[Backport release-26.05] reposilite: 3.5.28 -> 3.6.2 (#556408)

(cherry picked from commit 1a09b1f853)

.editorconfig

@@ -23,15 +23,15 @@ insert_final_newline = false
 
 # see https://nixos.org/nixpkgs/manual/#chap-conventions
 
-[*.{bash,css,js,json,lock,md,nix,pl,pm,py,rb,sh,xml}]
+[*.{bash,css,js,json,lock,md,nix,pl,pm,py,rb,sh,ts,xml}]
 indent_style = space
 
 # Match docbook files, set indent width of one
 [*.xml]
 indent_size = 1
 
-# Match json/lockfiles/markdown/nix/ruby files, set indent width of two
-[*.{js,json,lock,md,nix,rb}]
+# Match js/json/lockfiles/markdown/nix/ruby/ts files, set indent width of two
+[*.{js,json,lock,md,nix,rb,ts}]
 indent_size = 2
 
 # Match all the Bash code in Nix files, set indent width of two

.github/actions/checkout/action.yml

@@ -13,7 +13,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+    - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       env:
         MERGED_SHA: ${{ inputs.merged-as-untrusted-at }}
         TARGET_SHA: ${{ inputs.target-as-trusted-at }}

.github/dependabot.yml

@@ -1,7 +1,9 @@
 version: 2
 updates:
   - package-ecosystem: "github-actions"
-    directory: "/"
+    directories:
+      - "/"
+      - ".github/actions/*/*"
     schedule:
       interval: "weekly"
     labels: []

.github/workflows/build.yml

@@ -59,7 +59,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
         with:
           # Sandbox is disabled on MacOS by default.
           extra_nix_config: sandbox = true

.github/workflows/check.yml

@@ -134,6 +134,35 @@ jobs:
           GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
         run: gh api /rate_limit | jq
 
+  github-script:
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+          sparse-checkout: .github/actions
+
+      - name: Checkout merge and target commits
+        uses: ./.github/actions/checkout
+        with:
+          merged-as-untrusted-at: ${{ inputs.mergedSha }}
+          target-as-trusted-at: ${{ inputs.targetSha }}
+
+      - name: Install dependencies to trusted/
+        run: |
+          npm ci --package-lock-only=false
+          echo "$PWD/node_modules/.bin" >> "$GITHUB_PATH"
+        working-directory: nixpkgs/trusted/ci/github-script
+
+      - name: Link trusted/ dependencies to untrusted/
+        run: ln -s "$PWD/trusted/ci/github-script/node_modules" untrusted/ci/github-script/node_modules
+        working-directory: nixpkgs
+
+      - name: Type-check ci/github-script
+        run: tsc --build
+        working-directory: nixpkgs/untrusted/ci/github-script
+
   owners:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 5
@@ -142,13 +171,14 @@ jobs:
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
+
       - name: Checkout merge and target commits
         uses: ./.github/actions/checkout
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true

.github/workflows/eval.yml

@@ -139,7 +139,7 @@ jobs:
             core.info(`Found pinned.json commit: ${ciPinBumpCommit}`)
 
       - name: Install Nix
-        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
 
       - name: Load supported versions
         id: versions
@@ -187,7 +187,7 @@ jobs:
           target-as-trusted-at: ${{ inputs.targetSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true
@@ -277,7 +277,7 @@ jobs:
           merge-multiple: true
 
       - name: Install Nix
-        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
 
       - name: Combine all output paths and eval stats
         run: |
@@ -375,7 +375,7 @@ jobs:
         with:
           github-token: ${{ steps.app-token.outputs.token || github.token }}
           script: |
-            require('./nixpkgs/trusted/ci/github-script/check-target-branch.js')({
+            require('./nixpkgs/trusted/ci/github-script/check-target-branch.ts')({
               github,
               context,
               core,
@@ -486,7 +486,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
 
       - name: Ensure flake outputs on all systems still evaluate
         run: nix flake check --all-systems --no-build './nixpkgs/untrusted?shallow=1'

.github/workflows/lint.yml

@@ -35,7 +35,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
 
       # TODO: Figure out how to best enable caching for the treefmt job. Cachix won't work well,
       # because the cache would be invalidated on every commit - treefmt checks every file.
@@ -70,7 +70,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true
@@ -100,7 +100,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true

.github/workflows/test.yml

@@ -77,7 +77,7 @@ jobs:
               '.github/workflows/pull-request-target.yml',
               '.github/workflows/test.yml',
               'ci/github-script/bot.js',
-              'ci/github-script/check-target-branch.js',
+              'ci/github-script/check-target-branch.ts',
               'ci/github-script/commits.js',
               'ci/github-script/get-pr-commit-details.js',
               'ci/github-script/lint-commits.js',

CONTRIBUTING.md

@@ -571,7 +571,10 @@ If a contributor does not want committers to push to their branch, they must unc
 
 ### Release notes
 
-If you removed packages or made some major NixOS changes, write about it in the next release notes in [`nixos/doc/manual/release-notes`](./nixos/doc/manual/release-notes).
+If you add or remove a NixOS module, or make other breaking or significant NixOS changes, write about it in the next NixOS release notes in [`nixos/doc/manual/release-notes`](./nixos/doc/manual/release-notes).
+
+If you make major or breaking changes to a package (other than removal), write about it in the next Nixpkgs release notes in [`doc/release-notes`](./doc/release-notes).
+Package removals should not get a Nixpkgs release note, [a throwing alias should be added instead](./pkgs/README.md#steps-to-remove-a-package-from-nixpkgs).
 
 ### File naming and organisation
 

ci/OWNERS

@@ -502,7 +502,7 @@ pkgs/by-name/oc/octodns/ @anthonyroussel
 pkgs/by-name/te/teleport*     @arianvp @justinas @sigma @tomberek @techknowlogick @JuliusFreudenberger
 
 # Warp-terminal
-pkgs/by-name/wa/warp-terminal/  @emilytrau @imadnyc @FlameFlag @johnrtitor
+pkgs/by-name/wa/warp-terminal/  @emilytrau @imadnyc @4evy @johnrtitor
 
 # Nim
 /doc/languages-frameworks/nim.section.md  @NixOS/nim

ci/github-script/.gitignore

@@ -1,2 +1,5 @@
+comparison
+comparison.zip
 node_modules
 step-summary.md
+*.tsbuildinfo

ci/github-script/bot.js

@@ -1,3 +1,4 @@
+// @ts-nocheck
 module.exports = async ({ github, context, core, dry }) => {
   const path = require('node:path')
   const { DefaultArtifactClient } = await import('@actions/artifact')

ci/github-script/check-target-branch.ts

@@ -1,4 +1,6 @@
-/// @ts-check
+import type * as actionsCore from '@actions/core'
+import type { context as actionsContext } from '@actions/github'
+import type { GitHub } from '@actions/github/lib/utils'
 
 // TODO: should this be combined with the branch checks in prepare.js?
 // They do seem quite similar, but this needs to run after eval,
@@ -9,39 +11,47 @@ const { readFile } = require('node:fs/promises')
 const { postReview, dismissReviews } = require('./reviews.js')
 
 const reviewKey = 'check-target-branch'
-/**
- * @param {{
- *  github: InstanceType<import('@actions/github/lib/utils').GitHub>,
- *  context: typeof import('@actions/github').context
- *  core: import('@actions/core')
- *  dry: boolean
- * }} CheckTargetBranchProps
- */
-async function checkTargetBranch({ github, context, core, dry }) {
-  /**
-   * @type {{
-   *  attrdiff: {
-   *   added: string[],
-   *   changed: string[],
-   *   removed: string[],
-   *  },
-   *  attrdiffByKernel: Record<string, {
-   *   added: string[],
-   *   changed: string[],
-   *   removed: string[],
-   *  }>,
-   *  attrdiffByPlatform: Record<string, {
-   *   added: string[],
-   *   changed: string[],
-   *   removed: string[],
-   *  }>,
-   *  labels: Record<string, boolean>,
-   *  rebuildCountByKernel: Record<string, number>,
-   *  rebuildsByKernel: Record<string, string[]>,
-   *  rebuildsByPlatform: Record<string, string[]>,
-   * }}
-   */
-  const changed = JSON.parse(
+
+type ChangedPaths = {
+  attrdiff: {
+    added: string[]
+    changed: string[]
+    removed: string[]
+  }
+  attrdiffByKernel: Record<
+    string,
+    {
+      added: string[]
+      changed: string[]
+      removed: string[]
+    }
+  >
+  attrdiffByPlatform: Record<
+    string,
+    {
+      added: string[]
+      changed: string[]
+      removed: string[]
+    }
+  >
+  labels: Record<string, boolean>
+  rebuildCountByKernel: Record<string, number>
+  rebuildsByKernel: Record<string, string[]>
+  rebuildsByPlatform: Record<string, string[]>
+}
+
+async function checkTargetBranch({
+  github,
+  context,
+  core,
+  dry,
+}: {
+  github: InstanceType<typeof GitHub>
+  context: typeof actionsContext
+  core: typeof actionsCore
+  dry: boolean
+}) {
+  const changed: ChangedPaths = JSON.parse(
     await readFile('comparison/changed-paths.json', 'utf-8'),
   )
   const pull_number = context.payload.pull_request?.number
@@ -155,7 +165,7 @@ async function checkTargetBranch({ github, context, core, dry }) {
       reviewKey,
     })
   } else if (rebuildsAllTests && !isExemptKernelUpdate) {
-    let branchText
+    let branchText: string
     if (base === 'master' && maxRebuildCount >= 500) {
       branchText = '(probably either `staging-nixos` or `staging`)'
     } else if (base === 'master') {

ci/github-script/commits.js

@@ -1,3 +1,4 @@
+// @ts-nocheck
 module.exports = async ({ github, context, core, dry, cherryPicks }) => {
   const { execFileSync } = require('node:child_process')
   const { classify } = require('../supportedBranches.js')

ci/github-script/get-pr-commit-details.js

@@ -1,4 +1,4 @@
-// @ts-check
+// @ts-nocheck
 const { promisify } = require('node:util')
 const execFile = promisify(require('node:child_process').execFile)
 
@@ -16,7 +16,7 @@ const execFile = promisify(require('node:child_process').execFile)
 /**
  * @param {{
  *  args: string[]
- *  core: import('@actions/core'),
+ *  core: typeof import('@actions/core'),
  *  quiet?: boolean,
  *  repoPath?: string,
  * }} RunGitProps
@@ -40,7 +40,7 @@ async function runGit({ args, repoPath, core, quiet }) {
  * of 250 commits and doesn't return the changed files.
  *
  * @param {{
- *  core: import('@actions/core'),
+ *  core: typeof import('@actions/core'),
  *  pr: Awaited<ReturnType<InstanceType<import('@actions/github/lib/utils').GitHub>["rest"]["pulls"]["get"]>>["data"]
  *  repoPath?: string,
  * }} GetCommitMessagesForPRProps

ci/github-script/get-teams.js

@@ -1,3 +1,4 @@
+// @ts-nocheck
 const excludeTeams = [
   /^voters.*$/,
   /^nixpkgs-maintainers$/,

ci/github-script/lint-commits.js

@@ -1,4 +1,3 @@
-// @ts-check
 const { classify } = require('../supportedBranches.js')
 const { getCommitDetailsForPR } = require('./get-pr-commit-details.js')
 
@@ -6,9 +5,9 @@ const { getCommitDetailsForPR } = require('./get-pr-commit-details.js')
 
 /**
  * @param {{
- *  github: InstanceType<import('@actions/github/lib/utils').GitHub>,
+ *  github: InstanceType<typeof import('@actions/github/lib/utils').GitHub>,
  *  context: typeof import('@actions/github').context,
- *  core: import('@actions/core'),
+ *  core: typeof import('@actions/core'),
  *  repoPath?: string,
  * }} LintCommitsProps
  */
@@ -57,7 +56,7 @@ async function lintCommits({ github, context, core, repoPath }) {
 /**
  * @param {{
  *  commits: Commit[],
- *  core: import('@actions/core'),
+ *  core: typeof import('@actions/core'),
  * }} CheckCommitMessagesProps
  */
 async function checkCommitMessages({ commits, core }) {
@@ -170,7 +169,7 @@ async function checkCommitMessages({ commits, core }) {
 /**
  * @param {{
  *  commits: Commit[],
- *  core: import('@actions/core'),
+ *  core: typeof import('@actions/core'),
  * }} CheckGitFieldsProps
  */
 async function checkCommitMetadata({ commits, core }) {

ci/github-script/manual-file-edits.js

@@ -1,12 +1,11 @@
-// @ts-check
 const { classify } = require('../supportedBranches.js')
 const { getCommitDetailsForPR } = require('./get-pr-commit-details')
 
 /**
  * @param {{
- *  github: InstanceType<import('@actions/github/lib/utils').GitHub>,
+ *  github: InstanceType<typeof import('@actions/github/lib/utils').GitHub>,
  *  context: typeof import('@actions/github').context,
- *  core: import('@actions/core'),
+ *  core: typeof import('@actions/core'),
  *  repoPath?: string,
  *  dry: boolean,
  * }} CheckManualFileEditsProps

ci/github-script/merge.js

@@ -1,3 +1,4 @@
+// @ts-nocheck
 const { classify } = require('../supportedBranches.js')
 
 function runChecklist({

ci/github-script/package-lock.json

@@ -10,6 +10,11 @@
         "@actions/github": "9.1.0",
         "bottleneck": "2.19.5",
         "commander": "14.0.3"
+      },
+      "devDependencies": {
+        "@tsconfig/node24": "24.0.4",
+        "@types/node": "24.13.3",
+        "typescript": "7.0.2"
       }
     },
     "node_modules/@actions/artifact": {
@@ -588,6 +593,19 @@
         "protoc-gen-ts": "bin/protoc-gen-ts"
       }
     },
+    "node_modules/@protobuf-ts/plugin/node_modules/typescript": {
+      "version": "3.9.10",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-3.9.10.tgz",
+      "integrity": "sha512-w6fIxVE/H1PkLKcCPsFqKE7Kv7QUwhU8qQY2MueZXWx5cPZdwFupLgKK3vntcK98BtNHZtAF4LA/yl2a7k8R6Q==",
+      "license": "Apache-2.0",
+      "bin": {
+        "tsc": "bin/tsc",
+        "tsserver": "bin/tsserver"
+      },
+      "engines": {
+        "node": ">=4.2.0"
+      }
+    },
     "node_modules/@protobuf-ts/protoc": {
       "version": "2.11.1",
       "resolved": "https://registry.npmjs.org/@protobuf-ts/protoc/-/protoc-2.11.1.tgz",
@@ -612,6 +630,343 @@
         "@protobuf-ts/runtime": "^2.11.1"
       }
     },
+    "node_modules/@tsconfig/node24": {
+      "version": "24.0.4",
+      "resolved": "https://registry.npmjs.org/@tsconfig/node24/-/node24-24.0.4.tgz",
+      "integrity": "sha512-2A933l5P5oCbv6qSxHs7ckKwobs8BDAe9SJ/Xr2Hy+nDlwmLE1GhFh/g/vXGRZWgxBg9nX/5piDtHR9Dkw/XuA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/node": {
+      "version": "24.13.3",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.13.3.tgz",
+      "integrity": "sha512-Dh8vAsV36ig5wa9OX4pXvMc9D3Veibfw2wix0CUwYODLD8nkj9UsLjASr49nPg+2eKzxhBV+v7L8pXvT4e639Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "undici-types": "~7.18.0"
+      }
+    },
+    "node_modules/@typescript/typescript-aix-ppc64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-aix-ppc64/-/typescript-aix-ppc64-7.0.2.tgz",
+      "integrity": "sha512-MTKKkWB7p/0E9xi1d1tHtZ5PiLkGEMIq88pK2CubZjOsLtYTLqhgIgi6zepFa+9GHZ6h05NMCkQxGKiPXMxXtQ==",
+      "cpu": [
+        "ppc64"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "aix"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-darwin-arm64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-darwin-arm64/-/typescript-darwin-arm64-7.0.2.tgz",
+      "integrity": "sha512-gowzar9MwS/aRWp6f3a4KUqzRjAZjOsmGNCM6LcTgXum+dBfgsBVMN+AgvOCCbguXyick6LJhpBszxMebJ8syA==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-darwin-x64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-darwin-x64/-/typescript-darwin-x64-7.0.2.tgz",
+      "integrity": "sha512-SZ9xZInqApNlNGc9s0W1VSsktYSOe9cFqNOIqmN1Gs8SmkjKZYFt017G4VwPxASInODuAdbTW7sXiFUf893RgA==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-freebsd-arm64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-freebsd-arm64/-/typescript-freebsd-arm64-7.0.2.tgz",
+      "integrity": "sha512-W5NH4y/J0plIIS5b2xvTEkU7JFxyqdMAOgf+Ilhl0vHQXKO5dZoxd+C/jEtq56c4F3wk71RB4BMRQ2XdI+bwYQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-freebsd-x64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-freebsd-x64/-/typescript-freebsd-x64-7.0.2.tgz",
+      "integrity": "sha512-UMGDx5sTpzNw3WiPebH7l90IWfJggEd+egHt/q6p7/Cm3zqoV7VxkGXt+3DxPIw8CcmvAB0j3sVVfbhX+M4Tpw==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-arm": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-arm/-/typescript-linux-arm-7.0.2.tgz",
+      "integrity": "sha512-gffT3xPz9sR7j/YJExkyPntrI0P2EP9XbOyWzth2/Gs0RstK+90RBcO0ncXoXy/beYll1SXw846Nf2zdnEz0QQ==",
+      "cpu": [
+        "arm"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-arm64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-arm64/-/typescript-linux-arm64-7.0.2.tgz",
+      "integrity": "sha512-Qh4eU4/y3yDjnfjjyPYihMj5/ODIlmt+Bzu17OI+fiSRDW57QmU5SiN63exPRNJPKUzcc1INa1NXdrJ+MqHjUQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-loong64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-loong64/-/typescript-linux-loong64-7.0.2.tgz",
+      "integrity": "sha512-uEHck9i8hoAzXPiYRib1O7miOnz23SxIeVl6F4LXox+qov1K35jHcEW6VHKvZI+pyvl7fZEP4MCU5LYvIq1GuQ==",
+      "cpu": [
+        "loong64"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-mips64el": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-mips64el/-/typescript-linux-mips64el-7.0.2.tgz",
+      "integrity": "sha512-R4KvAMnE43W5Qeqb0Ly56O3mWMWIAgsMyz36DCaycd5nbg/9kzm0liw3JocfRqyJY0KPmzFjbswozXyW0DnIYA==",
+      "cpu": [
+        "mips64el"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-ppc64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-ppc64/-/typescript-linux-ppc64-7.0.2.tgz",
+      "integrity": "sha512-DORx5b3sd/4S7eayxm4FQv+A7CrkUIGRaHiwI8oiHTAI1fAPWhF4J0vAlkC8biAlHSVVwxMQ3tjZ2/DVbnQiiA==",
+      "cpu": [
+        "ppc64"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-riscv64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-riscv64/-/typescript-linux-riscv64-7.0.2.tgz",
+      "integrity": "sha512-wf0jqEDOjrPRnKwYRyyJDRo11KMbvMFrU+q4zqKyChODBzvlkbhNQfKvLxQCcwTpdDaXSHZTVuh0JoCrKCUMHQ==",
+      "cpu": [
+        "riscv64"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-s390x": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-s390x/-/typescript-linux-s390x-7.0.2.tgz",
+      "integrity": "sha512-IkwJc3L7yhytWd/ewjyxNDfOmswCm9GWMJT/ue/dU4aZNbwZeYAetq42VyLmsmSjvoX7z74X6ZaYCtzAr0EuGw==",
+      "cpu": [
+        "s390x"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-x64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-x64/-/typescript-linux-x64-7.0.2.tgz",
+      "integrity": "sha512-EYdf2cNg7rgCWJnxCdJ+F3V39O8ihb37eHAu1LK8oAFizgTQbPOK7zHHXbPt8rX24COqODXeI3sIf0fCXG7H/A==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-netbsd-arm64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-netbsd-arm64/-/typescript-netbsd-arm64-7.0.2.tgz",
+      "integrity": "sha512-+polYF4MF04aPpO5FTkHran9yUQDSXqy5GiSDKpsll5jy3l3+g9QLhpf39T+ePtefhXLOGrLl0QIjkQP6VnelA==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-netbsd-x64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-netbsd-x64/-/typescript-netbsd-x64-7.0.2.tgz",
+      "integrity": "sha512-8YIT0EHM/3dq10ZOVF/A7pc/YSMtbcecct4rWtexrnSCHOPcpC2KTLXfTCR6vDpnSiY12heNb1GiN/wu+T/FyA==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-openbsd-arm64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-openbsd-arm64/-/typescript-openbsd-arm64-7.0.2.tgz",
+      "integrity": "sha512-APT8+ClYnuYm1u9+kgGXoMj2VzWzcymwh2gNSQVySHfkRDGOTVkoWLjCmOQSaO+PoqQ57B0flRp9SA+7GnnkzQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-openbsd-x64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-openbsd-x64/-/typescript-openbsd-x64-7.0.2.tgz",
+      "integrity": "sha512-yX7s+Q0Dln0Dt9tEzZsAjXXR/+ytBM7AlglaqyeMPxQszJ1JhlJdZ6jLA+IzldHtflX81em7lDao1xXu+aRRkg==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-sunos-x64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-sunos-x64/-/typescript-sunos-x64-7.0.2.tgz",
+      "integrity": "sha512-dLJDGaLZ1D4HPQn62u1n8mBDkJREwMsAkCdkwd4Ieqw+x3TUyTsqY0YiBCtE6H6OzzgGk3iuZ3vFWRS+E8/d1g==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "sunos"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-win32-arm64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-win32-arm64/-/typescript-win32-arm64-7.0.2.tgz",
+      "integrity": "sha512-Gyl1Vy6OsWesLzmq+EP0Fb7b4Nid5232AvcA2SFcdYreldpNtYFFofPjnt62y9hQy7VTaZp65ICJjuAQRaVcIQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-win32-x64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-win32-x64/-/typescript-win32-x64-7.0.2.tgz",
+      "integrity": "sha512-0BQ3HkAHHlKLSp1qRvf3SUhGpGsDuhB/jgFw75guyqbxJqEaS0Cw/VFO8i2nHglJUzQCRtMMR/IBAKE3ETMC4g==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
     "node_modules/@typescript/vfs": {
       "version": "1.6.1",
       "resolved": "https://registry.npmjs.org/@typescript/vfs/-/vfs-1.6.1.tgz",
@@ -1657,16 +2012,37 @@
       }
     },
     "node_modules/typescript": {
-      "version": "3.9.10",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-3.9.10.tgz",
-      "integrity": "sha512-w6fIxVE/H1PkLKcCPsFqKE7Kv7QUwhU8qQY2MueZXWx5cPZdwFupLgKK3vntcK98BtNHZtAF4LA/yl2a7k8R6Q==",
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-7.0.2.tgz",
+      "integrity": "sha512-8FYau96o3NKOhbjKi/qNvG/W5jhzxkbdm5sj9AbZ/5T5sWqn3hJgLfGx27sRKZWTvyzCP8dLRBTf5tBTSRVUNA==",
       "license": "Apache-2.0",
       "bin": {
-        "tsc": "bin/tsc",
-        "tsserver": "bin/tsserver"
+        "tsc": "bin/tsc"
       },
       "engines": {
-        "node": ">=4.2.0"
+        "node": ">=16.20.0"
+      },
+      "optionalDependencies": {
+        "@typescript/typescript-aix-ppc64": "7.0.2",
+        "@typescript/typescript-darwin-arm64": "7.0.2",
+        "@typescript/typescript-darwin-x64": "7.0.2",
+        "@typescript/typescript-freebsd-arm64": "7.0.2",
+        "@typescript/typescript-freebsd-x64": "7.0.2",
+        "@typescript/typescript-linux-arm": "7.0.2",
+        "@typescript/typescript-linux-arm64": "7.0.2",
+        "@typescript/typescript-linux-loong64": "7.0.2",
+        "@typescript/typescript-linux-mips64el": "7.0.2",
+        "@typescript/typescript-linux-ppc64": "7.0.2",
+        "@typescript/typescript-linux-riscv64": "7.0.2",
+        "@typescript/typescript-linux-s390x": "7.0.2",
+        "@typescript/typescript-linux-x64": "7.0.2",
+        "@typescript/typescript-netbsd-arm64": "7.0.2",
+        "@typescript/typescript-netbsd-x64": "7.0.2",
+        "@typescript/typescript-openbsd-arm64": "7.0.2",
+        "@typescript/typescript-openbsd-x64": "7.0.2",
+        "@typescript/typescript-sunos-x64": "7.0.2",
+        "@typescript/typescript-win32-arm64": "7.0.2",
+        "@typescript/typescript-win32-x64": "7.0.2"
       }
     },
     "node_modules/undici": {
@@ -1681,6 +2057,13 @@
         "node": ">=14.0"
       }
     },
+    "node_modules/undici-types": {
+      "version": "7.18.2",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.18.2.tgz",
+      "integrity": "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/universal-user-agent": {
       "version": "7.0.3",
       "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-7.0.3.tgz",

ci/github-script/package.json

@@ -10,5 +10,10 @@
     "@actions/github": "9.1.0",
     "bottleneck": "2.19.5",
     "commander": "14.0.3"
+  },
+  "devDependencies": {
+    "@tsconfig/node24": "24.0.4",
+    "@types/node": "24.13.3",
+    "typescript": "7.0.2"
   }
 }

ci/github-script/prepare.js

@@ -1,3 +1,4 @@
+// @ts-nocheck
 const { classify } = require('../supportedBranches.js')
 const { postReview, dismissReviews } = require('./reviews.js')
 const reviewKey = 'prepare'

ci/github-script/reviewers.js

@@ -1,3 +1,4 @@
+// @ts-nocheck
 async function handleReviewers({
   github,
   context,

ci/github-script/reviews.js

@@ -1,5 +1,3 @@
-// @ts-check
-
 const eventToState = {
   COMMENT: 'COMMENTED',
   REQUEST_CHANGES: 'CHANGES_REQUESTED',
@@ -16,7 +14,7 @@ const reviewUsers = [
 ]
 
 /**
- * @typedef {InstanceType<import('@actions/github/lib/utils').GitHub>} GitHub
+ * @typedef {InstanceType<typeof import('@actions/github/lib/utils').GitHub>} GitHub
  * @typedef {typeof import('@actions/github').context} Context
  *
  * @typedef {Awaited<ReturnType<GitHub['rest']['pulls']['listReviews']>>['data'][number]} Review
@@ -27,7 +25,7 @@ const reviewUsers = [
  * @param {{
  *  github: GitHub,
  *  context: Context,
- *  core: import('@actions/core'),
+ *  core: typeof import('@actions/core'),
  *  dry: boolean,
  *  reviewKey?: string,
  * }} DismissReviewsProps
@@ -165,10 +163,10 @@ async function dismissReviews({ github, context, core, dry, reviewKey }) {
  * @param {{
  *  github: GitHub,
  *  context: Context,
- *  core: import('@actions/core'),
+ *  core: typeof import('@actions/core'),
  *  dry: boolean,
  *  body: string,
- *  event: keyof eventToState,
+ *  event: keyof typeof eventToState,
  *  reviewKey: string,
  * }} PostReviewProps
  */

ci/github-script/run

@@ -112,8 +112,8 @@ program
   .argument('<repo>', 'Name of the GitHub repository to run on (Example: nixpkgs)')
   .argument('<pr>', 'Number of the Pull Request to run on')
   .action(async (owner, repo, pr, options) => {
-    const checkCommitMessages = (await import('./check-target-branch.js')).default
-    await run(checkCommitMessages, owner, repo, pr, options)
+    const checkTargetBranch = (await import('./check-target-branch.ts')).default
+    await run(checkTargetBranch, owner, repo, pr, options)
   })
 
 program

ci/github-script/supportedSystems.js

@@ -1,3 +1,4 @@
+// @ts-nocheck
 module.exports = async ({ github, context, targetSha }) => {
   const { content, encoding } = (
     await github.rest.repos.getContent({

ci/github-script/tsconfig.json

@@ -0,0 +1,26 @@
+{
+  "compilerOptions": {
+    "lib": [
+      "es2024",
+      "ESNext.Array",
+      "ESNext.Collection",
+      "ESNext.Error",
+      "ESNext.Iterator",
+      "ESNext.Promise"
+    ],
+    "module": "nodenext",
+    "target": "es2024",
+
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "moduleResolution": "node16",
+
+    "allowImportingTsExtensions": true,
+    "allowJs": true,
+    "checkJs": true,
+    "erasableSyntaxOnly": true,
+    "verbatimModuleSyntax": true,
+    "noEmit": true,
+  }
+}

ci/github-script/withRateLimit.js

@@ -1,3 +1,4 @@
+// @ts-nocheck
 module.exports = async ({ github, core, maxConcurrent = 1 }, callback) => {
   const Bottleneck = require('bottleneck')
 

ci/supportedBranches.js

@@ -2,6 +2,7 @@
 /*
 #!nix-shell -i node -p nodejs
 */
+// @ts-nocheck
 
 const typeConfig = {
   master: ['development', 'primary'],

doc/languages-frameworks/ocaml.section.md

@@ -59,6 +59,9 @@ Here is a simple package example.
 - The library will be installed using the `angstrom.install` file that dune
   generates.
 
+- It also accepts an optional `dunePackages` argument, if there is more than one
+  dune package that needs to be built (see `zipperposition`)
+
 ```nix
 {
   lib,

maintainers/github-teams.json

@@ -2,11 +2,10 @@
   "acme": {
     "description": "Maintain ACME-related packages and modules.",
     "id": 3806126,
-    "maintainers": {
-      "emilazy": 18535642
-    },
+    "maintainers": {},
     "members": {
       "arianvp": 628387,
+      "emilazy": 18535642,
       "m1cr0man": 3044438
     },
     "name": "ACME"
@@ -60,7 +59,6 @@
       "adamcstephens": 2071575,
       "ankhers": 750786,
       "gleber": 33185,
-      "minijackson": 1200507,
       "yurrriq": 1866448
     },
     "name": "Beam"
@@ -68,11 +66,10 @@
   "boot-security": {
     "description": "Maintain support for boot security technologies like Secure Boot",
     "id": 18686947,
-    "maintainers": {
-      "emilazy": 18535642
-    },
+    "maintainers": {},
     "members": {
-      "ElvishJerricco": 1365692
+      "ElvishJerricco": 1365692,
+      "emilazy": 18535642
     },
     "name": "Boot security"
   },
@@ -98,8 +95,8 @@
       "fgaz": 8182846,
       "natsukium": 25083790,
       "philiptaron": 43863,
-      "pyrotelekinetic": 29682759,
-      "tomodachi94": 68489118
+      "tomodachi94": 68489118,
+      "tr3foil": 29682759
     },
     "members": {},
     "name": "Categorization"
@@ -184,7 +181,6 @@
     "description": "Improve Darwin-support across Nixpkgs and help maintainers without access to Darwin hardware. Apply to join through https://github.com/NixOS/nixpkgs/issues/323144 to keep the process transparent.",
     "id": 2385202,
     "maintainers": {
-      "emilazy": 18535642,
       "toonn": 1486805
     },
     "members": {
@@ -211,10 +207,12 @@
       "cideM": 4246921,
       "cidkidnix": 67574902,
       "copumpkin": 2623,
+      "delafthi": 50531499,
       "devusb": 4951663,
       "domenkozar": 126339,
       "dwt": 57199,
       "eclairevoyant": 848000,
+      "emilazy": 18535642,
       "ethancedwards8": 60861925,
       "fiddlerwoaroof": 808745,
       "fulsomenko": 14945057,
@@ -580,11 +578,11 @@
     "id": 9955829,
     "maintainers": {
       "RossComputerGuy": 19699320,
-      "alyssais": 2768870,
-      "emilazy": 18535642
+      "alyssais": 2768870
     },
     "members": {
       "Ericson2314": 1055245,
+      "emilazy": 18535642,
       "peterwaller-arm": 52030119,
       "rrbutani": 7833358
     },
@@ -696,8 +694,8 @@
       "eclairevoyant": 848000
     },
     "members": {
-      "Eveeifyeve": 88671402,
-      "daylinmorgan": 47667941
+      "daylinmorgan": 47667941,
+      "eveeifyeve": 88671402
     },
     "name": "nim"
   },
@@ -756,16 +754,6 @@
     },
     "name": "Nixpkgs CI"
   },
-  "nixpkgs-core": {
-    "description": "Provides leadership for and has authority over Nixpkgs.",
-    "id": 14317027,
-    "maintainers": {
-      "alyssais": 2768870,
-      "emilazy": 18535642
-    },
-    "members": {},
-    "name": "Nixpkgs core"
-  },
   "nixpkgs-merge-bot": {
     "description": "This team exists as a target for triggering the nixpkgs merge bot.",
     "id": 13926892,
@@ -800,10 +788,11 @@
     "description": "Maintain Pantheon desktop environment and platform",
     "id": 4786995,
     "maintainers": {
+      "bobby285271": 20080233,
       "davidak": 91113
     },
     "members": {
-      "bobby285271": 20080233
+      "amz-x": 18249234
     },
     "name": "Pantheon"
   },
@@ -907,7 +896,6 @@
       "0x4A6F": 9675338
     },
     "members": {
-      "DarkKirb": 23011243,
       "dramforever": 2818072,
       "fgaz": 8182846,
       "jonhermansen": 660911
@@ -1001,11 +989,11 @@
     "id": 11265412,
     "maintainers": {
       "RossComputerGuy": 19699320,
-      "emilazy": 18535642,
       "philiptaron": 43863
     },
     "members": {
       "Ericson2314": 1055245,
+      "emilazy": 18535642,
       "reckenrode": 7413633
     },
     "name": "stdenv"

maintainers/maintainer-list.nix

@@ -257,6 +257,12 @@
     githubId = 3417013;
     name = "Eske Nielsen";
   };
+  _4evy = {
+    name = "4evy";
+    email = "git@evy.pink";
+    github = "4evy";
+    githubId = 57304299;
+  };
   _4r7if3x = {
     email = "the.artifex@proton.me";
     matrix = "@4r7if3x:matrix.org";
@@ -1958,6 +1964,12 @@
     githubId = 14838767;
     name = "Jacopo Scannella";
   };
+  antoineco = {
+    email = "hello@acotten.com";
+    github = "antoineco";
+    githubId = 3299086;
+    name = "Antoine Cotten";
+  };
   anton-4 = {
     name = "Anton";
     github = "Anton-4";
@@ -2102,6 +2114,12 @@
     githubId = 8436007;
     name = "Aria Edmonds";
   };
+  ar4m1s = {
+    name = "Aramis";
+    github = "Ar4m1s";
+    githubId = 59250656;
+    matrix = "@vegardbm:matrix.org";
+  };
   arbel-arad = {
     email = "arbel@spacetime.technology";
     github = "arbel-arad";
@@ -3550,13 +3568,6 @@
     githubId = 185443;
     name = "Alexey Lebedeff";
   };
-  binary-eater = {
-    email = "sergeantsagara@protonmail.com";
-    github = "Binary-Eater";
-    githubId = 10691440;
-    name = "Rahul Rameshbabu";
-    keys = [ { fingerprint = "678A 8DF1 D9F2 B51B 7110  BE53 FF24 7B3E 5411 387B"; } ];
-  };
   binarycat = {
     email = "binarycat@envs.net";
     github = "lolbinarycat";
@@ -7981,6 +7992,12 @@
     githubId = 1365692;
     name = "Will Fancher";
   };
+  elzorrorebelde = {
+    name = "Jorge Javier Araya Navarro";
+    email = "jorge@esavara.cr";
+    github = "elzorrorebelde";
+    githubId = 1055216;
+  };
   emaiax = {
     email = "github@emaiax.dev";
     github = "emaiax";
@@ -9017,13 +9034,6 @@
     name = "Sebastian Neubauer";
     keys = [ { fingerprint = "2F93 661D AC17 EA98 A104  F780 ECC7 55EE 583C 1672"; } ];
   };
-  FlameFlag = {
-    name = "FlameFlag";
-    email = "github@flameflag.dev";
-    github = "FlameFlag";
-    githubId = 57304299;
-    matrix = "@donteatoreo:matrix.org";
-  };
   Flameopathic = {
     email = "flameopathic@gmail.com";
     github = "Flameopathic";
@@ -23364,6 +23374,12 @@
     githubId = 12279531;
     name = "Ricardo Guevara";
   };
+  rharish = {
+    email = "harish.rajagopals@gmail.com";
+    github = "rharish101";
+    githubId = 25344287;
+    name = "Harish Rajagopal";
+  };
   rhelmot = {
     name = "Audrey Dutcher";
     github = "rhelmot";
@@ -25123,12 +25139,6 @@
     githubId = 5512096;
     name = "Sébastien Guimmara";
   };
-  shackra = {
-    name = "Jorge Javier Araya Navarro";
-    email = "jorge@esavara.cr";
-    github = "shackra";
-    githubId = 1055216;
-  };
   shadaj = {
     github = "shadaj";
     githubId = 543055;
@@ -28271,6 +28281,12 @@
     githubId = 5623227;
     name = "Quentin Boyer";
   };
+  tree-sapii = {
+    email = "supersapiiiiii@gmail.com";
+    github = "tree-sapii";
+    githubId = 144389458;
+    name = "sapii";
+  };
   treemo = {
     email = "matthieu.chevrier@treemo.fr";
     github = "treemo";
@@ -29886,6 +29902,13 @@
     githubId = 1595132;
     name = "Kranium Gikos Mendoza";
   };
+  WOnder93 = {
+    email = "omosnacek@gmail.com";
+    github = "WOnder93";
+    githubId = 3041388;
+    matrix = "@omos:fedora.im";
+    name = "Ondrej Mosnáček";
+  };
   workflow = {
     email = "4farlion@gmail.com";
     github = "workflow";

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -24,6 +24,8 @@
 
 - [Nezha](https://github.com/nezhahq/nezha), a self-hosted, lightweight server and website monitoring and O&M tool. Available as [services.nezha](#opt-services.nezha.enable).
 
+- [feishin](https://github.com/jeffvli/feishin), a modern self-hosted music player. Available as [services.feishin](#opt-services.feishin.enable).
+
 - [FlapAlerted](https://github.com/Kioubit/FlapAlerted), detects BGP flapping events and provides statistics based on BGP update messages. Available as [services.flap-alerted](#opt-services.flap-alerted.enable).
 
 ## Backward Incompatibilities {#sec-release-26.11-incompatibilities}

nixos/modules/hardware/all-hardware.nix

@@ -108,6 +108,10 @@ in
       "pata_qdi"
       "pata_winbond"
     ]
+    ++ lib.optionals (lib.versionAtLeast config.boot.kernelPackages.kernel.version "7.2") [
+      # xhci-pci defers AMD 800-series chipset controllers to this driver.
+      "xhci_pci_prom21"
+    ]
     ++ lib.optionals platform.isx86 [ "vmw_balloon" ]
     ++ lib.optionals (pkgs.stdenv.hostPlatform.isi686 || pkgs.stdenv.hostPlatform.isx86_64) [
       "vmw_vmci"

nixos/modules/module-list.nix

@@ -759,6 +759,7 @@
   ./services/logging/syslog-ng.nix
   ./services/logging/syslogd.nix
   ./services/logging/SystemdJournal2Gelf.nix
+  ./services/logging/udp514-journal.nix
   ./services/logging/ulogd.nix
   ./services/logging/vector.nix
   ./services/mail/automx2.nix
@@ -1651,6 +1652,7 @@
   ./services/web-apps/engelsystem.nix
   ./services/web-apps/ente.nix
   ./services/web-apps/fediwall.nix
+  ./services/web-apps/feishin.nix
   ./services/web-apps/fider.nix
   ./services/web-apps/filebrowser.nix
   ./services/web-apps/firefly-iii-data-importer.nix

nixos/modules/services/computing/boinc/client.nix

@@ -50,7 +50,7 @@ in
         only the hosts listed in {var}`dataDir`/remote_hosts.cfg will be allowed to
         connect.
 
-        See also: <https://boinc.berkeley.edu/wiki/Controlling_BOINC_remotely#Remote_access>
+        See also: <https://github.com/BOINC/boinc/wiki/Controlling_BOINC_remotely#remote-access>
       '';
     };
 

nixos/modules/services/desktop-managers/gnome.nix

@@ -435,6 +435,7 @@ in
           optionalPackages = [
             pkgs.adwaita-icon-theme
             nixos-background-info
+            pkgs.glycin-thumbnailer # Image thumbnailers
             pkgs.gnome-backgrounds
             pkgs.gnome-bluetooth
             pkgs.gnome-color-manager
@@ -443,6 +444,7 @@ in
             pkgs.gnome-user-docs
             pkgs.glib # for gsettings program
             pkgs.gnome-menus
+            pkgs.gst-thumbnailers # Audio and video thumbnailers
             pkgs.gtk3.out # for gtk-launch program
             pkgs.xdg-user-dirs # Update user dirs as described in https://freedesktop.org/wiki/Software/xdg-user-dirs/
             pkgs.xdg-user-dirs-gtk # Used to create the default bookmarks

nixos/modules/services/logging/udp514-journal.nix

@@ -0,0 +1,95 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.udp514-journal;
+  description = "Forward syslog from network (udp/514) to journal";
+in
+{
+  options = {
+    services.udp514-journal = {
+      enable = lib.mkEnableOption "the udp514-journal systemd socket/service";
+
+      openFirewall = lib.mkEnableOption "" // {
+        description = "Whether to open the port in the firewall.";
+      };
+
+      port = lib.mkOption {
+        type = lib.types.port;
+        default = 514;
+        description = "Port to listen on";
+      };
+
+      package = lib.mkPackageOption pkgs "udp514-journal" { };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.sockets.udp514-journal = {
+      enable = true;
+      name = "udp514-journal.socket";
+      inherit description;
+      listenDatagrams = [ (builtins.toString cfg.port) ];
+      wantedBy = [ "sockets.target" ];
+    };
+
+    systemd.services.udp514-journal = {
+      enable = true;
+      name = "udp514-journal.service";
+      inherit description;
+      requires = [
+        "systemd-journald.socket"
+        "udp514-journal.socket"
+      ];
+      serviceConfig = {
+        Type = "notify";
+        Restart = "always";
+        ExecStart = "${cfg.package}/bin/udp514-journal";
+        DynamicUser = "on";
+        CapabilityBoundingSet = "";
+        AmbientCapabilities = "";
+        ProtectSystem = "strict";
+        ProtectHome = "on";
+        PrivateDevices = "on";
+        PrivateTmp = true;
+        PrivateUsers = "self";
+        PrivateNetwork = "on";
+        RestrictAddressFamilies = [ "AF_UNIX" ];
+        RestrictNamespaces = true;
+        RestrictSUIDSGID = true;
+        RestrictRealtime = true;
+        LockPersonality = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
+        ProtectClock = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = "on";
+        ProtectControlGroups = "strict";
+        ProtectProc = "noaccess";
+        ProcSubset = "pid";
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        MemoryMax = "5M";
+        UMask = "0077";
+      };
+      confinement = {
+        enable = true;
+        binSh = null;
+      };
+    };
+
+    networking.firewall.allowedUDPPorts = lib.mkIf cfg.openFirewall [ cfg.port ];
+  };
+
+  meta.maintainers = with lib.maintainers; [ usovalx ];
+}

nixos/modules/services/matrix/mautrix-meta.nix

@@ -18,6 +18,7 @@ let
   settingsFileUnsubstituted = cfg: settingsFormat.generate "mautrix-meta-config.yaml" cfg.settings;
 
   metaName = name: "mautrix-meta-${name}";
+  packageName = network: if network == "instagram" then "mautrix-instagram" else "mautrix-meta";
 
   enabledInstances = lib.filterAttrs (
     name: config: config.enable
@@ -200,8 +201,10 @@ in
                   '';
                   description = ''
                     {file}`config.yaml` configuration as a Nix attribute set.
-                    Configuration options should match those described in
-                    [example-config.yaml](https://github.com/mautrix/meta/blob/main/example-config.yaml).
+                    Configuration options should match those described in the example configuration.
+                    Get an example configuration by executing one of those commands
+                      - `mautrix-meta -c example.yaml --generate-example-config`
+                      - `mautrix-instagram -c example.yaml --generate-example-config`
 
                     Secret tokens should be specified using {option}`environmentFile`
                     instead
@@ -471,7 +474,7 @@ in
               cp '${settingsFile cfg}' '${settingsFile cfg}.tmp'
 
               echo "Generating registration file"
-              mautrix-meta \
+              ${lib.getExe' upperCfg.package (packageName cfg.settings.network.mode)} \
                 --generate-registration \
                 --config='${settingsFile cfg}.tmp' \
                 --registration='${cfg.registrationFile}'
@@ -568,7 +571,7 @@ in
               EnvironmentFile = cfg.environmentFile;
 
               ExecStart = lib.escapeShellArgs [
-                (lib.getExe upperCfg.package)
+                (lib.getExe' upperCfg.package (packageName cfg.settings.network.mode))
                 "--config=${settingsFile cfg}"
               ];
             };

nixos/modules/services/misc/gitlab/default.nix

@@ -1285,6 +1285,8 @@ in
     services.postgresql = optionalAttrs databaseActuallyCreateLocally {
       enable = true;
       ensureUsers = singleton { name = cfg.databaseUsername; };
+      # With the PostgreSQL update to 17.6, the default was no longer enough.
+      settings.max_locks_per_transaction = lib.mkDefault 128;
     };
 
     # Enable rotation of log files
@@ -1455,6 +1457,7 @@ in
       "d ${cfg.statePath}/custom_hooks/post-receive.d 0700 ${cfg.user} ${cfg.group} -"
       "d ${cfg.statePath}/custom_hooks/update.d 0700 ${cfg.user} ${cfg.group} -"
       "d ${gitlabConfig.production.shared.path} 0750 ${cfg.user} ${cfg.group} -"
+      "d ${gitlabConfig.production.shared.path}/agent_plan_content 0750 ${cfg.user} ${cfg.group} -"
       "d ${gitlabConfig.production.shared.path}/artifacts 0750 ${cfg.user} ${cfg.group} -"
       "d ${gitlabConfig.production.shared.path}/lfs-objects 0750 ${cfg.user} ${cfg.group} -"
       "d ${gitlabConfig.production.shared.path}/packages 0750 ${cfg.user} ${cfg.group} -"

nixos/modules/services/monitoring/ups.nix

@@ -679,7 +679,7 @@ in
       environment = envVars;
       serviceConfig = {
         Type = "oneshot";
-        ExecStart = "${cfg.package}/bin/upsdrvctl shutdown";
+        ExecStart = "${cfg.package}/bin/upsdrvctl -u root shutdown";
       };
     };
 

nixos/modules/services/networking/technitium-dns-server.nix

@@ -66,6 +66,7 @@ in
 
         StateDirectory = "technitium-dns-server";
         LogsDirectory = "technitium";
+        WorkingDirectory = "%S/technitium-dns-server";
 
         Restart = "always";
         RestartSec = 10;

nixos/modules/services/video/frigate.nix

@@ -787,6 +787,7 @@ in
 
         # Caches
         PrivateTmp = true;
+        TemporaryFileSystem = "/dev/shm:mode=1777,nosuid,nodev";
         CacheDirectory = [
           "frigate"
           # https://github.com/blakeblackshear/frigate/discussions/18129

nixos/modules/services/web-apps/discourse.nix

@@ -641,6 +641,8 @@ in
       s3_http_continue_timeout = null;
       s3_install_cors_rule = null;
       s3_asset_cdn_url = null;
+      s3_role_arn = null;
+      s3_role_session_name = null;
 
       max_user_api_reqs_per_minute = 20;
       max_user_api_reqs_per_day = 2880;
@@ -667,7 +669,6 @@ in
       compress_anon_cache = false;
       anon_cache_store_threshold = 2;
       allowed_theme_repos = null;
-      enable_email_sync_demon = false;
       max_digests_enqueued_per_30_mins_per_site = 10000;
       cluster_name = null;
       multisite_config_path = "config/multisite.yml";
@@ -681,6 +682,10 @@ in
       allow_impersonation = true;
       log_line_max_chars = 160000;
       yjit_enabled = false;
+      # this option is set to `true` in discourse's defaults.
+      # however, having this option enabled appears to cause a segfault in mini_racer
+      # see https://github.com/rubyjs/mini_racer/issues/422
+      mini_racer_single_threaded = false;
     };
 
     services.redis.servers.discourse =
@@ -951,27 +956,35 @@ in
               # asset pipeline enables this
               brotli_static on;
               gzip_static on;
+              add_header Access-Control-Allow-Origin *;
             '';
             "~ ^/plugins/".extraConfig = cache_1y;
             "~ /images/emoji/".extraConfig = cache_1y;
             "~ ^/uploads/" = proxy {
-              extraConfig = cache_1y + ''
+              extraConfig = ''
                 proxy_set_header X-Sendfile-Type X-Accel-Redirect;
                 proxy_set_header X-Accel-Mapping ${cfg.package}/share/discourse/public/=/downloads/;
 
                 # custom CSS
                 location ~ /stylesheet-cache/ {
+                    ${cache_1y}
                     try_files $uri =404;
                 }
                 # this allows us to bypass rails
                 location ~* \.(gif|png|jpg|jpeg|bmp|tif|tiff|ico|webp)$ {
+                    ${cache_1y}
                     try_files $uri =404;
                 }
-                # SVG needs an extra header attached
+                # force attachment so SVGs can't render as a document on direct navigation
                 location ~* \.(svg)$ {
+                    ${cache_1y}
+                    add_header Access-Control-Allow-Origin *;
+                    add_header Content-Disposition attachment;
+                    try_files $uri =404;
                 }
                 # thumbnails & optimized images
                 location ~ /_?optimized/ {
+                    ${cache_1y}
                     try_files $uri =404;
                 }
               '';

nixos/modules/services/web-apps/docuseal.nix

@@ -130,6 +130,7 @@ in
         SystemCallFilter = [
           "@system-service"
           "~@privileged"
+          "@chown"
         ];
         # User and group
         DynamicUser = true;

nixos/modules/services/web-apps/feishin.nix

@@ -0,0 +1,156 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.feishin;
+in
+{
+  options.services.feishin = {
+    enable = lib.mkEnableOption "the web version of Feishin";
+
+    package = lib.mkPackageOption pkgs "feishin-web" { };
+
+    domain = lib.mkOption {
+      description = "Domain to use for the virtualhost.";
+      type = lib.types.str;
+    };
+
+    pathbase = lib.mkOption {
+      description = "URL path base to use for the virtualhost.";
+      type = lib.types.str;
+      default = "";
+      example = "/music";
+    };
+
+    settings = lib.mkOption {
+      description = ''
+        Configuration for the web version of Feishin, specified as key-value pairs.
+
+        Refer to <https://github.com/jeffvli/feishin#configuration>, and
+        <https://github.com/jeffvli/feishin/blob/development/settings.js.template>
+        for the template.
+      '';
+      type = lib.types.attrsOf lib.types.str;
+      default = {
+        ANALYTICS_DISABLED = "true";
+      };
+      example = {
+        ANALYTICS_DISABLED = "true";
+        SERVER_NAME = "My Server";
+        SERVER_LOCK = "true";
+      };
+    };
+
+    nginx = {
+      enable = lib.mkEnableOption "a virtualhost to serve Feishin through nginx";
+
+      virtualHost = lib.mkOption {
+        description = "Extra configuration for the nginx virtualhost for Feishin.";
+        type = lib.types.submodule (import ../web-servers/nginx/vhost-options.nix { inherit config lib; });
+        default = { };
+        example = lib.literalExpression ''
+          {
+            serverAliases = [ "feishin.''${config.networking.domain}" ];
+          }
+        '';
+      };
+    };
+
+    caddy = {
+      enable = lib.mkEnableOption "a virtualhost to serve Feishin through Caddy";
+
+      virtualHost = lib.mkOption {
+        description = "Extra configuration for the Caddy virtualhost for Feishin.";
+        type = lib.types.submodule (
+          import ../web-servers/caddy/vhost-options.nix { cfg = config.services.caddy; }
+        );
+        default = { };
+        example = lib.literalExpression ''
+          {
+            serverAliases = [ "feishin.''${config.networking.domain}" ];
+          }
+        '';
+      };
+    };
+  };
+
+  config =
+    let
+      resolvedSettings =
+        cfg.settings // lib.optionalAttrs (cfg.pathbase != "") { PUBLIC_PATH = cfg.pathbase; };
+      settingsJs = ''
+        "use strict";
+        ${lib.concatMapAttrsStringSep "\n" (name: value: ''window.${name} = "${value}";'') resolvedSettings}
+      '';
+      settingsJsDir = pkgs.writeTextDir "settings.js" settingsJs;
+    in
+    lib.mkIf cfg.enable {
+      services.nginx = lib.mkIf cfg.nginx.enable {
+        enable = lib.mkDefault true;
+        virtualHosts."${cfg.domain}" = lib.mkMerge [
+          cfg.nginx.virtualHost
+          {
+            root = lib.mkForce "${cfg.package}";
+            extraConfig = ''
+              gzip on;
+              gzip_vary    on;
+              gzip_proxied any;
+              gzip_types   text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;
+            '';
+            locations."${cfg.pathbase}/" = {
+              tryFiles = "$uri $uri/ /index.html =404";
+            };
+            locations."=${cfg.pathbase}/settings.js" = {
+              alias = settingsJsDir + "/settings.js";
+              extraConfig = ''
+                add_header Cache-Control "no-store";
+              '';
+            };
+          }
+        ];
+      };
+
+      services.caddy = lib.mkIf cfg.caddy.enable {
+        enable = lib.mkDefault true;
+        virtualHosts."${cfg.domain}" = lib.mkMerge [
+          cfg.caddy.virtualHost
+          {
+            hostName = lib.mkForce cfg.domain;
+            extraConfig =
+              let
+                baseConfig = ''
+                  encode
+                  handle /settings.js {
+                    header Cache-Control no-store
+                    root ${settingsJsDir}
+                    file_server
+                  }
+                  handle {
+                    root ${cfg.package}
+                    try_files {path} /index.html
+                    file_server
+                  }
+                '';
+              in
+              if (cfg.pathbase == "") then
+                baseConfig
+              else
+                ''
+                  handle_path ${cfg.pathbase}/* {
+                    ${baseConfig}
+                  }
+                '';
+          }
+        ];
+      };
+    };
+
+  meta.maintainers = with lib.maintainers; [
+    rharish
+    BatteredBunny
+  ];
+}

nixos/modules/services/web-apps/flarum.nix

@@ -12,17 +12,19 @@ let
 
   # Only placeholders reach the world-readable Nix store; the install
   # script substitutes the real secrets at runtime.
+  dbConfig =
+    cfg.database
+    // optionalAttrs (cfg.databasePasswordFile != null) {
+      password = "@databasePassword@";
+    };
+
   flarumInstallConfig = pkgs.writeText "config.json" (
     builtins.toJSON {
       debug = false;
       offline = false;
 
       baseUrl = cfg.baseUrl;
-      databaseConfiguration =
-        cfg.database
-        // optionalAttrs (cfg.databasePasswordFile != null) {
-          password = "@databasePassword@";
-        };
+      databaseConfiguration = dbConfig;
       adminUser = {
         username = cfg.adminUser;
         password =
@@ -34,6 +36,25 @@ let
       };
     }
   );
+
+  phpFormat = pkgs.formats.php { };
+
+  configPhpFile = phpFormat.generate "flarum-config.php" {
+    debug = false;
+    database = dbConfig;
+    url = cfg.baseUrl;
+    paths = {
+      api = "api";
+      admin = "admin";
+    };
+    headers = {
+      poweredByHeader = true;
+      referrerPolicy = "same-origin";
+    };
+    queue = {
+      driver = "sync";
+    };
+  };
 in
 {
   options.services.flarum = {
@@ -268,26 +289,31 @@ in
         ln -sf ${cfg.package}/share/php/flarum/public/index.php public/
       ''
       + optionalString (cfg.createDatabaseLocally && cfg.database.driver == "mysql") ''
-        if [ ! -f config.php ]; then
-          install -m 0600 ${flarumInstallConfig} /tmp/flarum-install.json
-          ${optionalString (cfg.initialAdminPasswordFile != null) ''
-            ${pkgs.replace-secret}/bin/replace-secret '@adminPassword@' \
-              ${escapeShellArg cfg.initialAdminPasswordFile} /tmp/flarum-install.json
-          ''}
-          ${optionalString (cfg.databasePasswordFile != null) ''
-            ${pkgs.replace-secret}/bin/replace-secret '@databasePassword@' \
-              ${escapeShellArg cfg.databasePasswordFile} /tmp/flarum-install.json
-          ''}
-          php flarum install --file=/tmp/flarum-install.json
-          # config.php contains the database password; stateDir is world-readable
-          chmod 600 config.php
+        if [ ! -f .flarum-installed ]; then
+          if [ ! -f config.php ]; then
+            install -m 0600 ${flarumInstallConfig} /tmp/flarum-install.json
+            ${optionalString (cfg.initialAdminPasswordFile != null) ''
+              ${pkgs.replace-secret}/bin/replace-secret '@adminPassword@' \
+                ${escapeShellArg cfg.initialAdminPasswordFile} /tmp/flarum-install.json
+            ''}
+            ${optionalString (cfg.databasePasswordFile != null) ''
+              ${pkgs.replace-secret}/bin/replace-secret '@databasePassword@' \
+                ${escapeShellArg cfg.databasePasswordFile} /tmp/flarum-install.json
+            ''}
+            php flarum install --file=/tmp/flarum-install.json
+          fi
+          touch .flarum-installed
         fi
       ''
       + ''
-        if [ -f config.php ]; then
-          php flarum migrate
-          php flarum cache:clear
-        fi
+        install -m 0600 ${configPhpFile} config.php
+        ${optionalString (cfg.databasePasswordFile != null) ''
+          ${pkgs.replace-secret}/bin/replace-secret '@databasePassword@' \
+            ${escapeShellArg cfg.databasePasswordFile} config.php
+        ''}
+
+        php flarum migrate
+        php flarum cache:clear
       '';
     };
   };

nixos/modules/services/web-apps/miniflux.nix

@@ -214,7 +214,13 @@ in
       abi <abi/4.0>,
       include <tunables/global>
 
-      profile ${cfg.package}/bin/miniflux {
+      # Flag `attach_disconnected` is necessary
+      # because the PostgreSQL socket path appears
+      # as a "disconnected" path: `run/postgresql/.s.PGSQL.XXXX`,
+      # without the trailing slash, which AppArmor can't resolve.
+      # The flag prepends a `/`, which isn't recommended,
+      # but there aren't any alternative currently.
+      profile ${cfg.package}/bin/miniflux flags=(attach_disconnected) {
         include <abstractions/base>
         include <abstractions/nameservice>
         include <abstractions/ssl_certs>
@@ -222,6 +228,8 @@ in
         include "${pkgs.apparmorRulesFromClosure { name = "miniflux"; } cfg.package}"
         ${cfg.package}/bin/miniflux r,
         /run/miniflux/** rw,
+        /run/postgresql/.s.PGSQL.* rw,
+        /run/credentials/** r,
         include if exists <local/bin.miniflux>
       }
     '';

nixos/modules/services/web-apps/misskey.nix

@@ -231,7 +231,7 @@ in
         webserver = lib.mkOption {
           type = lib.types.attrTag {
             nginx = lib.mkOption {
-              type = lib.types.submodule (import ../web-servers/nginx/vhost-options.nix);
+              type = lib.types.submodule ../web-servers/nginx/vhost-options.nix;
               default = { };
               description = ''
                 Extra configuration for the nginx virtual host of Misskey.
@@ -240,7 +240,7 @@ in
             };
             caddy = lib.mkOption {
               type = lib.types.submodule (
-                import ../web-servers/caddy/vhost-options.nix { cfg = config.services.caddy; }
+                lib.modules.importApply ../web-servers/caddy/vhost-options.nix { cfg = config.services.caddy; }
               );
               default = { };
               description = ''

nixos/modules/system/boot/kernel.nix

@@ -370,6 +370,10 @@ in
           "hid_corsair"
 
         ]
+        ++ optionals (versionAtLeast kernel.version "7.2") [
+          # xhci-pci defers AMD 800-series chipset controllers to this driver.
+          "xhci_pci_prom21"
+        ]
         ++ optionals pkgs.stdenv.hostPlatform.isx86 [
           # Misc. x86 keyboard stuff.
           "pcips2"

nixos/tests/all-tests.nix

@@ -560,6 +560,7 @@ in
   fastnetmon-advanced = runTest ./fastnetmon-advanced.nix;
   fcitx5 = runTest ./fcitx5;
   fedimintd = runTest ./fedimintd.nix;
+  feishin = handleTest ./feishin { };
   ferm = runTest ./ferm.nix;
   ferretdb = import ./ferretdb.nix { inherit pkgs runTest; };
   fider = runTest ./fider.nix;
@@ -1755,6 +1756,7 @@ in
   ucarp = runTest ./ucarp.nix;
   udisks2 = runTest ./udisks2.nix;
   udp-over-tcp = runTest ./udp-over-tcp.nix;
+  udp514-journal = runTest ./udp514-journal.nix;
   ulogd = runTest ./ulogd/ulogd.nix;
   umami = runTest ./web-apps/umami.nix;
   umurmur = runTest ./umurmur.nix;

nixos/tests/feishin/caddy.nix

@@ -0,0 +1,36 @@
+import ../make-test-python.nix (
+  { lib, ... }:
+
+  {
+    name = "feishin-caddy";
+    meta.maintainers = with lib.maintainers; [
+      rharish
+      BatteredBunny
+    ];
+
+    nodes.machine =
+      { pkgs, ... }:
+      {
+        services.feishin = {
+          enable = true;
+          domain = "localhost:80";
+          pathbase = "/feishin";
+          settings = {
+            ANALYTICS_DISABLED = "true";
+          };
+          caddy.enable = true;
+          caddy.virtualHost.extraConfig = "tls internal";
+        };
+        # disable letsencrypt cert fetching
+        services.caddy.globalConfig = "auto_https disable_certs";
+      };
+
+    testScript = ''
+      machine.wait_for_unit("caddy.service")
+      machine.wait_for_open_port(80)
+      machine.succeed("curl -vvv --fail --show-error --silent --location --insecure http://localhost/feishin/")
+      assert "<title>Feishin</title>" in machine.succeed("curl --fail --show-error --silent --location --insecure http://localhost/feishin/")
+      assert "window.ANALYTICS_DISABLED = \"true\";" in machine.succeed("curl --fail --show-error --silent --location --insecure http://localhost/feishin/settings.js")
+    '';
+  }
+)

nixos/tests/feishin/default.nix

@@ -0,0 +1,6 @@
+{ system, pkgs, ... }:
+
+{
+  caddy = import ./caddy.nix { inherit system pkgs; };
+  nginx = import ./nginx.nix { inherit system pkgs; };
+}

nixos/tests/feishin/nginx.nix

@@ -0,0 +1,33 @@
+import ../make-test-python.nix (
+  { lib, ... }:
+
+  {
+    name = "feishin-nginx";
+    meta.maintainers = with lib.maintainers; [
+      rharish
+      BatteredBunny
+    ];
+
+    nodes.machine =
+      { pkgs, ... }:
+      {
+        services.feishin = {
+          enable = true;
+          domain = "localhost";
+          pathbase = "/feishin";
+          settings = {
+            ANALYTICS_DISABLED = "true";
+          };
+          nginx.enable = true;
+        };
+      };
+
+    testScript = ''
+      machine.wait_for_unit("nginx.service")
+      machine.wait_for_open_port(80)
+      machine.succeed("curl -vvv --fail --show-error --silent --location --insecure http://localhost/feishin/")
+      assert "<title>Feishin</title>" in machine.succeed("curl --fail --show-error --silent --location --insecure http://localhost/feishin/")
+      assert "window.ANALYTICS_DISABLED = \"true\";" in machine.succeed("curl --fail --show-error --silent --location --insecure http://localhost/feishin/settings.js")
+    '';
+  }
+)

nixos/tests/flarum.nix

@@ -69,5 +69,17 @@
     # not be world-readable.
     machine.succeed("grep -q 'flarum-db-password' /var/lib/flarum/config.php")
     machine.succeed("[ $(stat -c %a /var/lib/flarum/config.php) = 600 ]")
+
+    # `flarum install` must not rerun on later activations, or it errors out
+    # since the database already exists.
+    machine.succeed(
+        "echo 'create table nixos_test_marker (id int); insert into nixos_test_marker values (1);' "
+        + "| sudo -u flarum mysql -u flarum flarum"
+    )
+    machine.succeed("systemctl restart flarum-install.service")
+    machine.succeed(
+        "echo 'select id from nixos_test_marker;' | sudo -u flarum mysql -u flarum flarum -N | grep -q 1"
+    )
+    machine.succeed("[ -f /var/lib/flarum/.flarum-installed ]")
   '';
 }

nixos/tests/jool.nix

@@ -71,6 +71,7 @@ in
         ];
       };
 
+      boot.kernelPackages = pkgs.linuxPackages_latest;
       networking.jool.enable = true;
       networking.jool.siit.default.global.pool6 = "fd::/96";
     };
@@ -191,6 +192,7 @@ in
         ];
       };
 
+      boot.kernelPackages = pkgs.linuxPackages_latest;
       networking.jool.enable = true;
       networking.jool.nat64.default = {
         bib = [
@@ -206,17 +208,17 @@ in
           {
             protocol = "TCP";
             prefix = "203.0.113.1/32";
-            "port range" = "40001-65535";
+            "port range" = "20000-29999";
           }
           {
             protocol = "UDP";
             prefix = "203.0.113.1/32";
-            "port range" = "40001-65535";
+            "port range" = "20000-29999";
           }
           {
             protocol = "ICMP";
             prefix = "203.0.113.1/32";
-            "port range" = "40001-65535";
+            "port range" = "20000-29999";
           }
           # Ports for static BIB entries
           {

nixos/tests/matrix/mautrix-meta-postgres.nix

@@ -90,12 +90,21 @@ in
               as_token = "$AS_TOKEN";
               hs_token = "$HS_TOKEN";
 
-              database = {
-                type = "postgres";
-                uri = "postgres:///mautrix-meta-instagram?host=/var/run/postgresql";
+              bot = {
+                username = botUserName;
+                avatar = "";
               };
+            };
 
-              bot.username = botUserName;
+            database = {
+              type = "postgres";
+              uri = "postgres:///mautrix-meta-instagram?host=/var/run/postgresql";
+            };
+
+            encryption = {
+              allow = false;
+              default = false;
+              require = false;
             };
 
             bridge.permissions."@${userName}:server" = "user";
@@ -127,13 +136,14 @@ in
               import functools
               import asyncio
 
-              from nio import AsyncClient, RoomMessageNotice, RoomCreateResponse, RoomInviteResponse
+              from nio import AsyncClient, RoomMessageText, RoomCreateResponse, RoomInviteResponse
 
 
-              async def message_callback(matrix: AsyncClient, msg: str, _r, e):
+              async def message_callback(matrix: AsyncClient, expected_msg: str, expected_sender: str, _r, e):
                   print("Received matrix text message: ", e)
-                  assert msg in e.body
-                  exit(0)  # Success!
+                  if getattr(e, "sender", "") == expected_sender and expected_msg in getattr(e, "body", ""):
+                      print("Success!")
+                      exit(0)  # Success!
 
 
               async def run(homeserver: str):
@@ -151,9 +161,9 @@ in
                   assert isinstance(response, RoomInviteResponse)
 
                   callback = functools.partial(
-                      message_callback, matrix, "Hello, I'm an Instagram bridge bot."
+                      message_callback, matrix, "Hello, I'm a Instagram bridge bot.", "@${botUserName}:${homeserverDomain}"
                   )
-                  matrix.add_event_callback(callback, RoomMessageNotice)
+                  matrix.add_event_callback(callback, RoomMessageText)
 
                   print("Waiting for matrix message...")
                   await matrix.sync_forever(timeout=30000)
@@ -171,11 +181,10 @@ in
     def extract_token(data):
         stdout = data[1]
         stdout = stdout.strip()
-        line = stdout.split('\n')[-1]
-        return line.split(':')[-1].strip("\" '\n")
+        return stdout.split(':')[-1].strip("\" '\n")
 
     def get_token_from(token, file):
-        data = server.execute(f"cat {file} | grep {token}")
+        data = server.execute(f"grep -E '^\\s*{token}:' {file}")
         return extract_token(data)
 
     def get_as_token_from(file):

nixos/tests/matrix/mautrix-meta-sqlite.nix

@@ -4,7 +4,7 @@ let
   homeserverUrl = "http://server:8008";
   username = "alice";
   instagramBotUsername = "instagrambot";
-  facebookBotUsername = "facebookbot";
+  metaBotUsername = "metabot";
 in
 {
   name = "mautrix-meta-sqlite";
@@ -60,7 +60,16 @@ in
             appservice = {
               port = 8009;
 
-              bot.username = facebookBotUsername;
+              bot = {
+                username = metaBotUsername;
+                avatar = "";
+              };
+            };
+
+            encryption = {
+              allow = false;
+              default = false;
+              require = false;
             };
 
             bridge.permissions."@${username}:server" = "user";
@@ -79,7 +88,16 @@ in
             appservice = {
               port = 8010;
 
-              bot.username = instagramBotUsername;
+              bot = {
+                username = instagramBotUsername;
+                avatar = "";
+              };
+            };
+
+            encryption = {
+              allow = false;
+              default = false;
+              require = false;
             };
 
             bridge.permissions."@${username}:server" = "user";
@@ -136,16 +154,17 @@ in
               import functools
               import asyncio
 
-              from nio import AsyncClient, RoomMessageNotice, RoomCreateResponse, RoomInviteResponse
+              from nio import AsyncClient, RoomMessageText, RoomCreateResponse, RoomInviteResponse
 
 
-              async def message_callback(matrix: AsyncClient, msg: str, _r, e):
+              async def message_callback(matrix: AsyncClient, expected_msg: str, expected_sender: str, _r, e):
                   print("Received matrix text message: ", e)
-                  assert msg in e.body
-                  exit(0)  # Success!
+                  if getattr(e, "sender", "") == expected_sender and expected_msg in getattr(e, "body", ""):
+                      print("Success!")
+                      exit(0)  # Success!
 
 
-              async def run(username: str, bot_username: str, homeserver: str):
+              async def run(username: str, bot_username: str, homeserver: str, expected_msg: str):
                   matrix = AsyncClient(homeserver, f"@{username}:${homeserverDomain}")
 
                   response = await matrix.login("foobar")
@@ -161,16 +180,16 @@ in
                   assert isinstance(response, RoomInviteResponse)
 
                   callback = functools.partial(
-                      message_callback, matrix, "Hello, I'm an Instagram bridge bot."
+                      message_callback, matrix, expected_msg, f"@{bot_username}:${homeserverDomain}"
                   )
-                  matrix.add_event_callback(callback, RoomMessageNotice)
+                  matrix.add_event_callback(callback, RoomMessageText)
 
                   print("Waiting for matrix message...")
                   await matrix.sync_forever(timeout=30000)
 
 
               if __name__ == "__main__":
-                  asyncio.run(run(sys.argv[1], sys.argv[2], sys.argv[3]))
+                  asyncio.run(run(sys.argv[1], sys.argv[2], sys.argv[3], sys.argv[4]))
             ''
           )
         ];
@@ -181,11 +200,10 @@ in
     def extract_token(data):
         stdout = data[1]
         stdout = stdout.strip()
-        line = stdout.split('\n')[-1]
-        return line.split(':')[-1].strip("\" '\n")
+        return stdout.split(':')[-1].strip("\" '\n")
 
     def get_token_from(token, file):
-        data = server.execute(f"cat {file} | grep {token}")
+        data = server.execute(f"grep -E '^\\s*{token}:' {file}")
         return extract_token(data)
 
     def get_as_token_from(file):
@@ -216,8 +234,8 @@ in
         client.succeed("register_user ${username} ${homeserverUrl} >&2")
 
     with subtest("ensure messages can be exchanged"):
-        client.succeed("do_test ${username} ${facebookBotUsername} ${homeserverUrl} >&2")
-        client.succeed("do_test ${username} ${instagramBotUsername} ${homeserverUrl} >&2")
+        client.succeed("do_test ${username} ${metaBotUsername} ${homeserverUrl} \"Hello, I'm a Facebook Messenger bridge bot.\" >&2")
+        client.succeed("do_test ${username} ${instagramBotUsername} ${homeserverUrl} \"Hello, I'm a Instagram bridge bot.\" >&2")
 
     with subtest("ensure as_token and hs_token stays same after restart"):
         generated_as_token_facebook = get_as_token_from(config_yaml)
@@ -252,7 +270,7 @@ in
         assert generated_hs_token_facebook == new_hs_token_facebook, f"hs_token should stay the same after restart inside the registration file (is: {new_hs_token_facebook}, was: {generated_hs_token_facebook})"
 
     with subtest("ensure messages can be exchanged after restart"):
-        client.succeed("do_test ${username} ${instagramBotUsername} ${homeserverUrl} >&2")
-        client.succeed("do_test ${username} ${facebookBotUsername} ${homeserverUrl} >&2")
+        client.succeed("do_test ${username} ${instagramBotUsername} ${homeserverUrl} \"Hello, I'm a Instagram bridge bot.\" >&2")
+        client.succeed("do_test ${username} ${metaBotUsername} ${homeserverUrl} \"Hello, I'm a Facebook Messenger bridge bot.\" >&2")
   '';
 }

nixos/tests/matrix/mjolnir.nix

@@ -118,7 +118,7 @@ in
           (pkgs.writers.writePython3Bin "create_management_room_and_invite_mjolnir"
             {
               libraries = with pkgs.python3Packages; [
-                (matrix-nio.override { withOlm = true; })
+                (matrix-nio.override { withVodozemac = true; })
               ];
             }
             ''

nixos/tests/miniflux.nix

@@ -29,6 +29,7 @@ in
     default =
       { ... }:
       {
+        security.apparmor.enable = true;
         services.miniflux = {
           enable = true;
           inherit adminCredentialsFile;
@@ -38,6 +39,7 @@ in
     withoutSudo =
       { ... }:
       {
+        security.apparmor.enable = true;
         services.miniflux = {
           enable = true;
           inherit adminCredentialsFile;
@@ -48,6 +50,7 @@ in
     customized =
       { ... }:
       {
+        security.apparmor.enable = true;
         services.miniflux = {
           enable = true;
           config = {
@@ -82,6 +85,7 @@ in
     externalDb =
       { ... }:
       {
+        security.apparmor.enable = true;
         services.miniflux = {
           enable = true;
           createDatabaseLocally = false;
@@ -105,6 +109,7 @@ in
       machine.succeed(
           f"curl 'http://localhost:{port}/v1/me' -u '{user}' -H Content-Type:application/json | grep '\"is_admin\":true'"
       )
+      machine.fail('journalctl -b --no-pager --grep "^audit: .*apparmor=\\"DENIED\\""')
 
     default.start()
     withoutSudo.start()

nixos/tests/opencloud.nix

@@ -21,12 +21,14 @@ let
         from selenium.webdriver.common.by import By
         from selenium.webdriver import Firefox
         from selenium.webdriver.firefox.options import Options
+        from selenium.webdriver.firefox.service import Service
         from selenium.webdriver.support.ui import WebDriverWait
         from selenium.webdriver.support import expected_conditions as EC
 
         options = Options()
         options.add_argument('--headless')
-        driver = Firefox(options=options)
+        service = Service(executable_path="${lib.getExe pkgs.geckodriver}")
+        driver = Firefox(options=options, service=service)
 
         host = sys.argv[1]
         user = sys.argv[2]
@@ -71,6 +73,7 @@ in
       environment = {
         ADMIN_PASSWORD = adminPassword;
         IDM_CREATE_DEMO_USERS = "true";
+        IDM_LDAPS_ADDR = "127.0.0.1:9235";
         IDM_LDAPS_CERT = "${certs.${domain}.cert}";
         IDM_LDAPS_KEY = "${certs.${domain}.key}";
         OC_INSECURE = "false";

nixos/tests/udp514-journal.nix

@@ -0,0 +1,25 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+{
+  name = "udp514-journal";
+  meta.maintainers = with lib.maintainers; [ usovalx ];
+
+  containers.machine = {
+    services.udp514-journal.enable = true;
+    environment.systemPackages = [ pkgs.netcat ];
+  };
+
+  testScript = ''
+    start_all()
+
+    machine.wait_for_unit("udp514-journal.socket");
+
+    # send a test log entry via UDP, RFC 5424 format
+    machine.execute('echo "<34>1 2026-08-01T00:24:15.123+01:00 router01 - testing" | nc -w1 -u localhost 514')
+
+    machine.wait_until_succeeds('journalctl -u udp514-journal --grep "router01 - testing"', timeout = 60)
+  '';
+}

pkgs/applications/audio/mpg123/default.nix

@@ -21,11 +21,11 @@ assert withConplay -> !libOnly;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "${lib.optionalString libOnly "lib"}mpg123";
-  version = "1.33.4";
+  version = "1.33.7";
 
   src = fetchurl {
     url = "mirror://sourceforge/mpg123/mpg123-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-OujJ/4Cpe/wOIuifvNdGh+yk/B2zFbEmB/J/ActaR9k=";
+    hash = "sha256-MdDjWkylZ+ybXr2mwwYrtENdbT6s1u8NlcrdeFTcA+4=";
   };
 
   outputs = [

pkgs/applications/editors/emacs/sources.nix

@@ -131,6 +131,11 @@ in
         url = "https://gitweb.gentoo.org/proj/emacs-patches.git/plain/emacs/30.2/02_all_ts-query-pred.patch?id=86190bf195b3e17108372d8ad89eb57037180dd2";
         hash = "sha256-0GPyfKLSaB09a8hamrSf6lx4Qk8Big4AKMOivkN1wEM=";
       })
+      (fetchpatch {
+        name = "nullify-read-symbol-shorthands-around-risky-intern-calls-80574.patch";
+        url = "https://cgit.git.savannah.gnu.org/cgit/emacs.git/patch/?id=8466eb44991707d128110bdc549fad14c8e1d61e";
+        hash = "sha256-SyRCay2MahCJovtzBHA9M1H9hXhtD5IG3ZFSEUwaWlg=";
+      })
     ];
   });
 
@@ -156,6 +161,11 @@ in
         url = "https://gitweb.gentoo.org/proj/emacs-patches.git/plain/emacs/30.2/02_all_ts-query-pred.patch?id=86190bf195b3e17108372d8ad89eb57037180dd2";
         hash = "sha256-0GPyfKLSaB09a8hamrSf6lx4Qk8Big4AKMOivkN1wEM=";
       })
+      (fetchpatch {
+        name = "nullify-read-symbol-shorthands-around-risky-intern-calls-80574.patch";
+        url = "https://cgit.git.savannah.gnu.org/cgit/emacs.git/patch/?id=8466eb44991707d128110bdc549fad14c8e1d61e";
+        hash = "sha256-SyRCay2MahCJovtzBHA9M1H9hXhtD5IG3ZFSEUwaWlg=";
+      })
     ];
   });
 }

pkgs/applications/editors/jetbrains/builder/linux.nix

@@ -23,6 +23,26 @@
   libGL,
   libx11,
 
+  # bundled jcef-plugin
+  alsa-lib,
+  at-spi2-atk,
+  at-spi2-core,
+  atk,
+  cairo,
+  cups,
+  dbus,
+  libgbm,
+  libxcb,
+  libxcomposite,
+  libxdamage,
+  libxext,
+  libxfixes,
+  libxkbcommon,
+  libxrandr,
+  nspr,
+  nss,
+  pango,
+
   jdk,
   vmopts ? null,
   forceWayland ? null,
@@ -88,6 +108,24 @@ lib.extendMkDerivation {
         libx11
         # required for the bundled jcef-plugin
         udev
+        alsa-lib
+        at-spi2-atk
+        at-spi2-core
+        atk
+        cairo
+        cups
+        dbus
+        libgbm
+        libxcb
+        libxcomposite
+        libxdamage
+        libxext
+        libxfixes
+        libxkbcommon
+        libxrandr
+        nspr
+        nss
+        pango
       ];
 
       nativeBuildInputs = nativeBuildInputs ++ [
@@ -106,6 +144,19 @@ lib.extendMkDerivation {
           patch -F3 -p1 < ${../patches/jetbrains-remote-dev.patch}
         fi
 
+        # The bundled libraries of the remote dev server are not used (see the patch above),
+        # so drop them. This has to happen before autoPatchelfHook runs, otherwise their
+        # directory ends up in the RPATH of unrelated binaries, see below.
+        rm -rf plugins/remote-dev-server/selfcontained
+
+        # libjcef.so has "." in its RPATH. autoPatchelfHook follows the RPATHs of the
+        # libraries it indexes and resolves that "." against the build directory, which
+        # makes it prefer bundled copies of libraries over the ones from nixpkgs and
+        # bake build-time-only paths into the RPATHs it writes.
+        if [ -e plugins/jcef-plugin/jcef/libjcef.so ]; then
+          patchelf --set-rpath '$ORIGIN' plugins/jcef-plugin/jcef/libjcef.so
+        fi
+
         vmopts_file=bin/linux/${vmoptsName}
         if [[ ! -f $vmopts_file ]]; then
           vmopts_file=bin/${vmoptsName}
@@ -179,7 +230,6 @@ lib.extendMkDerivation {
         fi
 
         ln -s "$launcher" $out/bin/$pname
-        rm -rf $out/$pname/plugins/remote-dev-server/selfcontained/
         echo -e '#!/usr/bin/env bash\n'"$out/$pname/bin/remote-dev-server.sh"' "$@"' > $out/$pname/bin/remote-dev-server-wrapped.sh
         chmod +x $out/$pname/bin/remote-dev-server-wrapped.sh
         ln -s "$out/$pname/bin/remote-dev-server-wrapped.sh" $out/bin/$pname-remote-dev-server

pkgs/applications/editors/jetbrains/default.nix

@@ -5,18 +5,28 @@
   callPackage,
 
   python3,
+  jetbrains,
 
-  jdk,
   vmopts ? null,
   forceWayland ? false,
 }:
 
 let
-  mkJetBrainsProduct = callPackage ./builder/default.nix { inherit jdk forceWayland vmopts; };
-  mkJetBrainsSource = callPackage ./source/build.nix { };
+  jetbrainsBuilder =
+    jdk:
+    callPackage ./builder/default.nix {
+      inherit jdk forceWayland vmopts;
+    };
 
   mkSrcIde =
-    path: extras: callPackage path ({ inherit mkJetBrainsProduct mkJetBrainsSource; } // extras);
+    path: extras:
+    callPackage path (
+      {
+        mkJetBrainsProduct = jetbrainsBuilder jetbrains.jdk;
+        mkJetBrainsSource = callPackage ./source/build.nix { };
+      }
+      // extras
+    );
 
   _idea-oss = mkSrcIde ./ides/idea-oss.nix { };
 
@@ -25,7 +35,7 @@ let
     path: extras:
     callPackage path (
       {
-        inherit mkJetBrainsProduct;
+        mkJetBrainsProduct = jetbrainsBuilder jetbrains.jdk-no-jcef;
         libdbm = _idea-oss.libdbm;
         fsnotifier = _idea-oss.fsnotifier;
       }

pkgs/applications/editors/jetbrains/ides/pycharm.nix

@@ -13,20 +13,20 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/python/pycharm-2026.2.tar.gz";
-      hash = "sha256-rDb3wHQ0ZSFb+CJwebdycpRTOMSFwdprkk5WRoBGvVo=";
+      url = "https://download.jetbrains.com/python/pycharm-2026.2.0.1.tar.gz";
+      hash = "sha256-SjfLLRVwNVPGHoFNjgFL+kcwhQhHDeX5aMTpZFt3FnU=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/python/pycharm-2026.2-aarch64.tar.gz";
-      hash = "sha256-O2PS9JDBTFQcmK/YUfIYBpo8iFzq7dm9sA5aByhc+AI=";
+      url = "https://download.jetbrains.com/python/pycharm-2026.2.0.1-aarch64.tar.gz";
+      hash = "sha256-8ptqeCpY+rsjJxXbj++XZb/a68brWQ7UYsT5ZWIidCc=";
     };
     x86_64-darwin = {
       url = "https://download.jetbrains.com/python/pycharm-2026.1.4.dmg";
       hash = "sha256-Q5hTcYoNUzmAxwcsXJNS4medQjFKWc/Sgkybt4PQPfg=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/python/pycharm-2026.2-aarch64.dmg";
-      hash = "sha256-wiOQISfsvBnlpjeyzAPXUJfXOwYwrZ8nGoiRRvQ4YUY=";
+      url = "https://download.jetbrains.com/python/pycharm-2026.2.0.1-aarch64.dmg";
+      hash = "sha256-X3YP6mtKkBvBp2UoQWfwX5AjenwwwKTSmP9GUESVDdQ=";
     };
   };
   # update-script-end: urls
@@ -40,8 +40,8 @@ in
   product = "PyCharm";
 
   # update-script-start: version
-  version = "2026.2";
-  buildNumber = "262.8665.309";
+  version = "2026.2.0.1";
+  buildNumber = "262.8665.369";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

pkgs/applications/editors/jetbrains/ides/rider.nix

@@ -24,20 +24,20 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.2.tar.gz";
-      hash = "sha256-7rvEnimFJJbLx/Y5nrR7VuipX8khxNrnwFzKay9tIqc=";
+      url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.2.0.1.tar.gz";
+      hash = "sha256-fpc9aJufO2Qiw7dyr1uOsMHsvBruFuX4D0KY1erpmwo=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.2-aarch64.tar.gz";
-      hash = "sha256-fvdgV1Q8gLgYB/ihrpukJW9DqLupZ45JGKad7vovAIo=";
+      url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.2.0.1-aarch64.tar.gz";
+      hash = "sha256-MuK1dvi3fnPdSyETPeEkW4k7hNFPkHYtaKjp/IZzdIU=";
     };
     x86_64-darwin = {
       url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.1.4.dmg";
       hash = "sha256-GfQ5WpKunJ+JhE1VcArm3UxZ5udCbfnS1Kw3D4gZorA=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.2-aarch64.dmg";
-      hash = "sha256-Y+hXTTMqHHGm5pJhQ8yepmZmAzkiF7ylOxroOa9BG6Q=";
+      url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.2.0.1-aarch64.dmg";
+      hash = "sha256-q0UXuh2RuH0sC1kqbjv0QcxmLtml9v3qeLRVcjCCVuw=";
     };
   };
   # update-script-end: urls
@@ -51,8 +51,8 @@ in
   product = "Rider";
 
   # update-script-start: version
-  version = "2026.2";
-  buildNumber = "262.8665.328";
+  version = "2026.2.0.1";
+  buildNumber = "262.8665.385";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

pkgs/applications/misc/electrum/default.nix

@@ -9,6 +9,8 @@
   enablePythonEcdsa ? false,
   callPackage,
   qtwayland,
+
+  writableTmpDirAsHomeHook,
 }:
 
 let
@@ -22,17 +24,15 @@ let
 in
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "electrum";
-  version = "4.8.0";
+  version = "4.8.1";
   pyproject = true;
 
   src = fetchurl {
     url = "https://download.electrum.org/${finalAttrs.version}/Electrum-${finalAttrs.version}.tar.gz";
-    hash = "sha256-z14bzs81eJNTMSWSBLTyCmsljDNztG54SVkoTcSqvsM=";
+    hash = "sha256-71t/YdLItZg6D5yFFVbjpveKncIv5hG7pJxu67a9/b4=";
   };
 
-  build-system = with python3.pkgs; [
-    setuptools
-  ];
+  build-system = [ python3.pkgs.setuptools ];
 
   nativeBuildInputs = [
     python3.pkgs.pythonRelaxDepsHook
@@ -67,13 +67,13 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
       ledger-bitcoin
       cbor2
       pyserial
+      trezor
     ]
     ++ lib.optionals enablePythonEcdsa [
       # enablePythonEcdsa gates plugins known to pull in python-ecdsa, which we
       # avoid by default due to CVE-2024-23342.
       ckcc-protocol
       keepkey
-      trezor
       bitbox02
     ]
     ++ lib.optionals enableQt [
@@ -90,11 +90,9 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     "protobuf"
   ];
 
-  checkInputs =
-    with python3.pkgs;
-    lib.optionals enableQt [
-      pyqt6
-    ];
+  checkInputs = lib.optionals enableQt [
+    python3.pkgs.pyqt6
+  ];
   disabledTestPaths = lib.optionals (!enableQt) [
     "tests/test_qml_types.py"
   ];
@@ -132,14 +130,15 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     pytestCheckHook
     pyaes
     pycryptodomex
+
+    # avoid homeless-shelter error in tests
+    writableTmpDirAsHomeHook
   ];
 
   enabledTestPaths = [ "tests" ];
 
-  # avoid homeless-shelter error in tests
   preCheck = ''
     export PYTHONPATH=${python3.pkgs.protobuf}/${python3.sitePackages}:$PYTHONPATH
-    export HOME="$(mktemp -d)"
   '';
 
   postCheck = ''

pkgs/applications/networking/browsers/chromium/common.nix

@@ -653,6 +653,28 @@ let
       # which is annoying, so let's make it use Go from $PATH for
       # both (all) architectures instead.
       ./patches/chromium-151-dawn-use-Go-from-PATH.patch
+    ]
+    ++ lib.optionals (chromiumVersionAtLeast "151.0.7922.169" && !ungoogled) [
+      # Don't show misleading Terms of Service dialog on first run that literally says [^1]
+      #
+      # > This Space Intentionally Blank
+      # >
+      # > In official builds this space will show the terms of service.
+      #
+      # "official builds" refers to offical Google Chrome builds, not Chromium, for which we
+      # explicitly set is_official_build=true as gn flag. If this does ever change to something
+      # actually worthwhile, we can drop this revert and update our VM test to handle this dialog.
+      # Exclude ungoogled-chromium, as it ships its own variant of this patch.
+      # [^1]: https://chromium.googlesource.com/chromium/src/+/151.0.7922.169/components/resources/terms/terms_chromium.txt
+      (fetchpatch {
+        name = "chromium-151-revert-Show-Linux-first-run-terms-of-service-dialog-by-default.patch";
+        # https://chromium-review.googlesource.com/c/chromium/src/+/8257374
+        url = "https://chromium.googlesource.com/chromium/src/+/ae9b17ac975d4b10af762e9344083d858f1347ce^!?format=TEXT";
+        decode = "base64 -d";
+        revert = true;
+        includes = [ "chrome/browser/first_run/first_run.h" ];
+        hash = "sha256-d1Zm2flZPG++ROF4CCawn9U8T7/qgZFMHTXArqIShTk=";
+      })
     ];
 
     postPatch =

pkgs/applications/networking/browsers/chromium/info.json

@@ -1,10 +1,10 @@
 {
   "chromium": {
-    "version": "151.0.7922.108",
+    "version": "151.0.7922.173",
     "chromedriver": {
-      "version": "151.0.7922.109",
-      "hash_darwin": "sha256-VzMu90gOs02icI3PgvpNYXeE5c0QjCVB9CpM287roZo=",
-      "hash_darwin_aarch64": "sha256-5djEbPAayOVr8hr2VfXvlU4W6F+Kd/wiCt5NvQtgoOY="
+      "version": "151.0.7922.174",
+      "hash_darwin": "sha256-ZvSYSZVVXOUVNjBkrXNQ04qdUcAj7Z2RbWPt6/rVkdo=",
+      "hash_darwin_aarch64": "sha256-10cDX124TzB9kIQfx+Jxzz6mgo3Aq/C+Nfwy9BR0F2c="
     },
     "deps": {
       "depot_tools": {
@@ -21,8 +21,8 @@
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "4744b886309d987d292e43232776d2206cccb13d",
-        "hash": "sha256-1i2IAA5sXyMPBzh6xOIY3CllEDtIS9Buk8Z2Vm1JnYw=",
+        "rev": "a96602f30358e9b5d256a0464e7e4d4bec223004",
+        "hash": "sha256-uumIVSzf318Xd1JB9jESXgpLxXlrvMDclOzSFQqweZ8=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -92,8 +92,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "a17d5224d83f6018eb6a21a644ad9ef86eac475d",
-        "hash": "sha256-oXjtHByC3KrLgG3by6OdvID4ViM+2AnSft+fcspbNG0="
+        "rev": "a17d6c8e92696bc78bcbdaf56fc197ebd0cc1fde",
+        "hash": "sha256-lz8BqENfeHI31L1EOHWlCcE+tANVwuZVrqVDYXMjqQU="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -137,8 +137,8 @@
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "48d9737ff728e6211290d591b203a44cb77a2cc5",
-        "hash": "sha256-OZkgORs2BdFc4tbKD6gUAzqOA/BQ2K3al1p7zggSv0Q="
+        "rev": "29256ad98530582b82d1d6b76bae8354f1565e74",
+        "hash": "sha256-7fh6g+xTrmqa1flbs2NTdiQiaj8N3LShIx3GeqqbZq0="
       },
       "src/third_party/dawn/third_party/glfw3/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -657,8 +657,8 @@
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "86bb2f25f46f4d620b4a26e738f59a9b6c22d2eb",
-        "hash": "sha256-tnUcFuwWtw0uGNIsU38M54V1MAYFs7/2yjP9Cs1fEHo="
+        "rev": "7ad44b72c93c242f96f2563edb566439fe816c0a",
+        "hash": "sha256-hCMg8otfjZU/zzlLZT4ywLFAU1HbXymSTqr7BfQcu5E="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -827,8 +827,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "20ad8d002c17ccc7ccfbefc6c4dcf1242fe80921",
-        "hash": "sha256-J2dblSPMoZTpotDpuPp6beRYv+KtCirqNxEGEQKpqcQ="
+        "rev": "4b407bc23f23059b1019cde542601c2cf8f70eb2",
+        "hash": "sha256-TB1A+iIyZOdlbHvim1JOaXOf9uQnoAYqbUL2+PFKUcs="
       },
       "src/agents/shared": {
         "url": "https://chromium.googlesource.com/chromium/agents.git",
@@ -838,7 +838,7 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "151.0.7922.108",
+    "version": "151.0.7922.173",
     "deps": {
       "depot_tools": {
         "rev": "94e89b10b92cc9d6e58fc8d1b6474b7d29e8a114",
@@ -850,16 +850,16 @@
         "hash": "sha256-T2LdISIkp8fcUli5ZetTqrESBAc7coJhWdJv7I+o9kk="
       },
       "ungoogled-patches": {
-        "rev": "151.0.7922.108-1",
-        "hash": "sha256-EhnX4fkuKTTIF6wztKWitrjNzKUf36fAnr7lUkJqJtQ="
+        "rev": "151.0.7922.173-1",
+        "hash": "sha256-m7Wp64ns06DXbjMcLT9Dz6WBBqBGCPkrCuveYZ/VqZ4="
       },
       "npmHash": "sha256-pF0JtwFpPC4/fodbhSJnQKkczA9WlDg4VqEAy9aDVLg="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "4744b886309d987d292e43232776d2206cccb13d",
-        "hash": "sha256-1i2IAA5sXyMPBzh6xOIY3CllEDtIS9Buk8Z2Vm1JnYw=",
+        "rev": "a96602f30358e9b5d256a0464e7e4d4bec223004",
+        "hash": "sha256-uumIVSzf318Xd1JB9jESXgpLxXlrvMDclOzSFQqweZ8=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -929,8 +929,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "a17d5224d83f6018eb6a21a644ad9ef86eac475d",
-        "hash": "sha256-oXjtHByC3KrLgG3by6OdvID4ViM+2AnSft+fcspbNG0="
+        "rev": "a17d6c8e92696bc78bcbdaf56fc197ebd0cc1fde",
+        "hash": "sha256-lz8BqENfeHI31L1EOHWlCcE+tANVwuZVrqVDYXMjqQU="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -974,8 +974,8 @@
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "48d9737ff728e6211290d591b203a44cb77a2cc5",
-        "hash": "sha256-OZkgORs2BdFc4tbKD6gUAzqOA/BQ2K3al1p7zggSv0Q="
+        "rev": "29256ad98530582b82d1d6b76bae8354f1565e74",
+        "hash": "sha256-7fh6g+xTrmqa1flbs2NTdiQiaj8N3LShIx3GeqqbZq0="
       },
       "src/third_party/dawn/third_party/glfw3/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -1494,8 +1494,8 @@
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "86bb2f25f46f4d620b4a26e738f59a9b6c22d2eb",
-        "hash": "sha256-tnUcFuwWtw0uGNIsU38M54V1MAYFs7/2yjP9Cs1fEHo="
+        "rev": "7ad44b72c93c242f96f2563edb566439fe816c0a",
+        "hash": "sha256-hCMg8otfjZU/zzlLZT4ywLFAU1HbXymSTqr7BfQcu5E="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -1664,8 +1664,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "20ad8d002c17ccc7ccfbefc6c4dcf1242fe80921",
-        "hash": "sha256-J2dblSPMoZTpotDpuPp6beRYv+KtCirqNxEGEQKpqcQ="
+        "rev": "4b407bc23f23059b1019cde542601c2cf8f70eb2",
+        "hash": "sha256-TB1A+iIyZOdlbHvim1JOaXOf9uQnoAYqbUL2+PFKUcs="
       },
       "src/agents/shared": {
         "url": "https://chromium.googlesource.com/chromium/agents.git",

pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix

@@ -10,11 +10,11 @@
 buildMozillaMach rec {
   pname = "firefox-beta";
   binaryName = "firefox-beta";
-  version = "153.0b13";
+  version = "154.0b10";
   applicationName = "Firefox Beta";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "fecfb1837d1907d54ed52bc40113804b6637352c2cbe6eb906f950d7749cbece32446b42c392102fa9e16591949619237dc2dbeb13bec18697ddd42e9ce8d4dd";
+    sha512 = "ddbe3ff45217a16df9eecfac52fcb12425accae76457e7054b20bd085f5b22908940a20448f213c3dc62d1276bb1c81f38194432336ba97459b2c17393ebd3cd";
   };
 
   meta = {

pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix

@@ -10,13 +10,13 @@
 buildMozillaMach rec {
   pname = "firefox-devedition";
   binaryName = "firefox-devedition";
-  version = "154.0b4";
+  version = "154.0b10";
   applicationName = "Firefox Developer Edition";
   requireSigning = false;
   branding = "browser/branding/aurora";
   src = fetchurl {
     url = "mirror://mozilla/devedition/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "1dae1edf7b97891224d186f469e31cfa0d2c4fbbdfd6d03f74c03b4421902739fee8d359c66b3c2c431318a4212b0e6221456a233fd6a141c96122f3c6e62bea";
+    sha512 = "e2275579e4769a0690010d8fbba528a0e347d86f0dc981d1702b3e627d9c73f3fd7399d3e618c514bf6a3c0059fa3aa5a29f9cdec802e52955a03b1122ca8d39";
   };
 
   # buildMozillaMach sets MOZ_APP_REMOTINGNAME during configuration, but

pkgs/applications/networking/browsers/firefox/packages/firefox-esr-140.nix

@@ -9,11 +9,11 @@
 
 buildMozillaMach rec {
   pname = "firefox";
-  version = "140.13.0esr";
+  version = "140.14.0esr";
   applicationName = "Firefox ESR";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "937a4103d71c5e1e4bf051821729f6ea70b5c18d444930a487695cc23d74712a0134047248f6ac02305e01becb705426a55b9d89739f02a01eda01ecf5bc27f1";
+    sha512 = "0609cca9bfaecbff56cdf13458534bd8cfa43f139056867d3b6394a767281599ee600f83165ad25565ced59b552592aa84431357458ccecfbe5bf104dca501c7";
   };
 
   meta = {

pkgs/applications/networking/browsers/firefox/packages/firefox-esr-153.nix

@@ -8,11 +8,11 @@
 
 buildMozillaMach rec {
   pname = "firefox";
-  version = "153.0esr";
+  version = "153.1.0esr";
   applicationName = "Firefox ESR";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "3ea7956ef2fdcaa86430ef922f04484cbb1a3faf447e035107159fcd5ecd8d0a0e4507a332fc3d7b66e4308c38733bd0624affd7629447b89c655a9ea0fb0936";
+    sha512 = "0e5be18878a1bb8575d4ff03b499a092663fcd1779a05b59b82a8b663a3d7047cf3d6f971faeb3d1262f83b23022a703a2033e8ea38bcbd9c85f44bdd35d86c1";
   };
 
   meta = {

pkgs/applications/networking/browsers/firefox/packages/firefox.nix

@@ -9,10 +9,10 @@
 
 buildMozillaMach rec {
   pname = "firefox";
-  version = "153.0.3";
+  version = "154.0";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "449f30c51c94f53df2ceb45e27d7a2724269c929519159149de9c8f63f797af2c1cb2b5cd0a6aaf67326ccfd0c23c133fd6831b832af1a258632da5a864824bc";
+    sha512 = "a77cd664982add628681167ef5939bd6bf0c894aa380cca66f9b5fb265947874d1e819d42264f1dd07c843f8a6dc020da268cca9ff1e064fca019de91af9b996";
   };
 
   meta = {

pkgs/applications/networking/instant-messengers/discord/default.nix

@@ -74,7 +74,7 @@ let
     mainProgram = "discord";
     maintainers = with lib.maintainers; [
       artturin
-      FlameFlag
+      _4evy
       infinidoge
       jopejoe1
       Scrumplex

pkgs/applications/networking/instant-messengers/ferdium/default.nix

@@ -4,26 +4,35 @@
   fetchurl,
   libxshmfence,
   stdenv,
+  writeShellScript,
+  nix-update,
+  jq,
+  nix,
+  common-updater-scripts,
 }:
 
 let
+  inherit (stdenv.hostPlatform) system;
+  throwSystem = throw "ferdium: arch ${system} not supported";
+
   arch =
     {
       x86_64-linux = "amd64";
       aarch64-linux = "arm64";
     }
-    ."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+    .${system} or throwSystem;
+
   hash =
     {
-      amd64-linux_hash = "sha256-1jXo8MMk2EEkLo0n4ICmGJteKProLYKkMF//g63frHs=";
-      arm64-linux_hash = "sha256-jYDGVZhL0bswowm1H/4aa35lNJalil6ymV34NQM5Gfc=";
+      x86_64-linux = "sha256-ODQKFjBa2riJY26aPaAfLzuCyLYkB5oYSxIE28nMmwY=";
+      aarch64-linux = "sha256-CYHoTw6JUyU63iTd9tAbfWVnb48WcZgGtjthqnlAD8I=";
     }
-    ."${arch}-linux_hash";
+    .${system} or throwSystem;
 in
 mkFranzDerivation rec {
   pname = "ferdium";
   name = "Ferdium";
-  version = "7.1.1";
+  version = "7.1.2";
   src = fetchurl {
     url = "https://github.com/ferdium/ferdium-app/releases/download/v${version}/Ferdium-linux-${version}-${arch}.deb";
     inherit hash;
@@ -31,9 +40,21 @@ mkFranzDerivation rec {
 
   extraBuildInputs = [ libxshmfence ];
 
-  passthru = {
-    updateScript = ./update.sh;
-  };
+  passthru.updateScript = writeShellScript "update-ferdium" ''
+    ${lib.getExe nix-update} ferdium --no-src --override-filename pkgs/applications/networking/instant-messengers/ferdium/default.nix
+    latestVersion=$(nix eval --raw --file . ferdium.version)
+    if [[ "$latestVersion" == "$UPDATE_NIX_OLD_VERSION" ]]; then
+      exit 0
+    fi
+    for system in x86_64-linux aarch64-linux; do
+      hash=$(${lib.getExe nix} store prefetch-file --json \
+        "$(nix eval --raw --file . ferdium.src.url --argstr system "$system")" \
+        | ${lib.getExe jq} --raw-output .hash)
+      ${lib.getExe' common-updater-scripts "update-source-version"} \
+        ferdium "$latestVersion" "$hash" --system="$system" \
+        --ignore-same-version --ignore-same-hash
+    done
+  '';
 
   meta = {
     description = "All your services in one place built by the community";

pkgs/applications/networking/instant-messengers/ferdium/update.sh

@@ -1,12 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p git bash curl jq nix-update
-
-set -xe
-
-dirname="$(dirname "$0")"
-
-latestTag=$(curl https://api.github.com/repos/ferdium/ferdium-app/releases/latest | jq -r ".tag_name")
-latestVersion="$(expr $latestTag : 'v\(.*\)')"
-
-nix-update --version "$latestVersion" --system aarch64-linux --override-filename "$dirname/default.nix" ferdium
-nix-update --version skip --system x86_64-linux --override-filename "$dirname/default.nix" ferdium

pkgs/applications/networking/instant-messengers/gajim/default.nix

@@ -42,14 +42,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "gajim";
-  version = "2.4.7.1";
+  version = "2.5.0";
 
   src = fetchFromGitLab {
     domain = "dev.gajim.org";
     owner = "gajim";
     repo = "gajim";
-    tag = "${finalAttrs.version}+win";
-    hash = "sha256-/X2Xp1ZnPLTZc1Hf4Kp6R/+mezU6qoUhaT9OskYlnOY=";
+    tag = finalAttrs.version;
+    hash = "sha256-3/HQNizXLjeQpCdEK14LMflyNUKF1BI8eli3BGxiH40=";
   };
 
   pyproject = true;
@@ -59,11 +59,11 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     adwaita-icon-theme
     gtksourceview5
     glib-networking
+    gstreamer
+    gst-plugins-base
   ]
   ++ lib.optionals enableJingle [
     farstream
-    gstreamer
-    gst-plugins-base
     gst-libav
     gst-plugins-good
     libnice

pkgs/applications/networking/irc/weechat/scripts/weechat-matrix/default.nix

@@ -60,7 +60,7 @@ buildPythonPackage {
     attrs
     logbook
     pygments
-    (matrix-nio.override { withOlm = true; })
+    (matrix-nio.override { withVodozemac = true; })
     aiohttp
     requests
   ];

pkgs/applications/networking/mailreaders/thunderbird/packages.nix

@@ -77,8 +77,8 @@ rec {
   thunderbird = thunderbird-latest;
 
   thunderbird-latest = common {
-    version = "153.0.1";
-    sha512 = "d69e6c8fd32742cf21752f27bac918eb2234989ae19ca36b5cfd131213c356924d3d48ef9d54c3a256cf5139eb7c38be5f1d1bd9cd2ee7ffccf12b953f3f5d2a";
+    version = "153.0.3";
+    sha512 = "6a9271af8473fa6679d4943a35fab0a335e8eb736aebfab4d79e250578faf6090cda19e80708487bec7c2221242b059072dda9ca817478a6d76556594972202b";
 
     updateScript = callPackage ./update.nix {
       attrPath = "thunderbirdPackages.thunderbird-latest";
@@ -91,8 +91,8 @@ rec {
   thunderbird-153 = common {
     applicationName = "Thunderbird ESR";
 
-    version = "153.0.1esr";
-    sha512 = "3773b49b69341aea108a627faa0dd5b7cfb52cdb4c37e625fbb8cbaef7f9166f925ecbc199173302d5bef7994e6bff3b56cd56a3a4c38a9d702cc3e5aeafcf7c";
+    version = "153.1.0esr";
+    sha512 = "3d6c82e1489b906e6cf73c3eeb7d7e23de6901a75c704176b996d183a889f24275214999155992789a57a713e6cd073e2752120c3b281136ed34f36f289fbcb4";
 
     updateScript = callPackage ./update.nix {
       attrPath = "thunderbirdPackages.thunderbird-153";

pkgs/applications/science/logic/coq/default.nix

@@ -286,7 +286,10 @@ let
       + ''
         ln -s $out/lib/coq${suffix} $OCAMLFIND_DESTDIR/coq${suffix}
       ''
-      + lib.optionalString (coqAtLeast "8.14") ''
+      + lib.optionalString (coqAtLeast "9.4") ''
+        ln -s $out/lib/rocqide-server $OCAMLFIND_DESTDIR/rocqide-server
+      ''
+      + lib.optionalString (coqAtLeast "8.14" && !coqAtLeast "9.4") ''
         ln -s $out/lib/coqide-server $OCAMLFIND_DESTDIR/coqide-server
       ''
       + lib.optionalString buildIde ''
@@ -315,6 +318,7 @@ let
       mainProgram = if buildIde then "coqide" else "coqtop";
     };
   };
+  coqrocqide-server = if coqAtLeast "9.4" then "rocqide-server" else "coqide-server";
 in
 if coqAtLeast "8.21" then
   self.overrideAttrs (o: {
@@ -324,12 +328,12 @@ if coqAtLeast "8.21" then
     ];
     buildPhase = ''
       runHook preBuild
-      dune build -p coq-core,coqide-server${lib.optionalString buildIde ",rocqide"} -j $NIX_BUILD_CORES
+      dune build -p coq-core,${coqrocqide-server}${lib.optionalString buildIde ",rocqide"} -j $NIX_BUILD_CORES
       runHook postBuild
     '';
     installPhase = ''
       runHook preInstall
-      dune install --prefix $out coq-core coqide-server${lib.optionalString buildIde " rocqide"}
+      dune install --prefix $out coq-core ${coqrocqide-server}${lib.optionalString buildIde " rocqide"}
       # coq and rocq are now in different directories, which sometimes confuses coq_makefile
       # which expects both in the same /nix/store/.../bin/ directory
       # adding symlinks to content it

pkgs/applications/video/obs-studio/plugins/obs-source-record.nix

@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/exeldro/obs-source-record";
     maintainers = with lib.maintainers; [
       robbins
-      shackra
+      elzorrorebelde
     ];
     license = lib.licenses.gpl2Only;
     inherit (obs-studio.meta) platforms;

pkgs/applications/virtualization/docker/compose.nix

@@ -6,16 +6,16 @@
 }:
 buildGoModule rec {
   pname = "docker-compose";
-  version = "5.1.4";
+  version = "5.4.0";
 
   src = fetchFromGitHub {
     owner = "docker";
     repo = "compose";
     tag = "v${version}";
-    hash = "sha256-sdRxssZ6bRGRB/WPp2BiDTVHQ5LBmNGwXQYBdSpylQg=";
+    hash = "sha256-BLApJ1RWI2nUM3EDFLWBPwIbT+wUUCqxCRjc7QlkFd4=";
   };
 
-  vendorHash = "sha256-hgNboIZx5QOGjPadey4f2TKpPw+b2sja6mcwoMjINuY=";
+  vendorHash = "sha256-NCHNe+aLNsJNtKdgQxyL6cMuu9XxA5ycleHf9gToEks=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
 

pkgs/applications/virtualization/docker/default.nix

@@ -424,18 +424,18 @@ in
 
   docker_29 =
     let
-      version = "29.6.2";
+      version = "29.7.2";
     in
     callPackage dockerGen {
       inherit version;
       cliRev = "v${version}";
-      cliHash = "sha256-WpPSePMCfWAVxCkX1nZyI+sra/Vug009ZPmnVKDaX0I=";
+      cliHash = "sha256-ZYXRX4IQfUbb21yk/NodO5NH5OeX/KFDL9UdFS1e5ng=";
       mobyRev = "docker-v${version}";
-      mobyHash = "sha256-zrvrZCRUuiZ2vixZNOUFeGmDehHzSI+FzDMzV1gMqMc=";
-      runcRev = "v1.3.6";
-      runcHash = "sha256-cBMYZOElWHQ4OkF2NlYJSZrlW4833WD8CRJRkkXeKJc=";
-      containerdRev = "v2.2.6";
-      containerdHash = "sha256-Ngo9x847cXFYPnj/0I+g7BeV7e1/5T2YXfA1zkIdiPg=";
+      mobyHash = "sha256-k28c4cwt+ASVj8FTvM8dgIOL3yqR5wbI21r3LtrVamU=";
+      runcRev = "v1.4.3";
+      runcHash = "sha256-I9DruagoSWjrEBB4n+w5rzali5wvD/q3tVQFWPDnLAI=";
+      containerdRev = "v2.3.3";
+      containerdHash = "sha256-wa9Pixaq5RRrJucWibbBe4n6s53Pdj+mr5gLoFmDgLU=";
       tiniRev = "369448a167e8b3da4ca5bca0b3307500c3371828";
       tiniHash = "sha256-jCBNfoJAjmcTJBx08kHs+FmbaU82CbQcf0IVjd56Nuw=";
     };

pkgs/applications/virtualization/virtualbox/default.nix

@@ -72,9 +72,9 @@ let
   buildType = "release";
   # Use maintainers/scripts/update.nix to update the version and all related hashes or
   # change the hashes in extpack.nix and guest-additions/default.nix as well manually.
-  virtualboxVersion = "7.2.14";
+  virtualboxVersion = "7.2.16";
   virtualboxSubVersion = "";
-  virtualboxSha256 = "384f293184c52fd51bc941c17d753b4019446f53a6b07c828adfb3e61fe0a500";
+  virtualboxSha256 = "50356ccdaefe8f03537600ec31898b506e3a85ce79b94f26fb6cc1920c9e18eb";
 
   kvmPatchVboxVersion = "7.2.6";
   kvmPatchVersion = "20260201";

pkgs/applications/virtualization/virtualbox/extpack.nix

@@ -5,7 +5,7 @@
 }:
 fetchurl rec {
   pname = "virtualbox-extpack";
-  version = "7.2.14";
+  version = "7.2.16";
   name = "Oracle_VirtualBox_Extension_Pack-${version}.vbox-extpack";
   url = "https://download.virtualbox.org/virtualbox/${version}/${name}";
   sha256 =
@@ -13,7 +13,7 @@ fetchurl rec {
     # Thus do not use `nix-prefetch-url` but instead plain old `sha256sum`.
     # Checksums can also be found at https://download.virtualbox.org/virtualbox/${version}/SHA256SUMS
     let
-      value = "ce4461de974f041435660751b382f987fece831028a8c98572d668eda2eee96d";
+      value = "d1e268cfa05223fd651703043af09f39dfb90da259ce9ec093d9d9b022f19689";
     in
     assert (builtins.stringLength value) == 64;
     value;

pkgs/applications/virtualization/virtualbox/guest-additions-iso/default.nix

@@ -5,7 +5,7 @@
 }:
 fetchurl {
   url = "http://download.virtualbox.org/virtualbox/${virtualboxVersion}/VBoxGuestAdditions_${virtualboxVersion}.iso";
-  sha256 = "4f51a073296de31cce53924860549149be5dc339f65dcd1dbf34fd7accefe8fb";
+  sha256 = "c9349c0231d81c821fc1de7b9592bf07bb7c3f111c3f942ddddc211496ef7a3e";
   meta = {
     description = "Guest additions ISO for VirtualBox";
     longDescription = ''

pkgs/applications/virtualization/virtualbox/guest-additions/default.nix

@@ -18,9 +18,9 @@
   libx11,
 }:
 let
-  virtualboxVersion = "7.2.14";
+  virtualboxVersion = "7.2.16";
   virtualboxSubVersion = "";
-  virtualboxSha256 = "384f293184c52fd51bc941c17d753b4019446f53a6b07c828adfb3e61fe0a500";
+  virtualboxSha256 = "50356ccdaefe8f03537600ec31898b506e3a85ce79b94f26fb6cc1920c9e18eb";
 
   platform =
     if stdenv.hostPlatform.isAarch64 then
@@ -96,6 +96,11 @@ stdenv.mkDerivation {
   ]
   ++ kernel.moduleBuildDependencies;
 
+  # https://github.com/VirtualBox/virtualbox/issues/812
+  postPatch = ''
+    substituteInPlace ./src/vboxguest-${virtualboxVersion}_NixOS/vboxvideo/vbox_fb.c --replace-fail "RTLNX_VER_MIN(6,19,0)" "RTLNX_VER_RANGE(6,6,152, 6,6,999) || RTLNX_VER_RANGE(6,12,103, 6,12,999) || RTLNX_VER_RANGE(6,18,44, 6,18,999) || RTLNX_VER_MIN(6,19,0)"
+  '';
+
   buildPhase = ''
     runHook preBuild
 

pkgs/build-support/ocaml/dune.nix

@@ -18,6 +18,7 @@ lib.extendMkDerivation {
     {
       pname,
       version,
+      dunePackages ? [ pname ],
       nativeBuildInputs ? [ ],
       enableParallelBuilding ? true,
       ...
@@ -58,14 +59,14 @@ lib.extendMkDerivation {
         buildPhase =
           args.buildPhase or ''
             runHook preBuild
-            dune build -p ${pname} ''${enableParallelBuilding:+-j $NIX_BUILD_CORES}
+            dune build -p ${lib.concatStringsSep "," dunePackages} ''${enableParallelBuilding:+-j $NIX_BUILD_CORES}
             runHook postBuild
           '';
 
         installPhase =
           args.installPhase or ''
             runHook preInstall
-            dune install --prefix $out --libdir $OCAMLFIND_DESTDIR ${pname} \
+            dune install --prefix $out --libdir $OCAMLFIND_DESTDIR ${lib.concatStringsSep " " dunePackages} \
              ${
                if lib.versionAtLeast Dune.version "2.9" then
                  "--docdir $out/share/doc --mandir $out/share/man"
@@ -78,7 +79,7 @@ lib.extendMkDerivation {
         checkPhase =
           args.checkPhase or ''
             runHook preCheck
-            dune runtest -p ${pname} ''${enableParallelBuilding:+-j $NIX_BUILD_CORES}
+            dune runtest -p ${lib.concatStringsSep "," dunePackages} ''${enableParallelBuilding:+-j $NIX_BUILD_CORES}
             runHook postCheck
           '';
 

pkgs/by-name/ac/acli/sources.json

@@ -1,21 +1,21 @@
 {
-  "version": "1.3.22-stable",
+  "version": "1.3.29-stable",
   "sources": {
     "aarch64-darwin": {
-      "url": "https://acli.atlassian.com/darwin/1.3.22-stable/acli_1.3.22-stable_darwin_arm64.tar.gz",
-      "sha256": "3a9a6ff1bb0bce5902780e26e748b18b9adb4489df67d88ea878f4b7673944ad"
+      "url": "https://acli.atlassian.com/darwin/1.3.29-stable/acli_1.3.29-stable_darwin_arm64.tar.gz",
+      "sha256": "b2f6343d13ac8f3c32ea1043aba8317876d845662967793eb00016a2e5b5cf79"
     },
     "aarch64-linux": {
-      "url": "https://acli.atlassian.com/linux/1.3.22-stable/acli_1.3.22-stable_linux_arm64.tar.gz",
-      "sha256": "1a9e86d0b46a62a8f1992c1ef98b3af7e9a9ee3f76d0efa215fe1f2d1b2fd139"
+      "url": "https://acli.atlassian.com/linux/1.3.29-stable/acli_1.3.29-stable_linux_arm64.tar.gz",
+      "sha256": "cea39c4eb90c65d8d0cafc869a75fa3b6afaaf4573f8da650f4ae73801f8ec46"
     },
     "x86_64-darwin": {
       "url": "https://acli.atlassian.com/darwin/1.3.22-stable/acli_1.3.22-stable_darwin_amd64.tar.gz",
       "sha256": "993fd692700d602fd1e3cff7f1d29f70e44a2ebb8056fbb93bdc8aed1e5cbbd4"
     },
     "x86_64-linux": {
-      "url": "https://acli.atlassian.com/linux/1.3.22-stable/acli_1.3.22-stable_linux_amd64.tar.gz",
-      "sha256": "de9e0a60a556e4119428b9072f6ca787e75b9f9a538aa71ebcc8084deb8ca1a6"
+      "url": "https://acli.atlassian.com/linux/1.3.29-stable/acli_1.3.29-stable_linux_amd64.tar.gz",
+      "sha256": "8dcfc7bcf9dc788e7143e93d74445310094977ba1bad2513c6c613460851d34e"
     }
   }
 }

pkgs/by-name/al/alt-tab-macos/package.nix

@@ -35,7 +35,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     homepage = "https://alt-tab-macos.netlify.app";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [
-      FlameFlag
+      _4evy
       emilytrau
     ];
     platforms = lib.platforms.darwin;

pkgs/by-name/an/anker-powerconf-c200-linux-tools/package.nix

@@ -0,0 +1,41 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "anker-powerconf-c200-linux-tools";
+  version = "0.1.0";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "erans";
+    repo = "anker-powerconf-c200-linux-tools";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-txIVTbqxnFQ8GcJgxTp89Qc3U5CXkYolXCO4E1PXHHA=";
+  };
+
+  strictDeps = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out"/bin
+    cp ./build/anker-powerconf-c200-linux-tools "$out"/bin
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Linux CLI tools for the Anker PowerConf C200 webcam";
+    mainProgram = "anker-powerconf-c200-linux-tools";
+    homepage = "https://github.com/erans/anker-powerconf-c200-linux-tools";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fernsehmuell ];
+    platforms = lib.platforms.linux;
+  };
+})

pkgs/by-name/ap/appium-inspector/package.nix

@@ -2,7 +2,7 @@
   lib,
   buildNpmPackage,
   copyDesktopItems,
-  electron_41,
+  electron_43,
   fetchFromGitHub,
   makeDesktopItem,
   makeWrapper,
@@ -14,22 +14,21 @@
 }:
 
 let
-  electron = electron_41;
-  version = "2026.5.1";
+  electron = electron_43;
 in
 
 buildNpmPackage (finalAttrs: {
   pname = "appium-inspector";
-  inherit version;
+  version = "2026.7.1";
 
   src = fetchFromGitHub {
     owner = "appium";
     repo = "appium-inspector";
-    tag = "v${version}";
-    hash = "sha256-SJlTTVTZ/zGIK7Nf35cZ62tdhevXC95MsbiQJCLiVtk=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-7pxXlY/aifrg4cuGZSgxONF+RPL8P7JcZ6Gobqv2nz4=";
   };
 
-  npmDepsHash = "sha256-2rjgKS1mIrjOg+YXuMaqKyEQt0utLA4DGxOs0oI4BaQ=";
+  npmDepsHash = "sha256-W9FWIHhtS2d9xBpIEGB8sWmDfcdyphL+0eCk1+8pu2s=";
   npmFlags = [ "--ignore-scripts" ];
 
   nativeBuildInputs = [
@@ -102,7 +101,7 @@ buildNpmPackage (finalAttrs: {
   meta = {
     description = "GUI inspector for the appium UI automation tool";
     homepage = "https://appium.github.io/appium-inspector";
-    changelog = "https://github.com/appium/appium-inspector/releases/tag/v${version}";
+    changelog = "https://github.com/appium/appium-inspector/releases/tag/v${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     mainProgram = "appium-inspector";
     maintainers = with lib.maintainers; [ marie ];

pkgs/by-name/ar/archon-lite/package.nix

@@ -6,10 +6,10 @@
 }:
 let
   pname = "archon-lite";
-  version = "9.4.36";
+  version = "9.5.0";
   src = fetchurl {
     url = "https://github.com/RPGLogs/Uploaders-archon-lite/releases/download/v${version}/archon-lite-v${version}.AppImage";
-    hash = "sha256-th48nSDIi2iugtiqjgkI7/QZtBq+BRQjRs1pKweDArI=";
+    hash = "sha256-ZuALgVtqsYtvnSq8hkJL4A+i4UaEpk+2L3bpSEXrhRM=";
   };
 
   extracted = appimageTools.extractType2 { inherit pname version src; };
@@ -20,13 +20,12 @@ appimageTools.wrapType2 {
   extraInstallCommands = ''
     mkdir -p $out/share/applications
     mkdir -p $out/share/icons/hicolor/512x512/apps
-    cp -r ${extracted}/usr/share/icons/hicolor/512x512/apps/'Archon App Lite.png' $out/share/icons/hicolor/512x512/apps/archon-lite.png
+    cp -r ${extracted}/usr/share/icons/hicolor/512x512/apps/archon-lite.png $out/share/icons/hicolor/512x512/apps/archon-lite.png
     chmod -R +w $out/share/
     test ! -e $out/share/icons/hicolor/0x0 # check for regression of https://github.com/electron-userland/electron-builder/issues/5294
-    cp ${extracted}/'Archon App Lite.desktop' $out/share/applications/archon-lite.desktop
+    cp ${extracted}/archon-lite.desktop $out/share/applications/archon-lite.desktop
     substituteInPlace $out/share/applications/archon-lite.desktop \
-      --replace-fail "Exec=AppRun --no-sandbox" "Exec=archon-lite" \
-      --replace-fail "Icon=Archon App Lite" "Icon=archon-lite"
+      --replace-fail "Exec=AppRun --no-sandbox" "Exec=archon-lite"
   '';
 
   passthru.updateScript = nix-update-script { };

pkgs/by-name/ar/arti/package.nix

@@ -13,7 +13,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "arti";
-  version = "2.5.0";
+  version = "2.5.1";
 
   src = fetchFromGitLab {
     domain = "gitlab.torproject.org";
@@ -21,7 +21,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "core";
     repo = "arti";
     tag = "arti-v${finalAttrs.version}";
-    hash = "sha256-jOCFXlBI2xAzgpb7Fa8ap53SpDF6kcRGYnBXcu3vpk4=";
+    hash = "sha256-fPobYu2ADTeIwpeXyxQKh5yr1zw+yMQfqTkiZMMd8YY=";
   };
 
   # Working around a bug in cargo that appears with cargo-auditable, see
@@ -32,7 +32,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   '';
 
   buildAndTestSubdir = "crates/arti";
-  cargoHash = "sha256-JK6ubp697jZ98ErNrZdFe0mXIez3lUZ5SmAHkyD97WQ=";
+  cargoHash = "sha256-+JQ+SkRLyLl4RUq69nIUn1zJ/DmYpVEICQO5o85FsNw=";
 
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ pkg-config ];