Merge master into staging-next

Diff: 20260910...20260916

nixos/doc/manual/redirects.json

@@ -1,4 +1,13 @@
 {
+  "module-services-netbird-relay": [
+    "index.html#module-services-netbird-relay"
+  ],
+  "module-services-netbird-relay-quickstart": [
+    "index.html#module-services-netbird-relay-quickstart"
+  ],
+  "module-services-netbird-relay-tls": [
+    "index.html#module-services-netbird-relay-tls"
+  ],
   "module-services-portmaster": [
     "index.html#module-services-portmaster"
   ],

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -132,6 +132,8 @@
 
 - [qbit-manage](https://github.com/StuffAnThings/qbit_manage), a tool to help manage tedious tasks in qBittorrent and automate them. Available as [services.qbit-manage](#opt-services.qbit-manage.enable).
 
+- [Netbird Relay](https://netbird.io/), a module to relay traffic when a point-to-point connection is not possible.
+
 ## Backward Incompatibilities {#sec-release-26.11-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

nixos/modules/module-list.nix

@@ -1353,6 +1353,7 @@
   ./services/networking/nebula-lighthouse-service.nix
   ./services/networking/nebula.nix
   ./services/networking/netbird.nix
+  ./services/networking/netbird/netbird-relay.nix
   ./services/networking/netbird/server.nix
   ./services/networking/netclient.nix
   ./services/networking/netfoil.nix

nixos/modules/services/cluster/kubernetes/kubelet.nix

@@ -129,13 +129,24 @@ in
     };
 
     clusterDns = mkOption {
-      description = "Use alternative DNS.";
+      description = ''
+        List of DNS resolvers (IP addresses) used inside containers.
+
+        Defaulted to {option}`services.kubernetes.addons.dns.clusterIp`
+        when {option}`services.kubernetes.addons.dns.enable` is `true`.
+
+        Refer to the list of configuration attributes for [KubeletConfiguration](https://kubernetes.io/docs/reference/config-api/kubelet-config.v1beta1/#kubelet-config-k8s-io-v1beta1-KubeletConfiguration).
+      '';
       default = [ "10.1.0.1" ];
       type = listOf str;
     };
 
     clusterDomain = mkOption {
-      description = "Use alternative domain.";
+      description = ''
+        Search DNS domain used inside containers.
+
+        Refer to the list of configuration attributes for [KubeletConfiguration](https://kubernetes.io/docs/reference/config-api/kubelet-config.v1beta1/#kubelet-config-k8s-io-v1beta1-KubeletConfiguration).
+      '';
       default = config.services.kubernetes.addons.dns.clusterDomain;
       defaultText = literalExpression "config.${options.services.kubernetes.addons.dns.clusterDomain}";
       type = str;

nixos/modules/services/networking/netbird.md

@@ -1,4 +1,4 @@
-# Netbird {#module-services-netbird}
+# Netbird Client {#module-services-netbird}
 
 ## Quickstart {#module-services-netbird-quickstart}
 

nixos/modules/services/networking/netbird/netbird-relay.md

@@ -0,0 +1,92 @@
+# Netbird Relay {#module-services-netbird-relay}
+
+The Relay service forwards encrypted WireGuard traffic between peers that cannot establish a direct P2P connection
+
+For more information, check [external relays](https://docs.netbird.io/selfhosted/maintenance/scaling/set-up-external-relays) documentation.
+
+## Quickstart {#module-services-netbird-relay-quickstart}
+
+You can run the relay directly, or behind a reverse proxy, like `traefik`.
+
+To run it directly, you'll have to run it on HTTPS port (443) and it will need the TLS certificates. Which you can configure using the `acme` module.
+
+In the following example, we can see the `traefik` route and the relay configuration.
+The operator should configure the TLS for the domain used by the relay, whether it's via `traefik` itself or using the `acme` module.
+
+```nix
+let
+  relayDomain = "relay.example.com";
+in
+{
+  services.netbird.relay = {
+    enable = true;
+    settings = {
+      listen-address = ":33080";
+      exposed-address = "rels://${relayDomain}:443";
+      log-level = "info";
+      enable-stun = true;
+      stun-ports = [ 3479 ];
+    };
+    openFirewall = true;
+    authSecretFile = "/run/auth_secret";
+  };
+
+  services.traefik = {
+    enable = true;
+    dynamicConfigOptions = {
+      http = {
+        routers = {
+          vpn-relay = {
+            rule = "Host(`${relayDomain}`)";
+            entryPoints = [ "websecure" ];
+            service = "vpn-relay-svc";
+            tls = { };
+          };
+        };
+        services = {
+          vpn-relay-svc = {
+            loadBalancer.servers = [ { url = "http://[::1]:33080"; } ];
+          };
+        };
+      };
+    };
+  };
+}
+```
+
+Finally, you must let `netbird.server` know about the new relay:
+
+```nix
+{ }:
+{
+  services.netbird.server = {
+    # ...other config...
+    management = {
+      # ...other config...
+      settings = {
+        # ...other config...
+        Relay = {
+          Addresses = [ "rels://${relayDomain}:443" ];
+          CredentialsTTL = "24h0m0s";
+          Secret = {
+            _secret = "/run/auth_secret";
+          };
+        };
+      };
+    };
+  };
+}
+```
+Done!
+
+## TLS with Let's Encrypt {#module-services-netbird-relay-tls}
+
+You can expose the netbird relay directly to the internet with TLS. Then you won't need a reverse proxy.
+
+To use TLS, set `settings."letsencrypt-domains"`.
+The relay gets and renews the certificates only when `settings."letsencrypt-domains"` is set.
+
+Certificates are stored on disk, and the services runs as a systemd dynamic user.
+The only writable location is therefore a `StateDirectory`, which can only be under `/var/lib`.
+
+Open the ports `tcp/443` and `tcp/80` manually for the HTTP challenge.

nixos/modules/services/networking/netbird/netbird-relay.nix

@@ -0,0 +1,248 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib)
+    getExe'
+    types
+    ;
+
+  cfg = config.services.netbird.relay;
+  cmd = getExe' cfg.package "netbird-relay";
+  derivedLEDataDir = lib.optionalAttrs (
+    cfg.settings ? "letsencrypt-domain" && !cfg.settings ? "letsencrypt-data-dir"
+  ) { "letsencrypt-data-dir" = "/var/lib/netbird-relay"; };
+
+  args = lib.cli.toCommandLineShellGNU { } (cfg.settings // derivedLEDataDir);
+
+  listenPortMatch = builtins.match ".*:([0-9]+)$" cfg.settings.listen-address;
+  listenPort = if listenPortMatch == null then null else lib.toInt (builtins.head listenPortMatch);
+
+  # Checks
+  authSecretSet = cfg.authSecretFile != null;
+  needsPrivPort = listenPort != null && listenPort < 1024;
+  letsencryptEnabled = cfg.settings ? "letsencrypt-domain";
+in
+{
+  options.services.netbird.relay = {
+    enable = lib.mkEnableOption "Netbird's Relay Service";
+    package = lib.mkPackageOption pkgs "netbird-relay" { };
+
+    # as per RFC 0042:
+    settings = lib.mkOption {
+      type = types.submodule {
+        freeformType =
+          with lib.types;
+          nullOr (oneOf [
+            bool
+            str
+            # For --letsencrypt-domains strings
+            (listOf (oneOf [ str ]))
+          ]);
+        options.listen-address = lib.mkOption {
+          type = types.str;
+          description = ''
+            The host address and port separated by colon where the relay will listen
+          '';
+          default = ":33080";
+        };
+        options.exposed-address = lib.mkOption {
+          type = types.str;
+          description = ''
+            Exposed address for peers. Address told to the peers to connect to
+          '';
+          example = "rels://relay.example.com:443";
+        };
+        options.enable-stun = lib.mkOption {
+          type = types.bool;
+          default = false;
+          description = "Enable embedded STUN server";
+        };
+        options.stun-ports = lib.mkOption {
+          type = types.listOf types.port;
+          default = [ 3478 ];
+          description = "STUN server UDP ports";
+        };
+        options.log-level = lib.mkOption {
+          type = types.enum [
+            "panic"
+            "fatal"
+            "error"
+            "warn"
+            "info"
+            "debug"
+            "trace"
+          ];
+          default = "info";
+          description = "Log level of the netbird relay service";
+        };
+        options.metrics-port = lib.mkOption {
+          type = types.port;
+          default = 9092;
+          description = "Metrics endpoint http port. Metrics are accessible under host:metrics-port/metrics";
+        };
+        options.health-listen-address = lib.mkOption {
+          type = types.str;
+          description = ''
+            Listen address of healthcheck server
+          '';
+          default = ":9000";
+        };
+      };
+      default = null;
+      description = ''
+        Settings to configure the netbird relay.
+        Converted automatically into cli args, check all the options with `netbird-relay --help`
+      '';
+    };
+
+    environmentFile = lib.mkOption {
+      type = types.nullOr types.externalPath;
+      default = null;
+      description = ''
+        Path (as string) to an environmentFile with the netbird relay environment variables.
+        You can find all the variables under [Relay runtime env variables](https://docs.netbird.io/selfhosted/environment-variables#runtime-variables-2).
+
+        WARNING: You must manually open any port configured via environmentFile.
+        If you use an Internet domain privileged port (e.g 443), add CAP_NET_BIND_SERVICE to systemd's CapabilityBoundingSet and AmbientCapabilities
+      '';
+      example = "/run/netbird-relay.env";
+    };
+
+    openFirewall = lib.mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Open STUN ports in the firewall for the netbird relay.
+
+        WARNING: You must manually open listen-address port/tcp and port 80/tcp,
+        if you are exposing the relay directly to the internet.
+        Review [set-up-external-relays](https://docs.netbird.io/selfhosted/maintenance/scaling/set-up-external-relays)
+      '';
+    };
+
+    authSecretFile = lib.mkOption {
+      type = types.nullOr types.externalPath;
+      default = null;
+      description = ''
+        Path (as string) to a file containing the auth-secret used by netbird to connect to the relay server.
+        It will populate `NB_AUTH_SECRET`
+      '';
+      example = "/run/auth_secret";
+    };
+
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = authSecretSet || cfg.environmentFile != null;
+        message = "services.netbird.relay requires NB_AUTH_SECRET, either set authSecretFile or configure it in environmentFile";
+      }
+      {
+        assertion = !(cfg.settings.auth-secret or null != null);
+        message = "settings.auth-secret puts the secret into the nix store and the cli args. Use relay.authSecretFile instead";
+      }
+      {
+        assertion =
+          !letsencryptEnabled || lib.hasPrefix "/var/lib/" (cfg.settings."letsencrypt-data-dir" or "");
+        message = "settings.letsencrypt-data-dir must be under /var/lib, the only writable location when using DynamidcUser in systemd";
+      }
+      {
+        assertion = !(cfg.settings.enable-stun && cfg.settings.stun-ports == [ ]);
+        message = "Missing stun ports while enable-stun = true";
+      }
+    ];
+
+    systemd.services.netbird-relay = {
+      description = "Relay for Netbird, a wireguard VPN";
+      documentation = [ "https://netbird.io/docs/" ];
+      after = [
+        "network.target"
+      ];
+      wantedBy = [ "multi-user.target" ];
+
+      script = ''
+        ${lib.optionalString authSecretSet ''
+          export NB_AUTH_SECRET="$(< "$CREDENTIALS_DIRECTORY/auth_secret")"
+        ''}
+        exec ${cmd} ${args}
+      '';
+      unitConfig = {
+        # Spread the restart
+        StartLimitIntervalSec = 60;
+        StartLimitBurst = 10;
+      };
+      serviceConfig = {
+        EnvironmentFile = lib.mkIf (cfg.environmentFile != null) [ cfg.environmentFile ];
+
+        # Let systemd ingest the secret safely
+        LoadCredential = lib.mkIf authSecretSet "auth_secret:${cfg.authSecretFile}";
+
+        Restart = "always";
+        RestartSec = "5s";
+
+        StateDirectory = lib.mkIf letsencryptEnabled (
+          lib.removeSuffix "/" (lib.removePrefix "/var/lib/" cfg.settings."letsencrypt-data-dir")
+        );
+
+        # Hardening::Start
+        # Dynamic user automatically sets:
+        #   NoNewPrivileges = true;
+        #   RemoveIPC = true;
+        #   RestrictSUIDSGID = true;
+        #   ProtectSystem = "strict";
+        #   ProtectHome = "read-only";
+        # see https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#DynamicUser=
+        DynamicUser = true;
+
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        # Relay is mostly stateless, no need to give access to any of this:
+        PrivateDevices = true;
+        PrivateMounts = true;
+        PrivateTmp = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProcSubset = "pid";
+        ProtectProc = "invisible";
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        SystemCallFilter = [ "@system-service" ];
+        SystemCallArchitectures = "native";
+
+        # If a user wants to bind netbird to 443, we must allow binding to
+        # a socket to Internet domain privileged ports
+        CapabilityBoundingSet = lib.optionals needsPrivPort [ "CAP_NET_BIND_SERVICE" ];
+        AmbientCapabilities = lib.optionals needsPrivPort [ "CAP_NET_BIND_SERVICE" ];
+
+        # Use only IP, no socket needed
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_NETLINK"
+        ];
+        UMask = "0077";
+        # Hardening::End
+      };
+    };
+    networking.firewall.allowedUDPPorts = lib.mkIf (
+      cfg.openFirewall && cfg.settings.enable-stun
+    ) cfg.settings.stun-ports;
+  };
+
+  meta = {
+    doc = ./netbird-relay.md;
+    maintainers = [
+      lib.maintainers.woile
+    ];
+  };
+}

nixos/tests/all-tests.nix

@@ -1240,6 +1240,7 @@ in
   nebula.reload = runTest ./nebula/reload.nix;
   neo4j = runTest ./neo4j.nix;
   netbird = runTest ./netbird.nix;
+  netbird-relay = runTest ./netbird-relay.nix;
   netbox = runTest ./web-apps/netbox/default.nix;
   netdata = runTest ./netdata.nix;
   netfoil = runTest ./netfoil.nix;

nixos/tests/netbird-relay.nix

@@ -0,0 +1,53 @@
+{ pkgs, ... }:
+{
+  name = "netbird-relay";
+
+  meta.maintainers = [
+    pkgs.lib.maintainers.woile
+  ];
+
+  nodes = {
+    relay = {
+      environment.systemPackages = [
+        pkgs.coturn
+      ];
+      networking.hosts = {
+        "127.0.0.1" = [ "relay.example.com" ];
+      };
+      systemd.tmpfiles.rules = [
+        "d /run/ 0755 root root -"
+        "f /run/auth_secret 0600 root root - super-secret-token"
+      ];
+
+      services.netbird.relay = {
+        enable = true;
+        settings = {
+          listen-address = ":33080";
+          # rel -> http ; rels -> https
+          exposed-address = "rel://relay.example.com:33080";
+          log-level = "info";
+          enable-stun = true;
+          stun-ports = [ 3479 ];
+          health-listen-address = ":9000";
+        };
+        authSecretFile = "/run/auth_secret";
+      };
+    };
+  };
+
+  testScript = ''
+    # Wait for service to start
+    relay.start()
+    relay.wait_for_unit("netbird-relay.service")
+
+    # Wait for TCP ports to be open an active
+    relay.wait_for_open_port(9000)
+    relay.wait_for_open_port(33080)
+
+    # Test the STUN port (UDP)
+    relay.wait_until_succeeds("turnutils_stunclient -p 3479 127.0.0.1", timeout=10)
+
+    # assert on health
+    relay.succeed("curl -f http://127.0.0.1:9000/health")
+  '';
+}

pkgs/by-name/am/amnezia-vpn/disable-conan-runtime-bundling.patch

@@ -1,6 +1,8 @@
+diff --git a/service/server/CMakeLists.txt b/service/server/CMakeLists.txt
+index 4cc47168..b7840b4d 100644
 --- a/service/server/CMakeLists.txt
 +++ b/service/server/CMakeLists.txt
-@@ -341,56 +341,6 @@
+@@ -341,115 +341,6 @@ if(APPLE)
      )
  endif()
  
@@ -32,6 +34,30 @@
 -        ${CONAN_EXECS} ${CONAN_BINS}
 -        "$<TARGET_FILE_DIR:${PROJECT}>"
 -)
+-
+-# prebuilt openvpn carries the rpath of whatever machine baked it; point the
+-# build-tree copy at the local conan openssl (install rewrites it to $ORIGIN)
+-if(LINUX)
+-    file(GENERATE OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/set_openvpn_rpath.cmake
+-        CONTENT "file(RPATH_SET FILE \"$<TARGET_FILE_DIR:${PROJECT}>/openvpn\" NEW_RPATH \"$<TARGET_FILE_DIR:OpenSSL::SSL>\")\n"
+-    )
+-    add_custom_command(TARGET ${PROJECT} POST_BUILD
+-        COMMAND ${CMAKE_COMMAND} -P ${CMAKE_CURRENT_BINARY_DIR}/set_openvpn_rpath.cmake
+-    )
+-elseif(APPLE)
+-    file(GENERATE OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/set_openvpn_rpath.cmake CONTENT
+-[=[
+-set(ovpn "$<TARGET_FILE_DIR:AmneziaVPN-service>/openvpn")
+-set(dir "$<TARGET_FILE_DIR:OpenSSL::SSL>")
+-execute_process(COMMAND install_name_tool -delete_rpath "${dir}" "${ovpn}" ERROR_QUIET)
+-execute_process(COMMAND install_name_tool -add_rpath "${dir}" "${ovpn}")
+-]=]
+-    )
+-    add_custom_command(TARGET ${PROJECT} POST_BUILD
+-        COMMAND ${CMAKE_COMMAND} -P ${CMAKE_CURRENT_BINARY_DIR}/set_openvpn_rpath.cmake
+-    )
+-endif()
+-
 -if(WIN32)
 -    # using PERMISSIONS on Windows appends read-only flag
 -    # to the files so just omit it for it
@@ -40,7 +66,11 @@
 -        COMPONENT AmneziaVPN
 -    )
 -else()
--    install(FILES ${CONAN_EXECS}
+-    set(CONAN_EXECS_INSTALL ${CONAN_EXECS})
+-    if(LINUX)
+-        list(REMOVE_ITEM CONAN_EXECS_INSTALL "$<TARGET_FILE:openvpn::openvpn>")
+-    endif()
+-    install(FILES ${CONAN_EXECS_INSTALL}
 -        DESTINATION ${CMAKE_INSTALL_BINDIR}
 -        COMPONENT AmneziaVPN
 -        PERMISSIONS
@@ -53,6 +83,37 @@
 -    DESTINATION ${CMAKE_INSTALL_BINDIR}
 -    COMPONENT AmneziaVPN
 -)
+-
+-# install openvpn via the service's dep set to ship its openssl, then
+-# rewrite conan's absolute build rpath to a relative one for the package
+-if(LINUX)
+-    install(IMPORTED_RUNTIME_ARTIFACTS openvpn::openvpn
+-        RUNTIME_DEPENDENCY_SET service_deps
+-        PERMISSIONS
+-            OWNER_READ OWNER_EXECUTE
+-            GROUP_READ GROUP_EXECUTE
+-            WORLD_READ WORLD_EXECUTE
+-        COMPONENT AmneziaVPN
+-    )
+-    install(CODE "
+-        set(_ovpn \"\$ENV{DESTDIR}\${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_BINDIR}/openvpn\")
+-        file(CHMOD \"\${_ovpn}\" PERMISSIONS
+-            OWNER_READ OWNER_WRITE OWNER_EXECUTE GROUP_READ GROUP_EXECUTE WORLD_READ WORLD_EXECUTE)
+-        file(RPATH_SET FILE \"\${_ovpn}\" NEW_RPATH \"$ORIGIN:$ORIGIN/../lib\")
+-        file(CHMOD \"\${_ovpn}\" PERMISSIONS
+-            OWNER_READ OWNER_EXECUTE GROUP_READ GROUP_EXECUTE WORLD_READ WORLD_EXECUTE)
+-    "
+-        COMPONENT AmneziaVPN
+-    )
+-elseif(APPLE)
+-    install(CODE "
+-        set(_ovpn \"\$ENV{DESTDIR}\${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_BINDIR}/openvpn\")
+-        execute_process(COMMAND install_name_tool -delete_rpath \"$<TARGET_FILE_DIR:OpenSSL::SSL>\" \"\${_ovpn}\" ERROR_QUIET)
+-        execute_process(COMMAND install_name_tool -add_rpath \"@executable_path/../Frameworks\" \"\${_ovpn}\")
+-    "
+-        COMPONENT AmneziaVPN
+-    )
+-endif()
 -
  # install drivers
  if (WIN32)

pkgs/by-name/am/amnezia-vpn/package.nix

@@ -22,13 +22,13 @@ let
   # Even minor updates can break VPN connections without failing the build.
   amneziawg-go-pinned = amneziawg-go.overrideAttrs (
     finalAttrs: _: {
-      version = "3.0.1";
+      version = "3.1.20260814";
 
       src = fetchFromGitHub {
         owner = "amnezia-vpn";
         repo = "amneziawg-go";
         tag = "v${finalAttrs.version}";
-        hash = "sha256-wtjUJSTDWWgJLedyQPlPa+TtOztciyDWIbyZ24N5ELM=";
+        hash = "sha256-HMmbKd1wYzotB+GAZ8GulyJmX7+XUnXOEerab0OCPO8=";
       };
 
       vendorHash = "sha256-Y2dCwlKMVLrkzDcNKyCPxFJwMbCA2mQKkakvzwbamCY=";
@@ -84,7 +84,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "amnezia-vpn";
-  version = "5.0.0.5";
+  version = "5.0.1.5";
 
   __structuredAttrs = true;
 
@@ -92,7 +92,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "amnezia-vpn";
     repo = "amnezia-client";
     tag = finalAttrs.version;
-    hash = "sha256-knQgGyNkOV9CX1I0hJ8xEMRENBV35E2DwWUOgby3iUo=";
+    hash = "sha256-pSuKAv/Vy4k9kCotIzN1g5NbnyUG/6hDeuQQcGOt5Ow=";
     fetchSubmodules = true;
     # Preserve VCS metadata needed by the build before .git is removed.
     postCheckout = ''

pkgs/by-name/am/amnezia-vpn/xray-lib.nix

@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "amnezia-xray";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "amnezia-vpn";
     repo = "amnezia-xray-bindings";
     tag = "v${version}";
-    hash = "sha256-kGtRw5Ic/++1ehwLToZ96WfC3ULp+DIsPYArqjL06ck=";
+    hash = "sha256-lvU3bDzd5kgYl5DjdglnQzgjPwhtczxWu6LyxeVvVXE=";
   };
 
-  vendorHash = "sha256-JAHpQUMQT6tJKwGld0QCobDxgLVujA4KHkhOLXHS65w=";
+  vendorHash = "sha256-L05GHzj9lyFAm9JgR8ZDQf+2auumug6PcoD1F4ozk3E=";
 
   env.CGO_ENABLED = 1;
 

pkgs/by-name/au/aurral/package.nix

@@ -16,7 +16,7 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "aurral";
-  version = "2.8.0";
+  version = "2.9.0";
 
   __structuredAttrs = true;
 
@@ -24,7 +24,7 @@ buildNpmPackage (finalAttrs: {
     owner = "lklynet";
     repo = "aurral";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Ceo5CHIGa+98XFLazqmAyAV64rzDYqB0gvJ95AKwfUk=";
+    hash = "sha256-pwk+efWL0dfvKiobRmGXgPtvunpRDOVbtxohbJamVqY=";
   };
 
   # Specifies files to package leveraging npm & nix hooks. Not used by upstream.
@@ -33,7 +33,7 @@ buildNpmPackage (finalAttrs: {
     ./package.json.patch
   ];
 
-  npmDepsHash = "sha256-Qa/TcKzMEY/w8FWKMiHUeqVB9cMxxWtEwF30y0nndkg=";
+  npmDepsHash = "sha256-NVz5eqDDtMBKiTDl3aX0pHBYGTcYal8lmCf8mbKu31I=";
 
   nodejs = nodejs_26;
 

pkgs/by-name/ba/bazarr/package.nix

@@ -1,29 +1,16 @@
 {
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  fetchNpmDeps,
-  nodejs,
-  npmHooks,
+  buildNpmPackage,
   dart-sass,
-  makeBinaryWrapper,
-  python313,
+  fetchFromGitHub,
   ffmpeg,
-  unar,
-  nixosTests,
+  lib,
   nix-update-script,
+  nixosTests,
+  nodejs_22,
+  python313Packages,
+  unar,
 }:
-let
-  python = python313.withPackages (ps: [
-    ps.lxml
-    ps.numpy
-    ps.pillow
-    ps.psycopg2
-    ps.setuptools
-    ps.webrtcvad
-  ]);
-in
-stdenv.mkDerivation (finalAttrs: {
+python313Packages.buildPythonApplication (finalAttrs: {
   pname = "bazarr";
   version = "1.6.0";
 
@@ -34,41 +21,28 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-r3H0JEcGYzQOTHVR/zONmtOIF+LnJd+qn2pcAj8vdOA=";
   };
 
-  npmRoot = "frontend";
-  npmDeps = fetchNpmDeps {
-    name = "${finalAttrs.pname}-${finalAttrs.version}-npm-deps";
-    inherit (finalAttrs) src;
-    sourceRoot = "${finalAttrs.src.name}/frontend";
-    hash = "sha256-cb++eqVtKZer9B1rwJ9WR4mZImnASeFU2MojgXAPWf4=";
-  };
-
-  nativeBuildInputs = [
-    nodejs
-    npmHooks.npmConfigHook
-    dart-sass
-    makeBinaryWrapper
+  dependencies = with python313Packages; [
+    lxml
+    numpy
+    pillow
+    psycopg2
+    setuptools
+    webrtcvad
   ];
 
-  buildPhase = ''
-    runHook preBuild
-    pushd frontend
-    # sass-embedded's bundled Dart compiler won't run in the sandbox; use nixpkgs' dart-sass.
-    # https://github.com/sass/embedded-host-node/issues/334
-    substituteInPlace node_modules/sass-embedded/dist/lib/src/compiler-path.js \
-      --replace-fail 'compilerCommand = (() => {' 'compilerCommand = (() => { return ["dart-sass"];'
-    npm run build
-    popd
-    runHook postBuild
-  '';
+  __structuredAttrs = true;
+  dontBuild = true;
+  dontWrapPythonPrograms = true;
+  pyproject = false;
 
   installPhase = ''
     runHook preInstall
 
-    mkdir -p $out/share/bazarr/frontend
-    cp -r bazarr bazarr.py custom_libs libs migrations $out/share/bazarr/
-    cp -r frontend/build $out/share/bazarr/frontend/build
+    mkdir -p $out/lib/bazarr/frontend
+    cp -r bazarr bazarr.py custom_libs libs migrations $out/lib/bazarr/
+    cp -r ${finalAttrs.passthru.frontend} $out/lib/bazarr/frontend/build
 
-    printf '%s' "${finalAttrs.version}" > $out/share/bazarr/VERSION
+    printf '%s' "${finalAttrs.version}" > $out/lib/bazarr/VERSION
 
     printf '%s' "${
       lib.generators.toKeyValue { } {
@@ -77,29 +51,62 @@ stdenv.mkDerivation (finalAttrs: {
         packageversion = finalAttrs.version;
         packageauthor = "nixpkgs";
       }
-    }" > $out/share/bazarr/package_info
+    }" > $out/lib/bazarr/package_info
 
-    makeWrapper ${lib.getExe python} $out/bin/bazarr \
-      --add-flags $out/share/bazarr/bazarr.py \
+    makeWrapper ${lib.getExe python313Packages.python} $out/bin/bazarr \
+      --add-flags $out/lib/bazarr/bazarr.py \
       --prefix PATH : ${
         lib.makeBinPath [
           ffmpeg
           unar
         ]
-      }
+      } \
+      --prefix PYTHONPATH : ${python313Packages.makePythonPath finalAttrs.passthru.dependencies} \
+      --set PYTHONNOUSERSITE true
 
     runHook postInstall
   '';
 
   passthru = {
+    frontend = buildNpmPackage {
+      inherit (finalAttrs) src version;
+      pname = "${finalAttrs.pname}-frontend";
+
+      sourceRoot = "${finalAttrs.src.name}/frontend";
+
+      nodejs = nodejs_22;
+
+      npmDepsHash = "sha256-cb++eqVtKZer9B1rwJ9WR4mZImnASeFU2MojgXAPWf4=";
+
+      nativeBuildInputs = [ dart-sass ];
+
+      # sass-embedded's bundled Dart compiler won't run in the sandbox; use nixpkgs' dart-sass.
+      # https://github.com/sass/embedded-host-node/issues/334
+      preBuild = ''
+        substituteInPlace node_modules/sass-embedded/dist/lib/src/compiler-path.js \
+          --replace-fail 'compilerCommand = (() => {' 'compilerCommand = (() => { return ["dart-sass"];'
+      '';
+
+      installPhase = ''
+        runHook preInstall
+        mv build $out
+        runHook postInstall
+      '';
+
+      dontFixup = true;
+    };
+
     tests.smoke-test = nixosTests.bazarr;
-    updateScript = nix-update-script { };
+
+    updateScript = nix-update-script {
+      extraArgs = lib.cli.toCommandLineGNU { } { subpackage = "frontend"; };
+    };
   };
 
   meta = {
     description = "Subtitle manager for Sonarr and Radarr";
     homepage = "https://www.bazarr.media/";
-    changelog = "https://github.com/morpheus65535/bazarr/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/morpheus65535/bazarr/releases/tag/${finalAttrs.src.tag}";
     sourceProvenance = with lib.sourceTypes; [ fromSource ];
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [

pkgs/by-name/br/brook/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "brook";
-  version = "20240606";
+  version = "20270101";
 
   src = fetchFromGitHub {
     owner = "txthinking";
     repo = "brook";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-rfCqYI0T/nbK+rlPGl5orLo3qHKITesdFNtXc/ECATA=";
+    sha256 = "sha256-OIuEJFGOUkvHjxI4FPKWU65VFvgXG0+pu9giGJXYS0w=";
   };
 
-  vendorHash = "sha256-dYiifLUOq6RKAVSXuoGlok9Jp8jHmbXN/EjQeQpoqWw=";
+  vendorHash = "sha256-974jdNwpQbdTbYjY/6KaicwNclizeIQXfyMZI3v/9aA=";
 
   meta = {
     homepage = "https://github.com/txthinking/brook";

pkgs/by-name/ca/casadi/package.nix

@@ -37,13 +37,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "casadi";
-  version = "3.8.0";
+  version = "3.8.1";
 
   src = fetchFromGitHub {
     owner = "casadi";
     repo = "casadi";
     tag = finalAttrs.version;
-    hash = "sha256-kSuNOn55eSaF4admtw4aHmPpdxUS/JDF1yBMrRbPv04=";
+    hash = "sha256-GY7Dyt53QE3+/aPB5oDRfZzpRLqKTGrxrmvihq4YJ2o=";
   };
 
   postPatch = ''

pkgs/by-name/cl/clickhouse/lts.nix

@@ -1,6 +1,6 @@
 import ./generic.nix {
-  version = "26.8.2.7-lts";
-  rev = "c2930599c56702022276de06657ed51d83f31a05";
-  hash = "sha256-AKEzqbWWfi04Llhw7R4MCEuWPrcyym1z59LR14OluRI=";
+  version = "26.8.5.13-lts";
+  rev = "ec5605431dacfc812affc406cc81ca398ca68174";
+  hash = "sha256-PKvk9iJoPFHB4dTHSWox2hPiTNt2EPlwZ/t3+Up9GsY=";
   lts = true;
 }

pkgs/by-name/da/dalfox/package.nix

@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "dalfox";
-  version = "3.2.2";
+  version = "3.2.3";
 
   src = fetchFromGitHub {
     owner = "hahwul";
     repo = "dalfox";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cTpZGRBlrZEb5H08UIqrefpE0TGNYH6sIHebhQZHtpk=";
+    hash = "sha256-NhYoxsV1xxCbteI691ld6rHdlBGyJr6yn0ZJvDHEt8w=";
   };
 
-  cargoHash = "sha256-F2JkgwGt7uhl7vq2UI1/l1/C5QTVrPXgBj5mxUu7pYI=";
+  cargoHash = "sha256-huOPIV2sblLQ5P5dO+qrBDl5F7LokTieyecjhjmhmP0=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/dm/dms-greeter/package.nix

@@ -8,7 +8,7 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "dms-greeter";
-  version = "1.6.1";
+  version = "1.6.2";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -17,7 +17,7 @@ buildGoModule (finalAttrs: {
     owner = "AvengeMedia";
     repo = "dank-greeter";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Tt4/VvShpkHNbgXQedAsTzN2GbwIaQj0l9rOjqpRU+M=";
+    hash = "sha256-kON8+yjGeCwjvULWNoaHlPmC5OglqL+IejtVlzsvqv4=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/es/essh/package.nix

@@ -10,18 +10,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "essh";
-  version = "0.3.3";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "matthart1983";
     repo = "essh";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-dK9M730LgS4CG/BAOSfvH2T06RJsEWHVFT0/VoFvt3Q=";
+    hash = "sha256-+NBKATXTaKaXjkVIrXJvYibI/Xbcuh048kuMZShVjo8=";
   };
 
   __structuredAttrs = true;
 
-  cargoHash = "sha256-2ZAvm3LJHpLF99ahLdTFKuneRMLn6XryNd+ZT2uSawE=";
+  cargoHash = "sha256-IU9TNPJPGT+KgrCTt6tcgLHudNpJeAtus4NAcjaQYAE=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/fc/fcitx5-rime/package.nix

@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "fcitx5-rime";
-  version = "5.1.14";
+  version = "5.1.16";
 
   src = fetchurl {
     url = "https://download.fcitx-im.org/fcitx5/${pname}/${pname}-${version}.tar.zst";
-    hash = "sha256-dHiBH74dTnzabm23TrDAXV/oHSGMqdyBtrf0uyuwjWI=";
+    hash = "sha256-MlGoRCHE8ou69BZU108jgKUt4O3RuoAt5ZQMK/O/ps8=";
   };
 
   cmakeFlags = [

pkgs/by-name/fc/fcitx5-skk/package.nix

@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fcitx5-skk";
-  version = "5.1.10";
+  version = "5.1.11";
 
   src = fetchFromGitHub {
     owner = "fcitx";
     repo = pname;
     rev = version;
-    hash = "sha256-4ApXom3SDwlT55lj0q3u5wBmKRGAzJCvpx1H30z3Ubo=";
+    hash = "sha256-DM0QNAgXnzOhrcNsnBPdI6hrKejMxPbYZCK+yaFqVPA=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/fc/fcitx5/package.nix

@@ -35,6 +35,7 @@
   libxkbfile,
   nixosTests,
   gettext,
+  librsvg,
 }:
 let
   enDictVer = "20121020";
@@ -45,13 +46,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "fcitx5";
-  version = "5.1.21";
+  version = "5.1.22";
 
   src = fetchFromGitHub {
     owner = "fcitx";
     repo = pname;
     rev = version;
-    hash = "sha256-IR5mKOsVJ/GPL2czdztLVXGJTNk1JXnWpzmqC/UIwuw=";
+    hash = "sha256-t0Xn15su7nij9ll7EbQeIC75ScSwCoPOgPtTbuP4xN8=";
     fetchSubmodules = true;
   };
 
@@ -94,6 +95,7 @@ stdenv.mkDerivation rec {
     xcb-imdkit
     xkeyboard_config
     libxkbfile
+    librsvg
   ];
 
   cmakeFlags = lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [

pkgs/by-name/gp/gpu-screen-recorder-notification/package.nix

@@ -21,12 +21,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gpu-screen-recorder-notification";
-  version = "1.3.4";
+  version = "1.3.6";
 
   src = fetchgit {
     url = "https://repo.dec05eba.com/gpu-screen-recorder-notification";
     tag = finalAttrs.version;
-    hash = "sha256-rGredPrTda6/3pG4+0k6fHr4fRSVCRvTC/+sRFytrWo=";
+    hash = "sha256-UmK9aDVsWgMZx9dCA0LFLmY0NLmhwh3O2VgztUzvPOs=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/gp/gpu-screen-recorder-ui/package.nix

@@ -34,12 +34,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gpu-screen-recorder-ui";
-  version = "1.13.7";
+  version = "1.13.9";
 
   src = fetchgit {
     url = "https://repo.dec05eba.com/gpu-screen-recorder-ui";
     tag = finalAttrs.version;
-    hash = "sha256-liBdZDHI32ElTTsHAZekYKFgZY1eP7rz4u7tM4pkpZ4=";
+    hash = "sha256-f4jTv3IS73NWStg1af20pGKlqwIN9K9ZyLjKUX9Tp3s=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/gr/gremlin-console/package.nix

@@ -10,10 +10,10 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gremlin-console";
-  version = "3.8.1";
+  version = "3.8.2";
   src = fetchzip {
     url = "https://downloads.apache.org/tinkerpop/${finalAttrs.version}/apache-tinkerpop-gremlin-console-${finalAttrs.version}-bin.zip";
-    sha256 = "sha256-43coWvunyzOrFKzkUx5hUHiiXynkaCiV1WVkJvIgwd0=";
+    sha256 = "sha256-U2sorMLLFcYV9dRX64uHR+eUu92ZmxhYgOK4CBsL5YE=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/by-name/gt/gthumb/package.nix

@@ -34,11 +34,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gthumb";
-  version = "3.12.10";
+  version = "3.12.11";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gthumb/${lib.versions.majorMinor finalAttrs.version}/gthumb-${finalAttrs.version}.tar.xz";
-    sha256 = "sha256-MiI0RlPNb7XXmBtzlRrj2QxBT3QiCoschmWyVXQoTHU=";
+    sha256 = "sha256-HDGuxNoV7Ma6AcAa8LH4JTf7JQuXDIboBm1enDEfZIE=";
   };
 
   strictDeps = true;

pkgs/by-name/je/jet/package.nix

@@ -19,8 +19,24 @@ buildGraalvmNativeImage (finalAttrs: {
     "-H:Log=registerResource:"
     "--no-fallback"
     "--no-server"
+    "-J-Djet.native=true"
+    # GraalVM >= 25.1 no longer discovers @AutomaticFeature annotations.
+    "--features=InitAtBuildTimeFeature"
   ];
 
+  doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    output="$(
+      printf '%s\n' '{"value":1}' \
+        | $out/bin/jet --from json --to edn --keywordize
+    )"
+    test "$output" = '{:value 1}'
+
+    runHook postInstallCheck
+  '';
+
   passthru.tests.version = testers.testVersion {
     inherit (finalAttrs) version;
     package = finalAttrs.finalPackage;

pkgs/by-name/ju/just-lsp/package.nix

@@ -8,7 +8,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "just-lsp";
-  version = "0.7.1";
+  version = "0.8.0";
 
   __structuredAttrs = true;
 
@@ -16,10 +16,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "terror";
     repo = "just-lsp";
     tag = finalAttrs.version;
-    hash = "sha256-MQzXXsosKyFBRJBXB8Om9Su5aZDGSnW8rGdLfvuCo6U=";
+    hash = "sha256-V075W4jrHGhOraSzoVCVtK3WSTCyb8lm6Vdfxyo8UOY=";
   };
 
-  cargoHash = "sha256-D52hr/h2+/GTp95ZZJWxh6wXLa6FU/xVlP/2M8A6KL8=";
+  cargoHash = "sha256-yp/4n1WR/JqhyGeK7CTvfaeHAu+9yhRiYI0W2ZBF6VY=";
 
   nativeInstallCheckInputs = [
     versionCheckHook

pkgs/by-name/ke/keycloak/keycloak-orgs/default.nix

@@ -6,13 +6,13 @@
 }:
 maven.buildMavenPackage (finalAttrs: {
   pname = "keycloak-orgs";
-  version = "0.175";
+  version = "0.180";
 
   src = fetchFromGitHub {
     owner = "p2-inc";
     repo = "keycloak-orgs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TKej3VjDLn3GJ8UPFyAzMQmMIZfktzcrK/CDWRqHuS4=";
+    hash = "sha256-M9adZ3oNf4ZcPgSVT++66ltznCc2vJM+eOrYrUk9qI4=";
   };
 
   mvnHash = "sha256-kU9nmiu/hWJaEfQzdVKC/IIWqZarRPpOqDP/bJQIIEY=";

pkgs/by-name/ki/kicad/base.nix

@@ -2,12 +2,9 @@
   lib,
   stdenv,
   cmake,
-  libGLU,
-  libGL,
   zlib,
   wxGTK,
   gtk3,
-  libx11,
   gettext,
   glew,
   glm,
@@ -17,30 +14,12 @@
   boost,
   pkg-config,
   doxygen,
-  graphviz,
-  libpthread-stubs,
-  libxdmcp,
   unixodbc,
   libgit2,
   libsecret,
-  libgcrypt,
-  libgpg-error,
   ninja,
   writableTmpDirAsHomeHook,
 
-  util-linuxMinimal,
-  libselinux,
-  libsepol,
-  libthai,
-  libdatrie,
-  libxkbcommon,
-  libepoxy,
-  dbus,
-  at-spi2-core,
-  libxtst,
-  pcre2,
-  libdeflate,
-
   swig,
   python,
   poppler,
@@ -133,41 +112,18 @@ stdenv.mkDerivation (finalAttrs: {
     cmake
     ninja
     doxygen
-    graphviz
     pkg-config
     libgit2
     libsecret
-    libgcrypt
-    libgpg-error
-  ]
-  # wanted by configuration on linux, doesn't seem to affect performance
-  # no effect on closure size
-  ++ optionals (stdenv.hostPlatform.isLinux) [
-    util-linuxMinimal
-    libselinux
-    libsepol
-    libthai
-    libdatrie
-    libxkbcommon
-    libepoxy
-    dbus
-    at-spi2-core
-    libxtst
-    pcre2
   ];
 
   buildInputs = [
-    libGLU
-    libGL
     zlib
-    libx11
     wxGTK
     gtk3
-    libxdmcp
     gettext
     glew
     glm
-    libpthread-stubs
     cairo
     curl
     openssl
@@ -176,7 +132,6 @@ stdenv.mkDerivation (finalAttrs: {
     python
     poppler
     unixodbc
-    libdeflate
     opencascade-occt
     protobuf_29
 

pkgs/by-name/li/libime/package.nix

@@ -18,26 +18,26 @@ let
     url = "https://download.fcitx-im.org/data/table-${tableVer}.tar.zst";
     hash = "sha256-Pp2HsEo5PxMXI0csjqqGDdI8N4o9T2qQBVE7KpWzYUs=";
   };
-  arpaVer = "20250113";
+  arpaVer = "20260629";
   arpa = fetchurl {
     url = "https://download.fcitx-im.org/data/lm_sc.arpa-${arpaVer}.tar.zst";
-    hash = "sha256-7oPs8g1S6LzNukz2zVcYPVPCV3E6Xrd+46Y9UPw3lt0=";
+    hash = "sha256-BoCDM7kXPlN0zyy1r8EtCPViW/mrtTZInKw3b8BfLn8=";
   };
-  dictVer = "20250327";
+  dictVer = "20260703";
   dict = fetchurl {
     url = "https://download.fcitx-im.org/data/dict-${dictVer}.tar.zst";
-    hash = "sha256-fKa+R1TA1MJ7p3AsDc5lFlm9LKH6pcvyhI2BoAU8jBM=";
+    hash = "sha256-xobKtt+JZMSNWW9X0gW6wx/HKHCwaoMBfkRQPfjAlpc=";
   };
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "libime";
-  version = "1.1.14";
+  version = "1.1.16";
 
   src = fetchFromGitHub {
     owner = "fcitx";
     repo = "libime";
     tag = finalAttrs.version;
-    hash = "sha256-q9OSY1q4MNlFqw6lRMrHO6QT9xP8Czz4b4M0BuIkp34=";
+    hash = "sha256-SDp7j37ZtIQ+YqOh+JKGaPgnrz0sVIom3lJx0Jmbk38=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/li/libmirage/package.nix

@@ -27,11 +27,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libmirage";
-  version = "3.3.2";
+  version = "3.3.3";
 
   src = fetchurl {
     url = "mirror://sourceforge/cdemu/libmirage-${finalAttrs.version}.tar.xz";
-    hash = "sha256-wMAzJpEue1QnDllWheFk3ZX+8pSkYw13s+GU0G/AOfs=";
+    hash = "sha256-tICwgjCyJVr0DDrIY0TAx3/JloZgFOBaadVVTpA11ls=";
   };
 
   env = {

pkgs/by-name/li/libvirt/package.nix

@@ -15,7 +15,6 @@
   gnutls,
   iproute2,
   iptables,
-  libgcrypt,
   libpcap,
   libtasn1,
   libxml2,
@@ -226,7 +225,6 @@ stdenv.mkDerivation rec {
     dbus
     glib
     gnutls
-    libgcrypt
     libpcap
     libtasn1
     libxml2

pkgs/by-name/li/linux-firmware/package.nix

@@ -23,13 +23,13 @@ let
 in
 stdenvNoCC.mkDerivation rec {
   pname = "linux-firmware";
-  version = "20260910";
+  version = "20260916";
 
   src = fetchFromGitLab {
     owner = "kernel-firmware";
     repo = "linux-firmware";
     tag = version;
-    hash = "sha256-gT9XYrQk5oZvbJgp4u8xkGWR4NdDomx5tzLmB4V52H8=";
+    hash = "sha256-VbDTRN/i+a1BrKnDtdDFxanp3BQujBhe9CyWay9GTXY=";
   };
 
   postUnpack = ''

pkgs/by-name/ll/llama-cpp/package.nix

@@ -205,12 +205,16 @@ effectiveStdenv.mkDerivation (finalAttrs: {
   # the tests are failing as of 2025-08
   doCheck = false;
 
-  passthru = {
+  passthru = lib.optionalAttrs (!cudaSupport && !rocmSupport && !vulkanSupport) {
     updateScript = ./update.sh;
   };
 
   meta = {
-    description = "Inference of Meta's LLaMA model (and others) in pure C/C++";
+    description =
+      "Inference of Meta's LLaMA model (and others) in pure C/C++"
+      + optionalString cudaSupport ", with CUDA support"
+      + optionalString rocmSupport ", with ROCm support"
+      + optionalString vulkanSupport ", with Vulkan support";
     homepage = "https://github.com/ggml-org/llama.cpp";
     license = lib.licenses.mit;
     mainProgram = "llama";

pkgs/by-name/ma/malwoverview/package.nix

@@ -6,7 +6,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "malwoverview";
-  version = "8.0.5";
+  version = "8.1.0";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -15,7 +15,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "alexandreborges";
     repo = "malwoverview";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BIuz7QitSM7xOSwiIsitIdYXaBoENhzrOLVfyVcoy3M=";
+    hash = "sha256-Dd2phAb1xNNkWVQ8b52HnkOQ8BU5UxnuvcF/3dmec+w=";
   };
 
   build-system = with python3Packages; [

pkgs/by-name/ma/mastodon/source.nix

@@ -5,14 +5,14 @@
   patches ? [ ],
 }:
 let
-  version = "4.6.7";
+  version = "4.6.8";
 in
 applyPatches {
   src = fetchFromGitHub {
     owner = "mastodon";
     repo = "mastodon";
     rev = "v${version}";
-    hash = "sha256-gSJXe4/uRYYKQTmjMirD2uFA7ymRl2LQP6VHt8nBD9k=";
+    hash = "sha256-fDbQunhcpnMnIufEX2oRH9vulsHjtlR95boj0M2O3CQ=";
     passthru = {
       inherit version;
       yarnHash = "sha256-VlOG91ZuO+1UXTbtwIrYUbqHjmSfPSfLhrf4TxCJqJ0=";

pkgs/by-name/mu/mujoco/package.nix

@@ -108,6 +108,18 @@ stdenv.mkDerivation (finalAttrs: {
     ./mujoco-system-deps-dont-fetch.patch
   ];
 
+  # Install plugins to expose them in python to fix mujoco-warp tests
+  # ref. https://github.com/google-deepmind/mujoco/pull/3602
+  postPatch = ''
+    for plugin in actuator elasticity sensor; do
+      echo "install(TARGETS $plugin)" >> plugin/$plugin/CMakeLists.txt
+    done
+
+    for plugin in sdf usd_decoder; do
+      echo "install(TARGETS $plugin""_plugin)" >> plugin/$plugin/CMakeLists.txt
+    done
+  '';
+
   nativeBuildInputs = [
     cmake
     # git is needed to apply patches to ccd-src and qhull-src (see below)

pkgs/by-name/mu/mullvad-browser/package.nix

@@ -97,7 +97,7 @@ let
     ++ lib.optionals mediaSupport [ ffmpeg_7 ]
   );
 
-  version = "15.0.21";
+  version = "15.0.23";
 
   sources = {
     x86_64-linux = fetchurl {
@@ -109,7 +109,7 @@ let
         "https://tor.eff.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"
         "https://tor.calyxinstitute.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"
       ];
-      hash = "sha256-LHv/hY/abmy7/8nsNkKiwJh+SvRLzEO97fNNvPuYXQo=";
+      hash = "sha256-Bzd0atOeqHFhmIlpN3cbGogkwg6SwpNhn5m4yscpIzo=";
     };
   };
 

pkgs/by-name/ne/netbird/package.nix

@@ -196,18 +196,22 @@ buildGoModule (finalAttrs: {
   versionCheckProgramArg = component.versionCheckProgramArg or "version";
 
   passthru = {
-    tests = lib.attrsets.optionalAttrs (componentName == "client") {
-      nixos = nixosTests.netbird;
-      inherit
-        # make sure child packages are built by `ofborg`
-        netbird-management
-        netbird-relay
-        netbird-signal
-        netbird-ui
-        netbird-upload
-        netbird-proxy
-        ;
-    };
+    tests =
+      lib.attrsets.optionalAttrs (componentName == "client") {
+        nixos = nixosTests.netbird;
+        inherit
+          # make sure child packages are built by `ofborg`
+          netbird-management
+          netbird-relay
+          netbird-signal
+          netbird-ui
+          netbird-upload
+          netbird-proxy
+          ;
+      }
+      // lib.attrsets.optionalAttrs (componentName == "relay") {
+        nixos = nixosTests.netbird-relay;
+      };
     updateScript = nix-update-script { };
   };
 

pkgs/by-name/ne/networkmanager/package.nix

@@ -83,11 +83,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "networkmanager";
-  version = "1.58.0";
+  version = "1.58.1";
 
   src = fetchurl {
     url = "https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/releases/${finalAttrs.version}/downloads/NetworkManager-${finalAttrs.version}.tar.xz";
-    hash = "sha256-DG8nA6LJsBfNaPv+HS6KGl1/8FE3x1HsQhy6NulFRro=";
+    hash = "sha256-Jihkz9GYEj0+Xb6Rk3RBuX7pBZ1tcS4aW/uxxUZo0U0=";
   };
 
   outputs = [

pkgs/by-name/ol/ollama/package.nix

@@ -383,9 +383,10 @@ goBuild (finalAttrs: {
       service-rocm = nixosTests.ollama-rocm;
       service-vulkan = nixosTests.ollama-vulkan;
     };
-    updateScript = ./update.sh;
   }
-  // lib.optionalAttrs (!enableRocm && !enableCuda && !enableVulkan) { updateScript = ./update.sh; };
+  // lib.optionalAttrs (!rocmRequested && !cudaRequested && !vulkanRequested) {
+    updateScript = ./update.sh;
+  };
 
   meta = {
     description =

pkgs/by-name/om/omp/package.nix

@@ -32,7 +32,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "omp";
-  version = "18.1.21";
+  version = "18.2.1";
 
   strictDeps = true;
   __structuredAttrs = true;
@@ -41,12 +41,12 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "can1357";
     repo = "oh-my-pi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Zy7nk0hz1RlVt3HYmXiasSDvIDHUv0/Ek/izvOb3dZM=";
+    hash = "sha256-Xxce8dTViESlYF0koYujNHH7lbZj+BRA9tvgOKXmQ7s=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src;
-    hash = "sha256-KDUALAEWzm5Lf+SZcqhK4uzBpMcEUxBFsKoj7VFJMeU=";
+    hash = "sha256-PIsVh8HAIuUIoi8K8vExBKurGM86RSebB4f475jdai8=";
   };
 
   postPatch = ''
@@ -91,7 +91,7 @@ stdenv.mkDerivation (finalAttrs: {
     # Prevents breaking symlinks in node_modules
     dontFixup = true;
 
-    outputHash = "sha256-t7DIu+/aP6VG+Fks/6FjAprpJMlip0XoFCHPQqdjx94=";
+    outputHash = "sha256-EeOZ7XTDjSHH6QtcqOVBQQeXMh47GhCOPXHTB52VeOA=";
     outputHashMode = "recursive";
   };
 

pkgs/by-name/pg/pgschema/package.nix

@@ -1,4 +1,5 @@
 {
+  stdenv,
   lib,
   buildGoModule,
   fetchFromGitHub,
@@ -33,11 +34,15 @@ buildGoModule (finalAttrs: {
     "github.com/pgplex/pgschema/internal/postgres.binariesPath=${postgresql}"
   ];
 
+  # Tests fail in sandbox on darwin, with:
+  # Could not create shared memory segment: Cannot allocate memory
+  # Failed system call was shmget(key=18446744072262306125, size=56, 03600)
+  doCheck = !stdenv.hostPlatform.isDarwin;
+
   doInstallCheck = true;
   nativeInstallCheckInputs = [
     versionCheckHook
   ];
-  versionCheckProgramArg = "--help"; # there is no -v/--version
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/po/poke/package.nix

@@ -22,11 +22,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "poke";
-  version = "4.3";
+  version = "5.0";
 
   src = fetchurl {
     url = "mirror://gnu/poke/poke-${finalAttrs.version}.tar.gz";
-    hash = "sha256-qEy5F11Q1FpBHySB/QZiuDyzLOUXMWuInPtXCBlXk3M=";
+    hash = "sha256-aHPVmr6CHIERuIYj6nrZ4JCJL6lcdVYmBt2IN04vW48=";
   };
 
   outputs = [

pkgs/by-name/po/portmaster/package.nix

@@ -26,7 +26,7 @@
 }:
 
 let
-  version = "2.2.1";
+  version = "2.2.3";
 
   nodejsPython = buildPackages.nodejs.python.withPackages (ps: [ ps.setuptools ]);
 
@@ -34,7 +34,7 @@ let
     owner = "safing";
     repo = "portmaster";
     tag = "v${version}";
-    hash = "sha256-MkVVRPI0yoQ9dl2vyluSz+eNgErfcMveLmeaReJuYIM=";
+    hash = "sha256-MVcynhN8svv83TDOx54dZ/zFyl4lDfUT1bIgHcmeKYE=";
   };
 
   portmasterUI = buildNpmPackage {
@@ -49,7 +49,7 @@ let
     ];
 
     sourceRoot = "${src.name}/desktop/angular";
-    npmDepsHash = "sha256-MVlOjD/rKtR+bcCz51mDhZo65jyqTAa1Al+sK/1hJgw=";
+    npmDepsHash = "sha256-TvH3dIrSFmkfuHoJfUjEfPoOJcIzximFQ8vkwQHJXac=";
 
     nativeBuildInputs = [ nodejsPython ];
 
@@ -85,7 +85,7 @@ let
     pname = "portmaster-desktop";
     inherit version src;
 
-    cargoHash = "sha256-QK/L3vUD+MZjFVLgwWm+kZIgXY9ol0y9EIP7aSD45sU=";
+    cargoHash = "sha256-9xJMNkihi+v5eRl6CfcxN4WTMrE/x+jp/isgwNwq1Cs=";
     cargoRoot = "desktop/tauri/src-tauri";
     buildAndTestSubdir = finalAttrs.cargoRoot;
 
@@ -153,7 +153,7 @@ buildGoModule (finalAttrs: {
     ./disable-software-updates.patch
   ];
 
-  vendorHash = "sha256-22sIbmpbgYtOwrnxcrKfksgbyqaFRH5DZ/UNXr8723I=";
+  vendorHash = "sha256-sxjARIwy46mJhqgrafj+nGG231Vvq4/iuC+ECXyAU9U=";
 
   nativeBuildInputs = [
     copyDesktopItems

pkgs/by-name/ro/roon-server/package.nix

@@ -16,7 +16,7 @@
   stdenv,
 }:
 let
-  version = "2.70.1671";
+  version = "2.71.1683";
   urlVersion = builtins.replaceStrings [ "." ] [ "0" ] version;
 in
 stdenv.mkDerivation {
@@ -25,7 +25,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://download.roonlabs.com/updates/production/RoonServer_linuxx64_${urlVersion}.tar.bz2";
-    hash = "sha256-vYFhYMGFyu/eaQnVoRij9aUP9aZvxBj8N7yHmXD7904=";
+    hash = "sha256-z/8rORTsDUhgh2hfep62jMVeAvX/c5HW4vBkVnvhcQc=";
   };
 
   dontConfigure = true;
@@ -50,19 +50,14 @@ stdenv.mkDerivation {
       # NB: While this might seem like odd behavior, it's what Roon expects. The
       # tarball distribution provides scripts that do a bunch of nonsense on top
       # of what wrapBin is doing here, so consider it the lesser of two evils.
-      # I didn't bother checking whether the symlinks are really necessary, but
-      # I wouldn't put it past Roon to have custom code based on the binary
-      # name, so we're playing it safe.
       wrapBin = binPath: ''
         (
           binDir="$(dirname "${binPath}")"
           binName="$(basename "${binPath}")"
-          dotnetDir="$out/RoonDotnet"
+          actualBin="$binDir/$binName.exe"
 
-          ln -sf "$dotnetDir/dotnet" "$dotnetDir/$binName"
           rm "${binPath}"
-          makeWrapper "$dotnetDir/$binName" "${binPath}" \
-            --add-flags "$binDir/$binName.dll" \
+          makeWrapper "$actualBin" "${binPath}" \
             --argv0 "$binName" \
             --prefix LD_LIBRARY_PATH : "${
               lib.makeLibraryPath [
@@ -72,7 +67,7 @@ stdenv.mkDerivation {
                 openssl
               ]
             }" \
-            --prefix PATH : "$dotnetDir" \
+            --prefix PATH : "$binDir" \
             --prefix PATH : "${
               lib.makeBinPath [
                 alsa-utils
@@ -80,8 +75,7 @@ stdenv.mkDerivation {
                 ffmpeg
               ]
             }" \
-            --chdir "$binDir" \
-            --set DOTNET_ROOT "$dotnetDir"
+            --chdir "$binDir"
         )
       '';
     in

pkgs/by-name/rp/rpi-imager/package.nix

@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rpi-imager";
-  version = "2.0.10-1-proto1";
+  version = "2.0.11.1";
 
   src = fetchFromGitHub {
     owner = "raspberrypi";
     repo = "rpi-imager";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5EmriYrjm73fEgcbL/WJ5ggnFqyPQ/DXLBOnhDq1NxA=";
+    hash = "sha256-FjFbDRwykY9q+aDJsEiXhRXjmy12DNpAQTUuF3tRIu4=";
   };
 
   patches = [ ./remove-vendoring.patch ];

pkgs/by-name/ru/rustfs-cli/package.nix

@@ -7,17 +7,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rustfs-cli";
-  version = "0.1.35";
+  version = "0.1.36";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "rustfs";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-KLFQxoQfIvXHmO6gUCV4c9xM10svYhjThZ15Ja47E04=";
+    hash = "sha256-KKidgJMijvcxp5Ek0gknEdr5paHyarXYAB75e7feKEQ=";
   };
 
-  cargoHash = "sha256-gP4f3L6t0FAUAISG20GG07wYCQ8AmogMWaQ15pyvAfY=";
+  cargoHash = "sha256-CmPMjJc/yyn0csYsKJawzfc+Rkz2gYWCmJVkgJLz/pQ=";
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/sh/shattered-pixel-dungeon/rat-king-adventure/default.nix

@@ -5,15 +5,17 @@
 
 callPackage ../generic.nix rec {
   pname = "rat-king-adventure";
-  version = "2.3.2";
+  version = "2.3.4";
 
   src = fetchFromGitHub {
     owner = "TrashboxBobylev";
     repo = "Rat-King-Adventure";
     rev = version;
-    hash = "sha256-iGlTDSoXvn1m7avLOBbqPjlEkCoHSL/FtWCyR6IRwM0=";
+    hash = "sha256-uT61XUzR5Eubmjglr4NRY/LFqmyvv6aIZxmnCt+VcbA=";
   };
 
+  patches = [ ];
+
   desktopName = "Rat King Adventure";
 
   meta = {

pkgs/by-name/sh/shattered-pixel-dungeon/rat-king-adventure/deps.json

@@ -1,38 +1,55 @@
 {
  "!comment": "This is a nixpkgs Gradle dependency lockfile. For more details, refer to the Gradle section in the nixpkgs manual.",
  "!version": 1,
+ "https://plugins.gradle.org/m2/org": {
+  "beryx#badass-runtime-plugin/2.0.1": {
+   "jar": "sha256-qc8YDAVtxs/vU2XOjloPJml5eJr7CUdlERPRyqm2UhQ=",
+   "module": "sha256-Y1r26XwZhilpzegxJvdwltB8i536+fk+x2sQYCukbcY=",
+   "pom": "sha256-l6xBsi4rPVcN9UXfSjFHmkVqH5O0bMl27Jo/WdHw/Ak="
+  },
+  "beryx/runtime#org.beryx.runtime.gradle.plugin/2.0.1": {
+   "pom": "sha256-Jm5jyHX+OFPIobK4qpMSMU2uK+ceihR2Z/mSnRwc1tQ="
+  },
+  "slf4j#slf4j-api/1.7.32": {
+   "jar": "sha256-NiT4R0wa9G11+YvAl9eGSjI8gbOAiqQ2iabhxgHAJ74=",
+   "pom": "sha256-ABzeWzxrqRBwQlz+ny5pXkrri8KQotTNllMRJ6skT+U="
+  },
+  "slf4j#slf4j-parent/1.7.32": {
+   "pom": "sha256-WrNJ0PTHvAjtDvH02ThssZQKL01vFSFQ4W277MC4PHA="
+  }
+ },
  "https://repo.maven.apache.org/maven2": {
-  "com/badlogicgames/gdx#gdx-backend-lwjgl3/1.12.1": {
-   "jar": "sha256-B3OwjHfBoHcJPFlyy4u2WJuRe4ZF/+tKh7gKsDg41o0=",
-   "module": "sha256-9O7d2ip5+E6OiwN47WWxC8XqSX/mT+b0iDioCRTTyqc=",
-   "pom": "sha256-IRSihaCUPC2d0QzB0MVDoOWM1DXjcisTYtnaaxR9SRo="
+  "com/badlogicgames/gdx#gdx-backend-lwjgl3/1.14.0": {
+   "jar": "sha256-3pV68nyhyv+3eO2hqNMbmDXcc/AEcB0WduyjOWMHICA=",
+   "module": "sha256-GJYW7PSrxbXLJMt1Xwc+IsogkUv4ojCdFdJ/fnpoyOU=",
+   "pom": "sha256-S+xaAWtXxkg0Rruzr4XV0V9f4gedhSpnTcVLMOWd9pY="
   },
-  "com/badlogicgames/gdx#gdx-freetype-platform/1.12.1": {
-   "pom": "sha256-cAGFUunqi4o21kDX8V86OT6aMmXjJUqyMHLHhUWLBm4="
+  "com/badlogicgames/gdx#gdx-freetype-platform/1.14.0": {
+   "pom": "sha256-qQmd0nb4AW2O5i/+TUneaeGohmjS2crXrGc7PvSbKM0="
   },
-  "com/badlogicgames/gdx#gdx-freetype-platform/1.12.1/natives-desktop": {
-   "jar": "sha256-1g5ZN21QWpk+yLogowR3rwaQKx4pJ/8uN17/2/Ql2UE="
+  "com/badlogicgames/gdx#gdx-freetype-platform/1.14.0/natives-desktop": {
+   "jar": "sha256-SFwrJdkZBLlBQ0Bm+BAgBpJHMMLCONBIcq5goC63Ofc="
   },
-  "com/badlogicgames/gdx#gdx-freetype/1.12.1": {
-   "jar": "sha256-rbjskAa7YdrW0pdslaHeGN5eGmUULRilgH0OUkyL8WU=",
-   "module": "sha256-HG9UGDxQFjSvGqLrKEkE7YnVvqtURs7FyqWwunHdXKE=",
-   "pom": "sha256-pLaMZBcEufzo+xszIlcUPJSYJJQg1uY6rm7tb6fHyT8="
+  "com/badlogicgames/gdx#gdx-freetype/1.14.0": {
+   "jar": "sha256-Pr/nUymeEYNLyIzzxMDCzIucJDWsA+VgsKh2QlZYK7Q=",
+   "module": "sha256-fUf8X7lgc5I5ddUqrgMuACcJ144JKU/wOK6K3R7W44A=",
+   "pom": "sha256-Rtq9qlQ6ZRDgUGOMNmphRdkGkbIaBiEf+rSbICMyQiw="
   },
-  "com/badlogicgames/gdx#gdx-jnigen-loader/2.3.1": {
-   "jar": "sha256-ZJDdoiWmHHYCwnu+xOSBE3/1lfjOCy3bpBTww0Bq7mA=",
-   "module": "sha256-nNWFK9nlHTbRJxrypGzZfOwk5XEHblQTbsmtNxhGua8=",
-   "pom": "sha256-7e2XZPzSpbw8peeAUEHppiAZ+ovkNLWZ8D1JR+KkQng="
+  "com/badlogicgames/gdx#gdx-jnigen-loader/2.5.2": {
+   "jar": "sha256-34HyPP1nhcUtNeEI7qo5MPVZ1NJ3CmEC51ynv6b58no=",
+   "module": "sha256-jwtii5G9Ez24XxUuFZMprPf0tmeDvR32AcNZfcJRIiQ=",
+   "pom": "sha256-i0dgu2bbPz+ZuEBj7z6ZDWOhzZx81XSlatf07kvRdoc="
   },
-  "com/badlogicgames/gdx#gdx-platform/1.12.1": {
-   "pom": "sha256-bZhlcVVYfr/+qIAG20v12CgcyUetGduKZP28TnOzkZc="
+  "com/badlogicgames/gdx#gdx-platform/1.14.0": {
+   "pom": "sha256-2Ps74A82eRr6thqFkeVCr7qkkQEHoFdUnMlwBu2NoRs="
   },
-  "com/badlogicgames/gdx#gdx-platform/1.12.1/natives-desktop": {
-   "jar": "sha256-P+utqUwiNjYQkXufuMJLD55h4+bGnHO9DTUDhYTA4e0="
+  "com/badlogicgames/gdx#gdx-platform/1.14.0/natives-desktop": {
+   "jar": "sha256-qKjJzM9endUYJWs8315raJpdaWoU4EYK9bDLxR218vE="
   },
-  "com/badlogicgames/gdx#gdx/1.12.1": {
-   "jar": "sha256-jTIJ6UghH96c2swrAfrO0yPlSKpS73jlx2CEWoh0aXA=",
-   "module": "sha256-7Th6fCSDcEBGAyOsXYZIZwKAPw88K1h448x4If03n6o=",
-   "pom": "sha256-Qg9vfLMYtQsglKsHYme67w6bBlI0yHqWCqkvtCEYpZY="
+  "com/badlogicgames/gdx#gdx/1.14.0": {
+   "jar": "sha256-owWJXpFfxfWUg95dOZokoMpi/hFQFf/oIQw249ZPgSY=",
+   "module": "sha256-xJCoyufsdrraEiLaEyJl5fqyyyzc3q51IXrIhkmUWyU=",
+   "pom": "sha256-CiUFNinRwfRgZMN7orOC0MRmQstKTssVF3jbNXEKmgw="
   },
   "com/badlogicgames/gdx-controllers#gdx-controllers-core/2.2.4": {
    "jar": "sha256-BNpnYnsaNkbvjyFMkdKWdCp8BVl9vCFnqqsJy9zHdHA=",

pkgs/by-name/so/sogo/package.nix

@@ -58,6 +58,12 @@ clangStdenv.mkDerivation rec {
   patches = lib.optional enableActiveSync ./enable-activesync.patch;
 
   postPatch = ''
+    # Don't record the compile command line in .GCC.command.line sections of
+    # the installed binaries: it embeds the store paths of the whole toolchain
+    # and turns clang, llvm and gcc into runtime dependencies.
+    substituteInPlace general.make \
+      --replace-fail ' $(call cc-option,-frecord-gcc-switches)' ""
+
     # Exclude NIX_ variables
     sed -i 's/grep GNUSTEP_/grep ^GNUSTEP_/g' configure
 

pkgs/by-name/so/sope/package.nix

@@ -23,6 +23,14 @@ clangStdenv.mkDerivation rec {
     hash = "sha256-0G28qDXygDe/TJ2znNE+NVQry3bkqUO59jqtJm/t2S4=";
   };
 
+  postPatch = ''
+    # Don't record the compile command line in .GCC.command.line sections of
+    # the installed binaries: it embeds the store paths of the whole toolchain
+    # and turns clang, llvm and gcc into runtime dependencies.
+    substituteInPlace general.make \
+      --replace-fail ' $(call cc-option,-frecord-gcc-switches)' ""
+  '';
+
   nativeBuildInputs = lib.optional (libpq != null) libpq.pg_config;
   buildInputs = [
     gnustep-base

pkgs/by-name/sw/swayimg/package.nix

@@ -13,6 +13,7 @@
   exiv2,
   fontconfig,
   giflib,
+  ffmpeg,
   libheif,
   libjpeg,
   libwebp,
@@ -34,13 +35,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "swayimg";
-  version = "5.5";
+  version = "5.6";
 
   src = fetchFromGitHub {
     owner = "artemsen";
     repo = "swayimg";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-PaxVcuEafLdUETSG78lGSaDukPv/2m1TUbfvpBZTT40=";
+    hash = "sha256-R+tdrKnQXLMu+nrcZRiH9SoiMYoV2LTFHS+jYXLJb7g=";
   };
 
   strictDeps = true;
@@ -69,6 +70,7 @@ stdenv.mkDerivation (finalAttrs: {
     exiv2
     fontconfig
     giflib
+    ffmpeg
     libheif
     libjpeg
     libwebp

pkgs/by-name/ta/taproot-assets/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "taproot-assets";
-  version = "0.8.3";
+  version = "0.8.4";
 
   src = fetchFromGitHub {
     owner = "lightninglabs";
     repo = "taproot-assets";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-1ZTCRsPJia4+v7SUtRZkwNr1Dm2p385ot1TO83fx46E=";
+    hash = "sha256-eMT6hQx5zzSouusgSmD5IWh93/KakW9PitrwxP3sSj4=";
   };
 
-  vendorHash = "sha256-kfcgeMgyK3gElf79aWvonsLz4PrRGkImEqm0JTkOKxk=";
+  vendorHash = "sha256-YpxWfNln7YwpKEINbOVbLf1iHEVCRWXj53tC2DhLI6w=";
 
   subPackages = [
     "cmd/tapcli"

pkgs/by-name/to/tor-browser/package.nix

@@ -102,7 +102,7 @@ let
     ++ lib.optionals mediaSupport [ ffmpeg_7 ]
   );
 
-  version = "15.0.22";
+  version = "15.0.23";
 
   sources = {
     x86_64-linux = fetchurl {
@@ -112,7 +112,7 @@ let
         "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
         "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
       ];
-      hash = "sha256-wizrBGx5zl57M7obg3iUr9Y7P/H8ckwCPbVL2BNWZFc=";
+      hash = "sha256-D2L41lx/w03UuGy6t/yq7HOBVz3aNGrHsX5WjiK0vzk=";
     };
 
     i686-linux = fetchurl {
@@ -122,7 +122,7 @@ let
         "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
         "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
       ];
-      hash = "sha256-1J82ddE8DqVSOnS4yI4ayLyx3MBP++TOonLulGsBz4E=";
+      hash = "sha256-EXCHkprnH1ylopayMN/kckEpYJAePWnzmUlldSqVswk=";
     };
   };
 

pkgs/by-name/tr/trash-cli/package.nix

@@ -9,14 +9,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "trash-cli";
-  version = "0.24.5.26";
+  version = "0.26.9.14";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "andreafrancia";
     repo = "trash-cli";
     rev = finalAttrs.version;
-    hash = "sha256-ltuMnxtG4jTTSZd6ZHWl8wI0oQMMFqW0HAPetZMfGtc=";
+    hash = "sha256-gmLJDTlCGFOmrUgjrQbdr5WBsS+H0czSKnxcmS8F8MI=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/tu/tutanota-desktop/package.nix

@@ -9,16 +9,16 @@
 
 let
   pname = "tutanota-desktop";
-  version = "357.260812.1";
+  version = "359.260904.0";
 
   linuxSrc = fetchurl {
     url = "https://github.com/tutao/tutanota/releases/download/tutanota-desktop-release-${version}/tutanota-desktop-linux.AppImage";
-    hash = "sha256-CnOJmmMLYyC4lCY/3WLz+WrdnC7nysDl4JWWL8KAn74=";
+    hash = "sha256-bhgKpOVkx5NdnhbfDawZp3cvE9sjdZYu0TKcUSgi6w4=";
   };
 
   darwinSrc = fetchurl {
     url = "https://github.com/tutao/tutanota/releases/download/tutanota-desktop-release-${version}/tutanota-desktop-mac.dmg";
-    hash = "sha256-RKwhWXTeVC6NICbXnsuORH3Xdp3qsX/VJPycr0Dnizs=";
+    hash = "sha256-l0M1p/9HNOS7Z0+ljnDeX0eHeyLHc6rM4//EjDsWzo4=";
   };
 
   passthru.updateScript = ./update.sh;

pkgs/by-name/wr/wrapGNUstepAppsHook/wrapGNUstepAppsHook.sh

@@ -4,6 +4,10 @@ if [[ -z "${__nix_wrapGNUstepAppsHook-}" ]]; then
     # Inherit arguments given in mkDerivation
     gnustepWrapperArgs=(${gnustepWrapperArgs-})
 
+    # NIX_GNUSTEP_SYSTEM_HEADERS is deliberately missing here: it only matters
+    # while compiling and gnustep-base ignores it at run time, so writing it
+    # into the installed config file would only pull the -dev outputs of every
+    # build input into the runtime closure.
     gnustepConfigVars+=(
         GNUSTEP_MAKEFILES
         NIX_GNUSTEP_SYSTEM_APPS
@@ -12,7 +16,6 @@ if [[ -z "${__nix_wrapGNUstepAppsHook-}" ]]; then
         NIX_GNUSTEP_SYSTEM_TOOLS
         NIX_GNUSTEP_SYSTEM_ADMIN_TOOLS
         NIX_GNUSTEP_SYSTEM_LIBRARY
-        NIX_GNUSTEP_SYSTEM_HEADERS
         NIX_GNUSTEP_SYSTEM_LIBRARIES
         NIX_GNUSTEP_SYSTEM_DOC
         NIX_GNUSTEP_SYSTEM_DOC_MAN
@@ -38,30 +41,59 @@ if [[ -z "${__nix_wrapGNUstepAppsHook-}" ]]; then
             fi
         }
 
-        gsAddToIncludeSearchPath() {
-            local -n ref="$1"
+        # Without strictDeps, gnustep-make's environment hook also picks up
+        # native build inputs, so the NIX_GNUSTEP_* paths include the compiler
+        # wrapper and friends. Keeping those in the installed config file would
+        # make the whole toolchain a runtime dependency (~1.6 GB).
+        gsDropBuildOnlyPaths() {
+            local -n pathsRef="$1"
+            local -a kept=()
+            local entry prefix
+            local IFS=:
 
-            if [[ -d "$2" && "${ref-}" != *"$2"* ]]; then
-                if [[ "${ref-}" != "" ]]; then
-                    ref+=" "
-                fi
+            for entry in ${pathsRef-}; do
+                for prefix in "${gnustepRuntimePrefixes[@]}"; do
+                    if [[ "$entry" =~ ^"$prefix"(/|$) ]]; then
+                        kept+=("$entry")
+                        break
+                    fi
+                done
+            done
 
-                ref+="$2"
-            fi
+            pathsRef="${kept[*]}"
         }
 
+        gnustepRuntimePrefixes=()
+
+        for output in ${outputs:-out}; do
+            gnustepRuntimePrefixes+=("${!output}")
+        done
+
+        for pkg in \
+            ${pkgsHostHost+"${pkgsHostHost[@]}"} \
+            ${pkgsHostTarget+"${pkgsHostTarget[@]}"}
+        do
+            gnustepRuntimePrefixes+=("$pkg")
+        done
+
         gsAddToSearchPath NIX_GNUSTEP_SYSTEM_APPS "$out/lib/GNUstep/Applications"
         gsAddToSearchPath NIX_GNUSTEP_SYSTEM_ADMIN_APPS "$out/lib/GNUstep/Applications"
         gsAddToSearchPath NIX_GNUSTEP_SYSTEM_WEB_APPS "$out/lib/GNUstep/WebApplications"
         gsAddToSearchPath NIX_GNUSTEP_SYSTEM_TOOLS "$out/bin"
         gsAddToSearchPath NIX_GNUSTEP_SYSTEM_ADMIN_TOOLS "$out/sbin"
         gsAddToSearchPath NIX_GNUSTEP_SYSTEM_LIBRARY "$out/lib/GNUstep"
-        gsAddToIncludeSearchPath NIX_GNUSTEP_SYSTEM_HEADERS "$out/include"
         gsAddToSearchPath NIX_GNUSTEP_SYSTEM_LIBRARIES "$out/lib"
         gsAddToSearchPath NIX_GNUSTEP_SYSTEM_DOC "$out/share/GNUstep/Documentation"
         gsAddToSearchPath NIX_GNUSTEP_SYSTEM_DOC_MAN "$out/share/man"
         gsAddToSearchPath NIX_GNUSTEP_SYSTEM_DOC_INFO "$out/share/info"
 
+        for var in "${gnustepConfigVars[@]}"; do
+            # GNUSTEP_MAKEFILES is a single path pointing at gnustep-make
+            # rather than a search path assembled from the build environment.
+            [[ "$var" == NIX_GNUSTEP_* ]] || continue
+            gsDropBuildOnlyPaths "$var"
+        done
+
         for var in "${gnustepConfigVars[@]}"; do
             if [[ -n "${!var-}" ]]; then
                 printf '%s="%s"\n' "$var" "${!var}"

pkgs/by-name/xc/xchm/package.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xchm";
-  version = "1.39";
+  version = "1.40";
 
   src = fetchFromGitHub {
     owner = "rzvncj";
     repo = "xCHM";
     rev = finalAttrs.version;
-    sha256 = "sha256-u/7f3yGWvCjmYhd5fs5TcSccz8Wr+WFQlHqUqgriUc0=";
+    sha256 = "sha256-83u13OINHH1poImsyi75mjRZTWu7nvhxKbnF29Cjk0c=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/xk/xkcd-font/package.nix

@@ -5,15 +5,15 @@
   installFonts,
 }:
 
-stdenvNoCC.mkDerivation {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "xkcd-font";
-  version = "0-unstable-2017-08-24";
+  version = "2026.2";
 
   src = fetchFromGitHub {
     owner = "ipython";
     repo = "xkcd-font";
-    rev = "5632fde618845dba5c22f14adc7b52bf6c52d46d";
-    hash = "sha256-1DgSx2L+OpXuPVSXbbl/hcZUyBK9ikPyGWuk6wNzlwc=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-IRDwdrlktO/uda3etrv5fpsF6gd+AFAXmRz/X7U5CeA=";
   };
 
   preInstall = "rm xkcd/build/xkcd.otf";
@@ -32,4 +32,4 @@ stdenvNoCC.mkDerivation {
     platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [ pancaek ];
   };
-}
+})

pkgs/by-name/xm/xmlsec/package.nix

@@ -1,97 +1,90 @@
 {
   stdenv,
   fetchurl,
-  fetchpatch,
   libxml2,
   gnutls,
   libxslt,
   pkg-config,
-  libgcrypt,
   libtool,
   openssl,
   nss,
   lib,
+  python3Packages,
   runCommandCC,
   writeText,
 }:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xmlsec";
+  version = "1.3.12";
 
-lib.fix (
-  self:
-  stdenv.mkDerivation (finalAttrs: {
-    pname = "xmlsec";
-    version = "1.3.7";
+  __structuredAttrs = true;
 
-    src = fetchurl {
-      urls = [
-        "https://www.aleksey.com/xmlsec/download/xmlsec1-${finalAttrs.version}.tar.gz"
+  src = fetchurl {
+    urls = [
+      "https://www.aleksey.com/xmlsec/download/xmlsec1-${finalAttrs.version}.tar.gz"
 
-        # for when the ${finalAttrs.version} gets older than the last two
-        "https://www.aleksey.com/xmlsec/download/older-releases/xmlsec1-${finalAttrs.version}.tar.gz"
-      ];
-      hash = "sha256-2C6TtpuKogWmFrYpF6JpMiv2Oj6q+zd1AU5hdSsgE+o=";
-    };
-
-    patches = [
-      ./lt_dladdsearchdir.patch
-      ./remove_bsd_base64_decode_flag.patch
-      (fetchpatch {
-        # xmlDoc.encoding is no longer const in libxml 2.15, so fetch the fix
-        url = "https://github.com/lsh123/xmlsec/commit/ef0e3b5cac04db13ce070b1e5bcad7dd7b0eb49b.patch?full_index=1";
-        hash = "sha256-Hv8PaJXkXLq++NuCAJ4IvsYBPj8wkN7dBTniYucq18o=";
-      })
+      # for when the ${finalAttrs.version} gets older than the last two
+      "https://www.aleksey.com/xmlsec/download/older-releases/xmlsec1-${finalAttrs.version}.tar.gz"
     ];
+    hash = "sha256-JARRma8S2T/l/bu/fjhugj5IQgcelDLiuQrBCLiJqSM=";
+  };
 
-    postPatch = ''
-      substituteAllInPlace src/dl.c
-    '';
+  patches = [
+    ./lt_dladdsearchdir.patch
+    ./remove_bsd_base64_decode_flag.patch
+  ];
 
-    outputs = [
-      "out"
-      "dev"
-    ];
+  postPatch = ''
+    substituteInPlace src/dl.c --replace-fail "@out@" "$out"
+  '';
 
-    nativeBuildInputs = [ pkg-config ];
+  outputs = [
+    "out"
+    "dev"
+  ];
 
-    buildInputs = [
-      libxml2
-      gnutls
-      libgcrypt
-      libtool
-      openssl
-      nss
-    ];
+  strictDeps = true;
 
-    propagatedBuildInputs = [
-      # required by xmlsec/transforms.h
-      libxslt
-    ];
+  nativeBuildInputs = [ pkg-config ];
 
-    enableParallelBuilding = true;
-    doCheck = true;
-    nativeCheckInputs = [ nss.tools ];
-    preCheck = ''
-      export TMPFOLDER=$(mktemp -d)
-      substituteInPlace tests/testrun.sh --replace 'timestamp=`date +%Y%m%d_%H%M%S`' 'timestamp=19700101_000000'
-    '';
+  buildInputs = [
+    libxml2
+    gnutls
+    libtool
+    openssl
+    nss
+  ];
 
-    # enable deprecated soap headers required by lasso
-    # https://dev.entrouvert.org/issues/18771
-    configureFlags = [ "--enable-soap" ];
+  propagatedBuildInputs = [
+    # required by xmlsec/transforms.h
+    libxslt
+  ];
 
-    # otherwise libxmlsec1-gnutls.so won't find libgcrypt.so, after #909
-    env.NIX_LDFLAGS = "-lgcrypt";
+  enableParallelBuilding = true;
+  doCheck = true;
+  nativeCheckInputs = [ nss.tools ];
+  preCheck = ''
+    export TMPFOLDER=$(mktemp -d)
+    substituteInPlace tests/testrun.sh --replace 'timestamp=`date +%Y%m%d_%H%M%S`' 'timestamp=19700101_000000'
+  '';
 
-    postInstall = ''
-      moveToOutput "bin/xmlsec1-config" "$dev"
-      moveToOutput "lib/xmlsec1Conf.sh" "$dev"
-    '';
+  # enable deprecated soap headers required by lasso
+  # https://dev.entrouvert.org/issues/18771
+  configureFlags = [ "--enable-soap" ];
 
-    passthru.tests.libxmlsec1-crypto =
+  postInstall = ''
+    moveToOutput "bin/xmlsec1-config" "$dev"
+    moveToOutput "lib/xmlsec1Conf.sh" "$dev"
+  '';
+
+  passthru.tests = {
+    python-xmlsec = python3Packages.xmlsec;
+    libxmlsec1-crypto =
       runCommandCC "libxmlsec1-crypto-test"
         {
           nativeBuildInputs = [ pkg-config ];
           buildInputs = [
-            self
+            finalAttrs.finalPackage
             libxml2
             libxslt
             libtool
@@ -109,20 +102,20 @@ lib.fix (
             }
           ''}
 
-          for crypto in "" gcrypt gnutls nss openssl; do
+          for crypto in "" gnutls nss openssl; do
             ./crypto-test $crypto
           done
           touch $out
         '';
+  };
 
-    meta = {
-      description = "XML Security Library in C based on libxml2";
-      homepage = "https://www.aleksey.com/xmlsec/";
-      downloadPage = "https://www.aleksey.com/xmlsec/download.html";
-      license = lib.licenses.mit;
-      mainProgram = "xmlsec1";
-      maintainers = [ ];
-      platforms = with lib.platforms; linux ++ darwin;
-    };
-  })
-)
+  meta = {
+    description = "XML Security Library in C based on libxml2";
+    homepage = "https://www.aleksey.com/xmlsec/";
+    downloadPage = "https://www.aleksey.com/xmlsec/download.html";
+    license = lib.licenses.mit;
+    mainProgram = "xmlsec1";
+    maintainers = [ ];
+    platforms = with lib.platforms; linux ++ darwin;
+  };
+})

pkgs/development/compilers/llvm/23/lldb/gnu-install-dirs.patch

@@ -0,0 +1,64 @@
+diff --git a/bindings/lua/CMakeLists.txt b/bindings/lua/CMakeLists.txt
+index f4ca6bb5f9cb..2355eb159d98 100644
+--- a/bindings/lua/CMakeLists.txt
++++ b/bindings/lua/CMakeLists.txt
+@@ -61,7 +61,7 @@ function(finish_swig_lua swig_target lldb_lua_bindings_dir lldb_lua_target_dir)
+   if(LLDB_BUILD_FRAMEWORK)
+     set(LLDB_LUA_INSTALL_PATH ${LLDB_FRAMEWORK_INSTALL_DIR}/LLDB.framework/Resources/Lua)
+   else()
+-    set(LLDB_LUA_INSTALL_PATH ${LLDB_LUA_RELATIVE_PATH})
++    set(LLDB_LUA_INSTALL_PATH ${CMAKE_INSTALL_LIBDIR}/../${LLDB_LUA_RELATIVE_PATH})
+   endif()
+   install(DIRECTORY ${lldb_lua_target_dir}/
+           DESTINATION ${LLDB_LUA_INSTALL_PATH}
+diff --git a/bindings/python/CMakeLists.txt b/bindings/python/CMakeLists.txt
+index d29b143c1408..8ce045f7fa1f 100644
+--- a/bindings/python/CMakeLists.txt
++++ b/bindings/python/CMakeLists.txt
+@@ -197,7 +197,7 @@ function(finish_swig_python swig_target lldb_python_bindings_dir lldb_python_tar
+   if(LLDB_BUILD_FRAMEWORK)
+     set(LLDB_PYTHON_INSTALL_PATH ${LLDB_FRAMEWORK_INSTALL_DIR}/LLDB.framework/Versions/${LLDB_FRAMEWORK_VERSION}/Resources/Python)
+   else()
+-    set(LLDB_PYTHON_INSTALL_PATH ${LLDB_PYTHON_RELATIVE_PATH})
++    set(LLDB_PYTHON_INSTALL_PATH ${CMAKE_INSTALL_LIBDIR}/../${LLDB_PYTHON_RELATIVE_PATH})
+   endif()
+   if (NOT CMAKE_CFG_INTDIR STREQUAL  ".")
+     string(REPLACE ${CMAKE_CFG_INTDIR} "\$\{CMAKE_INSTALL_CONFIG_NAME\}" LLDB_PYTHON_INSTALL_PATH ${LLDB_PYTHON_INSTALL_PATH})
+@@ -248,14 +248,6 @@ function(add_python_wrapper target)
+   add_dependencies(${target} swig_wrapper_python)
+   add_swig_wrapper(${target} ${lldb_python_wrapper})
+ 
+-  # lib/pythonX.Y/dist-packages/lldb/_lldb.so is a symlink to lib/liblldb.so,
+-  # which depends on lib/libLLVM*.so (BUILD_SHARED_LIBS) or lib/libLLVM-10git.so
+-  # (LLVM_LINK_LLVM_DYLIB). Add an additional rpath $ORIGIN/../../../../lib so
+-  # that _lldb.so can be loaded from Python.
+-  if(LLDB_ENABLE_PYTHON AND (BUILD_SHARED_LIBS OR LLVM_LINK_LLVM_DYLIB) AND UNIX AND NOT APPLE)
+-    set_property(TARGET ${target} APPEND PROPERTY INSTALL_RPATH "\$ORIGIN/../../../../lib${LLVM_LIBDIR_SUFFIX}")
+-  endif()
+-
+   if(Python3_RPATH)
+     set_property(TARGET ${target} APPEND PROPERTY INSTALL_RPATH "${Python3_RPATH}")
+     set_property(TARGET ${target} APPEND PROPERTY BUILD_RPATH   "${Python3_RPATH}")
+diff --git a/cmake/modules/AddLLDB.cmake b/cmake/modules/AddLLDB.cmake
+index b6ad8d46380b..02c5f9806295 100644
+--- a/cmake/modules/AddLLDB.cmake
++++ b/cmake/modules/AddLLDB.cmake
+@@ -329,7 +329,7 @@ function(add_lldb_library name)
+   endif()
+ 
+   if(PARAM_SHARED)
+-    set(install_dest lib${LLVM_LIBDIR_SUFFIX})
++    set(install_dest ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX})
+     if(PARAM_INSTALL_PREFIX)
+       set(install_dest ${PARAM_INSTALL_PREFIX})
+     endif()
+diff --git a/tools/intel-features/CMakeLists.txt b/tools/intel-features/CMakeLists.txt
+index 7d48491ec89a..c04543585588 100644
+--- a/tools/intel-features/CMakeLists.txt
++++ b/tools/intel-features/CMakeLists.txt
+@@ -30,4 +30,4 @@ add_lldb_library(lldbIntelFeatures SHARED
+   )
+ 
+ install(TARGETS lldbIntelFeatures
+-  LIBRARY DESTINATION lib${LLVM_LIBDIR_SUFFIX})
++  LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX})

pkgs/development/compilers/llvm/common/lldb/default.nix

@@ -3,6 +3,7 @@
   stdenv,
   llvm_meta,
   release_version,
+  getVersionFile,
   cmake,
   zlib,
   ncurses,
@@ -75,7 +76,7 @@ stdenv.mkDerivation (
     sourceRoot = "${finalAttrs.src.name}/lldb";
 
     patches = [
-      ./gnu-install-dirs.patch
+      (getVersionFile "lldb/gnu-install-dirs.patch")
     ]
     ++ lib.optionals (lib.versions.major release_version == "18") [
       # Fix build with gcc15

pkgs/development/compilers/llvm/common/patches.nix

@@ -20,6 +20,16 @@
       path = ../18;
     }
   ];
+  "lldb/gnu-install-dirs.patch" = [
+    {
+      before = "23";
+      path = ../18;
+    }
+    {
+      after = "23";
+      path = ../23;
+    }
+  ];
   "llvm/backport-darwin-triple-parsing.patch" = [
     {
       after = "18";

pkgs/development/ocaml-modules/jws/default.nix

@@ -0,0 +1,44 @@
+{
+  lib,
+  buildDunePackage,
+  fetchurl,
+  base64,
+  digestif,
+  jsont,
+  mirage-crypto-ec,
+  mirage-crypto-pk,
+  mirage-crypto-rng,
+  ounit2,
+  x509,
+}:
+
+buildDunePackage (finalAttrs: {
+  pname = "jws";
+  version = "0.0.2";
+  src = fetchurl {
+    url = "https://github.com/robur-coop/jws/releases/download/v${finalAttrs.version}/jws-${finalAttrs.version}.tbz";
+    hash = "sha256-7qcxmuhMNkm0xyzVn2MI+mLyO7UbQe+4r0o6CX3XHD0=";
+  };
+
+  propagatedBuildInputs = [
+    base64
+    digestif
+    jsont
+    mirage-crypto-ec
+    mirage-crypto-pk
+  ];
+
+  doCheck = true;
+  checkInputs = [
+    mirage-crypto-rng
+    ounit2
+    x509
+  ];
+
+  meta = {
+    homepage = "https://git.robur.coop/robur/jws";
+    description = "Implementation of JSON Web Signature/Token (RFC 7515)";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.vbgl ];
+  };
+})

pkgs/development/ocaml-modules/letsencrypt/app.nix

@@ -16,7 +16,6 @@
 
 buildDunePackage {
   pname = "letsencrypt-app";
-  minimalOCamlVersion = "4.08";
 
   inherit (letsencrypt)
     src

pkgs/development/ocaml-modules/letsencrypt/default.nix

@@ -2,17 +2,11 @@
   buildDunePackage,
   lib,
   fetchurl,
-  uri,
-  base64,
-  digestif,
+  jws,
+  lun,
   logs,
   fmt,
-  lwt,
-  mirage-crypto,
-  mirage-crypto-ec,
-  mirage-crypto-pk,
   x509,
-  yojson,
   ounit2,
   ptime,
   domain-name,
@@ -20,15 +14,13 @@
 
 buildDunePackage (finalAttrs: {
   pname = "letsencrypt";
-  version = "1.1.0";
+  version = "2.1.0";
 
   src = fetchurl {
     url = "https://github.com/mmaker/ocaml-letsencrypt/releases/download/v${finalAttrs.version}/letsencrypt-${finalAttrs.version}.tbz";
-    hash = "sha256-Iw55GffyG5tWA49hao1z9BX6p4N2+EKuhLIoOwG8EKM=";
+    hash = "sha256-fBSPKtt8roTqhzBlpf9rDg5Y1ieC2lS6XQJNQGncUO0=";
   };
 
-  minimalOCamlVersion = "4.08";
-
   buildInputs = [
     fmt
     ptime
@@ -36,16 +28,10 @@ buildDunePackage (finalAttrs: {
   ];
 
   propagatedBuildInputs = [
+    jws
     logs
-    yojson
-    lwt
-    base64
-    digestif
-    mirage-crypto
-    mirage-crypto-ec
-    mirage-crypto-pk
+    lun
     x509
-    uri
   ];
 
   doCheck = true;

pkgs/development/ocaml-modules/letsencrypt/dns.nix

@@ -11,7 +11,6 @@
 
 buildDunePackage {
   pname = "letsencrypt-dns";
-  minimalOCamlVersion = "4.08";
 
   inherit (letsencrypt)
     version

pkgs/development/ocaml-modules/ocaml-solo5/default.nix

@@ -17,20 +17,24 @@
       throw "ocaml-solo5 does not support ${stdenv.targetPlatform.system}",
 }:
 
-assert lib.asserts.assertOneOf "ocaml-solo5's ocaml version" ocaml.version [
-  "5.4.1"
-  "5.5.0"
-];
+let
+  # check upstream patches/<name> directory names
+  allowlisted = [ "5.5" ];
+  entry =
+    if lib.elem ocaml.version allowlisted then ocaml.version else lib.versions.majorMinor ocaml.version;
+in
+
+assert lib.asserts.assertOneOf "ocaml-solo5's ocaml version" entry allowlisted;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ocaml-solo5";
-  version = "1.3.3";
+  version = "1.3.4";
 
   src = fetchFromGitHub {
     owner = "mirage";
     repo = "ocaml-solo5";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/xUF98MPhjv9yRWoRDx2uIkCr2Furz1qUJexIxnHhI4=";
+    hash = "sha256-ZbJoh3HHjD7XNvGK1Ehdu/uEoPFtRgVNNz8vtT7zaXI=";
   };
 
   strictDeps = true;
@@ -52,12 +56,9 @@ stdenv.mkDerivation (finalAttrs: {
   postPatch = ''
     mkdir ocaml
     tar xf ${ocaml.src} -C ocaml --strip-components=1
-    version=$(head -n1 ocaml/VERSION)
-    if test -d "patches/$version"; then
-      for p in "patches/$version"/*; do
-        patch -d ocaml -p1 < "$p"
-      done
-    fi
+    for p in patches/${entry}/*; do
+      patch -d ocaml -p1 < "$p"
+    done
   '';
 
   # stdenv exports these environment variables

pkgs/development/python-modules/claude-agent-sdk/default.nix

@@ -14,14 +14,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "claude-agent-sdk";
-  version = "0.2.152";
+  version = "0.2.153";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "anthropics";
     repo = "claude-agent-sdk-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-h3LjBolK1hpcATNX45ftYZBTKWQtSF34o78E6fRab2M=";
+    hash = "sha256-lGLTNY+XtudqR0SzkDw+HrU1k53mm37inmczfB5jw4I=";
   };
 
   build-system = [ hatchling ];

pkgs/development/python-modules/fastgit/default.nix

@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "fastgit";
-  version = "0.1.3";
+  version = "0.1.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "AnswerDotAI";
     repo = "fastgit";
     tag = finalAttrs.version;
-    hash = "sha256-yN471RY02Ccpct0zrHxhHkiz5Fpbmpgwx+fzSktib4E=";
+    hash = "sha256-sBnl4CWYts4cjQ/etfPN1IZWlT1TPDGW+aM/oPukR0E=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/mjviser/default.nix

@@ -0,0 +1,64 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  uv-build,
+
+  # dependencies
+  mujoco,
+  numpy,
+  pillow,
+  trimesh,
+  viser,
+
+  # tests
+  pytestCheckHook,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "mjviser";
+  version = "0.0.14";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "mujocolab";
+    repo = "mjviser";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-LzltAgWKK84gQU4IlzKv7SClaUrLCdyU8vzHh4LIqDs=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail \
+        "uv_build>=0.8.19,<0.9.0" \
+        "uv_build"
+  '';
+
+  build-system = [
+    uv-build
+  ];
+
+  dependencies = [
+    mujoco
+    numpy
+    pillow
+    trimesh
+    viser
+  ];
+
+  pythonImportsCheck = [ "mjviser" ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  meta = {
+    description = "Web-based MuJoCo viewer powered by Viser";
+    homepage = "https://github.com/mujocolab/mjviser";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ nim65s ];
+  };
+})

pkgs/development/python-modules/msmart-ng/default.nix

@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "msmart-ng";
-  version = "2026.8.0";
+  version = "2026.9.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mill1000";
     repo = "midea-msmart";
     tag = version;
-    hash = "sha256-UbRL42jQk3A8VYe/eLj3XNTFPhyVjBMzB/lTNs0tyRM=";
+    hash = "sha256-pTL7Kn+m5HP1xJ2cvxWaj8700c7bGPonS4nku+SwsRI=";
   };
 
   build-system = [

pkgs/development/python-modules/mujoco-warp/default.nix

@@ -0,0 +1,72 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  setuptools,
+
+  # dependencies
+  absl-py,
+  etils,
+  mujoco,
+  numpy,
+  warp-lang,
+
+  # optional-dependencies
+  jax,
+
+  # tests
+  pytestCheckHook,
+  writableTmpDirAsHomeHook,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "mujoco-warp";
+  version = "3.13.0";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "google-deepmind";
+    repo = "mujoco_warp";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-R+YizRSaPOt4eSy6W0dRsFn+ovn+Ks05wVyd5e9lgYc=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    absl-py
+    etils
+    mujoco
+    numpy
+    warp-lang
+  ];
+
+  optional-dependencies = {
+    cpu = [
+      jax
+    ];
+    cuda = [
+      jax
+    ];
+  };
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    writableTmpDirAsHomeHook
+  ];
+
+  pythonImportsCheck = [ "mujoco_warp" ];
+
+  meta = {
+    description = "GPU-optimized version of the MuJoCo physics simulator, designed for NVIDIA hardware";
+    homepage = "https://github.com/google-deepmind/mujoco_warp";
+    changelog = "https://github.com/google-deepmind/mujoco_warp/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ nim65s ];
+  };
+})

pkgs/development/python-modules/playwright/default.nix

@@ -38,7 +38,7 @@ buildPythonPackage (finalAttrs: {
     owner = "microsoft";
     repo = "playwright-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DHMX7RaySqfy2Xi+Rw4nUg9pYrpxIksjq1JhWfknOaI=";
+    hash = "sha256-RwIn+0EcHnStjORVFmT7gp4bGjl+qer1FgtI3+aPF2w=";
   };
 
   patches = [

pkgs/development/python-modules/print-color/default.nix

@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "print-color";
-  version = "0.4.7";
+  version = "0.4.8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "xy3";
     repo = "print-color";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bVmJiRFYThAwNz25DKvBl1k1mdqwQ5FB2vuaYvuf4kg=";
+    hash = "sha256-WzWButpFc+YHQNjd7+t5MHgAa8W9nSyWfTCd9zmnD6s=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/rsl-rl-lib/default.nix

@@ -0,0 +1,77 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  setuptools,
+
+  # dependencies
+  gitpython,
+  numpy,
+  onnx,
+  onnxscript,
+  tensorboard,
+  tensordict,
+  torch,
+  torchvision,
+
+  # optional-dependencies
+  wandb,
+
+  # tests
+  pytestCheckHook,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "rsl-rl-lib";
+  version = "5.4.2";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "leggedrobotics";
+    repo = "rsl_rl";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-m9M9yWCKs5vLHb7k5A7AFfHko980HDeF3qr1x7s1KGE=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    gitpython
+    numpy
+    onnx
+    onnxscript
+    tensorboard
+    tensordict
+    torch
+    torchvision
+  ];
+
+  optional-dependencies = {
+    # https://github.com/neptune-ai/neptune-client is archived
+    # neptune = [
+    #   neptune
+    # ];
+    wandb = [
+      wandb
+    ];
+  };
+
+  pythonImportsCheck = [ "rsl_rl" ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  meta = {
+    description = "Fast and simple implementation of learning algorithms for robotics";
+    homepage = "https://github.com/leggedrobotics/rsl_rl";
+    changelog = "https://github.com/leggedrobotics/rsl_rl/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ nim65s ];
+  };
+})

pkgs/development/python-modules/torchrunx/default.nix

@@ -0,0 +1,81 @@
+{
+  lib,
+  stdenv,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  uv-build,
+
+  # dependencies
+  cloudpickle,
+  fabric,
+  numpy,
+  torch,
+
+  # tests
+  pytestCheckHook,
+  submitit,
+  transformers,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "torchrunx";
+  version = "0.4.0";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "apoorvkh";
+    repo = "torchrunx";
+    tag = finalAttrs.version;
+    hash = "sha256-cb9X65rnacgB59NdjEVpReFZD1wvC9GWmE0BULnCTow=";
+  };
+
+  build-system = [
+    uv-build
+  ];
+
+  dependencies = [
+    cloudpickle
+    fabric
+    numpy
+    torch
+  ];
+
+  pythonImportsCheck = [ "torchrunx" ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    submitit
+    transformers
+  ];
+
+  disabledTests = [
+    # RuntimeError: Not in a SLURM job
+    "test_launch"
+
+    # RuntimeError: Could not detect "srun", are you indeed on a slurm cluster?
+    "test_submitit"
+
+    #  RuntimeError: workers_per_host="gpu", but no GPUs detected on: ['localhost'].
+    "test_distributed_train"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    # torch.distributed.DistNetworkError: The client socket has timed out after 300000ms while
+    # trying to connect to (build03, 63972).
+    "test_error"
+    "test_logging"
+    "test_simple_localhost"
+  ];
+
+  __darwinAllowLocalNetworking = true;
+
+  meta = {
+    description = "Easily run PyTorch on multiple GPUs & machines";
+    homepage = "https://github.com/apoorvkh/torchrunx";
+    changelog = "https://github.com/apoorvkh/torchrunx/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ nim65s ];
+  };
+})

pkgs/development/python-modules/xmlsec/default.nix

@@ -3,6 +3,7 @@
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch,
 
   # build-system
   pkgconfig,
@@ -38,6 +39,20 @@ buildPythonPackage (finalAttrs: {
     hash = "sha256-p3V75DLUI2PKdharP3/0HrKOgma9Kh3lAOZLRAQjo80=";
   };
 
+  patches = [
+    # https://github.com/lsh123/xmlsec/issues/1148
+    # https://github.com/xmlsec/python-xmlsec/pull/422
+    (fetchpatch {
+      name = "xmlsec-1.3.11-test-compatibility.patch";
+      url = "https://github.com/xmlsec/python-xmlsec/commit/5e8b4e6aa133c358b8aaf8e17ceb5b3b7fea78e8.patch";
+      includes = [
+        "src/*"
+        "tests/*"
+      ];
+      hash = "sha256-+J2L6oq802/534qIDvFqsWYfn9LExRlXXIeDvVqZEYk=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace-fail "lxml==" "lxml>=" \

pkgs/development/web/playwright/webkit.nix

@@ -32,6 +32,7 @@
   libgcrypt,
   libgpg-error,
   libjpeg8,
+  libmanette,
   libopus,
   libpng,
   libsoup_3,
@@ -167,6 +168,7 @@ let
       libgcrypt
       libgpg-error
       libjpeg8
+      libmanette
       libopus
       libpng
       libsoup_3

pkgs/servers/home-assistant/custom-components/midea_ac/package.nix

@@ -10,13 +10,13 @@
 buildHomeAssistantComponent rec {
   owner = "mill1000";
   domain = "midea_ac";
-  version = "2026.8.3";
+  version = "2026.9.0";
 
   src = fetchFromGitHub {
     owner = "mill1000";
     repo = "midea-ac-py";
     tag = version;
-    hash = "sha256-vuSMP+RuDRQPiaz5SauXym/dNPtJBARPybAEiFWRFbw=";
+    hash = "sha256-c8svh2Td2fxVnoMGhSK9Iz+ZekS7dCvoVQ6Z7WiQgA4=";
   };
 
   dependencies = [ msmart-ng ];

pkgs/tools/inputmethods/fcitx5/fcitx5-chinese-addons.nix

@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  fetchpatch,
   fetchFromGitHub,
   cmake,
   pkg-config,
@@ -19,6 +18,7 @@
   fmt,
   qtbase,
   luaSupport ? true,
+  nlohmann_json,
 }:
 
 let
@@ -36,13 +36,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "fcitx5-chinese-addons";
-  version = "5.1.12";
+  version = "5.1.14";
 
   src = fetchFromGitHub {
     owner = "fcitx";
     repo = pname;
     rev = version;
-    hash = "sha256-bAx5m+tU8hT1WdaLChpQV3J0l+QJzDLzMEPTgjEGCuw=";
+    hash = "sha256-EtAoUoZQqxb049oD7r/UgdpJdS/kenMn3t1SHv+YIkg=";
   };
 
   nativeBuildInputs = [
@@ -68,6 +68,7 @@ stdenv.mkDerivation rec {
     qtwebengine
     fmt
     qtbase
+    nlohmann_json
   ]
   ++ lib.optional luaSupport fcitx5-lua;
 

pkgs/tools/inputmethods/fcitx5/fcitx5-qt.nix

@@ -16,13 +16,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "fcitx5-qt${majorVersion}";
-  version = "5.1.14";
+  version = "5.1.15";
 
   src = fetchFromGitHub {
     owner = "fcitx";
     repo = "fcitx5-qt";
     rev = version;
-    hash = "sha256-fyqejCb6c6VuPb44UPQDLrdZ93mHTxlX29jCN6KcZ5I=";
+    hash = "sha256-xmtFiWjjknDNN0RdI45GwiuBojRCRZiSGxP9asE5OeY=";
   };
 
   postPatch = ''

pkgs/top-level/ocaml-packages.nix

@@ -1053,6 +1053,8 @@ let
         junit_alcotest = callPackage ../development/ocaml-modules/junit/alcotest.nix { };
         junit_ounit = callPackage ../development/ocaml-modules/junit/ounit.nix { };
 
+        jws = callPackage ../development/ocaml-modules/jws { };
+
         jwto = callPackage ../development/ocaml-modules/jwto { };
 
         ### K ###

pkgs/top-level/python-packages.nix

@@ -10926,6 +10926,8 @@ self: super: with self; {
 
   mizani = callPackage ../development/python-modules/mizani { };
 
+  mjviser = callPackage ../development/python-modules/mjviser { };
+
   mkdocs = callPackage ../development/python-modules/mkdocs { };
 
   mkdocs-autolinks-plugin = callPackage ../development/python-modules/mkdocs-autolinks-plugin { };
@@ -11325,6 +11327,8 @@ self: super: with self; {
 
   mujoco-mjx = callPackage ../development/python-modules/mujoco-mjx { mujoco-main = pkgs.mujoco; };
 
+  mujoco-warp = callPackage ../development/python-modules/mujoco-warp { };
+
   mujson = callPackage ../development/python-modules/mujson { };
 
   mullvad-api = callPackage ../development/python-modules/mullvad-api { };
@@ -18344,6 +18348,8 @@ self: super: with self; {
 
   rsa = callPackage ../development/python-modules/rsa { };
 
+  rsl-rl-lib = callPackage ../development/python-modules/rsl-rl-lib { };
+
   rsskey = callPackage ../development/python-modules/rsskey { };
 
   rst2ansi = callPackage ../development/python-modules/rst2ansi { };
@@ -20962,6 +20968,8 @@ self: super: with self; {
 
   torchrl = callPackage ../development/python-modules/torchrl { };
 
+  torchrunx = callPackage ../development/python-modules/torchrunx { };
+
   torchsde = callPackage ../development/python-modules/torchsde { };
 
   torchsnapshot = callPackage ../development/python-modules/torchsnapshot { };