maintainers: add Matrix for aaravrav (#567411)

Co-authored-by: Robert Hensing <roberth@users.noreply.github.com>

.github/workflows/lint.yml

@@ -130,7 +130,7 @@ jobs:
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
-            const { default: checkCommitMessages } = await import('${{ github.workspace }}/trusted/ci/github-script/lint-commits.js')
+            const { default: checkCommitMessages } = await import('${{ github.workspace }}/trusted/ci/github-script/lint-commits.ts')
 
             await checkCommitMessages({
               github,

.github/workflows/merge-group.yml

@@ -38,8 +38,8 @@ jobs:
           TARGET_SHA: ${{ inputs.targetSha }}
         with:
           script: |
-            const { classify } = await import('${{ github.workspace }}/ci/github-script/supportedBranches.js')
-            const { default: supportedSystems } = await import('${{ github.workspace }}/ci/github-script/supportedSystems.js')
+            const { classify } = await import('${{ github.workspace }}/ci/github-script/supportedBranches.ts')
+            const { default: supportedSystems } = await import('${{ github.workspace }}/ci/github-script/supportedSystems.ts')
 
             const baseBranch = (
               context.payload.merge_group?.base_ref ??

.github/workflows/test.yml

@@ -64,8 +64,8 @@ jobs:
               '.github/workflows/test.yml',
               'ci/github-script/package.json',
               'ci/github-script/package-lock.json',
-              'ci/github-script/supportedBranches.js',
-              'ci/github-script/supportedSystems.js',
+              'ci/github-script/supportedBranches.ts',
+              'ci/github-script/supportedSystems.ts',
               'ci/pinned.json',
               'pkgs/top-level/release-supported-systems.json',
             ].includes(file))) core.setOutput('merge-group', true)
@@ -82,8 +82,8 @@ jobs:
               'ci/github-script/bot.js',
               'ci/github-script/check-target-branch.ts',
               'ci/github-script/commits.ts',
-              'ci/github-script/get-pr-commit-details.js',
-              'ci/github-script/lint-commits.js',
+              'ci/github-script/get-pr-commit-details.ts',
+              'ci/github-script/lint-commits.ts',
               'ci/github-script/manual-file-edits.ts',
               'ci/github-script/merge.js',
               'ci/github-script/package.json',
@@ -91,9 +91,9 @@ jobs:
               'ci/github-script/prepare.js',
               'ci/github-script/reminders.ts',
               'ci/github-script/reviewers.js',
-              'ci/github-script/reviews.js',
-              'ci/github-script/supportedBranches.js',
-              'ci/github-script/supportedSystems.js',
+              'ci/github-script/reviews.ts',
+              'ci/github-script/supportedBranches.ts',
+              'ci/github-script/supportedSystems.ts',
               'ci/github-script/withRateLimit.js',
               'ci/pinned.json',
               'pkgs/top-level/release-supported-systems.json',

ci/OWNERS

@@ -444,9 +444,9 @@ nixos/tests/forgejo.nix               @adamcstephens @bendlas @christoph-heiss @
 /doc/hooks/zig.section.md       @RossComputerGuy
 
 # Buildbot
-nixos/modules/services/continuous-integration/buildbot @Mic92 @zowoq
-nixos/tests/buildbot.nix                               @Mic92 @zowoq
-pkgs/development/tools/continuous-integration/buildbot @Mic92 @zowoq
+nixos/modules/services/continuous-integration/buildbot @Mic92
+nixos/tests/buildbot.nix                               @Mic92
+pkgs/development/tools/continuous-integration/buildbot @Mic92
 
 # Pretix
 pkgs/by-name/pr/pretix/ @mweinelt

ci/README.md

@@ -104,7 +104,7 @@ For the purposes of CI, branches in the NixOS/nixpkgs repository are classified
 
 Some branches also have a version component, which is either `unstable` or `YY.MM`.
 
-`ci/github-script/supportedBranches.js` is a script imported by CI to classify the base and head branches of a Pull Request.
+`ci/github-script/supportedBranches.ts` is a script imported by CI to classify the base and head branches of a Pull Request.
 This classification will then be used to skip certain jobs.
 This script can also be run locally to print basic test cases.
 

ci/github-script/bot.js

@@ -4,7 +4,7 @@ import path from 'node:path'
 import { DefaultArtifactClient } from '@actions/artifact'
 import { handleMerge } from './merge.js'
 import { handleReviewers } from './reviewers.js'
-import { classify } from './supportedBranches.js'
+import { classify } from './supportedBranches.ts'
 import withRateLimit from './withRateLimit.js'
 
 export default async ({ github, context, core, dry }) => {

ci/github-script/check-target-branch-policy.ts

@@ -1,4 +1,4 @@
-import { classify, split } from './supportedBranches.js'
+import { classify, split } from './supportedBranches.ts'
 
 type TargetBranchPolicyFacts = {
   base: string

ci/github-script/check-target-branch.ts

@@ -6,8 +6,8 @@ import {
   evaluateTargetBranchPolicy,
   getTargetBranchPolicy,
 } from './check-target-branch-policy.ts'
-import { dismissReviews, postReview } from './reviews.js'
-import { split } from './supportedBranches.js'
+import { dismissReviews, postReview } from './reviews.ts'
+import { split } from './supportedBranches.ts'
 
 // TODO: should this be combined with the branch checks in prepare.js?
 // They do seem quite similar, but this needs to run after eval,

ci/github-script/commits.ts

@@ -2,8 +2,8 @@ import { execFileSync } from 'node:child_process'
 import type * as actionsCore from '@actions/core'
 import type { context as actionsContext } from '@actions/github'
 import type { GitHub } from '@actions/github/lib/utils'
-import { dismissReviews, postReview } from './reviews.js'
-import { classify } from './supportedBranches.js'
+import { dismissReviews, postReview } from './reviews.ts'
+import { classify } from './supportedBranches.ts'
 import withRateLimit from './withRateLimit.js'
 
 const dirname = import.meta.dirname

ci/github-script/get-pr-commit-details.ts

@@ -3,26 +3,23 @@ import { promisify } from 'node:util'
 
 const execFile = promisify(nodeExecFile)
 
-/**
- * @typedef {{
- *  subject: string,
- *  sha: string,
- *  author: { name: string, email: string },
- *  committer: { name: string, email: string}
- *  changedPaths: string[],
- *  changedPathSegments: Set<string>,
- * }} Commit
- */
+export type Commit = {
+  subject: string
+  sha: string
+  author: { name: string; email: string }
+  committer: { name: string; email: string }
+  changedPaths: string[]
+  changedPathSegments: Set<string>
+}
 
-/**
- * @param {{
- *  args: string[]
- *  core: typeof import('@actions/core'),
- *  quiet?: boolean,
- *  repoPath?: string,
- * }} RunGitProps
- */
-async function runGit({ args, repoPath, core, quiet }) {
+interface RunGitProps {
+  args: string[]
+  core: typeof import('@actions/core')
+  quiet?: boolean
+  repoPath?: string
+}
+
+async function runGit({ args, repoPath, core, quiet }: RunGitProps) {
   if (repoPath) {
     args = ['-C', repoPath, ...args]
   }
@@ -34,21 +31,29 @@ async function runGit({ args, repoPath, core, quiet }) {
   return await execFile('git', args)
 }
 
+interface GetCommitMessagesForPRProps {
+  core: typeof import('@actions/core')
+  pr: Awaited<
+    ReturnType<
+      InstanceType<
+        typeof import('@actions/github/lib/utils').GitHub
+      >['rest']['pulls']['get']
+    >
+  >['data']
+  repoPath?: string
+}
+
 /**
  * Gets the SHA, subject and changed files for each commit in the given PR.
  *
  * Don't use GitHub API at all: the "list commits on PR" endpoint has a limit
  * of 250 commits and doesn't return the changed files.
- *
- * @param {{
- *  core: typeof import('@actions/core'),
- *  pr: Awaited<ReturnType<InstanceType<typeof import('@actions/github/lib/utils').GitHub>["rest"]["pulls"]["get"]>>["data"]
- *  repoPath?: string,
- * }} GetCommitMessagesForPRProps
- *
- * @returns {Promise<Commit[]>}
  */
-export async function getCommitDetailsForPR({ core, pr, repoPath }) {
+export async function getCommitDetailsForPR({
+  core,
+  pr,
+  repoPath,
+}: GetCommitMessagesForPRProps): Promise<Commit[]> {
   await runGit({
     args: ['fetch', `--depth=1`, 'origin', pr.base.sha],
     repoPath,

ci/github-script/lint-commits.ts

@@ -1,17 +1,23 @@
-import { getCommitDetailsForPR } from './get-pr-commit-details.js'
-import { classify } from './supportedBranches.js'
+import { type Commit, getCommitDetailsForPR } from './get-pr-commit-details.ts'
+import { classify } from './supportedBranches.ts'
 
-/** @typedef {import('./get-pr-commit-details.js').Commit} Commit */
+type GitHub = InstanceType<typeof import('@actions/github/lib/utils').GitHub>
+type Context = typeof import('@actions/github').context
+type Core = typeof import('@actions/core')
 
-/**
- * @param {{
- *  github: InstanceType<typeof import('@actions/github/lib/utils').GitHub>,
- *  context: typeof import('@actions/github').context,
- *  core: typeof import('@actions/core'),
- *  repoPath?: string,
- * }} LintCommitsProps
- */
-export default async function lintCommits({ github, context, core, repoPath }) {
+interface LintCommitsProps {
+  github: GitHub
+  context: Context
+  core: Core
+  repoPath?: string
+}
+
+export default async function lintCommits({
+  github,
+  context,
+  core,
+  repoPath,
+}: LintCommitsProps) {
   // This check should only be run when we have the pull_request context.
   const pull_number = context.payload.pull_request?.number
   if (!pull_number) {
@@ -53,13 +59,15 @@ export default async function lintCommits({ github, context, core, repoPath }) {
   await checkCommitMetadata({ commits, core })
 }
 
-/**
- * @param {{
- *  commits: Commit[],
- *  core: typeof import('@actions/core'),
- * }} CheckCommitMessagesProps
- */
-async function checkCommitMessages({ commits, core }) {
+interface CheckCommitMessagesProps {
+  commits: Commit[]
+  core: Core
+}
+
+async function checkCommitMessages({
+  commits,
+  core,
+}: CheckCommitMessagesProps) {
   const failures = new Set()
 
   const conventionalCommitTypes = [
@@ -80,10 +88,13 @@ async function checkCommitMessages({ commits, core }) {
   ]
 
   /**
-   * @param {string[]} types e.g. ["fix", "feat"]
-   * @param {string?} sha commit hash
+   * @param types e.g. ["fix", "feat"]
+   * @param sha commit hash
    */
-  function makeConventionalCommitRegex(types, sha = null) {
+  function makeConventionalCommitRegex(
+    types: string[],
+    sha: string | null = null,
+  ) {
     core.info(
       `${
         sha
@@ -166,17 +177,15 @@ async function checkCommitMessages({ commits, core }) {
   }
 }
 
-/**
- * @param {{
- *  commits: Commit[],
- *  core: typeof import('@actions/core'),
- * }} CheckGitFieldsProps
- */
-async function checkCommitMetadata({ commits, core }) {
+interface CheckGitFieldsProps {
+  commits: Commit[]
+  core: Core
+}
+
+async function checkCommitMetadata({ commits, core }: CheckGitFieldsProps) {
   const failures = new Set()
 
-  /** @type {(s: string) => boolean} */
-  const isEmail = (s) => /^.+@.*$/.test(s)
+  const isEmail = (s: string) => /^.+@.*$/.test(s)
 
   for (const commit of commits) {
     if (!commit.author.name) {

ci/github-script/manual-file-edits.ts

@@ -1,6 +1,6 @@
-import { getCommitDetailsForPR } from './get-pr-commit-details.js'
-import { dismissReviews, postReview } from './reviews.js'
-import { classify } from './supportedBranches.js'
+import { getCommitDetailsForPR } from './get-pr-commit-details.ts'
+import { dismissReviews, postReview } from './reviews.ts'
+import { classify } from './supportedBranches.ts'
 
 export default async function checkManualFileEdits({
   github,

ci/github-script/merge.js

@@ -1,5 +1,5 @@
 // @ts-nocheck
-import { classify } from './supportedBranches.js'
+import { classify } from './supportedBranches.ts'
 
 function runChecklist({
   committers,

ci/github-script/prepare.js

@@ -1,7 +1,7 @@
 // @ts-nocheck
-import { dismissReviews, postReview } from './reviews.js'
-import { classify } from './supportedBranches.js'
-import supportedSystems from './supportedSystems.js'
+import { dismissReviews, postReview } from './reviews.ts'
+import { classify } from './supportedBranches.ts'
+import supportedSystems from './supportedSystems.ts'
 
 const reviewKey = 'prepare'
 
@@ -66,7 +66,7 @@ export default async ({ github, context, core, dry }) => {
       // commits between that base and head is the real base. We can query for this via GitHub's
       // REST API. There can be multiple candidates for the real base with the same number of
       // commits. In this case we pick the "best" candidate by a fixed ordering of branches,
-      // as defined in ci/github-script/supportedBranches.js.
+      // as defined in ci/github-script/supportedBranches.ts.
       //
       // These requests take a while, when comparing against the wrong release - they need
       // to look at way more than 10k commits in that case. Thus, we try to minimize the

ci/github-script/reminders.ts

@@ -3,9 +3,9 @@ import path from 'node:path'
 import type * as actionsCore from '@actions/core'
 import type { context as actionsContext } from '@actions/github'
 import type { GitHub } from '@actions/github/lib/utils'
-import { getCommitDetailsForPR } from './get-pr-commit-details.js'
-import { dismissReviews, postReview } from './reviews.js'
-import { classify } from './supportedBranches.js'
+import { getCommitDetailsForPR } from './get-pr-commit-details.ts'
+import { dismissReviews, postReview } from './reviews.ts'
+import { classify } from './supportedBranches.ts'
 
 /**
  * Reminders to post as a non-blocking review when a pull request touches

ci/github-script/reminders/docs-styleguide.md

@@ -1,6 +1,6 @@
 Thanks for contributing to the documentation
 
-Make sure you follow the [documentation styleguide](https://github.com/NixOS/nixpkgs/blob/master/doc/styleguide.md), most notably:
+Make sure you follow the [documentation style guide](https://github.com/NixOS/nixpkgs/blob/master/doc/styleguide.md), most notably:
 
 - Show, don't tell: lead with a minimal working example; explanation follows the code.
 - No meta-commentary: don't write "This section explains how to…", just do it.

ci/github-script/reviews.ts

@@ -13,30 +13,28 @@ const reviewUsers = [
   'manual-edit',
 ]
 
-/**
- * @typedef {InstanceType<typeof import('@actions/github/lib/utils').GitHub>} GitHub
- * @typedef {typeof import('@actions/github').context} Context
- *
- * @typedef {Awaited<ReturnType<GitHub['rest']['pulls']['listReviews']>>['data'][number]} Review
- * @typedef {Review & { user: NonNullable<Review['user']> }} ReviewWithNonNullUser
- */
+type GitHub = InstanceType<typeof import('@actions/github/lib/utils').GitHub>
+type Context = typeof import('@actions/github').context
+type Review = Awaited<
+  ReturnType<GitHub['rest']['pulls']['listReviews']>
+>['data'][number]
+type ReviewWithNonNullUser = Review & { user: NonNullable<Review['user']> }
+
+interface DismissReviewsProps {
+  github: GitHub
+  context: Context
+  core: typeof import('@actions/core')
+  dry: boolean
+  reviewKey?: string
+}
 
-/**
- * @param {{
- *  github: GitHub,
- *  context: Context,
- *  core: typeof import('@actions/core'),
- *  dry: boolean,
- *  reviewKey?: string,
- * }} DismissReviewsProps
- */
 export async function dismissReviews({
   github,
   context,
   core,
   dry,
   reviewKey,
-}) {
+}: DismissReviewsProps) {
   const pull_number = context.payload.pull_request?.number
   if (!pull_number) {
     core.warning('dismissReviews called outside of pull_request context')
@@ -47,23 +45,29 @@ export async function dismissReviews({
     return
   }
 
-  const allReviews = await github.paginate(github.rest.pulls.listReviews, {
-    ...context.repo,
-    pull_number,
-  })
+  const allReviews: Review[] = await github.paginate(
+    github.rest.pulls.listReviews,
+    {
+      ...context.repo,
+      pull_number,
+    },
+  )
 
-  const reviews = /** @type {ReviewWithNonNullUser[]} */ (
-    allReviews.filter(
+  const reviews = allReviews
+    .filter((review): review is ReviewWithNonNullUser => !!review.user)
+    .filter(
       (review) =>
-        review.user &&
         review.state !== 'DISMISSED' &&
         review.user.login.endsWith('[bot]') &&
         reviewUsers.some((substr) => review.user?.login.includes(substr)),
     )
-  )
 
   const reviewsByUser = reviews.reduce(
     (prev, curr) => {
+      if (!curr.user) {
+        return prev
+      }
+
       if (!(curr.user.login in prev)) {
         prev[curr.user.login] = []
       }
@@ -72,7 +76,7 @@ export async function dismissReviews({
 
       return prev
     },
-    /** @type {Record<string, ReviewWithNonNullUser[]> } */ ({}),
+    {} as Record<string, ReviewWithNonNullUser[]>,
   )
 
   const commentRegex = new RegExp(
@@ -86,8 +90,8 @@ export async function dismissReviews({
   )
 
   let reviewsToMinimize = reviews
-  const /** @type {ReviewWithNonNullUser[]} */ reviewsToDismiss = []
-  const /** @type {ReviewWithNonNullUser[]} */ reviewsToResolve = []
+  const reviewsToDismiss: ReviewWithNonNullUser[] = []
+  const reviewsToResolve: ReviewWithNonNullUser[] = []
 
   if (reviewKey && reviews.every((review) => commentRegex.test(review.body))) {
     reviewsToMinimize = reviews.filter((review) =>
@@ -165,17 +169,16 @@ export async function dismissReviews({
   ])
 }
 
-/**
- * @param {{
- *  github: GitHub,
- *  context: Context,
- *  core: typeof import('@actions/core'),
- *  dry: boolean,
- *  body: string,
- *  event: keyof typeof eventToState,
- *  reviewKey: string,
- * }} PostReviewProps
- */
+interface PostReviewProps {
+  github: GitHub
+  context: Context
+  core: typeof import('@actions/core')
+  dry: boolean
+  body: string
+  event: keyof typeof eventToState
+  reviewKey: string
+}
+
 export async function postReview({
   github,
   context,
@@ -184,7 +187,7 @@ export async function postReview({
   body,
   event = 'REQUEST_CHANGES',
   reviewKey,
-}) {
+}: PostReviewProps) {
   const pull_number = context.payload.pull_request?.number
   if (!pull_number) {
     core.warning('postReview called outside of pull_request context')
@@ -210,8 +213,7 @@ export async function postReview({
       reviewUsers.some((substr) => review.user?.login.includes(substr)),
   )
 
-  /** @type {null | Review} */
-  let pendingReview
+  let pendingReview: null | Review
   const matchingReviews = reviews.filter((review) =>
     reviewKeyRegex.test(review.body),
   )

ci/github-script/run

@@ -101,7 +101,7 @@ program
   .argument('<repo>', 'Name of the GitHub repository to run on (Example: nixpkgs)')
   .argument('<pr>', 'Number of the Pull Request to run on')
   .action(async (owner, repo, pr, options) => {
-    const checkCommitMessages = (await import('./lint-commits.js')).default
+    const checkCommitMessages = (await import('./lint-commits.ts')).default
     await run(checkCommitMessages, owner, repo, pr, options)
   })
 

ci/github-script/supportedBranches.ts

@@ -2,11 +2,12 @@
 /*
 #!nix-shell -i node -p nodejs
 */
-// @ts-nocheck
 import { resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
-const typeConfig = {
+type BranchType = 'channel' | 'development' | 'primary' | 'secondary'
+
+const typeConfig: Record<string, BranchType[]> = {
   master: ['development', 'primary'],
   release: ['development', 'primary'],
   staging: ['development', 'secondary'],
@@ -19,7 +20,7 @@ const typeConfig = {
 
 // "order" ranks the development branches by how likely they are the intended base branch
 // when they are an otherwise equally good fit according to ci/github-script/prepare.js.
-const orderConfig = {
+const orderConfig: Record<string, number> = {
   master: 0,
   release: 1,
   staging: 2,
@@ -28,15 +29,30 @@ const orderConfig = {
   'staging-next': 4,
 }
 
-function split(branch) {
-  return {
-    ...branch.match(
-      /(?<prefix>.+?)(-(?<version>\d{2}\.\d{2}|unstable)(?:-(?<suffix>.*))?)?$/,
-    ).groups,
-  }
+type Digit = 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9
+type Version = `${Digit}${Digit}.${Digit}${Digit}` | 'unstable'
+interface SplitResult {
+  prefix: string
+  version: Version
+  suffix?: string
 }
 
-function classify(branch) {
+function split(branch: string) {
+  const groups = branch.match(
+    /(?<prefix>.+?)(-(?<version>\d{2}\.\d{2}|unstable)(?:-(?<suffix>.*))?)?$/,
+  )!.groups!
+  return groups as unknown as SplitResult
+}
+
+interface BranchClassification {
+  branch: string
+  order: number
+  stable: boolean
+  type: BranchType[]
+  version: Version
+}
+
+function classify(branch: string): BranchClassification {
   const { prefix, version } = split(branch)
   return {
     branch,
@@ -55,7 +71,7 @@ if (
   fileURLToPath(import.meta.url) === resolve(process.argv[1])
 ) {
   console.log('split(branch)')
-  function testSplit(branch) {
+  function testSplit(branch: string) {
     console.log(branch, split(branch))
   }
   testSplit('master')
@@ -72,7 +88,7 @@ if (
   console.log('')
 
   console.log('classify(branch)')
-  function testClassify(branch) {
+  function testClassify(branch: string) {
     console.log(branch, classify(branch))
   }
   testClassify('master')

ci/github-script/supportedSystems.js

@@ -1,11 +0,0 @@
-// @ts-nocheck
-export default async ({ github, context, targetSha }) => {
-  const { content, encoding } = (
-    await github.rest.repos.getContent({
-      ...context.repo,
-      path: 'pkgs/top-level/release-supported-systems.json',
-      ref: targetSha,
-    })
-  ).data
-  return JSON.parse(Buffer.from(content, encoding).toString())
-}

ci/github-script/supportedSystems.ts

@@ -0,0 +1,30 @@
+interface SupportedSystemsProps {
+  github: InstanceType<typeof import('@actions/github/lib/utils').GitHub>
+  context: typeof import('@actions/github').context
+  targetSha: string
+}
+
+export default async ({
+  github,
+  context,
+  targetSha,
+}: SupportedSystemsProps) => {
+  const contentObject = (
+    await github.rest.repos.getContent({
+      ...context.repo,
+      path: 'pkgs/top-level/release-supported-systems.json',
+      ref: targetSha,
+    })
+  ).data
+
+  if ('type' in contentObject && contentObject.type === 'file') {
+    const { content, encoding } = contentObject
+    return JSON.parse(
+      Buffer.from(content, encoding as BufferEncoding).toString(),
+    )
+  } else {
+    throw new Error(
+      'Fetched pkgs/top-level/release-supported-systems.json is not a file',
+    )
+  }
+}

doc/README.md

@@ -7,19 +7,26 @@ This directory houses the source files for the Nixpkgs manual.
 > We are actively restructuring our documentation to be more beginner friendly.
 >
 
-When writing new docs use **Progressive Disclosure**
+When writing new docs use **Progressive Disclosure:**
 
-Start simple, pick up beginners.
-Use **examples** first to show how to get something done. Keep **Explanation** lean.
+- Start simple, pick up beginners.
+- Use **examples** first to show how to get something done.
+- Keep **explanation** lean.
 
-Use our [styleguide](./styleguide.md) for more in depth guidance on writing good documentation.
+Use our [style guide](./styleguide.md) for more in depth guidance on writing good documentation.
 
-Documentation about Nixpkgs belongs here, this includes 'getting-started'-guides and 'onboarding-guides' for *using* Nixpkgs and the language frameworks it ships.
+Documentation about Nixpkgs belongs here.
+This includes getting started guides and onboarding guides for *using* Nixpkgs and the language frameworks it ships.
 
 Write **guides** task-first: lead with a working example, then explain in prose.
 Write **reference** as the specification of functions and attributes.
 
-We are actively working to generate reference documentation from the [doc-comments](https://github.com/NixOS/rfcs/blob/master/rfcs/0145-doc-strings.md) present in code, which also lets you view it locally with `:doc` in `nix repl`.
+We are actively working to generate reference documentation from the [doc-comments](https://github.com/NixOS/rfcs/blob/master/rfcs/0145-doc-strings.md) present in code, which also lets you view it locally with the `:doc` command in `nix repl`, e.g.:
+
+```
+nix-repl> :l <nixpkgs>
+nix-repl> :doc lib.mapAttrsToList
+```
 
 See [Document structure](#document-structure) for a structural template.
 
@@ -42,23 +49,23 @@ If the build succeeds, the manual will be in `./result/share/doc/nixpkgs/manual.
 
 ### Development environment
 
-To reduce repetition, consider using tools from the provided development environment:
-
-Load it from the Nixpkgs documentation directory with
+To reduce repetition, consider using tools from the documentation development environment:
 
 ```ShellSession
 $ cd /path/to/nixpkgs/doc
 $ nix-shell
 ```
 
-To load the development utilities automatically when entering that directory, [set up `nix-direnv`](https://nix.dev/guides/recipes/direnv).
+To load the documentation development environment automatically when entering that directory:
 
-Make sure that your local files aren't added to Git history by adding the following lines to `.git/info/exclude` at the root of the Nixpkgs repository:
+1. Install [`nix-direnv`](https://search.nixos.org/packages?channel=unstable&query=nix-direnv#show=nix-direnv)
+1. Set up direnv in the documentation directory:
 
-```
-/**/.envrc
-/**/.direnv
-```
+   ```ShellSession
+   $ cd doc
+   $ echo "use nix" > .envrc
+   $ direnv allow
+   ```
 
 #### Live preview
 
@@ -215,7 +222,7 @@ When needed, each convention explains why it exists, so you can make a decision
 Note that these conventions are about the **structure** of the manual (and its source files), not about the content that goes in it.
 You, as the writer of documentation, are still in charge of its content.
 
-**For prose style, see the [documentation styleguide](./styleguide.md).**
+**For prose style, see the [documentation style guide](./styleguide.md).**
 
 ### Document structure
 
@@ -285,7 +292,7 @@ When changing existing content, update formatting if possible, but avoid excessi
 
 ### Examples first
 
-Put examples before detailed explanations (see the [styleguide](./styleguide.md) for the rationale).
+Put examples before detailed explanations (see the [style guide](./styleguide.md) for the rationale).
 
 Use this structure for each documented item:
 

doc/getting-started/dev-environments.md

@@ -5,7 +5,7 @@ Create a `shell.nix` with the following:
 ```nix
 # shell.nix
 let
-  nixpkgs = fetchTarball "https://github.com/NixOS/nixpkgs/archive/nixos-unstable.tar.gz";
+  nixpkgs = fetchTarball "https://channels.nixos.org/nixos-unstable/nixexprs.tar.zst";
   pkgs = import nixpkgs { };
 in
 pkgs.mkShell {
@@ -25,7 +25,7 @@ nix-shell
 This activates your `shell.nix` and you should see:
 
 ```sh
-unpacking 'https://github.com/NixOS/nixpkgs/archive/nixos-unstable.tar.gz' into the Git cache...
+unpacking 'https://channels.nixos.org/nixos-unstable/nixexprs.tar.zst' into the Git cache...
 Welcome in your nix shell
 ```
 

doc/getting-started/first-package.chapter.md

@@ -53,7 +53,7 @@ Pin Nixpkgs and call the package from `default.nix`:
 ```nix
 # default.nix
 let
-  nixpkgs = fetchTarball "https://github.com/NixOS/nixpkgs/archive/nixos-unstable.tar.gz";
+  nixpkgs = fetchTarball "https://channels.nixos.org/nixos-unstable/nixexprs.tar.zst";
   pkgs = import nixpkgs { };
 in
 pkgs.callPackage ./package.nix { }

doc/hooks/check-phase-thread-limit-hook.section.md

@@ -3,7 +3,7 @@
 This hook defaults a variety of environment variables known
 to control thread counts to 1. Many of these otherwise default
 to `$(nproc)`, which causes massive overloads on build machines
-if nix build jobs and build cores are already tuned to fully utilize
+if nix build jobs and build cores are already tuned to fully use
 compute capacity of a builder without additional parallelism.
 
 Currently sets the following environment variables:

doc/languages-frameworks/cosmic.section.md

@@ -5,7 +5,7 @@
 COSMIC (Computer Operating System Main Interface Components) is a desktop environment developed by
 System76, primarily for the Pop!_OS Linux distribution. Applications in the COSMIC ecosystem are
 written in Rust and use libcosmic, which builds on the Iced GUI framework. This section explains
-how to properly package and integrate COSMIC applications within Nix.
+how to package and integrate COSMIC applications within Nix.
 
 ### libcosmicAppHook {#ssec-cosmic-libcosmic-app-hook}
 
@@ -17,7 +17,7 @@ and wrapping applications based on libcosmic. It handles many common requirement
 - Managing Vergen environment variables for build-time information
 - Setting up Rust linker flags for specific libraries
 
-To use the hook, simply add it to your package's `nativeBuildInputs`:
+Add the hook to your package's `nativeBuildInputs`:
 
 ```nix
 {
@@ -61,8 +61,9 @@ rustPlatform.buildRustPackage {
 }
 ```
 
-Note that `cosmic-settings` is a separate application and not a part of the libcosmic settings
-system itself. It's included by default in `libcosmicAppHook` only to provide these fallback theme
+> [!Note]
+> `cosmic-settings` is a separate application and not a part of the libcosmic settings
+> system itself. It's included by default in `libcosmicAppHook` only to provide these fallback theme
 settings.
 
 ### Icons {#ssec-cosmic-icons}

doc/languages-frameworks/neovim.section.md

@@ -63,7 +63,7 @@ For instance, `sqlite-lua` needs `g:sqlite_clib_path` to be set to work. Nixpkgs
 - `wrapperArgs`: Extra arguments forwarded to the `makeWrapper` call.
 - `wrapRc`: Nix, not being able to write in your `$HOME`, loads the
   generated Neovim configuration via the `$VIMINIT` environment variable, i.e. : `export VIMINIT='lua dofile("/nix/store/…-init.lua")'`. This has side effects like preventing Neovim from sourcing your `init.lua` in `$XDG_CONFIG_HOME/nvim` (see bullet 7 of [`:help startup`](https://neovim.io/doc/user/starting.html#startup) in Neovim). Disable it if you want to generate your own wrapper. You can still reuse the generated vimscript init code via `neovim.passthru.initRc`.
-- `plugins`: A list of plugins to add to the wrapper.
+- `plugins`: A list of plugins to add to the wrapper. If a plugin is not available in nixpkgs, you can [package it yourself](#what-if-your-favourite-vim-plugin-isnt-already-packaged).
 - `extraLuaPackages`: A function passed on to `lua.withPackages`.
 - `extraPython3Packages`: A function passed on to `python3.withPackages`.
 - `withPython3`, `withNodeJs`, `withRuby`, `withPerl` control when to enable neovim

doc/release-notes/rl-2611.section.md

@@ -117,6 +117,9 @@
 
 - `himalaya` has been updated from `v1.2.0` to `v2.0.0`, which introduces breaking changes. See the [release notes](https://github.com/pimalaya/himalaya/releases/tag/v2.0.0) and the [migration guide](https://github.com/pimalaya/himalaya/blob/master/MIGRATION.md).
 
+- `proton-cli` has been updated from `2.2.3` to `3.4.0`, and installs its command as `proton`, with `proton-cli` kept beside it as a symlink.
+  `3.0.0` reworked the command line - `--output` is now the response format, secrets are no longer accepted as flag values, and several subcommands moved - so scripts need a review against the [upstream changelog](https://github.com/roman-16/proton-cli/blob/main/CHANGELOG.md).
+
 - `tengine` has been removed as it has seen seriously delayed responses to security vulnerabilities.
 
 - `jellyfin` has been upgraded to major version 12, which contains breaking changes. See the [upstream blog post](https://jellyfin.org/posts/jellyfin-release-12.0) for more information on how to safely upgrade.

doc/styleguide.md

@@ -1,4 +1,4 @@
-# Styleguide
+# Style guide
 
 Use this page as a reference and style guide for our internal and external documentation.
 
@@ -90,11 +90,13 @@ Don't describe what the documentation does. Just do it.
 **Don't:**
 
 > This section explains how to configure networking.
+
 > The following guide walks you through setting up a web server.
 
 **Do:**
 
 > Configure networking by setting:
+
 > Set up a web server:
 
 ### Code Examples

doc/toolchains/llvm.chapter.md

@@ -22,7 +22,7 @@ import <nixpkgs> {
 }
 ```
 
-Note that we set `linker` to `lld`. This is because LLVM has its own linker, called "lld". By setting it, we utilize Clang and lld within this new instance of Nixpkgs. There is a shorthand method for building everything with LLVM: `pkgsLLVM`. This is easier to use with `nix-build` (or `nix build`):
+Note that we set `linker` to `lld`. This is because LLVM has its own linker, called "lld". By setting it, we use Clang and lld within this new instance of Nixpkgs. There is a shorthand method for building everything with LLVM: `pkgsLLVM`. This is easier to use with `nix-build` (or `nix build`):
 
 ```bash
 nix-build -A pkgsLLVM.hello

doc/using/configuration.chapter.md

@@ -105,27 +105,48 @@ There are several ways to tweak how Nix handles a package which has been marked
     $ export NIXPKGS_ALLOW_UNFREE=1
     ```
 
--   It is possible to permanently allow individual unfree packages, while still blocking unfree packages by default using the `allowUnfreePredicate` configuration option in the user configuration file.
-
-    This option is a function which accepts a package as a parameter, and returns a boolean. The following example configuration accepts a package and always returns false:
-
-    ```nix
-    { allowUnfreePredicate = (pkg: false); }
-    ```
-
-    For a more useful example, try the following. This configuration only allows unfree packages named roon-server and Visual Studio Code:
+-   To allow specific unfree packages, add their names to your Nixpkgs configuration file:
 
     ```nix
     {
-      allowUnfreePredicate =
-        pkg:
-        builtins.elem (lib.getName pkg) [
-          "roon-server"
-          "vscode"
-        ];
+      allowUnfreePackages = [
+        "fence"
+        "roon-server"
+        "vscode"
+      ];
     }
     ```
 
+    `allowUnfreePackages` permits the listed unfree packages.
+
+    In NixOS modules, lists set through `nixpkgs.config.allowUnfreePackages` merge additively across modules. This allows you to declare your unfree exceptions in the same modules that triggered them.
+
+    To allow unfree packages programmatically:
+
+    ```nix
+    { lib, ... }:
+    {
+      allowUnfreePredicate = pkg: lib.hasPrefix "roon" (lib.getName pkg);
+    }
+    ```
+
+    This permits packages such as `roon-bridge` and `roon-server`.
+
+    To combine the list and predicate, set both options:
+
+    ```nix
+    { lib, ... }:
+    {
+      allowUnfreePackages = [
+        "fence"
+        "vscode"
+      ];
+      allowUnfreePredicate = pkg: lib.hasPrefix "roon" (lib.getName pkg);
+    }
+    ```
+
+    This permits unfree packages that match either option.
+
 -   It is also possible to allow and block licenses that are specifically acceptable or not acceptable, using `allowlistedLicenses` and `blocklistedLicenses`, respectively.
 
     The following example configuration allowlists the licenses `amd` and `wtfpl`:

lib/modules.nix

@@ -1595,17 +1595,76 @@ let
   */
   mkDefinition = args@{ file, value, ... }: args // { _type = "definition"; };
 
+  /**
+    Labels a definition with a priority.
+    See the documentation of `filterOverrides` for the interpretation of the priority value.
+    Nesting this function usually leads to an invalid definition.
+    `mkDefault`, `mkOptionDefault`, and `mkForce` partially apply `mkOverride` with common priorities used in the NixOS module system.
+
+    # Inputs
+
+    `priority`
+
+    : A numeric value representing the precedence.
+      See the documentation of `filterOverrides` for the interpretation of this value.
+
+    `content`
+
+    : The definition to be labeled with a given priority.
+
+    # Examples
+    :::{.example}
+    ## `lib.modules.mkOverride` usage example
+
+    ```nix
+    mkOverride 1000 "hello, world!"
+    => { _type = "override"; content = "hello, world!"; priority = 1000; }
+    ```
+
+    ```nix
+    (lib.evalModules {
+      modules = [
+        { options.foo = lib.mkOption { }; }
+        { config.foo = lib.mkOverride 20 1; }
+        { config.foo = lib.mkOverride 10 2; }
+      ];
+    }).config
+    => { foo = 2; }
+    ```
+    :::
+  */
   mkOverride = priority: content: {
     _type = "override";
     inherit priority content;
   };
 
-  mkOptionDefault = mkOverride 1500; # priority of option defaults
-  mkDefault = mkOverride 1000; # used in config sections of non-user modules to set a default
+  /**
+    Labels a definition with the priority of option declaration defaults.
+  */
+  mkOptionDefault = mkOverride 1500;
+
+  /**
+    Labels a definition with the priority used in config sections of non-user modules to set a default.
+  */
+  mkDefault = mkOverride 1000;
+
   defaultOverridePriority = 100;
-  mkImageMediaOverride = mkOverride 60; # image media profiles can be derived by inclusion into host config, hence needing to override host config, but do allow user to mkForce
+
+  /**
+    Labels a definition with the priority used in image media profiles.
+    Image media profiles can be derived by inclusion into host config, hence needing to override host config, but do allow users to `mkForce`.
+  */
+  mkImageMediaOverride = mkOverride 60;
+
+  /**
+    Labels a definition with a high priority (low value).
+  */
   mkForce = mkOverride 50;
-  mkVMOverride = mkOverride 10; # used by ‘nixos-rebuild build-vm’
+
+  /**
+    Labels a definition with used by {command}`nixos-rebuild build-vm`.
+  */
+  mkVMOverride = mkOverride 10;
 
   mkFixStrictness = warn "lib.mkFixStrictness has no effect and will be removed. It returns its argument unmodified, so you can just remove any calls." id;
 

maintainers/maintainer-list.nix

@@ -460,6 +460,7 @@
     name = "aaravrav";
     github = "aaravrav";
     githubId = 37036762;
+    matrix = "@hepara:matrix.org";
   };
   aarnphm = {
     email = "contact@aarnphm.xyz";
@@ -11513,6 +11514,13 @@
     githubId = 58676303;
     name = "hhydraa";
   };
+  hideyosh1 = {
+    email = "penelope.zhong@proton.me";
+    keys = [ { fingerprint = "01E9 0D3E 815F 84CA 1003  E7D7 2F75 2D18 C2C1 7AF8"; } ];
+    name = "Penelope Zhong";
+    github = "hideyosh1";
+    githubId = 64223175;
+  };
   higebu = {
     name = "Yuya Kusakabe";
     email = "yuya.kusakabe@gmail.com";
@@ -20094,6 +20102,12 @@
     githubId = 52401682;
     name = "myul";
   };
+  Myxogastria0808 = {
+    email = "r.rstudio.c@gmail.com";
+    github = "Myxogastria0808";
+    githubId = 78744619;
+    name = "Yuki Osada";
+  };
   myypo = {
     email = "nikirsmcgl@gmail.com";
     github = "myypo";

maintainers/team-list.nix

@@ -108,7 +108,6 @@ with lib.maintainers;
     members = [
       lopsided98
       mic92
-      zowoq
     ];
     scope = "Maintain Buildbot CI framework";
     shortName = "Buildbot";

nixos/modules/security/account-utils.nix

@@ -51,7 +51,10 @@ in
       sockets.pwupdd.wantedBy = lib.optional config.users.mutableUsers "sockets.target"; # immutable users do not need password updating
       sockets.newidmapd.wantedBy = [ "sockets.target" ];
       services."pwupdd@".environment.PWUPDD_OPTS = lib.escapeShellArgs cfg.extraArgs;
-      services."pwaccessd".environment.PWACCESSD_OPTS = lib.escapeShellArgs cfg.extraArgs;
+      services."pwaccessd".environment = {
+        LD_LIBRARY_PATH = config.system.nssModules.path;
+        PWACCESSD_OPTS = lib.escapeShellArgs cfg.extraArgs;
+      };
     };
 
     environment.systemPackages = [ cfg.package ];

nixos/modules/services/desktops/accountsservice.nix

@@ -48,6 +48,7 @@
 
           # Accounts daemon looks for dbus interfaces in $XDG_DATA_DIRS/accountsservice
           environment.XDG_DATA_DIRS = "${config.system.path}/share";
+          environment.LD_LIBRARY_PATH = config.system.nssModules.path;
 
         }
         (

nixos/modules/services/networking/fedimintd.nix

@@ -13,7 +13,6 @@ let
     mkEnableOption
     mkIf
     mkOption
-    mkOverride
     mkPackageOption
     nameValuePair
     recursiveUpdate
@@ -351,13 +350,11 @@ in
         fedimintdName: cfg:
         (nameValuePair cfg.nginx.fqdn (
           lib.mkMerge [
-            cfg.nginx.config
+            (lib.mapAttrsRecursive (_: lib.mkDefault) cfg.nginx.config)
 
             {
-              # Note: we want by default to enable OpenSSL, but it seems anything 100 and above is
-              # overridden by default value from vhost-options.nix
-              enableACME = mkOverride 99 true;
-              forceSSL = mkOverride 99 true;
+              enableACME = true;
+              forceSSL = true;
               locations.${cfg.nginx.path_ws} = {
                 proxyPass = "http://127.0.0.1:${toString cfg.api_ws.port}/";
                 proxyWebsockets = true;

nixos/tests/postgresql/wal2json.nix

@@ -22,6 +22,7 @@ let
               wal_level = "logical";
               max_replication_slots = "10";
               max_wal_senders = "10";
+              output_plugin_libraries = "wal2json";
             };
           };
         };

pkgs/applications/backup/timeshift/unwrapped.nix

@@ -18,7 +18,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "timeshift";
-  version = "25.12.4";
+  version = "26.09.0";
   outputs = [
     "out"
     "man"
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "linuxmint";
     repo = "timeshift";
     tag = finalAttrs.version;
-    hash = "sha256-4iK9RngcqwR0sYo9AXcTwEQ1eoPQPbAmwM5k/rcgU9s=";
+    hash = "sha256-mMG3rMC4wH8bpwfEntEJfFhn8gXoZf7iLraxTysttQ8=";
   };
 
   postPatch = ''

pkgs/applications/emulators/wine/sources.nix

@@ -151,9 +151,9 @@ rec {
 
   unstable = fetchurl rec {
     # NOTE: Don't forget to change the hash for staging as well.
-    version = "11.16";
+    version = "11.18";
     url = "https://dl.winehq.org/wine/source/11.x/wine-${version}.tar.xz";
-    hash = "sha256-xm4gkDQ9zXJ/f3/S+H7gv7CxGHkMHXRat7ikw6QZfy8=";
+    hash = "sha256-xigvbU2uzxHzq5+aK2xZj2e+fijDY7osroo8RLYR56Q=";
 
     patches = [
       # Also look for root certificates at $NIX_SSL_CERT_FILE
@@ -163,7 +163,7 @@ rec {
     # see https://gitlab.winehq.org/wine/wine-staging
     staging = fetchFromGitLab {
       inherit version;
-      hash = "sha256-14VEZMMlWCsStm2AJNO+wBPPO67EGDsQyNiFBBtIcUg=";
+      hash = "sha256-KZCkra0y3XFNrbD2lZ+YUCLyq1POC30Sd4sGCJZuwgQ=";
       domain = "gitlab.winehq.org";
       owner = "wine";
       repo = "wine-staging";

pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix

@@ -29,6 +29,10 @@ buildMozillaMach rec {
     maxSilent = 14400; # 4h, double the default of 7200s (c.f. #129212, #129115)
     license = lib.licenses.mpl20;
     mainProgram = binaryName;
+    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "mozilla" version // {
+      product = "firefox";
+      sw_edition = "beta";
+    };
   };
   tests = {
     inherit (nixosTests) firefox-beta;

pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix

@@ -42,6 +42,11 @@
     maxSilent = 14400; # 4h, double the default of 7200s (c.f. #129212, #129115)
     license = lib.licenses.mpl20;
     mainProgram = binaryName;
+    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "mozilla" version // {
+      product = "firefox";
+      sw_edition = "devedition";
+    };
+
   };
   tests = {
     inherit (nixosTests) firefox-devedition;

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -851,11 +851,11 @@
     "vendorHash": "sha256-BFhxDYfbHNY4omovikg01UDqt2oxCtg9Q85DPuHSUeE="
   },
   "launchdarkly_launchdarkly": {
-    "hash": "sha256-DVpsm3adZEwWzgvIFu8pXUGVTch18oW4UdXPQ8XZZb0=",
+    "hash": "sha256-4n7QRhQd/9juZ+qdO3G9Qs+uwokmia82/xJ254A+9q0=",
     "homepage": "https://registry.terraform.io/providers/launchdarkly/launchdarkly",
     "owner": "launchdarkly",
     "repo": "terraform-provider-launchdarkly",
-    "rev": "v3.1.5",
+    "rev": "v3.1.6",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-d8RQfuLRNGTUzA2Ygy3QEis5j5Ape5kmcnZSs77c84M="
   },

pkgs/applications/networking/instant-messengers/jackline/default.nix

@@ -8,7 +8,7 @@ with ocamlPackages;
 
 buildDunePackage {
   pname = "jackline";
-  version = "unstable-2024-10-21";
+  version = "0.1.0-unstable-2024-10-21";
 
   minimalOCamlVersion = "4.13";
 

pkgs/by-name/ai/aiken/package.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "aiken";
-  version = "1.1.23";
+  version = "1.1.24";
 
   src = fetchFromGitHub {
     owner = "aiken-lang";
     repo = "aiken";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9CPwIqUoOih4711vSEeV3AX1T1GGQ/AeYj7HnWI5UO8=";
+    hash = "sha256-yG96JwZ/H4/MrLkrmsResRg3HGUfh1Kz3kA6qv0Y62c=";
   };
 
-  cargoHash = "sha256-98oyeVo3z49DGikhSBMB7QSiz6+I7GkvqJIpOusuEz4=";
+  cargoHash = "sha256-BDe1GQtKzE2fyKPDdOEriF4wUxONe/jLfnyHiF/dUh4=";
 
   buildInputs = [ openssl ];
 

pkgs/by-name/ap/appium-inspector/package.nix

@@ -2,7 +2,7 @@
   lib,
   buildNpmPackage,
   copyDesktopItems,
-  electron_43,
+  electron_44,
   fetchFromGitHub,
   makeDesktopItem,
   makeWrapper,
@@ -14,21 +14,21 @@
 }:
 
 let
-  electron = electron_43;
+  electron = electron_44;
 in
 
 buildNpmPackage (finalAttrs: {
   pname = "appium-inspector";
-  version = "2026.7.1";
+  version = "2026.9.2";
 
   src = fetchFromGitHub {
     owner = "appium";
     repo = "appium-inspector";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7pxXlY/aifrg4cuGZSgxONF+RPL8P7JcZ6Gobqv2nz4=";
+    hash = "sha256-ePHLOHEXaigZwoCrZG18K7oYVeFEg3ZhZIKJJHyFQe8=";
   };
 
-  npmDepsHash = "sha256-W9FWIHhtS2d9xBpIEGB8sWmDfcdyphL+0eCk1+8pu2s=";
+  npmDepsHash = "sha256-MvDKtSx/1w3s8NjQczEzvxSE6SmJrWb5CUpPYhSX7Ts=";
   npmFlags = [ "--ignore-scripts" ];
 
   nativeBuildInputs = [

pkgs/by-name/ar/ariang-native/package.nix

@@ -0,0 +1,76 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+  nix-update-script,
+  copyDesktopItems,
+  icoutils,
+  makeWrapper,
+  makeDesktopItem,
+  electron,
+}:
+
+buildNpmPackage (finalAttrs: {
+  pname = "ariang-native";
+  version = "1.3.14";
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "mayswind";
+    repo = "AriaNg-Native";
+    tag = finalAttrs.version;
+    hash = "sha256-ByQPAZVQEqqjD7th0wq06NdOsAR7YchWpV3LHu4QzTk=";
+  };
+
+  dontNpmBuild = true;
+  npmDepsFetcherVersion = 2;
+  npmDepsHash = "sha256-mTu/QcsPq7YoUSuKtS34P+y38oIoB3zyuDL9ELQDoBQ=";
+  npmFlags = [ "--ignore-scripts" ];
+
+  nativeBuildInputs = [
+    copyDesktopItems
+    icoutils
+    makeWrapper
+  ];
+
+  desktopItems = with finalAttrs; [
+    (makeDesktopItem {
+      name = pname;
+      desktopName = "AriaNg Native";
+      genericName = meta.description;
+      comment = meta.description;
+      icon = pname;
+      exec = "${pname} %U";
+      mimeTypes = [ "x-scheme-handler/magnet" ];
+      categories = [ "Network" ];
+      startupWMClass = pname;
+    })
+  ];
+
+  postInstall = with finalAttrs; ''
+    # Create desktop icons
+    icotool -x assets/AriaNg.ico
+    ls *.png | sort -V | while read -r file; do
+      size=$(echo "$file" | awk -F '_' '{print $3}' | cut -d 'x' -f 1)
+      mkdir -p "$out/share/icons/hicolor/''${size}x''${size}/apps"
+      mv "$file" "$out/share/icons/hicolor/''${size}x''${size}/apps/${pname}.png"
+    done
+
+    makeWrapper ${lib.getExe electron} $out/bin/${pname} \
+      --inherit-argv0 \
+      --add-flags "$out/lib/node_modules/${pname}"
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Aria2 desktop frontend based on AriaNg with additional desktop features";
+    homepage = "https://github.com/mayswind/AriaNg-Native";
+    changelog = "https://github.com/mayswind/AriaNg-Native/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ProxyVT ];
+    mainProgram = finalAttrs.pname;
+    platforms = lib.platforms.linux;
+  };
+})

pkgs/by-name/bi/bitbake-setup/package.nix

@@ -0,0 +1,63 @@
+{
+  lib,
+  python3Packages,
+  fetchPypi,
+
+  git,
+
+  nix-update-script,
+  versionCheckHook,
+}:
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "bitbake-setup";
+  version = "2.19.0";
+  format = "wheel";
+
+  __structuredAttrs = true;
+
+  src = fetchPypi {
+    pname = "bitbake_setup";
+    inherit (finalAttrs) version;
+    format = "wheel";
+    dist = "py3";
+    python = "py3";
+    hash = "sha256-tq53r8I02HL4mTgnIxcVf4VTYhRngYgl232/cDgLzdI=";
+  };
+
+  makeWrapperArgs = [
+    "--prefix"
+    "PATH"
+    ":"
+    (lib.makeBinPath [ git ])
+  ];
+
+  pythonImportsCheck = [ "bitbake_setup" ];
+
+  versionCheckProgramArg = "--version";
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--url"
+      "mirror://pypi/b/bitbake_setup/"
+    ];
+  };
+
+  meta = {
+    description = "Command that sets up a BitBake build environment from a published configuration";
+    homepage = "https://git.openembedded.org/bitbake/";
+    downloadPage = "https://pypi.org/project/bitbake-setup/";
+    license = with lib.licenses; [
+      gpl2Only
+      mit
+      psfl
+      zlib
+      lgpl21Plus
+      bsd3Clear
+    ];
+    mainProgram = "bitbake-setup";
+    maintainers = with lib.maintainers; [ otavio ];
+    platforms = lib.platforms.linux;
+  };
+})

pkgs/by-name/ca/cargo-generate/package.nix

@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-generate";
-  version = "0.23.9";
+  version = "0.25.0";
 
   src = fetchFromGitHub {
     owner = "cargo-generate";
     repo = "cargo-generate";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-myakseKwLEjQa9GgcxdWZJWdjMFXh7Wi64CwrN2ZwSU=";
+    hash = "sha256-x0UkYgYJ1xe6ensm3yU5SEW+nnxHmnN+CbGCJXth8WQ=";
   };
 
-  cargoHash = "sha256-IAUgpk3HD9znLORCQKNw+AO6NG9GEVWMU/cez3B+CKc=";
+  cargoHash = "sha256-cXPks2uTUVnVyBXP9JT5Xm87pFkCvPHQy86R7vd2/zU=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/ca/catt/package.nix

@@ -7,7 +7,7 @@
 }:
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "catt";
-  version = "0.13.2";
+  version = "0.13.3";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -15,7 +15,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "skorokithakis";
     repo = "catt";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VjwYfaBoQ7HMKG6BztAB3mmQps42MoHSAiC2jHbRS/Q=";
+    hash = "sha256-UiO46HNzeO2wg41Zn89bUdl34UeZZmWjekGxxsLgGwQ=";
   };
 
   build-system = [

pkgs/by-name/ch/chatzone-desktop/package.nix

@@ -30,7 +30,7 @@ stdenvNoCC.mkDerivation {
   desktopItems = [
     (makeDesktopItem {
       name = "chatzone";
-      exec = "chatzone-desktop";
+      exec = "chatzone-desktop %U";
       icon = "chatzone-desktop";
       terminal = false;
       desktopName = "Chatzone";
@@ -42,7 +42,10 @@ stdenvNoCC.mkDerivation {
         "Chat"
       ];
       startupWMClass = "Chatzone";
-      mimeTypes = [ "x-scheme-handler/mattermost" ];
+      mimeTypes = [
+        "x-scheme-handler/mattermost"
+        "x-scheme-handler/chatzone"
+      ];
     })
   ];
 

pkgs/by-name/ch/cheat/package.nix

@@ -1,48 +1,44 @@
 {
+  stdenv,
   lib,
   fetchFromGitHub,
   buildGoModule,
   installShellFiles,
+  git,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "cheat";
-  version = "4.5.0";
+  version = "5.1.0";
 
   src = fetchFromGitHub {
     owner = "cheat";
     repo = "cheat";
     tag = finalAttrs.version;
-    sha256 = "sha256-RDfOdyQL9QICXZmgYCmz532iTuPdCW8GixajvEXmaUQ=";
+    hash = "sha256-0c8NZzzLxssMJffEWBI5L3leWWOU/Y0slPIg6bPKzfI=";
   };
 
-  subPackages = [ "cmd/cheat" ];
-
   nativeBuildInputs = [ installShellFiles ];
 
-  patches = [
-    (builtins.toFile "fix-zsh-completion.patch" ''
-      diff --git a/scripts/cheat.zsh b/scripts/cheat.zsh
-      index befe1b2..675c9f8 100755
-      --- a/scripts/cheat.zsh
-      +++ b/scripts/cheat.zsh
-      @@ -62,4 +62,4 @@ _cheat() {
-         esac
-       }
-
-      -compdef _cheat cheat
-      +_cheat "$@"
-    '')
+  nativeCheckInputs = [
+    git
   ];
 
   postInstall = ''
     installManPage doc/cheat.1
-    installShellCompletion scripts/cheat.{bash,fish,zsh}
+  ''
+  + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd cheat \
+      --bash <($out/bin/cheat --completion bash) \
+      --fish <($out/bin/cheat --completion fish) \
+      --zsh <($out/bin/cheat --completion zsh)
   '';
 
   vendorHash = null;
 
-  doCheck = false;
+  doCheck = true;
+
+  env.EDITOR = "cat";
 
   meta = {
     description = "Create and view interactive cheatsheets on the command-line";

pkgs/by-name/co/cockpit/package.nix

@@ -47,13 +47,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "cockpit";
-  version = "367";
+  version = "368";
 
   src = fetchFromGitHub {
     owner = "cockpit-project";
     repo = "cockpit";
     tag = finalAttrs.version;
-    hash = "sha256-TWB39cnhU9zgr/FP4FfXEzdMEnjXOs/HamYjSXLVadY=";
+    hash = "sha256-2bFQwK5L0S84nLSkUeHmbNgBkjBJIxR88t/21h5jmps=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/da/davs2/package.nix

@@ -66,5 +66,6 @@ stdenv.mkDerivation (finalAttrs: {
     pkgConfigModules = [ "davs2" ];
     maintainers = with lib.maintainers; [ jopejoe1 ];
     platforms = lib.platforms.all;
+    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "davs2_project" finalAttrs.version;
   };
 })

pkgs/by-name/di/discord-canary/package.nix

@@ -0,0 +1,6 @@
+{
+  discord,
+  ...
+}@args:
+
+discord.override ({ pname = "discord-canary"; } // removeAttrs args [ "discord" ])

pkgs/by-name/di/discord-development/package.nix

@@ -0,0 +1,6 @@
+{
+  discord,
+  ...
+}@args:
+
+discord.override ({ pname = "discord-development"; } // removeAttrs args [ "discord" ])

pkgs/by-name/di/discord-ptb/package.nix

@@ -0,0 +1,6 @@
+{
+  discord,
+  ...
+}@args:
+
+discord.override ({ pname = "discord-ptb"; } // removeAttrs args [ "discord" ])

pkgs/by-name/di/discord/metadata.nix

@@ -1,5 +1,4 @@
 {
-  callPackage,
   lib,
   stdenv,
   discord,
@@ -95,13 +94,11 @@ lib.genAttrs [ "discord" "discord-ptb" "discord-canary" "discord-development" ]
     platformName = if stdenv.hostPlatform.isDarwin then "osx" else "linux";
     source = sources."${platformName}-${args.branch}";
   in
-  callPackage ./wrapper.nix (
-    args
-    // {
-      inherit pname source;
-      meta = meta // {
-        mainProgram = args.binaryName;
-      };
-    }
-  )
+  args
+  // {
+    inherit source;
+    meta = meta // {
+      mainProgram = args.binaryName;
+    };
+  }
 )

pkgs/by-name/di/discord/package.nix

@@ -1,12 +1,6 @@
 {
   # Package metadata
-  pname,
-  source,
-  meta,
-  binaryName,
-  desktopName,
-  self,
-  branch,
+  pname ? "discord",
   # Feature flags (cross-platform)
   withOpenASAR ? false,
   withVencord ? false,
@@ -46,7 +40,17 @@
 let
   inherit (stdenv.hostPlatform) isLinux;
 
-  pkgArgs = removeAttrs args [
+  metadata = (callPackage ./metadata.nix { }).${pname};
+  inherit (metadata)
+    source
+    meta
+    binaryName
+    desktopName
+    self
+    branch
+    ;
+
+  pkgArgs = removeAttrs (args // metadata) [
     "branch"
     "self"
     "unwrappedDiscord"

pkgs/by-name/fo/folo/package.nix

@@ -15,13 +15,13 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "folo";
 
-  version = "1.13.0";
+  version = "1.14.0";
 
   src = fetchFromGitHub {
     owner = "RSSNext";
     repo = "Folo";
     tag = "desktop/v${finalAttrs.version}";
-    hash = "sha256-lK371YSqYcYzVjDJCfAbrl+wdAbDzmT6R4SlZXjiZLc=";
+    hash = "sha256-16hKEgTv2pWDsoxMG7Ct2xCvjCnmbPK2bymyutb1uW8=";
   };
 
   nativeBuildInputs = [
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
       ;
     pnpm = pnpm_11;
     fetcherVersion = 4;
-    hash = "sha256-bdqcY+ylviWHnbIvPxwRZimenXWFS5bJfDeFxMtOVM0=";
+    hash = "sha256-6ExELKJr6oAkywYSjsw+c24IHtipJ213N74aSzhEUTs=";
   };
 
   __structuredAttrs = true;

pkgs/by-name/fr/freecad/package.nix

@@ -215,6 +215,8 @@ freecad-utils.makeCustomizable (
       ];
       platforms = lib.platforms.linux;
       mainProgram = "freecad";
+      # repology claims `freecadweb` as vendor, but newer CVEs (e.g. CVE-2026-73235) are listed with freecad/freecad
+      identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "freecad" finalAttrs.version;
     };
   })
 )

pkgs/by-name/gr/graphify/package.nix

@@ -8,14 +8,14 @@
 python3Packages.buildPythonApplication rec {
   __structuredAttrs = true;
   pname = "graphify";
-  version = "0.9.61";
+  version = "0.9.66";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Graphify-Labs";
     repo = "graphify";
     tag = "v${version}";
-    hash = "sha256-9AEbHmqqZv/fBioUMNv60KAb/FpvWpwC6QhGSdBxISs=";
+    hash = "sha256-u6LCj74qI7x0TS972VOL2sYTyhRVBkFy7R+pIycCI4U=";
   };
 
   build-system = [

pkgs/by-name/im/immich/package.nix

@@ -169,6 +169,8 @@ stdenv.mkDerivation (finalAttrs: {
   env.ESBUILD_BINARY_PATH = lib.getExe esbuild';
   # fix for node-gyp, see https://github.com/nodejs/node-gyp/issues/1191#issuecomment-301243919
   env.npm_config_nodedir = nodejs;
+  # Prevent Python (via node-gyp) from writing bytecode to ensure build determinism
+  env.PYTHONDONTWRITEBYTECODE = "1";
 
   buildPhase = ''
     runHook preBuild

pkgs/by-name/in/inspircd/package.nix

@@ -151,13 +151,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "inspircd";
-  version = "4.12.0";
+  version = "4.12.1";
 
   src = fetchFromGitHub {
     owner = "inspircd";
     repo = "inspircd";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-bzhh6fAAHahfVRgy+8HTqGVY+Rzk7MSmKTbaFZBILUY=";
+    sha256 = "sha256-crIxqqBMwu+lYnftlOdZ/jNvOh0vS7Zr0YDMAR8wlfs=";
   };
 
   outputs = [

pkgs/by-name/ke/keycloak/keycloak-magic-link/default.nix

@@ -6,13 +6,13 @@
 }:
 maven.buildMavenPackage (finalAttrs: {
   pname = "keycloak-magic-link";
-  version = "0.75";
+  version = "0.84";
 
   src = fetchFromGitHub {
     owner = "p2-inc";
     repo = "keycloak-magic-link";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-k8+DRkMVhJyifXMdoxS3fPO7LPrfw2rUrZQ/zDBzLVo=";
+    hash = "sha256-t+OACAr9TJvJbjAQZzFbMf33CuhK9s/n+MESPRD4lUU=";
   };
 
   mvnHash = "sha256-nSJvNSgo1gftGYmx0lFXHIeIhpZ+Ph1KvOHz8jF3voE=";

pkgs/by-name/ke/keycloak/keycloak-orgs/default.nix

@@ -6,13 +6,13 @@
 }:
 maven.buildMavenPackage (finalAttrs: {
   pname = "keycloak-orgs";
-  version = "0.180";
+  version = "0.182";
 
   src = fetchFromGitHub {
     owner = "p2-inc";
     repo = "keycloak-orgs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-M9adZ3oNf4ZcPgSVT++66ltznCc2vJM+eOrYrUk9qI4=";
+    hash = "sha256-X+PjAw7L6373Zp2hikxP9+KotqBziUDo/aRuw2gnias=";
   };
 
   mvnHash = "sha256-kU9nmiu/hWJaEfQzdVKC/IIWqZarRPpOqDP/bJQIIEY=";

pkgs/by-name/ke/keycloak/package.nix

@@ -6,6 +6,7 @@
   jre_headless,
   nixosTests,
   callPackage,
+  bash,
   confFile ? null,
   plugins ? [ ],
   extraFeatures ? [ ],
@@ -36,6 +37,10 @@ stdenv.mkDerivation (finalAttrs: {
     jre_headless
   ];
 
+  buildInputs = [
+    bash
+  ];
+
   patches = [
     # Make home.dir and config.dir configurable through the
     # KC_HOME_DIR and KC_CONF_DIR environment variables.
@@ -59,10 +64,9 @@ stdenv.mkDerivation (finalAttrs: {
     ${lib.concatMapStringsSep "\n" (pl: "install_plugin ${lib.escapeShellArg pl}") plugins}
   ''
   + ''
-    patchShebangs bin/kc.sh
     export KC_HOME_DIR=$(pwd)
     export KC_CONF_DIR=$(pwd)/conf
-    bin/kc.sh build ${featuresSubcommand}
+    bash bin/kc.sh build ${featuresSubcommand}
 
     runHook postBuild
   '';

pkgs/by-name/le/leviculum/package.nix

@@ -10,7 +10,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "leviculum";
-  version = "0.8.1";
+  version = "0.9.0";
   __structuredAttrs = true;
 
   src = fetchFromGitea {
@@ -19,10 +19,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     repo = "leviculum";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = false;
-    hash = "sha256-ehAKFOZKgGwQh7V8XC4bphDA1vAQjEZ3Hav1DtW0DfY=";
+    hash = "sha256-mkYhTvareotglj03jRkcIaj0SN2IBFyioDxQN3Wuu+I=";
   };
 
-  cargoHash = "sha256-se+2aqR9S+470MZ1Ghny1dmIqY3MGmVHsOTFiYdFEoA=";
+  cargoHash = "sha256-0LuzJK7I4+WofgSDJZM5ggo5z5TAk7kPJsEjkO7QIHg=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/li/libapparmor/package.nix

@@ -107,5 +107,8 @@ stdenv.mkDerivation (finalAttrs: {
     ];
     maintainers = lib.teams.apparmor.members;
     platforms = lib.platforms.linux;
+    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "canonical" finalAttrs.version // {
+      product = "apparmor";
+    };
   };
 })

pkgs/by-name/li/libff/package.nix

@@ -31,6 +31,11 @@ stdenv.mkDerivation (finalAttrs: {
 
   postPatch = ''
     substituteInPlace CMakeLists.txt --replace "VERSION 2.8" "VERSION 3.10"
+    # CMake >= 4.3 treats install(DIRECTORY "" ...) as a no-op instead of
+    # installing the current source directory, so no headers get installed.
+    # https://gitlab.kitware.com/cmake/cmake/-/issues/27568
+    substituteInPlace libff/CMakeLists.txt \
+      --replace-fail 'DIRECTORY "" DESTINATION "include/libff"' 'DIRECTORY "./" DESTINATION "include/libff"'
   ''
   + lib.optionalString (!enableStatic) ''
     substituteInPlace libff/CMakeLists.txt --replace "STATIC" "SHARED"

pkgs/by-name/li/libinklevel/package.nix

@@ -4,20 +4,22 @@
   fetchurl,
   pkg-config,
   libusb1,
+  libxml2,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libinklevel";
-  version = "0.9.4";
+  version = "0.9.7";
 
   src = fetchurl {
     url = "mirror://sourceforge/libinklevel/libinklevel-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-J0cEaC5v4naO4GGUzdfV55kB7KzA+q+v64i5y5Xbp9Q=";
+    sha256 = "sha256-gZ07tMJXhyLBBXyfPamZoaPrRmKPD+ka61K/zNOIRnU=";
   };
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     libusb1
+    libxml2
   ];
 
   outputs = [

pkgs/by-name/li/librewolf-unwrapped/src.json

@@ -1,11 +1,11 @@
 {
-  "packageVersion": "156.0-1",
+  "packageVersion": "156.0.1-1",
   "source": {
-    "rev": "156.0-1",
-    "hash": "sha256-r5i+lFRxx5pcMcDotl9gIEuRytqyY0/opAYTcljUF4c="
+    "rev": "156.0.1-1",
+    "hash": "sha256-XPHluJoaPEerOw6FRhBCXd/B5Ndrr72MR3fjJaH7xsY="
   },
   "firefox": {
-    "version": "156.0",
-    "hash": "sha512-BGMwSgiYZw0kgRT2b3wjUWauI5fDmJp8h4yW8MWJ+7uh8ch0MtqiJjO5+t2UOUrfHcN/DmfSKwZsde/l7q11zg=="
+    "version": "156.0.1",
+    "hash": "sha512-gKMqeSaLZyIG9Ud8pr/eYgy3QZsnqsCQ4B8G3waZDuC72Bu1xKp4rB0O2yaxM7HG+hHLZSJEXszXDILnGaJNWw=="
   }
 }

pkgs/by-name/li/limine/package.nix

@@ -47,14 +47,14 @@ in
 # as bootloader for various platforms and corresponding binary and helper files.
 stdenv.mkDerivation (finalAttrs: {
   pname = "limine";
-  version = "12.9.0";
+  version = "12.9.1";
 
   # We don't use the Git source but the release tarball, as the source has a
   # `./bootstrap` script performing network access to download resources.
   # Packaging that in Nix is very cumbersome.
   src = fetchurl {
     url = "https://github.com/Limine-Bootloader/Limine/releases/download/v${finalAttrs.version}/limine-${finalAttrs.version}.tar.gz";
-    hash = "sha256-reqSKvO5yBeaRna87Mjk3y8+9yrTaz9K+rRMv18mXjY=";
+    hash = "sha256-7nxJhnDQ0WyJfss5HNg3zTdQgc/TZL0xmNsUTJKqzLQ=";
   };
 
   enableParallelBuilding = true;

pkgs/by-name/li/livekit-cli/package.nix

@@ -10,7 +10,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "livekit-cli";
-  version = "2.18.6";
+  version = "2.18.8";
 
   __structuredAttrs = true;
   __darwinAllowLocalNetworking = true;
@@ -19,10 +19,10 @@ buildGoModule (finalAttrs: {
     owner = "livekit";
     repo = "livekit-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kdvlrRS9sKi84QL1DRsB0gTQoP+J4qYaIAtQUh61goY=";
+    hash = "sha256-IuqgAaaZZblAl8a/rs2xE+zhuY4s3UNND+kmQOq/yPg=";
   };
 
-  vendorHash = "sha256-AF1764F5g7dfo26G0Veoo0D0xiMPDArARR3Osm8htEI=";
+  vendorHash = "sha256-B/woYmWYrdtL+qFDQzvBmyXLEo2HarOjRQlEX/GcPNQ=";
 
   # Use nixpkgs portaudio package + pkg-config rather than relying on a vendored
   # git submodule, similar to the homebrew solution

pkgs/by-name/lm/lmstudio/package.nix

@@ -7,12 +7,12 @@
 let
   pname = "lmstudio";
 
-  version_aarch64-linux = "0.4.23-1";
-  hash_aarch64-linux = "sha256-MzPygFB0StS8KTuZWq0AR+ZtiQIJ353QHlgpddOa19Y=";
-  version_aarch64-darwin = "0.4.23-1";
-  hash_aarch64-darwin = "sha256-9FD1ENl1YIpF+/VM2JKRXChQZswHy/NEHX3bC6Mynw4=";
-  version_x86_64-linux = "0.4.23-1";
-  hash_x86_64-linux = "sha256-wb3xlSgeJdySGvXJHrJQIDUkDc4SFxQMQwNtbPMDj9g=";
+  version_aarch64-linux = "0.4.25-1";
+  hash_aarch64-linux = "sha256-4+8yo3ZW5+Tlza31LnL6kp1fJutgB74WZsduT9uo4IQ=";
+  version_aarch64-darwin = "0.4.25-1";
+  hash_aarch64-darwin = "sha256-i6uFfD0pAOFKtGQ18NFHHeBo8WXnYbucF3CT6KJeF3Q=";
+  version_x86_64-linux = "0.4.25-1";
+  hash_x86_64-linux = "sha256-7KRnRGyDOCRpfovvqzAP5Saf35hOPuQ4X8uthQLwfFM=";
 
   meta = {
     description = "LM Studio is an easy to use desktop app for experimenting with local and open-source Large Language Models (LLMs)";

pkgs/by-name/ma/maven_4/package.nix

@@ -13,11 +13,11 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "maven";
-  version = "4.0.0-rc-6";
+  version = "4.0.0-rc-7";
 
   src = fetchurl {
     url = "mirror://apache/maven/maven-4/${finalAttrs.version}/binaries/apache-maven-${finalAttrs.version}-bin.tar.gz";
-    hash = "sha256-/B0VCwGZnwlmKbuvSOiuQ00ATV3DbDOWK8i+ZXnT+R0=";
+    hash = "sha256-lRxjJnaH1Bi7nAbAjiVUQyhYNRmRm5Zheqci+BOxnm8=";
   };
 
   sourceRoot = ".";

pkgs/by-name/md/mdctags/package.nix

@@ -6,13 +6,16 @@
 
 rustPlatform.buildRustPackage {
   pname = "mdctags";
-  version = "unstable-2020-06-11"; # v0.1.0 does not build with our rust version
+  version = "0.1.0-unstable-2020-07-11"; # v0.1.0 does not build with our rust version
+
+  strictDeps = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "wsdjeg";
     repo = "mdctags.rs";
     rev = "0ed9736ea0c77e6ff5b560dda46f5ed0a983ed82";
-    sha256 = "14gryhgh9czlkfk75ml0620c6v8r74i6h3ykkkmc7gx2z8h1jxrb";
+    hash = "sha256-K3cZIPqiv8PqnNMPaCI5GW3DgDCA1nKmm/SzBB/0+ZE=";
   };
 
   cargoHash = "sha256-xg9tBBo3Al8x0HkgRnfdZybcjaHsNMv/Ot3NwGiHkBg=";

pkgs/by-name/me/meilisearch/package.nix

@@ -8,18 +8,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "meilisearch";
-  version = "1.53.2";
+  version = "1.54.0";
 
   src = fetchFromGitHub {
     owner = "meilisearch";
     repo = "meilisearch";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bbVuB8brplUAqKrmTBah4HKbmshv0n5Hn2v9hUnY62c=";
+    hash = "sha256-GFVMplrViua0dQyMC6qq4/uk0HJaQZ2HLP5zooYdhyI=";
   };
 
   cargoBuildFlags = [ "--package=meilisearch" ];
 
-  cargoHash = "sha256-ojRJPL3EHyGmWHcX5SLv11fkP1pUNKrYkd82GEC4zKE=";
+  cargoHash = "sha256-OddLDA+jyIFUnP8XNnh3oFTVmop3IKGn9UpfYD48jWE=";
 
   # Default features include mini dashboard which downloads something from the internet.
   buildNoDefaultFeatures = true;

pkgs/by-name/mi/microsoft-edge/package.nix

@@ -1,11 +1,13 @@
 {
-  lib,
-  stdenvNoCC,
+  bintools,
   fetchurl,
+  lib,
   makeWrapper,
   patchelf,
-  bintools,
+  stdenvNoCC,
+  testers,
   dpkg,
+
   # Linked dynamic libraries
   alsa-lib,
   at-spi2-atk,
@@ -46,15 +48,20 @@
   pipewire,
   vulkan-loader,
   wayland, # ozone/wayland
+
   # Command line programs
   coreutils,
+
   # command line arguments which are always set e.g "--disable-gpu"
   commandLineArgs ? "",
+
   # Will crash without.
   systemd,
+
   # Loaded at runtime.
   libexif,
   pciutils,
+
   # Additional dependencies according to other distros
   ## Ubuntu
   curl,
@@ -73,27 +80,38 @@
   ## Gentoo
   bzip2,
   libcap,
+
   # Necessary for USB audio devices.
   libpulseaudio,
   pulseSupport ? true,
+
   adwaita-icon-theme,
   gsettings-desktop-schemas,
+
   # For video acceleration via VA-API (--enable-features=VaapiVideoDecoder)
   libva,
   libvaSupport ? true,
+
   # For Vulkan support (--enable-features=Vulkan)
   addDriverRunpath,
-  # For QT support
+  undmg,
+
+  # Enables Edge's "Use QT" appearance to introspect the user's Plasma theme
+  plasmaSupport ? false,
   qt6,
-  # Edge AAD sync
+  kdePackages,
+
+  # Edge Specific and AAD sync
   cacert,
   libsecret,
-  # Edge Specific
   libuuid,
+
   # Create a symlink at $out/bin/microsoft-edge-stable
   withSymlink ? true,
 }:
+
 let
+  pname = "microsoft-edge";
   opusWithCustomModes = libopus.override { withCustomModes = true; };
 
   deps = [
@@ -115,15 +133,20 @@ let
     gcc-unwrapped.lib
     gdk-pixbuf
     glib
+    gtk3
+    gtk4
     harfbuzz
     icu
     libcap
     libdrm
     liberation_ttf
     libexif
+    libgbm
     libglvnd
     libkrb5
     libpng
+    libsecret
+    libuuid
     libx11
     libxcb
     libxcomposite
@@ -138,7 +161,6 @@ let
     libxscrnsaver
     libxshmfence
     libxtst
-    libgbm
     nspr
     nss
     opusWithCustomModes
@@ -152,124 +174,178 @@ let
     vulkan-loader
     wayland
     wget
-    libsecret
-    libuuid
-    gtk3
-    gtk4
+  ]
+  ++ lib.optional pulseSupport libpulseaudio
+  ++ lib.optional libvaSupport libva
+  ++ lib.optionals plasmaSupport [
     qt6.qtbase
     qt6.qtwayland
-  ]
-  ++ lib.optionals pulseSupport [ libpulseaudio ]
-  ++ lib.optionals libvaSupport [ libva ];
-in
-stdenvNoCC.mkDerivation (finalAttrs: {
-  pname = "microsoft-edge";
-  version = "154.0.4258.37";
-
-  src = fetchurl {
-    url = "https://packages.microsoft.com/repos/edge/pool/main/m/microsoft-edge-stable/microsoft-edge-stable_${finalAttrs.version}-1_amd64.deb";
-    hash = "sha256-xvopdHM5kTIbRsQGS3hc3sWhTYzd0YK8X9oFfjfnYD0=";
-  };
-
-  # With strictDeps on, some shebangs were not being patched correctly
-  # ie, $out/share/microsoft/msedge/microsoft-edge
-  strictDeps = false;
-
-  nativeBuildInputs = [
-    makeWrapper
-    patchelf
-    dpkg
+    kdePackages.plasma-integration
+    kdePackages.breeze
   ];
 
-  buildInputs = [
-    # needed for XDG_ICON_DIRS
-    adwaita-icon-theme
-    glib
-    gtk3
-    gtk4
-    # needed for GSETTINGS_SCHEMAS_PATH
-    gsettings-desktop-schemas
-  ];
+  linux = stdenvNoCC.mkDerivation (finalAttrs: {
+    inherit pname meta;
+    version = "154.0.4258.37";
 
-  rpath = lib.makeLibraryPath deps + ":" + lib.makeSearchPathOutput "lib" "lib64" deps;
-  binpath = lib.makeBinPath deps;
+    src = fetchurl {
+      url = "https://packages.microsoft.com/repos/edge/pool/main/m/microsoft-edge-stable/microsoft-edge-stable_${finalAttrs.version}-1_amd64.deb";
+      hash = "sha256-xvopdHM5kTIbRsQGS3hc3sWhTYzd0YK8X9oFfjfnYD0=";
+    };
 
-  installPhase = ''
-    runHook preInstall
+    # With strictDeps on, some shebangs were not being patched correctly
+    # ie, $out/share/microsoft/msedge/microsoft-edge
+    strictDeps = false;
 
-    appname=msedge
-    dist=stable
+    nativeBuildInputs = [
+      makeWrapper
+      patchelf
+      dpkg
+    ];
 
-    exe=$out/bin/microsoft-edge
+    buildInputs = [
+      # needed for XDG_ICON_DIRS
+      adwaita-icon-theme
+      glib
+      gtk3
+      gtk4
+      # needed for GSETTINGS_SCHEMAS_PATH
+      gsettings-desktop-schemas
+    ];
 
-    mkdir -p $out/bin
-    cp -v -a usr/share $out/share
-    cp -v -a opt/microsoft $out/share/microsoft
+    rpath = lib.makeLibraryPath deps + ":" + lib.makeSearchPathOutput "lib" "lib64" deps;
+    binpath = lib.makeBinPath deps;
 
-    # replace bundled vulkan-loader
-    rm -v $out/share/microsoft/$appname/libvulkan.so.1
-    ln -v -s -t "$out/share/microsoft/$appname" "${lib.getLib vulkan-loader}/lib/libvulkan.so.1"
+    installPhase = ''
+      runHook preInstall
 
-    substituteInPlace $out/share/microsoft/$appname/microsoft-edge \
-      --replace-fail 'CHROME_WRAPPER' 'WRAPPER'
-    substituteInPlace $out/share/applications/microsoft-edge.desktop \
-      --replace-fail /usr/bin/microsoft-edge-$dist $exe
-    substituteInPlace $out/share/applications/com.microsoft.Edge.desktop \
-      --replace-fail /usr/bin/microsoft-edge-$dist $exe
-    substituteInPlace $out/share/gnome-control-center/default-apps/microsoft-edge.xml \
-      --replace-fail /opt/microsoft/msedge $exe
+      appname=msedge
+      dist=stable
 
-    for icon_file in $out/share/microsoft/msedge/product_logo_[0-9]*.png; do
-      num_and_suffix="''${icon_file##*logo_}"
-      if [ $dist = "stable" ]; then
-        icon_size="''${num_and_suffix%.*}"
-      else
-        icon_size="''${num_and_suffix%_*}"
-      fi
-      logo_output_prefix="$out/share/icons/hicolor"
-      logo_output_path="$logo_output_prefix/''${icon_size}x''${icon_size}/apps"
-      mkdir -p "$logo_output_path"
-      mv "$icon_file" "$logo_output_path/microsoft-edge.png"
-    done
+      exe=$out/bin/microsoft-edge-$dist
 
-    # "--simulate-outdated-no-au" disables auto updates and browser outdated popup
-    makeWrapper "$out/share/microsoft/$appname/microsoft-edge" "$exe" \
-      --prefix QT_PLUGIN_PATH  : "${qt6.qtbase}/lib/qt-6/plugins" \
-      --prefix QT_PLUGIN_PATH  : "${qt6.qtwayland}/lib/qt-6/plugins" \
-      --prefix NIXPKGS_QT6_QML_IMPORT_PATH : "${qt6.qtwayland}/lib/qt-6/qml" \
-      --prefix LD_LIBRARY_PATH : "$rpath" \
-      --prefix PATH            : "$binpath" \
-      --suffix PATH            : "${lib.makeBinPath [ xdg-utils ]}" \
-      --prefix XDG_DATA_DIRS   : "$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH:${addDriverRunpath.driverLink}/share" \
-      --set SSL_CERT_FILE "${cacert}/etc/ssl/certs/ca-bundle.crt" \
-      --set CHROME_WRAPPER  "microsoft-edge-$dist" \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true --wayland-text-input-version=3}}" \
-      --add-flags "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" \
-      --add-flags ${lib.escapeShellArg commandLineArgs}
+      mkdir -p $out/bin $out/share
+      cp -v -a opt/* $out/share
+      cp -v -a usr/share/* $out/share
 
-    # Edge specific set liboneauth
-    patchelf --set-rpath $rpath $out/share/microsoft/$appname/liboneauth.so
+      # replace bundled vulkan-loader
+      rm -v $out/share/microsoft/$appname/libvulkan.so.1
+      ln -v -s -t "$out/share/microsoft/$appname" "${lib.getLib vulkan-loader}/lib/libvulkan.so.1"
 
-    for elf in $out/share/microsoft/$appname/{msedge,msedge-sandbox,msedge_crashpad_handler}; do
-      patchelf --set-rpath $rpath $elf
-      patchelf --set-interpreter ${bintools.dynamicLinker} $elf
-    done
+      substituteInPlace $out/share/microsoft/$appname/microsoft-edge \
+        --replace-fail 'CHROME_WRAPPER' 'WRAPPER'
+      substituteInPlace $out/share/applications/microsoft-edge.desktop \
+        --replace-fail /usr/bin/microsoft-edge-$dist $exe
+      substituteInPlace $out/share/applications/com.microsoft.Edge.desktop \
+        --replace-fail /usr/bin/microsoft-edge-$dist $exe
+      substituteInPlace $out/share/gnome-control-center/default-apps/microsoft-edge.xml \
+        --replace-fail /opt/microsoft/$appname $exe
 
-    ${lib.optionalString withSymlink ''
-      ln -s $out/bin/microsoft-edge $out/bin/microsoft-edge-stable
-    ''}
+      for icon_file in $out/share/microsoft/msedge/product_logo_[0-9]*.png; do
+        num_and_suffix="''${icon_file##*logo_}"
+        if [ $dist = "stable" ]; then
+          icon_size="''${num_and_suffix%.*}"
+        else
+          icon_size="''${num_and_suffix%_*}"
+        fi
+        logo_output_prefix="$out/share/icons/hicolor"
+        logo_output_path="$logo_output_prefix/''${icon_size}x''${icon_size}/apps"
+        mkdir -p "$logo_output_path"
+        mv "$icon_file" "$logo_output_path/microsoft-edge.png"
+      done
 
-    runHook postInstall
-  '';
+      # "--simulate-outdated-no-au" disables auto updates and browser outdated popup
+      makeWrapper "$out/share/microsoft/$appname/microsoft-edge" "$exe" \
+        ${lib.optionalString plasmaSupport ''
+          --prefix QT_PLUGIN_PATH  : "${qt6.qtbase}/lib/qt-6/plugins" \
+          --prefix QT_PLUGIN_PATH  : "${qt6.qtwayland}/lib/qt-6/plugins" \
+          --prefix QT_PLUGIN_PATH  : "${kdePackages.plasma-integration}/lib/qt-6/plugins" \
+          --prefix QT_PLUGIN_PATH  : "${kdePackages.breeze}/lib/qt-6/plugins" \
+          --prefix NIXPKGS_QT6_QML_IMPORT_PATH : "${qt6.qtwayland}/lib/qt-6/qml" \
+        ''} \
+        --prefix LD_LIBRARY_PATH : "$rpath" \
+        --prefix PATH            : "$binpath" \
+        --suffix PATH            : "${lib.makeBinPath [ xdg-utils ]}" \
+        --prefix XDG_DATA_DIRS   : "$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH:${addDriverRunpath.driverLink}/share" \
+        --set SSL_CERT_FILE "${cacert}/etc/ssl/certs/ca-bundle.crt" \
+        --set CHROME_WRAPPER  "microsoft-edge-$dist" \
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true --wayland-text-input-version=3}}" \
+        --add-flags "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" \
+        --add-flags ${lib.escapeShellArg commandLineArgs}
 
-  passthru.updateScript = ./update.py;
+      # Edge specific set liboneauth
+      patchelf --set-rpath $rpath $out/share/microsoft/$appname/liboneauth.so
+
+      for elf in $out/share/microsoft/$appname/{msedge,msedge-sandbox,msedge_crashpad_handler}; do
+        patchelf --set-rpath $rpath $elf
+        patchelf --set-interpreter ${bintools.dynamicLinker} $elf
+      done
+
+      runHook postInstall
+    '';
+
+    postInstall = lib.optionalString withSymlink ''
+      ln -s $out/bin/microsoft-edge-stable $out/bin/microsoft-edge
+    '';
+
+    passthru = {
+      updateScript = ./update.sh;
+      tests.version = testers.testVersion { package = finalAttrs.finalPackage; };
+    };
+  });
+
+  darwin = stdenvNoCC.mkDerivation (finalAttrs: {
+    inherit pname meta;
+    version = "154.0.4258.37";
+    uuid = "f7dec597-801d-4c4b-ae51-c8a53c78925c";
+
+    src = fetchurl {
+      url = "https://msedge.sf.dl.delivery.mp.microsoft.com/filestreamingservice/files/${finalAttrs.uuid}/MicrosoftEdge-${finalAttrs.version}.dmg";
+      hash = "sha256-R385aGFby0WK64wxHGCbKnDymsUIG+lzTpQfVO2NBgA=";
+    };
+
+    dontPatch = true;
+    dontConfigure = true;
+    dontBuild = true;
+    dontFixup = true;
+
+    nativeBuildInputs = [
+      makeWrapper
+      undmg
+    ];
+
+    sourceRoot = ".";
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/Applications
+      cp -r *.app $out/Applications
+
+      mkdir -p $out/bin
+
+      # "--simulate-outdated-no-au" disables auto updates and browser outdated popup
+      makeWrapper $out/Applications/Microsoft\ Edge.app/Contents/MacOS/Microsoft\ Edge $out/bin/microsoft-edge-stable \
+        --add-flags "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" \
+        --add-flags ${lib.escapeShellArg commandLineArgs}
+      runHook postInstall
+    '';
+
+    postInstall = lib.optionalString withSymlink ''
+      ln -s $out/bin/microsoft-edge-stable $out/bin/microsoft-edge
+    '';
+
+    passthru = {
+      updateScript = ./update.sh;
+      tests.version = testers.testVersion { package = finalAttrs.finalPackage; };
+    };
+  });
 
   meta = {
-    changelog = "https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnote-stable-channel";
     description = "Web browser from Microsoft";
     homepage = "https://www.microsoft.com/en-us/edge";
+    changelog = "https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnote-stable-channel";
     license = lib.licenses.unfree;
-    mainProgram = "microsoft-edge";
     maintainers = with lib.maintainers; [
       cholli
       ulrikstrid
@@ -278,7 +354,17 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       jonhermansen
       iedame
     ];
-    platforms = [ "x86_64-linux" ];
+    platforms = lib.platforms.darwin ++ [
+      "x86_64-linux"
+    ];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    mainProgram = "microsoft-edge-stable";
   };
-})
+
+in
+if stdenvNoCC.hostPlatform.isDarwin then
+  darwin
+else if stdenvNoCC.hostPlatform.isLinux then
+  linux
+else
+  throw "Unsupported platform ${stdenvNoCC.hostPlatform.system}"

pkgs/by-name/mi/microsoft-edge/update.py

@@ -1,46 +0,0 @@
-#! /usr/bin/env nix-shell
-#! nix-shell -i python3 -p python3Packages.packaging python3Packages.python-debian common-updater-scripts
-
-import subprocess
-from collections import OrderedDict
-from os.path import abspath, dirname
-from urllib import request
-
-from debian.deb822 import Packages
-from debian.debian_support import Version
-
-PIN_PATH = dirname(abspath(__file__)) + "/default.nix"
-
-
-def packages():
-    packages_url = "https://packages.microsoft.com/repos/edge/dists/stable/main/binary-amd64/Packages"
-    handle = request.urlopen(packages_url)
-    return handle
-
-
-def latest_packages(packages: bytes):
-    latest_packages: OrderedDict[str, Packages] = {}
-    for package in Packages.iter_paragraphs(packages, use_apt_pkg=False):
-        name: str = package["Package"]
-        if not name.startswith("microsoft-edge-stable"):
-            continue
-        channel = name.replace("microsoft-edge-", "")
-        if channel not in latest_packages:
-            latest_packages[channel] = package
-        else:
-            old_package = latest_packages[channel]
-            if old_package.get_version() < package.get_version():  # type: ignore
-                latest_packages[channel] = package
-    return OrderedDict(sorted(latest_packages.items(), key=lambda x: x[0]))
-
-
-def write_expression():
-    latest = latest_packages(packages())
-    version = Version.re_valid_version.match(latest["stable"]["Version"]).group(
-        "upstream_version"
-    )
-    subprocess.run(["update-source-version", "microsoft-edge", version])
-    subprocess.run(["update-source-version", "msedgedriver", version])
-
-
-write_expression()

pkgs/by-name/mi/microsoft-edge/update.sh

@@ -0,0 +1,257 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -I nixpkgs=./. -i bash -p curl gawk nix common-updater-scripts python3Packages.python-debian
+# shellcheck shell=bash
+
+set -euo pipefail
+
+DEFAULT_NIX="$(realpath "./pkgs/by-name/mi/microsoft-edge/package.nix")"
+DRIVER_NIX="$(realpath "./pkgs/by-name/ms/msedgedriver/package.nix")"
+
+get_linux_version_info() {
+    local packages_url
+    local response
+    local version
+    local current_version
+    local download_url
+
+    packages_url="https://packages.microsoft.com/repos/edge/dists/stable/main/binary-amd64/Packages"
+
+    response="$(curl --silent --fail "$packages_url")"
+    read -r version download_url <<< "$(
+        python3 -c '
+import sys
+from debian.deb822 import Packages
+from debian.debian_support import Version
+
+latest = None
+
+for package in Packages.iter_paragraphs(sys.stdin, use_apt_pkg=False):
+    if package["Package"] != "microsoft-edge-stable":
+        continue
+
+    if latest is None or latest.get_version() < package.get_version():
+        latest = package
+
+if latest is None:
+    raise SystemExit("microsoft-edge-stable not found")
+
+version = Version.re_valid_version.match(
+    latest["Version"]
+).group("upstream_version")
+
+url = (
+    "https://packages.microsoft.com/repos/edge/"
+    + latest["Filename"]
+)
+
+print(version, url)
+' <<< "$response"
+    )"
+
+    current_version="$(
+        awk '
+            /^  linux = stdenvNoCC.mkDerivation/ { in_block=1 }
+            in_block && /version = "/ {
+                match($0, /version = "([^"]+)"/, arr)
+                print arr[1]
+                exit
+            }
+            in_block && /^  \};/ { exit }
+        ' "$DEFAULT_NIX"
+    )"
+
+    echo "$version" "$current_version" "$download_url"
+}
+
+get_darwin_version_info() {
+    local redirect_url
+    local final_url
+    local version
+    local current_version
+    local uuid
+
+    redirect_url="https://go.microsoft.com/fwlink/?linkid=2192091"
+
+    final_url="$(
+        curl \
+            --silent \
+            --show-error \
+            --fail \
+            --location \
+            --output /dev/null \
+            --write-out '%{url_effective}' \
+            "$redirect_url"
+    )"
+
+    if [[ "$final_url" =~ /files/([^/]+)/MicrosoftEdge-([0-9.]+)\.dmg$ ]]; then
+        uuid="${BASH_REMATCH[1]}"
+        version="${BASH_REMATCH[2]}"
+    else
+        echo "Could not parse Darwin URL: $final_url" >&2
+        exit 1
+    fi
+
+    current_version="$(
+        awk '
+            /^  darwin = stdenvNoCC.mkDerivation/ { in_block=1 }
+            in_block && /version = "/ {
+                match($0, /version = "([^"]+)"/, arr)
+                print arr[1]
+                exit
+            }
+            in_block && /^  \};/ { exit }
+        ' "$DEFAULT_NIX"
+    )"
+
+    echo "$version" "$current_version" "$uuid" "$final_url"
+}
+
+update_linux() {
+    local version_info
+    local version
+    local current_version
+    local download_url
+    local new_hash
+
+    read -ra version_info <<< "$(get_linux_version_info)"
+
+    version="${version_info[0]}"
+    current_version="${version_info[1]}"
+    download_url="${version_info[2]}"
+
+    if [[ "$current_version" = "$version" ]]; then
+        echo "[Nix] Linux microsoft-edge: same version"
+        return 0
+    fi
+
+    new_hash="$(
+        nix --extra-experimental-features nix-command \
+            hash convert \
+            --hash-algo sha256 \
+            --to sri \
+            "$(nix-prefetch-url "$download_url" 2>/dev/null)"
+    )"
+
+    sed -i \
+        "/^  linux = stdenvNoCC.mkDerivation/,/^  });/s/version = \".*\"/version = \"$version\"/" \
+        "$DEFAULT_NIX"
+
+    sed -i \
+        "/^  linux = stdenvNoCC.mkDerivation/,/^  });/s|hash = \".*\"|hash = \"$new_hash\"|" \
+        "$DEFAULT_NIX"
+
+    echo "[Nix] Linux microsoft-edge: $current_version -> $version with hash $new_hash"
+
+}
+
+update_darwin() {
+    local version_info
+    local version
+    local current_version
+    local uuid
+    local url
+    local new_hash
+
+    read -ra version_info <<< "$(get_darwin_version_info)"
+
+    version="${version_info[0]}"
+    current_version="${version_info[1]}"
+    uuid="${version_info[2]}"
+    url="${version_info[3]}"
+
+    if [[ "$current_version" = "$version" ]]; then
+        echo "[Nix] Darwin microsoft-edge: same version"
+        return 0
+    fi
+
+    new_hash="$(
+        nix --extra-experimental-features nix-command \
+            hash convert \
+            --hash-algo sha256 \
+            --to sri \
+            "$(nix-prefetch-url "$url" 2>/dev/null)"
+    )"
+
+    sed -i \
+        "/^  darwin = stdenvNoCC.mkDerivation/,/^  });/s/version = \".*\"/version = \"$version\"/" \
+        "$DEFAULT_NIX"
+
+    sed -i \
+        "/^  darwin = stdenvNoCC.mkDerivation/,/^  });/s|uuid = \".*\"|uuid = \"$uuid\"|" \
+        "$DEFAULT_NIX"
+
+    sed -i \
+        "/^  darwin = stdenvNoCC.mkDerivation/,/^  });/s|hash = \".*\"|hash = \"$new_hash\"|" \
+        "$DEFAULT_NIX"
+
+    echo "[Nix] Darwin microsoft-edge: $current_version -> $version with hash $new_hash"
+}
+
+update_msedgedriver() {
+    local version="$1"
+    local current_version
+    local new_hash
+    local driver_arch
+    local url
+
+    current_version="$(
+        awk '
+            /pname = "msedgedriver";/ { in_block=1 }
+            in_block && /version = "/ {
+                match($0, /version = "([^"]+)"/, arr)
+                print arr[1]
+                exit
+            }
+        ' "$DRIVER_NIX"
+    )"
+
+    if [[ "$current_version" = "$version" ]]; then
+        echo "[Nix] msedgedriver: same version"
+        return 0
+    fi
+
+    # All supported driver archives use the Linux Edge version.
+    # The archive names correspond to the driverArch mapping in
+    # msedgedriver/package.nix
+    declare -A hashes=(
+        [mac64_m1]=""
+        [linux64]=""
+    )
+
+    for driver_arch in mac64_m1 linux64; do
+        url="https://msedgedriver.microsoft.com/${version}/edgedriver_${driver_arch}.zip"
+
+        new_hash="$(
+            nix --extra-experimental-features nix-command \
+                hash convert \
+                --hash-algo sha256 \
+                --to sri \
+                "$(nix-prefetch-url --unpack "$url" 2>/dev/null)"
+        )"
+
+        hashes["$driver_arch"]="$new_hash"
+
+        echo "[Nix] msedgedriver ${driver_arch}: $new_hash"
+    done
+
+    sed -i \
+        "/pname = \"msedgedriver\";/,/^  meta = {/s/version = \".*\"/version = \"$version\"/" \
+        "$DRIVER_NIX"
+
+    for driver_arch in mac64_m1 linux64; do
+        sed -i \
+            "/pname = \"msedgedriver\";/,/^  meta = {/s|${driver_arch} = \".*\"|${driver_arch} = \"${hashes[$driver_arch]}\"|" \
+            "$DRIVER_NIX"
+    done
+
+    echo "[Nix] msedgedriver: $current_version -> $version"
+}
+
+update_linux
+update_darwin
+
+# Linux is the canonical platform for the shared msedgedriver version
+linux_version_info="$(get_linux_version_info)"
+read -r linux_version _ _ <<< "$linux_version_info"
+
+update_msedgedriver "$linux_version"

pkgs/by-name/mi/minc_widgets/package.nix

@@ -14,13 +14,16 @@
 
 stdenv.mkDerivation {
   pname = "minc-widgets";
-  version = "unstable-2016-04-20";
+  version = "1.0.0-unstable-2016-04-20";
+
+  strictDeps = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "BIC-MNI";
     repo = "minc-widgets";
     rev = "f08b643894c81a1a2e0fbfe595a17a42ba8906db";
-    sha256 = "1b9g6lf37wpp211ikaji4rf74rl9xcmrlyqcw1zq3z12ji9y33bm";
+    hash = "sha256-dY3hU5Qi/IF/4Ax7mivriWZyXCZRqhlDEPfyMxw1L60=";
   };
 
   patches = [

pkgs/by-name/mo/mons/package.nix

@@ -13,13 +13,13 @@
 
 resholve.mkDerivation {
   pname = "mons";
-  version = "unstable-2020-03-20";
+  version = "0.8.2-unstable-2020-03-20";
 
   src = fetchFromGitHub {
     owner = "Ventto";
     repo = "mons";
     rev = "375bbba3aa700c8b3b33645a7fb70605c8b0ff0c";
-    sha256 = "19r5y721yrxhd9jp99s29jjvm0p87vl6xfjlcj38bljq903f21cl";
+    hash = "sha256-lAXhBkhY0oWGZFS6bug+6IK6pUxCp3RlarBnH8TxJac=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/mp/mprisence/package.nix

@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mprisence";
-  version = "1.8.5";
+  version = "1.8.8";
 
   src = fetchFromGitHub {
     owner = "lazykern";
     repo = "mprisence";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GiRhhJv6CHRWaTNdMLkEbldZJcL9ol849JwCky64H/s=";
+    hash = "sha256-+TZnhA9z6duk7d9U2OBPlXJyrTFoVyKRIS35l6E62/c=";
   };
 
-  cargoHash = "sha256-maEBwe14jMy608fs9yJ4T9Z0xvYgGWDrMnPaSic4PCs=";
+  cargoHash = "sha256-B3Z/GkHOy4R9hhRZtVIItHs6J6wQSNVv0KNGF2/NSlo=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/mp/mpv/scripts/youtube-chat.nix

@@ -7,7 +7,7 @@
 
 buildLua {
   pname = "youtube-chat";
-  version = "unstable-2024-06-08";
+  version = "0-unstable-2024-06-08";
 
   src = fetchFromGitHub {
     owner = "BanchouBoo";

pkgs/by-name/ms/msedgedriver/package.nix

@@ -14,39 +14,44 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "msedgedriver";
   version = "154.0.4258.37";
 
-  src = fetchzip {
-    url = "https://msedgedriver.microsoft.com/${finalAttrs.version}/edgedriver_linux64.zip";
-    hash = "sha256-XbOQl9FyckF3Qybb+40474ImJDKahBkekPoydf/TxV0=";
-    stripRoot = false;
-  };
+  src =
+    let
+      driverArch =
+        {
+          aarch64-darwin = "mac64_m1";
+          x86_64-linux = "linux64";
+        }
+        .${stdenvNoCC.hostPlatform.system};
+    in
+    fetchzip {
+      url = "https://msedgedriver.microsoft.com/${finalAttrs.version}/edgedriver_${driverArch}.zip";
+      hash =
+        {
+          mac64_m1 = "sha256-6nwe/vRPh5MkQLTiZNXepfFsLtILwoK925mgLCUUVNg=";
+          linux64 = "sha256-XbOQl9FyckF3Qybb+40474ImJDKahBkekPoydf/TxV0=";
+        }
+        .${driverArch};
+      stripRoot = false;
+    };
 
-  buildInputs = [
+  buildInputs = lib.optionals stdenvNoCC.hostPlatform.isLinux [
     glib
     libxcb
     nspr
     nss
   ];
 
-  nativeBuildInputs = [ autoPatchelfHook ];
+  nativeBuildInputs = lib.optionals stdenvNoCC.hostPlatform.isLinux [
+    autoPatchelfHook
+  ];
 
-  installPhase =
-    if stdenvNoCC.hostPlatform.isDarwin then
-      ''
-        runHook preInstall
+  installPhase = ''
+    runHook preInstall
 
-        mkdir -p $out/{Applications/msedgedriver,bin}
-        cp -R . $out/Applications/msedgedriver
+    install -D msedgedriver $out/bin/msedgedriver
 
-        runHook postInstall
-      ''
-    else
-      ''
-        runHook preInstall
-
-        install -m777 -D "msedgedriver" $out/bin/msedgedriver
-
-        runHook postInstall
-      '';
+    runHook postInstall
+  '';
 
   meta = {
     homepage = "https://developer.microsoft.com/en-us/microsoft-edge/tools/webdriver";
@@ -54,7 +59,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfree;
     maintainers = microsoft-edge.meta.maintainers;
-    platforms = [
+    platforms = lib.platforms.darwin ++ [
       "x86_64-linux"
     ];
     mainProgram = "msedgedriver";

pkgs/by-name/my/mycli/package.nix

@@ -7,20 +7,31 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "mycli";
-  version = "1.44.2";
+  version = "2.20.0";
   pyproject = true;
 
+  # test_ssh_tunnel.py binds to localhost to find a free port; the darwin
+  # sandbox blocks loopback networking unless this is enabled
+  __darwinAllowLocalNetworking = true;
+
   src = fetchFromGitHub {
     owner = "dbcli";
     repo = "mycli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7G7Yy0jdULzBiQr4JACWuBG4XdXDYZ8IyfbzGQKF428=";
+    hash = "sha256-jbEbyY5N6IY344sLiY9cjhPbwzHtNUJK4+SXkXU2lqM=";
   };
 
   pythonRelaxDeps = [
-    "sqlglot" # https://github.com/dbcli/mycli/issues/1696
+    "pygments"
+    "pymysql"
+    "wcwidth"
+    "sqlglot"
+    "sqlglotc"
     "sqlparse"
     "click"
+    "cryptography"
+    "cli_helpers"
+    "yaspin"
   ];
 
   build-system = with python3Packages; [
@@ -33,25 +44,48 @@ python3Packages.buildPythonApplication (finalAttrs: {
     [
       cli-helpers
       click
+      clickdc
       configobj
       cryptography
+      jinja2
+      keyring
       llm
-      paramiko
       prompt-toolkit
       pycryptodomex
       pygments
       pymysql
       pyperclip
+      rapidfuzz
       sqlglot
       sqlparse
       pyfzf
+      wcwidth
     ]
-    ++ cli-helpers.optional-dependencies.styles;
+    ++ cli-helpers.optional-dependencies.styles
+    ++ [ yaspin ];
 
-  nativeCheckInputs = [ writableTmpDirAsHomeHook ] ++ (with python3Packages; [ pytestCheckHook ]);
+  nativeCheckInputs = [
+    writableTmpDirAsHomeHook
+  ]
+  ++ (with python3Packages; [
+    pytestCheckHook
+    pytest-random-order
+  ]);
 
   disabledTestPaths = [
-    "mycli/packages/paramiko_stub/__init__.py"
+    # require optional polars dependency (not packaged)
+    "test/pytests/test_polars_transform.py"
+    "test/pytests/test_polars_completion.py"
+  ];
+
+  pytestFlags = [
+    # environment-specific completion keyword differences
+    "--deselect=test/pytests/test_smart_completion_public_schema_only.py::test_backticked_column_completion_three_character"
+    "--deselect=test/pytests/test_smart_completion_public_schema_only.py::test_backticked_column_completion_two_character"
+    "--deselect=test/pytests/test_naive_completion.py::test_function_name_completion"
+    # bash completion harness is sensitive to the system bash version and
+    # exercises only the static completion script, not the packaged code
+    "--deselect=test/pytests/test_bash_completion.py::test_bash_completion_matches_mycli_completion_behavior"
   ];
 
   meta = {

pkgs/by-name/ne/netbox/plugins/netbox-cable-labels/package.nix

@@ -0,0 +1,44 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  netbox,
+  python,
+}:
+buildPythonPackage (finalAttrs: {
+  pname = "netbox-cable-labels";
+  version = "0.1.0";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "jsenecal";
+    repo = "netbox-cable-labels";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-aTZXCHRyumfYk50bc0rFiDGscZt1n+fsW2uYZAkZwOQ=";
+  };
+
+  build-system = [ setuptools ];
+
+  nativeCheckInputs = [ netbox ];
+
+  preFixup = ''
+    export PYTHONPATH=${netbox}/opt/netbox/netbox:$PYTHONPATH
+  '';
+
+  dontUsePythonImportsCheck = python.pythonVersion != netbox.python.pythonVersion;
+
+  pythonImportsCheck = [ "netbox_cable_labels" ];
+
+  passthru.pluginName = "netbox_cable_labels";
+
+  meta = {
+    description = "NetBox plugin for automated label generated based on a user defined template";
+    homepage = "https://github.com/jsenecal/netbox-cable-labels";
+    changelog = "https://github.com/jsenecal/netbox-cable-labels/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ felbinger ];
+    platforms = lib.platforms.linux;
+  };
+})

pkgs/by-name/ne/netbox/plugins/netbox-notices/package.nix

@@ -0,0 +1,47 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  icalendar,
+  netbox,
+  python,
+}:
+buildPythonPackage (finalAttrs: {
+  pname = "netbox-notices";
+  version = "1.3.0";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "jsenecal";
+    repo = "netbox-notices";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-He7F4DAkrrhjNorhJ8Aok8out0txvmtSbiZ4BzRVPWg=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ icalendar ];
+
+  nativeCheckInputs = [ netbox ];
+
+  preFixup = ''
+    export PYTHONPATH=${netbox}/opt/netbox/netbox:$PYTHONPATH
+  '';
+
+  dontUsePythonImportsCheck = python.pythonVersion != netbox.python.pythonVersion;
+
+  pythonImportsCheck = [ "notices" ];
+
+  passthru.pluginName = "notices";
+
+  meta = {
+    description = "NetBox plugin to track maintenance and outage events against NetBox models";
+    homepage = "https://github.com/jsenecal/netbox-notices";
+    changelog = "https://github.com/jsenecal/netbox-notices/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ felbinger ];
+    platforms = lib.platforms.linux;
+  };
+})

pkgs/by-name/ne/netbox/plugins/netbox-sqids/package.nix

@@ -0,0 +1,47 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  sqids,
+  netbox,
+  python,
+}:
+buildPythonPackage (finalAttrs: {
+  pname = "netbox-sqids";
+  version = "0.2.0";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "jsenecal";
+    repo = "netbox-sqids";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-B9BUjaKUqORlITbjiDYFetCaSx8lL0ECRU9yuPkoA0k=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ sqids ];
+
+  nativeCheckInputs = [ netbox ];
+
+  preFixup = ''
+    export PYTHONPATH=${netbox}/opt/netbox/netbox:$PYTHONPATH
+  '';
+
+  dontUsePythonImportsCheck = python.pythonVersion != netbox.python.pythonVersion;
+
+  pythonImportsCheck = [ "netbox_sqids" ];
+
+  passthru.pluginName = "netbox_sqids";
+
+  meta = {
+    description = "NetBox plugin for short, URL-safe, globally unique identifiers";
+    homepage = "https://github.com/jsenecal/netbox-sqids";
+    changelog = "https://github.com/jsenecal/netbox-sqids/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ felbinger ];
+    platforms = lib.platforms.linux;
+  };
+})

pkgs/by-name/ne/newflasher/package.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "newflasher";
-  version = "60";
+  version = "61";
 
   src = fetchFromGitHub {
     owner = "munjeni";
     repo = "newflasher";
     tag = "${finalAttrs.version}";
-    hash = "sha256-YmFY0WPT92f5zN10TEfuRv2mzhEweqeZEpzWCK4otYg=";
+    hash = "sha256-9qEGFzA5sMn+1MOKNTJeBukurzytksXitgXraPL0KDU=";
   };
 
   buildInputs = [

pkgs/by-name/om/omp/package.nix

@@ -32,7 +32,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "omp";
-  version = "18.2.11";
+  version = "18.3.3";
 
   strictDeps = true;
   __structuredAttrs = true;
@@ -41,12 +41,12 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "can1357";
     repo = "oh-my-pi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xzkxOCQbvCRE1I4gYKhnoKBQXpuaFjO+QiZKhVk4TlE=";
+    hash = "sha256-wyLc5yebo3EswxilJBxYVoXBon58to3OlaxIllq4ZQA=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src;
-    hash = "sha256-9tQE1Kg2sVSn7KBHMA1JgvI4kQbc1pTNgv9gXwnsuN0=";
+    hash = "sha256-NquckJxx4Ibfy3PjUtxL+vfTceavMLRAaEgbqqneFsM=";
   };
 
   postPatch = ''
@@ -91,7 +91,7 @@ stdenv.mkDerivation (finalAttrs: {
     # Prevents breaking symlinks in node_modules
     dontFixup = true;
 
-    outputHash = "sha256-di12mFSglfXGN2duxDS5wZcevCiGI9+t4SaQ5mjpi7Y=";
+    outputHash = "sha256-0SpMVoWelw3FVNaDfM8yndXRrXb6K03xxoC7mym6hec=";
     outputHashMode = "recursive";
   };
 

pkgs/by-name/pa/paratest/composer.lock

@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "e05bb884082da19a1a78e8a5f8a64417",
+    "content-hash": "1f220d5db23e158a3958000e9ad56f0d",
     "packages": [
         {
             "name": "fidry/cpu-core-counter",
@@ -189,16 +189,16 @@
         },
         {
             "name": "nikic/php-parser",
-            "version": "v5.8.0",
+            "version": "v5.9.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/nikic/PHP-Parser.git",
-                "reference": "044a6a392ff8ad0d61f14370a5fbbd0a0107152f"
+                "reference": "9e33da9553fe7786f0962b35f4e4ecf01be89def"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/nikic/PHP-Parser/zipball/044a6a392ff8ad0d61f14370a5fbbd0a0107152f",
-                "reference": "044a6a392ff8ad0d61f14370a5fbbd0a0107152f",
+                "url": "https://api.github.com/repos/nikic/PHP-Parser/zipball/9e33da9553fe7786f0962b35f4e4ecf01be89def",
+                "reference": "9e33da9553fe7786f0962b35f4e4ecf01be89def",
                 "shasum": ""
             },
             "require": {
@@ -240,9 +240,9 @@
             ],
             "support": {
                 "issues": "https://github.com/nikic/PHP-Parser/issues",
-                "source": "https://github.com/nikic/PHP-Parser/tree/v5.8.0"
+                "source": "https://github.com/nikic/PHP-Parser/tree/v5.9.0"
             },
-            "time": "2026-07-04T14:30:18+00:00"
+            "time": "2026-09-13T18:51:52+00:00"
         },
         {
             "name": "phar-io/manifest",
@@ -364,16 +364,16 @@
         },
         {
             "name": "phpunit/php-code-coverage",
-            "version": "14.3.1",
+            "version": "14.3.5",
             "source": {
                 "type": "git",
                 "url": "https://github.com/sebastianbergmann/php-code-coverage.git",
-                "reference": "6ce313bb110384148d1dc7695a99175f59529069"
+                "reference": "96af7aaa1e15561a67b2fa5b98906b063ebec9c2"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/sebastianbergmann/php-code-coverage/zipball/6ce313bb110384148d1dc7695a99175f59529069",
-                "reference": "6ce313bb110384148d1dc7695a99175f59529069",
+                "url": "https://api.github.com/repos/sebastianbergmann/php-code-coverage/zipball/96af7aaa1e15561a67b2fa5b98906b063ebec9c2",
+                "reference": "96af7aaa1e15561a67b2fa5b98906b063ebec9c2",
                 "shasum": ""
             },
             "require": {
@@ -381,7 +381,7 @@
                 "ext-libxml": "*",
                 "ext-mbstring": "*",
                 "ext-xmlwriter": "*",
-                "nikic/php-parser": "^5.8.0",
+                "nikic/php-parser": "^5.9.0",
                 "php": ">=8.4",
                 "phpunit/php-text-template": "^6.0",
                 "sebastian/complexity": "^6.0",
@@ -392,7 +392,7 @@
                 "theseer/tokenizer": "^2.0.1"
             },
             "require-dev": {
-                "phpunit/phpunit": "^13.3.1"
+                "phpunit/phpunit": "^13.3.4"
             },
             "suggest": {
                 "ext-pcov": "PHP extension that provides line coverage",
@@ -430,7 +430,7 @@
             "support": {
                 "issues": "https://github.com/sebastianbergmann/php-code-coverage/issues",
                 "security": "https://github.com/sebastianbergmann/php-code-coverage/security/policy",
-                "source": "https://github.com/sebastianbergmann/php-code-coverage/tree/14.3.1"
+                "source": "https://github.com/sebastianbergmann/php-code-coverage/tree/14.3.5"
             },
             "funding": [
                 {
@@ -450,7 +450,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-08-16T05:23:47+00:00"
+            "time": "2026-09-25T08:28:49+00:00"
         },
         {
             "name": "phpunit/php-file-iterator",
@@ -747,16 +747,16 @@
         },
         {
             "name": "phpunit/phpunit",
-            "version": "13.3.1",
+            "version": "13.3.5",
             "source": {
                 "type": "git",
                 "url": "https://github.com/sebastianbergmann/phpunit.git",
-                "reference": "fc024931d6ad047404e9d86536735923fe63a06b"
+                "reference": "1b482b9a77774705a5c4a47ab7d60819d2589e90"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/sebastianbergmann/phpunit/zipball/fc024931d6ad047404e9d86536735923fe63a06b",
-                "reference": "fc024931d6ad047404e9d86536735923fe63a06b",
+                "url": "https://api.github.com/repos/sebastianbergmann/phpunit/zipball/1b482b9a77774705a5c4a47ab7d60819d2589e90",
+                "reference": "1b482b9a77774705a5c4a47ab7d60819d2589e90",
                 "shasum": ""
             },
             "require": {
@@ -770,14 +770,14 @@
                 "phar-io/manifest": "^2.0.4",
                 "phar-io/version": "^3.2.1",
                 "php": ">=8.4.1",
-                "phpunit/php-code-coverage": "^14.3",
-                "phpunit/php-file-iterator": "^7.0.1",
+                "phpunit/php-code-coverage": "^14.3.5",
+                "phpunit/php-file-iterator": "^7.0.2",
                 "phpunit/php-invoker": "^7.0.0",
                 "phpunit/php-text-template": "^6.0.0",
                 "phpunit/php-timer": "^9.0.0",
                 "sebastian/cli-parser": "^5.0.1",
                 "sebastian/comparator": "^8.4",
-                "sebastian/diff": "^9.0",
+                "sebastian/diff": "^9.0.1",
                 "sebastian/environment": "^9.3.2",
                 "sebastian/exporter": "^8.2.1",
                 "sebastian/file-filter": "^1.0",
@@ -827,7 +827,7 @@
             "support": {
                 "issues": "https://github.com/sebastianbergmann/phpunit/issues",
                 "security": "https://github.com/sebastianbergmann/phpunit/security/policy",
-                "source": "https://github.com/sebastianbergmann/phpunit/tree/13.3.1"
+                "source": "https://github.com/sebastianbergmann/phpunit/tree/13.3.5"
             },
             "funding": [
                 {
@@ -835,7 +835,7 @@
                     "type": "other"
                 }
             ],
-            "time": "2026-08-13T13:14:23+00:00"
+            "time": "2026-09-25T08:41:20+00:00"
         },
         {
             "name": "psr/container",
@@ -2050,16 +2050,16 @@
         },
         {
             "name": "symfony/console",
-            "version": "v8.1.5",
+            "version": "v8.1.7",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/console.git",
-                "reference": "d07c06839e33047e2c894a6793248f3fb66c8129"
+                "reference": "29afb89f4e941f68a6e90f28e3f52ff1f6793a7d"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/console/zipball/d07c06839e33047e2c894a6793248f3fb66c8129",
-                "reference": "d07c06839e33047e2c894a6793248f3fb66c8129",
+                "url": "https://api.github.com/repos/symfony/console/zipball/29afb89f4e941f68a6e90f28e3f52ff1f6793a7d",
+                "reference": "29afb89f4e941f68a6e90f28e3f52ff1f6793a7d",
                 "shasum": ""
             },
             "require": {
@@ -2126,7 +2126,7 @@
                 "terminal"
             ],
             "support": {
-                "source": "https://github.com/symfony/console/tree/v8.1.5"
+                "source": "https://github.com/symfony/console/tree/v8.1.7"
             },
             "funding": [
                 {
@@ -2146,7 +2146,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-08-21T14:29:57+00:00"
+            "time": "2026-09-13T10:55:57+00:00"
         },
         {
             "name": "symfony/deprecation-contracts",
@@ -2636,16 +2636,16 @@
         },
         {
             "name": "symfony/process",
-            "version": "v8.1.5",
+            "version": "v8.1.7",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/process.git",
-                "reference": "d863f5e70d7c87abb906ac11b61f83036093000b"
+                "reference": "10823b09358e690df4ff943e24e8492bb1019fc3"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/process/zipball/d863f5e70d7c87abb906ac11b61f83036093000b",
-                "reference": "d863f5e70d7c87abb906ac11b61f83036093000b",
+                "url": "https://api.github.com/repos/symfony/process/zipball/10823b09358e690df4ff943e24e8492bb1019fc3",
+                "reference": "10823b09358e690df4ff943e24e8492bb1019fc3",
                 "shasum": ""
             },
             "require": {
@@ -2677,7 +2677,7 @@
             "description": "Executes commands in sub-processes",
             "homepage": "https://symfony.com",
             "support": {
-                "source": "https://github.com/symfony/process/tree/v8.1.5"
+                "source": "https://github.com/symfony/process/tree/v8.1.7"
             },
             "funding": [
                 {
@@ -2697,20 +2697,20 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-08-21T17:47:34+00:00"
+            "time": "2026-09-02T12:40:29+00:00"
         },
         {
             "name": "symfony/service-contracts",
-            "version": "v3.7.1",
+            "version": "v3.7.3",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/service-contracts.git",
-                "reference": "c0a284bab1ed8aa0417e3d69250ab437739563a0"
+                "reference": "15e6a07ec2a2c75ceb1b21dd98105ee8456d2257"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/service-contracts/zipball/c0a284bab1ed8aa0417e3d69250ab437739563a0",
-                "reference": "c0a284bab1ed8aa0417e3d69250ab437739563a0",
+                "url": "https://api.github.com/repos/symfony/service-contracts/zipball/15e6a07ec2a2c75ceb1b21dd98105ee8456d2257",
+                "reference": "15e6a07ec2a2c75ceb1b21dd98105ee8456d2257",
                 "shasum": ""
             },
             "require": {
@@ -2764,7 +2764,7 @@
                 "standards"
             ],
             "support": {
-                "source": "https://github.com/symfony/service-contracts/tree/v3.7.1"
+                "source": "https://github.com/symfony/service-contracts/tree/v3.7.3"
             },
             "funding": [
                 {
@@ -2784,20 +2784,20 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-06-16T09:55:08+00:00"
+            "time": "2026-07-27T15:39:01+00:00"
         },
         {
             "name": "symfony/string",
-            "version": "v8.1.2",
+            "version": "v8.1.7",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/string.git",
-                "reference": "286a76b7255e5cc4bf0101a0bc5388ecf1c38ccc"
+                "reference": "d950140b5f56f31901e5b7a0c04ffc3a3deb943c"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/string/zipball/286a76b7255e5cc4bf0101a0bc5388ecf1c38ccc",
-                "reference": "286a76b7255e5cc4bf0101a0bc5388ecf1c38ccc",
+                "url": "https://api.github.com/repos/symfony/string/zipball/d950140b5f56f31901e5b7a0c04ffc3a3deb943c",
+                "reference": "d950140b5f56f31901e5b7a0c04ffc3a3deb943c",
                 "shasum": ""
             },
             "require": {
@@ -2854,7 +2854,7 @@
                 "utf8"
             ],
             "support": {
-                "source": "https://github.com/symfony/string/tree/v8.1.2"
+                "source": "https://github.com/symfony/string/tree/v8.1.7"
             },
             "funding": [
                 {
@@ -2874,7 +2874,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-07-28T07:35:25+00:00"
+            "time": "2026-09-11T14:51:16+00:00"
         },
         {
             "name": "theseer/tokenizer",
@@ -3082,16 +3082,16 @@
         },
         {
             "name": "phpstan/phpdoc-parser",
-            "version": "2.3.3",
+            "version": "2.3.5",
             "source": {
                 "type": "git",
                 "url": "https://github.com/phpstan/phpdoc-parser.git",
-                "reference": "fb19eedd2bb67ff8cf7a5502ad329e701d6398a3"
+                "reference": "148cefffaf0233e4c08cc13db8a195a56dd6dfe9"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/phpstan/phpdoc-parser/zipball/fb19eedd2bb67ff8cf7a5502ad329e701d6398a3",
-                "reference": "fb19eedd2bb67ff8cf7a5502ad329e701d6398a3",
+                "url": "https://api.github.com/repos/phpstan/phpdoc-parser/zipball/148cefffaf0233e4c08cc13db8a195a56dd6dfe9",
+                "reference": "148cefffaf0233e4c08cc13db8a195a56dd6dfe9",
                 "shasum": ""
             },
             "require": {
@@ -3123,17 +3123,17 @@
             "description": "PHPDoc parser with support for nullable, intersection and generic types",
             "support": {
                 "issues": "https://github.com/phpstan/phpdoc-parser/issues",
-                "source": "https://github.com/phpstan/phpdoc-parser/tree/2.3.3"
+                "source": "https://github.com/phpstan/phpdoc-parser/tree/2.3.5"
             },
-            "time": "2026-07-08T07:01:06+00:00"
+            "time": "2026-08-31T16:05:28+00:00"
         },
         {
             "name": "phpstan/phpstan",
-            "version": "2.2.9",
+            "version": "2.2.16",
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/13d6b4f347bad222da436580c8304fa6f83e6bd0",
-                "reference": "13d6b4f347bad222da436580c8304fa6f83e6bd0",
+                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/46a6d9060e5a7763adfcc21ebcb8b504ebdbcb92",
+                "reference": "46a6d9060e5a7763adfcc21ebcb8b504ebdbcb92",
                 "shasum": ""
             },
             "require": {
@@ -3189,7 +3189,7 @@
                     "type": "github"
                 }
             ],
-            "time": "2026-08-22T07:38:16+00:00"
+            "time": "2026-09-25T09:31:51+00:00"
         },
         {
             "name": "phpstan/phpstan-deprecation-rules",
@@ -3244,22 +3244,22 @@
         },
         {
             "name": "phpstan/phpstan-phpunit",
-            "version": "2.0.18",
+            "version": "2.0.19",
             "source": {
                 "type": "git",
                 "url": "https://github.com/phpstan/phpstan-phpunit.git",
-                "reference": "f5dc20ff8082d02339b60cab68ec3eb0d859fb30"
+                "reference": "33a190a5e8e69fd18308443a80d4f43f42d43604"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/phpstan/phpstan-phpunit/zipball/f5dc20ff8082d02339b60cab68ec3eb0d859fb30",
-                "reference": "f5dc20ff8082d02339b60cab68ec3eb0d859fb30",
+                "url": "https://api.github.com/repos/phpstan/phpstan-phpunit/zipball/33a190a5e8e69fd18308443a80d4f43f42d43604",
+                "reference": "33a190a5e8e69fd18308443a80d4f43f42d43604",
                 "shasum": ""
             },
             "require": {
                 "phar-io/version": "^3.2",
                 "php": "^7.4 || ^8.0",
-                "phpstan/phpstan": "^2.2.3"
+                "phpstan/phpstan": "^2.2.6"
             },
             "conflict": {
                 "phpunit/phpunit": "<7.0"
@@ -3296,9 +3296,9 @@
             ],
             "support": {
                 "issues": "https://github.com/phpstan/phpstan-phpunit/issues",
-                "source": "https://github.com/phpstan/phpstan-phpunit/tree/2.0.18"
+                "source": "https://github.com/phpstan/phpstan-phpunit/tree/2.0.19"
             },
-            "time": "2026-07-04T12:16:09+00:00"
+            "time": "2026-09-26T17:07:06+00:00"
         },
         {
             "name": "phpstan/phpstan-strict-rules",
@@ -3503,16 +3503,16 @@
         },
         {
             "name": "symfony/filesystem",
-            "version": "v8.1.5",
+            "version": "v8.1.6",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/filesystem.git",
-                "reference": "6b2f4a0eeb28b5d74f90862592923a654bc629b3"
+                "reference": "7599ebb855fede59413ddb7f15198d67bfcae7ba"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/filesystem/zipball/6b2f4a0eeb28b5d74f90862592923a654bc629b3",
-                "reference": "6b2f4a0eeb28b5d74f90862592923a654bc629b3",
+                "url": "https://api.github.com/repos/symfony/filesystem/zipball/7599ebb855fede59413ddb7f15198d67bfcae7ba",
+                "reference": "7599ebb855fede59413ddb7f15198d67bfcae7ba",
                 "shasum": ""
             },
             "require": {
@@ -3550,7 +3550,7 @@
             "description": "Provides basic utilities for the filesystem",
             "homepage": "https://symfony.com",
             "support": {
-                "source": "https://github.com/symfony/filesystem/tree/v8.1.5"
+                "source": "https://github.com/symfony/filesystem/tree/v8.1.6"
             },
             "funding": [
                 {
@@ -3570,7 +3570,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-08-21T12:16:08+00:00"
+            "time": "2026-08-23T10:06:25+00:00"
         }
     ],
     "aliases": [],
@@ -3579,7 +3579,7 @@
     "prefer-stable": false,
     "prefer-lowest": false,
     "platform": {
-        "php": "~8.4.0 || ~8.5.0",
+        "php": "~8.4.0 || ~8.5.0 || ~8.6.0",
         "ext-dom": "*",
         "ext-pcre": "*",
         "ext-reflection": "*",

pkgs/by-name/pa/paratest/package.nix

@@ -8,17 +8,17 @@
 (php.withExtensions ({ enabled, all }: enabled ++ [ all.pcov ])).buildComposerProject2
   (finalAttrs: {
     pname = "paratest";
-    version = "7.24.1";
+    version = "7.25.0";
 
     src = fetchFromGitHub {
       owner = "paratestphp";
       repo = "paratest";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-wNdZyZ7r9UpXCJwE4yucEg9FmWCy06HRr56s1XZQWB0=";
+      hash = "sha256-rvxDqtcZ6KbhjX5rBkiPn1FxqT1s+YtYfIwhMyTTTZU=";
     };
 
     composerLock = ./composer.lock;
-    vendorHash = "sha256-LomuNhr/g9Fa6du0xPcRHPSEXDLRcbqEOqha9wwtY7M=";
+    vendorHash = "sha256-bszTB7FcalfGLywtjn4qt2kBBDqyESUc/a20IfMpQ6Y=";
 
     passthru.updateScript = ./update.sh;
 

pkgs/by-name/pi/pix/package.nix

@@ -35,13 +35,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pix";
-  version = "3.4.10";
+  version = "3.4.11";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "pix";
     rev = finalAttrs.version;
-    hash = "sha256-IrRE2Bv2+DZMLI48at7npcAd3TSJRuZNzU/YbNK8x3k=";
+    hash = "sha256-iiqy/IsQE1o1tv5MjdhCOFQnTGheSSZsC/1UwDt2x24=";
   };
 
   nativeBuildInputs = [