.isGhcjs || stdenv.hostPlatform.isWasm) nodejs;
   propagatedBuildInputs =
     buildDepends ++ libraryHaskellDepends ++ executableHaskellDepends ++ libraryFrameworkDepends;
   otherBuildInputsHaskell =

pkgs/development/python-modules/aioeagle/default.nix

@@ -7,16 +7,16 @@
   xmltodict,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "aioeagle";
-  version = "1.1.0";
+  version = "1.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "home-assistant-libs";
     repo = "aioeagle";
-    tag = version;
-    hash = "sha256-ZO5uODCGebggItsEVKtis0uwU67dmSxc7DHzzkBZ9oQ=";
+    tag = finalAttrs.version;
+    hash = "sha256-MJTq8mWdn+QvLhagPwmdXVcGnDB8Y+2ivBFV6h9vnDU=";
   };
 
   build-system = [ setuptools ];
@@ -34,8 +34,8 @@ buildPythonPackage rec {
   meta = {
     description = "Python library to control EAGLE-200";
     homepage = "https://github.com/home-assistant-libs/aioeagle";
-    changelog = "https://github.com/home-assistant-libs/aioshelly/releases/tag/${version}";
+    changelog = "https://github.com/home-assistant-libs/aioshelly/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})

pkgs/development/python-modules/asteval/default.nix

@@ -7,16 +7,16 @@
   setuptools-scm,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "asteval";
-  version = "1.0.9";
+  version = "1.0.10";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lmfit";
     repo = "asteval";
-    tag = version;
-    hash = "sha256-TJGKQA4jI6aRcwUbFH2t1pFs0XdN3MVSEfGovnzI2/Q=";
+    tag = finalAttrs.version;
+    hash = "sha256-Z30H1bSud/VbYnHqRYzyJnDufFM4uBhPcMtVmZ1Sl94=";
   };
 
   build-system = [ setuptools-scm ];
@@ -36,8 +36,8 @@ buildPythonPackage rec {
   meta = {
     description = "AST evaluator of Python expression using ast module";
     homepage = "https://github.com/lmfit/asteval";
-    changelog = "https://github.com/lmfit/asteval/releases/tag/${src.tag}";
+    changelog = "https://github.com/lmfit/asteval/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})

pkgs/development/python-modules/infisicalsdk/default.nix

@@ -0,0 +1,56 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pyprojectVersionPatchHook,
+  setuptools,
+  python-dateutil,
+  aenum,
+  requests,
+  boto3,
+  botocore,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "infisicalsdk";
+  version = "1.0.16";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "Infisical";
+    repo = "python-sdk-official";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-2bfT99ynl14CSbqIOG2SMQb3oW+uAWD+iJifdMQG8CE=";
+  };
+
+  # fix version in setup.py AND pyproject.toml
+  postPatch = ''
+    substituteInPlace ./setup.py --replace-fail \
+      'VERSION = "1.0.1"' 'VERSION = "${finalAttrs.version}"'
+  '';
+  nativeBuildInputs = [ pyprojectVersionPatchHook ];
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    python-dateutil
+    aenum
+    requests
+    boto3
+    botocore
+  ];
+
+  pythonImportsCheck = [ "infisical_sdk" ];
+
+  doCheck = false; # tests require network access + api keys
+
+  meta = {
+    homepage = "https://github.com/Infisical/python-sdk-official";
+    description = "Infisical Python SDK";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ artur-sannikov ];
+    teams = [ lib.teams.infisical ];
+  };
+})

pkgs/development/python-modules/optiland/default.nix

@@ -2,10 +2,10 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch,
 
   # build-system
   hatchling,
+  versioningit,
 
   # dependencies
   matplotlib,
@@ -22,6 +22,8 @@
 
   # tests
   pytestCheckHook,
+  pytest-xdist,
+  writableTmpDirAsHomeHook,
 
   # optional-dependencies
   pyside6,
@@ -31,7 +33,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "optiland";
-  version = "0.6.0";
+  version = "0.6.2";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -39,28 +41,19 @@ buildPythonPackage (finalAttrs: {
     owner = "HarrisonKramer";
     repo = "optiland";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-s+EFsfj+3VIgpqhBv8f6IblyxfxXHWnO/i1lO3bEke4=";
+    hash = "sha256-4A58AdEDVvHtG3ZS67Ycpd+kRKt69BLEtPMaIGR1dvI=";
   };
 
-  patches = [
-    # wayland is not supported, see:
-    # https://github.com/optiland/optiland/issues/556
-    (fetchpatch {
-      url = "https://github.com/optiland/optiland/commit/9644df6e06bd24c5a3a7cf36c8df9dd83050bccc.patch";
-      hash = "sha256-a74Z7rp3ji3+9lM8Q/RttMIzwlRBki1N2Y0YtBiVaEA=";
-    })
-    # A fixup for the above, see:
-    #
-    # - https://github.com/optiland/optiland/pull/564#discussion_r3106831922
-    # - https://github.com/optiland/optiland/pull/568
-    (fetchpatch {
-      url = "https://github.com/optiland/optiland/commit/652922bce5e1854f1d067e292422d95dee129a46.patch";
-      hash = "sha256-9O+DNbqBDDSAaRkwCy3o76lwy5MJ7WHQqzfcN1fcmnE=";
-    })
-  ];
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail \
+        'default-version = "0.0.0+unknown"' \
+        'default-version = "${finalAttrs.version}"'
+  '';
 
   build-system = [
     hatchling
+    versioningit
   ];
 
   dependencies = [
@@ -91,6 +84,8 @@ buildPythonPackage (finalAttrs: {
 
   nativeCheckInputs = [
     pytestCheckHook
+    pytest-xdist
+    writableTmpDirAsHomeHook
   ]
   # No need for optional-dependencies.gui, as the relevant tests requiring the
   # gui dependencies are disabled below.
@@ -100,6 +95,13 @@ buildPythonPackage (finalAttrs: {
     # From some reason, importing pyside6 during tests causes a core dump of the
     # python interpreter, so we disable all GUI tests.
     "tests/gui/"
+    # All of these 5 fail similarly, see:
+    # https://github.com/optiland/optiland/issues/746
+    "tests/test_ray_aiming.py::test_epd_invariant_under_translation[backend=numpy-25.0-issue613"
+    "tests/test_ray_aiming.py::test_epd_invariant_under_translation[backend=numpy--15.0-issue613"
+    "tests/test_ray_aiming.py::test_float_by_stop_epd_invariant_under_translation[backend=numpy-30.0"
+    "tests/test_ray_aiming.py::test_float_by_stop_epd_invariant_under_translation[backend=numpy--10.0"
+    "tests/test_ray_aiming.py::test_float_by_stop_epd_invariant_under_translation[backend=numpy-1000.0"
   ];
 
   pythonImportsCheck = [

pkgs/development/python-modules/otpauth/default.nix

@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "otpauth";
-  version = "2.2.1";
+  version = "2.2.2";
 
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Fpp629cV/KaH9qZtAszb78Ip+0n4pjS5WNKG+QgTTVk=";
+    hash = "sha256-1DBnkO8b+zsYIWz/cWAyj4nqJqBPiQedemAhb3gIS8w=";
   };
 
   build-system = [ hatchling ];

pkgs/development/python-modules/pyisbn/default.nix

@@ -2,28 +2,33 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  setuptools,
   hypothesis,
-  pytestCheckHook,
   pytest-cov-stub,
+  pytestCheckHook,
+  uv-build,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pyisbn";
-  version = "1.3.1";
+  version = "1.4.3";
   pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-cPVjgXlps/8IUGieULx/917puGXD+A+DWWSxMGxO1Rk=";
+    inherit (finalAttrs) pname version;
+    hash = "sha256-qPOS8G/ZUqH23mvhSKcs93s8UfpXIxIc0cIgGvRjpbM=";
   };
 
-  build-system = [ setuptools ];
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "uv_build>=0.9.0,<0.10.0" "uv_build"
+  '';
+
+  build-system = [ uv-build ];
 
   nativeCheckInputs = [
     hypothesis
-    pytestCheckHook
     pytest-cov-stub
+    pytestCheckHook
   ];
 
   pythonImportsCheck = [ "pyisbn" ];
@@ -31,7 +36,8 @@ buildPythonPackage rec {
   meta = {
     description = "Python module for working with 10- and 13-digit ISBNs";
     homepage = "https://github.com/JNRowe/pyisbn";
+    changelog = "https://github.com/JNRowe/pyisbn/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.gpl3Plus;
     maintainers = [ ];
   };
-}
+})

pkgs/development/python-modules/python-pooldose/default.nix

@@ -11,16 +11,16 @@
   websockets,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "python-pooldose";
-  version = "0.9.6";
+  version = "0.9.9";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lmaertin";
     repo = "python-pooldose";
-    tag = version;
-    hash = "sha256-eSFe3PRKhVMuwJ7XUHRec8nPilSxGUQ1T2k2loLubUg=";
+    tag = finalAttrs.version;
+    hash = "sha256-03U6x1Q0f8oH58Z3IDUW82dc24Od9+fqF/fF0mbzcgg=";
   };
 
   build-system = [ setuptools ];
@@ -40,10 +40,10 @@ buildPythonPackage rec {
   ];
 
   meta = {
-    changelog = "https://github.com/lmaertin/python-pooldose/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/lmaertin/python-pooldose/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     description = "Unofficial async Python client for SEKO PoolDose devices";
     homepage = "https://github.com/lmaertin/python-pooldose";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ dotlambda ];
   };
-}
+})

pkgs/development/python-modules/safety-schemas/default.nix

@@ -10,15 +10,15 @@
   typing-extensions,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "safety-schemas";
-  version = "0.0.19";
+  version = "0.0.20";
   pyproject = true;
 
   src = fetchPypi {
     pname = "safety_schemas";
-    inherit version;
-    hash = "sha256-R4HwbUhSpPKLlo+OxmqagnxbAtJXBUIQoMIILIy3qo0=";
+    inherit (finalAttrs) version;
+    hash = "sha256-D9FHrnxlyLucCGEo9VHuhPrzEUALYQmmTkyiQSCw5WM=";
   };
 
   postPatch = ''
@@ -51,4 +51,4 @@ buildPythonPackage rec {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ dotlambda ];
   };
-}
+})

pkgs/development/python-modules/sciline/default.nix

@@ -24,7 +24,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "sciline";
-  version = "25.11.1";
+  version = "26.8.0";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -32,7 +32,7 @@ buildPythonPackage (finalAttrs: {
     owner = "scipp";
     repo = "sciline";
     tag = finalAttrs.version;
-    hash = "sha256-BTdvPAeI7SWV8gNfXVC63YKghZOfJ9eFousOqycpTAw=";
+    hash = "sha256-FJZjwQGuh8joRPIdA8aQ/MG6GhLVQfp0BtTQkMc4hzI=";
   };
 
   build-system = [
@@ -60,14 +60,6 @@ buildPythonPackage (finalAttrs: {
     "sciline"
   ];
 
-  disabledTestPaths = [
-    # Causes all tests to abort due to TypeError, see:
-    # https://github.com/scipp/sciline/issues/233
-    "tests/complex_workflow_test.py"
-    # Fails too with a similar TypeError, reported in the above issue.
-    "tests/pipeline_test.py::test_subclasses_of_generic_array_provider_defined_with_Scope_work"
-  ];
-
   meta = {
     description = "Build scientific pipelines for your data";
     homepage = "https://scipp.github.io/sciline/";

pkgs/development/python-modules/slack-bolt/default.nix

@@ -5,6 +5,7 @@
 
   # build-system
   setuptools,
+  pkg-resources-backport,
 
   # dependencies
   slack-sdk,
@@ -34,21 +35,21 @@
 
   # tests
   docker,
-  pytest-asyncio_0,
+  pytest-asyncio,
   pytestCheckHook,
   writableTmpDirAsHomeHook,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "slack-bolt";
-  version = "1.29.0";
+  version = "1.30.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "slackapi";
     repo = "bolt-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3U15V++q/x73LuEgw9uWaIGWulJmPkmkpUxxK1EXuzU=";
+    hash = "sha256-B9yE2nZ+GF2s2pj5mCaVUiV2rSr6ilaXgQUiLB0XVRQ=";
   };
 
   build-system = [ setuptools ];
@@ -85,7 +86,8 @@ buildPythonPackage (finalAttrs: {
 
   nativeCheckInputs = [
     docker
-    pytest-asyncio_0
+    pkg-resources-backport
+    pytest-asyncio
     pytestCheckHook
     writableTmpDirAsHomeHook
   ]

pkgs/development/python-modules/streamlit/default.nix

@@ -34,12 +34,12 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "streamlit";
-  version = "1.61.1";
+  version = "1.62.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-aKzx/xtgBbGSBcJ3fYMt7qDB7db7v39D8JG5YiDl418=";
+    hash = "sha256-nSVx2m5nmcuvD1lUj1dzkmJgqHppgHzz4vD2j59eTUU=";
   };
 
   build-system = [ setuptools ];

pkgs/os-specific/linux/systemd/default.nix

@@ -828,7 +828,6 @@ stdenv.mkDerivation (finalAttrs: {
           systemd-networkd-bridge
           systemd-networkd-dhcpserver
           systemd-networkd-dhcpserver-static-leases
-          systemd-networkd-ipv6-prefix-delegation
           systemd-networkd-vrf
           systemd-no-tainted
           systemd-nspawn

pkgs/servers/sql/postgresql/ext/pg_textsearch.nix

@@ -8,13 +8,13 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "pg_textsearch";
-  version = "1.3.1";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "timescale";
     repo = "pg_textsearch";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TqY7mLO/aY30p1QAtILnjIvwDYEV+EYDU94TqUCucDA=";
+    hash = "sha256-im15Z6MnW1x8yN71WkrPArfpD0y2Gp7L7HXOsMWK0ds=";
   };
 
   passthru.tests.extension = postgresqlTestExtension {

pkgs/top-level/aliases.nix

@@ -1148,6 +1148,7 @@ mapAliases {
   incrtcl = throw "'incrtcl' has been renamed to/replaced by 'tclPackages.incrtcl'"; # Converted to throw 2025-10-27
   indicator-application-gtk2 = throw "'indicator-application-gtk2' has been removed as it depended on the deprecated GTK 2 engine. Consider using 'indicator-application-gtk3' instead."; # Added 2026-08-10
   infamousPlugins = infamousplugins; # Added 2026-02-08
+  infisicalsdk = python3Packages.infisicalsdk; # Added 2026-08-23
   inotifyTools = throw "'inotifyTools' has been renamed to/replaced by 'inotify-tools'"; # Converted to throw 2025-10-27
   insync-emblem-icons = throw "'insync-emblem-icons' has been removed, use 'insync-nautilus' instead"; # Added 2025-05-14
   intel2200BGFirmware = warnAlias "'intel2200BGFirmware' has been renamed to 'ipw2200-firmware'" ipw2200-firmware; # Added 2026-02-08

pkgs/top-level/python-packages.nix

@@ -8317,6 +8317,8 @@ self: super: with self; {
 
   infinity = callPackage ../development/python-modules/infinity { };
 
+  infisicalsdk = callPackage ../development/python-modules/infisicalsdk { };
+
   inflate64 = callPackage ../development/python-modules/inflate64 { };
 
   inflect = callPackage ../development/python-modules/inflect { };