Merge release-26.05 into staging-next-26.05

pkgs/by-name/ai/airshipper/package.nix

@@ -16,62 +16,48 @@
   alsa-lib,
   stdenv,
   libxcb,
-  bzip2,
-  cmake,
-  fontconfig,
-  freetype,
   pkg-config,
   makeWrapper,
   writeShellScript,
   patchelf,
 }:
 let
-  version = "0.17.0";
-  # Patch for airshipper to install veloren
-  patch =
-    let
-      runtimeLibs = [
-        udev
-        alsa-lib
-        (lib.getLib stdenv.cc.cc)
-        libxkbcommon
-        libxcb
-        libx11
-        libxcursor
-        libxrandr
-        libxi
-        vulkan-loader
-        libGL
-      ];
-    in
-    writeShellScript "patch" ''
-      echo "making binaries executable"
-      chmod +x {veloren-voxygen,veloren-server-cli}
-      echo "patching dynamic linkers"
-      ${patchelf}/bin/patchelf \
-        --set-interpreter "${stdenv.cc.bintools.dynamicLinker}" \
-        veloren-server-cli
+  # Patch for airshipper to install veloren client
+  patchVoxygen =
+    runtimeLibs:
+    writeShellScript "voxygen-patch" ''
+      echo "making veloren-voxygen executable"
+      chmod +x veloren-voxygen
+      echo "patching veloren-voxygen dynamic linker"
       ${patchelf}/bin/patchelf \
         --set-interpreter "${stdenv.cc.bintools.dynamicLinker}" \
         --set-rpath "${lib.makeLibraryPath runtimeLibs}" \
         veloren-voxygen
     '';
+  # Patch for airshipper to install veloren server
+  patchServer = writeShellScript "server-cli-patch" ''
+    echo "making veloren-server-cli executable"
+    chmod +x veloren-server-cli
+    echo "patching veloren-server-cli dynamic linker"
+    ${patchelf}/bin/patchelf \
+      --set-interpreter "${stdenv.cc.bintools.dynamicLinker}" \
+      veloren-server-cli
+  '';
 in
-rustPlatform.buildRustPackage {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "airshipper";
-  inherit version;
+  version = "0.17.0";
 
   src = fetchFromGitLab {
     owner = "Veloren";
     repo = "airshipper";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-M89RswC08MZnNfk2T1+rtDajTpDGTnJoZ2U8bU5U2+0=";
   };
 
   cargoHash = "sha256-ry0hFvMDnotDQu6mqgyt+6hKOvGRJLmZKs3SxEVtDRg=";
 
   buildInputs = [
-    fontconfig
     openssl
     wayland
     wayland-protocols
@@ -80,9 +66,10 @@ rustPlatform.buildRustPackage {
     libxrandr
     libxi
     libxcursor
+    vulkan-loader
+    libGL
   ];
   nativeBuildInputs = [
-    cmake
     pkg-config
     makeWrapper
   ];
@@ -94,30 +81,40 @@ rustPlatform.buildRustPackage {
     install -Dm444    "client/assets/net.veloren.airshipper.png"  "$out/share/icons/net.veloren.airshipper.png"
   '';
 
-  postFixup =
-    let
-      libPath = lib.makeLibraryPath [
-        libGL
-        vulkan-loader
-        wayland
-        wayland-protocols
-        bzip2
-        fontconfig
-        freetype
-        libxkbcommon
-        libx11
-        libxrandr
-        libxi
-        libxcursor
-      ];
-    in
-    ''
-      # We set LD_LIBRARY_PATH instead of using patchelf in order to propagate the libs
-      # to both Airshipper itself as well as the binaries downloaded by Airshipper.
-      wrapProgram "$out/bin/airshipper" \
-        --set VELOREN_PATCHER "${patch}" \
-        --prefix LD_LIBRARY_PATH : "${libPath}"
-    '';
+  passthru = {
+    inherit patchVoxygen patchServer;
+    runtimeLibs = [
+      udev
+      alsa-lib
+      (lib.getLib stdenv.cc.cc)
+      libxkbcommon
+      libxcb
+      libx11
+      libxcursor
+      libxrandr
+      libxi
+      vulkan-loader
+      libGL
+      wayland
+      wayland-protocols
+    ];
+  };
+
+  postFixup = ''
+    ${patchelf}/bin/patchelf \
+      --set-rpath ${
+        lib.makeLibraryPath (
+          finalAttrs.buildInputs
+          ++ [
+            (lib.getLib stdenv.cc.cc)
+            stdenv.cc.libc
+          ]
+        )
+      } "$out/bin/airshipper"
+    wrapProgram "$out/bin/airshipper" \
+      --set VELOREN_VOXYGEN_PATCHER "${finalAttrs.passthru.patchVoxygen finalAttrs.passthru.runtimeLibs}" \
+      --set VELOREN_SERVER_CLI_PATCHER "${finalAttrs.passthru.patchServer}"
+  '';
 
   doCheck = false;
   cargoBuildFlags = [
@@ -136,4 +133,4 @@ rustPlatform.buildRustPackage {
     license = lib.licenses.gpl3;
     maintainers = with lib.maintainers; [ yusdacra ];
   };
-}
+})

pkgs/by-name/cl/cloudflared/package.nix

@@ -1,24 +1,24 @@
 {
   lib,
   stdenv,
-  buildGoModule,
+  buildGo127Module,
   fetchFromGitHub,
   callPackage,
   gitUpdater,
 }:
 
-buildGoModule (finalAttrs: {
+buildGo127Module (finalAttrs: {
   pname = "cloudflared";
-  version = "2026.5.2";
+  version = "2026.10.3";
 
   src = fetchFromGitHub {
     owner = "cloudflare";
     repo = "cloudflared";
     tag = finalAttrs.version;
-    hash = "sha256-3rMA+DsyC1/ycscL4VfSCS8fZcJzMdDUw8zgmmUhRyQ=";
+    hash = "sha256-k1OMkHHItOT5VHhQqgC8ODm/RCJEtwtZi0Lxyf/esLg=";
   };
 
-  vendorHash = null;
+  vendorHash = "sha256-KqTLXEm0jxJ1TsyYzxAwYMe8niIgJxBHQPz/aZKmS40=";
 
   ldflags = [
     "-s"
@@ -33,7 +33,7 @@ buildGoModule (finalAttrs: {
 
     # Workaround for: protocol_test.go:11:
     #   lookup protocol-v2.argotunnel.com on [::1]:53: read udp [::1]:51876->[::1]:53: read: connection refused
-    substituteInPlace "edgediscovery/protocol_test.go" \
+    substituteInPlace "connection/protocol_test.go" \
       --replace-warn "TestProtocolPercentage" "SkipProtocolPercentage"
 
     # Workaround for: origin_icmp_proxy_test.go:46:

pkgs/by-name/di/dislocker/package.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dislocker";
-  version = "0.7.3-unstable-2026-08-31";
+  version = "0.7.4";
 
   src = fetchFromGitHub {
     owner = "Aorimn";
     repo = "dislocker";
-    rev = "0706462db88efe8df88150e4c3e4332b808f4581";
-    hash = "sha256-lH2BdMcseZDw5gtzY5V0Gyy4MS0I8Vlyb0uZkkZdcbM=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-+T+B8pJDvL8sa2zCVl43RMw7M3i2mRD8+vFbEILL0Io=";
   };
 
   nativeBuildInputs = [
@@ -30,11 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
     mbedtls
   ];
 
-  env.CFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-DFUSE_DARWIN_ENABLE_EXTENSIONS=0";
-
-  passthru.updateScript = nix-update-script {
-    extraArgs = [ "--version=branch" ];
-  };
+  passthru.updateScript = nix-update-script { };
 
   meta = {
     description = "Read BitLocker encrypted partitions in Linux";
@@ -45,6 +41,5 @@ stdenv.mkDerivation (finalAttrs: {
       yuannan
     ];
     platforms = lib.platforms.unix;
-    broken = stdenv.hostPlatform.isDarwin;
   };
 })

pkgs/by-name/fl/flap-alerted/package.nix

@@ -1,6 +1,6 @@
 {
   lib,
-  buildGoModule,
+  buildGo127Module,
   fetchFromGitHub,
   versionCheckHook,
   nix-update-script,
@@ -16,16 +16,16 @@
   withRoaFilter ? false,
 }:
 
-buildGoModule (finalAttrs: {
+buildGo127Module (finalAttrs: {
   pname = "flap-alerted";
-  version = "4.5.0";
+  version = "4.6.0";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "Kioubit";
     repo = "FlapAlerted";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-D4+FLAMt/cHXCks4GQI33ymbZIHzBajpvKU6QQntofk=";
+    hash = "sha256-7uK8d0XLSYRWHmw7wMxJsNpefdJTdzWWc5/lavz1vjM=";
   };
 
   vendorHash = null;

pkgs/by-name/fo/forgejo/generic.nix

@@ -149,6 +149,9 @@ buildGoModule rec {
         "TestMigrateWhiteBlocklist" # requires network: gitlab.com (DNS)
         "TestURLAllowedSSH/Pushmirror_URL" # requires network git.gay (DNS)
         "TestBleveDeleteIssue" # Known Flake-y https://github.com/NixOS/nixpkgs/issues/509878
+      ]
+      ++ lib.optionals (lib.versionAtLeast version "17") [
+        "TestActivityPubMatchesList" # requires local network, which is not available in sandbox
       ];
     in
     [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];

pkgs/by-name/fo/forgejo/lts.nix

@@ -1,7 +1,7 @@
 import ./generic.nix {
-  version = "15.0.10";
-  hash = "sha256-pc97BrybZatSfBgIRJGXodMaltPSv3+/1AFAx9U7GTo=";
-  npmDepsHash = "sha256-cR8lIw11G57tmHFJIU9YercxC9p0IUNJ+vUSfonHSOU=";
+  version = "15.0.11";
+  hash = "sha256-Y7bJri8fu16ETNxvo21t1kAtomeXZcsd1nV6ATBQBvE=";
+  npmDepsHash = "sha256-B8npL45uJlj6oD6C/MYsu1KRyT9UgOYp1Jg9/xZRqtQ=";
   vendorHash = "sha256-tIQmzsPVf5Ka3LmJJxlju750Ja1BKN3JX+8HRyjze+0=";
   lts = true;
   nixUpdateExtraArgs = [

pkgs/by-name/fo/forgejo/package.nix

@@ -1,8 +1,8 @@
 import ./generic.nix {
-  version = "16.0.6";
-  hash = "sha256-629cbLUh+okT3SFHwHFQDPiOoao0hrTxOzdOKxYEd6Q=";
-  npmDepsHash = "sha256-C/ht4Z3ivtm6nBNHUkNmKpLsnmnrpzW6rBq153LuITc=";
-  vendorHash = "sha256-wOAbZ6eEwlavMIcTOmqPpdgLNcgylCX4MwxuI/35YZw=";
+  version = "17.0.1";
+  hash = "sha256-O12795/ydtEequagQfHfOhKTEp8QlmzsJe+RtlHC60A=";
+  npmDepsHash = "sha256-5TrydMO82d30L/EaWg3GI+yaBwG6tZS4IVs+dydpKRY=";
+  vendorHash = "sha256-vXjsZ08eez3oiLL2Um+uFX9YbrRnbq8q5Pj/P3mZTeY=";
   lts = false;
   nixUpdateExtraArgs = [
     "--override-filename"

pkgs/by-name/go/google-chrome/package.nix

@@ -180,7 +180,7 @@ let
 
   linux = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta;
-    version = "156.0.8078.47";
+    version = "156.0.8078.73";
 
     src =
       let
@@ -195,8 +195,8 @@ let
         url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_${debArch}.deb";
         hash =
           {
-            amd64 = "sha256-bJLNIukMbj4lXXgpkVQ/ogkduGFOhTapcadDOlxNesg=";
-            arm64 = "sha256-VFeZnt355l/AUqbTRNyvJHct4AYam9IrqvmeQEPkWY8=";
+            amd64 = "sha256-/RnGiV2td/TX9xLC2fDV62gvSm5/8isb0NQNA3ENKIw=";
+            arm64 = "sha256-/umXYTVl1DFNJvmhThTAHTdSo9c68JzrjsGVaBjpQ00=";
           }
           .${debArch};
       };
@@ -306,11 +306,11 @@ let
 
   darwin = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta;
-    version = "156.0.8078.48";
+    version = "156.0.8078.74";
 
     src = fetchurl {
-      url = "https://dl.google.com/release2/chrome/acpz6fsjbxgnl2ylrkmukmxx2b7q_156.0.8078.48/GoogleChrome-156.0.8078.48.dmg";
-      hash = "sha256-DgE6AQ2VksSpBd4MgTmbo9wz7AtCB7777OyF1nAxMB8=";
+      url = "https://dl.google.com/release2/chrome/acg2teiapq4qsajscuhoyboaquhq_156.0.8078.74/GoogleChrome-156.0.8078.74.dmg";
+      hash = "sha256-VdfHUiP08np0i4x+yYXXp1LvNX6tQ/W/GlR3rtt5dVE=";
     };
 
     dontPatch = true;

pkgs/by-name/he/headscale/package.nix

@@ -1,6 +1,6 @@
 {
   lib,
-  buildGoModule,
+  buildGo127Module,
   fetchFromGitHub,
   installShellFiles,
   iana-etc,
@@ -9,15 +9,15 @@
   postgresql,
   stdenv,
 }:
-buildGoModule (finalAttrs: {
+buildGo127Module (finalAttrs: {
   pname = "headscale";
-  version = "0.29.3";
+  version = "0.29.6";
 
   src = fetchFromGitHub {
     owner = "juanfont";
     repo = "headscale";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ddJHSEqZd++JeG3UjUwzw7i45FlZYggUwhEG/tDkq0s=";
+    hash = "sha256-KWsoNZTbsv1MqmBKrClmk/QcU8Xll5a+AZvTApipX20=";
   };
 
   postPatch = ''
@@ -26,7 +26,7 @@ buildGoModule (finalAttrs: {
       --replace-fail 'Commit:    "unknown"' 'Commit: "${finalAttrs.src.tag}"'
   '';
 
-  vendorHash = "sha256-fzKyXNMw/2yAEhaTZu0n1NXatPO2IP0HFA2ey1vZIYM=";
+  vendorHash = "sha256-aDP2N3EUPeXZWAvlFHWxsGUZTtVGFtcT+Lul1PnGwT4=";
 
   subPackages = [ "cmd/headscale" ];
 

pkgs/by-name/lx/lx-music-desktop/electron-44-clipboard.patch

@@ -0,0 +1,64 @@
+--- a/src/common/utils/electron.ts
++++ b/src/common/utils/electron.ts
+@@ -24,15 +24,15 @@
+  * 复制文本到剪贴板
+  * @param str
+  */
+-export const clipboardWriteText = (str: string) => {
+-  clipboard.writeText(str)
++export const clipboardWriteText = (str: string) => {
++  void clipboard.writeText(str)
+ }
+ 
+ /**
+  * 从剪贴板读取文本
+  * @returns
+  */
+-export const clipboardReadText = (): string => {
++export const clipboardReadText = async (): Promise<string> => {
+   return clipboard.readText()
+ }
+ 
+--- a/src/renderer/views/List/MusicList/components/SearchList.vue
++++ b/src/renderer/views/List/MusicList/components/SearchList.vue
+@@ -196,8 +196,8 @@
+       } else return
+       this.$refs.dom_scrollContainer.scrollTo(0, top)
+     },
+-    handleContextMenu() {
+-      let str = clipboardReadText()
++    async handleContextMenu() {
++      let str = await clipboardReadText()
+       str = str.trim()
+       str = str.replace(/\t|\r\n|\n|\r/g, ' ')
+       str = str.replace(/\s+/g, ' ')
+--- a/src/renderer/components/material/SearchInput.vue
++++ b/src/renderer/components/material/SearchInput.vue
+@@ -179,8 +179,8 @@
+         this.selectIndex = -1
+       }
+     },
+-    handleContextMenu() {
+-      let str = clipboardReadText()
++    async handleContextMenu() {
++      let str = await clipboardReadText()
+       str = str.trim()
+       str = str.replace(/\t|\r\n|\n|\r/g, ' ')
+       str = str.replace(/\s+/g, ' ')
+--- a/src/renderer/components/base/Input.vue
++++ b/src/renderer/components/base/Input.vue
+@@ -65,12 +65,12 @@
+     focus() {
+       this.$refs.dom_input.focus()
+     },
+-    handleContextMenu(event) {
++    async handleContextMenu(event) {
+       if (this.stopContentEventPropagation) event.stopPropagation()
+       if (!this.autoPaste) return
+       let dom_input = this.$refs.dom_input
+       if (dom_input.selectionStart === null) return
+-      let str = clipboardReadText()
++      let str = await clipboardReadText()
+       str = str.trim()
+       str = str.replace(/\t|\r\n|\n|\r/g, ' ')
+       str = str.replace(/\s+/g, ' ')

pkgs/by-name/lx/lx-music-desktop/electron-version.patch

@@ -0,0 +1,35 @@
+--- a/package.json
++++ b/package.json
+@@ -123,7 +123,7 @@
+     "css-loader": "^7.1.5",
+     "css-minimizer-webpack-plugin": "^8.0.0",
+     "del": "^6.1.1",
+-    "electron": "42.11.6",
++    "electron": "44.9.1",
+     "electron-builder": "^26.15.7",
+     "electron-debug": "^3.2.0",
+     "electron-devtools-installer": "github:lyswhut/electron-devtools-installer#64596d615c1fc891eefd8aef1dfcb2c87aaadf03",
+--- a/package-lock.json
++++ b/package-lock.json
+@@ -50,7 +50,7 @@
+         "css-loader": "^7.1.5",
+         "css-minimizer-webpack-plugin": "^8.0.0",
+         "del": "^6.1.1",
+-        "electron": "42.11.6",
++        "electron": "44.9.1",
+         "electron-builder": "^26.15.7",
+         "electron-debug": "^3.2.0",
+         "electron-devtools-installer": "github:lyswhut/electron-devtools-installer#64596d615c1fc891eefd8aef1dfcb2c87aaadf03",
+@@ -5396,9 +5396,9 @@
+       }
+     },
+     "node_modules/electron": {
+-      "version": "42.11.6",
+-      "resolved": "https://registry.npmjs.org/electron/-/electron-42.11.6.tgz",
+-      "integrity": "sha512-IgDsjQp+CYLnArfQbzzS2VmkRgHmSU1G9nGVOtSnFpkUYR8rkeAUSDO77qtqAPX1jgAGly1kgisUmwB9CbUHXw==",
++      "version": "44.9.1",
++      "resolved": "https://registry.npmjs.org/electron/-/electron-44.9.1.tgz",
++      "integrity": "sha512-x/tECFFDa2OFNjMObFH0EGKWrCnFZPOR1wP2iMIVt0STecGl8FmDXdaiaryY0kf8mtw9kSLP2yK8dfdaWkfDmw==",
+       "dev": true,
+       "license": "MIT",
+       "dependencies": {

pkgs/by-name/lx/lx-music-desktop/package.nix

@@ -10,12 +10,12 @@
   makeWrapper,
   makeDesktopItem,
 
-  electron_42,
+  electron_44,
   commandLineArgs ? "",
 }:
 
 let
-  electron = electron_42;
+  electron = electron_44;
 in
 buildNpmPackage (finalAttrs: {
   pname = "lx-music-desktop";
@@ -51,6 +51,10 @@ buildNpmPackage (finalAttrs: {
   ];
 
   patches = [
+    # the upstream use an EOL electron version
+    ./electron-version.patch
+    # clipboard APIs are async since electron 44
+    ./electron-44-clipboard.patch
     # set electron version and dist dir
     # disable before-pack: it would copy prebuilt libraries
     (replaceVars ./electron-builder.patch {
@@ -63,7 +67,7 @@ buildNpmPackage (finalAttrs: {
     copyDesktopItems
   ];
 
-  npmDepsHash = "sha256-bBgewJxBSzyL1V9U9qm0TbWCZMjheCUK6DvvoE3T67M=";
+  npmDepsHash = "sha256-LF/E7JJZQQzEHTEQeFiYa1eMeV+OrqK+8ktwhTmRY30=";
 
   makeCacheWritable = true;
 

pkgs/by-name/ob/obsidian/package.nix

@@ -68,7 +68,7 @@ let
   desktopItem = makeDesktopItem {
     name = "obsidian";
     desktopName = "Obsidian";
-    startupWMClass = "md.Obsidian";
+    startupWMClass = "md.obsidian.Obsidian";
     comment = "Knowledge base";
     icon = "obsidian";
     exec = "obsidian %u";

pkgs/by-name/op/openbao/package.nix

@@ -14,16 +14,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "openbao";
-  version = "2.6.4";
+  version = "2.6.5";
 
   src = fetchFromGitHub {
     owner = "openbao";
     repo = "openbao";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xj8mFvUzwNnbcIMsOJ2mN7ZpXExYStNepigFm9xBGJ0=";
+    hash = "sha256-3he42gk7A0jk8lSEaiHlIigh0x/xxlZHUu2QQvDxOeg=";
   };
 
-  vendorHash = "sha256-gC8KgYH2N1PsC/Fy7NLWyMk3FZPJo9tKrqfdTPxaNnQ=";
+  vendorHash = "sha256-uHJi6s3IAAqZ7q3Gu3BrJIIoJpnlPpbRcIzVZoccaHM=";
 
   proxyVendor = true;
 

pkgs/by-name/po/pocket-casts/package.nix

@@ -5,10 +5,10 @@
   makeDesktopItem,
   copyDesktopItems,
   makeWrapper,
-  electron_42,
+  electron_44,
 }:
 let
-  electron = electron_42;
+  electron = electron_44;
 in
 buildNpmPackage rec {
   pname = "pocket-casts";

pkgs/by-name/pr/proftpd/package.nix

@@ -19,13 +19,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "proftpd";
-  version = "1.3.9d";
+  version = "1.3.9e";
 
   src = fetchFromGitHub {
     owner = "proftpd";
     repo = "proftpd";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-e0E775p8+UdLy9YqdeY5NJGYn8ojWtvOLVAr+UkTEv0=";
+    hash = "sha256-TdPdZHQt6H58s/MblgWs2Dd4r8dgL09cC3hk77nkkQM=";
   };
 
   patches = [ ./no-install-user.patch ];

pkgs/by-name/so/source2viewer-cli/package.nix

@@ -12,13 +12,13 @@ buildDotnetModule (finalAttrs: {
   __structuredAttrs = true;
 
   pname = "source2viewer-cli";
-  version = "20.0";
+  version = "20.1";
 
   src = fetchFromGitHub {
     owner = "ValveResourceFormat";
     repo = "ValveResourceFormat";
     tag = finalAttrs.version;
-    hash = "sha256-GgDRWrZKqAaWL145r6sAqPA31B8KmqW9XlxG75vzESM=";
+    hash = "sha256-CMcWWf06lBNLGvFbalEn+LsbeOV3NmUtneDa8tKrfhQ=";
   };
 
   projectFile = "CLI/CLI.csproj";

pkgs/by-name/uv/uv/package.nix

@@ -9,6 +9,7 @@
 
   # nativeBuildInputs
   installShellFiles,
+  makeBinaryWrapper,
 
   buildPackages,
   versionCheckHook,
@@ -34,7 +35,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rust-jemalloc-sys
   ];
 
-  nativeBuildInputs = [ installShellFiles ];
+  nativeBuildInputs = [
+    installShellFiles
+    makeBinaryWrapper
+  ];
 
   cargoBuildFlags = [
     "--package"
@@ -44,17 +48,22 @@ rustPlatform.buildRustPackage (finalAttrs: {
   # Tests require python3
   doCheck = false;
 
-  postInstall = lib.optionalString (stdenv.hostPlatform.emulatorAvailable buildPackages) (
-    let
-      emulator = stdenv.hostPlatform.emulator buildPackages;
-    in
-    ''
-      installShellCompletion --cmd uv \
-        --bash <(${emulator} $out/bin/uv generate-shell-completion bash) \
-        --fish <(${emulator} $out/bin/uv generate-shell-completion fish) \
-        --zsh <(${emulator} $out/bin/uv generate-shell-completion zsh)
-    ''
-  );
+  postInstall =
+    lib.optionalString (stdenv.hostPlatform.emulatorAvailable buildPackages) (
+      let
+        emulator = stdenv.hostPlatform.emulator buildPackages;
+      in
+      ''
+        installShellCompletion --cmd uv \
+          --bash <(${emulator} $out/bin/uv generate-shell-completion bash) \
+          --fish <(${emulator} $out/bin/uv generate-shell-completion fish) \
+          --zsh <(${emulator} $out/bin/uv generate-shell-completion zsh)
+      ''
+    )
+    # uvx runs the uv next to it, so the wrapper also covers uvx.
+    + ''
+      wrapProgram $out/bin/uv --set-default UV_SYSTEM_CERTS 1
+    '';
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;

pkgs/development/cuda-modules/packages/cudnn.nix

@@ -5,7 +5,7 @@
   lib,
   libcublas,
   cuda_nvrtc,
-  patchelf,
+  buildPackages,
   zlib,
 }:
 buildRedist (
@@ -39,8 +39,8 @@ buildRedist (
     # exist in CuDNN 8.
     # NOTE: Versions from CUDNN releases have four components.
     postFixup = lib.optionalString (cudnnAtLeast "8" && cudnnOlder "9") ''
-      ${lib.getExe patchelf} ''${!outputLib:?}/lib/libcudnn.so --add-needed libcudnn_cnn_infer.so
-      ${lib.getExe patchelf} ''${!outputLib:?}/lib/libcudnn_ops_infer.so --add-needed libcublas.so --add-needed libcublasLt.so
+      ${lib.getExe buildPackages.patchelf} ''${!outputLib:?}/lib/libcudnn.so --add-needed libcudnn_cnn_infer.so
+      ${lib.getExe buildPackages.patchelf} ''${!outputLib:?}/lib/libcudnn_ops_infer.so --add-needed libcublas.so --add-needed libcublasLt.so
     '';
 
     # CuDNN depends on libnvrtc.so at runtime, as mentioned here in one small error description

pkgs/development/libraries/nss/latest.nix

@@ -5,8 +5,8 @@
 #       Example: nix-shell ./maintainers/scripts/update.nix --argstr package cacert
 
 import ./generic.nix {
-  version = "3.131";
-  hash = "sha256-bhhlw4Q4hs4CUWPI4m+cdOStSTKPrZSRqQfWbhfgFzM=";
+  version = "3.132";
+  hash = "sha256-UH7XCsyFyFx+x7I3kD6aPFDoCemVq4fZ3TD5SBQmjl4=";
   filename = "latest.nix";
   versionRegex = "NSS_(\\d+)_(\\d+)(?:_(\\d+))?_RTM";
 }

pkgs/development/tools/build-managers/rebar3/default.nix

@@ -4,6 +4,7 @@
   fetchFromGitHub,
   fetchgit,
   fetchHex,
+  cacert,
   erlang,
   makeWrapper,
   writeScript,
@@ -19,7 +20,7 @@ let
   deps = import ./rebar-deps.nix { inherit fetchFromGitHub fetchgit fetchHex; };
   rebar3 = stdenv.mkDerivation rec {
     pname = "rebar3";
-    version = "3.27.3";
+    version = "3.28.0";
 
     # How to obtain `sha256`:
     # nix-prefetch-url --unpack https://github.com/erlang/rebar3/archive/${version}.tar.gz
@@ -27,7 +28,7 @@ let
       owner = "erlang";
       repo = "rebar3";
       tag = version;
-      sha256 = "Om6c2cpeFCdPAemeA965YxKXhasHbx3gHVgSh+jO2TI=";
+      sha256 = "bhNpZNBYVnM/81EERADvzUGkN9jIR7wPv/kXCC5tWO8=";
     };
 
     buildInputs = [ erlang ];
@@ -60,7 +61,8 @@ let
     '';
 
     checkPhase = ''
-      HOME=. escript ./rebar3 ct
+      HOME=. ERL_FLAGS="-public_key cacerts_path '\"${cacert}/etc/ssl/certs/ca-bundle.crt\"'" \
+        escript ./rebar3 ct
     '';
 
     doCheck = true;

pkgs/servers/http/nginx/mainline.nix

@@ -1,6 +1,6 @@
 { callPackage, ... }@args:
 
 callPackage ./generic.nix args {
-  version = "1.31.7";
-  hash = "sha256-ieqKPcFxUR9zJQQ7UOTANiSNn61f637ICcC4LV30LGU=";
+  version = "1.31.8";
+  hash = "sha256-BlK3YLO3ctLsF7R8L8FdmpXm/jXNW4d+rcGmLZvHWvE=";
 }

pkgs/servers/sql/postgresql/ext/pgvectorscale/package.nix

@@ -9,18 +9,18 @@
 
 buildPgrxExtension (finalAttrs: {
   pname = "pgvectorscale";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "timescale";
     repo = "pgvectorscale";
     tag = finalAttrs.version;
-    hash = "sha256-whGTJI73wifYkleC+aAbDV4nhwls3uFs1xKcB0zLDRo=";
+    hash = "sha256-4i5PhGfvfMPMhkmxfxvaWdIvmGHR1ZkMQzBSTNvqEgw=";
   };
 
   doCheck = false;
 
-  cargoHash = "sha256-uaRKUtsUdZPcrQLAixCiEphXQqdsRhi8nSfh9b3w0ao=";
+  cargoHash = "sha256-2QmOxRKVkC/WBz6BRnxD57hH2E5ANHtNKrp/ytBaILI=";
   cargoPatches = [
     ./add-Cargo.lock.patch
   ];
@@ -65,8 +65,12 @@ buildPgrxExtension (finalAttrs: {
   };
 
   meta = {
-    # Upstream removed support for PostgreSQL 13 on 0.9.0: https://github.com/timescale/pgvectorscale/releases/tag/0.9.0
-    broken = lib.versionOlder postgresql.version "14";
+    # PostgreSQL 19 is not yet supported
+    # See https://github.com/timescale/pgvectorscale/issues/281
+    # Check after next package update.
+    broken =
+      lib.warnIf (finalAttrs.version != "0.9.1") "Is postgresql19Packages.pgvectorscale still broken?"
+        (lib.versionAtLeast postgresql.version "19");
     homepage = "https://github.com/timescale/pgvectorscale";
     maintainers = [
       lib.maintainers.leona