Merge master into staging-next

doc/languages-frameworks/javascript.section.md

@@ -444,6 +444,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "...";
+    fetcherVersion = 2;
   };
 })
 ```
@@ -558,6 +559,41 @@ set `prePnpmInstall` to the right commands to run. For example:
 
 In this example, `prePnpmInstall` will be run by both `pnpm.configHook` and by the `pnpm.fetchDeps` builder.
 
+#### PNPM `fetcherVersion` {#javascript-pnpm-fetcherVersion}
+
+This is the version of the output of `pnpm.fetchDeps`, if you haven't set it already, you can use `1` with your current hash:
+
+```nix
+{
+  # ...
+  pnpmDeps = pnpm.fetchDeps {
+    # ...
+    hash = "..."; # you can use your already set hash here
+    fetcherVersion = 1;
+  };
+}
+```
+
+After upgrading to a newer `fetcherVersion`, you need to regenerate the hash:
+
+```nix
+{
+  # ...
+  pnpmDeps = pnpm.fetchDeps {
+    # ...
+    hash = "..."; # clear this hash and generate a new one
+    fetcherVersion = 2;
+  };
+}
+```
+
+This variable ensures that we can make changes to the output of `pnpm.fetchDeps` without breaking existing hashes.
+Changes can include workarounds or bug fixes to existing PNPM issues.
+
+##### Version history {#javascript-pnpm-fetcherVersion-versionHistory}
+
+- 1: Initial version, nothing special
+- 2: [Ensure consistent permissions](https://github.com/NixOS/nixpkgs/pull/422975)
 
 ### Yarn {#javascript-yarn}
 

doc/redirects.json

@@ -3347,6 +3347,12 @@
   "javascript-pnpm-extraCommands": [
     "index.html#javascript-pnpm-extraCommands"
   ],
+  "javascript-pnpm-fetcherVersion": [
+    "index.html#javascript-pnpm-fetcherVersion"
+  ],
+  "javascript-pnpm-fetcherVersion-versionHistory": [
+    "index.html#javascript-pnpm-fetcherVersion-versionHistory"
+  ],
   "javascript-yarn": [
     "index.html#javascript-yarn"
   ],

nixos/modules/services/mail/spamassassin.nix

@@ -98,7 +98,7 @@ in
           # loadplugin Mail::SpamAssassin::Plugin::Shortcircuit
           loadplugin Mail::SpamAssassin::Plugin::SpamCop
           loadplugin Mail::SpamAssassin::Plugin::SPF
-          #loadplugin Mail::SpamAssassin::Plugin::TextCat
+          loadplugin Mail::SpamAssassin::Plugin::TextCat
           # loadplugin Mail::SpamAssassin::Plugin::TxRep
           loadplugin Mail::SpamAssassin::Plugin::URIDetail
           loadplugin Mail::SpamAssassin::Plugin::URIDNSBL
@@ -183,6 +183,11 @@ in
         "sa-update.service"
       ];
 
+      reloadTriggers = [
+        config.environment.etc."mail/spamassassin/init.pre".source
+        config.environment.etc."mail/spamassassin/local.cf".source
+      ];
+
       serviceConfig = {
         User = "spamd";
         Group = "spamd";

nixos/modules/services/misc/redlib.nix

@@ -95,6 +95,47 @@ in
       environment = mapAttrs (_: v: if isBool v then boolToString' v else toString v) cfg.settings;
       serviceConfig =
         {
+          # Hardening
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          NoNewPrivileges = true;
+          PrivateDevices = true;
+          PrivateIPC = true;
+          PrivateTmp = true;
+          ProcSubset = "pid";
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectProc = "invisible";
+          ProtectSystem = "full";
+          RemoveIPC = true;
+          RestrictAddressFamilies = [
+            "AF_INET"
+            "AF_INET6"
+          ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [
+            "~@mount"
+            "~@swap"
+            "~@resources"
+            "~@reboot"
+            "~@raw-io"
+            "~@obsolete"
+            "~@module"
+            "~@debug"
+            "~@cpu-emulation"
+            "~@clock"
+            "~@privileged"
+          ];
+          UMask = "0027";
+
           ExecStart = [
             ""
             "${lib.getExe cfg.package} ${args}"
@@ -111,6 +152,7 @@ in
               # A private user cannot have process capabilities on the host's user
               # namespace and thus CAP_NET_BIND_SERVICE has no effect.
               PrivateUsers = true;
+              CapabilityBoundingSet = false;
             }
         );
     };

nixos/modules/services/web-apps/froide-govplan.nix

@@ -182,6 +182,7 @@ in
             StateDirectory = lib.mkIf (cfg.dataDir == "/var/lib/froide-govplan") "froide-govplan";
             User = "govplan";
             Group = "govplan";
+            TimeoutStartSec = "5m";
           };
           after = [
             "postgresql.target"
@@ -191,7 +192,7 @@ in
           wantedBy = [ "multi-user.target" ];
           environment =
             {
-              PYTHONPATH = pkg.pythonPath;
+              PYTHONPATH = "${pkg.pythonPath}:${pkg}/${pkg.python.sitePackages}";
               GDAL_LIBRARY_PATH = "${pkgs.gdal}/lib/libgdal.so";
               GEOS_LIBRARY_PATH = "${pkgs.geos}/lib/libgeos_c.so";
             }

nixos/modules/system/boot/systemd/oomd.nix

@@ -45,6 +45,8 @@ in
       "systemd-oomd.service"
       "systemd-oomd.socket"
     ];
+    # TODO: Added upstream in upcoming systemd release. Good to drop once we use v258 or later
+    systemd.services.systemd-oomd.after = [ "systemd-sysusers.service" ];
     systemd.services.systemd-oomd.wantedBy = [ "multi-user.target" ];
 
     environment.etc."systemd/oomd.conf".text = lib.generators.toINI { } {

pkgs/applications/audio/youtube-music/default.nix

@@ -25,6 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-xIQyTetHU37gTxCcQp4VCqzGdIfVQGy/aORCVba6YQ0=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/applications/editors/vscode/extensions/amazonwebservices.amazon-q-vscode/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
   mktplcRef = {
     name = "amazon-q-vscode";
     publisher = "AmazonWebServices";
-    version = "1.81.0";
-    hash = "sha256-zuE+KR0iLEkQrxxS835ZYq20yxWgV1S14bay4shqVWg=";
+    version = "1.83.0";
+    hash = "sha256-BicMVFpCmG3/NnBJUG5w8B/5039SWx6kAv8SC+Vaj5c=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/default.nix

@@ -2453,8 +2453,8 @@ let
         mktplcRef = {
           name = "vscode-vibrancy-continued";
           publisher = "illixion";
-          version = "1.1.54";
-          hash = "sha256-CzhDStBa/LB/bzgzrFCUEcVDeBluWJPblneUbHdIcRE=";
+          version = "1.1.57";
+          hash = "sha256-UJn+RFBlQXmPqKkFIBiD4AblnX4s0O2IK747fG+UC/0=";
         };
         meta = {
           downloadPage = "https://marketplace.visualstudio.com/items?itemName=illixion.vscode-vibrancy-continued";

pkgs/applications/editors/vscode/extensions/ms-windows-ai-studio.windows-ai-studio/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "windows-ai-studio";
     publisher = "ms-windows-ai-studio";
-    version = "0.16.0";
-    hash = "sha256-JBHdwvlJ4BHlphABT2ViR03R4zRVSwkHkOw1n3bNzAQ=";
+    version = "0.16.1";
+    hash = "sha256-uhAUSXB7ULNmkRSHqfbo3T3AZ3TiUaIqEZL4YwkWxtY=";
   };
 
   meta = {

pkgs/applications/video/mpv/scripts/quality-menu.nix

@@ -8,13 +8,13 @@
 
 buildLua rec {
   pname = "mpv-quality-menu";
-  version = "4.2.0";
+  version = "4.2.1";
 
   src = fetchFromGitHub {
     owner = "christoph-heinrich";
     repo = "mpv-quality-menu";
     rev = "v${version}";
-    hash = "sha256-uaU4W72P7zhHzxmfr59icCAl1mJ3ycLGzkGcYasHllI=";
+    hash = "sha256-W+6OYjh0S7nYrNC/P9sF7t6p1Rt/awOtO865cr6qtR0=";
   };
   passthru.updateScript = gitUpdater { rev-prefix = "v"; };
 

pkgs/by-name/ao/aonsoku/package.nix

@@ -28,6 +28,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   pnpmDeps = pnpm_8.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-h1rcM+H2c0lk7bpGeQT5ue9bQIggrCFHkj4o7KxnH08=";
+    fetcherVersion = 1;
   };
 
   cargoRoot = "src-tauri";

pkgs/by-name/ap/apache-answer/package.nix

@@ -29,6 +29,7 @@ buildGoModule rec {
       inherit src version pname;
       sourceRoot = "${src.name}/ui";
       hash = "sha256-/se6IWeHdazqS7PzOpgtT4IxCJ1WptqBzZ/BdmGb4BA=";
+      fetcherVersion = 1;
     };
 
     nativeBuildInputs = [

pkgs/by-name/ap/aporetic-bin/package.nix

@@ -6,13 +6,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "aporetic-bin";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "protesilaos";
     repo = "aporetic";
     tag = finalAttrs.version;
-    hash = "sha256-5lPViAo9SztOdds6HEmKJpT17tgcxmU/voXDffxTMDI=";
+    hash = "sha256-1BbuC/mWEcXJxzDppvsukhNtdOLz0QosD6QqI/93Khc=";
   };
 
   installPhase = ''

pkgs/by-name/ap/aporetic/package.nix

@@ -14,12 +14,12 @@ let
     "serif"
   ];
   pname = "aporetic";
-  version = "1.1.0";
+  version = "1.2.0";
   src = fetchFromGitHub {
     owner = "protesilaos";
     repo = "aporetic";
     tag = version;
-    hash = "sha256-5lPViAo9SztOdds6HEmKJpT17tgcxmU/voXDffxTMDI=";
+    hash = "sha256-1BbuC/mWEcXJxzDppvsukhNtdOLz0QosD6QqI/93Khc=";
   };
   privateBuildPlan = src.outPath + "/private-build-plans.toml";
   makeIosevkaFont =
@@ -40,11 +40,11 @@ let
             src = fetchFromGitHub {
               owner = "be5invis";
               repo = "iosevka";
-              tag = "v32.5.0";
-              hash = "sha256-MzsAkq5l4TP19UJNPW/8hvIqsJd94pADrrv8wLG6NMQ=";
+              tag = "v33.2.2";
+              hash = "sha256-dhMTcceHru/uLHRY4eWzFV+73ckCBBnDlizP3iY5w5w=";
             };
 
-            npmDepsHash = "sha256-HeqwpZyHLHdMhd/UfXVBonMu+PhStrLCxAMuP/KuTT8=";
+            npmDepsHash = "sha256-5DcMV9N16pyQxRaK6RCoeghZqAvM5EY1jftceT/bP+o=";
           }
         );
     });

pkgs/by-name/ar/artalk/package.nix

@@ -34,6 +34,7 @@ let
     pnpmDeps = pnpm_9.fetchDeps {
       inherit (finalAttrs) pname version src;
       hash = "sha256-QIfadS2gNPtH006O86EndY/Hx2ml2FoKfUXJF5qoluw=";
+      fetcherVersion = 1;
     };
 
     buildPhase = ''

pkgs/by-name/as/astro-language-server/package.nix

@@ -26,6 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
       prePnpmInstall
       ;
     hash = "sha256-tlpk+wbLjJqt37lu67p2A2RZAR1ZfnZFiYoqIQwvWPQ=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/au/autobrr/package.nix

@@ -41,6 +41,7 @@ let
         sourceRoot
         ;
       hash = "sha256-TbdRJqLdNI7wchUsx2Kw1LlDyv50XlCiKyn6rhZyN1U=";
+      fetcherVersion = 1;
     };
 
     postBuild = ''

pkgs/by-name/au/autoprefixer/package.nix

@@ -26,6 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-zb/BwL//i0oly5HEXN20E3RzZXdaOn+G2yIWRas3PB4=";
+    fetcherVersion = 1;
   };
 
   installPhase = ''

pkgs/by-name/ba/backrest/package.nix

@@ -34,6 +34,7 @@ let
     pnpmDeps = pnpm_9.fetchDeps {
       inherit (finalAttrs) pname version src;
       hash = "sha256-q7VMQb/FRT953yT2cyGMxUPp8p8XkA9mvqGI7S7Eifg=";
+      fetcherVersion = 1;
     };
 
     buildPhase = ''

pkgs/by-name/ba/bash-language-server/package.nix

@@ -29,6 +29,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       pnpmWorkspaces
       ;
     hash = "sha256-NvyqPv5OKgZi3hW98Da8LhsYatmrzrPX8kLOfLr+BrI=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/bf/bfscripts/package.nix

@@ -1,8 +1,10 @@
 {
-  stdenv,
   fetchFromGitHub,
+  git,
   lib,
   python3,
+  rpm,
+  stdenv,
 }:
 
 let
@@ -36,19 +38,24 @@ let
 in
 stdenv.mkDerivation {
   pname = "bfscripts";
-  version = "unstable-2023-05-15";
+  version = "unstable-2025-06-27";
 
   src = fetchFromGitHub {
     owner = "Mellanox";
     repo = "bfscripts";
-    rev = "1da79f3ece7cdf99b2571c00e8b14d2e112504a4";
-    hash = "sha256-pTubrnZKEFmtAj/omycFYeYwrCog39zBDEszoCrsQNQ=";
+    rev = "ed8ede79fa002a2d83719a1bef6fbe0f7dcf37a4";
+    hash = "sha256-x+hpH6D5HTl39zD0vYj6wRFw881M4AcfM+ePcgXMst8=";
   };
 
   buildInputs = [
     python3
   ];
 
+  nativeBuildInputs = [
+    git
+    rpm
+  ];
+
   installPhase = ''
     ${lib.concatStringsSep "\n" (map (b: "install -D ${b} $out/bin/${b}") binaries)}
   '';
@@ -58,6 +65,9 @@ stdenv.mkDerivation {
     homepage = "https://github.com/Mellanox/bfscripts";
     license = licenses.bsd2;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ nikstur ];
+    maintainers = with maintainers; [
+      nikstur
+      thillux
+    ];
   };
 }

pkgs/by-name/bu/bumpp/package.nix

@@ -25,6 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-duxpym1DlJM4q5j0wmrubYiAHQ3cDEFfeD9Gyic6mbI=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/ca/capnproto/package.nix

@@ -30,14 +30,14 @@ in
 # See: https://gerrit.lix.systems/c/lix/+/1874
 clangStdenv.mkDerivation rec {
   pname = "capnproto";
-  version = "1.1.0";
+  version = "1.2.0";
 
   # release tarballs are missing some ekam rules
   src = fetchFromGitHub {
     owner = "capnproto";
     repo = "capnproto";
     rev = "v${version}";
-    hash = "sha256-gxkko7LFyJNlxpTS+CWOd/p9x/778/kNIXfpDGiKM2A=";
+    hash = "sha256-aDcn4bLZGq8915/NPPQsN5Jv8FRWd8cAspkG3078psc=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/ca/cargo-tauri/test-app.nix

@@ -35,6 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
       ;
 
     hash = "sha256-plANa/+9YEQ4ipgdQ7QzPyxgz6eDCBhO7qFlxK6Ab58=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/cd/cdxgen/package.nix

@@ -38,6 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-7NrDYd4H0cPQs8w4lWlB0BhqcYZVo6/9zf0ujPjBzsE=";
+    fetcherVersion = 1;
   };
 
   buildPhase = ''

pkgs/by-name/cl/clash-verge-rev/unwrapped.nix

@@ -38,6 +38,7 @@ rustPlatform.buildRustPackage {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
     hash = pnpm-hash;
+    fetcherVersion = 1;
   };
 
   env = {

pkgs/by-name/co/code-cursor/package.nix

@@ -16,20 +16,20 @@ let
 
   sources = {
     x86_64-linux = fetchurl {
-      url = "https://downloads.cursor.com/production/031e7e0ff1e2eda9c1a0f5df67d44053b059c5df/linux/x64/Cursor-1.2.1-x86_64.AppImage";
-      hash = "sha256-2rOs5+85crKO/N9dCQLFfUXTfP9JVVR1s/g0bK2E78s=";
+      url = "https://downloads.cursor.com/production/faa03b17cce93e8a80b7d62d57f5eda6bb6ab9fa/linux/x64/Cursor-1.2.2-x86_64.AppImage";
+      hash = "sha256-mQr1QMw4wP+kHvE9RWPkCKtHObbr0jpyOxNw3LfTPfc=";
     };
     aarch64-linux = fetchurl {
-      url = "https://downloads.cursor.com/production/031e7e0ff1e2eda9c1a0f5df67d44053b059c5df/linux/arm64/Cursor-1.2.1-aarch64.AppImage";
-      hash = "sha256-Otg+NyW1DmrqIb0xqZCfJ4ys61/DBOQNgaAR8PMOCfg=";
+      url = "https://downloads.cursor.com/production/faa03b17cce93e8a80b7d62d57f5eda6bb6ab9fa/linux/arm64/Cursor-1.2.2-aarch64.AppImage";
+      hash = "sha256-EGvm/VW+NDTmOB1o2j3dpq4ckWbroFWEbF9Pezr8SZQ=";
     };
     x86_64-darwin = fetchurl {
-      url = "https://downloads.cursor.com/production/031e7e0ff1e2eda9c1a0f5df67d44053b059c5df/darwin/x64/Cursor-darwin-x64.dmg";
-      hash = "sha256-Rh1erFG7UtGwO1NaM5+tq17mI5WdIX750pIzeO9AK+Q=";
+      url = "https://downloads.cursor.com/production/faa03b17cce93e8a80b7d62d57f5eda6bb6ab9fa/darwin/x64/Cursor-darwin-x64.dmg";
+      hash = "sha256-IDJklB8wMfrPpc2SO02iVBBE9d7fLN7JotVpPyCQkyE=";
     };
     aarch64-darwin = fetchurl {
-      url = "https://downloads.cursor.com/production/031e7e0ff1e2eda9c1a0f5df67d44053b059c5df/darwin/arm64/Cursor-darwin-arm64.dmg";
-      hash = "sha256-k/j3hJnHIdtfK9+T0aq2gFkRM+JulDt4FpU7n4HGEYM=";
+      url = "https://downloads.cursor.com/production/faa03b17cce93e8a80b7d62d57f5eda6bb6ab9fa/darwin/arm64/Cursor-darwin-arm64.dmg";
+      hash = "sha256-GxiNf58Kf5/l01eBhXRWMLMxAnj1txDQwSe5ei6nTgg=";
     };
   };
 
@@ -39,7 +39,7 @@ in
   inherit useVSCodeRipgrep;
   commandLineArgs = finalCommandLineArgs;
 
-  version = "1.2.1";
+  version = "1.2.2";
   pname = "cursor";
 
   # You can find the current VSCode version in the About dialog:

pkgs/by-name/co/codipack/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "codipack";
-  version = "2.3.2";
+  version = "3.0.0";
 
   src = fetchFromGitHub {
     owner = "SciCompKL";
     repo = "CoDiPack";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-feYtPDV0t7b49NIL5s6ZoBttRG2Bkwc0gOX6R6xDIbs=";
+    hash = "sha256-dGzLPU8YOrBdXPwUnEElqfxzbUdkAQxtv2+7+itNsyI=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/co/comic-neue/package.nix

@@ -9,21 +9,20 @@ stdenv.mkDerivation rec {
   version = "2.51";
 
   src = fetchzip {
-    url = "http://comicneue.com/${pname}-${version}.zip";
-    sha256 = "sha256-DjRZtFnJOtZnxhfpgU5ihZFAonRK608/BQztCAExIU0=";
-    stripRoot = false; # because it comes with a __MACOSX directory
+    url = "https://github.com/crozynski/comicneue/releases/download/${version}/comicneue-master.zip";
+    hash = "sha256-Xkw+Yd36ffptKsS8RSEP9BPX6eQI7TZn2NgU49rdo80=";
   };
 
   installPhase = ''
     mkdir -pv $out/share/{doc/${pname}-${version},fonts/{opentype,truetype,WOFF,WOFF2}}
-    cp -v ${pname}-${version}/{FONTLOG,OFL-FAQ,OFL}.txt $out/share/doc/
-    cp -v ${pname}-${version}/Booklet-ComicNeue.pdf $out/share/doc/
-    cp -v ${pname}-${version}/OTF/ComicNeue-Angular/*.otf $out/share/fonts/opentype
-    cp -v ${pname}-${version}/OTF/ComicNeue/*.otf $out/share/fonts/opentype
-    cp -v ${pname}-${version}/TTF/ComicNeue-Angular/*.ttf $out/share/fonts/truetype
-    cp -v ${pname}-${version}/TTF/ComicNeue/*.ttf $out/share/fonts/truetype
-    cp -v ${pname}-${version}/WebFonts/*.woff $out/share/fonts/WOFF
-    cp -v ${pname}-${version}/WebFonts/*.woff2 $out/share/fonts/WOFF2
+    cp -v {FONTLOG,OFL-FAQ,OFL}.txt $out/share/doc/
+    cp -v Booklet-ComicNeue.pdf $out/share/doc/
+    cp -v Fonts/OTF/ComicNeue-Angular/*.otf $out/share/fonts/opentype
+    cp -v Fonts/OTF/ComicNeue/*.otf $out/share/fonts/opentype
+    cp -v Fonts/TTF/ComicNeue-Angular/*.ttf $out/share/fonts/truetype
+    cp -v Fonts/TTF/ComicNeue/*.ttf $out/share/fonts/truetype
+    cp -v Fonts/WebFonts/*.woff $out/share/fonts/WOFF
+    cp -v Fonts/WebFonts/*.woff2 $out/share/fonts/WOFF2
   '';
 
   meta = with lib; {

pkgs/by-name/co/concurrently/package.nix

@@ -30,6 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
       patches
       ;
     hash = "sha256-F1teWIABkK0mqZcK3RdGNKmexI/C59QWSrrD1jYbHt0=";
+    fetcherVersion = 1;
   };
 
   patches = [

pkgs/by-name/cr/crowdin-cli/package.nix

@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "crowdin-cli";
-  version = "4.8.0";
+  version = "4.9.0";
 
   src = fetchurl {
     url = "https://github.com/crowdin/crowdin-cli/releases/download/${finalAttrs.version}/crowdin-cli.zip";
-    hash = "sha256-4+D1O+/32aYbZs1aKAEPuKq3IDmZho7oX+zERRrGMpw=";
+    hash = "sha256-fPgcr0Gg0uIgDhnfowFp6K+NhtKdjThLd4yzjcZ78K4=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/da/daed/package.nix

@@ -28,6 +28,7 @@ let
     pnpmDeps = pnpm_9.fetchDeps {
       inherit pname version src;
       hash = "sha256-+yLpSbDzr1OV/bmUUg6drOvK1ok3cBd+RRV7Qrrlp+Q=";
+      fetcherVersion = 1;
     };
 
     nativeBuildInputs = [

pkgs/by-name/db/dbeaver-bin/package.nix

@@ -18,7 +18,7 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "dbeaver-bin";
-  version = "25.1.1";
+  version = "25.1.2";
 
   src =
     let
@@ -31,10 +31,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
         aarch64-darwin = "macos-aarch64.dmg";
       };
       hash = selectSystem {
-        x86_64-linux = "sha256-PFY1eZFG8mvbG6D7pDJBBbsySeNmw6/DlxSyNvCJcSI=";
-        aarch64-linux = "sha256-Fny8+XA7N3rmXqP2UfTPYFIwHHSZTLbABjm+ESMoFJ4=";
-        x86_64-darwin = "sha256-/U8lcvJotAB+K0pQWpy6RIRqbfJzqVefS67qF9arzw0=";
-        aarch64-darwin = "sha256-lfz+B2ZHaBoyDKduDn45ocSTMAsS/bBXrByBeIZb0Ew=";
+        x86_64-linux = "sha256-jyqUIar/RnUvcnXOB3/c7F5BAcpUVL3ufnGuKNGHq0M=";
+        aarch64-linux = "sha256-1aEbrgPVIaWG3rUwHQCcnVTQtRgS2ksjqH5l13eR7NY=";
+        x86_64-darwin = "sha256-n6cu7wzC4GowWGUMF2vg+kA+tiOWzgaWLcUw0I/fCXU=";
+        aarch64-darwin = "sha256-XRFg11t6kiBTPhX8wZbVkHotacjRu3BK1MMGaHDJs6s=";
       };
     in
     fetchurl {

pkgs/by-name/de/deltachat-desktop/package.nix

@@ -49,6 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-PBCmyNmlH88y5s7+8WHcei8SP3Q0lIAAnAQn9uaFxLc=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs =

pkgs/by-name/do/dorion/package.nix

@@ -60,6 +60,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-xBonUzA4+1zbViEsKap6CaG6ZRldW1LjNYIB+FmVRFs=";
+    fetcherVersion = 1;
   };
 
   # CMake (webkit extension)

pkgs/by-name/do/dotbot/package.nix

@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "dotbot";
-  version = "1.22.0";
+  version = "1.23.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "anishathalye";
     repo = "dotbot";
     tag = "v${version}";
-    hash = "sha256-3U8lIsqy95Ulxa5f2hHGFmuAqQ7WZtikvgaplX6GTF0=";
+    hash = "sha256-Bv9nvS8DxmpMB5Bo4Sw2+rVbrnQIcnc/hQZiq0qeJxc=";
   };
 
   preCheck = ''

pkgs/by-name/em/emmet-language-server/package.nix

@@ -21,6 +21,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-hh5PEtmSHPs6QBgwWHS0laGU21e82JckIP3mB/P9/vE=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/en/en-croissant/package.nix

@@ -31,6 +31,7 @@ rustPlatform.buildRustPackage rec {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
     hash = "sha256-hvWXSegUWJvwCU5NLb2vqnl+FIWpCLxw96s9NUIgJTI=";
+    fetcherVersion = 1;
   };
 
   cargoRoot = "src-tauri";

pkgs/by-name/eq/equibop/package.nix

@@ -40,6 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
       patches
       ;
     hash = "sha256-laTyxRh54x3iopGVgoFtcgaV7R6IKux1O/+tzGEy0Fg=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/eq/equicord/package.nix

@@ -26,6 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-fjfzBy1Z7AUKA53yjjCQ6yasHc5QMaOBtXtXA5fNK5s=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/et/etherpad-lite/package.nix

@@ -32,6 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-n7LolizpKng7zzccytYoCwJ7uGQbMagsgYPDuq0mdxU=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/ev/evince/package.nix

@@ -42,7 +42,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "evince";
-  version = "48.0";
+  version = "48.1";
 
   outputs = [
     "out"
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/evince/${lib.versions.major finalAttrs.version}/evince-${finalAttrs.version}.tar.xz";
-    hash = "sha256-zS9lg1X6kHX9+eW0SqCvOn4JKMVWFOsQQrNhds9FESY=";
+    hash = "sha256-fYuab6OgXT9bkEiFkCdojHOniP9ukjvDlFEmiElD+hA=";
   };
 
   depsBuildBuild = [

pkgs/by-name/fe/fedistar/package.nix

@@ -39,6 +39,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-xXVsjAXmrsOp+mXrYAxSKz4vX5JApLZ+Rh6hrYlnJDI=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/fi/filebrowser/package.nix

@@ -38,6 +38,7 @@ let
       inherit (finalAttrs) pname version src;
       sourceRoot = "${src.name}/frontend";
       hash = "sha256-vLOtVeGFeHXgQglvKsih4lj1uIs6wipwfo374viIq4I=";
+      fetcherVersion = 1;
     };
 
     installPhase = ''

pkgs/by-name/fi/firezone-gui-client/package.nix

@@ -41,6 +41,7 @@ let
       inherit pname version;
       src = "${src}/rust/gui-client";
       hash = "sha256-ttbTYBuUv0vyiYzrFATF4x/zngsRXjuLPfL3qW2HEe4=";
+      fetcherVersion = 1;
     };
     pnpmRoot = "rust/gui-client";
 

pkgs/by-name/fi/firezone-server/package.nix

@@ -35,6 +35,7 @@ beamPackages.mixRelease rec {
     inherit pname version;
     src = "${src}/apps/web/assets";
     hash = "sha256-ejyBppFtKeyVhAWmssglbpLleOnbw9d4B+iM5Vtx47A=";
+    fetcherVersion = 1;
   };
   pnpmRoot = "apps/web/assets";
 

pkgs/by-name/fl/flood/package.nix

@@ -23,6 +23,7 @@ buildNpmPackage rec {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
     hash = "sha256-E2VxRcOMLvvCQb9gCAGcBTsly571zh/HWM6Q1Zd2eVw=";
+    fetcherVersion = 1;
   };
 
   passthru = {

pkgs/by-name/fo/follow/package.nix

@@ -31,6 +31,7 @@ stdenv.mkDerivation rec {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
     hash = "sha256-xNGLYzEz1G5sZSqmji+ItJ9D1vvZcwkkygnDeuypcIM=";
+    fetcherVersion = 1;
   };
 
   env = {

pkgs/by-name/fr/froide-govplan/package.nix

@@ -14,13 +14,14 @@
 let
   python = python3Packages.python.override {
     packageOverrides = self: super: {
-      django = super.django.override { withGdal = true; };
+      django_5 = super.django_5.override { withGdal = true; };
+      django = super.django_5;
     };
   };
 in
 python.pkgs.buildPythonApplication rec {
   pname = "froide-govplan";
-  version = "0-unstable-2025-01-27";
+  version = "0-unstable-2025-06-25";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -28,8 +29,8 @@ python.pkgs.buildPythonApplication rec {
     repo = "froide-govplan";
     # No tagged release yet
     # https://github.com/okfde/froide-govplan/issues/15
-    rev = "f1763807614b8c54a9214359a2a1e442ca58cb6d";
-    hash = "sha256-Y7/qjhu3y9E55ZDmDf5HUk9JVcUTvi9KnqavqwNixTM=";
+    rev = "9c325e70a84f26fea37b5a34f24d19fd82ea62ff";
+    hash = "sha256-OD4vvKt0FLuiAVGwpspWLB2ZuM1UJkZdv2YcbKKYk9A=";
   };
 
   patches = [
@@ -69,7 +70,6 @@ python.pkgs.buildPythonApplication rec {
   build-inputs = [ gdal ];
 
   dependencies = with python.pkgs; [
-    bleach
     django-admin-sortable2
     django-cms
     django-filer
@@ -93,6 +93,7 @@ python.pkgs.buildPythonApplication rec {
         };
       })
     ))
+    nh3
     psycopg
   ];
 
@@ -103,7 +104,7 @@ python.pkgs.buildPythonApplication rec {
     cp -r project $out/${python.sitePackages}/froide_govplan/
     cp -r froide_govplan/locale $out/${python.sitePackages}/froide_govplan/
     makeWrapper $out/${python.sitePackages}/froide_govplan/manage.py $out/bin/froide-govplan \
-      --prefix PYTHONPATH : "$PYTHONPATH" \
+      --prefix PYTHONPATH : ${passthru.pythonPath}:$out/${python.sitePackages} \
       --set GDAL_LIBRARY_PATH "${gdal}/lib/libgdal.so" \
       --set GEOS_LIBRARY_PATH "${geos}/lib/libgeos_c.so"
   '';
@@ -112,8 +113,8 @@ python.pkgs.buildPythonApplication rec {
     tests = {
       inherit (nixosTests) froide-govplan;
     };
-    python = python;
-    pythonPath = "${python.pkgs.makePythonPath dependencies}:${froide-govplan}/${python.sitePackages}";
+    inherit python;
+    pythonPath = "${python.pkgs.makePythonPath dependencies}";
   };
 
   meta = {

pkgs/by-name/fr/froide/package.nix

@@ -15,20 +15,38 @@
 let
 
   python = python3Packages.python.override {
-    packageOverrides = self: super: { django = super.django.override { withGdal = true; }; };
+    packageOverrides = self: super: {
+      django_5 = super.django_5.override { withGdal = true; };
+      django = super.django_5;
+      # custom python module part of froide
+      dogtail = super.buildPythonPackage {
+        pname = "dogtail";
+        version = "0-unstable-2024-11-27";
+        pyproject = true;
+
+        src = fetchFromGitHub {
+          owner = "okfde";
+          repo = "dogtail";
+          rev = "d2f341cab0f05ef4e193f0158fe5a64aadc5bae6";
+          hash = "sha256-2lQZgvFXAz6q/3NpBcwckUologWxKmwXI0ZG5nylajg=";
+        };
+
+        build-system = with super; [ setuptools ];
+      };
+    };
   };
 
 in
 python.pkgs.buildPythonApplication rec {
   pname = "froide";
-  version = "0-unstable-2025-04-25";
+  version = "0-unstable-2025-07-01";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "okfde";
     repo = "froide";
-    rev = "9e4838fc5f17a0506af42ad5fd1ebc66cff4b92a";
-    hash = "sha256-0EC6oCaiK7gw5ikemskiK3qOlflGHzlG4giDQNj9tBQ=";
+    rev = "362bddb5a8fdfe762d59cdebd29016568c9531b2";
+    hash = "sha256-c8I/FvXQSkAeacxMQJCpCMKFueNEnLI4R0ElqRbVbNg=";
   };
 
   patches = [ ./django_42_storages.patch ];
@@ -48,11 +66,9 @@ python.pkgs.buildPythonApplication rec {
   ];
 
   dependencies = with python.pkgs; [
-    bleach
     celery
     celery-singleton
     channels
-    coreapi
     dj-database-url
     django
     django-celery-beat
@@ -63,9 +79,6 @@ python.pkgs.buildPythonApplication rec {
     django-elasticsearch-dsl
     django-filingcabinet
     django-filter
-    # Project discontinued upstream
-    # https://github.com/okfde/froide/issues/893
-    django-fsm
     django-json-widget
     django-leaflet
     django-mfa3
@@ -86,6 +99,7 @@ python.pkgs.buildPythonApplication rec {
     geoip2
     icalendar
     markdown
+    nh3
     phonenumbers
     pillow
     pikepdf
@@ -104,7 +118,8 @@ python.pkgs.buildPythonApplication rec {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit pname version src;
-    hash = "sha256-IeuQoiI/r9AKLZgKkZx0C+qE9ueWuC39Y77MB08zSAc=";
+    hash = "sha256-g7YX2fVXGmb3Qq9NNCb294bk4/0khcIZVSskYbE8Mdw=";
+    fetcherVersion = 1;
   };
 
   postBuild = ''
@@ -114,7 +129,7 @@ python.pkgs.buildPythonApplication rec {
   postInstall = ''
     cp -r build manage.py $out/${python.sitePackages}/froide/
     makeWrapper $out/${python.sitePackages}/froide/manage.py $out/bin/froide \
-      --prefix PYTHONPATH : "$PYTHONPATH" \
+      --prefix PYTHONPATH : "${python3Packages.makePythonPath dependencies}" \
       --set GDAL_LIBRARY_PATH "${gdal}/lib/libgdal.so" \
       --set GEOS_LIBRARY_PATH "${geos}/lib/libgeos_c.so"
   '';
@@ -129,6 +144,7 @@ python.pkgs.buildPythonApplication rec {
 
   checkInputs = with python.pkgs; [
     beautifulsoup4
+    pytest-asyncio
     pytest-factoryboy
     time-machine
   ];
@@ -156,6 +172,9 @@ python.pkgs.buildPythonApplication rec {
     "test_bouncing_email"
     "test_multiple_partial"
     "test_logfile_rotation"
+    # Test hangs
+    "test_collapsed_menu"
+    "test_make_request_logged_out_with_existing_account"
   ];
 
   preCheck =

pkgs/by-name/gi/gitbutler/package.nix

@@ -65,6 +65,7 @@ rustPlatform.buildRustPackage rec {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
     hash = "sha256-5NtfstUuIYyntt09Mu9GAFAOImfO6VMmJ7g15kvGaLE=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/gi/gitify/package.nix

@@ -34,6 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-eIvqZ9a+foYH+jXuqGz1m/4C+0Xq8mTvm7ZajKeOw58=";
+    fetcherVersion = 1;
   };
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = 1;

pkgs/by-name/gl/glycin-loaders/package.nix

@@ -24,11 +24,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "glycin-loaders";
-  version = "1.2.1";
+  version = "1.2.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/glycin/${lib.versions.majorMinor finalAttrs.version}/glycin-${finalAttrs.version}.tar.xz";
-    hash = "sha256-zMV46aPoPQ3BU1c30f2gm6qVxxZ/Xl7LFfeGZUCU7tU=";
+    hash = "sha256-SrRG1YsQx2KDInplSHuLvbdLpQCentIwRfz6i6P7KGE=";
   };
 
   patches = [

pkgs/by-name/gn/gnome-builder/package.nix

@@ -42,7 +42,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-builder";
-  version = "48.0";
+  version = "48.2";
 
   outputs = [
     "out"
@@ -51,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-builder/${lib.versions.major finalAttrs.version}/gnome-builder-${finalAttrs.version}.tar.xz";
-    hash = "sha256-ev6aejs8ZiF2i8RqYdaY3XiLNlP7RqcII4vcz03me6Q=";
+    hash = "sha256-7BKA1H6BSjE7dMuSfVoFk4BUSqD1bodVKXg5fWx0zGM=";
   };
 
   patches = [

pkgs/by-name/gn/gnome-online-accounts/package.nix

@@ -32,7 +32,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-online-accounts";
-  version = "3.54.3";
+  version = "3.54.4";
 
   outputs =
     [
@@ -46,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-online-accounts/${lib.versions.majorMinor finalAttrs.version}/gnome-online-accounts-${finalAttrs.version}.tar.xz";
-    hash = "sha256-vPZV3R3cIrwleTtoQNoZ9crXugtyJ/+WntnCUvA2qsU=";
+    hash = "sha256-VXOZQ+dH3LSIXqYHpMJ2fYAC9xKV4a/+pi6jb20c9ZM=";
   };
 
   mesonFlags = [

pkgs/by-name/gn/gnome-shell-extensions/package.nix

@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-shell-extensions";
-  version = "48.2";
+  version = "48.3";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-shell-extensions/${lib.versions.major finalAttrs.version}/gnome-shell-extensions-${finalAttrs.version}.tar.xz";
-    hash = "sha256-6Sh+hjSJ5fpqLFWuW+ocqRCuQBbe6zQXNiZ4sEqR7P8=";
+    hash = "sha256-rd40wI9AtjQRvm8dF+I1VQoAkElIceZIHDEpidf0otQ=";
   };
 
   patches = [

pkgs/by-name/gn/gnome-shell/package.nix

@@ -69,7 +69,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-shell";
-  version = "48.2";
+  version = "48.3";
 
   outputs = [
     "out"
@@ -78,7 +78,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-shell/${lib.versions.major finalAttrs.version}/gnome-shell-${finalAttrs.version}.tar.xz";
-    hash = "sha256-XSbMfvymNIW33bbHo5Msoa+fqPy+OLjJnqP0qyFzpqk=";
+    hash = "sha256-+wID/HSFk/FOUXMmGOHwQlJf1xl2Sg/bDuP2/kE6mys=";
   };
 
   patches = [

pkgs/by-name/gn/gnome-software/package.nix

@@ -48,11 +48,11 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-software";
-  version = "48.2";
+  version = "48.3";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-software/${lib.versions.major finalAttrs.version}/gnome-software-${finalAttrs.version}.tar.xz";
-    hash = "sha256-q/0wZDqGxl9IhrZ2XrO7YhXJ6gmBfWvRZcUAVokIIsk=";
+    hash = "sha256-Emlx6LwADdwgAXjI+sj3EU7tQt5KTiASugaz/+cH4jo=";
   };
 
   patches = [

pkgs/by-name/gn/gnome-user-share/package.nix

@@ -26,11 +26,11 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-user-share";
-  version = "48.0";
+  version = "48.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-user-share/${lib.versions.major finalAttrs.version}/gnome-user-share-${finalAttrs.version}.tar.xz";
-    hash = "sha256-tVgFBwGVwvZYQVuc0shbLNFOqYHWGCOlANTWK4v4OAE=";
+    hash = "sha256-grz9TvPqf9eyr3+6mkW0dOF03NgowcS/5/+KLvhYunc=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {

pkgs/by-name/go/goofcord/package.nix

@@ -43,6 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm'.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-8dSyU9arSvISc2kDWbg/CP6L4sZjZi/Zv7TZN4ONOjQ=";
+    fetcherVersion = 1;
   };
 
   env = {

pkgs/by-name/gu/gui-for-clash/package.nix

@@ -44,6 +44,7 @@ let
       inherit (finalAttrs) pname version src;
       sourceRoot = "${finalAttrs.src.name}/frontend";
       hash = "sha256-5tz1FItH9AvZhJjka8i5Kz22yf/tEmRPkDhz6iswZzc=";
+      fetcherVersion = 1;
     };
 
     sourceRoot = "${finalAttrs.src.name}/frontend";

pkgs/by-name/gu/gui-for-singbox/package.nix

@@ -46,6 +46,7 @@ let
       inherit (finalAttrs) pname version src;
       sourceRoot = "${finalAttrs.src.name}/frontend";
       hash = "sha256-5tz1FItH9AvZhJjka8i5Kz22yf/tEmRPkDhz6iswZzc=";
+      fetcherVersion = 1;
     };
 
     sourceRoot = "${finalAttrs.src.name}/frontend";

pkgs/by-name/he/heroic-unwrapped/package.nix

@@ -34,6 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-9WCIdQ91IU8pfq6kpbmmn6APBTNwpCi9ovgRuWYUad8=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/ho/homebox/package.nix

@@ -39,6 +39,7 @@ buildGo123Module {
     inherit pname version;
     src = "${src}/frontend";
     hash = "sha256-6Q+tIY5dl5jCQyv1F8btLdJg0oEUGs0Wyu/joVdVhf8=";
+    fetcherVersion = 1;
   };
   pnpmRoot = "../frontend";
 

pkgs/by-name/ho/homepage-dashboard/package.nix

@@ -51,6 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
       patches
       ;
     hash = "sha256-aPkXHKG3vDsfYqYx9q9+2wZhuFqmPcXdoBqOfAvW9oA=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/ho/homer/package.nix

@@ -26,6 +26,7 @@ stdenvNoCC.mkDerivation rec {
       patches
       ;
     hash = "sha256-y1R+rlaOtFOHHAgEHPBl40536U10Ft0iUSfGcfXS08Y=";
+    fetcherVersion = 1;
   };
 
   # Enables specifying a custom Sass compiler binary path via `SASS_EMBEDDED_BIN_PATH` environment variable.

pkgs/by-name/it/it-tools/package.nix

@@ -24,6 +24,7 @@ stdenv.mkDerivation rec {
   pnpmDeps = pnpm_8.fetchDeps {
     inherit pname version src;
     hash = "sha256-m1eXBE5rakcq8NGnPC9clAAvNJQrN5RuSQ94zfgGZxw=";
+    fetcherVersion = 1;
   };
 
   buildPhase = ''

pkgs/by-name/je/jellyseerr/package.nix

@@ -29,6 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-Ym16jPHMHKmojMQOuMamDsW/u+oP1UhbCP5dooTUzFQ=";
+    fetcherVersion = 1;
   };
 
   buildInputs = [ sqlite ];

pkgs/by-name/ju/jumpy/package.nix

@@ -2,6 +2,7 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
+  fetchpatch2,
   makeWrapper,
   pkg-config,
   zstd,
@@ -14,19 +15,27 @@
   xorg,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "jumpy";
-  version = "0.8.0";
+  version = "0.12.2";
 
   src = fetchFromGitHub {
     owner = "fishfolk";
     repo = "jumpy";
-    rev = "v${version}";
-    sha256 = "sha256-ggePJH2kKJ17aOWRKUnLyolIdSzlc6Axf5Iw74iFfek=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-g/CpSycTCM1i6O7Mir+3huabvr4EXghDApquEUNny8c=";
   };
 
+  # This patch may be removed in the next release
+  cargoPatches = [
+    (fetchpatch2 {
+      url = "https://github.com/fishfolk/jumpy/commit/8234e6d2c0b33c75e2112596ded1734fdba50fb8.patch?full_index=1";
+      hash = "sha256-IWjBw1Wj/6CT/x6xm6vfpUMfk7A5/EsdbPDvWywRFc8=";
+    })
+  ];
+
   useFetchCargoVendor = true;
-  cargoHash = "sha256-hVEpTNTXwOQoxlhOewUvHyfBh+APnx8Fox90CmdMRQ4=";
+  cargoHash = "sha256-2I9s1zH94GRqXGBxZYyXOQwNeYrpV1UhUSKGCs9Ce9Q=";
 
   nativeBuildInputs = [
     makeWrapper
@@ -77,12 +86,14 @@ rustPlatform.buildRustPackage rec {
   meta = {
     description = "Tactical 2D shooter played by up to 4 players online or on a shared screen";
     mainProgram = "jumpy";
-    homepage = "https://fishfight.org/";
-    changelog = "https://github.com/fishfolk/jumpy/releases/tag/v${version}";
+    homepage = "https://fishfolk.org/games/jumpy";
+    changelog = "https://github.com/fishfolk/jumpy/releases/tag/v${finalAttrs.version}";
     license = with lib.licenses; [
       mit # or
       asl20
+      # Assets
+      cc-by-nc-40
     ];
     maintainers = with lib.maintainers; [ figsoda ];
   };
-}
+})

pkgs/by-name/ka/karakeep/package.nix

@@ -54,6 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
     };
 
     hash = "sha256-yf8A0oZ0Y4A5k7gfinIU02Lbqp/ygyvIBlldS0pv5+0=";
+    fetcherVersion = 1;
   };
   buildPhase = ''
     runHook preBuild

pkgs/by-name/le/legcord/package.nix

@@ -45,6 +45,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-nobOORfhwlGEvNt+MfDKd3rXor6tJHDulz5oD1BGY4I=";
+    fetcherVersion = 1;
   };
 
   buildPhase = ''

pkgs/by-name/li/libdex/package.nix

@@ -15,7 +15,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libdex";
-  version = "0.10.0";
+  version = "0.10.1";
 
   outputs = [
     "out"
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/libdex/${lib.versions.majorMinor finalAttrs.version}/libdex-${finalAttrs.version}.tar.xz";
-    hash = "sha256-mKaWJqp2Rq1FW+p6f5LSof+kfkVZoVShv+mMFvpxHuE=";
+    hash = "sha256-dHLogJDbKyKDB1Be3rpEg+hyaBNAywQErmSsPaW+0KY=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/li/libglycin/package.nix

@@ -15,6 +15,8 @@
   gtk4,
   gobject-introspection,
   gnome,
+  common-updater-scripts,
+  _experimental-update-script-combinators,
   buildPackages,
   withIntrospection ?
     lib.meta.availableOn stdenv.hostPlatform gobject-introspection
@@ -22,14 +24,14 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "libglycin";
-  version = "1.2.1";
+  version = "1.2.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "GNOME";
     repo = "glycin";
     tag = finalAttrs.version;
-    hash = "sha256-M4DcWLE40OPB7zIkv4uLj6xTac3LTDcZ2uAO2S/cUz4=";
+    hash = "sha256-K+cR+0a/zRpOvMsX1ZljjJYYOXbHkyDGE9Q9vY1qJBg=";
   };
 
   nativeBuildInputs =
@@ -48,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-iNSpLvIi3oZKSRlkwkDJp5i8MdixRvmWIOCzbFHIdHw=";
+    hash = "sha256-zGDmmRbaR2boaf9lLzvW/H7xgMo9uHTmlC0oNupLUos=";
   };
 
   buildInputs = [
@@ -71,10 +73,33 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   passthru = {
-    updateScript = gnome.updateScript {
-      attrPath = "libglycin";
-      packageName = "glycin";
-    };
+    updateScript =
+      let
+        updateSource = gnome.updateScript {
+          attrPath = "libglycin";
+          packageName = "glycin";
+        };
+        updateLockfile = {
+          command = [
+            "sh"
+            "-c"
+            ''
+              PATH=${
+                lib.makeBinPath [
+                  common-updater-scripts
+                ]
+              }
+              update-source-version libglycin --ignore-same-version --source-key=cargoDeps.vendorStaging > /dev/null
+            ''
+          ];
+          # Experimental feature: do not copy!
+          supportedFeatures = [ "silent" ];
+        };
+      in
+      _experimental-update-script-combinators.sequence [
+        updateSource
+        updateLockfile
+      ];
   };
 
   meta = {

pkgs/by-name/ma/mark/package.nix

@@ -8,16 +8,16 @@
 # https://github.com/kovetskiy/mark/pull/581#issuecomment-2797872996
 buildGoModule rec {
   pname = "mark";
-  version = "14.1.0";
+  version = "14.1.1";
 
   src = fetchFromGitHub {
     owner = "kovetskiy";
     repo = "mark";
     rev = "${version}";
-    sha256 = "sha256-TQU49rPpHCDQEOIfC3R89kdtVMVJrisOXF5DhbRgJQ0=";
+    sha256 = "sha256-jKc5QugqfdjSQjK7SbLG02a9+YdFcweS+91LhdR0Dzg=";
   };
 
-  vendorHash = "sha256-y5WCpL0bJE48iVUO2hPy7AvAx9KEVQJUK6vVwFfob/M=";
+  vendorHash = "sha256-AHtIVp2n5v4YoYfWAsE7eD1QcEFKdjSqzGIlR7+mnxg=";
 
   ldflags = [
     "-s"

pkgs/by-name/me/memos/package.nix

@@ -62,6 +62,7 @@ let
       inherit (finalAttrs) pname version src;
       sourceRoot = "${finalAttrs.src.name}/web";
       hash = "sha256-AyQYY1vtBB6DTcieC7nw5aOOVuwESJSDs8qU6PGyaTw=";
+      fetcherVersion = 1;
     };
     pnpmRoot = "web";
     nativeBuildInputs = [

pkgs/by-name/me/metacubexd/package.nix

@@ -25,6 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-Ct/YLnpZb0YBXVaghd5W1bmDcjVRladwQNRoLagHgJo=";
+    fetcherVersion = 1;
   };
 
   buildPhase = ''

pkgs/by-name/mi/misskey/package.nix

@@ -38,6 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-T8LwpEjeWNmkIo3Dn1BCFHBsTzA/Dt6/pk/NMtvT0N4=";
+    fetcherVersion = 1;
   };
 
   buildPhase = ''

pkgs/by-name/ml/mlxbf-bootctl/package.nix

@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mlxbf-bootctl";
-  version = "1.1-6";
+  version = "unstable-2025-01-16";
 
   src = fetchFromGitHub {
     owner = "Mellanox";
     repo = "mlxbf-bootctl";
-    rev = "mlxbf-bootctl-${version}";
-    hash = "sha256-F49ZZtty+NARXA/doAFLhsQn4XkPW6GWLXGy4waIaM0=";
+    rev = "278160ca8e08251cff5e7989e5a1010bd247a6ae";
+    hash = "sha256-qS35wCb8zvuF2Zs/5hPZkoZAapr7fwKQ/0ZOBPtrkRQ=";
   };
 
   installPhase = ''
@@ -27,6 +27,9 @@ stdenv.mkDerivation rec {
     # This package is supposed to only run on a BlueField. Thus aarch64-linux
     # is the only relevant platform.
     platforms = [ "aarch64-linux" ];
-    maintainers = with lib.maintainers; [ nikstur ];
+    maintainers = with lib.maintainers; [
+      nikstur
+      thillux
+    ];
   };
 }

pkgs/by-name/ml/mlxbf-bootimages/package.nix

@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mlxbf-bootimages";
-  version = "4.10.0-13520";
+  version = "4.11.0-13611";
 
   src = fetchurl {
     url = "https://linux.mellanox.com/public/repo/bluefield/${version}/bootimages/prod/${pname}-signed_${version}_arm64.deb";
-    hash = "sha256-lPclxhKmn1hvGXWI1A+Q1yXK7FZzKUcOtBoXG6KRsCA=";
+    hash = "sha256-bZpZ6qnC3Q/BuOngS4ZoU6vjeekPjVom0KdDoJF5iko=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/mo/models-dev/package.nix

@@ -0,0 +1,117 @@
+{
+  lib,
+  stdenvNoCC,
+  bun,
+  fetchFromGitHub,
+  nix-update-script,
+  writableTmpDirAsHomeHook,
+}:
+
+let
+  models-dev-node-modules-hash = {
+    "aarch64-darwin" = "sha256-2EVW5zQTcqH9zBYAegWj/Wtb0lYHZwA7Bbqs3gRjcx0=";
+    "aarch64-linux" = "sha256-nJgFnszwvknqA21uaqlGQQ1x+4ztKx0/tEvcNrv1LJg=";
+    "x86_64-darwin" = "sha256-Un6UxmvsmBuDdUwcWnu4qb0nPN1V1PFJi4VGVkNh/YU=";
+    "x86_64-linux" = "sha256-nlL+Ayacxz4fm404cABORSVGQcNxb3cB4mOezkrI90U=";
+  };
+in
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "models-dev";
+  version = "0-unstable-2025-07-14";
+  src = fetchFromGitHub {
+    owner = "sst";
+    repo = "models.dev";
+    rev = "2b0849aa20d48c28e2bac1fa3762aec867a2e7c7";
+    hash = "sha256-SC2yOy+6xjiGgRuRJY6wCtzWjFJm/DUy+gSlMXXDgAk=";
+  };
+
+  node_modules = stdenvNoCC.mkDerivation {
+    pname = "models-dev-node_modules";
+    inherit (finalAttrs) version src;
+
+    impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [
+      "GIT_PROXY_COMMAND"
+      "SOCKS_SERVER"
+    ];
+
+    nativeBuildInputs = [
+      bun
+      writableTmpDirAsHomeHook
+    ];
+
+    dontConfigure = true;
+
+    buildPhase = ''
+      runHook preBuild
+
+       export BUN_INSTALL_CACHE_DIR=$(mktemp -d)
+
+       bun install \
+         --force \
+         --frozen-lockfile \
+         --no-progress
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/node_modules
+      cp -R ./node_modules $out
+
+      runHook postInstall
+    '';
+
+    # Required else we get errors that our fixed-output derivation references store paths
+    dontFixup = true;
+
+    outputHash = models-dev-node-modules-hash.${stdenvNoCC.hostPlatform.system};
+    outputHashAlgo = "sha256";
+    outputHashMode = "recursive";
+  };
+
+  nativeBuildInputs = [ bun ];
+
+  configurePhase = ''
+    runHook preConfigure
+
+    cp -R ${finalAttrs.node_modules}/node_modules .
+
+    runHook postConfigure
+  '';
+
+  preBuild = ''
+    patchShebangs packages/web/script/build.ts
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    cd packages/web
+    bun run build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/dist
+    cp -R ./dist $out
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch" ];
+  };
+
+  meta = {
+    description = "Comprehensive open-source database of AI model specifications, pricing, and capabilities";
+    homepage = "https://github.com/sst/models-dev";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ delafthi ];
+  };
+})

pkgs/by-name/mo/modrinth-app-unwrapped/package.nix

@@ -37,6 +37,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-Q6e942R+3+511qFe4oehxdquw1TgaWMyOGOmP3me54o=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/mo/moonfire-nvr/package.nix

@@ -33,6 +33,7 @@ let
       inherit (finalAttrs) pname version src;
       sourceRoot = "${finalAttrs.src.name}/ui";
       hash = "sha256-7fMhUFlV5lz+A9VG8IdWoc49C2CTdLYQlEgBSBqJvtw=";
+      fetcherVersion = 1;
     };
     installPhase = ''
       runHook preInstall

pkgs/by-name/mo/moonlight/package.nix

@@ -28,6 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
     buildInputs = [ nodejs_22 ];
 
     hash = "sha256-vrSfrAnLc30kba+8VOPawdp8KaQVUhsD6mUq+YdAJTY=";
+    fetcherVersion = 1;
   };
 
   env = {

pkgs/by-name/mu/mutter/package.nix

@@ -72,7 +72,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mutter";
-  version = "48.3.1";
+  version = "48.4";
 
   outputs = [
     "out"
@@ -83,7 +83,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/mutter/${lib.versions.major finalAttrs.version}/mutter-${finalAttrs.version}.tar.xz";
-    hash = "sha256-BvimrX/0+HOa9q8uF1PJHfp7mDl+UpRmMloQGMeVCmo=";
+    hash = "sha256-EYnPfmPMh8/dHzqG6PFNl8M9ap2iVPI+gWVVSbbFDZM=";
   };
 
   mesonFlags = [

pkgs/by-name/n8/n8n/package.nix

@@ -29,6 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-HzJej2Mt110n+1KX0wzuAn6j69zQOzI42EGxQB6PYbc=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs =

pkgs/by-name/na/nautilus/package.nix

@@ -40,7 +40,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nautilus";
-  version = "48.2";
+  version = "48.3";
 
   outputs = [
     "out"
@@ -50,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/nautilus/${lib.versions.major finalAttrs.version}/nautilus-${finalAttrs.version}.tar.xz";
-    hash = "sha256-oDD2Fj+KaAZPrlqeieN/Gcuyk94uEqGd1eIQlW0N9LU=";
+    hash = "sha256-IaKuoAUWDbCDx6HU0sCYm4RcxyLATvnrtgElp+xbOT0=";
   };
 
   patches = [

pkgs/by-name/ni/ni/package.nix

@@ -25,6 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-gDBjAwut217mdbWyk/dSU4JOkoRbOk4Czlb/lXhWqRU=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/oc/ocis/package.nix

@@ -51,6 +51,7 @@ buildGoModule rec {
     inherit pname version src;
     sourceRoot = "${src.name}/services/idp";
     hash = "sha256-gNlN+u/bobnTsXrsOmkDcWs67D/trH3inT5AVQs3Brs=";
+    fetcherVersion = 1;
   };
   pnpmRoot = "services/idp";
 

pkgs/by-name/oc/ocis/web.nix

@@ -37,6 +37,7 @@ stdenvNoCC.mkDerivation rec {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
     hash = "sha256-3Erva6srdkX1YQ727trx34Ufx524nz19MUyaDQToz6M=";
+    fetcherVersion = 1;
   };
 
   meta = {

pkgs/by-name/op/opencloud/idp-web.nix

@@ -17,6 +17,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version src;
     sourceRoot = "${finalAttrs.src.name}/${finalAttrs.pnpmRoot}";
     hash = "sha256-yseRO1tClLTRpQj5BzMscElUlgLEzj1u8ndT1+di2+Y=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/op/opencloud/web.nix

@@ -21,6 +21,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-7wwviWveMf+xnYmO05MI3XuPVZ/pcSqQi4sGjrEdjGc=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/op/opencode/package.nix

@@ -12,10 +12,10 @@
 
 let
   opencode-node-modules-hash = {
-    "aarch64-darwin" = "sha256-+eXXWskZg0CIY12+Ee4Y3uwpB5I92grDiZ600Whzx/I=";
-    "aarch64-linux" = "sha256-rxLPrYAIiKDh6de/GACPfcYXY7nIskqAu1Xi12y5DpU=";
-    "x86_64-darwin" = "sha256-LOz7N6gMRaZLPks+y5fDIMOuUCXTWpHIss1v0LHPnqw=";
-    "x86_64-linux" = "sha256-GKLR+T+lCa7GFQr6HqSisfa4uf8F2b79RICZmePmCBE=";
+    "aarch64-darwin" = "sha256-uk8HQfHCKTAW54rNHZ1Rr0piZzeJdx6i4o0+xKjfFZs=";
+    "aarch64-linux" = "sha256-gDQh8gfFKl0rAujtos1XsCUnxC2Vjyq9xH5FLZoNW5s=";
+    "x86_64-darwin" = "sha256-H5+qa7vxhwNYRXUo4v8IFUToVXtyXzU3veIqu4idAbU=";
+    "x86_64-linux" = "sha256-1ZxetDrrRdNNOfDOW2uMwMwpEs5S3BLF+SejWcRdtik=";
   };
   bun-target = {
     "aarch64-darwin" = "bun-darwin-arm64";
@@ -26,12 +26,12 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "opencode";
-  version = "0.1.194";
+  version = "0.2.33";
   src = fetchFromGitHub {
     owner = "sst";
     repo = "opencode";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-51Mc0Qrg3C0JTpXl2OECKEUvle+6X+j9+/Blu8Nu9Ao=";
+    hash = "sha256-l/V9YHwuIPN73ieMT++enL1O5vecA9L0qBDGr8eRVxY=";
   };
 
   tui = buildGoModule {
@@ -39,7 +39,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     inherit (finalAttrs) version;
     src = "${finalAttrs.src}/packages/tui";
 
-    vendorHash = "sha256-hxtQHlaV2Em8CyTK3BNaoo/LgnGbMjj5XafbleF+p9I=";
+    vendorHash = "sha256-0vf4fOk32BLF9/904W8g+5m0vpe6i6tUFRXqDHVcMIQ=";
 
     subPackages = [ "cmd/opencode" ];
 
@@ -113,7 +113,11 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [ bun ];
 
-  patches = [ ./fix-models-macro.patch ];
+  patches = [
+    # Patch `packages/opencode/src/provider/models-macro.ts` to load the prefetched `models.dev/api.json`
+    # from the `MODELS_JSON` environment variable instead of fetching it at build time.
+    ./fix-models-macro.patch
+  ];
 
   configurePhase = ''
     runHook preConfigure
@@ -144,7 +148,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   installPhase = ''
     runHook preInstall
 
-    mkdir -p $out/bin
     install -Dm755 opencode $out/bin/opencode
 
     runHook postInstall

pkgs/by-name/op/openlist/frontend.nix

@@ -33,6 +33,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-PTZ+Vhg3hNnORnulkzuVg6TF/jY0PvUWYja9z7S4GdM=";
+    fetcherVersion = 1;
   };
 
   buildPhase = ''

pkgs/by-name/or/orthanc/package.nix

@@ -28,12 +28,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "orthanc";
-  version = "1.12.7";
+  version = "1.12.8";
 
   src = fetchhg {
     url = "https://orthanc.uclouvain.be/hg/orthanc/";
     rev = "Orthanc-${finalAttrs.version}";
-    hash = "sha256-aWUA8cCnWff5Tl8PWGJJtERlGh4GX4a8hTG9E2ADG9k=";
+    hash = "sha256-ktfTqCid/0aYAp5HPB7niZ1sw+zMNmd5mhZrXRbMGyk=";
   };
 
   outputs = [

pkgs/by-name/ov/overlayed/package.nix

@@ -36,6 +36,7 @@ rustPlatform.buildRustPackage rec {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
     hash = "sha256-+yyxoodcDfqJ2pkosd6sMk77/71RDsGthedo1Oigwto=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/pa/paperless-ngx/package.nix

@@ -70,6 +70,7 @@ let
       pnpmDeps = pnpm.fetchDeps {
         inherit pname version src;
         hash = "sha256-VtYYwpMXPAC3g1OESnw3dzLTwiGqJBQcicFZskEucok=";
+        fetcherVersion = 1;
       };
 
       nativeBuildInputs =
@@ -162,7 +163,17 @@ python.pkgs.buildPythonApplication rec {
       concurrent-log-handler
       dateparser
       django
-      django-allauth
+      # django-allauth version 65.9.X not yet supported
+      # See https://github.com/paperless-ngx/paperless-ngx/issues/10336
+      (django-allauth.overrideAttrs (
+        new: prev: rec {
+          version = "65.7.0";
+          src = prev.src.override {
+            tag = version;
+            hash = "sha256-1HmEJ5E4Vp/CoyzUegqQXpzKUuz3dLx2EEv7dk8fq8w=";
+          };
+        }
+      ))
       django-auditlog
       django-celery-results
       django-compression-middleware

pkgs/by-name/pa/parallel-disk-usage/package.nix

@@ -5,17 +5,17 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "parallel-disk-usage";
-  version = "0.12.0";
+  version = "0.13.1";
 
   src = fetchFromGitHub {
     owner = "KSXGitHub";
     repo = "parallel-disk-usage";
     rev = version;
-    hash = "sha256-Wj19lWepCrZe36njX+NMdpwXeRRh3ml9jKbbi7irrpg=";
+    hash = "sha256-gzjNi7ujYe7OZKYyrYk1xqqo/k8yBJdIwRoNASm5Db4=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-UK+jonM/ZBGoCKFcQlCo5OqYtKeU0VIWtx83oBh3lJQ=";
+  cargoHash = "sha256-3U61AkCicX7VNh1bf0IHPH5YX7qAtp4PvWi8FRKoBQI=";
 
   meta = with lib; {
     description = "Highly parallelized, blazing fast directory tree analyzer";

pkgs/by-name/pa/parca/package.nix

@@ -25,6 +25,7 @@ let
     pnpmDeps = pnpm_9.fetchDeps {
       inherit (finalAttrs) pname src version;
       hash = "sha256-gczEkCU9xESn9T1eVOmGAufh+24mOsYCMO6f5tcbdmQ=";
+      fetcherVersion = 1;
     };
 
     nativeBuildInputs = [

pkgs/by-name/pd/pds/package.nix

@@ -51,6 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
       sourceRoot
       ;
     hash = "sha256-KyHa7pZaCgyqzivI0Y7E6Y4yBRllYdYLnk1s0o0dyHY=";
+    fetcherVersion = 1;
   };
 
   buildPhase = ''