Merge staging-next into staging

2026-10-03 21:40:12 +00:00 · 2025-06-21 00:17:53 +00:00
parent 3adcc3f95e 0c3c46a559
commit ce741b345a
84 changed files with 653 additions and 383 deletions
--- a/nixos/modules/services/networking/fedimintd.nix
+++ b/nixos/modules/services/networking/fedimintd.nix
@@ -49,36 +49,36 @@ let
          openFirewall = mkOption {
            type = types.bool;
            default = true;
-            description = "Opens port in firewall for fedimintd's p2p port";
+            description = "Opens port in firewall for fedimintd's p2p port (both TCP and UDP)";
          };
          port = mkOption {
            type = types.port;
            default = 8173;
-            description = "Port to bind on for p2p connections from peers";
+            description = "Port to bind on for p2p connections from peers (both TCP and UDP)";
          };
          bind = mkOption {
            type = types.str;
            default = "0.0.0.0";
-            description = "Address to bind on for p2p connections from peers";
+            description = "Address to bind on for p2p connections from peers (both TCP and UDP)";
          };
          url = mkOption {
-            type = types.str;
+            type = types.nullOr types.str;
            example = "fedimint://p2p.myfedimint.com:8173";
            description = ''
-              Public address for p2p connections from peers
+              Public address for p2p connections from peers (if TCP is used)
            '';
          };
        };
-        api = {
+        api_ws = {
          openFirewall = mkOption {
            type = types.bool;
            default = false;
-            description = "Opens port in firewall for fedimintd's api port";
+            description = "Opens TCP port in firewall for fedimintd's Websocket API";
          };
          port = mkOption {
            type = types.port;
            default = 8174;
-            description = "Port to bind on for API connections relied by the reverse proxy/tls terminator.";
+            description = "TCP Port to bind on for API connections relayed by the reverse proxy/tls terminator.";
          };
          bind = mkOption {
            type = types.str;
@@ -86,12 +86,46 @@ let
            description = "Address to bind on for API connections relied by the reverse proxy/tls terminator.";
          };
          url = mkOption {
-            type = types.str;
+            type = types.nullOr types.str;
            description = ''
              Public URL of the API address of the reverse proxy/tls terminator. Usually starting with `wss://`.
            '';
          };
        };
+        api_iroh = {
+          openFirewall = mkOption {
+            type = types.bool;
+            default = true;
+            description = "Opens UDP port in firewall for fedimintd's API Iroh endpoint";
+          };
+          port = mkOption {
+            type = types.port;
+            default = 8174;
+            description = "UDP Port to bind Iroh endpoint for API connections";
+          };
+          bind = mkOption {
+            type = types.str;
+            default = "0.0.0.0";
+            description = "Address to bind on for Iroh endpoint for API connections";
+          };
+        };
+        ui = {
+          openFirewall = mkOption {
+            type = types.bool;
+            default = false;
+            description = "Opens TCP port in firewall for built-in UI";
+          };
+          port = mkOption {
+            type = types.port;
+            default = 8175;
+            description = "TCP Port to bind on for UI connections";
+          };
+          bind = mkOption {
+            type = types.str;
+            default = "127.0.0.1";
+            description = "Address to bind on for UI connections";
+          };
+        };
        bitcoin = {
          network = mkOption {
            type = types.str;
@@ -159,7 +193,13 @@ let
            example = "api.myfedimint.com";
            description = "Public domain of the API address of the reverse proxy/tls terminator.";
          };
-          path = mkOption {
+          path_ui = mkOption {
+            type = types.str;
+            example = "/";
+            default = "/";
+            description = "Path to host the built-in UI on and forward to the daemon's api port";
+          };
+          path_ws = mkOption {
            type = types.str;
            example = "/";
            default = "/ws/";
@@ -197,7 +237,21 @@ in
      networking.firewall.allowedTCPPorts = concatLists (
        mapAttrsToList (
          fedimintdName: cfg:
-          (lib.optional cfg.api.openFirewall cfg.api.port ++ lib.optional cfg.p2p.openFirewall cfg.p2p.port)
+          (
+            lib.optional cfg.api_ws.openFirewall cfg.api_ws.port
+            ++ lib.optional cfg.p2p.openFirewall cfg.p2p.port
+            ++ lib.optional cfg.ui.openFirewall cfg.ui.port
+          )
+        ) eachFedimintd
+      );
+
+      networking.firewall.allowedUDPPorts = concatLists (
+        mapAttrsToList (
+          fedimintdName: cfg:
+          (
+            lib.optional cfg.api_iroh.openFirewall cfg.api_iroh.port
+            ++ lib.optional cfg.p2p.openFirewall cfg.p2p.port
+          )
        ) eachFedimintd
      );

@@ -205,14 +259,13 @@ in
        fedimintdName: cfg:
        (nameValuePair "fedimintd-${fedimintdName}" (
          let
-            startScript = pkgs.writeShellScript "fedimintd-start" (
+            startScript = pkgs.writeShellScriptBin "fedimintd" (
              (
                if cfg.bitcoin.rpc.secretFile != null then
                  ''
-                    secret=$(${pkgs.coreutils}/bin/head -n 1 "${cfg.bitcoin.rpc.secretFile}")
-                    prefix="''${FM_BITCOIN_RPC_URL%*@*}"  # Everything before the last '@'
-                    suffix="''${FM_BITCOIN_RPC_URL##*@}"  # Everything after the last '@'
-                    FM_BITCOIN_RPC_URL="''${prefix}:''${secret}@''${suffix}"
+                    >&2 echo "Setting FM_FORCE_BITCOIN_RPC_URL using password from ${cfg.bitcoin.rpc.secretFile}"
+                    secret=$(${pkgs.coreutils}/bin/head -n 1 "${cfg.bitcoin.rpc.secretFile}" || exit 1)
+                    export FM_FORCE_BITCOIN_RPC_URL=$(echo "$FM_BITCOIN_RPC_URL" | sed "s|^\(\w\+://[^@]\+\)\(@.*\)|\1:''${secret}\2|")
                  ''
                else
                  ""
@@ -229,14 +282,23 @@ in
            environment = lib.mkMerge [
              {
                FM_BIND_P2P = "${cfg.p2p.bind}:${toString cfg.p2p.port}";
-                FM_BIND_API = "${cfg.api.bind}:${toString cfg.api.port}";
-                FM_P2P_URL = cfg.p2p.url;
-                FM_API_URL = cfg.api.url;
+                FM_BIND_API_WS = "${cfg.api_ws.bind}:${toString cfg.api_ws.port}";
+                FM_BIND_API_IROH = "${cfg.api_iroh.bind}:${toString cfg.api_iroh.port}";
+                FM_BIND_UI = "${cfg.ui.bind}:${toString cfg.ui.port}";
                FM_DATA_DIR = cfg.dataDir;
                FM_BITCOIN_NETWORK = cfg.bitcoin.network;
                FM_BITCOIN_RPC_URL = cfg.bitcoin.rpc.url;
                FM_BITCOIN_RPC_KIND = cfg.bitcoin.rpc.kind;
              }
+
+              (lib.optionalAttrs (cfg.p2p.url != null) {
+                FM_P2P_URL = cfg.p2p.url;
+              })
+
+              (lib.optionalAttrs (cfg.api_ws.url != null) {
+                FM_API_URL = cfg.api_ws.url;
+              })
+
              cfg.environment
            ];
            serviceConfig = {
@@ -244,7 +306,7 @@ in

              StateDirectory = "fedimintd-${fedimintdName}";
              StateDirectoryMode = "0700";
-              ExecStart = startScript;
+              ExecStart = "${startScript}/bin/fedimintd";

              Restart = "always";
              RestartSec = 10;
@@ -268,9 +330,11 @@ in
              RestrictAddressFamilies = [
                "AF_INET"
                "AF_INET6"
+                "AF_NETLINK"
              ];
              RestrictNamespaces = true;
              RestrictRealtime = true;
+              SocketBindAllow = "udp:${builtins.toString cfg.api_iroh.port}";
              SystemCallArchitectures = "native";
              SystemCallFilter = [
                "@system-service"
@@ -292,13 +356,19 @@ in
              # overridden by default value from vhost-options.nix
              enableACME = mkOverride 99 true;
              forceSSL = mkOverride 99 true;
-              locations.${cfg.nginx.path} = {
-                proxyPass = "http://127.0.0.1:${toString cfg.api.port}/";
+              locations.${cfg.nginx.path_ws} = {
+                proxyPass = "http://127.0.0.1:${builtins.toString cfg.api_ws.port}/";
                proxyWebsockets = true;
                extraConfig = ''
                  proxy_pass_header Authorization;
                '';
              };
+              locations.${cfg.nginx.path_ui} = {
+                proxyPass = "http://127.0.0.1:${builtins.toString cfg.ui.port}/";
+                extraConfig = ''
+                  proxy_pass_header Authorization;
+                '';
+              };
            }
          ]
        ))
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -1158,7 +1158,7 @@ in
              imap0 (i: v: ''
                ${lib.getExe occ} config:system:set trusted_domains \
                  ${toString i} --value="${toString v}"
-              '') ([ cfg.hostName ] ++ cfg.settings.trusted_domains)
+              '') (lib.unique ([ cfg.hostName ] ++ cfg.settings.trusted_domains))
            );

          in
--- a/nixos/tests/fedimintd.nix
+++ b/nixos/tests/fedimintd.nix
@@ -17,12 +17,10 @@
        p2p = {
          url = "fedimint://example.com";
        };
-        api = {
+        api_ws = {
          url = "wss://example.com";
        };
-        environment = {
-          "FM_REL_NOTES_ACK" = "0_4_xyz";
-        };
+        environment = { };
      };
    };

@@ -32,6 +30,6 @@
      start_all()

      machine.wait_for_unit("fedimintd-mainnet.service")
-      machine.wait_for_open_port(${toString nodes.machine.services.fedimintd.mainnet.api.port})
+      machine.wait_for_open_port(${toString nodes.machine.services.fedimintd.mainnet.api_ws.port})
    '';
 }
--- a/pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix
@@ -12,12 +12,12 @@
  pkgs,
 }:
 let
-  version = "0.0.24-unstable-2025-06-12";
+  version = "0.0.25-unstable-2025-06-20";
  src = fetchFromGitHub {
    owner = "yetone";
    repo = "avante.nvim";
-    rev = "8a64d454ef8cfaef2c6280efc9a09ba94fec2c42";
-    hash = "sha256-45Hnopy5yAFpPFNnsTEmfeFTub5tQvhf4dRYoKC+F0g=";
+    rev = "060c0de2aa2ef7c9e6e100f3bd8ef92c085d0555";
+    hash = "sha256-g5GVTRy1RiNNYrVIQbHxOu1ihxlQk/kww3DEKJ6hF9Q=";
  };
  avante-nvim-lib = rustPlatform.buildRustPackage {
    pname = "avante-nvim-lib";
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1589,8 +1589,8 @@ let
          # semver scheme, contrary to preview versions which are listed on
          # the VSCode Marketplace and use a calver scheme. We should avoid
          # using preview versions, because they expire after two weeks.
-          version = "17.1.1";
-          hash = "sha256-hlhq4bR3v0AqI3lxilgNEgjjEEBVL0xfvIWbV/Ronh4=";
+          version = "17.2.0";
+          hash = "sha256-jruhqXJfCACYBFUbPCL22nhqCSrm1QFSMIpsPguQ6J8=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/eamodio.gitlens/changelog";
@@ -2516,8 +2516,8 @@ let
        mktplcRef = {
          name = "Ionide-fsharp";
          publisher = "Ionide";
-          version = "7.26.1";
-          hash = "sha256-xNbW3VoFGeOaII3Z1l51F1IAKKaGP7FhE+rGuCdaHTI=";
+          version = "7.26.2";
+          hash = "sha256-Ox2L39Q3XsnktThVaLP0JxqJlvvkJXaZsdBE2A2ntAc=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/Ionide.Ionide-fsharp/changelog";
--- a/pkgs/applications/editors/vscode/update-shell.nix
+++ b/pkgs/applications/editors/vscode/update-shell.nix
@@ -1,20 +0,0 @@
-{
-  pkgs ? import ../../../.. { },
-}:
-
-# Ideally, pkgs points to default.nix file of Nixpkgs official tree
-with pkgs;
-
-mkShell {
-  packages = [
-    bash
-    curl
-    gawk
-    gnugrep
-    gnused
-    jq
-    nix
-    nix-prefetch
-    nix-prefetch-scripts
-  ];
-}
--- a/pkgs/applications/editors/vscode/update-vscode.sh
+++ b/pkgs/applications/editors/vscode/update-vscode.sh
@@ -1,53 +1,26 @@
 #! /usr/bin/env nix-shell
-#! nix-shell update-shell.nix -i bash
-
-# Update script for the vscode versions and hashes.
-# Usually doesn't need to be called by hand,
-# but is called by a bot: https://github.com/samuela/nixpkgs-upkeep/actions
-# Call it by hand if the bot fails to automatically update the versions.
+#!nix-shell -i bash -p bash curl gawk gnugrep gnused jq nix nix-prefetch nix-prefetch-scripts common-updater-scripts

 set -eou pipefail

-ROOT="$(dirname "$(readlink -f "$0")")"
-if [ ! -f "$ROOT/vscode.nix" ]; then
-  echo "ERROR: cannot find vscode.nix in $ROOT"
-  exit 1
+latestVersion=$(curl --fail --silent https://api.github.com/repos/Microsoft/vscode/releases/latest | jq --raw-output .tag_name)
+currentVersion=$(nix eval --raw -f . vscode.version)
+
+echo "latest  version: $latestVersion"
+echo "current version: $currentVersion"
+
+if [[ "$latestVersion" == "$currentVersion" ]]; then
+  echo "package is up-to-date"
+  exit 0
 fi

-# VSCode
+update-source-version vscode $latestVersion

-VSCODE_VER=$(curl --fail --silent https://api.github.com/repos/Microsoft/vscode/releases/latest | jq --raw-output .tag_name)
-sed -i "s/version = \".*\"/version = \"${VSCODE_VER}\"/" "$ROOT/vscode.nix"
+systems=$(nix eval --json -f . vscode.meta.platforms | jq --raw-output '.[]')
+for system in $systems; do
+  hash=$(nix hash convert --to sri --hash-algo sha256 $(nix-prefetch-url $(nix eval --raw -f . vscode.src.url --system "$system")))
+  update-source-version vscode $latestVersion $hash --system=$system --ignore-same-version --ignore-same-hash
+done

-TEMP_FOLDER=$(mktemp -d)
-
-VSCODE_X64_LINUX_URL="https://update.code.visualstudio.com/${VSCODE_VER}/linux-x64/stable"
-
-# Split output by newlines into Bash array
-readarray -t VSCODE_X64_LINUX <<< $(nix-prefetch-url --print-path ${VSCODE_X64_LINUX_URL})
-
-sed -i "s/x86_64-linux = \".\{52\}\"/x86_64-linux = \"${VSCODE_X64_LINUX[0]}\"/" "$ROOT/vscode.nix"
-
-tar xf ${VSCODE_X64_LINUX[1]} -C $TEMP_FOLDER
-VSCODE_COMMIT=$(jq --raw-output .commit $TEMP_FOLDER/VSCode-linux-x64/resources/app/product.json)
-sed -i "s/rev = \".\{40\}\"/rev = \"${VSCODE_COMMIT}\"/" "$ROOT/vscode.nix"
-
-SERVER_X64_LINUX_URL="https://update.code.visualstudio.com/commit:${VSCODE_COMMIT}/server-linux-x64/stable"
-SERVER_X64_LINUX_SHA256=$(nix-prefetch-url ${SERVER_X64_LINUX_URL})
-sed -i "s/sha256 = \".\{51,52\}\"/sha256 = \"${SERVER_X64_LINUX_SHA256}\"/" "$ROOT/vscode.nix"
-
-VSCODE_X64_DARWIN_URL="https://update.code.visualstudio.com/${VSCODE_VER}/darwin/stable"
-VSCODE_X64_DARWIN_SHA256=$(nix-prefetch-url ${VSCODE_X64_DARWIN_URL})
-sed -i "s/x86_64-darwin = \".\{52\}\"/x86_64-darwin = \"${VSCODE_X64_DARWIN_SHA256}\"/" "$ROOT/vscode.nix"
-
-VSCODE_AARCH64_LINUX_URL="https://update.code.visualstudio.com/${VSCODE_VER}/linux-arm64/stable"
-VSCODE_AARCH64_LINUX_SHA256=$(nix-prefetch-url ${VSCODE_AARCH64_LINUX_URL})
-sed -i "s/aarch64-linux = \".\{52\}\"/aarch64-linux = \"${VSCODE_AARCH64_LINUX_SHA256}\"/" "$ROOT/vscode.nix"
-
-VSCODE_AARCH64_DARWIN_URL="https://update.code.visualstudio.com/${VSCODE_VER}/darwin-arm64/stable"
-VSCODE_AARCH64_DARWIN_SHA256=$(nix-prefetch-url ${VSCODE_AARCH64_DARWIN_URL})
-sed -i "s/aarch64-darwin = \".\{52\}\"/aarch64-darwin = \"${VSCODE_AARCH64_DARWIN_SHA256}\"/" "$ROOT/vscode.nix"
-
-VSCODE_ARMV7L_LINUX_URL="https://update.code.visualstudio.com/${VSCODE_VER}/linux-armhf/stable"
-VSCODE_ARMV7L_LINUX_SHA256=$(nix-prefetch-url ${VSCODE_ARMV7L_LINUX_URL})
-sed -i "s/armv7l-linux = \".\{52\}\"/armv7l-linux = \"${VSCODE_ARMV7L_LINUX_SHA256}\"/" "$ROOT/vscode.nix"
+rev=$(curl --fail --silent https://api.github.com/repos/Microsoft/vscode/git/ref/tags/$latestVersion | jq --raw-output .object.sha)
+update-source-version vscode $rev --version-key=rev --source-key=vscodeServer.src --ignore-same-version --ignore-same-hash
--- a/pkgs/applications/editors/vscode/vscode.nix
+++ b/pkgs/applications/editors/vscode/vscode.nix
@@ -1,7 +1,7 @@
 {
+  lib,
  stdenv,
  stdenvNoCC,
-  lib,
  callPackage,
  fetchurl,
  nixosTests,
@@ -34,24 +34,24 @@ let

  archive_fmt = if stdenv.hostPlatform.isDarwin then "zip" else "tar.gz";

-  sha256 =
+  hash =
    {
-      x86_64-linux = "1zc64d1n84kzwmwh8m3j897di5955qlm7glnpjvl8g7q70b4rdax";
-      x86_64-darwin = "04ycsad1khxjmiph9fk9449w942m8gmq65amwkf8jxqzn0rybh76";
-      aarch64-linux = "0lhqmp59vccs35fksgvdgvw82b0mr9b2wlyafxlwb8pk2q0l0xga";
-      aarch64-darwin = "1axzsk6xqlzs3j9irjxp5f4fbdxyi4fffhdk89h45q3zkw8m9m4i";
-      armv7l-linux = "1rv3a8xj7iv1d8mfikpj58n398ww5cndbyvgy5328nj7dh6azrsw";
+      x86_64-linux = "sha256-Rr7JNWloV4VkgGk9zDEnD/WRHSYv5su8UrOSIl3247c=";
+      x86_64-darwin = "sha256-hHAJVmFKwD0Z8YyqvNlM4SpWnSIniVvdMwR3fhk/mKE=";
+      aarch64-linux = "sha256-/pYykG/1IJU7aJ9wtO5oo3dUdCGtfxklre0SGMpgnq8=";
+      aarch64-darwin = "sha256-pWMCQlgxoJ4EGfycuz3H76r9Sc3x006el1ITOM6E4wE=";
+      armv7l-linux = "sha256-M0fK1n/HMuNQvN85I4g5GV8QAg3n6vQtR6V/B1PFAwQ=";
    }
    .${system} or throwSystem;
 in
 callPackage ./generic.nix rec {
  # Please backport all compatible updates to the stable release.
  # This is important for the extension ecosystem.
-  version = "1.101.0";
+  version = "1.101.1";
  pname = "vscode" + lib.optionalString isInsiders "-insiders";

  # This is used for VS Code - Remote SSH test
-  rev = "dfaf44141ea9deb3b4096f7cd6d24e00c147a4b1";
+  rev = "18e3a1ec544e6907be1e944a94c496e302073435";

  executableName = "code" + lib.optionalString isInsiders "-insiders";
  longName = "Visual Studio Code" + lib.optionalString isInsiders " - Insiders";
@@ -61,7 +61,7 @@ callPackage ./generic.nix rec {
  src = fetchurl {
    name = "VSCode_${version}_${plat}.${archive_fmt}";
    url = "https://update.code.visualstudio.com/${version}/${plat}/stable";
-    inherit sha256;
+    inherit hash;
  };

  # We don't test vscode on CI, instead we test vscodium
@@ -75,7 +75,7 @@ callPackage ./generic.nix rec {
    src = fetchurl {
      name = "vscode-server-${rev}.tar.gz";
      url = "https://update.code.visualstudio.com/commit:${rev}/server-linux-x64/stable";
-      sha256 = "0rjd4f54k58k97gxvnivwj52aha5s8prws1izvmg43vphhfvk014";
+      hash = "sha256-Myq0OUrwv6bq53Q5FDCVtt+wfGlEX2bjz9CMeVLfd+4=";
    };
    stdenv = stdenvNoCC;
  };
@@ -91,7 +91,7 @@ callPackage ./generic.nix rec {

  hasVsceSign = true;

-  meta = with lib; {
+  meta = {
    description = ''
      Open source source code editor developed by Microsoft for Windows,
      Linux and macOS
@@ -106,8 +106,8 @@ callPackage ./generic.nix rec {
    '';
    homepage = "https://code.visualstudio.com/";
    downloadPage = "https://code.visualstudio.com/Updates";
-    license = licenses.unfree;
-    maintainers = with maintainers; [
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [
      eadwu
      synthetica
      bobby285271
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@@ -26,11 +26,11 @@ let

  hash =
    {
-      x86_64-linux = "sha256-c/0+67nosODGvNFav9JAsZlOOL4AqlcRnM1KvcfTXok=";
-      x86_64-darwin = "sha256-1mqzNWbZE0a7EqbYbPK5iJK4tRuKS0nTDcoDDOikj7g=";
-      aarch64-linux = "sha256-/ygtxPvX4fKG1s4KD+JCdc+PTdEg57J9RYW0GmcOf/4=";
-      aarch64-darwin = "sha256-TRwLkZ0uUeD9FA6IPsZ/pK672IgqmhHHycVME9d5X80=";
-      armv7l-linux = "sha256-81Fm+9iBci7UJupzeG7FWMCIseVGWSSsgyMtOce1fE4=";
+      x86_64-linux = "sha256-8ICeLN4KZo3kg0QSGgDqwnulMf4wligZZTeXQ+dC61U=";
+      x86_64-darwin = "sha256-4UDb678hbstvnkySzwI8uhgoR4pmL7KXv9gYLdhigkg=";
+      aarch64-linux = "sha256-dMsyOV4HFF4xZuUzOBOhVru1XfNu14Ga/2iX2ux07qY=";
+      aarch64-darwin = "sha256-lcX3562Aj994+vWQNcDTOVkSJ/zhH0GRjlNlNxoZUXg=";
+      armv7l-linux = "sha256-iSqVoTppc5WDBLRCFhy1hNtovCxeN2bpcvBW4Gqu2+U=";
    }
    .${system} or throwSystem;

@@ -41,7 +41,7 @@ callPackage ./generic.nix rec {

  # Please backport all compatible updates to the stable release.
  # This is important for the extension ecosystem.
-  version = "1.101.03933";
+  version = "1.101.14098";
  pname = "vscodium";

  executableName = "codium";
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -797,7 +797,7 @@
    }
  },
  "ungoogled-chromium": {
-    "version": "137.0.7151.103",
+    "version": "137.0.7151.119",
    "deps": {
      "depot_tools": {
        "rev": "1fcc527019d786502b02f71b8b764ee674a40953",
@@ -808,16 +808,16 @@
        "hash": "sha256-+nKP2hBUKIqdNfDz1vGggXSdCuttOt0GwyGUQ3Z1ZHI="
      },
      "ungoogled-patches": {
-        "rev": "137.0.7151.103-1",
-        "hash": "sha256-KMzO25yruwrT7rpqbQ56FMGxkVZOwDSsvFqCZbUUM5Y="
+        "rev": "137.0.7151.119-1",
+        "hash": "sha256-SMEe/Wc4cjaZfw4pQIWeblEvB9CmOJWVNkDvCKAow3Q="
      },
      "npmHash": "sha256-I6MsfAhrLRmgiRJ13LSejfy2N63C3Oug5tOOXA622j4="
    },
    "DEPS": {
      "src": {
        "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "3dcc738117a3439068c9773ccd31f9858923fc4a",
-        "hash": "sha256-MIEjHLpfKIBiTFh+bO+NUf6iDpizTP9yfXQqbHfiDwo=",
+        "rev": "e0ac9d12dff5f2d33c935958b06bf1ded7f1c08c",
+        "hash": "sha256-+3C2n/7bbIOpXGvBrFnSMNlgLVRMoPtOF14CDROVClI=",
        "recompress": true
      },
      "src/third_party/clang-format/script": {
@@ -1037,8 +1037,8 @@
      },
      "src/third_party/devtools-frontend/src": {
        "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "e423961606946be24c8c1ec0d1ec91511efbabc5",
-        "hash": "sha256-MhooXuF6aw+ixPzvVCBl+6T+79cTReCYx86qqXAZ6bg="
+        "rev": "afc8e923a37090445d6d97ca23fea49d9eb7b9cf",
+        "hash": "sha256-io0J6tt0RXumjjSklZyJpALV5IikPbROd40xcrX4iBs="
      },
      "src/third_party/dom_distiller_js/dist": {
        "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
@@ -1587,8 +1587,8 @@
      },
      "src/v8": {
        "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "41f53aba7095888c959932bd8f2ee8b4e16af223",
-        "hash": "sha256-ICrdvHA6fe2CUphRgPdlofazr0L+NFypWDNOI5e5QIM="
+        "rev": "075234cf3d7622d9d588a6f748fc4501aa23080c",
+        "hash": "sha256-wrLxRuJ3rq1yC0PIUGPsuDB/YNee1x3J/i6ZSLk70HM="
      }
    }
  }
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
@@ -10,11 +10,11 @@
 buildMozillaMach rec {
  pname = "firefox-beta";
  binaryName = pname;
-  version = "140.0b7";
+  version = "140.0b9";
  applicationName = "Firefox Beta";
  src = fetchurl {
    url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "51a9dad564bc20aaacec5bc8cfe05f7213d6fbc826783790bcb1067cbea7349a88f479df70f73501357625c6a239d33a10a840e7287d077771dc08b0fd9b076b";
+    sha512 = "eb63be9dd42f5f777706c15a87e536769deb22658da6c35070962d98d03ec678409a1d09bf257c0421039cccdf7db892eb4c7aee610341a262ffae28b04b52b3";
  };

  meta = {
--- a/pkgs/applications/networking/cluster/helm/default.nix
+++ b/pkgs/applications/networking/cluster/helm/default.nix
@@ -9,15 +9,15 @@

 buildGoModule (finalAttrs: {
  pname = "kubernetes-helm";
-  version = "3.18.2";
+  version = "3.18.3";

  src = fetchFromGitHub {
    owner = "helm";
    repo = "helm";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-yt5OsJscTjAvr/EAgf4BuE18O+OVmAFNzWMvDCGQ4sw=";
+    sha256 = "sha256-V5gWzgsinT0hGFDocPlljH1ls8Z0j5cz37oPrB6LI9Y=";
  };
-  vendorHash = "sha256-gadl9Jkj95eZpzkFWqk33O1jrLr8IxtB5kml7fNlsIo=";
+  vendorHash = "sha256-r9DLYgEjxapUOAz+FCgYXqdE6APhGKO/YnshbLRmdrU=";

  subPackages = [ "cmd/helm" ];
  ldflags = [
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -967,13 +967,13 @@
    "vendorHash": "sha256-Z8ARwVWhep9qrUpl/B7Gj9Aey07Wtwn1XiLnCirV11M="
  },
  "openstack": {
-    "hash": "sha256-7oQ4O76yEF8QKFUHTrwchbShtiG0LAp67MqfIcDLU7o=",
+    "hash": "sha256-pGNHWhg/1LM1IJYEVLppCJWVzow+j3WPW+H8yWQXMyM=",
    "homepage": "https://registry.terraform.io/providers/terraform-provider-openstack/openstack",
    "owner": "terraform-provider-openstack",
    "repo": "terraform-provider-openstack",
-    "rev": "v3.1.0",
+    "rev": "v3.2.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-HQVKblAm8H0Q5pbJdIVSMc5FLi3O9TV475yass6BraY="
+    "vendorHash": "sha256-mTWLix4A0GRe7ayHTwU3Jt+DfDKMIKJlt1I6JuL3wXU="
  },
  "opentelekomcloud": {
    "hash": "sha256-PPrZAxJxLiR3LLEAtWucdWXI5qvsmOVfwCDCtjWuu/A=",
--- a/pkgs/by-name/an/ankama-launcher/package.nix
+++ b/pkgs/by-name/an/ankama-launcher/package.nix
@@ -1,19 +1,19 @@
 {
+  lib,
  appimageTools,
  fetchurl,
-  lib,
 }:
 let
  pname = "ankama-launcher";
-  version = "3.12.39";
+  version = "3.13.5";

  # The original URL for the launcher is:
  # https://launcher.cdn.ankama.com/installers/production/Ankama%20Launcher-Setup-x86_64.AppImage
  # As it does not encode the version, we use the wayback machine (web.archive.org) to get a fixed URL.
  # To update the client, head to web.archive.org and create a new snapshot of the download page.
  src = fetchurl {
-    url = "https://web.archive.org/web/20250413180128/https://launcher.cdn.ankama.com/installers/production/Ankama%20Launcher-Setup-x86_64.AppImage";
-    hash = "sha256-25x+x5Y0pIxvJyjbctt9weCEiH0UlqGbGM7/RKkyHXA=";
+    url = "https://web.archive.org/web/20250617174847/https://launcher.cdn.ankama.com/installers/production/Ankama%20Launcher-Setup-x86_64.AppImage";
+    hash = "sha256-c3lG4Svd5gxsaUVJ3fiBO2ZL+U4pJxJX5Fg5ITZ/QwI=";
  };

  appimageContents = appimageTools.extract { inherit pname version src; };
--- a/pkgs/by-name/ap/appmenu-glib-translator/package.nix
+++ b/pkgs/by-name/ap/appmenu-glib-translator/package.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  fetchFromGitLab,
+  glib,
+  gtk3,
+  meson,
+  ninja,
+  pkg-config,
+  gobject-introspection,
+  vala,
+  stdenv,
+  wrapGAppsHook3,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "appmenu-glib-translator";
+  version = "25.04";
+
+  src = fetchFromGitLab {
+    owner = "vala-panel-project";
+    repo = "vala-panel-appmenu";
+    tag = finalAttrs.version;
+    fetchSubmodules = true;
+    hash = "sha256-v5J3nwViNiSKRPdJr+lhNUdKaPG82fShPDlnmix5tlY=";
+  };
+
+  sourceRoot = "source/subprojects/appmenu-glib-translator";
+
+  nativeBuildInputs = [
+    meson
+    ninja
+
+    pkg-config
+    wrapGAppsHook3
+    vala
+  ];
+
+  buildInputs = [
+    glib
+    gobject-introspection
+    gtk3
+  ];
+
+  meta = {
+    description = "GTK module that strips menus from all GTK programs, converts to MenuModel and sends to AppMenu";
+    homepage = "https://gitlab.com/vala-panel-project/vala-panel-appmenu/-/tree/${finalAttrs.version}/subprojects/appmenu-gtk-module";
+    license = lib.licenses.lgpl3Plus;
+    maintainers = with lib.maintainers; [ perchun ];
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/by-name/bi/biliup-rs/package.nix
+++ b/pkgs/by-name/bi/biliup-rs/package.nix
@@ -10,13 +10,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "biliup-rs";
-  version = "0.2.2";
+  version = "0.2.3";

  src = fetchFromGitHub {
    owner = "biliup";
    repo = "biliup-rs";
    tag = "v${version}";
-    hash = "sha256-Wpi5ONOzWL/NUUuIR4jaDcJFq7ZIYi7gkIxFIU3SLVY=";
+    hash = "sha256-Gr2veeFDNHisqin4MQl/RcZN51BUHwTn7zUplP+VODo=";
  };

  nativeBuildInputs = [
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage rec {
  ];

  useFetchCargoVendor = true;
-  cargoHash = "sha256-4SH7ux15Sm7NJDY79x9O7oahvbjS4kZzzY/9UsLDq0U=";
+  cargoHash = "sha256-7LiwKBsDAIc3zZvKFzgnIjup8lA70g7r7TtBCJ5VgL8=";

  passthru.updateScript = nix-update-script { };

--- a/pkgs/by-name/bt/btcpayserver/deps.json
+++ b/pkgs/by-name/bt/btcpayserver/deps.json
@@ -51,8 +51,8 @@
  },
  {
    "pname": "BTCPayServer.Lightning.All",
-    "version": "1.6.10",
-    "hash": "sha256-v2D43E9aEFKN/oMP4W98BST+WBMRDLDBD6AKJZey7PA="
+    "version": "1.6.11",
+    "hash": "sha256-HId8axtrx8i205y1uytHp/04/DyKsXzJwSEMzpr7Mzk="
  },
  {
    "pname": "BTCPayServer.Lightning.Charge",
@@ -96,8 +96,8 @@
  },
  {
    "pname": "BTCPayServer.Lightning.Phoenixd",
-    "version": "1.5.7",
-    "hash": "sha256-kDl8tDEzrwNwyFRp77NSFw0WkHwudeS5pefJNSvq/IM="
+    "version": "1.5.8",
+    "hash": "sha256-pISNuSZW/B0MZ5VkW8nHAENTOUoFI+YfvrubD/vh74w="
  },
  {
    "pname": "BTCPayServer.NETCore.Plugins",
--- a/pkgs/by-name/bt/btcpayserver/package.nix
+++ b/pkgs/by-name/bt/btcpayserver/package.nix
@@ -8,13 +8,13 @@

 buildDotnetModule rec {
  pname = "btcpayserver";
-  version = "2.1.4";
+  version = "2.1.5";

  src = fetchFromGitHub {
    owner = "btcpayserver";
    repo = "btcpayserver";
    tag = "v${version}";
-    hash = "sha256-GY6s/em5jlok1IFe474bD1L34Zlr6gYtG+Wn6eZxMIc=";
+    hash = "sha256-qm/MdgM5sPQu7fI1S8qf/dvkMZbmP4rLA1RdSQHSawE=";
  };

  projectFile = "BTCPayServer/BTCPayServer.csproj";
--- a/pkgs/by-name/ca/cargo-expand/package.nix
+++ b/pkgs/by-name/ca/cargo-expand/package.nix
@@ -6,17 +6,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-expand";
-  version = "1.0.108";
+  version = "1.0.109";

  src = fetchFromGitHub {
    owner = "dtolnay";
    repo = "cargo-expand";
    rev = version;
-    hash = "sha256-MJ7v761w8+QePCH5aSi7rTUyMFLwgcmZtHXrfHFRLxU=";
+    hash = "sha256-LMY9kSyFc9B1yxuJ+maE/ETIyaClRLlGlKixnQ7oirw=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-ax16yGwMGHfaXf/feh+1UcgwCEdgINQtz63J1IqH0pc=";
+  cargoHash = "sha256-MK3YODig3KK8qJ3EjLYGE1qR9vukHux9gsEA1C2v8EQ=";

  meta = {
    description = "Cargo subcommand to show result of macro expansion";
--- a/pkgs/by-name/ch/checkov/package.nix
+++ b/pkgs/by-name/ch/checkov/package.nix
@@ -25,14 +25,14 @@ with py.pkgs;

 python3.pkgs.buildPythonApplication rec {
  pname = "checkov";
-  version = "3.2.442";
+  version = "3.2.443";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "bridgecrewio";
    repo = "checkov";
    tag = version;
-    hash = "sha256-/0Y9zlFS/hBKd9Mxb95u51+/OPjbxgC+OPoP+nIRIl0=";
+    hash = "sha256-qROzLxbeH3DeB5RzUPXJU4zyI4p7j96/vp/+iab2M6A=";
  };

  pythonRelaxDeps = [
--- a/pkgs/by-name/cl/clickhouse-backup/package.nix
+++ b/pkgs/by-name/cl/clickhouse-backup/package.nix
@@ -8,13 +8,13 @@

 buildGoModule rec {
  pname = "clickhouse-backup";
-  version = "2.6.22";
+  version = "2.6.23";

  src = fetchFromGitHub {
    owner = "Altinity";
    repo = "clickhouse-backup";
    rev = "v${version}";
-    hash = "sha256-EAaXRFNaK4BzLfvfdVdMiVPdv9giAxbA1UMGqDggjss=";
+    hash = "sha256-r2Oc7WQcWw60g+Pcv4UrSEpxhUET46uNeqF67iK9cvU=";
  };

  vendorHash = "sha256-tgDNKujpmDk6wcP9jEwfSbRWzJqiPs7aAWkkaD195Ss=";
--- a/pkgs/by-name/cr/crawley/package.nix
+++ b/pkgs/by-name/cr/crawley/package.nix
@@ -7,18 +7,18 @@

 buildGoModule rec {
  pname = "crawley";
-  version = "1.7.11";
+  version = "1.7.12";

  src = fetchFromGitHub {
    owner = "s0rg";
    repo = "crawley";
    rev = "v${version}";
-    hash = "sha256-P+BsfVYqUDZ+wqIwziWLI3V0nUnypenHFfmw6EkPigo=";
+    hash = "sha256-MMjyDWDA4gVbMvqZSpTcM9PZtcmHNm4oglkjvjTKzsw=";
  };

  nativeBuildInputs = [ installShellFiles ];

-  vendorHash = "sha256-lcCcfn83WGBegQzUKEF8kpu7DdcLyVbS+PGX0mYrr40=";
+  vendorHash = "sha256-JlAk3ctEVOHnwTBLBqIYFENPEDX+t+Je9DykgK8mBrw=";

  ldflags = [
    "-w"
--- a/pkgs/by-name/cr/credhub-cli/package.nix
+++ b/pkgs/by-name/cr/credhub-cli/package.nix
@@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "credhub-cli";
-  version = "2.9.46";
+  version = "2.9.47";

  src = fetchFromGitHub {
    owner = "cloudfoundry-incubator";
    repo = "credhub-cli";
    rev = version;
-    sha256 = "sha256-g5Wa+noAcip4My8epfzLZos1wo/J85v5x0G2rwgJLtE=";
+    sha256 = "sha256-3/CYwgdGOFkiGNsWrIGbHGK/iSJxz6KRneTdaJT6i24=";
  };

  # these tests require network access that we're not going to give them
--- a/pkgs/by-name/cy/cyme/package.nix
+++ b/pkgs/by-name/cy/cyme/package.nix
@@ -12,17 +12,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "cyme";
-  version = "2.2.2";
+  version = "2.2.3";

  src = fetchFromGitHub {
    owner = "tuna-f1sh";
    repo = "cyme";
    rev = "v${version}";
-    hash = "sha256-oOr7LYQfA/ZtC1Up4/dAHFdtWAM+8J+OPiHIOtVLQxY=";
+    hash = "sha256-Zbb9CEsDtig9Nc6FUFZSdsfU7l6XHQvQK8asZ7O/Weo=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-PaX2Eod/5eCZFzMzkLovhE/TpQqNyhqCHaF1LiRxndg=";
+  cargoHash = "sha256-HdlhsOctPxOanbPAIJnlUoY4QeIluVsJlPglFXHBpFY=";

  nativeBuildInputs =
    [
--- a/pkgs/by-name/de/delsum/package.nix
+++ b/pkgs/by-name/de/delsum/package.nix
@@ -0,0 +1,31 @@
+{
+  fetchFromGitHub,
+  gf2x,
+  lib,
+  rustPlatform,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "delsum";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "8051Enthusiast";
+    repo = "delsum";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-trCH2LIC3hjm3MMEoVGO2AY33eYTfn4N2mm2rOfUwt4=";
+  };
+
+  cargoHash = "sha256-Flz7h2/i4WIGr8CgVjpbCGHUkkGKSiHw5wlOIo7uuXo=";
+
+  buildInputs = [
+    gf2x
+  ];
+
+  meta = {
+    homepage = "https://github.com/8051Enthusiast/delsum";
+    description = "Reverse engineer's checksum toolbox";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ timschumi ];
+    mainProgram = "delsum";
+  };
+})
--- a/pkgs/by-name/do/docker-language-server/package.nix
+++ b/pkgs/by-name/do/docker-language-server/package.nix
@@ -8,13 +8,13 @@

 buildGoModule rec {
  pname = "docker-language-server";
-  version = "0.10.2";
+  version = "0.12.0";

  src = fetchFromGitHub {
    owner = "docker";
    repo = "docker-language-server";
    tag = "v${version}";
-    hash = "sha256-IFHwlunenIeTJUMIgMSi/xFbIMjrC3sABxow5Toxi50=";
+    hash = "sha256-cMHWdSMPo38Nuvx/K187PJ4tp6F1Fqs73+sIOrAk8Jo=";
  };

  vendorHash = "sha256-yb/GdwgEwv6ybb1CkBivCC6WKc/DX9FXxz+7WLr3scw=";
--- a/pkgs/by-name/fa/fastp/package.nix
+++ b/pkgs/by-name/fa/fastp/package.nix
@@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "fastp";
-  version = "0.26.0";
+  version = "1.0.0";

  src = fetchFromGitHub {
    owner = "OpenGene";
    repo = "fastp";
    rev = "v${version}";
-    sha256 = "sha256-DrvY2FqTlQU3mJkBp/gM+GHlBlumfYRZItpphaF1xfs=";
+    sha256 = "sha256-oUThNtxM5zQgC4k3igrzYbFsza8d6E0U/o7w0FC8J3o=";
  };

  buildInputs = [
--- a/pkgs/by-name/fe/fedimint/package.nix
+++ b/pkgs/by-name/fe/fedimint/package.nix
@@ -6,21 +6,24 @@
  pkg-config,
  protobuf,
  rustPlatform,
+  version ? "0.7.1",
+  hash ? "sha256-7meBYUN7sG1OAtMEm6I66+ptf4EfsbA+dm5/4P3IRV4=",
+  cargoHash ? "sha256-4cFuasH2hvrnzTBTFifHEMtXZKsBv7OVpuwPlV19GGw=",
 }:

 rustPlatform.buildRustPackage rec {
  pname = "fedimint";
-  version = "0.5.1";
+  inherit version;

  src = fetchFromGitHub {
    owner = "fedimint";
    repo = "fedimint";
    rev = "v${version}";
-    hash = "sha256-dhZYOfXepOnt1lQEgrM/y++5V58weiiTMAyMKl2t37Q=";
+    inherit hash;
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-WElH4AdLlF/BuxRrURUv6xNGUVBZ6hhSFg1p+T3jG54=";
+  inherit cargoHash;

  nativeBuildInputs = [
    protobuf
@@ -45,7 +48,7 @@ rustPlatform.buildRustPackage rec {
    mkdir -p $fedimint/bin $fedimintCli/bin $gateway/bin $gatewayCli/bin $devimint/bin

    # delete fuzzing targets and other binaries no one cares about
-    binsToKeep=(fedimint-cli fedimint-dbtool recoverytool fedimintd gatewayd gateway-cli gateway-cln-extension devimint)
+    binsToKeep=(fedimint-cli fedimint-dbtool recoverytool fedimintd gatewayd gateway-cli devimint)
    keepPattern=$(printf "|%s" "''${binsToKeep[@]}")
    keepPattern=''${keepPattern:1}
    find "$out/bin" -maxdepth 1 -type f | grep -Ev "(''${keepPattern})" | xargs rm -f
@@ -59,7 +62,6 @@ rustPlatform.buildRustPackage rec {
    cp -a $releaseDir/gateway-cli $gatewayCli/bin/

    cp -a $releaseDir/gatewayd $gateway/bin/
-    cp -a $releaseDir/gateway-cln-extension $gateway/bin/

    cp -a $releaseDir/devimint $devimint/bin/
  '';
--- a/pkgs/by-name/gi/github-backup/package.nix
+++ b/pkgs/by-name/gi/github-backup/package.nix
@@ -8,14 +8,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "github-backup";
-  version = "0.50.1";
+  version = "0.50.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "josegonzalez";
    repo = "python-github-backup";
    tag = version;
-    hash = "sha256-9fPZ+QWHkIQVEgPKCZMJZk4p5nkXan61Ym+tbF0ZOMM=";
+    hash = "sha256-MUPQa1L3HmAMn1pZSzQk8VKpcz2nDGuWZB8pVi7CyYs=";
  };

  build-system = with python3Packages; [
--- a/pkgs/by-name/go/gomi/package.nix
+++ b/pkgs/by-name/go/gomi/package.nix
@@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "gomi";
-  version = "1.6.0";
+  version = "1.6.1";

  src = fetchFromGitHub {
    owner = "b4b4r07";
    repo = "gomi";
    tag = "v${version}";
-    hash = "sha256-0C+us4GO8Jd51ATaaf0aRU3NnhmDvu0I3qDDXBoaiXU=";
+    hash = "sha256-Sxf/x29uADkdILrWwdKZhTc1Y7zCJbpMNK6vV/SGF1Q=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
@@ -24,12 +24,12 @@ buildGoModule rec {
    '';
  };

-  vendorHash = "sha256-8aw81DKBmgNsQzgtHCsUkok5e5+LeAC8BUijwKVT/0s=";
+  vendorHash = "sha256-Lt2SA3IHD8wDxv5bScU37hqStnfxVYQQZS6ajr7PhJM=";

  subPackages = [ "." ];

  # Add version information fetched from the repository to ldflags.
-  # https://github.com/babarot/gomi/blob/v1.6.0/.goreleaser.yaml#L20-L22
+  # https://github.com/babarot/gomi/blob/v1.6.1/.goreleaser.yaml#L20-L22
  ldflags = [
    "-X main.version=v${version}"
  ];
--- a/pkgs/by-name/gt/gtklock-powerbar-module/package.nix
+++ b/pkgs/by-name/gt/gtklock-powerbar-module/package.nix
@@ -7,6 +7,7 @@
  pkg-config,
  gtk3,
  gtklock,
+  systemd,
 }:

 stdenv.mkDerivation (finalAttrs: {
@@ -28,6 +29,17 @@ stdenv.mkDerivation (finalAttrs: {

  buildInputs = [ gtk3 ];

+  postPatch =
+    let
+      systemctl = lib.getExe' systemd "systemctl";
+    in
+    ''
+      substituteInPlace source.c \
+        --replace-fail '"systemctl reboot"' '"${systemctl} reboot"' \
+        --replace-fail '"systemctl -i poweroff"' '"${systemctl} -i poweroff"' \
+        --replace-fail '"systemctl suspend"' '"${systemctl} suspend"'
+    '';
+
  passthru.tests.testModule = gtklock.testModule finalAttrs.finalPackage;

  meta = {
--- a/pkgs/by-name/hu/hut/package.nix
+++ b/pkgs/by-name/hu/hut/package.nix
@@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "hut";
-  version = "0.6.0";
+  version = "0.7.0";

  src = fetchFromSourcehut {
    owner = "~xenrox";
    repo = "hut";
    rev = "v${version}";
-    sha256 = "sha256-wfnuGnO1aiK0D8P5nMCqD38DJ3RpcsK//02KaE5SkZE=";
+    sha256 = "sha256-pc6E3ORDmaMhoNe8GQeYZrxhe5ySQqsMPe/iUbclnGk=";
  };

-  vendorHash = "sha256-6dIqcjtacxlmadnPzRlOJYoyOaO4zdjzrjO64KS2Bq0=";
+  vendorHash = "sha256-/51cv/EvcBCyCOf91vJ5M75p0bkAQqVoRUp+C+i70Os=";

  nativeBuildInputs = [
    scdoc
--- a/pkgs/by-name/hy/hydra/package.nix
+++ b/pkgs/by-name/hy/hydra/package.nix
@@ -130,13 +130,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "hydra";
-  version = "0-unstable-2025-05-27";
+  version = "0-unstable-2025-06-15";

  src = fetchFromGitHub {
    owner = "NixOS";
    repo = "hydra";
-    rev = "2e3c168ec49fb78554247bf1aa7d11fbf716e107";
-    hash = "sha256-S3gG8xXItXdefeSIaR4tTzjHv+pceu/i5s+wGQNHAWQ=";
+    rev = "ed500ca4345f7edaa6c3d84027a7599d38b15a29";
+    hash = "sha256-Mxz4n40VKxA2ILtIHX6fObgcy2WlgsM+ERfpjuVJ0BU=";
  };

  outputs = [
--- a/pkgs/by-name/li/lifeograph/package.nix
+++ b/pkgs/by-name/li/lifeograph/package.nix
@@ -16,12 +16,12 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "lifeograph";
-  version = "3.0.2";
+  version = "3.0.3";

  src = fetchgit {
    url = "https://git.launchpad.net/lifeograph";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-eb31/ncGH5+Wz1vPCHeEFP1AiKe29rAOg5SL2cjabCc=";
+    hash = "sha256-VaDxmbTVx6wiFMDRYuBM5Y4oPODWPTm8QP6zpT+yBOY=";
  };

  nativeBuildInputs = [
@@ -40,11 +40,6 @@ stdenv.mkDerivation (finalAttrs: {
    libshumate
  ];

-  postInstall = ''
-    substituteInPlace $out/share/applications/net.sourceforge.Lifeograph.desktop \
-      --replace-fail "Exec=" "Exec=$out/bin/"
-  '';
-
  meta = {
    homepage = "https://lifeograph.sourceforge.net/doku.php?id=start";
    description = "Off-line and private journal and note taking application";
--- a/pkgs/by-name/lu/lutgen/package.nix
+++ b/pkgs/by-name/lu/lutgen/package.nix
@@ -8,17 +8,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "lutgen";
-  version = "0.12.0";
+  version = "0.12.1";

  src = fetchFromGitHub {
    owner = "ozwaldorf";
    repo = "lutgen-rs";
    rev = "v${version}";
-    hash = "sha256-VE4R0rdQbZ7cyCPRtWWARUAnlR/KWGFUoJSJ4lySwzY=";
+    hash = "sha256-JFVDiq53AZhiTqEXplCuKoATxeHp/HDJ8p0a6WzVq6I=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-H913/EjCh14AcCIj/Em6neP5F6i88rSVbPMmnS3po/I=";
+  cargoHash = "sha256-tOFO2eRWd03zzGX3Ia1IBQ27kmSMX7JgbXmaejRTfp4=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/ma/mark/package.nix
+++ b/pkgs/by-name/ma/mark/package.nix
@@ -8,16 +8,16 @@
 # https://github.com/kovetskiy/mark/pull/581#issuecomment-2797872996
 buildGoModule rec {
  pname = "mark";
-  version = "14.0.4";
+  version = "14.1.0";

  src = fetchFromGitHub {
    owner = "kovetskiy";
    repo = "mark";
    rev = "${version}";
-    sha256 = "sha256-o5y1rybj32IrlSPMIw1Jv+Os/fdrQSjeUgvGvFvYS3A=";
+    sha256 = "sha256-TQU49rPpHCDQEOIfC3R89kdtVMVJrisOXF5DhbRgJQ0=";
  };

-  vendorHash = "sha256-ClSFazL9+prDgqHGK5ihSIqCWp8IDtyQ5dpKECfUp6A=";
+  vendorHash = "sha256-y5WCpL0bJE48iVUO2hPy7AvAx9KEVQJUK6vVwFfob/M=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/me/melonDS/package.nix
+++ b/pkgs/by-name/me/melonDS/package.nix
@@ -28,13 +28,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "melonDS";
-  version = "1.0rc-unstable-2025-05-27";
+  version = "1.0rc-unstable-2025-06-18";

  src = fetchFromGitHub {
    owner = "melonDS-emu";
    repo = "melonDS";
-    rev = "7117178c2dd56df32b6534ba6a54ad1f8547e693";
-    hash = "sha256-6bwagPFIv87WtmQ3cl8cDZ/1A8Ab6itLHAr33CJy/Eo=";
+    rev = "71edf793fcd2726c4212f7915194c60107dc2809";
+    hash = "sha256-B/qWdt+fWSov54zA+7S25bEVxqQuspo5oT3MyMk4Ato=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/mo/moon/package.nix
+++ b/pkgs/by-name/mo/moon/package.nix
@@ -13,16 +13,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "moon";
-  version = "1.37.1";
+  version = "1.37.3";

  src = fetchFromGitHub {
    owner = "moonrepo";
    repo = "moon";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-qPrrVk+rVEtLPJxhvgYCQ2CczwfGp/Pv1Ck+/FlimwI=";
+    hash = "sha256-XBuB26ghUUXkQrUDZCt7L4c8aW5odI7BqDdM6Si8Nck=";
  };

-  cargoHash = "sha256-PEmCrE7GcH09buX5p+UoDgqdBCoY5mqmLxm+hNaz3Yo=";
+  cargoHash = "sha256-7XcpJngFzWvVdmYWLf3jYLVG/rgXaetP1w4vAt6INDQ=";

  env = {
    RUSTFLAGS = "-C strip=symbols";
--- a/pkgs/by-name/mo/moonraker/package.nix
+++ b/pkgs/by-name/mo/moonraker/package.nix
@@ -35,13 +35,13 @@ let
 in
 stdenvNoCC.mkDerivation rec {
  pname = "moonraker";
-  version = "0.9.3-unstable-2025-05-22";
+  version = "0.9.3-unstable-2025-06-12";

  src = fetchFromGitHub {
    owner = "Arksine";
    repo = "moonraker";
-    rev = "0310d0be9fd207c510554ff64ca418cf4bcdaf9f";
-    sha256 = "sha256-tTCMNn1UmEeeBEGm8Sw0TrlNcVYHLjw57HH0LIA2y8k=";
+    rev = "ccbfd6498941cb4d8b49d192c8dd34feacfbe84a";
+    sha256 = "sha256-SCexS9dRbdwNSy5bTrGaEfP9EmkO3c/IL2+OIG7/K24=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/by-name/ni/niri/package.nix
+++ b/pkgs/by-name/ni/niri/package.nix
@@ -110,6 +110,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
        "-Wl,--pop-state"
      ]
    );
+
+    # Upstream recommends setting the commit hash manually when in a
+    # build environment where the Git repository is unavailable.
+    # See https://github.com/YaLTeR/niri/wiki/Packaging-niri#version-string
+    NIRI_BUILD_COMMIT = "Nixpkgs";
  };

  nativeInstallCheckInputs = [ versionCheckHook ];
--- a/pkgs/by-name/no/nomad-driver-podman/package.nix
+++ b/pkgs/by-name/no/nomad-driver-podman/package.nix
@@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "nomad-driver-podman";
-  version = "0.6.2";
+  version = "0.6.3";

  src = fetchFromGitHub {
    owner = "hashicorp";
    repo = "nomad-driver-podman";
    rev = "v${version}";
-    sha256 = "sha256-QvIc0RNQX9do6pTyGbJTTR7jANp50DVlHsl/8teiCnY=";
+    sha256 = "sha256-foGbOIR1pdimMKVVrnvffNfqcWDwomenxtE696I1KwE=";
  };

-  vendorHash = "sha256-9uXpcF/b2iR3xwVQ6XwJ9USuVqzYND4nuGMjMmEIbVs=";
+  vendorHash = "sha256-nQTxadv2EBf4U0dXQXXAetqk9SzB8s+WyU9nRD+I438=";

  subPackages = [ "." ];

--- a/pkgs/by-name/no/nova/package.nix
+++ b/pkgs/by-name/no/nova/package.nix
@@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "nova";
-  version = "3.11.2";
+  version = "3.11.4";

  src = fetchFromGitHub {
    owner = "FairwindsOps";
    repo = "nova";
    rev = "v${version}";
-    hash = "sha256-7GAA5Kc5ximdf71Bd8Q5o2pXixLOobXykKxfI31j/4A=";
+    hash = "sha256-0jDmuZqq3NNTekmu6saUjCuc0G0tj10hV0tRjwkYQg4=";
  };

-  vendorHash = "sha256-tWUE3OUpacxRpShbJQtFbHhjEDt4ULL1wc4vfX4DJ2c=";
+  vendorHash = "sha256-qXYhj3vVS6MoU4JPEDIxDZNDM2j/4Nxp6ZSlqUYVjMA=";

  ldflags = [
    "-X main.version=${version}"
--- a/pkgs/by-name/nu/nufmt/package.nix
+++ b/pkgs/by-name/nu/nufmt/package.nix
@@ -1,19 +1,19 @@
 {
  lib,
  fetchFromGitHub,
-  rustPlatform,
  nix-update-script,
+  rustPlatform,
+  stdenv,
 }:
-
 rustPlatform.buildRustPackage {
  pname = "nufmt";
-  version = "0-unstable-2025-04-28";
+  version = "0-unstable-2025-05-23";

  src = fetchFromGitHub {
    owner = "nushell";
    repo = "nufmt";
-    rev = "feafe695659c4d5153018a78fad949d088d8a480";
-    hash = "sha256-4FnZIlZWuvSAXMQbdyONNrgIuMxH5Vq3MFbb8J2CnHM=";
+    rev = "62fd38af2f6536bb19ecc78a4dd0f0e1245c0939";
+    hash = "sha256-JG8XCXEdjVERQ9f6ZsYCLXVGN85qPWCQhS2svJYW390=";
  };

  nativeBuildInputs = [
@@ -21,7 +21,14 @@ rustPlatform.buildRustPackage {
  ];

  useFetchCargoVendor = true;
-  cargoHash = "sha256-zS4g/uMh1eOoPo/RZfanL6afCEU5cnyzHrIqkvuQVrg=";
+  cargoHash = "sha256-KDXC2/1GcJL6qH+L/FzzQCA7kJigtKOfxVDLv5qXYao=";
+
+  # NOTE: Patch follows similar intention upstream https://github.com/nushell/nufmt/commit/62fd38af2f6536bb19ecc78a4dd0f0e1245c0939
+  postPatch = ''
+    substituteInPlace tests/main.rs --replace-fail \
+      'const TEST_BINARY: &str = "target/debug/nufmt";' \
+      'const TEST_BINARY: &str = "target/${stdenv.hostPlatform.rust.rustcTarget}/release/nufmt";'
+  '';

  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };

--- a/pkgs/by-name/nv/nvidia-modprobe/package.nix
+++ b/pkgs/by-name/nv/nvidia-modprobe/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation rec {
  pname = "nvidia-modprobe";
-  version = "575.57.08";
+  version = "575.64";

  src = fetchFromGitHub {
    owner = "NVIDIA";
    repo = "nvidia-modprobe";
    rev = version;
-    hash = "sha256-KpHhPFl+cNTQpld9LtI9yLidN9gj1zNz+jKfzF+n+sI=";
+    hash = "sha256-V0kD0Kk9PaIzQ9tGd9Tb16wwcvyCg4+1Sm+PwCC98Zs=";
  };

  nativeBuildInputs = [ gnum4 ];
--- a/pkgs/by-name/or/orbiton/package.nix
+++ b/pkgs/by-name/or/orbiton/package.nix
@@ -12,13 +12,13 @@

 buildGoModule rec {
  pname = "orbiton";
-  version = "2.69.0";
+  version = "2.70.0";

  src = fetchFromGitHub {
    owner = "xyproto";
    repo = "orbiton";
    tag = "v${version}";
-    hash = "sha256-0ba+IkiBQUsesq54S4Ngd9vTO5E7kqOQS61HidxE0jM=";
+    hash = "sha256-3EAYPCNVQiED8qHyLbwyYU7gXJn2TFgiJ2/JyxyD7+M=";
  };

  vendorHash = null;
--- a/pkgs/by-name/py/pyenv/package.nix
+++ b/pkgs/by-name/py/pyenv/package.nix
@@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "pyenv";
-  version = "2.6.1";
+  version = "2.6.3";

  src = fetchFromGitHub {
    owner = "pyenv";
    repo = "pyenv";
    tag = "v${version}";
-    hash = "sha256-Lv8bMFCj+aS3u/1el97O2Z8NnnSjrk1wpguEJIW2oDk=";
+    hash = "sha256-X4Gwjbgl7y/p/CEz1Z2wydP7ZBHD1i8lzmuYISVL/bo=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ri/rio/package.nix
+++ b/pkgs/by-name/ri/rio/package.nix
@@ -53,17 +53,17 @@ let
 in
 rustPlatform.buildRustPackage rec {
  pname = "rio";
-  version = "0.2.18";
+  version = "0.2.19";

  src = fetchFromGitHub {
    owner = "raphamorim";
    repo = "rio";
    rev = "v${version}";
-    hash = "sha256-VEiurf5y3BAQ2UCl0AKBL4fz36F8RH+GOpJwCZxSnMg=";
+    hash = "sha256-qEJrsA6MmLs26cnLo83QkKMUm6XMDk/h0UirUZ3/xGg=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-d7t6XbJs5D8QXyDfXfOqeP6ZhYobcyRADD2SAZX+YQA=";
+  cargoHash = "sha256-+bGP8JDzOtpqggg3kvtPZuT0KFG2VdB15+bRsahQ6SA=";

  nativeBuildInputs =
    [
--- a/pkgs/by-name/ro/roxterm/package.nix
+++ b/pkgs/by-name/ro/roxterm/package.nix
@@ -31,13 +31,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "roxterm";
-  version = "3.16.3";
+  version = "3.16.6";

  src = fetchFromGitHub {
    owner = "realh";
    repo = "roxterm";
    rev = finalAttrs.version;
-    hash = "sha256-aS15oFLJVsUDzBtisnHS9S92cZs4w8mqhwrpJJm+6lQ=";
+    hash = "sha256-T6xFExsgYGUVLgDS7sx5juoraMjzIYyfsXHvQUAm1fc=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/si/signal-desktop/package.nix
+++ b/pkgs/by-name/si/signal-desktop/package.nix
@@ -52,13 +52,13 @@ let
    '';
  });

-  version = "7.56.1";
+  version = "7.58.0";

  src = fetchFromGitHub {
    owner = "signalapp";
    repo = "Signal-Desktop";
    tag = "v${version}";
-    hash = "sha256-zPoZ76ujS8H4ls7RW4bojRIKOrPRJPjdHJVAl1cH9vY=";
+    hash = "sha256-0WO4cjbZLVaf/ju7PdfZJKOa7qGXsjWZHGY8lxOvr3w=";
  };

  sticker-creator = stdenv.mkDerivation (finalAttrs: {
@@ -120,15 +120,15 @@ stdenv.mkDerivation (finalAttrs: {
      ;
    hash =
      if withAppleEmojis then
-        "sha256-RP3d1t4bbvehdCDSL3bHrlJEnn65TDViI5jVjSiuJw8="
+        "sha256-h2yaGRqAtVh/8Jv+YZAcXw3/b8+fi+cKFSqcRhMH2sM="
      else
-        "sha256-KJvc+kVcwRKsUVW3lK7fPXUSqDQlJFPbYAzQjhFtfoU=";
+        "sha256-1dkJBIQVJxpsd8IQIlRncDYHp+2j0fowlbEEWpQSPtI=";
  };

  env = {
    ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
    SIGNAL_ENV = "production";
-    SOURCE_DATE_EPOCH = 1749072888;
+    SOURCE_DATE_EPOCH = 1750276003;
  };

  preBuild = ''
--- a/pkgs/by-name/si/signal-desktop/ringrtc.nix
+++ b/pkgs/by-name/si/signal-desktop/ringrtc.nix
@@ -19,16 +19,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "ringrtc";
-  version = "2.52.0";
+  version = "2.53.0";

  src = fetchFromGitHub {
    owner = "signalapp";
    repo = "ringrtc";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Ao1mFJYPnV3lfg4SERwq4dGnBhOVI9pwsqPAsUtV/iY=";
+    hash = "sha256-JxEeE5r/qQGfTBP0szpChRdPuUl4PMK1km84N/8Dozg=";
  };
  useFetchCargoVendor = true;
-  cargoHash = "sha256-mO9t4ZDDM5Y9cMkmdrYrdGYukN1xfGogPSNq+S1t4Us=";
+  cargoHash = "sha256-qOBjSj1MErB0SajScicVPEn2pqAY+kWq7TS4Wiu4oxI=";

  cargoBuildFlags = [
    "-p"
--- a/pkgs/by-name/si/signal-desktop/webrtc-sources.json
+++ b/pkgs/by-name/si/signal-desktop/webrtc-sources.json
@@ -1,33 +1,33 @@
 {
    "src": {
        "args": {
-            "hash": "sha256-AFMJmIo7O4fYrVWABciQphTxHQSj4CdfhluIIPpPWAw=",
+            "hash": "sha256-laPkmf87ujO0dmQ6LqGSnvajeE2D0i5hL95RxN+SdNA=",
            "owner": "signalapp",
            "repo": "webrtc",
-            "tag": "6998c"
+            "tag": "7103d"
        },
        "fetcher": "fetchFromGitHub"
    },
    "src/base": {
        "args": {
-            "hash": "sha256-hglQbmk4pfkzhHPXPGPrjN60VfpEbCn3mbOkM1kcjhE=",
-            "rev": "e0914b7606a151a3a12e994c400519f2e291c53f",
+            "hash": "sha256-Jm+OJlnJJUrTtsAMWEB+DM7eLZyIMJa5jQysVsyHwfk=",
+            "rev": "1d80e43078965dbe6ded5521fbffb128f59124a6",
            "url": "https://chromium.googlesource.com/chromium/src/base"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/build": {
        "args": {
-            "hash": "sha256-f7sLdyVzuWsVMsH21tLBDPadEJPyzSWhk8f97P7Meko=",
-            "rev": "64e296c42a93fbd27acc9a94713e4289273409b2",
+            "hash": "sha256-4iM0mh+1AL1maBjle+GOmfr4AMadQpcNDQg0X5tVD5U=",
+            "rev": "52d62707eaec02b88722a99e335315d166ceda77",
            "url": "https://chromium.googlesource.com/chromium/src/build"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/buildtools": {
        "args": {
-            "hash": "sha256-w6CVjFp5hkRHscXF7qUJ/Ei9Nl7lqBcGnwHXmjrehHw=",
-            "rev": "a660247d3c14a172b74b8e832ba1066b30183c97",
+            "hash": "sha256-Nbaoin+aMtJJaC4mDTYFB7q3RbmzSuEUDDZN3tAXoSI=",
+            "rev": "6f359296daa889aa726f3d05046b9f37be241169",
            "url": "https://chromium.googlesource.com/chromium/src/buildtools"
        },
        "fetcher": "fetchFromGitiles"
@@ -43,40 +43,40 @@
    },
    "src/testing": {
        "args": {
-            "hash": "sha256-VQJ0hqEI2QIFPKZwLCAtUtKuPkJndvndtK4lGRiX20M=",
-            "rev": "63412fdcdfe281e6b9531a5e1086a59c0b9e6909",
+            "hash": "sha256-CZOMatu2JSB3fztVz8DvW87KtglBqq0hUYm3IM3pZwY=",
+            "rev": "f46b86c7f1fc7a7f52e61c11dbd0573a48cf7a6a",
            "url": "https://chromium.googlesource.com/chromium/src/testing"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party": {
        "args": {
-            "hash": "sha256-88mIRDQvFeCcwiLPt4cyFE/xfmEJ95xB93uUcRPe670=",
-            "rev": "d212a71416ad7c6ceca04d6d27dfdd84fd00c04c",
+            "hash": "sha256-BbFD3QSoHMHsy4d+Quz01Nta7nArhe8or9zsARmlc/U=",
+            "rev": "10064104c1f11074312018c3a9c4b66f25584bdd",
            "url": "https://chromium.googlesource.com/chromium/src/third_party"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/boringssl/src": {
        "args": {
-            "hash": "sha256-Mrv/aV7RjDLPVi0QN7p1qJ3M8zHWogcq+u2F+S1LoNE=",
-            "rev": "d4b6eb542d4fd109baacd550935efd00c521e674",
+            "hash": "sha256-fUPl9E2b7RfanH0pZNArIkJ4lnnmCtyk7sCaTArCB70=",
+            "rev": "a9993612faac4866bc33ca8ff37bfd0659af1c48",
            "url": "https://boringssl.googlesource.com/boringssl.git"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/breakpad/breakpad": {
        "args": {
-            "hash": "sha256-jOTRgF2WxsX5P0LgUI9zdCc0+NcqSnO310aq15msThY=",
-            "rev": "0dfd77492fdb0dcd06027c5842095e2e908adc90",
+            "hash": "sha256-9MePkv10fwyJ0VDWRtvRcbLMAcJzZlziGTPzXJYjVJE=",
+            "rev": "657a441e5c1a818d4c10b7bafd431454e6614901",
            "url": "https://chromium.googlesource.com/breakpad/breakpad.git"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/catapult": {
        "args": {
-            "hash": "sha256-XtQclu96NHJxt8kJCyp8iaJUkTI2bS+q6NRwvIgmhX8=",
-            "rev": "b15611f18b506cf9dbc03e9bf87dbc8df549ccce",
+            "hash": "sha256-xwR9gGE8uU8qFr7GgS3/1JiuTmj1tvcM5CoCfPMdW2M=",
+            "rev": "5bda0fdab9d93ec9963e2cd858c7b49ad7fec7d4",
            "url": "https://chromium.googlesource.com/catapult.git"
        },
        "fetcher": "fetchFromGitiles"
@@ -115,24 +115,24 @@
    },
    "src/third_party/dav1d/libdav1d": {
        "args": {
-            "hash": "sha256-Ft71Ubirlpi7IJcNDFIfyZqmR2Xxv68PiEOfg7JhLuU=",
-            "rev": "edb16889d16f5e13161b6e8f7a839cd82d7d655d",
+            "hash": "sha256-+DY4p41VuAlx7NvOfXjWzgEhvtpebjkjbFwSYOzSjv4=",
+            "rev": "8d956180934f16244bdb58b39175824775125e55",
            "url": "https://chromium.googlesource.com/external/github.com/videolan/dav1d.git"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/depot_tools": {
        "args": {
-            "hash": "sha256-Qea35ZMbVtvdFPmge0ShrEW0p17Z1UJUGdBTaxaZ5gQ=",
-            "rev": "80d1969422e75e8e9eecafa46074074b289e2568",
+            "hash": "sha256-O9vVbrCqHD4w39Q8ZAxl1RwzJxbH/thjqacMtCnOPdg=",
+            "rev": "f40ddcd8d51626fb7be3ab3c418b3f3be801623f",
            "url": "https://chromium.googlesource.com/chromium/tools/depot_tools.git"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/ffmpeg": {
        "args": {
-            "hash": "sha256-OXumpRb9XB38dOCJmL3jDcabiJ08wAvydVlJwMgpCoQ=",
-            "rev": "d10a0f8bf5ddcce572df95105152bc74041cae0c",
+            "hash": "sha256-bGa0BCvzNxEKu9VZEwJ1NLt+b2KKWUxshpKSN2FHNEM=",
+            "rev": "fbce2a76c00cd2e5aeffe3c2e71d44c284ec52d6",
            "url": "https://chromium.googlesource.com/chromium/third_party/ffmpeg.git"
        },
        "fetcher": "fetchFromGitiles"
@@ -155,16 +155,16 @@
    },
    "src/third_party/freetype/src": {
        "args": {
-            "hash": "sha256-wKzsJ5SXicsLXs0M2+usPz72gy8IsmQGTD3RGKYnhgo=",
-            "rev": "a059b237bb01eb3e4f9f8b1618dda8c117498bab",
+            "hash": "sha256-LhSIX7X0+dmLADYGNclg73kIrXmjTMM++tJ92MKzanA=",
+            "rev": "82090e67c24259c343c83fd9cefe6ff0be7a7eca",
            "url": "https://chromium.googlesource.com/chromium/src/third_party/freetype2.git"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/fuzztest/src": {
        "args": {
-            "hash": "sha256-KjO8h5KS7/3vP8zRY2I09nIA/eJHKnmBuY8i8KU81KQ=",
-            "rev": "00edfa0dd94d7e00a89684e950015c30d3b7ae07",
+            "hash": "sha256-1pzRK+iorGhnLWWpuWdRjBCh0whKoDgEUhTTs2NlPZU=",
+            "rev": "3c7bc855a4938c5d0d1d07303aa0697c88d33e6c",
            "url": "https://chromium.googlesource.com/external/github.com/google/fuzztest.git"
        },
        "fetcher": "fetchFromGitiles"
@@ -179,16 +179,16 @@
    },
    "src/third_party/googletest/src": {
        "args": {
-            "hash": "sha256-9hPtc5kLEaetJXqtcneXFOcC2z5AdkvWGYgKMSB+vbs=",
-            "rev": "2b6b042a77446ff322cd7522ca068d9f2a21c1d1",
+            "hash": "sha256-8keF4E6ag/rikv5ROaWUB7oganjViupEAdxW1NJVgmE=",
+            "rev": "52204f78f94d7512df1f0f3bea1d47437a2c3a58",
            "url": "https://chromium.googlesource.com/external/github.com/google/googletest.git"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/grpc/src": {
        "args": {
-            "hash": "sha256-RKGZWtH2JmP2mXN+4ln/nCJvOyzynrYcfrxSY8k1vVg=",
-            "rev": "a363b6c001139b9c8ffb7cd63f60a72f15349c3b",
+            "hash": "sha256-0ljptpIh4wirWZ+utJyiy4g4dhPRB8pIvjcvoqeycu0=",
+            "rev": "d8ce421830bd993885038934abdc74e1e56e3213",
            "url": "https://chromium.googlesource.com/external/github.com/grpc/grpc.git"
        },
        "fetcher": "fetchFromGitiles"
@@ -203,24 +203,24 @@
    },
    "src/third_party/harfbuzz-ng/src": {
        "args": {
-            "hash": "sha256-TStJvz3Txn4cvU1tCPPZn6RLslvM+VNUqt8l8g67JN4=",
-            "rev": "1c249be96e27eafd15eb86d832b67fbc3751634b",
+            "hash": "sha256-/WNGrvyvJ+FGqoIoHapaux1iu63zjID0yR30HYPpxaw=",
+            "rev": "8efd2d85c78fbba6ca09a3e454f77525f3b296ce",
            "url": "https://chromium.googlesource.com/external/github.com/harfbuzz/harfbuzz.git"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/icu": {
        "args": {
-            "hash": "sha256-O9qrAt8lwNBg5LCVz+SfTe48uJx8onVYwn0LRXIhUvY=",
-            "rev": "bbccc2f6efc1b825de5f2c903c48be685cd0cf22",
+            "hash": "sha256-Omv4sp9z44eINXtaE0+1TzIU1q2hWviANA79fmkF78U=",
+            "rev": "c9fb4b3a6fb54aa8c20a03bbcaa0a4a985ffd34b",
            "url": "https://chromium.googlesource.com/chromium/deps/icu.git"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/instrumented_libs": {
        "args": {
-            "hash": "sha256-7w5wMcmPcKLS91buxyRdcgaQjbKGFdmrKClvYVO3iko=",
-            "rev": "3cc43119a29158bcde39d288a8def4b8ec49baf8",
+            "hash": "sha256-8kokdsnn5jD9KgM/6g0NuITBbKkGXWEM4BMr1nCrfdU=",
+            "rev": "69015643b3f68dbd438c010439c59adc52cac808",
            "url": "https://chromium.googlesource.com/chromium/third_party/instrumented_libraries.git"
        },
        "fetcher": "fetchFromGitiles"
@@ -243,32 +243,32 @@
    },
    "src/third_party/libaom/source/libaom": {
        "args": {
-            "hash": "sha256-oceORERaQDEQkssZwiWGOtAsbuI0YeOciwb9FgtFuHw=",
-            "rev": "d737ca3ebe92feec465876a8fc98950cecd08fd8",
+            "hash": "sha256-nfnt5JXyKR9JR3BflpGEkwzDo0lYa/oeCDm2bKH/j1g=",
+            "rev": "9680f2b1781fb33b9eeb52409b75c679c8a954be",
            "url": "https://aomedia.googlesource.com/aom.git"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/libc++/src": {
        "args": {
-            "hash": "sha256-QxEbtsEKCs2Xgulq7nVWtAeOGkIYFOy/L1ROfXa5u8U=",
-            "rev": "2e25154d49c29fa9aa42c30ad4a027bd30123434",
+            "hash": "sha256-Ypi5fmWdoNA1IZDoKITlkNRITmho8HzVlgjlmtx0Y84=",
+            "rev": "449310fe2e37834a7e62972d2a690cade2ef596b",
            "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx.git"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/libc++abi/src": {
        "args": {
-            "hash": "sha256-RIPejJnlQE5S8ss3WijR4uLVC+yRL9Ba0vslQeJFNiE=",
-            "rev": "8205ccf0f23545ebcd8846363ea1d29e77917a22",
+            "hash": "sha256-wMMfj3E2AQJxovoSEIuT2uTyrcGBurS1HrHZOmP36+g=",
+            "rev": "94c5d7a8edc09f0680aee57548c0b5d400c2840d",
            "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi.git"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/libjpeg_turbo": {
        "args": {
-            "hash": "sha256-qgHXAjCDFxQ+QqJ8pSmI1NUvHvKKTi4MkIe1I/+hUAI=",
-            "rev": "927aabfcd26897abb9776ecf2a6c38ea5bb52ab6",
+            "hash": "sha256-Ig+tmprZDvlf/M72/DTar2pbxat9ZElgSqdXdoM0lPs=",
+            "rev": "e14cbfaa85529d47f9f55b0f104a579c1061f9ad",
            "url": "https://chromium.googlesource.com/chromium/deps/libjpeg_turbo.git"
        },
        "fetcher": "fetchFromGitiles"
@@ -283,88 +283,88 @@
    },
    "src/third_party/libunwind/src": {
        "args": {
-            "hash": "sha256-JazjgI+ch9RgnsDgu6p4cT4UmCBor4x4sRi1ClLISAY=",
-            "rev": "e55d8cf51c6db1fdd4bb56c158945ec59772c8ee",
+            "hash": "sha256-LdRaxPo2i7uMeFxpR7R4o3V+1ycBcygT/D+gklsD0tA=",
+            "rev": "e2e6f2a67e9420e770b014ce9bba476fa2ab9874",
            "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind.git"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/libvpx/source/libvpx": {
        "args": {
-            "hash": "sha256-8/Ttkc1ZLQ9WvQf+0/BW9zlmWvlyGDujELyLDqNmQxI=",
-            "rev": "7a65480684b1b28bb9defae164bf0dc78b32653e",
+            "hash": "sha256-+4I6B1aTa+txhey6LMeflU0pe39V6TJ+lNIJPh6yFGM=",
+            "rev": "027bbee30a0103b99d86327b48d29567fed11688",
            "url": "https://chromium.googlesource.com/webm/libvpx.git"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/libyuv": {
        "args": {
-            "hash": "sha256-hHwJLMI/leUm8RjkBsSQn/GaNU8Aan1yllGnXvdfG78=",
-            "rev": "10592b60c0b2c33210b7752454253dc2625b4305",
+            "hash": "sha256-8sH11psWPXLMy3Q0tAizCZ/woUWvTCCUf44jcr2C4Xs=",
+            "rev": "ccdf870348764e4b77fa3b56accb2a896a901bad",
            "url": "https://chromium.googlesource.com/libyuv/libyuv.git"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/llvm-libc/src": {
        "args": {
-            "hash": "sha256-OtNt+IRn2AFRTKvrA+c9AD+mbfBD37K2S9PXk3UI99A=",
-            "rev": "12809bfa855813dcef51871e2ee3155e53ed35ea",
+            "hash": "sha256-sV1wqk8BC7cl7HPgAd+kmxOWpBuWT6kTX91IXIoSYts=",
+            "rev": "188329a7f2118a957efbb3e6219c255e7dba997c",
            "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libc.git"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/lss": {
        "args": {
-            "hash": "sha256-hE8uZf9Fst66qJkoVYChiB8G41ie+k9M4X0W+5JUSdw=",
-            "rev": "ce877209e11aa69dcfffbd53ef90ea1d07136521",
+            "hash": "sha256-rhp4EcZYdgSfu9cqn+zxxGx6v2IW8uX8V+iA0UfZhFY=",
+            "rev": "ed31caa60f20a4f6569883b2d752ef7522de51e0",
            "url": "https://chromium.googlesource.com/linux-syscall-support.git"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/nasm": {
        "args": {
-            "hash": "sha256-SiRXHsUlWXtH6dbDjDjqNAm105ibEB3jOfNtQAM4CaY=",
-            "rev": "f477acb1049f5e043904b87b825c5915084a9a29",
+            "hash": "sha256-yg4qwhS68B/sWfcJeXUqPC69ppE8FaIyRc+IkUQXSnU=",
+            "rev": "767a169c8811b090df222a458b25dfa137fc637e",
            "url": "https://chromium.googlesource.com/chromium/deps/nasm.git"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/openh264/src": {
        "args": {
-            "hash": "sha256-S7dS2IZwt4p4ZrF6K7E5HnwKuI3owU2I7vwtu95uTkE=",
-            "rev": "478e5ab3eca30e600006d5a0a08b176fd34d3bd1",
+            "hash": "sha256-tf0lnxATCkoq+xRti6gK6J47HwioAYWnpEsLGSA5Xdg=",
+            "rev": "652bdb7719f30b52b08e506645a7322ff1b2cc6f",
            "url": "https://chromium.googlesource.com/external/github.com/cisco/openh264"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/perfetto": {
        "args": {
-            "hash": "sha256-ogrB+n5F4UnmL3nHJRyMFOLYVUvjirT9BClg20mTZkc=",
-            "rev": "a0c2bc7919f7467cf4a8287c8389c3f96a3fcbac",
+            "hash": "sha256-peD4Vnar1Uf8S/JYPpHH8dJZCDIpzpE4EYDfTqVyG8U=",
+            "rev": "40b529923598b739b2892a536a7692eedbed5685",
            "url": "https://android.googlesource.com/platform/external/perfetto.git"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/protobuf-javascript/src": {
        "args": {
-            "hash": "sha256-TmP6xftUVTD7yML7UEM/DB8bcsL5RFlKPyCpcboD86U=",
-            "rev": "e34549db516f8712f678fcd4bc411613b5cc5295",
+            "hash": "sha256-zq86SrDASl6aYPFPijRZp03hJqXUFz2Al/KkiNq7i0M=",
+            "rev": "eb785a9363664a402b6336dfe96aad27fb33ffa8",
            "url": "https://chromium.googlesource.com/external/github.com/protocolbuffers/protobuf-javascript"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/third_party/re2/src": {
        "args": {
-            "hash": "sha256-IeANwJlJl45yf8iu/AZNDoiyIvTCZIeK1b74sdCfAIc=",
-            "rev": "6dcd83d60f7944926bfd308cc13979fc53dd69ca",
+            "hash": "sha256-f/k2rloV2Nwb0KuJGUX4SijFxAx69EXcsXOG4vo+Kis=",
+            "rev": "c84a140c93352cdabbfb547c531be34515b12228",
            "url": "https://chromium.googlesource.com/external/github.com/google/re2.git"
        },
        "fetcher": "fetchFromGitiles"
    },
    "src/tools": {
        "args": {
-            "hash": "sha256-C3bzAAJp8OpKAHhM54P/sTBVFf3K6ffxvrpfKKxLRII=",
-            "rev": "6820cc03cc8a4b1fb99747f30e8249d138a70981",
+            "hash": "sha256-Vmhd5kfPaOyPJaDSg67V64FSgi4maEVjXE4PMnxnIFw=",
+            "rev": "3460fbcdee33353d37800dad5caa6bba327ad8c8",
            "url": "https://chromium.googlesource.com/chromium/src/tools"
        },
        "fetcher": "fetchFromGitiles"
--- a/pkgs/by-name/si/signal-desktop/webrtc.nix
+++ b/pkgs/by-name/si/signal-desktop/webrtc.nix
@@ -10,6 +10,7 @@
  pulseaudio,
  writeShellScriptBin,
  gclient2nix,
+  rustc,
 }:

 stdenv.mkDerivation (finalAttrs: {
@@ -26,6 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
      exec python3 "$@"
    '')
    python3
+    rustc
    pkg-config
    gclient2nix.gclientUnpackHook
  ];
@@ -70,6 +72,8 @@ stdenv.mkDerivation (finalAttrs: {
    "symbol_level=1"
    "rtc_include_tests=false"
    "rtc_enable_protobuf=false"
+
+    ''rust_sysroot_absolute="${rustc}"''
  ];
  ninjaFlags = [ "webrtc" ];

--- a/pkgs/by-name/si/signalbackup-tools/package.nix
+++ b/pkgs/by-name/si/signalbackup-tools/package.nix
@@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "signalbackup-tools";
-  version = "20250606";
+  version = "20250617";

  src = fetchFromGitHub {
    owner = "bepaald";
    repo = "signalbackup-tools";
    rev = version;
-    hash = "sha256-UGSto0RbC+ZTXgcT+F5UEmRYg79jGyYJaWA4m5ulB+Y=";
+    hash = "sha256-sX/JM8d0kex09OT8n4IF26+bSPwvTjarqoiRTknA2Og=";
  };

  nativeBuildInputs =
--- a/pkgs/by-name/sl/slipshow/package.nix
+++ b/pkgs/by-name/sl/slipshow/package.nix
@@ -0,0 +1,62 @@
+{
+  lib,
+  ocamlPackages,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+ocamlPackages.buildDunePackage rec {
+  pname = "slipshow";
+  version = "0.2.0";
+
+  src = fetchFromGitHub {
+    owner = "panglesd";
+    repo = "slipshow";
+    tag = "v${version}";
+    hash = "sha256-1gjQDkjDxanshvn1fNxwpJFt12uRWnkmRbs0tWdTgtM=";
+  };
+
+  postPatch = ''
+    substituteInPlace ./src/cli/main.ml \
+      --replace-fail '%%VERSION%%' '${version}'
+  '';
+
+  nativeBuildInputs = with ocamlPackages; [
+    js_of_ocaml
+  ];
+
+  buildInputs = with ocamlPackages; [
+    base64
+    bos
+    cmdliner
+    dream
+    fmt
+    fpath
+    irmin-watcher
+    js_of_ocaml-lwt
+    logs
+    lwt
+    magic-mime
+    ppx_blob
+    ppx_sexp_value
+    sexplib
+  ];
+
+  doCheck = true;
+
+  nativeCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Engine for displaying slips, the next-gen version of slides";
+    homepage = "https://slipshow.readthedocs.io/en/latest/index.html";
+    downloadPage = "https://github.com/panglesd/slipshow";
+    maintainers = [ lib.maintainers.ethancedwards8 ];
+    teams = [ lib.teams.ngi ];
+    mainProgram = "slipshow";
+  };
+}
--- a/pkgs/by-name/so/soteria/package.nix
+++ b/pkgs/by-name/so/soteria/package.nix
@@ -12,7 +12,7 @@
  polkit,
 }:
 let
-  version = "0.1.2";
+  version = "0.1.4";
 in
 rustPlatform.buildRustPackage {
  pname = "soteria";
@@ -22,11 +22,11 @@ rustPlatform.buildRustPackage {
    owner = "imvaskel";
    repo = "soteria";
    tag = "v${version}";
-    hash = "sha256-i7g2my0hP54Tj86UVEEFQIb5ih26djKgLg++I1n9Sfs=";
+    hash = "sha256-Dpu0GBpa3W2itIjCiqA4Yh4he0ZfLDSr26DYSfhMphI=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-Z9ycfFhnff0z2ZG+tqf+qGUL7gDJQ+kC+e+WZ21qN1Y=";
+  cargoHash = "sha256-RXPzmco+pLkLxY+jicafuqdul9LpkDv6YK8+bHCS+5s=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/st/stats/package.nix
+++ b/pkgs/by-name/st/stats/package.nix
@@ -8,11 +8,11 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "stats";
-  version = "2.11.41";
+  version = "2.11.45";

  src = fetchurl {
    url = "https://github.com/exelban/stats/releases/download/v${finalAttrs.version}/Stats.dmg";
-    hash = "sha256-iW22uCyfx9sCX3GyVmYzyJIHylxIpgJLns2oHVFBwc4=";
+    hash = "sha256-OdZ8LCU0kCCKk4SeyDryDpyCUsjf8aUZAv2o/cR4GX8=";
  };

  sourceRoot = ".";
--- a/pkgs/by-name/sw/swiftformat/package.nix
+++ b/pkgs/by-name/sw/swiftformat/package.nix
@@ -12,13 +12,13 @@

 swift.stdenv.mkDerivation rec {
  pname = "swiftformat";
-  version = "0.56.3";
+  version = "0.56.4";

  src = fetchFromGitHub {
    owner = "nicklockwood";
    repo = "SwiftFormat";
    rev = version;
-    sha256 = "sha256-ZPz/AAAs8L0Zn4jWbbCz2y0dVE8Ap1U16rVpxwQYUPI=";
+    sha256 = "sha256-WnBQTpbz9tcnbvmtWpZ9esirWdQKJOpVmH8zk97OuFE=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/te/terragrunt/package.nix
+++ b/pkgs/by-name/te/terragrunt/package.nix
@@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "terragrunt";
-  version = "0.81.7";
+  version = "0.81.8";

  src = fetchFromGitHub {
    owner = "gruntwork-io";
    repo = "terragrunt";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-/rpZK3uVd+EAP+lD2PohLRIFJY9GI9d32MNjJUo8hos=";
+    hash = "sha256-+f6rHS1ljj59wmR3NJwviJEBqeS6VzoMPfal4MuoyUE=";
  };

  nativeBuildInputs = [
@@ -26,7 +26,7 @@ buildGoModule (finalAttrs: {
    make generate-mocks
  '';

-  vendorHash = "sha256-P9EHKvtZwFr6go8IdA8B2SYCfDhaGCADZLVZ46SFQEI=";
+  vendorHash = "sha256-A8P0wJ/EUTnAeCIFfAECTBQmSaOcED6SDbeRnnTlcJ8=";

  doCheck = false;

--- a/pkgs/by-name/tt/ttyplot/package.nix
+++ b/pkgs/by-name/tt/ttyplot/package.nix
@@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "ttyplot";
-  version = "1.7.1";
+  version = "1.7.2";

  src = fetchFromGitHub {
    owner = "tenox7";
    repo = "ttyplot";
    rev = version;
-    hash = "sha256-XPWfSL1395TBkUmAO5kB9TdAZHL011o6t/2s01W/kk8=";
+    hash = "sha256-zTbcl8hM/XYdkV8V/BCQ94fuFXWOMGdQZeowKRhvYNo=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/xk/xk6/package.nix
+++ b/pkgs/by-name/xk/xk6/package.nix
@@ -9,13 +9,13 @@

 buildGoModule rec {
  pname = "xk6";
-  version = "0.20.1";
+  version = "1.0.0";

  src = fetchFromGitHub {
    owner = "grafana";
    repo = "xk6";
    tag = "v${version}";
-    hash = "sha256-RVuHGvoXQ9tAUEYTGK03Qjkgl3WCbFqbqt2rkPP6MYs=";
+    hash = "sha256-lSEMToo4Bjh9j2Z/wG64TIeHdJ/+HpYlEXyqIK9MJ/Y=";
  };

  vendorHash = null;
--- a/pkgs/by-name/ya/yamlfmt/package.nix
+++ b/pkgs/by-name/ya/yamlfmt/package.nix
@@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "yamlfmt";
-  version = "0.17.0";
+  version = "0.17.1";

  src = fetchFromGitHub {
    owner = "google";
    repo = "yamlfmt";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-G0tejPNlvtar8eR7wS8oK6//ATd9YkDlC7oa3OkzQ3c=";
+    hash = "sha256-ORVT70KXW/eatcQkDdpqb7LK6NbUr389zFDyYHy6Cxs=";
  };

  vendorHash = "sha256-Cy1eBvKkQ90twxjRL2bHTk1qNFLQ22uFrOgHKmnoUIQ=";
--- a/pkgs/by-name/zg/zgrviewer/package.nix
+++ b/pkgs/by-name/zg/zgrviewer/package.nix
@@ -6,27 +6,33 @@
  unzip,
  runtimeShell,
 }:
-stdenv.mkDerivation rec {
-  version = "0.9.0";
+
+stdenv.mkDerivation (finalAttrs: {
  pname = "zgrviewer";
+  version = "0.10.0";
+
  src = fetchurl {
-    url = "mirror://sourceforge/zvtm/${pname}/${version}/${pname}-${version}.zip";
-    sha256 = "1yg2rck81sqqrgfi5kn6c1bz42dr7d0zqpcsdjhicssi1y159f23";
+    url = "mirror://sourceforge/zvtm/zgrviewer/${finalAttrs.version}/zgrviewer-${finalAttrs.version}.zip";
+    hash = "sha256-0CrioPNtpUa8uCZOXpe2q/QOo90kYO7mC2s9x3ymP7I=";
  };
+
  nativeBuildInputs = [ unzip ];
+
  buildInputs = [ jre ];
-  buildPhase = "";
+
  installPhase = ''
+    runHook preInstall
+
    mkdir -p "$out"/{bin,share/java/zvtm/plugins,share/doc/zvtm}
-
-    cp overview.html *.license.* "$out/share/doc/zvtm"
-
+    cp *.license.* "$out/share/doc/zvtm"
    cp -r target/* "$out/share/java/zvtm/"
-
    echo '#!${runtimeShell}' > "$out/bin/zgrviewer"
-    echo "${jre}/bin/java -jar '$out/share/java/zvtm/zgrviewer-${version}.jar' \"\$@\"" >> "$out/bin/zgrviewer"
+    echo "${lib.getExe jre} -jar '$out/share/java/zvtm/zgrviewer-${finalAttrs.version}.jar' \"\$@\"" >> "$out/bin/zgrviewer"
    chmod a+x "$out/bin/zgrviewer"
+
+    runHook postInstall
  '';
+
  meta = {
    # Quicker to unpack locally than load Hydra
    hydraPlatforms = [ ];
@@ -37,4 +43,4 @@ stdenv.mkDerivation rec {
    platforms = with lib.platforms; unix;
    mainProgram = "zgrviewer";
  };
-}
+})
--- a/pkgs/by-name/zs/zsh-powerlevel10k/package.nix
+++ b/pkgs/by-name/zs/zsh-powerlevel10k/package.nix
@@ -7,19 +7,20 @@
  bash,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "powerlevel10k";
-  version = "1.20.14";
+  version = "1.20.15";

  src = fetchFromGitHub {
    owner = "romkatv";
    repo = "powerlevel10k";
    # upstream doesn't seem to use tags anymore
-    rev = "5e26473457d819fe148f7fff32db1082dae72012";
-    hash = "sha256-/+FEkgBR6EOTaCAc15vYGWNih2QZkN27ae6LMXlXZU4=";
+    rev = "36f3045d69d1ba402db09d09eb12b42eebe0fa3b";
+    hash = "sha256-BRJyGn+gTGUWifpJ1ziBKVHACcWw+R5N/HdUi8HzSvY=";
  };

  strictDeps = true;
+
  buildInputs = [ bash ];

  patches = [
@@ -29,15 +30,19 @@ stdenv.mkDerivation rec {
  ];

  installPhase = ''
+    runHook preInstall
+
    install -D powerlevel10k.zsh-theme --target-directory=$out/share/zsh-powerlevel10k
    install -D powerlevel9k.zsh-theme --target-directory=$out/share/zsh-powerlevel10k
    install -D config/* --target-directory=$out/share/zsh-powerlevel10k/config
    install -D internal/* --target-directory=$out/share/zsh-powerlevel10k/internal
    cp -R gitstatus $out/share/zsh-powerlevel10k/gitstatus
+
+    runHook postInstall
  '';

  meta = {
-    changelog = "https://github.com/romkatv/powerlevel10k/releases/tag/v${version}";
+    changelog = "https://github.com/romkatv/powerlevel10k/releases/tag/v${finalAttrs.version}";
    description = "Fast reimplementation of Powerlevel9k ZSH theme";
    longDescription = ''
      To make use of this derivation, use
@@ -48,4 +53,4 @@ stdenv.mkDerivation rec {
    platforms = lib.platforms.unix;
    maintainers = with lib.maintainers; [ ];
  };
-}
+})
--- a/pkgs/development/compilers/rust/binary.nix
+++ b/pkgs/development/compilers/rust/binary.nix
@@ -33,6 +33,7 @@ rec {
      homepage = "https://www.rust-lang.org/";
      sourceProvenance = with sourceTypes; [ binaryNativeCode ];
      description = "Safe, concurrent, practical language";
+      mainProgram = "rustc";
      maintainers = with maintainers; [ qknight ];
      license = [
        licenses.mit
--- a/pkgs/development/libraries/astal/modules/tray.nix
+++ b/pkgs/development/libraries/astal/modules/tray.nix
@@ -1,10 +1,13 @@
 {
  buildAstalModule,
  json-glib,
+  appmenu-glib-translator,
 }:
 buildAstalModule {
  name = "tray";
-  buildInputs = [ json-glib ];
+  buildInputs = [
+    json-glib
+    appmenu-glib-translator
+  ];
  meta.description = "Astal module for StatusNotifierItem";
-  meta.broken = true; # https://github.com/NixOS/nixpkgs/issues/337630
 }
--- a/pkgs/development/ocaml-modules/scfg/default.nix
+++ b/pkgs/development/ocaml-modules/scfg/default.nix
@@ -0,0 +1,57 @@
+{
+  lib,
+  buildDunePackage,
+  fetchzip,
+  bos,
+  cmdliner,
+  fmt,
+  fpath,
+  menhir,
+  menhirLib,
+  prelude,
+  sedlex,
+  writableTmpDirAsHomeHook,
+}:
+
+buildDunePackage rec {
+  pname = "scfg";
+  version = "0.5";
+
+  # upstream git repo is misconfigured and cannot be cloned
+  src = fetchzip {
+    url = "https://git.zapashcanon.fr/zapashcanon/scfg/archive/${version}.tar.gz";
+    hash = "sha256-XyNVmI0W0B1JqR+uuojpHe9L5KKLhyoH8vN8+9i7Xcg=";
+  };
+
+  nativeBuildInputs = [
+    menhir
+  ];
+
+  buildInputs = [
+    cmdliner
+  ];
+
+  propagatedBuildInputs = [
+    bos
+    fmt
+    fpath
+    menhirLib
+    prelude
+    sedlex
+  ];
+
+  checkInputs = [
+    writableTmpDirAsHomeHook
+  ];
+
+  doCheck = true;
+
+  meta = {
+    description = "Library to work with the scfg configuration file";
+    homepage = "https://ocaml.org/p/scfg/";
+    downloadPage = "https://git.zapashcanon.fr/zapashcanon/scfg";
+    changelog = "https://git.zapashcanon.fr/zapashcanon/scfg/src/tag/${version}/CHANGES.md";
+    license = lib.licenses.isc;
+    maintainers = [ lib.maintainers.ethancedwards8 ];
+  };
+}
--- a/pkgs/development/python-modules/babelfont/default.nix
+++ b/pkgs/development/python-modules/babelfont/default.nix
@@ -19,7 +19,7 @@

 buildPythonPackage rec {
  pname = "babelfont";
-  version = "3.1.2";
+  version = "3.1.3";
  pyproject = true;

  # PyPI source tarballs omit tests, fetch from Github instead
@@ -27,7 +27,7 @@ buildPythonPackage rec {
    owner = "simoncozens";
    repo = "babelfont";
    tag = "v${version}";
-    hash = "sha256-XNoyM3kjKRc0NWA94ufzC2DBzAsufJNJbzFDUbLu8Lc=";
+    hash = "sha256-wCJNJZqjMm0M00F9/kd/g97+DRdRPTn03Nk3rnh7me4=";
  };

  build-system = [
--- a/pkgs/development/python-modules/bdffont/default.nix
+++ b/pkgs/development/python-modules/bdffont/default.nix
@@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "bdffont";
-  version = "0.0.31";
+  version = "0.0.32";
  pyproject = true;

  disabled = pythonOlder "3.10";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "bdffont";
    inherit version;
-    hash = "sha256-jE6k1gym4UCHpQJTPEip+c5e+9QxNpT41v3fK9WVoLc=";
+    hash = "sha256-5O1AlidPMhp0ztzBi/eHJToFSKMcx+EuQHltt/w4goQ=";
  };

  build-system = [ hatchling ];
--- a/pkgs/development/python-modules/clarifai-grpc/default.nix
+++ b/pkgs/development/python-modules/clarifai-grpc/default.nix
@@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "clarifai-grpc";
-  version = "11.5.3";
+  version = "11.5.5";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "Clarifai";
    repo = "clarifai-python-grpc";
    tag = version;
-    hash = "sha256-XShgm9/i1YuQRdC2ToImjmeBYfFJL+sJOyPuZGSbC8E=";
+    hash = "sha256-ijfuZh35HpmR3p7n2S+cCpcO4ld52StQOpxgPJtRqM4=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/llm-openai-plugin/default.nix
+++ b/pkgs/development/python-modules/llm-openai-plugin/default.nix
@@ -15,14 +15,14 @@
 }:
 buildPythonPackage rec {
  pname = "llm-openai-plugin";
-  version = "0.4";
+  version = "0.5";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "simonw";
    repo = "llm-openai-plugin";
    tag = version;
-    hash = "sha256-UoUxCwR+qOUufHuS0gw6A5Q7sB77VO4HYuMjFGN7mhA=";
+    hash = "sha256-xlJS+xAKOo40hZH751yrvIuXZw1HQsB7K2anFoMxthU=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/meshtastic/default.nix
+++ b/pkgs/development/python-modules/meshtastic/default.nix
@@ -48,6 +48,7 @@ buildPythonPackage rec {

  pythonRelaxDeps = [
    "bleak"
+    "packaging"
    "protobuf"
  ];

--- a/pkgs/development/python-modules/molecule/default.nix
+++ b/pkgs/development/python-modules/molecule/default.nix
@@ -23,14 +23,14 @@

 buildPythonPackage rec {
  pname = "molecule";
-  version = "25.5.0";
+  version = "25.6.0";
  pyproject = true;

  disabled = pythonOlder "3.10";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-WF2M4K1JO+OulN4Jb4tKiWq5AQp+o2qGn99eKb1mj0s=";
+    hash = "sha256-DbII3li+zssMqHvyzEjhAXI04eOtlHwXlIdzf4hOfHw=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/niaarm/default.nix
+++ b/pkgs/development/python-modules/niaarm/default.nix
@@ -24,18 +24,19 @@
 buildPythonPackage rec {
  pname = "niaarm";
  # nixpkgs-update: no auto update
-  version = "0.4.1";
+  version = "0.4.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "firefly-cpp";
    repo = "NiaARM";
    tag = version;
-    hash = "sha256-/lEW6SUV+CRovYmLVWiolYDHYmMJSJHnYNo9+lBc9nY=";
+    hash = "sha256-WvVXL1a1DvgLF3upbGUi1+nH5aDBUNx5Bitlkb8lQkc=";
  };

  pythonRelaxDeps = [
    "numpy"
+    "plotly"
    "scikit-learn"
  ];

@@ -70,7 +71,7 @@ buildPythonPackage rec {
    description = "Minimalistic framework for Numerical Association Rule Mining";
    mainProgram = "niaarm";
    homepage = "https://github.com/firefly-cpp/NiaARM";
-    changelog = "https://github.com/firefly-cpp/NiaARM/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/firefly-cpp/NiaARM/releases/tag/${src.tag}";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ firefly-cpp ];
  };
--- a/pkgs/development/python-modules/onnxslim/default.nix
+++ b/pkgs/development/python-modules/onnxslim/default.nix
@@ -11,12 +11,12 @@

 buildPythonPackage rec {
  pname = "onnxslim";
-  version = "0.1.56";
+  version = "0.1.57";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-/c2id6XH0QQUdiISRlC8YDZNAm7E+8sEdfYfgv8J0Mw=";
+    hash = "sha256-VI1OaNMHuL2AhYxZ/n5zrwlqnfcCbjY39QXHX8gcdw8=";
  };

  build-system = [
--- a/pkgs/development/python-modules/python-gvm/default.nix
+++ b/pkgs/development/python-modules/python-gvm/default.nix
@@ -15,7 +15,7 @@

 buildPythonPackage rec {
  pname = "python-gvm";
-  version = "26.2.0";
+  version = "26.2.1";
  pyproject = true;

  disabled = pythonOlder "3.9";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
    owner = "greenbone";
    repo = "python-gvm";
    tag = "v${version}";
-    hash = "sha256-xWNOUgTanOVYjvoZZkQBrKYr0z+dn0/ur5jdO549FXw=";
+    hash = "sha256-rYUqWuAnbT5XAvUJx0D7y9I0w8z8/jhvwAFtxCL/iGw=";
  };

  build-system = [ poetry-core ];
--- a/pkgs/development/python-modules/python-matter-server/default.nix
+++ b/pkgs/development/python-modules/python-matter-server/default.nix
@@ -57,16 +57,16 @@ in

 buildPythonPackage rec {
  pname = "python-matter-server";
-  version = "7.0.1";
+  version = "8.0.0";
  pyproject = true;

-  disabled = pythonOlder "3.10";
+  disabled = pythonOlder "3.12";

  src = fetchFromGitHub {
    owner = "home-assistant-libs";
    repo = "python-matter-server";
-    rev = "refs/tags/${version}";
-    hash = "sha256-kwN7mLSKrxsAydp7PnN7kTvvi5zQSpXVwMh2slL6aIA=";
+    tag = version;
+    hash = "sha256-9dMcofwvGYBnI+9y7D+TDwz+uLgBVhcS4iVU7AUqclI=";
  };

  patches = [
@@ -77,7 +77,7 @@ buildPythonPackage rec {

  postPatch = ''
    substituteInPlace pyproject.toml \
-      --replace 'version = "0.0.0"' 'version = "${version}"'
+      --replace-fail 'version = "0.0.0"' 'version = "${version}"'
  '';

  build-system = [
@@ -124,12 +124,12 @@ buildPythonPackage rec {
    "tests/server/ota/test_dcl.py"
  ];

-  meta = with lib; {
-    changelog = "https://github.com/home-assistant-libs/python-matter-server/releases/tag/${version}";
+  meta = {
+    changelog = "https://github.com/home-assistant-libs/python-matter-server/releases/tag/${src.tag}";
    description = "Python server to interact with Matter";
    mainProgram = "matter-server";
    homepage = "https://github.com/home-assistant-libs/python-matter-server";
-    license = licenses.asl20;
-    teams = [ teams.home-assistant ];
+    license = lib.licenses.asl20;
+    teams = [ lib.teams.home-assistant ];
  };
 }
--- a/pkgs/development/python-modules/snowflake-sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/snowflake-sqlalchemy/default.nix
@@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "snowflake-sqlalchemy";
-  version = "1.7.3";
+  version = "1.7.4";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "snowflakedb";
    repo = "snowflake-sqlalchemy";
    tag = "v${version}";
-    hash = "sha256-E3UnlsGaQPlxHSgBVGrG8pGCA8fE7yN5x9eidbMQ10w=";
+    hash = "sha256-Twv8ugLrQT9y4wHNo0B8vkWOFNSci/t4eY9XvFlq/TE=";
  };

  build-system = [ hatchling ];
@@ -33,7 +33,7 @@ buildPythonPackage rec {

  meta = with lib; {
    description = "Snowflake SQLAlchemy Dialect";
-    changelog = "https://github.com/snowflakedb/snowflake-sqlalchemy/blob/v${version}/DESCRIPTION.md";
+    changelog = "https://github.com/snowflakedb/snowflake-sqlalchemy/blob/${src.tag}/DESCRIPTION.md";
    homepage = "https://github.com/snowflakedb/snowflake-sqlalchemy";
    license = licenses.asl20;
    maintainers = [ ];
--- a/pkgs/development/python-modules/textual-image/default.nix
+++ b/pkgs/development/python-modules/textual-image/default.nix
@@ -16,14 +16,14 @@

 buildPythonPackage rec {
  pname = "textual-image";
-  version = "0.8.2";
+  version = "0.8.3";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "lnqs";
    repo = "textual-image";
    tag = "v${version}";
-    hash = "sha256-ik/zvnxXN5u2jXHfsGsCLnymZZ+IQiixagOJdEMRDlw=";
+    hash = "sha256-XbQs3E2Zl6Jdq0QVSdF6LexnmEmlZEm9BmWZK+dyBjo=";
  };

  buildInputs = [ setuptools ];
--- a/pkgs/development/python-modules/types-requests/default.nix
+++ b/pkgs/development/python-modules/types-requests/default.nix
@@ -9,13 +9,13 @@

 buildPythonPackage rec {
  pname = "types-requests";
-  version = "2.32.0.20250328";
+  version = "2.32.4.20250611";
  pyproject = true;

  src = fetchPypi {
    pname = "types_requests";
    inherit version;
-    hash = "sha256-yeZyKOoQO9gRyWmE+sNu0q6NqHo2pjOWSiHxmdYLrzI=";
+    hash = "sha256-dByHd+1kJYML9R5U1qviRfebTcuQGfFiK3c0Y5Rr+CY=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/ufomerge/default.nix
+++ b/pkgs/development/python-modules/ufomerge/default.nix
@@ -13,14 +13,14 @@

 buildPythonPackage rec {
  pname = "ufomerge";
-  version = "1.9.3";
+  version = "1.9.4";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "googlefonts";
    repo = "ufomerge";
    tag = "v${version}";
-    hash = "sha256-AWEuHFm9upYrONaHXubPzK5qLsvYJ1M9/vcC5OgqRJM=";
+    hash = "sha256-kXwbdBqcPySboSBpGVevhQqrlE+/t+IFKTX03sh0nfw=";
  };

  build-system = [
--- a/pkgs/servers/home-assistant/custom-components/oref_alert/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/oref_alert/package.nix
@@ -21,6 +21,11 @@ buildHomeAssistantComponent rec {
    hash = "sha256-OO3My8U8SCmhaJQI7y0kxVKj/stvfp3pdqhFdTCcIWs=";
  };

+  postPatch = ''
+    substituteInPlace custom_components/oref_alert/manifest.json \
+      --replace-fail shapely==2.0.7 shapely
+  '';
+
  dependencies = [
    aiofiles
    shapely
--- a/pkgs/servers/monitoring/prometheus/pve-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/pve-exporter.nix
@@ -7,11 +7,11 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "prometheus_pve_exporter";
-  version = "3.5.4";
+  version = "3.5.5";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-eaBjvcnhqgb/FeD/J919T4WjM4Ft9yYYrLtBFFH/CBo=";
+    hash = "sha256-QFo/gnRF6+mk/xs6vJCxbR64LI3JwrLVwXib6tcEN8g=";
  };

  propagatedBuildInputs = with python3.pkgs; [
--- a/pkgs/tools/security/gotrue/supabase.nix
+++ b/pkgs/tools/security/gotrue/supabase.nix
@@ -8,13 +8,13 @@

 buildGoModule rec {
  pname = "auth";
-  version = "2.175.0";
+  version = "2.176.1";

  src = fetchFromGitHub {
    owner = "supabase";
    repo = "auth";
    rev = "v${version}";
-    hash = "sha256-2tHWisTlNFL1mJEeDD3kG/TWY+w0tjV1dBrl4i8u2C4=";
+    hash = "sha256-YXr5eGyX3cPk0GaV9XsvlIrroCOPIlWEyA1wvwdtT+k=";
  };

  vendorHash = "sha256-AU14lvEQQx9JCb1awSo+h63QY0k2v7QibYP8kidfJ8A=";
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -1849,6 +1849,8 @@ let

        sawja = callPackage ../development/ocaml-modules/sawja { };

+        scfg = callPackage ../development/ocaml-modules/scfg { };
+
        secp256k1 = callPackage ../development/ocaml-modules/secp256k1 {
          inherit (pkgs) secp256k1;
        };