Merge master into staging-next

https://www.thunderbird.net/en-US/thunderbird/140.13.0esr/releasenotes/

.gitignore

@@ -27,6 +27,9 @@ tags
 .mypy_cache
 __pycache__
 
+/AGENTS.md
+/CLAUDE.md
+
 /pkgs/development/libraries/qt-5/*/tmp/
 /pkgs/desktops/kde-5/*/tmp/
 /pkgs/development/mobile/androidenv/xml/*

doc/build-helpers/testers.chapter.md

@@ -758,6 +758,7 @@ An attribute set of derivations which perform the tests during their build.
   - Output attribute `config` is the resulting evaluated services attrset (e.g., the value of the `system.services` option in NixOS).
     This attribute must be available even if `checkDrv` would fail.
   - Output attribute `checkDrv` is a representative derivation whose existence and buildability prove the eval is sound (e.g., `system.build.toplevel` in NixOS, but could perhaps be more specific in the case of another process manager integration).
+  - The generic tester only reads `config` and `checkDrv`. An integration may return additional attributes for its own integration-specific eval checks. Such extra attributes are optional.
 
 `mkTest` (function)
 
@@ -772,6 +773,14 @@ An attribute set of derivations which perform the tests during their build.
 : Path to a directory writable by service processes and readable by `testExe`.
   The integration must ensure this directory is available when the services and `testExe` run.
 
+`callReload` (function)
+
+: `path -> string`.
+  Given a service's name `path` (the list of service names from the top-level service down to the target sub-service, e.g. `[ "reload" "inner" ]`), returns a shell command that reloads that service.
+  The command is embedded in `testExe` and executed with sufficient privilege to reload the service (e.g. as root in the test VM).
+  There is no manager-agnostic reload command, so every integration must provide this; the integration joins the `path` per its own unit-naming convention (the suite does not assume one).
+  On NixOS the `path` dash-joins into the systemd unit name with a `.service` suffix, so the command is `systemctl reload ${lib.concatStringsSep "-" path}.service` (a top-level service is a single-element path `[ "svc" ]` -> `svc.service`; a nested sub-service `[ "parent" "child" ]` -> `parent-child.service`).
+
 :::{.example #ex-modularServiceCompliance-nixos}
 
 # NixOS invocation of the compliance suite
@@ -802,6 +811,7 @@ recurseIntoAttrs (
         config = machine.config.system.services;
         checkDrv = machine.config.system.build.toplevel;
       };
+    callReload = path: "systemctl reload ${lib.concatStringsSep "-" path}.service";
     mkTest =
       {
         name,

doc/hooks/pnpm.section.md

@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
-    fetcherversion = 4;
+    fetcherVersion = 4;
     hash = lib.fakeHash;
   };
 
@@ -123,7 +123,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
-    fetcherversion = 4;
+    fetcherVersion = 4;
     hash = lib.fakeHash;
   };
 

lib/services/service.nix

@@ -7,10 +7,11 @@
 {
   lib,
   config,
+  options,
   ...
 }:
 let
-  inherit (lib) mkOption types;
+  inherit (lib) mkEnableOption mkOption types;
   pathOrStr = types.coercedTo types.path (x: "${x}") types.str;
 in
 {
@@ -40,7 +41,7 @@ in
       visible = "shallow";
     };
     process = {
-      argv = lib.mkOption {
+      argv = mkOption {
         type = types.listOf pathOrStr;
         example = lib.literalExpression ''[ (lib.getExe config.package) "--nobackground" ]'';
         description = ''
@@ -72,15 +73,12 @@ in
     };
 
     notificationProtocol = mkOption {
-      type = types.listOf (
-        types.enum [
-          "systemd"
-          "s6"
-        ]
-      );
-
-      default = [ ];
-      apply = v: lib.unique v;
+      type = types.submodule {
+        options = {
+          systemd = mkEnableOption "Whether the service supports systemd-notify.";
+          s6 = mkEnableOption "Whether the service supports s6-notify.";
+        };
+      };
       description = ''
         Notification protocol that this service supports with the underlying service manager.
       '';
@@ -90,13 +88,20 @@ in
   config = {
     assertions = [
       {
-        assertion = config.process.reloadSignal != null && config.process.reloadCommand != null;
+        # `reloadSignal` derives `reloadCommand` at `mkDefault` priority below, so a
+        # conflict only exists when the user *also* set `reloadCommand` explicitly.
+        # An explicit (non-`mkDefault`) definition has `defaultOverridePriority`.
+        assertion =
+          !(
+            config.process.reloadSignal != null
+            && options.process.reloadCommand.highestPrio <= lib.modules.defaultOverridePriority
+          );
         message = "reloadSignal conflicts with reloadCommand. Please either use reloadSignal or reloadCommand.";
       }
     ];
 
-    process.reloadCommand = (lib.mkIf config.process.reloadSignal != null) (
-      lib.mkForce "${pkgs.coreutils}/bin/kill -${config.process.reloadSignal} $MAINPID"
+    process.reloadCommand = lib.mkIf (config.process.reloadSignal != null) (
+      lib.mkDefault "${pkgs.coreutils}/bin/kill -${config.process.reloadSignal} $MAINPID"
     );
   };
 }

maintainers/maintainer-list.nix

@@ -4691,6 +4691,12 @@
     githubId = 53847249;
     name = "Casey Avila";
   };
+  caspersonn = {
+    email = "lucakasper8@gmail.com";
+    github = "Caspersonn";
+    githubId = 96787412;
+    name = "Luca Kasper";
+  };
   cassandracomar = {
     name = "Cassandra Comar";
     github = "cassandracomar";
@@ -19819,6 +19825,12 @@
     githubId = 364510;
     name = "Tobias Geerinckx-Rice";
   };
+  ndavd = {
+    email = "email@ndavd.com";
+    github = "ndavd";
+    githubId = 74260683;
+    name = "Nuno David";
+  };
   ndl = {
     email = "ndl@endl.ch";
     github = "ndl";
@@ -19931,6 +19943,12 @@
     name = "neo";
     email = "chojs990222@gmail.com";
   };
+  neobrain = {
+    github = "neobrain";
+    githubId = 4840017;
+    matrix = "@neobrain:matrix.org";
+    name = "Tony Wasserka";
+  };
   neonvoid = {
     email = "me@neonvoid.dev";
     github = "neonvoidx";
@@ -24994,6 +25012,12 @@
     githubId = 47582;
     name = "Samir Talwar";
   };
+  samiser = {
+    email = "nixos@me.samiser.xyz";
+    github = "samiser";
+    githubId = 32001364;
+    name = "Sam";
+  };
   samlich = {
     email = "nixos@samli.ch";
     github = "samlich";

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -77,6 +77,12 @@
 
 - A number of options for `services.llama-cpp` have been removed in favor of the structured [](#opt-services.llama-cpp.settings) option, attributes from which are used as arguments to `llama-server` executable, you can see all available options by running `llama-server --help`. Configuring model presets using Nix attribute set via `services.llama-cpp.modelsPreset` is no longer supported, please use `services.llama-cpp.settings.models-preset` with a path to an INI file containing desired options.
 
+- The `NIX_XDG_DESKTOP_PORTAL_DIR` environment variable is no longer used in the `xdg-desktop-portal` package and is therefore no longer set in `xdg.portal` module.
+  Instead the `XDG_DATA_DIRS` environment variable is used to find xdg-portals.
+
+  If you were relying on `NIX_XDG_DESKTOP_PORTAL_DIR` to point at custom portal
+  definitions, add the package providing them to `xdg.portal.extraPortals`.
+
 - Python 2 has been removed from the top-level package set, as it is long past end-of-life. The `python2`, `python27`, `python2Full`, `python27Full`, `python2Packages`, and `python27Packages` attributes, along with the legacy `python`, `pythonFull`, and `pythonPackages` aliases, now throw an error directing you to `python3`. The `isPy2` and `isPy27` package flags have been removed accordingly. The only remaining Python 2 interpreter is vendored inside the `resholve` package for its `oil` dependency and is not exposed for general use.
 
 - `security.polkit.enablePkexecWrapper` has been introduced, making the `pkexec` setuid wrapper opt-in.

nixos/modules/config/xdg/portal.nix

@@ -116,6 +116,8 @@ in
       packages = [ pkgs.xdg-desktop-portal ] ++ cfg.extraPortals;
     in
     mkIf cfg.enable {
+      programs.fuse.enable = true;
+
       warnings = lib.optional (cfg.configPackages == [ ] && cfg.config == { }) ''
         xdg-desktop-portal 1.17 reworked how portal implementations are loaded, you
         should either set `xdg.portal.config` or `xdg.portal.configPackages`
@@ -150,7 +152,6 @@ in
 
         sessionVariables = {
           NIXOS_XDG_OPEN_USE_PORTAL = mkIf cfg.xdgOpenUsePortal "1";
-          NIX_XDG_DESKTOP_PORTAL_DIR = "/run/current-system/sw/share/xdg-desktop-portal/portals";
         };
 
         etc = lib.concatMapAttrs (

nixos/modules/services/display-managers/dms-greeter.nix

@@ -4,7 +4,6 @@
   pkgs,
   ...
 }:
-
 let
   inherit (lib)
     types
@@ -24,13 +23,27 @@ let
   cfgAutoLogin = config.services.displayManager.autoLogin;
   sessionData = config.services.displayManager.sessionData;
 
+  # Miracle WM is nested under `programs.wayland.miracle-wm` unlike the rest
+  compositorOption =
+    if cfg.compositor.name == "miracle-wm" then "wayland.miracle-wm" else "${cfg.compositor.name}";
   cacheDir = "/var/lib/dms-greeter";
 
+  # Not all compositor packages match the name they use and Miracle does not have a package option
+  compositorPkg =
+    if cfg.compositor.name == "miracle-wm" then
+      pkgs.miracle-wm
+    else
+      lib.attrByPath [
+        "programs"
+        cfg.compositor.name
+        "package"
+      ] null config;
+
   greeterScript = pkgs.writeShellScriptBin "dms-greeter-start" ''
     export PATH=$PATH:${
       makeBinPath [
         cfg.quickshell.package
-        config.programs.${cfg.compositor.name}.package
+        compositorPkg
       ]
     }
     ${
@@ -123,6 +136,9 @@ in
           "niri"
           "hyprland"
           "sway"
+          "mangowc"
+          "miracle-wm"
+          "labwc"
         ];
         example = "niri";
         description = ''
@@ -135,6 +151,9 @@ in
           - niri: A scrollable-tiling Wayland compositor
           - hyprland: A dynamic tiling Wayland compositor
           - sway: An i3-compatible Wayland compositor
+          - mango: A dwm-inspired Wayland compositor with modern config options and multiple layouts
+          - miracle-wm: A keyboard-driven Wayland compositor with smooth animations and extensibility
+          - labwc: Lightweight stacking Wayland compositor inspired by Openbox
         '';
       };
 
@@ -242,12 +261,16 @@ in
   config = mkIf cfg.enable {
     assertions = [
       {
-        assertion = config.programs.${cfg.compositor.name}.enable or false;
+        assertion =
+          # Assemble the full attribute structure because miracle-wm is not nested in the same location as the others
+          lib.attrByPath (
+            [ "programs" ] ++ lib.splitString "." compositorOption ++ [ "enable" ]
+          ) false config;
         message = ''
           DankMaterialShell greeter: The compositor "${cfg.compositor.name}" is not enabled.
 
           Please enable the compositor via:
-            programs.${cfg.compositor.name}.enable = true;
+            programs.${compositorOption}.enable = true;
         '';
       }
       {

nixos/modules/services/mail/rspamd.nix

@@ -506,6 +506,7 @@ in
         CapabilityBoundingSet = "";
         DevicePolicy = "closed";
         LockPersonality = true;
+        MemoryDenyWriteExecute = false; # pcre2 jit
         NoNewPrivileges = true;
         PrivateDevices = true;
         PrivateMounts = true;

nixos/modules/services/misc/jellyfin.nix

@@ -33,7 +33,11 @@ let
     ;
   cfg = config.services.jellyfin;
   filteredDecodingCodecs = builtins.filter (
-    c: c != "hevcRExt10bit" && c != "hevcRExt12bit" && cfg.transcoding.hardwareDecodingCodecs.${c}
+    c:
+    c != "hevc10bit"
+    && c != "hevcRExt10bit"
+    && c != "hevcRExt12bit"
+    && cfg.transcoding.hardwareDecodingCodecs.${c}
   ) (builtins.attrNames cfg.transcoding.hardwareDecodingCodecs);
   encodingXmlText = ''
     <?xml version="1.0" encoding="utf-8"?>
@@ -58,6 +62,7 @@ let
       <AllowAv1Encoding>${boolToString cfg.transcoding.hardwareEncodingCodecs.av1}</AllowAv1Encoding>
       <EnableIntelLowPowerH264HwEncoder>${boolToString cfg.transcoding.enableIntelLowPowerEncoding}</EnableIntelLowPowerH264HwEncoder>
       <EnableIntelLowPowerHevcHwEncoder>${boolToString cfg.transcoding.enableIntelLowPowerEncoding}</EnableIntelLowPowerHevcHwEncoder>
+      <EnableDecodingColorDepth10Hevc>${boolToString cfg.transcoding.hardwareDecodingCodecs.hevc10bit}</EnableDecodingColorDepth10Hevc>
       <EnableDecodingColorDepth10HevcRext>${boolToString cfg.transcoding.hardwareDecodingCodecs.hevcRExt10bit}</EnableDecodingColorDepth10HevcRext>
       <EnableDecodingColorDepth12HevcRext>${boolToString cfg.transcoding.hardwareDecodingCodecs.hevcRExt12bit}</EnableDecodingColorDepth12HevcRext>
       <HardwareDecodingCodecs>

nixos/modules/services/misc/paperless.nix

@@ -24,6 +24,8 @@ let
     GRANIAN_HOST = cfg.address;
     GRANIAN_PORT = toString cfg.port;
     GRANIAN_WORKERS_KILL_TIMEOUT = "60";
+    # django-allauth uses python requests, which doesn't use the systems CA bundle by default: https://requests.readthedocs.io/en/latest/user/advanced/#ca-certificates
+    REQUESTS_CA_BUNDLE = config.security.pki.caBundle;
   }
   // lib.optionalAttrs (config.time.timeZone != null) {
     PAPERLESS_TIME_ZONE = config.time.timeZone;

nixos/modules/services/x11/display-managers/lightdm-greeters/enso-os.nix

@@ -1,122 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-with lib;
-let
-  dmcfg = config.services.xserver.displayManager;
-  ldmcfg = dmcfg.lightdm;
-  cfg = ldmcfg.greeters.enso;
-
-  theme = cfg.theme.package;
-  icons = cfg.iconTheme.package;
-  cursors = cfg.cursorTheme.package;
-
-  ensoGreeterConf = pkgs.writeText "lightdm-enso-os-greeter.conf" ''
-    [greeter]
-    default-wallpaper=${ldmcfg.background}
-    gtk-theme=${cfg.theme.name}
-    icon-theme=${cfg.iconTheme.name}
-    cursor-theme=${cfg.cursorTheme.name}
-    blur=${toString cfg.blur}
-    brightness=${toString cfg.brightness}
-    ${cfg.extraConfig}
-  '';
-in
-{
-  options = {
-    services.xserver.displayManager.lightdm.greeters.enso = {
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Whether to enable enso-os-greeter as the lightdm greeter
-        '';
-      };
-
-      theme = {
-        package = mkPackageOption pkgs "gnome-themes-extra" { };
-        name = mkOption {
-          type = types.str;
-          default = "Adwaita";
-          description = ''
-            Name of the theme to use for the lightdm-enso-os-greeter
-          '';
-        };
-      };
-
-      iconTheme = {
-        package = mkPackageOption pkgs "papirus-icon-theme" { };
-        name = mkOption {
-          type = types.str;
-          default = "ePapirus";
-          description = ''
-            Name of the icon theme to use for the lightdm-enso-os-greeter
-          '';
-        };
-      };
-
-      cursorTheme = {
-        package = mkPackageOption pkgs "capitaine-cursors" { };
-        name = mkOption {
-          type = types.str;
-          default = "capitane-cursors";
-          description = ''
-            Name of the cursor theme to use for the lightdm-enso-os-greeter
-          '';
-        };
-      };
-
-      blur = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Whether or not to enable blur
-        '';
-      };
-
-      brightness = mkOption {
-        type = types.int;
-        default = 7;
-        description = ''
-          Brightness
-        '';
-      };
-
-      extraConfig = mkOption {
-        type = types.lines;
-        default = "";
-        description = ''
-          Extra configuration that should be put in the greeter.conf
-          configuration file
-        '';
-      };
-    };
-  };
-
-  config = mkIf (ldmcfg.enable && cfg.enable) {
-    environment.etc."lightdm/greeter.conf".source = ensoGreeterConf;
-
-    environment.systemPackages = [
-      cursors
-      icons
-      theme
-    ];
-
-    services.xserver.displayManager.lightdm = {
-      greeter = mkDefault {
-        package = pkgs.lightdm-enso-os-greeter.xgreeters;
-        name = "pantheon-greeter";
-      };
-
-      greeters = {
-        gtk = {
-          enable = mkDefault false;
-        };
-      };
-    };
-  };
-}

nixos/modules/services/x11/display-managers/lightdm.nix

@@ -83,7 +83,6 @@ in
   imports = [
     ./lightdm-greeters/gtk.nix
     ./lightdm-greeters/mini.nix
-    ./lightdm-greeters/enso-os.nix
     ./lightdm-greeters/pantheon.nix
     ./lightdm-greeters/lomiri.nix
     ./lightdm-greeters/tiny.nix
@@ -107,6 +106,9 @@ in
         "user"
       ]
     )
+    (lib.mkRemovedOptionModule [ "services" "xserver" "displayManager" "lightdm" "greeters" "enso" ]
+      "services.xserver.displayManager.lightdm.greeters.enso has been removed following removal of the corresponding package."
+    )
   ];
 
   options = {

nixos/modules/system/service/systemd/service.nix

@@ -126,33 +126,29 @@ in
         `%i` (instance), `%t` (runtime directory), and environment variables using
         `''${VAR}` syntax in your command line.
 
-        By default, it is either set to null or this is set to the escaped version of {option}`process.reloadCommand`
-        when specified to prevent systemd substitution. Set this option explicitly to enable
-        systemd's substitution features.
+        By default, it is set to {option}`process.reloadCommand` when specified, or an
+        empty string otherwise. Because {option}`process.reloadCommand` is already a
+        command line (not an argument list), it is used verbatim so that references
+        like `$MAINPID` are preserved.
 
         To extend {option}`process.reloadCommand` with systemd specifiers, you can append
-        to the escaped arguments:
+        to the command line:
 
         ```nix
         systemd.mainExecReload =
-          config.systemd.lib.escapeSystemdExecArgs config.process.reload + " --systemd-unit %n";
+          config.process.reloadCommand + " --systemd-unit %n";
         ```
 
         This pattern allows you to pass the unit name (or other systemd specifiers)
-        as additional arguments while keeping the base command from {option}`process.argv`
-        properly escaped.
+        as additional arguments.
 
         See {manpage}`systemd.service(5)` (section "COMMAND LINES") for details on
         variable substitution and {manpage}`systemd.unit(5)` (section "SPECIFIERS")
         for available specifiers like `%n`, `%i`, `%t`.
       '';
       type = types.nullOr types.str;
-      default =
-        if config.process.reloadCommand then
-          config.systemd.lib.escapeSystemdExecArgs config.process.reloadCommand
-        else
-          "";
-      defaultText = lib.literalExpression "config.systemd.lib.escapeSystemdExecArgs config.process.reloadCommand";
+      default = if config.process.reloadCommand != null then config.process.reloadCommand else "";
+      defaultText = lib.literalExpression "config.process.reloadCommand";
     };
 
     systemd.services = mkOption {
@@ -213,9 +209,7 @@ in
       wantedBy = lib.mkDefault [ "multi-user.target" ];
       serviceConfig = {
         ExecReload = config.systemd.mainExecReload;
-        Type = lib.mkDefault (
-          if (config.serviceManager.notificationProtocol == "systemd") then "notify" else "simple"
-        );
+        Type = lib.mkDefault (if config.notificationProtocol.systemd then "notify" else "simple");
         Restart = lib.mkDefault "always";
         RestartSec = lib.mkDefault "5";
         ExecStart = [

nixos/tests/jellyfin.nix

@@ -33,6 +33,7 @@
           hardwareDecodingCodecs = {
             h264 = true;
             hevc = true;
+            hevc10bit = true;
             vp9 = true;
             hevcRExt10bit = true;
             hevcRExt12bit = true;
@@ -174,7 +175,8 @@
           assert config.get("EnableIntelLowPowerH264HwEncoder") == True, f"Intel low power H264: expected True, got '{config.get('EnableIntelLowPowerH264HwEncoder')}'"
           assert config.get("EnableIntelLowPowerHevcHwEncoder") == True, f"Intel low power HEVC: expected True, got '{config.get('EnableIntelLowPowerHevcHwEncoder')}'"
 
-          # HEVC RExt color depth verification
+          # HEVC color depth verification
+          assert config.get("EnableDecodingColorDepth10Hevc") == True, f"HEVC 10bit: expected True, got '{config.get('EnableDecodingColorDepth10Hevc')}'"
           assert config.get("EnableDecodingColorDepth10HevcRext") == True, f"HEVC RExt 10bit: expected True, got '{config.get('EnableDecodingColorDepth10HevcRext')}'"
           assert config.get("EnableDecodingColorDepth12HevcRext") == True, f"HEVC RExt 12bit: expected True, got '{config.get('EnableDecodingColorDepth12HevcRext')}'"
 

nixos/tests/system-services-compliance.nix

@@ -7,6 +7,23 @@
 
 let
   sharedDir = "/tmp/modular-service-compliance";
+
+  inherit (pkgs) lib coreutils;
+
+  evalSystemServices =
+    services:
+    evalSystem (
+      { ... }:
+      {
+        system.services = services;
+        system.stateVersion = "25.05";
+        fileSystems."/" = {
+          device = "/test/dummy";
+          fsType = "auto";
+        };
+        boot.loader.grub.enable = false;
+      }
+    );
 in
 let
   suite = pkgs.testers.modularServiceCompliance {
@@ -15,23 +32,13 @@ let
     evalConfig =
       { services }:
       let
-        machine = evalSystem (
-          { ... }:
-          {
-            system.services = services;
-            system.stateVersion = "25.05";
-            fileSystems."/" = {
-              device = "/test/dummy";
-              fsType = "auto";
-            };
-            boot.loader.grub.enable = false;
-          }
-        );
+        machine = evalSystemServices services;
       in
       {
         config = machine.config.system.services;
         checkDrv = machine.config.system.build.toplevel;
       };
+    callReload = path: "systemctl reload ${lib.concatStringsSep "-" path}.service";
     mkTest =
       {
         name,
@@ -49,6 +56,80 @@ let
         meta.maintainers = with pkgs.lib.maintainers; [ roberth ];
       };
   };
+
+  # systemd-specific eval assertions. serviceConfig.Type/ExecReload only exist on
+  # the resolved host units, so a fresh eval is used per case.
+  systemdEvalTests =
+    let
+      defaultUnits =
+        (evalSystemServices {
+          service.process.argv = [ "${coreutils}/bin/true" ];
+        }).config.systemd.services;
+
+      notifyUnits =
+        (evalSystemServices {
+          service = {
+            process.argv = [ "${coreutils}/bin/true" ];
+            notificationProtocol.systemd = true;
+          };
+        }).config.systemd.services;
+
+      reloadUnits =
+        (evalSystemServices {
+          service = {
+            process.argv = [ "${coreutils}/bin/true" ];
+            process.reloadSignal = "HUP";
+          };
+        }).config.systemd.services;
+    in
+    {
+      testDefaultType = {
+        expr = defaultUnits.service.serviceConfig.Type;
+        expected = "simple";
+      };
+
+      testNotifyType = {
+        expr = notifyUnits.service.serviceConfig.Type;
+        expected = "notify";
+      };
+
+      testReloadExecReload = {
+        expr = reloadUnits.service.serviceConfig.ExecReload;
+        expected = "${coreutils}/bin/kill -HUP $MAINPID";
+      };
+    };
+
+  systemdEval = pkgs.stdenvNoCC.mkDerivation (finalAttrs: {
+    __structuredAttrs = true;
+    name = "system-services-compliance-systemd-eval-report";
+    passthru = {
+      tests = systemdEvalTests;
+      failures = lib.runTests finalAttrs.finalPackage.tests;
+    };
+    testResults = lib.mapAttrs (_: test: test.expr == test.expected) finalAttrs.finalPackage.tests;
+    buildCommand = ''
+      touch $out
+      for testName in "''${!testResults[@]}"; do
+        if [[ -n "''${testResults[$testName]}" ]]; then
+          echo "PASS  $testName"
+        else
+          echo "FAIL  $testName"
+        fi
+      done
+    ''
+    + lib.optionalString (lib.any (v: !v) (lib.attrValues finalAttrs.testResults)) ''
+      {
+        echo ""
+        echo "systemd-specific eval-level compliance failures:"
+        for testName in "''${!testResults[@]}"; do
+          if [[ -z "''${testResults[$testName]}" ]]; then
+            echo "- $testName"
+          fi
+        done
+      } >&2
+      exit 1
+    '';
+  });
 in
 
 # Please the callTest pattern.
@@ -64,4 +145,4 @@ pkgs.lib.mapAttrs (
       test = v;
       driver = v;
     }
-) suite
+) (suite // { systemd-eval = systemdEval; })

pkgs/applications/editors/sublime/4/packages.nix

@@ -11,9 +11,9 @@ in
   } { };
 
   sublime4-dev = common {
-    buildVersion = "4205";
+    buildVersion = "4206";
     dev = true;
-    x64sha256 = "1Tg8m4FNrVOeHK6VSmlua30pW4Bu7Gz+sT0t/w01UyM=";
-    aarch64sha256 = "K94UipUVZRh8xJKYW35be0u9L/VHpZ+FYhC26v41b3U=";
+    x64sha256 = "WZ+MfKnOYTTfVbyW2QRstkAOhAxEv4nXsxsQnnAeA6I=";
+    aarch64sha256 = "opMVWTGsPQSb/SpN4Cz9CC8jL42BaqO/da6uC++6t3o=";
   } { };
 }

pkgs/applications/editors/vim/plugins/non-generated/fff-nvim/default.nix

@@ -13,18 +13,18 @@
   writableTmpDirAsHomeHook,
 }:
 let
-  version = "0.10.0";
+  version = "0.10.1";
   src = fetchFromGitHub {
     owner = "dmtrKovalenko";
     repo = "fff";
     tag = "v${version}";
-    hash = "sha256-nrstsxOxHTeSKkqpvyxdzyypfHU6wZBQpvNnCfjh9s4=";
+    hash = "sha256-GGoy8ghA87vwHEc0fi97uiBrpRTAGk/QgqzKu8BBRXo=";
   };
   fff-nvim-lib = rustPlatform.buildRustPackage {
     pname = "fff-nvim-lib";
     inherit version src;
 
-    cargoHash = "sha256-Nlf2Bxwe5KvZF0unpeK/mMFmv4NM+IKPpFOopXoNRxU=";
+    cargoHash = "sha256-sOE3Zrs/ZtOIusH0+OvR1Ew5sfQfse6eWSLPwDPVSU4=";
 
     cargoBuildFlags = [
       "-p"

pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix

@@ -21,22 +21,22 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-nDKqXhU97h0iBPPFASaCSzEdi6H48IW1rn4iB9cD36Y=";
+          hash = "sha256-Y6MXjJBmhMzuQMwhkPLHK/vtciTdjsGvkEblH3ofju0=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-gIN2FE6ROma6v3vJX/Wi+OqFrq5/YV7kJXNMwGRw0Z8=";
+          hash = "sha256-8VvDtb+8SoLTRC7pXwH40amRurxTQgCmhdi0u7e5AfU=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-rb50iFTniwhY/iqsKBN4jfV4j+RxjLF126opVkReyGA=";
+          hash = "sha256-bqjEgsjY+zyG1g/KtkRNxAlazIpc+HwGWvsMQNnPI2M=";
         };
       };
     in
     {
       name = "claude-code";
       publisher = "anthropic";
-      version = "2.1.217";
+      version = "2.1.218";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

pkgs/applications/editors/vscode/extensions/default.nix

@@ -1096,8 +1096,8 @@ let
         mktplcRef = {
           name = "csharpier-vscode";
           publisher = "csharpier";
-          version = "10.0.3";
-          hash = "sha256-YTDpBGLbyM6Nq5DlEtqFiSsSRRECLIEqSM4xgIIVWG0=";
+          version = "11.0.0";
+          hash = "sha256-LVGIKCW2z2Y2k0qPmJZZO66W3E9UDBtl5EnycanMPxA=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/csharpier.csharpier-vscode/changelog";
@@ -1375,8 +1375,8 @@ let
         mktplcRef = {
           name = "competitive-programming-helper";
           publisher = "DivyanshuAgrawal";
-          version = "2026.6.1780853884";
-          hash = "sha256-4nxH5qW3u3/9Vqf+QFs7l5BDusE5wcxxHiJFcPq/2EE=";
+          version = "2026.7.1784455023";
+          hash = "sha256-mUiQ+35R1HXC+23qYKRJwV61poEsyhY2NkDizU+QMx8=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/DivyanshuAgrawal.competitive-programming-helper/changelog";
@@ -2346,8 +2346,8 @@ let
         mktplcRef = {
           name = "vscode-vibrancy-continued";
           publisher = "illixion";
-          version = "1.1.84";
-          hash = "sha256-NijfD83LfEAsYsZtKwj/sBVqzpXht6pvtVZCQUUdfq0=";
+          version = "1.1.85";
+          hash = "sha256-hHbBg7h8iab8ArbiuEx+a5zqr02hIu8DGHnvh0XwH9g=";
         };
         meta = {
           downloadPage = "https://marketplace.visualstudio.com/items?itemName=illixion.vscode-vibrancy-continued";

pkgs/applications/emulators/wibo/default.nix

@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
         meta.license = lib.licenses.unfree;
       };
     in
-    lib.optionalString finalAttrs.doCheck ''
+    lib.optionalString finalAttrs.finalPackage.doCheck ''
       MWCIncludes=../test ./wibo ${gc}/GC/2.7/mwcceppc.exe -c ../test/test.c
       file test.o | grep "ELF 32-bit"
     '';

pkgs/applications/networking/cluster/helm/plugins/helm-dt.nix

@@ -5,13 +5,13 @@
 }:
 buildGoModule rec {
   pname = "helm-dt";
-  version = "0.8.0";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "vmware-labs";
     repo = "distribution-tooling-for-helm";
     tag = "v${version}";
-    hash = "sha256-KjIlmioDyj79jCnEi+Iimdg0eZruHdeD9JorkJbifJg=";
+    hash = "sha256-ytbwUfjPpvKxX6d24ifCyeD1WtFpzA52QniMImTun+c=";
   };
 
   vendorHash = "sha256-dkE3eYZnaS+kC0kDVxaFW/Ev15TY2MY3m5xgPof7Y18=";

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -1067,11 +1067,11 @@
     "vendorHash": null
   },
   "ovh_ovh": {
-    "hash": "sha256-01xbvlVgdpRXPw7S1J067cj92ogfcBOzC6y+/PTWtRM=",
+    "hash": "sha256-BKaPKG9xuRq2rNxkMJnN428woyeK0NnssZaJRrGutoM=",
     "homepage": "https://registry.terraform.io/providers/ovh/ovh",
     "owner": "ovh",
     "repo": "terraform-provider-ovh",
-    "rev": "v2.16.1",
+    "rev": "v2.17.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },

pkgs/applications/networking/instant-messengers/profanity/default.nix

@@ -95,7 +95,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   # see also: https://profanity-im.github.io/guide/latest/build.html#expl
   mesonFlags = [
-    (lib.mesonBool "tests" finalAttrs.doCheck)
+    (lib.mesonBool "tests" finalAttrs.finalPackage.doCheck)
     (lib.mesonEnable "notifications" notifySupport)
     (lib.mesonEnable "python-plugins" pythonPluginSupport)
     (lib.mesonEnable "c-plugins" true)

pkgs/applications/networking/mailreaders/thunderbird/packages.nix

@@ -92,8 +92,8 @@ rec {
   thunderbird-140 = common {
     applicationName = "Thunderbird ESR";
 
-    version = "140.12.1esr";
-    sha512 = "24e795483ba7bc112c0debe1becdaf79cc2de95703b9ee726d0216bfc1db7b33c169503f83ac867e5998a8d1d0284a6ef12c7d35d98b10d6432497c2db237477";
+    version = "140.13.0esr";
+    sha512 = "778d2fc2837ba367e90c4336f3873da5a0823c182e2f50aa9373cd1ee9ee2b5310372ad9d33e1e11978791b67de4a6952d3036ff7d57b257a06f49c8cd4a830e";
 
     updateScript = callPackage ./update.nix {
       attrPath = "thunderbirdPackages.thunderbird-140";

pkgs/applications/science/logic/coq/default.nix

@@ -19,7 +19,7 @@
   ocamlPackages_4_10,
   ocamlPackages_4_12,
   ocamlPackages_4_14,
-  ocamlPackages_5_4,
+  ocamlPackages_5_5,
   rocqPackages, # for versions >= 9.0 that are transition shims on top of Rocq
   ncurses,
   buildIde ? null, # default is true for Coq < 8.14 and false for Coq >= 8.14
@@ -76,6 +76,7 @@ let
     "9.1.0".sha256 = "sha256-+QL7I1/0BfT87n7lSaOmpHj2jJuDB4idWhAxwzvVQOE=";
     "9.1.1".sha256 = "sha256-aFsGsFzexyDnOVarHPKs35HjiV8uUCpeOKSl15wXZ4s=";
     "9.2.0".sha256 = "sha256-rVhv2GLImdVPgRwwTQ+wiWNtRUflMrES0ElIrdTIN1s=";
+    "9.3+rc1".sha256 = "sha256-vGJkRRzf8ur7i9IUpRA/sxVEQvZGnxfV/ex28Lt1kWw=";
   };
   releaseRev = v: "V${v}";
   fetched =
@@ -140,12 +141,15 @@ let
           case = lib.versions.range "8.7" "8.10";
           out = ocamlPackages_4_09;
         }
-      ] ocamlPackages_5_4;
+      ] ocamlPackages_5_5;
   ocamlNativeBuildInputs = [
     ocamlPackages.ocaml
     ocamlPackages.findlib
   ]
   ++ lib.optional (coqAtLeast "8.14") dune;
+  ocamlBuildInputs = [
+    ocamlPackages.findlib
+  ];
   ocamlPropagatedBuildInputs =
     [ ]
     ++ lib.optional (!coqAtLeast "8.10") ocamlPackages.camlp5
@@ -225,6 +229,7 @@ let
     buildInputs = [
       ncurses
     ]
+    ++ ocamlBuildInputs
     ++ lib.optionals buildIde (
       if coqAtLeast "8.10" then
         [
@@ -328,11 +333,18 @@ let
       platforms = lib.platforms.unix;
       mainProgram = if buildIde then "coqide" else "coqtop";
     };
+
+    # Things required by the CI
+    strictDeps = true;
+    __structuredAttrs = true;
   };
 in
 if coqAtLeast "8.21" then
   self.overrideAttrs (o: {
     # coq-core is now a shim for rocq
+    nativeBuildInputs = o.nativeBuildInputs ++ [
+      rocqPackages.rocq-core
+    ];
     propagatedBuildInputs = o.propagatedBuildInputs ++ [
       rocqPackages.rocq-core
     ];

pkgs/applications/science/logic/rocq-core/default.nix

@@ -14,7 +14,7 @@
   dune,
   customOCamlPackages ? null,
   ocamlPackages_4_14,
-  ocamlPackages_5_4,
+  ocamlPackages_5_5,
   ncurses,
   csdp ? null,
   version,
@@ -29,6 +29,7 @@ let
     "9.1.0".sha256 = "sha256-+QL7I1/0BfT87n7lSaOmpHj2jJuDB4idWhAxwzvVQOE=";
     "9.1.1".sha256 = "sha256-aFsGsFzexyDnOVarHPKs35HjiV8uUCpeOKSl15wXZ4s=";
     "9.2.0".sha256 = "sha256-rVhv2GLImdVPgRwwTQ+wiWNtRUflMrES0ElIrdTIN1s=";
+    "9.3+rc1".sha256 = "sha256-vGJkRRzf8ur7i9IUpRA/sxVEQvZGnxfV/ex28Lt1kWw=";
   };
   releaseRev = v: "V${v}";
   fetched =
@@ -66,12 +67,15 @@ let
       in
       lib.switch rocq-version [
         (case (range "9.0" "9.1") ocamlPackages_4_14)
-      ] ocamlPackages_5_4;
+      ] ocamlPackages_5_5;
   ocamlNativeBuildInputs = [
     ocamlPackages.ocaml
     ocamlPackages.findlib
     dune
   ];
+  ocamlBuildInputs = [
+    ocamlPackages.findlib
+  ];
   ocamlPropagatedBuildInputs = [ ocamlPackages.zarith ];
   self = stdenv.mkDerivation {
     pname = "rocq";
@@ -130,7 +134,7 @@ let
     };
 
     nativeBuildInputs = [ pkg-config ] ++ ocamlNativeBuildInputs;
-    buildInputs = [ ncurses ];
+    buildInputs = [ ncurses ] ++ ocamlBuildInputs;
 
     propagatedBuildInputs = ocamlPropagatedBuildInputs;
 
@@ -196,6 +200,10 @@ let
       platforms = lib.platforms.unix;
       mainProgram = "rocq";
     };
+
+    # Things required by the CI
+    strictDeps = true;
+    __structuredAttrs = true;
   };
 in
 self

pkgs/applications/virtualization/docker/default.nix

@@ -420,18 +420,18 @@ in
 
   docker_29 =
     let
-      version = "29.6.1";
+      version = "29.6.2";
     in
     callPackage dockerGen {
       inherit version;
       cliRev = "v${version}";
-      cliHash = "sha256-cpK2UMRP/WXHsehG9Sq5UJAjhMesmXTrhe00y4RMRZc=";
+      cliHash = "sha256-WpPSePMCfWAVxCkX1nZyI+sra/Vug009ZPmnVKDaX0I=";
       mobyRev = "docker-v${version}";
-      mobyHash = "sha256-gv+mea9X5TYDWN3IBRpmw0+R2waGxCiubdatNTeUQZI=";
+      mobyHash = "sha256-zrvrZCRUuiZ2vixZNOUFeGmDehHzSI+FzDMzV1gMqMc=";
       runcRev = "v1.3.6";
       runcHash = "sha256-cBMYZOElWHQ4OkF2NlYJSZrlW4833WD8CRJRkkXeKJc=";
-      containerdRev = "v2.2.5";
-      containerdHash = "sha256-3ui+0AjEU6H4VHYwF3G85ggVMUdONCLJ5KfciFasmkk=";
+      containerdRev = "v2.2.6";
+      containerdHash = "sha256-Ngo9x847cXFYPnj/0I+g7BeV7e1/5T2YXfA1zkIdiPg=";
       tiniRev = "369448a167e8b3da4ca5bca0b3307500c3371828";
       tiniHash = "sha256-jCBNfoJAjmcTJBx08kHs+FmbaU82CbQcf0IVjd56Nuw=";
     };

pkgs/build-support/testers/modular-service-compliance.nix

@@ -15,6 +15,7 @@
   evalConfig,
   mkTest,
   sharedDir,
+  callReload,
   namePrefix ? "modular-service-compliance",
 }:
 
@@ -45,6 +46,11 @@ let
           ];
           warnings = [ "compliance child warning" ];
         };
+        # A sub-service exercising reload derivation from a reload signal.
+        services.reloadee = {
+          process.argv = [ "${coreutils}/bin/true" ];
+          process.reloadSignal = "HUP";
+        };
       };
     };
   };
@@ -65,7 +71,7 @@ let
       };
 
       testAssertions = {
-        expr = builtins.elem {
+        expr = lib.elem {
           assertion = true;
           message = "compliance test assertion";
         } c.assertions;
@@ -73,12 +79,12 @@ let
       };
 
       testWarnings = {
-        expr = builtins.elem "compliance test warning" c.warnings;
+        expr = lib.elem "compliance test warning" c.warnings;
         expected = true;
       };
 
       testSubServiceAssertions = {
-        expr = builtins.elem {
+        expr = lib.elem {
           assertion = true;
           message = "compliance child assertion";
         } c.services.child.assertions;
@@ -86,14 +92,58 @@ let
       };
 
       testSubServiceWarnings = {
-        expr = builtins.elem "compliance child warning" c.services.child.warnings;
+        expr = lib.elem "compliance child warning" c.services.child.warnings;
+        expected = true;
+      };
+
+      # The reload-conflict assertion must not fire (its `assertion` must hold) for a
+      # service that sets only reloadSignal (guards the inverted-assertion fix, and the
+      # priority-aware conflict detection: reloadSignal derives reloadCommand internally,
+      # which must not be mistaken for a user-set conflict).
+      testNoReloadConflict = {
+        expr = lib.any (
+          a:
+          a.message
+          == "reloadSignal conflicts with reloadCommand. Please either use reloadSignal or reloadCommand."
+          && !a.assertion
+        ) c.services.reloadee.assertions;
+        expected = false;
+      };
+
+      # Setting process.reloadSignal derives process.reloadCommand
+      # (guards the misplaced-paren mkIf fix).
+      testReloadSignalDerivesCommand = {
+        expr = c.services.reloadee.process.reloadCommand;
+        expected = "${coreutils}/bin/kill -HUP $MAINPID";
+      };
+
+      # notificationProtocol submodule bools default to false.
+      testNotificationProtocolSystemdDefault = {
+        expr = c.notificationProtocol.systemd;
+        expected = false;
+      };
+
+      testNotificationProtocolS6Default = {
+        expr = c.notificationProtocol.s6;
+        expected = false;
+      };
+
+      # Setting both reloadSignal and reloadCommand explicitly is a genuine conflict,
+      # so the assertion must fire. Separate eval: checkDrv would fail on this.
+      testReloadConflictFires = {
+        expr = lib.any (
+          a:
+          a.message
+          == "reloadSignal conflicts with reloadCommand. Please either use reloadSignal or reloadCommand."
+          && !a.assertion
+        ) conflictEval.config.conflict.assertions;
         expected = true;
       };
 
       # Separate eval for a failing assertion — checkDrv would fail here,
       # so we only access config.
       testFailingAssertionValue = {
-        expr = builtins.elem {
+        expr = lib.elem {
           assertion = false;
           message = "compliance failing assertion";
         } failingEval.config.failing.assertions;
@@ -101,6 +151,16 @@ let
       };
     };
 
+  conflictEval = evalConfig {
+    services = {
+      conflict = {
+        process.argv = [ "${coreutils}/bin/true" ];
+        process.reloadSignal = "HUP";
+        process.reloadCommand = "${coreutils}/bin/kill -HUP $MAINPID";
+      };
+    };
+  };
+
   failingEval = evalConfig {
     services = {
       failing = {
@@ -129,6 +189,24 @@ let
     exec "${coreutils}/bin/sleep" infinity
   '';
 
+  /**
+    A reloadable service script. Like `svc`, it namespaces a comms subdirectory
+    by its first argument and records the remaining arguments. It traps SIGHUP
+    and appends a marker line to `$dir/reloads` on each reload, then stays alive
+    as the trapping shell itself (no `exec`, so the trap and MAINPID are kept).
+  */
+  reloadableSvc = writeShellScript "${namePrefix}-reloadable-svc" ''
+    id="$1"; shift
+    dir="${sharedDir}/$id"
+    mkdir -p "$dir"
+    : > "$dir/reloads"
+    reload() { printf 'reloaded\n' >> "$dir/reloads"; }
+    trap reload HUP
+    echo "$$" > "$dir/pid"
+    printf '%s\n' "$@" > "$dir/args"
+    while true; do "${coreutils}/bin/sleep" 1; done
+  '';
+
   mkArgv =
     id: extraArgs:
     [
@@ -171,6 +249,27 @@ let
       inherit text;
     });
 
+  # The reload runtime test's service tree. The reloadable unit is the *sub*-service,
+  # so its name path `[ "reload" "inner" ]` handed to `callReload` exercises the
+  # integration's nested unit naming (NixOS dash-joins to `reload-inner.service`).
+  reloadServices = {
+    reload = {
+      # Parent must run something; a bare keep-alive is enough.
+      process.argv = [
+        reloadableSvc
+        "reload-parent"
+      ];
+      services.inner.process = {
+        argv = [
+          reloadableSvc
+          "reload-inner"
+        ];
+        # The script traps SIGHUP; reloadSignal derives the manager's reload command.
+        reloadSignal = "HUP";
+      };
+    };
+  };
+
 in
 {
   # Eval-level tests: config structure, evaluated in the integration's
@@ -186,9 +285,9 @@ in
     representative = evalResult.checkDrv;
     passthru = {
       tests = evalTestDefs;
-      failures = lib.runTests finalAttrs.passthru.tests;
+      failures = lib.runTests finalAttrs.finalPackage.tests;
     };
-    testResults = lib.mapAttrs (_: test: test.expr == test.expected) finalAttrs.passthru.tests;
+    testResults = lib.mapAttrs (_: test: test.expr == test.expected) finalAttrs.finalPackage.tests;
     buildCommand = ''
       touch $out
       for testName in "''${!testResults[@]}"; do
@@ -247,5 +346,26 @@ in
     '';
   };
 
+  # Runtime reload: start a reloadable service, ask the integration to reload it,
+  # and assert the service observed the reload (recorded a SIGHUP marker).
+  reload = mkTest {
+    name = "${namePrefix}-reload";
+    services = reloadServices;
+    testExe = mkTestScript "reload" ''
+      ${waitAndCheck "reload-inner" [ ]}
+      ${callReload [
+        "reload"
+        "inner"
+      ]}
+      timeout=30; elapsed=0
+      while ! grep -qx "reloaded" "${sharedDir}/reload-inner/reloads" && [ "$elapsed" -lt "$timeout" ]; do
+        sleep 1; elapsed=$((elapsed + 1))
+      done
+      grep -qx "reloaded" "${sharedDir}/reload-inner/reloads" \
+        || { echo "reload: no reload recorded after ''${timeout}s"; cat "${sharedDir}/reload-inner/reloads"; exit 1; }
+      echo "reload: reload observed"
+    '';
+  };
+
   # See also the manual compliance items in doc/build-helpers/testers.chapter.md.
 }

pkgs/by-name/af/afew/package.nix

@@ -3,8 +3,7 @@
   python3Packages,
   fetchPypi,
   pkgs,
-  testers,
-  afew,
+  versionCheckHook,
 }:
 
 python3Packages.buildPythonApplication (finalAttrs: {
@@ -39,6 +38,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   nativeCheckInputs = [
     pkgs.notmuch
+    versionCheckHook
   ]
   ++ (with python3Packages; [
     freezegun
@@ -55,12 +55,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
     "man"
   ];
 
-  passthru.tests = {
-    version = testers.testVersion {
-      package = afew;
-    };
-  };
-
   meta = {
     homepage = "https://github.com/afewmail/afew";
     description = "Initial tagging script for notmuch mail";

pkgs/by-name/ap/apfel-llm/package.nix

@@ -8,7 +8,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "apfel-llm";
-  version = "1.8.3";
+  version = "1.8.4";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
   # Building from source requires swift 6.3.0 while nixpkgs only has 5.10.1
   src = fetchurl {
     url = "https://github.com/Arthur-Ficial/apfel/releases/download/v${finalAttrs.version}/apfel-${finalAttrs.version}-arm64-macos.tar.gz";
-    hash = "sha256-1AA86f5+Poo5YCrtxT1rAPGBctQbNa5hdAZmI008/yU=";
+    hash = "sha256-farvPPo3VU2qUat+72qaiMpcd9LwFO7kqzGGKKtPwGE=";
   };
 
   sourceRoot = ".";

pkgs/by-name/ap/apko/package.nix

@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "apko";
-  version = "1.2.25";
+  version = "1.2.27";
 
   src = fetchFromGitHub {
     owner = "chainguard-dev";
     repo = "apko";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-IRiW4sZZyzqmYGxNEmLZgbRb/z+Gfbn5bi4ci3/Rz4g=";
+    hash = "sha256-yu7DGFscciEVRshiUYHNo9QEggljbSOFLX/dl2LYsFU=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -29,7 +29,7 @@ buildGoModule (finalAttrs: {
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-  vendorHash = "sha256-nms4bDB9z4H2IbMO49bri0aQBiBfVj4kzVqwzURZ75c=";
+  vendorHash = "sha256-4aQAnmmnwEPAZE/ph/xyQWcW+thfVX42dpFQq296Hf4=";
 
   excludedPackages = [
     "internal/gen-jsonschema"

pkgs/by-name/ap/apparmor-parser/package.nix

@@ -51,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
     "POD2HTML=${lib.getExe' buildPackages.perl "pod2html"}"
     "MANDIR=share/man"
   ]
-  ++ lib.optional finalAttrs.doCheck "PROVE=${lib.getExe' perl "prove"}";
+  ++ lib.optional finalAttrs.finalPackage.doCheck "PROVE=${lib.getExe' perl "prove"}";
 
   installFlags = [
     "DESTDIR=$(out)"

pkgs/by-name/ar/ardour/package.nix

@@ -193,7 +193,7 @@ let
       # https://discourse.ardour.org/t/ardour-8-2-released/109615/8
       # "--use-external-libs"
     ]
-    ++ lib.optional finalAttrs.doCheck "--test"
+    ++ lib.optional finalAttrs.finalPackage.doCheck "--test"
     ++ lib.optional optimize "--optimize";
 
     env = {

pkgs/by-name/ar/artalk/package.nix

@@ -3,7 +3,7 @@
   buildGoModule,
   fetchFromGitHub,
   nodejs,
-  pnpm_9,
+  pnpm_10,
   fetchPnpmDeps,
   pnpmConfigHook,
   installShellFiles,
@@ -31,14 +31,14 @@ let
     nativeBuildInputs = [
       nodejs
       pnpmConfigHook
-      pnpm_9
+      pnpm_10
     ];
 
     pnpmDeps = fetchPnpmDeps {
       inherit (finalAttrs) pname version src;
-      pnpm = pnpm_9;
-      fetcherVersion = 3;
-      hash = "sha256-HypDGYb0MRCIDBHY8pVgwFoZQWC8us44cunORZRk3RM=";
+      pnpm = pnpm_10;
+      fetcherVersion = 4;
+      hash = "sha256-RSz/bx8/BAqLZH3/yQ6/H/nnwGvcCg8EzIEJ4/xkQgQ=";
     };
 
     buildPhase = ''

pkgs/by-name/at/atuin/package.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "atuin";
-  version = "18.17.0";
+  version = "18.17.1";
 
   src = fetchFromGitHub {
     owner = "atuinsh";
     repo = "atuin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cciogPSlbfiC9U3Dv+IGyuRI9PU9X4LdlequCFiG/a0=";
+    hash = "sha256-9wfeAqtE6HLNvQHdGlLX6Kv1kakmojgY14RVW/WpOSs=";
   };
 
-  cargoHash = "sha256-QX1JupLZafRdMUZjl58iFjiPgLSTYZazRVyU88n5QP8=";
+  cargoHash = "sha256-l2TX8thT+MnWhrTyD4ryapJkDg43mb2IurGDnyk2b74=";
 
   # atuin's default features include 'check-updates', which do not make sense
   # for distribution builds. List all other default features.

pkgs/by-name/az/azure-cli/extensions-manual.nix

@@ -345,9 +345,9 @@
 
   vm-repair = mkAzExtension rec {
     pname = "vm-repair";
-    version = "2.2.0";
+    version = "2.2.1";
     url = "https://azcliprod.blob.core.windows.net/cli-extensions/vm_repair-${version}-py2.py3-none-any.whl";
-    hash = "sha256-ppsK4rJa/nFFkO2XJvjnK0PIRp9/haVwWfqfF7oN5WQ=";
+    hash = "sha256-k/6ATtYT2YXaHm5nbb0Tf7xE98Oz9svRlbjodCOOuo8=";
     description = "Support for repairing Azure Virtual Machines";
     propagatedBuildInputs = with python3Packages; [ opencensus ];
     meta.maintainers = [ ];

pkgs/by-name/be/bellepoule/package.nix

@@ -2,9 +2,9 @@
   lib,
   stdenv,
   fetchgit,
-  goocanvas_1,
+  goocanvas_2,
   pkg-config,
-  gtk2,
+  gtk3,
   libxml2,
   curl,
   libmicrohttpd,
@@ -39,11 +39,11 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [
-    gtk2
+    gtk3
     libxml2
     curl
     libmicrohttpd
-    goocanvas_1
+    goocanvas_2
     qrencode
     openssl
     json-glib
@@ -59,17 +59,27 @@ stdenv.mkDerivation (finalAttrs: {
     "DESTDIR=$(out)"
   ];
 
-  # Use system php
-  # Disable git soft depend
-  # Disable dch changelog generation
-  # FixUp `install` phase output
   postPatch = ''
+    # Use system php
     substituteInPlace ./sources/common/network/web_server.cpp --replace-fail "php7.4" "${php}/bin/php"
+
+    # FixUp desktop templates to point to our own output
     substituteInPlace ./build/BellePoule/debian/bellepoule.desktop.template --replace-fail "/usr" "$out"
+
+    # FixUp erroneous properties in glade files tripping-up GTK2 -> GTK3 upgrade (identation is intentional here)
+    # Such as https://git.launchpad.net/bellepoule/tree/resources/glade/contest.glade?h=5.0/master#n197
+    substituteInPlace ./resources/glade/*.glade --replace "            <property name=\"homogeneous\">True</property>" ""
+
+    # Disable git soft depend
+    # Disable dch changelog generation
+    # FixUp output path
+    # Upgrade GTK2 -> GTK3, goocanvas1 -> goocanvas2
     substituteInPlace ./build/BellePoule/Makefile \
       --replace-fail "git" "#git" \
       --replace-fail "dch" "echo Ignoring: dch" \
-      --replace-fail "/usr" ""
+      --replace-fail "/usr" "" \
+      --replace-fail "gtk+-2.0" "gtk+-3.0" \
+      --replace-fail "GOO = goocanvas" "GOO = goocanvas-2.0"
   '';
 
   # Prepare release directory for buildPhase

pkgs/by-name/bi/bitcoin-knots/package.nix

@@ -151,7 +151,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "WITH_USDT" enableTracing)
     (lib.cmakeFeature "RDTS_CONSENT" "RUNTIME_WARN")
   ]
-  ++ lib.optionals (!finalAttrs.doCheck) [
+  ++ lib.optionals (!finalAttrs.finalPackage.doCheck) [
     (lib.cmakeBool "BUILD_TESTS" false)
     (lib.cmakeBool "BUILD_FUZZ_BINARY" false)
     (lib.cmakeBool "BUILD_GUI_TESTS" false)

pkgs/by-name/bi/bitcoin/package.nix

@@ -158,7 +158,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "WITH_ZMQ" true)
     (lib.cmakeBool "WITH_USDT" enableTracing)
   ]
-  ++ lib.optionals (!finalAttrs.doCheck) [
+  ++ lib.optionals (!finalAttrs.finalPackage.doCheck) [
     (lib.cmakeBool "BUILD_TESTS" false)
     (lib.cmakeBool "BUILD_FUZZ_BINARY" false)
     (lib.cmakeBool "BUILD_GUI_TESTS" false)

pkgs/by-name/bl/blazesym-c/package.nix

@@ -9,24 +9,27 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "blazesym-c";
-  version = "0.1.8";
+  version = "0.1.9";
 
   src = fetchFromGitHub {
     owner = "libbpf";
     repo = "blazesym";
     tag = "capi-v${finalAttrs.version}";
-    hash = "sha256-IdeY9FCGziYN9glnvQJu2oa5ogdXb6D9QcY2MRnq7vA=";
+    hash = "sha256-gaDNRVcoI6Nc1zWEwS49FhKPep4uI5560t3AaIRCYfw=";
   };
 
-  cargoHash = "sha256-fsvdhahTKxjrrH9z6m1k3cTkXfMUZXZNZlYRi3tgTlA=";
+  cargoHash = "sha256-ZLGtskOe38fBP8o8zIezzsNwY4Xwr7UnVrbx1KysEis=";
 
   cargoBuildFlags = [
     "--package"
     "blazesym-c"
   ];
 
-  nativeCheckInputs = [
+  nativeBuildInputs = [
     pkg-config
+  ];
+
+  buildInputs = [
     elfutils
     zlib
   ];

pkgs/by-name/bo/bolt-launcher/package.nix

@@ -136,7 +136,7 @@ buildFHSEnv {
       with pkgs;
       [
         gtk2-x11
-        openssl_1_1
+        # openssl_1_1
       ]
     );
 
@@ -166,5 +166,8 @@ buildFHSEnv {
     ];
     platforms = lib.platforms.linux;
     mainProgram = "bolt-launcher";
-  };
+  }
+  // (lib.optionalAttrs enableRS3 {
+    problems.broken.message = "OpenSSL 1.1 has been end of life since 2023 and will be removed soon.";
+  });
 }

pkgs/by-name/br/brave/package.nix

@@ -3,20 +3,20 @@
 
 let
   pname = "brave";
-  version = "1.92.141";
+  version = "1.92.143";
 
   allArchives = {
     aarch64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_arm64.deb";
-      hash = "sha256-FVzXaVpyfX+GIVofy3NfpE8rOH+9LjQpdEoEWQV0DqI=";
+      hash = "sha256-IHBJm9uow2d/X4Z9e117aGdP1Y+3R1ApWu40sPtdbr8=";
     };
     x86_64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-      hash = "sha256-A87vCTtcyuNMPLaLYDjgyIm85zwAXNc3Z4ImtC9Kjek=";
+      hash = "sha256-jaxNneurduBiw3jho5Fp7gXnBfSpLB5hlE06i/JK+ic=";
     };
     aarch64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-arm64.zip";
-      hash = "sha256-b4BmNt+c0CSrtS2n+30gdWrSsFOQSZnFAy2vWbGJz6g=";
+      hash = "sha256-EvfZgO8FAijof1Ml6gqSOyRndL8KYFdT0MNmVmuxAnU=";
     };
   };
 

pkgs/by-name/br/brlcad/package.nix

@@ -227,7 +227,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   cmakeFlags = [
     (lib.cmakeBool "BRLCAD_ENABLE_STRICT" false)
-    (lib.cmakeBool "BUILD_TESTING" finalAttrs.doCheck)
+    (lib.cmakeBool "BUILD_TESTING" finalAttrs.finalPackage.doCheck)
     (lib.cmakeBool "BRLCAD_ENABLE_QT" enableQt)
     (lib.cmakeFeature "GTE_INCLUDE_DIR" "${gtmathematics}/include/gtmathematics")
     (lib.cmakeFeature "LMDB_LIBRARY" "${lmdb.out}/lib/liblmdb${stdenv.hostPlatform.extensions.sharedLibrary}")

pkgs/by-name/bu/buck2/hashes.json

@@ -1,17 +1,17 @@
 {
   "aarch64-darwin": {
-    "buck2": "sha256-zBZ2gEPRxyaBYmnRfYfhYDqswqfiXvxYDHrUI92Z1UQ=",
-    "rust-project": "sha256-K86j0E32w0DUwzpPT0NBUiL3rV4Ze8hzfbKDkpy9JXo="
-  },
-  "x86_64-linux": {
-    "buck2": "sha256-IqDsyQ7Omy7QujT85oKrWwyirG7gwfupdxzvRoMRmQs=",
-    "rust-project": "sha256-iFSko4FTvAVlKUxJE/6FzR6H7V2SryRfEi7nRhfyhxQ="
+    "buck2": "sha256-CIysxyxAD6Q4vkBSw2eC9Wsq+GKHqt8T7OXpdy1yRVw=",
+    "rust-project": "sha256-o5m58wQ9zKkpa5GzgLpcLUV9LpA+n+MxVa/9hH9Tr40="
   },
   "aarch64-linux": {
-    "buck2": "sha256-VKV1vltATu3tAPmMiifba7MV9kNFH754FDda6i8cQrU=",
-    "rust-project": "sha256-oqxHdbNzQn1KHObboAd4/LTbilIJgLqMiWCgHLaPFrc="
+    "buck2": "sha256-4jm/cvQKeYfbkCTrbV4yVkL2SWxYnexr5UwQCNJhihk=",
+    "rust-project": "sha256-vGSOwVETwYqwBhkxlSTDJlVcMfbAIzYwDhEKbqz+6ok="
   },
-  "version": "2026-04-15",
-  "preludeGit": "f0896771c4cc1ab8f87e032c5293376c89e5096b",
-  "preludeFod": "sha256-Ga4q9zzifgFDGx0TbcbBoDN29H3A4s1BZnSwwv9Mix0="
+  "x86_64-linux": {
+    "buck2": "sha256-7MPYB90LD+/xpCNoi9WYJjuDOdIj5oVXiocZZFbBnZU=",
+    "rust-project": "sha256-de0SbH6cbjdDhcPpDTjxBo5HgQ8yS1eokQYjQrHKIDY="
+  },
+  "version": "2026-07-15",
+  "preludeGit": "caed0b8c0ee137c4e5e1f800a5054df151f490c2",
+  "preludeFod": "sha256-nMHnBf4vQJIxPgarmLPY38b15DFW2FlAQxDCzJgB+w8="
 }

pkgs/by-name/bu/buck2/package.nix

@@ -55,19 +55,19 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "buck2";
-  version = "unstable-${buildHashes.version}"; # TODO (aseipp): kill 'unstable' once a non-prerelease is made
+  version = buildHashes.version;
 
   srcs = [
     # the platform-specific binary — which is also
     # zstd-compressed
     (fetchurl {
-      url = "https://github.com/facebook/buck2/releases/download/${lib.removePrefix "unstable-" finalAttrs.version}/buck2-${platform-suffix}.zst";
+      url = "https://github.com/facebook/buck2/releases/download/${finalAttrs.version}/buck2-${platform-suffix}.zst";
       hash = archHashes.buck2;
     })
     # rust-project, which is used to provide IDE integration Buck2 Rust projects,
     # is part of the official distribution
     (fetchurl {
-      url = "https://github.com/facebook/buck2/releases/download/${lib.removePrefix "unstable-" finalAttrs.version}/rust-project-${platform-suffix}.zst";
+      url = "https://github.com/facebook/buck2/releases/download/${finalAttrs.version}/rust-project-${platform-suffix}.zst";
       hash = archHashes.rust-project;
     })
   ];
@@ -134,7 +134,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Fast, hermetic, multi-language build system";
     homepage = "https://buck2.build";
-    changelog = "https://github.com/facebook/buck2/releases/tag/${lib.removePrefix "unstable-" finalAttrs.version}";
+    changelog = "https://github.com/facebook/buck2/releases/tag/${finalAttrs.version}";
     license = with lib.licenses; [
       asl20 # or
       mit

pkgs/by-name/bu/buildah-unwrapped/package.nix

@@ -18,13 +18,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "buildah";
-  version = "1.44.0";
+  version = "1.44.1";
 
   src = fetchFromGitHub {
     owner = "podman-container-tools";
     repo = "buildah";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/Rv5la54ikmP4qVT19tg0sv0kM+xpQO6w9XU1PpGFk4=";
+    hash = "sha256-EGoH+PvePNw7I28Vq1kH9W0x4lYuUTSa1Rd+fEE8fkc=";
   };
 
   outputs = [

pkgs/by-name/bu/burpsuite/package.nix

@@ -15,7 +15,7 @@ assert lib.assertMsg (
 
 let
   pname = "burpsuite";
-  version = "2026.6";
+  version = "2026.7";
 
   src = fetchurl {
     name = "burpsuite.jar";
@@ -24,7 +24,7 @@ let
       "https://portswigger.net/burp/releases/download?product=desktop&version=${version}&type=Jar"
       "https://web.archive.org/web/https://portswigger.net/burp/releases/download?product=desktop&version=${version}&type=Jar"
     ];
-    hash = "sha256-nafdpcXgWpuIinmgYp+uXkfoFkQfhFRsDaxsh+Rgb3M=";
+    hash = "sha256-vZcCNFVEHg1zkhAjSqc6vVzFaU0YdZ27AF+eHLfLazs=";
   };
 
   description = "Integrated platform for performing security testing of web applications";

pkgs/by-name/ca/cargo-edit/package.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-edit";
-  version = "0.13.11";
+  version = "0.13.13";
 
   src = fetchFromGitHub {
     owner = "killercup";
     repo = "cargo-edit";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-u4mjbIs9rLZOZ4MUITc4QYnfEcTyZT5aXt6U7fwefoo=";
+    hash = "sha256-yaY6krZ+kt2g3Wnnzsw4P3xnpsaZuNwFfRk9GLvwps8=";
   };
 
-  cargoHash = "sha256-1PCncmiY+olGGMOT2AfIbGY5sup4ysPVqdBmuecDWk0=";
+  cargoHash = "sha256-Q4GDA81w0JR9rcpKSPe9Y+9HPpFdAvYP2RI+91R4NWE=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/ca/cargo-expand/package.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-expand";
-  version = "1.0.123";
+  version = "1.0.124";
 
   src = fetchFromGitHub {
     owner = "dtolnay";
     repo = "cargo-expand";
     tag = finalAttrs.version;
-    hash = "sha256-vd63DpKLZpE+fIdfy4gp9PDSSLICPXZdrjk7hMB9L0A=";
+    hash = "sha256-deGIcij3Tczsqc0HTBGUbncdUXKP+FGj5R+2fevQULA=";
   };
 
-  cargoHash = "sha256-mLpihgQ5PNRE72xWRHgcA8KxujR7Pi4bGnwahOQJ4qo=";
+  cargoHash = "sha256-MYaKNoz8h5bt0/Z+8PwLKZDvIWUUCfsvB5vibMaDmf4=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;

pkgs/by-name/cd/cdk8s-cli/package.nix

@@ -12,18 +12,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cdk8s-cli";
-  version = "2.207.40";
+  version = "2.207.41";
 
   src = fetchFromGitHub {
     owner = "cdk8s-team";
     repo = "cdk8s-cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-bSqvHUw9J9cmMqexZurVS14WFdD8budmjPGZ3Z6yOkc=";
+    hash = "sha256-O1L5cHw8Rrj7bwHJ1tH7idKivSPHyV/9ma8iQ5w87OY=";
   };
 
   yarnOfflineCache = fetchYarnDeps {
     inherit (finalAttrs) src;
-    hash = "sha256-wmT/CBAebKlaue9/TVRwoe8pavA6Fl+9D+3FbUK3+SM=";
+    hash = "sha256-ShQbJUhLfgPEYHtQ7XgvXuYNt5xOjzT7VorbBLT21us=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/cl/claude-code/manifest.json

@@ -1,47 +1,47 @@
 {
-  "version": "2.1.217",
-  "commit": "9963b018d22c3e6659c99e135e687870301b5c67",
-  "buildDate": "2026-07-21T18:45:36Z",
+  "version": "2.1.218",
+  "commit": "bce61b433bc397ce68686368abd12f545b0a013a",
+  "buildDate": "2026-07-22T18:42:19Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude",
-      "checksum": "5840c777fd47115e9ca276e165563c6e121e7c7e2b4d86598e0025f8cc37de56",
-      "size": 250456784
+      "checksum": "71abaff59312c9a9b6a1d818365048b42e4e95cc521a823660eded3e0880d9b7",
+      "size": 255069680
     },
     "darwin-x64": {
       "binary": "claude",
-      "checksum": "8387a6fd44edfd40d7e74c5fdc3270a15f5e6b1b58c7c6fee560e70d3d1943da",
-      "size": 259908496
+      "checksum": "9862b74a083e8a4ed572f99cbd4895185e0dd5a0a601affb0fb8e43d8d1f40e6",
+      "size": 264548368
     },
     "linux-arm64": {
       "binary": "claude",
-      "checksum": "40c53507ac669c1d438366c19760c22f52748a06e50e0fc0e353d2cb73425597",
-      "size": 265337760
+      "checksum": "295fd30481bd03b38450fdec2a6e25bb6472c2074f04b0c4a566cd5988f230bf",
+      "size": 269990816
     },
     "linux-x64": {
       "binary": "claude",
-      "checksum": "2630fc5dc6db61bc03f86b95daf47766e5ed5b61873f7bb7cfea764c5ac5a9ba",
-      "size": 268573680
+      "checksum": "e12071751a9336b8af1012c103358ff04ac18f9aaff4a738cff7ba5cdfaf63f2",
+      "size": 273177584
     },
     "linux-arm64-musl": {
       "binary": "claude",
-      "checksum": "e219a631e194e71bccbea2f81f5678c75f745aa6e7a74e8a407610c906d1299b",
-      "size": 258585960
+      "checksum": "efcaae48f8f537a0e9a47b4317a5f8c184706c99ddd8ca0a9a21391e2a766ef8",
+      "size": 263239016
     },
     "linux-x64-musl": {
       "binary": "claude",
-      "checksum": "7c44188927edbf7b918b41bc7a284292359b1ad556b7802db0148adb4b395732",
-      "size": 263197264
+      "checksum": "62986293277153f5db97404cf7e3e96de136f02c28f79ccd5c7bc99766224db4",
+      "size": 267801168
     },
     "win32-x64": {
       "binary": "claude.exe",
-      "checksum": "6e4a3a4679f381178a90cf741de9ce924a3274304b09277695ac3a679628ca17",
-      "size": 259460768
+      "checksum": "81fcf59bb7abb558aedc6f2361f4723b3d757d28e799962d88b18b4520df66ca",
+      "size": 263931552
     },
     "win32-arm64": {
       "binary": "claude.exe",
-      "checksum": "f0128e1a50b8d7dec5bb4dbdff0ef622f617e798df61ebb009ed3f03d2afe613",
-      "size": 253836448
+      "checksum": "a7959fd87feb9557d56f4e5752f7ed1ddf405f3bea91b2571bf93af636efd193",
+      "size": 258307232
     }
   },
   "sdkCompat": {
@@ -67,7 +67,8 @@
       "0.3.207",
       "0.3.208",
       "0.3.209",
-      "0.3.215"
+      "0.3.215",
+      "0.3.217"
     ],
     "harnessSchema": 1
   }

pkgs/by-name/cl/cliamp/package.nix

@@ -16,16 +16,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "cliamp";
-  version = "1.57.1";
+  version = "1.61.0";
 
   src = fetchFromGitHub {
     owner = "bjarneo";
     repo = "cliamp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wRXF2bnl3xFJtuESJX2UVSsPwl4xo6E+k7nIdtzCULo=";
+    hash = "sha256-BbyaZw+OvC6rb60Z2whhHj2iKow/ZJJ8VzuwPX7bHIE=";
   };
 
-  vendorHash = "sha256-A2Ygc1a9e2flZzaNAEXvr8Ui1cE89TxBfUNALmDzIo0=";
+  vendorHash = "sha256-KYjP6qEINdSlcDSEMKxMwDfXzuQPAQSe4oZh+o4PrFs=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/cl/clickhouse/package.nix

@@ -1,6 +1,6 @@
 import ./generic.nix {
-  version = "26.6.1.1193-stable";
-  rev = "6615864161fd5332edfcb2864658bd9ccc65197b";
-  hash = "sha256-S+JJ/bOziG6w+9GSe+KDT2GliL3osRf4Y+WI8x5n2CI=";
+  version = "26.7.1.1315-stable";
+  rev = "a6156303df65c307bdb8b66e9e9cc5637346a6b8";
+  hash = "sha256-jCUSLYmhRLIUvDw3JYDtqmcjW92aJBzfFHyCAtxvlsY=";
   lts = false;
 }

pkgs/by-name/cl/closurecompiler/package.nix

@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
     mkdir -p $out/share/java $out/bin
     cp ${finalAttrs.src} $out/share/java/closure-compiler-v${finalAttrs.version}.jar
     makeWrapper ${jre}/bin/java $out/bin/closure-compiler \
-      --add-flags "-jar $out/share/java/closure-compiler-v${finalAttrs.version}.jar"
+      --add-flags "\$NIX_JAVA_ARGS -jar $out/share/java/closure-compiler-v${finalAttrs.version}.jar"
   '';
 
   meta = {

pkgs/by-name/cm/cmocka/package.nix

@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [ cmake ];
 
   cmakeFlags =
-    lib.optional finalAttrs.doCheck "-DUNIT_TESTING=ON"
+    lib.optional finalAttrs.finalPackage.doCheck "-DUNIT_TESTING=ON"
     ++ lib.optional stdenv.hostPlatform.isStatic "-DBUILD_SHARED_LIBS=OFF";
 
   doCheck = true;

pkgs/by-name/co/code-cursor/sources.json

@@ -1,18 +1,18 @@
 {
-  "version": "3.12.17",
+  "version": "3.12.30",
   "vscodeVersion": "1.128.0",
   "sources": {
     "x86_64-linux": {
-      "url": "https://downloads.cursor.com/production/0fb762053c34788bb7760d5673f8a6d4c8589d52/linux/x64/Cursor-3.12.17-x86_64.AppImage",
-      "hash": "sha256-Fu00p0vaLNOl9wbGgtseLwhseXxmIQMyyhlNF7VZ+qM="
+      "url": "https://downloads.cursor.com/production/63a2996a10d9e476b6c28e951dd7691d9c0cf480/linux/x64/Cursor-3.12.30-x86_64.AppImage",
+      "hash": "sha256-7gyF8YtWLjFOjAxhqip2fVxTbaBj/4FtLsjw2JpTOD8="
     },
     "aarch64-linux": {
-      "url": "https://downloads.cursor.com/production/0fb762053c34788bb7760d5673f8a6d4c8589d52/linux/arm64/Cursor-3.12.17-aarch64.AppImage",
-      "hash": "sha256-/r6lFrSq7aSefGvOWqLw/YmyUy3VocaWRyOUHoHuSeM="
+      "url": "https://downloads.cursor.com/production/63a2996a10d9e476b6c28e951dd7691d9c0cf480/linux/arm64/Cursor-3.12.30-aarch64.AppImage",
+      "hash": "sha256-UKPf2q4py0pN5FlgdwGbTEKA52T7iJpM63z2kemz9h8="
     },
     "aarch64-darwin": {
-      "url": "https://downloads.cursor.com/production/0fb762053c34788bb7760d5673f8a6d4c8589d52/darwin/arm64/Cursor-darwin-arm64.dmg",
-      "hash": "sha256-WaUBglq+Jqa1Cn0sx62ccbBSKhYiBz1u1PjdHxcfQKE="
+      "url": "https://downloads.cursor.com/production/63a2996a10d9e476b6c28e951dd7691d9c0cf480/darwin/arm64/Cursor-darwin-arm64.dmg",
+      "hash": "sha256-uxAWl5wJISEbGSv7yHys29NZDquLe7z6wMNb61HC/7g="
     }
   }
 }

pkgs/by-name/co/concord-tui/package.nix

@@ -11,16 +11,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "concord-tui";
-  version = "2.4.1";
+  version = "2.4.5";
 
   src = fetchFromGitHub {
     owner = "chojs23";
     repo = "concord";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3c5jxpJrBr6vYnbcJIYD06d932Da94hXUZA5FLa3kkU=";
+    hash = "sha256-BLfNgIXTTYMr5pFmCBMfu4euKR96GAPLsGTW/AaqJjo=";
   };
 
-  cargoHash = "sha256-6iAyKsS+FoNCKkMvbL70vKSPoAaKQtUDiAQGaEMuxWk=";
+  cargoHash = "sha256-jaHDy/5e9BXXLRe3oc9g3JCCSg28bb1d2dMPkPJTkB4=";
 
   buildInputs = [
     opus

pkgs/by-name/co/conduktor/package.nix

@@ -1,89 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  fetchzip,
-  jdk11,
-  openjfx17,
-  gtk3,
-  glib,
-  pango,
-  cairo,
-  gdk-pixbuf,
-  libxtst,
-  makeBinaryWrapper,
-  makeDesktopItem,
-  copyDesktopItems,
-}:
-
-let
-  openjfx_jdk = openjfx17.override { withWebKit = true; };
-in
-stdenv.mkDerivation (finalAttrs: {
-  pname = "conduktor";
-  version = "2.24.9";
-
-  src = fetchzip {
-    url = "https://github.com/conduktor/builds/releases/download/v${finalAttrs.version}/Conduktor-linux-${finalAttrs.version}.zip";
-    hash = "sha256-c9QjlKPZpeJi5YTq4gm+sg7my4EP0LI95AfGguF4ork=";
-  };
-
-  nativeBuildInputs = [
-    makeBinaryWrapper
-    copyDesktopItems
-  ];
-
-  desktopItems = [
-    (makeDesktopItem {
-      type = "Application";
-      name = "conduktor";
-      desktopName = "Conduktor";
-      genericName = finalAttrs.meta.description;
-      exec = "conduktor";
-      icon = fetchurl {
-        url = "https://github.com/conduktor/builds/raw/v${finalAttrs.version}/.github/resources/Conduktor.png";
-        hash = "sha256-mk4c9ecookRb7gR56cedIWfPfQy2uGF+ZbX6NI90KI0=";
-      };
-      comment = "A beautiful and fully-featured desktop client for Apache Kafka";
-    })
-  ];
-
-  dontConfigure = true;
-  dontBuild = true;
-
-  installPhase = ''
-    runHook preInstall
-
-    cp -r . $out
-    wrapProgram $out/bin/conduktor \
-      --set JAVA_HOME ${jdk11.home} \
-      --set LD_LIBRARY_PATH ${
-        lib.makeLibraryPath [
-          openjfx_jdk
-          gtk3
-          gtk3
-          glib
-          pango
-          cairo
-          gdk-pixbuf
-          libxtst
-        ]
-      } \
-       --add-flags "--module-path ${openjfx_jdk}/lib --add-modules=javafx.controls,javafx.fxml"
-
-    runHook postInstall
-  '';
-
-  meta = {
-    description = "Apache Kafka Desktop Client";
-    longDescription = ''
-      Conduktor is a GUI over the Kafka ecosystem, to make the development
-      and management of Apache Kafka clusters as easy as possible.
-    '';
-    homepage = "https://www.conduktor.io/";
-    changelog = "https://www.conduktor.io/changelog/#${finalAttrs.version}";
-    license = lib.licenses.unfree;
-    maintainers = with lib.maintainers; [ trobert ];
-    platforms = lib.platforms.linux;
-  };
-})

pkgs/by-name/co/coroot/package.nix

@@ -11,16 +11,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "coroot";
-  version = "1.23.3";
+  version = "1.24.0";
 
   src = fetchFromGitHub {
     owner = "coroot";
     repo = "coroot";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-93WJv11NDk2/ScmdE4D2E8JmyBlP4FYuX7j4Jbm8bDE=";
+    hash = "sha256-50VB7qONhRQ5FehPH6uemA8+4HZin/vdJ7JmD0S7AEk=";
   };
 
-  vendorHash = "sha256-npMQah59pJqF6wgD2dlEleneIZbP/atDGEpjjb+KCpI=";
+  vendorHash = "sha256-P7EXBRG6OYIwaoObqpKBK2n0f6QYphr+DRNLbfysotA=";
   npmDeps = fetchNpmDeps {
     src = "${finalAttrs.src}/front";
     hash = "sha256-5N4dmtKdZgwulqxFHYKhnHOYAg0gnb/rzVVcmzjYFUg=";

pkgs/by-name/co/cotp/package.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cotp";
-  version = "1.9.10";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "replydev";
     repo = "cotp";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-yVzVo4l2bMZXrWlDfJXSgHUmic7Fe0Og+I5ROv3iQCQ=";
+    hash = "sha256-L/HxdNufqmNZ8pF8tQ1VuOJIz+pEQN5IRpmg2+QTYos=";
   };
 
-  cargoHash = "sha256-M0lI/DAMUVRMNbvoLc2w7PtU0rjjXiMYZM6vzfdEi0s=";
+  cargoHash = "sha256-Es9X9PDFeluHtPrOImLhWUstrawopX5yShdN0G7TuzI=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ libxcb ];
 

pkgs/by-name/cr/crosvm/package.nix

@@ -21,12 +21,12 @@
 
 rustPlatform.buildRustPackage {
   pname = "crosvm";
-  version = "0-unstable-2026-07-06";
+  version = "0-unstable-2026-07-15";
 
   src = fetchgit {
     url = "https://chromium.googlesource.com/chromiumos/platform/crosvm";
-    rev = "1378aabfc63333547e87b788a8204511da243166";
-    hash = "sha256-7cfiXOPlNHLIVHBW+y7WnYgdcxErtJeLBxPey/3uA1w=";
+    rev = "ffbf0df34699f9670db015962bac83d0d417d7e7";
+    hash = "sha256-4z1TXMGOvOMUAED1gluugHPF4mBigjDioxnFneQOIS8=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/cs/csvtk/package.nix

@@ -7,7 +7,7 @@
   buildPackages,
 }:
 let
-  version = "0.33.0";
+  version = "0.37.0";
 in
 buildGoModule {
   pname = "csvtk";
@@ -17,10 +17,13 @@ buildGoModule {
     owner = "shenwei356";
     repo = "csvtk";
     tag = "v${version}";
-    hash = "sha256-Zacs1hw4pryVNxnrkLIoBNWo0jcKjtYdx6kW2LTFEIs=";
+    hash = "sha256-dpWxLOckdA0tNhSM8wGqBag/cXmMFhonybN+W1+KBXA=";
   };
 
-  vendorHash = "sha256-T9flXxly3i8SKQlhp4AF2FNCqgcnGAHxv5b7nqzM3DI=";
+  vendorHash = "sha256-wi7WPwCg0MoNxgCLZO1UxG4M0g/Vo/GCiCGu8c5avyU=";
+
+  # stale upstream test: asserts byte length, but expr-lang now returns rune count
+  checkFlags = [ "-skip=TestMutate3" ];
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/ct/ctx7/package.nix

@@ -16,7 +16,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "ctx7";
-  version = "0.5.4";
+  version = "0.5.5";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "upstash";
     repo = "context7";
     tag = "${finalAttrs.pname}@${finalAttrs.version}";
-    hash = "sha256-yyz4UraRm1JR/C7J2ib0nBU6zsNpKCWIWduTu7OlebM=";
+    hash = "sha256-Ea281W/CT/TfFNFMKV7xQzXnMo/25mCAB/Gs9ofyUU4=";
   };
 
   nativeBuildInputs = [
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-S+TCwe4FJHjSLTUL/cPh+eRtWx/z7REUyfMNT0BgK7k=";
+    hash = "sha256-F1A0y4uZczVqzce0FfugCaU5Y2qqMZQXy7T6oqlgkbA=";
   };
 
   buildPhase = ''

pkgs/by-name/cu/cutter/package.nix

@@ -1,7 +1,6 @@
 {
   lib,
   fetchFromGitHub,
-  fetchpatch2,
   stdenv,
   # for passthru.plugins
   pkgs,
@@ -19,24 +18,16 @@
 let
   cutter = stdenv.mkDerivation rec {
     pname = "cutter";
-    version = "2.4.1";
+    version = "2.5.0";
 
     src = fetchFromGitHub {
       owner = "rizinorg";
       repo = "cutter";
       rev = "v${version}";
-      hash = "sha256-fNOznaFzWJ4Dve9U1+E4xPaznnyxae2jHNaBCdJzDyQ=";
+      hash = "sha256-dnVbtAp7TorPQx4qdK43L2pXMcnWvOYjhRC3MJBrAmM=";
       fetchSubmodules = true;
     };
 
-    patches = [
-      (fetchpatch2 {
-        name = "fix-shiboken6-type-index-case.patch";
-        url = "https://github.com/rizinorg/cutter/commit/07fea9c772dc573588dc2e5771f0740ee1883738.patch?full_index=1";
-        hash = "sha256-/C/s+Ui5F7MCxbzbChQ5Tv/oUHUQxXmk9xOnNI80xwQ=";
-      })
-    ];
-
     nativeBuildInputs = [
       cmake
       pkg-config

pkgs/by-name/cz/czkawka/package.nix

@@ -15,6 +15,7 @@
   libxi,
   libxkbcommon,
   libxrandr,
+  lld,
   pango,
   pkg-config,
   rustPlatform,
@@ -44,6 +45,9 @@ let
       gobject-introspection
       pkg-config
       wrapGAppsHook4
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      lld # ld crashes
     ];
 
     buildInputs = [

pkgs/by-name/di/di-tui/package.nix

@@ -2,17 +2,18 @@
   lib,
   nix-update-script,
   buildGoModule,
-  fetchFromGitHub,
+  fetchFromGitea,
 }:
 buildGoModule (finalAttrs: {
   pname = "di-tui";
-  version = "1.14.0";
+  version = "1.15.0";
 
-  src = fetchFromGitHub {
-    owner = "acaloiaro";
+  src = fetchFromGitea {
+    domain = "code.adriano.fyi";
+    owner = "me";
     repo = "di-tui";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-P784Tf3XA/28PgKTr89yizKAX1MhAb4877gV7vVHBYE=";
+    hash = "sha256-3dYcecrDSfd5sP5PjkagbFt2RmhaQSVw6kMt9J7wyeM=";
   };
 
   vendorHash = "sha256-b7dG0nSjPQpjWUbOlIxWudPZWKqtq96sQaJxKvsQT9I=";
@@ -21,7 +22,7 @@ buildGoModule (finalAttrs: {
 
   meta = {
     description = "Simple terminal UI player for di.fm";
-    homepage = "https://github.com/acaloiaro/di-tui";
+    homepage = "https://code.adriano.fyi/me/di-tui";
     license = lib.licenses.bsd2;
     maintainers = [ lib.maintainers.acaloiaro ];
     mainProgram = "di-tui";

pkgs/by-name/do/dokuwiki/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dokuwiki";
-  version = "2025-05-14b";
+  version = "2026-07-14a";
 
   src = fetchFromGitHub {
     owner = "dokuwiki";
     repo = "dokuwiki";
     rev = "release-${version}";
-    sha256 = "sha256-J7B+mvvGtAPK+WjlkHyadG61vli+zZfozfEmEynYQaE=";
+    sha256 = "sha256-qj+Ng20aB3qV2afrER309kvlh6gXRFPh3MqnomvvCf4=";
   };
 
   preload = writeText "preload.php" ''

pkgs/by-name/ea/earlybird/package.nix

@@ -14,13 +14,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "earlybird";
-  version = "4.6.0";
+  version = "4.6.1";
 
   src = fetchFromGitHub {
     owner = "americanexpress";
     repo = "earlybird";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-P8kA9MJA+2jtVOYLBu0oG9xTUTGCtiX4R+4ecmXDAAw=";
+    hash = "sha256-Wjvg0+IQHIB5wFwY+4grTOagk5fHMf6YlIB83Jv/ZwE=";
   };
 
   vendorHash = "sha256-pQ8gSDHsdDT/cgvRB0OSqnMZz2W5vAzFBzph0xksC2o=";

pkgs/by-name/ed/eddie/package.nix

@@ -17,7 +17,6 @@
   openvpn,
   stunnel,
 
-  gtk2,
   libayatana-indicator,
 
   mono,
@@ -70,7 +69,6 @@ buildDotnetModule (finalAttrs: {
   ];
 
   runtimeInputs = lib.makeLibraryPath [
-    gtk2
     gtk3
     libayatana-indicator
   ];

pkgs/by-name/el/elements/package.nix

@@ -64,7 +64,7 @@ stdenv.mkDerivation (finalAttrs: {
     "--with-boost-libdir=${boost.out}/lib"
     "--disable-bench"
   ]
-  ++ lib.optionals (!finalAttrs.doCheck) [
+  ++ lib.optionals (!finalAttrs.finalPackage.doCheck) [
     "--disable-tests"
     "--disable-gui-tests"
   ]

pkgs/by-name/es/esphome/package.nix

@@ -9,6 +9,7 @@
   esptool,
   git,
   versionCheckHook,
+  addBinToPathHook,
   nixosTests,
 }:
 
@@ -24,14 +25,14 @@ let
 in
 python.pkgs.buildPythonApplication (finalAttrs: {
   pname = "esphome";
-  version = "2026.6.2";
+  version = "2026.6.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "esphome";
     repo = "esphome";
     tag = finalAttrs.version;
-    hash = "sha256-h7aMPSXmIUutCGMoZlE3Z1wX2xNxdmZsHfBllcFHBHc=";
+    hash = "sha256-4sbc/X86OWN/Bx2sPk3H2lgzGxdQNS6bIspNLAVqHz8=";
   };
 
   patches = [
@@ -85,7 +86,6 @@ python.pkgs.buildPythonApplication (finalAttrs: {
     jinja2
     paho-mqtt
     pillow
-    platformio
     puremagic
     py7zr
     pyparsing
@@ -138,6 +138,7 @@ python.pkgs.buildPythonApplication (finalAttrs: {
     ++ [
       git
       versionCheckHook
+      addBinToPathHook
     ];
 
   disabledTestPaths = [
@@ -149,10 +150,6 @@ python.pkgs.buildPythonApplication (finalAttrs: {
     "tests/unit_tests/test_espidf_component.py"
   ];
 
-  preCheck = ''
-    export PATH=$PATH:$out/bin
-  '';
-
   postInstall =
     let
       argcomplete = lib.getExe' python.pkgs.argcomplete "register-python-argcomplete";
@@ -164,8 +161,6 @@ python.pkgs.buildPythonApplication (finalAttrs: {
         --fish <(${argcomplete} --shell fish esphome)
     '';
 
-  doInstallCheck = true;
-
   disabledTests = [
     # tries to import platformio, which is wrapped in an fhsenv
     "test_clean_build"
@@ -207,6 +202,7 @@ python.pkgs.buildPythonApplication (finalAttrs: {
       picnoir
       thanegill
       karlbeecken
+      tmarkus
     ];
     mainProgram = "esphome";
   };

pkgs/by-name/et/etherpad-lite/package.nix

@@ -3,7 +3,7 @@
   stdenv,
   fetchFromGitHub,
   nix-update-script,
-  pnpm_9,
+  pnpm_10,
   fetchPnpmDeps,
   pnpmConfigHook,
   makeWrapper,
@@ -30,14 +30,14 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
-    pnpm = pnpm_9;
-    fetcherVersion = 3;
-    hash = "sha256-2nKpmGxC+KVg0oF0BsswS9L84QxzpRF7NvKyqyQ7WJM=";
+    pnpm = pnpm_10;
+    fetcherVersion = 4;
+    hash = "sha256-scJhcZDyqUVdKv/EQvB5+EJN/SvMw220+QOcTUxTFJQ=";
   };
 
   nativeBuildInputs = [
     pnpmConfigHook
-    pnpm_9
+    pnpm_10
     makeWrapper
   ];
 
@@ -70,7 +70,7 @@ stdenv.mkDerivation (finalAttrs: {
     makeWrapper ${lib.getExe nodejs} $out/bin/etherpad-lite \
       --inherit-argv0 \
       --add-flags "--require tsx/cjs $out/lib/etherpad-lite/node_modules/ep_etherpad-lite/node/server.ts" \
-      --suffix PATH : "${lib.makeBinPath [ pnpm_9 ]}" \
+      --suffix PATH : "${lib.makeBinPath [ pnpm_10 ]}" \
       --set NODE_PATH "$out/lib/node_modules:$out/lib/etherpad-lite/node_modules/ep_etherpad-lite/node_modules" \
       --set-default NODE_ENV production
     find $out/lib -xtype l -delete

pkgs/by-name/ex/exim/package.nix

@@ -39,11 +39,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "exim";
-  version = "4.99.4";
+  version = "4.99.5";
 
   src = fetchurl {
     url = "https://ftp.exim.org/pub/exim/exim4/exim-${finalAttrs.version}.tar.xz";
-    hash = "sha256-h/84gVcA37HuTrfo26eRbfenVZBTVNLQ+qGuF5DE/Z0=";
+    hash = "sha256-wtL4Ctx8cdQk/YKkZlXqotfZtMoud4g+upB2lHt+5ic=";
   };
 
   enableParallelBuilding = true;

pkgs/by-name/ex/expresslrs-configurator/package.nix

@@ -12,7 +12,7 @@
 
 let
   pname = "expresslrs-configurator";
-  version = "1.8.1";
+  version = "1.8.2";
   installPath = "share/${pname}";
   resourcesPath = "${installPath}/resources";
 in
@@ -22,7 +22,7 @@ stdenv.mkDerivation {
   src = fetchzip {
     url = "https://github.com/ExpressLRS/ExpressLRS-Configurator/releases/download/v${version}/${pname}-${version}.zip";
     stripRoot = false;
-    hash = "sha256-3f2/ifXLs/gHZVVDI0EUBP05FEHH8exDvBzALDXq0Wo=";
+    hash = "sha256-fVERT1JkXYwEqP0UJZZxT8AgkEMRzlvSqWPM4Zo9KXU=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/f3/f3d/package.nix

@@ -94,7 +94,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Fast and minimalist 3D viewer using VTK";
-    homepage = "https://f3d-app.github.io/f3d";
+    homepage = "https://f3d.app";
     changelog = "https://github.com/f3d-app/f3d/releases/tag/v${version}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [

pkgs/by-name/fa/faas-cli/package.nix

@@ -24,13 +24,13 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "faas-cli";
-  version = "0.18.10";
+  version = "0.18.11";
 
   src = fetchFromGitHub {
     owner = "openfaas";
     repo = "faas-cli";
     rev = finalAttrs.version;
-    sha256 = "sha256-MctMhuaXJpm25VKqlhaAPG2QzSDQ//Ei8B1lRCKdz68=";
+    sha256 = "sha256-4bfp9nM6cAglx9mNzjQZ4uo6nJNWI9Q9g9zIdkev9FM=";
   };
 
   vendorHash = null;

pkgs/by-name/fe/feedbackd-device-themes/package.nix

@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   mesonFlags = [
-    (lib.mesonOption "validate" (if finalAttrs.doCheck then "enabled" else "disabled"))
+    (lib.mesonOption "validate" (if finalAttrs.finalPackage.doCheck then "enabled" else "disabled"))
   ];
 
   doCheck = true;

pkgs/by-name/fe/fex/package.nix

@@ -233,7 +233,7 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
       cmakeFlagsArray+=("-DBUILD_TESTING:BOOL=FALSE")
     else
       echo "Keeping checkPhase as-is"
-      cmakeFlagsArray+=("${lib.cmakeBool "BUILD_TESTING" finalAttrs.doCheck}")
+      cmakeFlagsArray+=("${lib.cmakeBool "BUILD_TESTING" finalAttrs.finalPackage.doCheck}")
     fi
   '';
 

pkgs/by-name/fi/firezone-server/package.nix

@@ -4,7 +4,7 @@
   fetchFromGitHub,
   beam27Packages,
   gitMinimal,
-  pnpm_9,
+  pnpm_10,
   fetchPnpmDeps,
   pnpmConfigHook,
   nodejs,
@@ -34,10 +34,10 @@ beam27Packages.mixRelease rec {
 
   pnpmDeps = fetchPnpmDeps {
     inherit pname version;
-    pnpm = pnpm_9;
+    pnpm = pnpm_10;
     src = "${src}/apps/web/assets";
-    fetcherVersion = 3;
-    hash = "sha256-tB0y3T/dZBe8BHz7AV913zQ4oQu7VLyqHCnzBycNg18=";
+    fetcherVersion = 4;
+    hash = "sha256-Uq6dAYYWT8G6upYcNEzVc8Gb2HUj8SaWRD0/w0quaRE=";
   };
   pnpmRoot = "apps/web/assets";
 
@@ -63,7 +63,7 @@ beam27Packages.mixRelease rec {
 
   nativeBuildInputs = [
     pnpmConfigHook
-    pnpm_9
+    pnpm_10
     nodejs
   ];
 

pkgs/by-name/fl/flatpak/package.nix

@@ -119,7 +119,7 @@ stdenv.mkDerivation (finalAttrs: {
     # and cannot bind FHS paths since those are not available on NixOS.
     finalAttrs.passthru.icon-validator-patch
   ]
-  ++ lib.optionals finalAttrs.doCheck [
+  ++ lib.optionals finalAttrs.finalPackage.doCheck [
     # Hardcode paths used by tests and change test runtime generation to use files from Nix store.
     # https://github.com/flatpak/flatpak/issues/1460
     (replaceVars ./fix-test-paths.patch {

pkgs/by-name/fl/flexget/package.nix

@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "flexget";
-  version = "3.19.28";
+  version = "3.19.30";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Flexget";
     repo = "Flexget";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-NEBE39rqYegFO7f1fd0rTIZzkamuQM+5d3dD/zYHCoU=";
+    hash = "sha256-LfitvBEg9qjv6glIK9KbttM/5nSnKA0i8+Q8gCNMVx8=";
   };
 
   pythonRelaxDeps = true;

pkgs/by-name/fr/frankenphp/package.nix

@@ -30,13 +30,13 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "frankenphp";
-  version = "1.12.4";
+  version = "1.12.5";
 
   src = fetchFromGitHub {
     owner = "php";
     repo = "frankenphp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DzncOAhdDyc5qOipMI8OPss0WciAQIam6GmaUoe8mR8=";
+    hash = "sha256-1f+3w9x6P1euUZr4hC4jOkgEJEbS/MJ11u+chGShCno=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/caddy";
@@ -44,7 +44,7 @@ buildGoModule (finalAttrs: {
   # frankenphp requires C code that would be removed with `go mod tidy`
   # https://github.com/golang/go/issues/26366
   proxyVendor = true;
-  vendorHash = "sha256-XY5a8pd5vJ/ouZMASzVqPoeXVfPbnEVDJFKkVNQF+2M=";
+  vendorHash = "sha256-d6ZTi1Ihu011eKVdHMiW9oSdPB4SYpDHMFxH65XLGac=";
 
   buildInputs = [
     phpUnwrapped

pkgs/by-name/fr/freeipa/package.nix

@@ -2,7 +2,6 @@
   stdenv,
   lib,
   fetchurl,
-  fetchpatch,
   pkg-config,
   autoconf,
   automake,
@@ -75,26 +74,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "freeipa";
-  version = "4.12.5";
+  version = "4.13.1";
 
   src = fetchurl {
     url = "https://releases.pagure.org/freeipa/freeipa-${finalAttrs.version}.tar.gz";
-    hash = "sha256-jvXS9Hx9VGFccFL19HogfH15JVIW7pc3/TY1pOvJglM=";
+    hash = "sha256-U1MSfXxWynK8LUWDdtRX+LDMRRzb0x3Hk5qIBY6RUnw=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "support-pyca-44.0";
-      url = "https://github.com/freeipa/freeipa/pull/7619/commits/2dc4133920fe58ce414c545102c74173d40d1997.patch";
-      hash = "sha256-PROnPc/1qS3hcO8s5sel55tsyZ1VPjEKLcua8Pd4DP0=";
-    })
-    (fetchpatch {
-      name = "fix-tripledes-cipher-warnings";
-      url = "https://github.com/freeipa/freeipa/pull/7619/commits/e2bf6e4091c7b5320ec6387dab2d5cabe4a9a42d.patch";
-      hash = "sha256-AyMK0hjXMrFK4/qIcjPMFH9DKvnvYOK2QS83Otcc+l4=";
-    })
-  ];
-
   nativeBuildInputs = [
     python3Packages.wrapPython
     jre

pkgs/by-name/fr/freetube/package.nix

@@ -22,13 +22,13 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "freetube";
-  version = "0.25.0";
+  version = "0.25.1";
 
   src = fetchFromGitHub {
     owner = "FreeTubeApp";
     repo = "FreeTube";
     tag = "v${finalAttrs.version}-beta";
-    hash = "sha256-oXa+3BXLVDTaLUzt0imgTtZ4/NywibFzul/y0wymnWk=";
+    hash = "sha256-CQiwAoOJoAZpcDIwqcOfUAvJHLWTdj8fIInlR3qyjg8=";
   };
 
   __structuredAttrs = true;
@@ -57,7 +57,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
     fetcherVersion = 4;
-    hash = "sha256-xHlxmeMtMd9/ImheeMH1K22MC0zmIzzgAHXzK+tLnQc=";
+    hash = "sha256-NWCgUjBuSeEl65mmAeJzOyIxCi2ha0Nr5qjOQq+CtMQ=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ft/ftxui/package.nix

@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
   cmakeFlags = [
     (lib.cmakeBool "FTXUI_BUILD_EXAMPLES" false)
     (lib.cmakeBool "FTXUI_BUILD_DOCS" true)
-    (lib.cmakeBool "FTXUI_BUILD_TESTS" finalAttrs.doCheck)
+    (lib.cmakeBool "FTXUI_BUILD_TESTS" finalAttrs.finalPackage.doCheck)
   ];
 
   meta = {

pkgs/by-name/fw/fwup/package.nix

@@ -49,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
     unzip
     zip
   ]
-  ++ lib.optionals finalAttrs.doCheck [
+  ++ lib.optionals finalAttrs.finalPackage.doCheck [
     mtools
     dosfstools
   ];

pkgs/by-name/gi/gitea-actions-runner/package.nix

@@ -9,17 +9,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "gitea-actions-runner";
-  version = "2.1.0";
+  version = "2.2.0";
 
   src = fetchFromGitea {
     domain = "gitea.com";
     owner = "gitea";
     repo = "runner";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-jkK61OZgbMDHD5yxrpyP1BWCVzDiR79dVaC5ItS99BU=";
+    hash = "sha256-aiba7Tdyyy8aDzJq62zOWNkEZE+twIxReW7clbIoVTI=";
   };
 
-  vendorHash = "sha256-5K0vL0CDYgL/Ud7i4um3mz887Er4qmuhCd9dt5zyUHA=";
+  vendorHash = "sha256-Zpq/G/SZ959SRUIMGo2votFv4DzB46OmPmZwFoae3gU=";
 
   # Tests require network access (artifactcache tests try to determine outbound IP)
   doCheck = false;

pkgs/by-name/gi/gitlab-container-registry/package.nix

@@ -6,7 +6,7 @@
 
 buildGo125Module rec {
   pname = "gitlab-container-registry";
-  version = "4.39.0";
+  version = "4.40.2";
   rev = "v${version}-gitlab";
 
   # nixpkgs-update: no auto update
@@ -14,10 +14,10 @@ buildGo125Module rec {
     owner = "gitlab-org";
     repo = "container-registry";
     inherit rev;
-    hash = "sha256-7dGKV2Pc3OPdM4OZqYjp3B9/s6DHtPvrqcWnWb3wHYw=";
+    hash = "sha256-k94uEM2VoOtdFRXWm6CDmeRt8LMXSNegRGes3ZKPg0I=";
   };
 
-  vendorHash = "sha256-s08LsgYZTRJm0sWkbEUsmTYGkfb/5PJl9o9ozY1KOms=";
+  vendorHash = "sha256-MD98JYwTo/t5/E7clIlUfjmv8t7nDPpVElbuYDRjMMc=";
 
   excludedPackages = [
     "devvm/*"

pkgs/by-name/gi/gitlab-runner/package.nix

@@ -12,16 +12,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "gitlab-runner";
-  version = "19.0.0";
+  version = "19.1.1";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-runner";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-uScTzj4pSRtSFCMxoOR5KqipCbPknwnydPYG6xU5dOo=";
+    hash = "sha256-QKiHd4UFTuAZElQ/793Tyid983RnfU9TeNpe1gFwChA=";
   };
 
-  vendorHash = "sha256-QqqTkIgR9ca1dYQ32SG7C+SpEIA07Hlf8x3lVhZ5vRQ=";
+  vendorHash = "sha256-Ed2PrEkkqZEWhFLtT1BJavWiacLuv4U7kIAcscMDQgM=";
 
   # For patchShebangs
   buildInputs = [ bash ];

pkgs/by-name/gi/gitte/package.nix

@@ -22,7 +22,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "gitte";
-  version = "0.9.0";
+  version = "0.9.1";
 
   __structuredAttrs = true;
 
@@ -30,12 +30,12 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "ckruse";
     repo = "Gitte";
     tag = finalAttrs.version;
-    hash = "sha256-k10Rqpf9fhcG+PU6WGr7Q2nVwZb0tLp2B2r3BNeicoI=";
+    hash = "sha256-/vVNWYuTsFf9SsL/PvM5hOJfULeibRn+9ukAbTs5rXk=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-eK8o/psq0eHwUlbfD0I/TwIqoA40Ay0eJ9CtZypZCi4=";
+    hash = "sha256-oz8pX33jua+bOBEmI87p4rkUxYrhzagBLcQvSHPOkp0=";
   };
 
   strictDeps = true;

pkgs/by-name/go/godotpcktool/package.nix

@@ -7,13 +7,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "godotpcktool";
-  version = "2.2";
+  version = "2.3";
 
   src = fetchFromGitHub {
     owner = "hhyyrylainen";
     repo = "GodotPckTool";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-H0v432PyKscazR9PN5d+MmYZ8ND497m3RHmWpw16UY4=";
+    hash = "sha256-v8etiUKVxSgVSB3ARqdLgbp3SEC12xBf0HXDl1RJRug=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/go/google-chrome/package.nix

@@ -179,11 +179,11 @@ let
 
   linux = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "150.0.7871.181";
+    version = "150.0.7871.186";
 
     src = fetchurl {
       url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb";
-      hash = "sha256-/sUJBfexI1pECXeoM0duAWKHT1ynnlBs30C3GvZNkvQ=";
+      hash = "sha256-QZPgC21dWWnuY/emlZaGj1RqoOjLB3s+C/nMHixxnQA=";
     };
 
     # With strictDeps on, some shebangs were not being patched correctly
@@ -289,11 +289,11 @@ let
 
   darwin = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "150.0.7871.182";
+    version = "150.0.7871.187";
 
     src = fetchurl {
-      url = "http://dl.google.com/release2/chrome/mb6usb7722qbv5pqtlgpq72utm_150.0.7871.182/GoogleChrome-150.0.7871.182.dmg";
-      hash = "sha256-eNrCQqKqd+6cuvGDbQ0VM5JpolHusOZou2elsAh0TD4=";
+      url = "http://dl.google.com/release2/chrome/ecziwrw2etq4lm3vlbpv5wzvce_150.0.7871.187/GoogleChrome-150.0.7871.187.dmg";
+      hash = "sha256-I1a+wR5zNfOSYyns2ehDek5DP1xccRQvmBLymxB/R7A=";
     };
 
     dontPatch = true;

pkgs/by-name/go/goose/package.nix

@@ -7,17 +7,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "goose";
-  version = "3.27.2";
+  version = "3.27.3";
 
   src = fetchFromGitHub {
     owner = "pressly";
     repo = "goose";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-4m/YYyQtz/Nj94vIUxChgmDsJVZqtzmp7qsSiuZVB38=";
+    hash = "sha256-CSS0OtC4/EeQD7PGin64U0Fag2z490RQ7CKNBRyp8f8=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-8riGHomL3wKqBOPOzgE13jWYjJT03tqz1UMWR/01pcE=";
+  vendorHash = "sha256-opO6G9Fdyt27GlWyaB/6J1xhm3wTgH9Xc/FYcLcqBVs=";
 
   # skipping: end-to-end tests require a docker daemon
   postPatch = ''

pkgs/by-name/go/gotosocial/package.nix

@@ -11,13 +11,13 @@
 }:
 buildGo125Module (finalAttrs: {
   pname = "gotosocial";
-  version = "0.22.0";
+  version = "0.22.1";
 
   src = fetchFromCodeberg {
     owner = "superseriousbusiness";
     repo = "gotosocial";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rslzi9WqPqN/wm9PN6SWdXtLdMRJJV6Hhb3whJ0RicU=";
+    hash = "sha256-fRMQISOYf0rGcnNBpdlDeYWO0vvVwW0UPXdeT1y0+Ec=";
   };
 
   vendorHash = null;

pkgs/by-name/gs/gsl-lite/package.nix

@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   cmakeFlags = [
-    (lib.cmakeBool "GSL_LITE_OPT_BUILD_TESTS" finalAttrs.doCheck)
+    (lib.cmakeBool "GSL_LITE_OPT_BUILD_TESTS" finalAttrs.finalPackage.doCheck)
   ];
 
   # Building tests is broken on Darwin.

pkgs/by-name/gt/gtkwave/package.nix

@@ -18,11 +18,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gtkwave";
-  version = "3.3.127";
+  version = "3.3.128";
 
   src = fetchurl {
     url = "mirror://sourceforge/gtkwave/gtkwave-gtk3-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-8Z2i20Oye7zGaXJYQ0UZRaaMOkziMlYuNB1vY7gLVeQ=";
+    sha256 = "sha256-gX4Zf8GAj4qsNUPCwvloPLATaMkRkrjq5a9YBw7x0fg=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/gz/gz-cmake/package.nix

@@ -45,8 +45,8 @@ stdenv.mkDerivation (finalAttrs: {
   doBuildExamples = false;
 
   cmakeFlags = [
-    (lib.cmakeBool "BUILDSYSTEM_TESTING" finalAttrs.doCheck)
-    (lib.cmakeBool "BUILD_TESTING" finalAttrs.doCheck)
+    (lib.cmakeBool "BUILDSYSTEM_TESTING" finalAttrs.finalPackage.doCheck)
+    (lib.cmakeBool "BUILD_TESTING" finalAttrs.finalPackage.doCheck)
     (lib.cmakeBool "BUILD_EXAMPLES" finalAttrs.doBuildExamples)
   ];
 

pkgs/by-name/he/headlamp-frontend/package.nix

@@ -12,7 +12,7 @@ buildNpmPackage {
 
   sourceRoot = "${headlamp-server.src.name}/frontend";
 
-  npmDepsHash = "sha256-73xc/GK1Cvz67D6ftYVRe5GARNgG5qD86CGK6uhoyWA=";
+  npmDepsHash = "sha256-v8aMlOk2JD2DzcUMWTK+2QP44n1Nl0LQPcIry7W51vg=";
 
   postPatch = ''
     chmod -R u+w ../app