Merge master into staging-nixos

Signed-off-by: Anish Pallati <i@anish.land>

.github/workflows/lint.yml

@@ -130,7 +130,7 @@ jobs:
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
-            const { default: checkCommitMessages } = await import('${{ github.workspace }}/trusted/ci/github-script/lint-commits.js')
+            const { default: checkCommitMessages } = await import('${{ github.workspace }}/trusted/ci/github-script/lint-commits.ts')
 
             await checkCommitMessages({
               github,

.github/workflows/merge-group.yml

@@ -38,8 +38,8 @@ jobs:
           TARGET_SHA: ${{ inputs.targetSha }}
         with:
           script: |
-            const { classify } = await import('${{ github.workspace }}/ci/github-script/supportedBranches.js')
-            const { default: supportedSystems } = await import('${{ github.workspace }}/ci/github-script/supportedSystems.js')
+            const { classify } = await import('${{ github.workspace }}/ci/github-script/supportedBranches.ts')
+            const { default: supportedSystems } = await import('${{ github.workspace }}/ci/github-script/supportedSystems.ts')
 
             const baseBranch = (
               context.payload.merge_group?.base_ref ??

.github/workflows/test.yml

@@ -64,8 +64,8 @@ jobs:
               '.github/workflows/test.yml',
               'ci/github-script/package.json',
               'ci/github-script/package-lock.json',
-              'ci/github-script/supportedBranches.js',
-              'ci/github-script/supportedSystems.js',
+              'ci/github-script/supportedBranches.ts',
+              'ci/github-script/supportedSystems.ts',
               'ci/pinned.json',
               'pkgs/top-level/release-supported-systems.json',
             ].includes(file))) core.setOutput('merge-group', true)
@@ -82,8 +82,8 @@ jobs:
               'ci/github-script/bot.js',
               'ci/github-script/check-target-branch.ts',
               'ci/github-script/commits.ts',
-              'ci/github-script/get-pr-commit-details.js',
-              'ci/github-script/lint-commits.js',
+              'ci/github-script/get-pr-commit-details.ts',
+              'ci/github-script/lint-commits.ts',
               'ci/github-script/manual-file-edits.ts',
               'ci/github-script/merge.js',
               'ci/github-script/package.json',
@@ -91,9 +91,9 @@ jobs:
               'ci/github-script/prepare.js',
               'ci/github-script/reminders.ts',
               'ci/github-script/reviewers.js',
-              'ci/github-script/reviews.js',
-              'ci/github-script/supportedBranches.js',
-              'ci/github-script/supportedSystems.js',
+              'ci/github-script/reviews.ts',
+              'ci/github-script/supportedBranches.ts',
+              'ci/github-script/supportedSystems.ts',
               'ci/github-script/withRateLimit.js',
               'ci/pinned.json',
               'pkgs/top-level/release-supported-systems.json',

ci/OWNERS

@@ -444,9 +444,9 @@ nixos/tests/forgejo.nix               @adamcstephens @bendlas @christoph-heiss @
 /doc/hooks/zig.section.md       @RossComputerGuy
 
 # Buildbot
-nixos/modules/services/continuous-integration/buildbot @Mic92 @zowoq
-nixos/tests/buildbot.nix                               @Mic92 @zowoq
-pkgs/development/tools/continuous-integration/buildbot @Mic92 @zowoq
+nixos/modules/services/continuous-integration/buildbot @Mic92
+nixos/tests/buildbot.nix                               @Mic92
+pkgs/development/tools/continuous-integration/buildbot @Mic92
 
 # Pretix
 pkgs/by-name/pr/pretix/ @mweinelt

ci/README.md

@@ -104,7 +104,7 @@ For the purposes of CI, branches in the NixOS/nixpkgs repository are classified
 
 Some branches also have a version component, which is either `unstable` or `YY.MM`.
 
-`ci/github-script/supportedBranches.js` is a script imported by CI to classify the base and head branches of a Pull Request.
+`ci/github-script/supportedBranches.ts` is a script imported by CI to classify the base and head branches of a Pull Request.
 This classification will then be used to skip certain jobs.
 This script can also be run locally to print basic test cases.
 

ci/github-script/bot.js

@@ -4,7 +4,7 @@ import path from 'node:path'
 import { DefaultArtifactClient } from '@actions/artifact'
 import { handleMerge } from './merge.js'
 import { handleReviewers } from './reviewers.js'
-import { classify } from './supportedBranches.js'
+import { classify } from './supportedBranches.ts'
 import withRateLimit from './withRateLimit.js'
 
 export default async ({ github, context, core, dry }) => {

ci/github-script/check-target-branch-policy.ts

@@ -1,4 +1,4 @@
-import { classify, split } from './supportedBranches.js'
+import { classify, split } from './supportedBranches.ts'
 
 type TargetBranchPolicyFacts = {
   base: string

ci/github-script/check-target-branch.ts

@@ -6,8 +6,8 @@ import {
   evaluateTargetBranchPolicy,
   getTargetBranchPolicy,
 } from './check-target-branch-policy.ts'
-import { dismissReviews, postReview } from './reviews.js'
-import { split } from './supportedBranches.js'
+import { dismissReviews, postReview } from './reviews.ts'
+import { split } from './supportedBranches.ts'
 
 // TODO: should this be combined with the branch checks in prepare.js?
 // They do seem quite similar, but this needs to run after eval,

ci/github-script/commits.ts

@@ -2,8 +2,8 @@ import { execFileSync } from 'node:child_process'
 import type * as actionsCore from '@actions/core'
 import type { context as actionsContext } from '@actions/github'
 import type { GitHub } from '@actions/github/lib/utils'
-import { dismissReviews, postReview } from './reviews.js'
-import { classify } from './supportedBranches.js'
+import { dismissReviews, postReview } from './reviews.ts'
+import { classify } from './supportedBranches.ts'
 import withRateLimit from './withRateLimit.js'
 
 const dirname = import.meta.dirname

ci/github-script/get-pr-commit-details.ts

@@ -3,26 +3,23 @@ import { promisify } from 'node:util'
 
 const execFile = promisify(nodeExecFile)
 
-/**
- * @typedef {{
- *  subject: string,
- *  sha: string,
- *  author: { name: string, email: string },
- *  committer: { name: string, email: string}
- *  changedPaths: string[],
- *  changedPathSegments: Set<string>,
- * }} Commit
- */
+export type Commit = {
+  subject: string
+  sha: string
+  author: { name: string; email: string }
+  committer: { name: string; email: string }
+  changedPaths: string[]
+  changedPathSegments: Set<string>
+}
 
-/**
- * @param {{
- *  args: string[]
- *  core: typeof import('@actions/core'),
- *  quiet?: boolean,
- *  repoPath?: string,
- * }} RunGitProps
- */
-async function runGit({ args, repoPath, core, quiet }) {
+interface RunGitProps {
+  args: string[]
+  core: typeof import('@actions/core')
+  quiet?: boolean
+  repoPath?: string
+}
+
+async function runGit({ args, repoPath, core, quiet }: RunGitProps) {
   if (repoPath) {
     args = ['-C', repoPath, ...args]
   }
@@ -34,21 +31,29 @@ async function runGit({ args, repoPath, core, quiet }) {
   return await execFile('git', args)
 }
 
+interface GetCommitMessagesForPRProps {
+  core: typeof import('@actions/core')
+  pr: Awaited<
+    ReturnType<
+      InstanceType<
+        typeof import('@actions/github/lib/utils').GitHub
+      >['rest']['pulls']['get']
+    >
+  >['data']
+  repoPath?: string
+}
+
 /**
  * Gets the SHA, subject and changed files for each commit in the given PR.
  *
  * Don't use GitHub API at all: the "list commits on PR" endpoint has a limit
  * of 250 commits and doesn't return the changed files.
- *
- * @param {{
- *  core: typeof import('@actions/core'),
- *  pr: Awaited<ReturnType<InstanceType<typeof import('@actions/github/lib/utils').GitHub>["rest"]["pulls"]["get"]>>["data"]
- *  repoPath?: string,
- * }} GetCommitMessagesForPRProps
- *
- * @returns {Promise<Commit[]>}
  */
-export async function getCommitDetailsForPR({ core, pr, repoPath }) {
+export async function getCommitDetailsForPR({
+  core,
+  pr,
+  repoPath,
+}: GetCommitMessagesForPRProps): Promise<Commit[]> {
   await runGit({
     args: ['fetch', `--depth=1`, 'origin', pr.base.sha],
     repoPath,

ci/github-script/lint-commits.ts

@@ -1,17 +1,23 @@
-import { getCommitDetailsForPR } from './get-pr-commit-details.js'
-import { classify } from './supportedBranches.js'
+import { type Commit, getCommitDetailsForPR } from './get-pr-commit-details.ts'
+import { classify } from './supportedBranches.ts'
 
-/** @typedef {import('./get-pr-commit-details.js').Commit} Commit */
+type GitHub = InstanceType<typeof import('@actions/github/lib/utils').GitHub>
+type Context = typeof import('@actions/github').context
+type Core = typeof import('@actions/core')
 
-/**
- * @param {{
- *  github: InstanceType<typeof import('@actions/github/lib/utils').GitHub>,
- *  context: typeof import('@actions/github').context,
- *  core: typeof import('@actions/core'),
- *  repoPath?: string,
- * }} LintCommitsProps
- */
-export default async function lintCommits({ github, context, core, repoPath }) {
+interface LintCommitsProps {
+  github: GitHub
+  context: Context
+  core: Core
+  repoPath?: string
+}
+
+export default async function lintCommits({
+  github,
+  context,
+  core,
+  repoPath,
+}: LintCommitsProps) {
   // This check should only be run when we have the pull_request context.
   const pull_number = context.payload.pull_request?.number
   if (!pull_number) {
@@ -53,13 +59,15 @@ export default async function lintCommits({ github, context, core, repoPath }) {
   await checkCommitMetadata({ commits, core })
 }
 
-/**
- * @param {{
- *  commits: Commit[],
- *  core: typeof import('@actions/core'),
- * }} CheckCommitMessagesProps
- */
-async function checkCommitMessages({ commits, core }) {
+interface CheckCommitMessagesProps {
+  commits: Commit[]
+  core: Core
+}
+
+async function checkCommitMessages({
+  commits,
+  core,
+}: CheckCommitMessagesProps) {
   const failures = new Set()
 
   const conventionalCommitTypes = [
@@ -80,10 +88,13 @@ async function checkCommitMessages({ commits, core }) {
   ]
 
   /**
-   * @param {string[]} types e.g. ["fix", "feat"]
-   * @param {string?} sha commit hash
+   * @param types e.g. ["fix", "feat"]
+   * @param sha commit hash
    */
-  function makeConventionalCommitRegex(types, sha = null) {
+  function makeConventionalCommitRegex(
+    types: string[],
+    sha: string | null = null,
+  ) {
     core.info(
       `${
         sha
@@ -166,17 +177,15 @@ async function checkCommitMessages({ commits, core }) {
   }
 }
 
-/**
- * @param {{
- *  commits: Commit[],
- *  core: typeof import('@actions/core'),
- * }} CheckGitFieldsProps
- */
-async function checkCommitMetadata({ commits, core }) {
+interface CheckGitFieldsProps {
+  commits: Commit[]
+  core: Core
+}
+
+async function checkCommitMetadata({ commits, core }: CheckGitFieldsProps) {
   const failures = new Set()
 
-  /** @type {(s: string) => boolean} */
-  const isEmail = (s) => /^.+@.*$/.test(s)
+  const isEmail = (s: string) => /^.+@.*$/.test(s)
 
   for (const commit of commits) {
     if (!commit.author.name) {

ci/github-script/manual-file-edits.ts

@@ -1,6 +1,6 @@
-import { getCommitDetailsForPR } from './get-pr-commit-details.js'
-import { dismissReviews, postReview } from './reviews.js'
-import { classify } from './supportedBranches.js'
+import { getCommitDetailsForPR } from './get-pr-commit-details.ts'
+import { dismissReviews, postReview } from './reviews.ts'
+import { classify } from './supportedBranches.ts'
 
 export default async function checkManualFileEdits({
   github,

ci/github-script/merge.js

@@ -1,5 +1,5 @@
 // @ts-nocheck
-import { classify } from './supportedBranches.js'
+import { classify } from './supportedBranches.ts'
 
 function runChecklist({
   committers,

ci/github-script/prepare.js

@@ -1,7 +1,7 @@
 // @ts-nocheck
-import { dismissReviews, postReview } from './reviews.js'
-import { classify } from './supportedBranches.js'
-import supportedSystems from './supportedSystems.js'
+import { dismissReviews, postReview } from './reviews.ts'
+import { classify } from './supportedBranches.ts'
+import supportedSystems from './supportedSystems.ts'
 
 const reviewKey = 'prepare'
 
@@ -66,7 +66,7 @@ export default async ({ github, context, core, dry }) => {
       // commits between that base and head is the real base. We can query for this via GitHub's
       // REST API. There can be multiple candidates for the real base with the same number of
       // commits. In this case we pick the "best" candidate by a fixed ordering of branches,
-      // as defined in ci/github-script/supportedBranches.js.
+      // as defined in ci/github-script/supportedBranches.ts.
       //
       // These requests take a while, when comparing against the wrong release - they need
       // to look at way more than 10k commits in that case. Thus, we try to minimize the

ci/github-script/reminders.ts

@@ -3,9 +3,9 @@ import path from 'node:path'
 import type * as actionsCore from '@actions/core'
 import type { context as actionsContext } from '@actions/github'
 import type { GitHub } from '@actions/github/lib/utils'
-import { getCommitDetailsForPR } from './get-pr-commit-details.js'
-import { dismissReviews, postReview } from './reviews.js'
-import { classify } from './supportedBranches.js'
+import { getCommitDetailsForPR } from './get-pr-commit-details.ts'
+import { dismissReviews, postReview } from './reviews.ts'
+import { classify } from './supportedBranches.ts'
 
 /**
  * Reminders to post as a non-blocking review when a pull request touches

ci/github-script/reminders/docs-styleguide.md

@@ -1,6 +1,6 @@
 Thanks for contributing to the documentation
 
-Make sure you follow the [documentation styleguide](https://github.com/NixOS/nixpkgs/blob/master/doc/styleguide.md), most notably:
+Make sure you follow the [documentation style guide](https://github.com/NixOS/nixpkgs/blob/master/doc/styleguide.md), most notably:
 
 - Show, don't tell: lead with a minimal working example; explanation follows the code.
 - No meta-commentary: don't write "This section explains how to…", just do it.

ci/github-script/reviews.ts

@@ -13,30 +13,28 @@ const reviewUsers = [
   'manual-edit',
 ]
 
-/**
- * @typedef {InstanceType<typeof import('@actions/github/lib/utils').GitHub>} GitHub
- * @typedef {typeof import('@actions/github').context} Context
- *
- * @typedef {Awaited<ReturnType<GitHub['rest']['pulls']['listReviews']>>['data'][number]} Review
- * @typedef {Review & { user: NonNullable<Review['user']> }} ReviewWithNonNullUser
- */
+type GitHub = InstanceType<typeof import('@actions/github/lib/utils').GitHub>
+type Context = typeof import('@actions/github').context
+type Review = Awaited<
+  ReturnType<GitHub['rest']['pulls']['listReviews']>
+>['data'][number]
+type ReviewWithNonNullUser = Review & { user: NonNullable<Review['user']> }
+
+interface DismissReviewsProps {
+  github: GitHub
+  context: Context
+  core: typeof import('@actions/core')
+  dry: boolean
+  reviewKey?: string
+}
 
-/**
- * @param {{
- *  github: GitHub,
- *  context: Context,
- *  core: typeof import('@actions/core'),
- *  dry: boolean,
- *  reviewKey?: string,
- * }} DismissReviewsProps
- */
 export async function dismissReviews({
   github,
   context,
   core,
   dry,
   reviewKey,
-}) {
+}: DismissReviewsProps) {
   const pull_number = context.payload.pull_request?.number
   if (!pull_number) {
     core.warning('dismissReviews called outside of pull_request context')
@@ -47,23 +45,29 @@ export async function dismissReviews({
     return
   }
 
-  const allReviews = await github.paginate(github.rest.pulls.listReviews, {
-    ...context.repo,
-    pull_number,
-  })
+  const allReviews: Review[] = await github.paginate(
+    github.rest.pulls.listReviews,
+    {
+      ...context.repo,
+      pull_number,
+    },
+  )
 
-  const reviews = /** @type {ReviewWithNonNullUser[]} */ (
-    allReviews.filter(
+  const reviews = allReviews
+    .filter((review): review is ReviewWithNonNullUser => !!review.user)
+    .filter(
       (review) =>
-        review.user &&
         review.state !== 'DISMISSED' &&
         review.user.login.endsWith('[bot]') &&
         reviewUsers.some((substr) => review.user?.login.includes(substr)),
     )
-  )
 
   const reviewsByUser = reviews.reduce(
     (prev, curr) => {
+      if (!curr.user) {
+        return prev
+      }
+
       if (!(curr.user.login in prev)) {
         prev[curr.user.login] = []
       }
@@ -72,7 +76,7 @@ export async function dismissReviews({
 
       return prev
     },
-    /** @type {Record<string, ReviewWithNonNullUser[]> } */ ({}),
+    {} as Record<string, ReviewWithNonNullUser[]>,
   )
 
   const commentRegex = new RegExp(
@@ -86,8 +90,8 @@ export async function dismissReviews({
   )
 
   let reviewsToMinimize = reviews
-  const /** @type {ReviewWithNonNullUser[]} */ reviewsToDismiss = []
-  const /** @type {ReviewWithNonNullUser[]} */ reviewsToResolve = []
+  const reviewsToDismiss: ReviewWithNonNullUser[] = []
+  const reviewsToResolve: ReviewWithNonNullUser[] = []
 
   if (reviewKey && reviews.every((review) => commentRegex.test(review.body))) {
     reviewsToMinimize = reviews.filter((review) =>
@@ -165,17 +169,16 @@ export async function dismissReviews({
   ])
 }
 
-/**
- * @param {{
- *  github: GitHub,
- *  context: Context,
- *  core: typeof import('@actions/core'),
- *  dry: boolean,
- *  body: string,
- *  event: keyof typeof eventToState,
- *  reviewKey: string,
- * }} PostReviewProps
- */
+interface PostReviewProps {
+  github: GitHub
+  context: Context
+  core: typeof import('@actions/core')
+  dry: boolean
+  body: string
+  event: keyof typeof eventToState
+  reviewKey: string
+}
+
 export async function postReview({
   github,
   context,
@@ -184,7 +187,7 @@ export async function postReview({
   body,
   event = 'REQUEST_CHANGES',
   reviewKey,
-}) {
+}: PostReviewProps) {
   const pull_number = context.payload.pull_request?.number
   if (!pull_number) {
     core.warning('postReview called outside of pull_request context')
@@ -210,8 +213,7 @@ export async function postReview({
       reviewUsers.some((substr) => review.user?.login.includes(substr)),
   )
 
-  /** @type {null | Review} */
-  let pendingReview
+  let pendingReview: null | Review
   const matchingReviews = reviews.filter((review) =>
     reviewKeyRegex.test(review.body),
   )

ci/github-script/run

@@ -101,7 +101,7 @@ program
   .argument('<repo>', 'Name of the GitHub repository to run on (Example: nixpkgs)')
   .argument('<pr>', 'Number of the Pull Request to run on')
   .action(async (owner, repo, pr, options) => {
-    const checkCommitMessages = (await import('./lint-commits.js')).default
+    const checkCommitMessages = (await import('./lint-commits.ts')).default
     await run(checkCommitMessages, owner, repo, pr, options)
   })
 

ci/github-script/supportedBranches.ts

@@ -2,11 +2,12 @@
 /*
 #!nix-shell -i node -p nodejs
 */
-// @ts-nocheck
 import { resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
-const typeConfig = {
+type BranchType = 'channel' | 'development' | 'primary' | 'secondary'
+
+const typeConfig: Record<string, BranchType[]> = {
   master: ['development', 'primary'],
   release: ['development', 'primary'],
   staging: ['development', 'secondary'],
@@ -19,7 +20,7 @@ const typeConfig = {
 
 // "order" ranks the development branches by how likely they are the intended base branch
 // when they are an otherwise equally good fit according to ci/github-script/prepare.js.
-const orderConfig = {
+const orderConfig: Record<string, number> = {
   master: 0,
   release: 1,
   staging: 2,
@@ -28,15 +29,30 @@ const orderConfig = {
   'staging-next': 4,
 }
 
-function split(branch) {
-  return {
-    ...branch.match(
-      /(?<prefix>.+?)(-(?<version>\d{2}\.\d{2}|unstable)(?:-(?<suffix>.*))?)?$/,
-    ).groups,
-  }
+type Digit = 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9
+type Version = `${Digit}${Digit}.${Digit}${Digit}` | 'unstable'
+interface SplitResult {
+  prefix: string
+  version: Version
+  suffix?: string
 }
 
-function classify(branch) {
+function split(branch: string) {
+  const groups = branch.match(
+    /(?<prefix>.+?)(-(?<version>\d{2}\.\d{2}|unstable)(?:-(?<suffix>.*))?)?$/,
+  )!.groups!
+  return groups as unknown as SplitResult
+}
+
+interface BranchClassification {
+  branch: string
+  order: number
+  stable: boolean
+  type: BranchType[]
+  version: Version
+}
+
+function classify(branch: string): BranchClassification {
   const { prefix, version } = split(branch)
   return {
     branch,
@@ -55,7 +71,7 @@ if (
   fileURLToPath(import.meta.url) === resolve(process.argv[1])
 ) {
   console.log('split(branch)')
-  function testSplit(branch) {
+  function testSplit(branch: string) {
     console.log(branch, split(branch))
   }
   testSplit('master')
@@ -72,7 +88,7 @@ if (
   console.log('')
 
   console.log('classify(branch)')
-  function testClassify(branch) {
+  function testClassify(branch: string) {
     console.log(branch, classify(branch))
   }
   testClassify('master')

ci/github-script/supportedSystems.js

@@ -1,11 +0,0 @@
-// @ts-nocheck
-export default async ({ github, context, targetSha }) => {
-  const { content, encoding } = (
-    await github.rest.repos.getContent({
-      ...context.repo,
-      path: 'pkgs/top-level/release-supported-systems.json',
-      ref: targetSha,
-    })
-  ).data
-  return JSON.parse(Buffer.from(content, encoding).toString())
-}

ci/github-script/supportedSystems.ts

@@ -0,0 +1,30 @@
+interface SupportedSystemsProps {
+  github: InstanceType<typeof import('@actions/github/lib/utils').GitHub>
+  context: typeof import('@actions/github').context
+  targetSha: string
+}
+
+export default async ({
+  github,
+  context,
+  targetSha,
+}: SupportedSystemsProps) => {
+  const contentObject = (
+    await github.rest.repos.getContent({
+      ...context.repo,
+      path: 'pkgs/top-level/release-supported-systems.json',
+      ref: targetSha,
+    })
+  ).data
+
+  if ('type' in contentObject && contentObject.type === 'file') {
+    const { content, encoding } = contentObject
+    return JSON.parse(
+      Buffer.from(content, encoding as BufferEncoding).toString(),
+    )
+  } else {
+    throw new Error(
+      'Fetched pkgs/top-level/release-supported-systems.json is not a file',
+    )
+  }
+}

doc/README.md

@@ -7,19 +7,26 @@ This directory houses the source files for the Nixpkgs manual.
 > We are actively restructuring our documentation to be more beginner friendly.
 >
 
-When writing new docs use **Progressive Disclosure**
+When writing new docs use **Progressive Disclosure:**
 
-Start simple, pick up beginners.
-Use **examples** first to show how to get something done. Keep **Explanation** lean.
+- Start simple, pick up beginners.
+- Use **examples** first to show how to get something done.
+- Keep **explanation** lean.
 
-Use our [styleguide](./styleguide.md) for more in depth guidance on writing good documentation.
+Use our [style guide](./styleguide.md) for more in depth guidance on writing good documentation.
 
-Documentation about Nixpkgs belongs here, this includes 'getting-started'-guides and 'onboarding-guides' for *using* Nixpkgs and the language frameworks it ships.
+Documentation about Nixpkgs belongs here.
+This includes getting started guides and onboarding guides for *using* Nixpkgs and the language frameworks it ships.
 
 Write **guides** task-first: lead with a working example, then explain in prose.
 Write **reference** as the specification of functions and attributes.
 
-We are actively working to generate reference documentation from the [doc-comments](https://github.com/NixOS/rfcs/blob/master/rfcs/0145-doc-strings.md) present in code, which also lets you view it locally with `:doc` in `nix repl`.
+We are actively working to generate reference documentation from the [doc-comments](https://github.com/NixOS/rfcs/blob/master/rfcs/0145-doc-strings.md) present in code, which also lets you view it locally with the `:doc` command in `nix repl`, e.g.:
+
+```
+nix-repl> :l <nixpkgs>
+nix-repl> :doc lib.mapAttrsToList
+```
 
 See [Document structure](#document-structure) for a structural template.
 
@@ -42,23 +49,23 @@ If the build succeeds, the manual will be in `./result/share/doc/nixpkgs/manual.
 
 ### Development environment
 
-To reduce repetition, consider using tools from the provided development environment:
-
-Load it from the Nixpkgs documentation directory with
+To reduce repetition, consider using tools from the documentation development environment:
 
 ```ShellSession
 $ cd /path/to/nixpkgs/doc
 $ nix-shell
 ```
 
-To load the development utilities automatically when entering that directory, [set up `nix-direnv`](https://nix.dev/guides/recipes/direnv).
+To load the documentation development environment automatically when entering that directory:
 
-Make sure that your local files aren't added to Git history by adding the following lines to `.git/info/exclude` at the root of the Nixpkgs repository:
+1. Install [`nix-direnv`](https://search.nixos.org/packages?channel=unstable&query=nix-direnv#show=nix-direnv)
+1. Set up direnv in the documentation directory:
 
-```
-/**/.envrc
-/**/.direnv
-```
+   ```ShellSession
+   $ cd doc
+   $ echo "use nix" > .envrc
+   $ direnv allow
+   ```
 
 #### Live preview
 
@@ -133,14 +140,12 @@ A few markups for other kinds of literals are also available:
 - `` {env}`XDG_DATA_DIRS` ``
 - `` {file}`/etc/passwd` ``
 - `` {option}`networking.useDHCP` ``
-- `` {var}`/etc/passwd` ``
+- `` {var}`pkgs` ``
+
+The values will be formatted as inline `<code>` elements.
 
 These literal kinds are used mostly in NixOS option documentation.
 
-This syntax is taken from [MyST](https://myst-parser.readthedocs.io/en/latest/syntax/syntax.html#roles-an-in-line-extension-point).
-Though, the feature originates from [reStructuredText](https://www.sphinx-doc.org/en/master/usage/restructuredtext/roles.html#role-manpage) with slightly different syntax.
-They are handled by `myst_role` defined per renderer. <!-- reverse references in code -->
-
 #### Admonitions
 
 Set off from the text to bring attention to something.
@@ -163,7 +168,7 @@ The following are supported:
 - `example`
 
 Example admonitions require a title to work.
-If you don't provide one, the manual won't be built.
+If you don't provide one, the manual won't build.
 
 ```markdown
 ::: {.example #ex-showing-an-example}
@@ -179,11 +184,11 @@ Text for the example.
 For defining a group of terms:
 
 ```markdown
-pear
-:   green or yellow bulbous fruit
+Pear
+:   Green or yellow bulbous fruit
 
-watermelon
-:   green fruit with red flesh
+Watermelon
+:   Green fruit with red flesh
 ```
 
 ## Commit conventions
@@ -215,7 +220,7 @@ When needed, each convention explains why it exists, so you can make a decision
 Note that these conventions are about the **structure** of the manual (and its source files), not about the content that goes in it.
 You, as the writer of documentation, are still in charge of its content.
 
-**For prose style, see the [documentation styleguide](./styleguide.md).**
+**For prose style, see the [documentation style guide](./styleguide.md).**
 
 ### Document structure
 
@@ -285,7 +290,7 @@ When changing existing content, update formatting if possible, but avoid excessi
 
 ### Examples first
 
-Put examples before detailed explanations (see the [styleguide](./styleguide.md) for the rationale).
+Put examples before detailed explanations (see the [style guide](./styleguide.md) for the rationale).
 
 Use this structure for each documented item:
 

doc/getting-started/dev-environments.md

@@ -5,7 +5,7 @@ Create a `shell.nix` with the following:
 ```nix
 # shell.nix
 let
-  nixpkgs = fetchTarball "https://github.com/NixOS/nixpkgs/archive/nixos-unstable.tar.gz";
+  nixpkgs = fetchTarball "https://channels.nixos.org/nixos-unstable/nixexprs.tar.zst";
   pkgs = import nixpkgs { };
 in
 pkgs.mkShell {
@@ -25,7 +25,7 @@ nix-shell
 This activates your `shell.nix` and you should see:
 
 ```sh
-unpacking 'https://github.com/NixOS/nixpkgs/archive/nixos-unstable.tar.gz' into the Git cache...
+unpacking 'https://channels.nixos.org/nixos-unstable/nixexprs.tar.zst' into the Git cache...
 Welcome in your nix shell
 ```
 

doc/getting-started/first-package.chapter.md

@@ -53,7 +53,7 @@ Pin Nixpkgs and call the package from `default.nix`:
 ```nix
 # default.nix
 let
-  nixpkgs = fetchTarball "https://github.com/NixOS/nixpkgs/archive/nixos-unstable.tar.gz";
+  nixpkgs = fetchTarball "https://channels.nixos.org/nixos-unstable/nixexprs.tar.zst";
   pkgs = import nixpkgs { };
 in
 pkgs.callPackage ./package.nix { }

doc/hooks/check-phase-thread-limit-hook.section.md

@@ -3,7 +3,7 @@
 This hook defaults a variety of environment variables known
 to control thread counts to 1. Many of these otherwise default
 to `$(nproc)`, which causes massive overloads on build machines
-if nix build jobs and build cores are already tuned to fully utilize
+if nix build jobs and build cores are already tuned to fully use
 compute capacity of a builder without additional parallelism.
 
 Currently sets the following environment variables:

doc/languages-frameworks/cosmic.section.md

@@ -5,7 +5,7 @@
 COSMIC (Computer Operating System Main Interface Components) is a desktop environment developed by
 System76, primarily for the Pop!_OS Linux distribution. Applications in the COSMIC ecosystem are
 written in Rust and use libcosmic, which builds on the Iced GUI framework. This section explains
-how to properly package and integrate COSMIC applications within Nix.
+how to package and integrate COSMIC applications within Nix.
 
 ### libcosmicAppHook {#ssec-cosmic-libcosmic-app-hook}
 
@@ -17,7 +17,7 @@ and wrapping applications based on libcosmic. It handles many common requirement
 - Managing Vergen environment variables for build-time information
 - Setting up Rust linker flags for specific libraries
 
-To use the hook, simply add it to your package's `nativeBuildInputs`:
+Add the hook to your package's `nativeBuildInputs`:
 
 ```nix
 {
@@ -61,8 +61,9 @@ rustPlatform.buildRustPackage {
 }
 ```
 
-Note that `cosmic-settings` is a separate application and not a part of the libcosmic settings
-system itself. It's included by default in `libcosmicAppHook` only to provide these fallback theme
+> [!Note]
+> `cosmic-settings` is a separate application and not a part of the libcosmic settings
+> system itself. It's included by default in `libcosmicAppHook` only to provide these fallback theme
 settings.
 
 ### Icons {#ssec-cosmic-icons}

doc/languages-frameworks/neovim.section.md

@@ -63,7 +63,7 @@ For instance, `sqlite-lua` needs `g:sqlite_clib_path` to be set to work. Nixpkgs
 - `wrapperArgs`: Extra arguments forwarded to the `makeWrapper` call.
 - `wrapRc`: Nix, not being able to write in your `$HOME`, loads the
   generated Neovim configuration via the `$VIMINIT` environment variable, i.e. : `export VIMINIT='lua dofile("/nix/store/…-init.lua")'`. This has side effects like preventing Neovim from sourcing your `init.lua` in `$XDG_CONFIG_HOME/nvim` (see bullet 7 of [`:help startup`](https://neovim.io/doc/user/starting.html#startup) in Neovim). Disable it if you want to generate your own wrapper. You can still reuse the generated vimscript init code via `neovim.passthru.initRc`.
-- `plugins`: A list of plugins to add to the wrapper.
+- `plugins`: A list of plugins to add to the wrapper. If a plugin is not available in nixpkgs, you can [package it yourself](#what-if-your-favourite-vim-plugin-isnt-already-packaged).
 - `extraLuaPackages`: A function passed on to `lua.withPackages`.
 - `extraPython3Packages`: A function passed on to `python3.withPackages`.
 - `withPython3`, `withNodeJs`, `withRuby`, `withPerl` control when to enable neovim

doc/release-notes/rl-2611.section.md

@@ -36,6 +36,10 @@
 - `zabbix.<package>` now defaults to version 7.4. If you want to keep using Zabbix 6.0, use `pkgs.zabbix60.<package>`.
   Note that Zabbix 6.0 is in limited support, and will be deprecated on February 28, 2027. Consider upgrading.
 
+- `zabbix-agent2-plugin-postgresql` is now moved to `zabbix{60,70,74}.plugins.postgresql`.
+
+- Official Zabbix plugins (ember-plus, mongodb, and mssql) have been added under `zabbix{60,70,74}.plugins.<plugin>`.
+
 - `perlPackages.NetOAuth` has been updated from 0.28 to 0.33.
   Callers that verify messages must now set `allowed_signature_methods` per message or configure `@Net::OAuth::ALLOWED_SIGNATURE_METHODS`; `verify` otherwise throws an exception.
   See the [upstream changelog](https://metacpan.org/dist/Net-OAuth/changes) for details.
@@ -117,6 +121,9 @@
 
 - `himalaya` has been updated from `v1.2.0` to `v2.0.0`, which introduces breaking changes. See the [release notes](https://github.com/pimalaya/himalaya/releases/tag/v2.0.0) and the [migration guide](https://github.com/pimalaya/himalaya/blob/master/MIGRATION.md).
 
+- `proton-cli` has been updated from `2.2.3` to `3.4.0`, and installs its command as `proton`, with `proton-cli` kept beside it as a symlink.
+  `3.0.0` reworked the command line - `--output` is now the response format, secrets are no longer accepted as flag values, and several subcommands moved - so scripts need a review against the [upstream changelog](https://github.com/roman-16/proton-cli/blob/main/CHANGELOG.md).
+
 - `tengine` has been removed as it has seen seriously delayed responses to security vulnerabilities.
 
 - `jellyfin` has been upgraded to major version 12, which contains breaking changes. See the [upstream blog post](https://jellyfin.org/posts/jellyfin-release-12.0) for more information on how to safely upgrade.
@@ -171,6 +178,8 @@
 - `replaceVarsWith` now enables `strictDeps` and `__structuredAttrs` and passing these attributes to the function is no longer allowed.
    By extension, `replaceVars` now also enables `strictDeps` and `__structuredAttrs`.
 
+- `nginx` / `nginxStable` is now built without the `rtmp` nginx module by default. You can enable it again using `nginx.override { modules = [ pkgs.nginxModules.rtmp ]; }`
+
 - `buildFHSEnvChroot` has been removed after deprecation in 23.05.
 
 - `leafnode` has been removed, as it was an unmaintained alpha-release of leafnode 2 and has a dependency on the EOL PRCE-library. Consider using `leafnode1` instead, which is still maintained.

doc/styleguide.md

@@ -1,4 +1,4 @@
-# Styleguide
+# Style guide
 
 Use this page as a reference and style guide for our internal and external documentation.
 
@@ -90,11 +90,13 @@ Don't describe what the documentation does. Just do it.
 **Don't:**
 
 > This section explains how to configure networking.
+
 > The following guide walks you through setting up a web server.
 
 **Do:**
 
 > Configure networking by setting:
+
 > Set up a web server:
 
 ### Code Examples

doc/toolchains/llvm.chapter.md

@@ -22,7 +22,7 @@ import <nixpkgs> {
 }
 ```
 
-Note that we set `linker` to `lld`. This is because LLVM has its own linker, called "lld". By setting it, we utilize Clang and lld within this new instance of Nixpkgs. There is a shorthand method for building everything with LLVM: `pkgsLLVM`. This is easier to use with `nix-build` (or `nix build`):
+Note that we set `linker` to `lld`. This is because LLVM has its own linker, called "lld". By setting it, we use Clang and lld within this new instance of Nixpkgs. There is a shorthand method for building everything with LLVM: `pkgsLLVM`. This is easier to use with `nix-build` (or `nix build`):
 
 ```bash
 nix-build -A pkgsLLVM.hello

doc/using/configuration.chapter.md

@@ -105,27 +105,48 @@ There are several ways to tweak how Nix handles a package which has been marked
     $ export NIXPKGS_ALLOW_UNFREE=1
     ```
 
--   It is possible to permanently allow individual unfree packages, while still blocking unfree packages by default using the `allowUnfreePredicate` configuration option in the user configuration file.
-
-    This option is a function which accepts a package as a parameter, and returns a boolean. The following example configuration accepts a package and always returns false:
-
-    ```nix
-    { allowUnfreePredicate = (pkg: false); }
-    ```
-
-    For a more useful example, try the following. This configuration only allows unfree packages named roon-server and Visual Studio Code:
+-   To allow specific unfree packages, add their names to your Nixpkgs configuration file:
 
     ```nix
     {
-      allowUnfreePredicate =
-        pkg:
-        builtins.elem (lib.getName pkg) [
-          "roon-server"
-          "vscode"
-        ];
+      allowUnfreePackages = [
+        "fence"
+        "roon-server"
+        "vscode"
+      ];
     }
     ```
 
+    `allowUnfreePackages` permits the listed unfree packages.
+
+    In NixOS modules, lists set through `nixpkgs.config.allowUnfreePackages` merge additively across modules. This allows you to declare your unfree exceptions in the same modules that triggered them.
+
+    To allow unfree packages programmatically:
+
+    ```nix
+    { lib, ... }:
+    {
+      allowUnfreePredicate = pkg: lib.hasPrefix "roon" (lib.getName pkg);
+    }
+    ```
+
+    This permits packages such as `roon-bridge` and `roon-server`.
+
+    To combine the list and predicate, set both options:
+
+    ```nix
+    { lib, ... }:
+    {
+      allowUnfreePackages = [
+        "fence"
+        "vscode"
+      ];
+      allowUnfreePredicate = pkg: lib.hasPrefix "roon" (lib.getName pkg);
+    }
+    ```
+
+    This permits unfree packages that match either option.
+
 -   It is also possible to allow and block licenses that are specifically acceptable or not acceptable, using `allowlistedLicenses` and `blocklistedLicenses`, respectively.
 
     The following example configuration allowlists the licenses `amd` and `wtfpl`:

lib/licenses/licenses.nix

@@ -703,11 +703,6 @@ lib.mapAttrs mkLicense (
       url = "https://www.schristiancollins.com/generaluser.php"; # license included in sources
     };
 
-    gfl = {
-      fullName = "GUST Font License";
-      url = "https://www.gust.org.pl/projects/e-foundry/licenses/GUST-FONT-LICENSE.txt";
-    };
-
     gfsl = {
       fullName = "GUST Font Source License";
       url = "https://www.gust.org.pl/projects/e-foundry/licenses/GUST-FONT-SOURCE-LICENSE.txt";

lib/modules.nix

@@ -1595,17 +1595,76 @@ let
   */
   mkDefinition = args@{ file, value, ... }: args // { _type = "definition"; };
 
+  /**
+    Labels a definition with a priority.
+    See the documentation of `filterOverrides` for the interpretation of the priority value.
+    Nesting this function usually leads to an invalid definition.
+    `mkDefault`, `mkOptionDefault`, and `mkForce` partially apply `mkOverride` with common priorities used in the NixOS module system.
+
+    # Inputs
+
+    `priority`
+
+    : A numeric value representing the precedence.
+      See the documentation of `filterOverrides` for the interpretation of this value.
+
+    `content`
+
+    : The definition to be labeled with a given priority.
+
+    # Examples
+    :::{.example}
+    ## `lib.modules.mkOverride` usage example
+
+    ```nix
+    mkOverride 1000 "hello, world!"
+    => { _type = "override"; content = "hello, world!"; priority = 1000; }
+    ```
+
+    ```nix
+    (lib.evalModules {
+      modules = [
+        { options.foo = lib.mkOption { }; }
+        { config.foo = lib.mkOverride 20 1; }
+        { config.foo = lib.mkOverride 10 2; }
+      ];
+    }).config
+    => { foo = 2; }
+    ```
+    :::
+  */
   mkOverride = priority: content: {
     _type = "override";
     inherit priority content;
   };
 
-  mkOptionDefault = mkOverride 1500; # priority of option defaults
-  mkDefault = mkOverride 1000; # used in config sections of non-user modules to set a default
+  /**
+    Labels a definition with the priority of option declaration defaults.
+  */
+  mkOptionDefault = mkOverride 1500;
+
+  /**
+    Labels a definition with the priority used in config sections of non-user modules to set a default.
+  */
+  mkDefault = mkOverride 1000;
+
   defaultOverridePriority = 100;
-  mkImageMediaOverride = mkOverride 60; # image media profiles can be derived by inclusion into host config, hence needing to override host config, but do allow user to mkForce
+
+  /**
+    Labels a definition with the priority used in image media profiles.
+    Image media profiles can be derived by inclusion into host config, hence needing to override host config, but do allow users to `mkForce`.
+  */
+  mkImageMediaOverride = mkOverride 60;
+
+  /**
+    Labels a definition with a high priority (low value).
+  */
   mkForce = mkOverride 50;
-  mkVMOverride = mkOverride 10; # used by ‘nixos-rebuild build-vm’
+
+  /**
+    Labels a definition with used by {command}`nixos-rebuild build-vm`.
+  */
+  mkVMOverride = mkOverride 10;
 
   mkFixStrictness = warn "lib.mkFixStrictness has no effect and will be removed. It returns its argument unmodified, so you can just remove any calls." id;
 

maintainers/maintainer-list.nix

@@ -460,6 +460,7 @@
     name = "aaravrav";
     github = "aaravrav";
     githubId = 37036762;
+    matrix = "@hepara:matrix.org";
   };
   aarnphm = {
     email = "contact@aarnphm.xyz";
@@ -5090,6 +5091,12 @@
     githubId = 1689801;
     name = "Mikhail Chekan";
   };
+  chemonke = {
+    email = "nixpkgs@chemonke.ch";
+    github = "chemonke";
+    githubId = 183837749;
+    name = "Curdin Bosshart";
+  };
   chen = {
     email = "i@cuichen.cc";
     github = "cu1ch3n";
@@ -11513,6 +11520,13 @@
     githubId = 58676303;
     name = "hhydraa";
   };
+  hideyosh1 = {
+    email = "penelope.zhong@proton.me";
+    keys = [ { fingerprint = "01E9 0D3E 815F 84CA 1003  E7D7 2F75 2D18 C2C1 7AF8"; } ];
+    name = "Penelope Zhong";
+    github = "hideyosh1";
+    githubId = 64223175;
+  };
   higebu = {
     name = "Yuya Kusakabe";
     email = "yuya.kusakabe@gmail.com";
@@ -12143,6 +12157,12 @@
     githubId = 71074737;
     name = "Simon Wick";
   };
+  ilovelinux = {
+    email = "nix+nixpkgs@ilovelinux.dev";
+    github = "ilovelinux";
+    githubId = 9268789;
+    name = "Antonio Spadaro";
+  };
   ilya-epifanov = {
     email = "mail@ilya.network";
     github = "ilya-epifanov";
@@ -20094,6 +20114,12 @@
     githubId = 52401682;
     name = "myul";
   };
+  Myxogastria0808 = {
+    email = "r.rstudio.c@gmail.com";
+    github = "Myxogastria0808";
+    githubId = 78744619;
+    name = "Yuki Osada";
+  };
   myypo = {
     email = "nikirsmcgl@gmail.com";
     github = "myypo";
@@ -28978,6 +29004,13 @@
     github = "thelissimus";
     githubId = 70096720;
   };
+  thelolcoder2007 = {
+    name = "thelolcoder2007";
+    github = "thelolcoder2007";
+    githubId = 52106896;
+    matrix = "@erents:dapperepoging.nl";
+    keys = [ { fingerprint = "E374 815F C754 462B 1C34  3562 FDC3 99DE 8F7E 200B"; } ];
+  };
   themadbit = {
     name = "Mark Tanui";
     email = "marktanui75@gmail.com";

maintainers/team-list.nix

@@ -108,7 +108,6 @@ with lib.maintainers;
     members = [
       lopsided98
       mic92
-      zowoq
     ];
     scope = "Maintain Buildbot CI framework";
     shortName = "Buildbot";

nixos/lib/test-driver/src/test_driver/machine/__init__.py

@@ -335,7 +335,7 @@ class BaseMachine(ABC):
         ...
 
     @abstractmethod
-    def wait_for_shutdown(self) -> None:
+    def wait_for_shutdown(self, timeout: dt.timedelta | None = None) -> None:
         """Wait for the machine to power off. This does *not* initiate a shutdown;
         that's usually done via `shutdown()`.
         """
@@ -1061,7 +1061,7 @@ class QemuMachine(BaseMachine):
                 break
             self.send_console(char.decode())
 
-    def wait_for_shutdown(self) -> None:
+    def wait_for_shutdown(self, timeout: dt.timedelta | None = None) -> None:
         """
         Wait for the VM to power off. This does *not* initiate a shutdown;
         that's usually done via `shutdown()`.
@@ -1072,7 +1072,9 @@ class QemuMachine(BaseMachine):
         with self.nested("waiting for the VM to power off"):
             sys.stdout.flush()
             assert self.process
-            self.process.wait()
+            self.process.wait(
+                timeout=timeout.total_seconds() if timeout is not None else None
+            )
 
             self.pid = None
             self.booted = False
@@ -1903,7 +1905,7 @@ class NspawnMachine(BaseMachine):
         self.systemctl("poweroff")
         self.wait_for_shutdown()
 
-    def wait_for_shutdown(self) -> None:
+    def wait_for_shutdown(self, timeout: dt.timedelta | None = None) -> None:
         """
         Wait for the container to power off. This does *not* initiate a shutdown;
         that's usually done via `shutdown()`.
@@ -1912,7 +1914,9 @@ class NspawnMachine(BaseMachine):
             return
 
         with self.nested("waiting for the container to power off"):
-            self.process.wait()
+            self.process.wait(
+                timeout=timeout.total_seconds() if timeout is not None else None
+            )
             self.process = None
 
 

nixos/modules/config/nix-channel.nix

@@ -42,7 +42,7 @@ in
         };
       };
 
-      nixPath = mkOption {
+      settings.nix-path = mkOption {
         type = types.listOf types.str;
         default =
           if cfg.channel.enable then
@@ -80,8 +80,11 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  imports = [
+    (lib.mkRenamedOptionModule [ "nix" "nixPath" ] [ "nix" "settings" "nix-path" ])
+  ];
 
+  config = mkIf cfg.enable {
     environment.extraInit = mkIf cfg.channel.enable ''
       if [ -e "$HOME/.nix-defexpr/channels" ]; then
         export NIX_PATH="$HOME/.nix-defexpr/channels''${NIX_PATH:+:$NIX_PATH}"
@@ -95,7 +98,7 @@ in
     # NIX_PATH has a non-empty default according to Nix docs, so we don't unset
     # it when empty.
     environment.sessionVariables = {
-      NIX_PATH = cfg.nixPath;
+      NIX_PATH = cfg.settings.nix-path;
     };
 
     systemd.tmpfiles.rules = lib.mkIf cfg.channel.enable [

nixos/modules/misc/nixpkgs-flake.nix

@@ -102,7 +102,7 @@ in
         # because we would need some kind of evil shim taking the *calling* flake's self path,
         # perhaps, to ever make that work (in order to know where the Nix expr for the system came
         # from and how to call it).
-        nix.nixPath = lib.mkDefault (
+        nix.settings.nix-path = lib.mkDefault (
           [ "nixpkgs=flake:nixpkgs" ]
           ++ lib.optional config.nix.channel.enable "/nix/var/nix/profiles/per-user/root/channels"
         );

nixos/modules/programs/wayland/noctalia.nix

@@ -33,7 +33,13 @@ in
   config = lib.mkIf cfg.enable (
     lib.mkMerge [
       {
-        environment.systemPackages = [ cfg.package ];
+        environment.systemPackages = [
+          cfg.package
+        ];
+
+        # Needed to add the freedesktop sound theme
+        # It's only a runtime dependency for noctalia, so it's not made a package dependency.
+        xdg.sounds.enable = true;
 
         systemd.user.services.noctalia = lib.mkIf cfg.systemd.enable {
           description = "Noctalia Wayland desktop shell";

nixos/modules/security/account-utils.nix

@@ -51,7 +51,10 @@ in
       sockets.pwupdd.wantedBy = lib.optional config.users.mutableUsers "sockets.target"; # immutable users do not need password updating
       sockets.newidmapd.wantedBy = [ "sockets.target" ];
       services."pwupdd@".environment.PWUPDD_OPTS = lib.escapeShellArgs cfg.extraArgs;
-      services."pwaccessd".environment.PWACCESSD_OPTS = lib.escapeShellArgs cfg.extraArgs;
+      services."pwaccessd".environment = {
+        LD_LIBRARY_PATH = config.system.nssModules.path;
+        PWACCESSD_OPTS = lib.escapeShellArgs cfg.extraArgs;
+      };
     };
 
     environment.systemPackages = [ cfg.package ];

nixos/modules/services/desktops/accountsservice.nix

@@ -48,6 +48,7 @@
 
           # Accounts daemon looks for dbus interfaces in $XDG_DATA_DIRS/accountsservice
           environment.XDG_DATA_DIRS = "${config.system.path}/share";
+          environment.LD_LIBRARY_PATH = config.system.nssModules.path;
 
         }
         (

nixos/modules/services/monitoring/beszel-agent.nix

@@ -136,6 +136,7 @@ in
       path =
         cfg.extraPath
         ++ lib.optionals cfg.smartmon.enable [ cfg.smartmon.package ]
+        ++ lib.optionals config.boot.zfs.enabled [ config.boot.zfs.package ]
         ++ lib.optionals (builtins.elem "nvidia" config.services.xserver.videoDrivers) [
           (lib.getBin config.hardware.nvidia.package)
         ]
@@ -182,9 +183,9 @@ in
 
         LockPersonality = true;
         NoNewPrivileges = !cfg.smartmon.enable;
-        PrivateDevices = !cfg.smartmon.enable;
+        PrivateDevices = !cfg.smartmon.enable && !config.boot.zfs.enabled;
         PrivateTmp = true;
-        PrivateUsers = !cfg.smartmon.enable && !cfg.environment.SKIP_SYSTEMD;
+        PrivateUsers = !cfg.smartmon.enable && !config.boot.zfs.enabled && !cfg.environment.SKIP_SYSTEMD;
         ProtectClock = true;
         ProtectControlGroups = "strict";
         ProtectHome = "read-only";

nixos/modules/services/networking/fedimintd.nix

@@ -13,7 +13,6 @@ let
     mkEnableOption
     mkIf
     mkOption
-    mkOverride
     mkPackageOption
     nameValuePair
     recursiveUpdate
@@ -351,13 +350,11 @@ in
         fedimintdName: cfg:
         (nameValuePair cfg.nginx.fqdn (
           lib.mkMerge [
-            cfg.nginx.config
+            (lib.mapAttrsRecursive (_: lib.mkDefault) cfg.nginx.config)
 
             {
-              # Note: we want by default to enable OpenSSL, but it seems anything 100 and above is
-              # overridden by default value from vhost-options.nix
-              enableACME = mkOverride 99 true;
-              forceSSL = mkOverride 99 true;
+              enableACME = true;
+              forceSSL = true;
               locations.${cfg.nginx.path_ws} = {
                 proxyPass = "http://127.0.0.1:${toString cfg.api_ws.port}/";
                 proxyWebsockets = true;

nixos/modules/services/networking/nebula.nix

@@ -292,7 +292,7 @@ in
     assertions = lib.mapAttrsToList (netName: netCfg: {
       # IFNAMSIZ caps network device names to 16 chars (including NULL terminator).
       # Without this check, users might end up with a truncated interface name.
-      assertion = !netCfg.tun.disable && builtins.stringLength netCfg.tun.device <= 15;
+      assertion = netCfg.tun.disable || builtins.stringLength netCfg.tun.device <= 15;
       message = ''
         Network device names can't be longer than 15 chars.
         `config.services.nebula.networks.${netName}.tun.device` is set to "${netCfg.tun.device}" which is above the limit.

nixos/modules/services/web-apps/changedetection-io.nix

@@ -202,7 +202,7 @@ in
 
         (mkIf cfg.playwrightSupport {
           changedetection-io-playwright = {
-            image = "browserless/chrome";
+            image = "docker.io/browserless/chrome";
             environment = {
               SCREEN_WIDTH = "1920";
               SCREEN_HEIGHT = "1024";

nixos/modules/services/web-apps/homebox.nix

@@ -43,7 +43,7 @@ in
       type = types.submodule { freeformType = types.attrsOf (types.nullOr types.str); };
       defaultText = lib.literalExpression ''
         {
-          HBOX_STORAGE_CONN_STRING = "file:///var/lib/homebox";
+          HBOX_STORAGE_CONN_STRING = "file:///var/lib/homebox?no_tmp_dir=1";
           HBOX_STORAGE_PREFIX_PATH = "data";
           HBOX_DATABASE_DRIVER = "sqlite3";
           HBOX_DATABASE_SQLITE_PATH = "/var/lib/homebox/data/homebox.db?_pragma=busy_timeout=999&_pragma=journal_mode=WAL&_fk=1";
@@ -51,7 +51,6 @@ in
           HBOX_OPTIONS_GITHUB_RELEASE_CHECK = "false";
           HBOX_MODE = "production";
           HOME = "/var/lib/homebox";
-          TMPDIR = "/var/lib/homebox/tmp";
         }
       '';
       description = ''
@@ -125,7 +124,9 @@ in
 
     services.homebox.settings = lib.mkMerge [
       (lib.mapAttrs (_: mkDefault) {
-        HBOX_STORAGE_CONN_STRING = "file:///var/lib/homebox";
+        # We cannot use a tempdir as homebox wants to rename the file, which does not work across filesystem boundaries
+        # also see: https://github.com/google/go-cloud/issues/3294 and https://pkg.go.dev/gocloud.dev/blob/fileblob#URLOpener
+        HBOX_STORAGE_CONN_STRING = "file:///var/lib/homebox?no_tmp_dir=1";
         HBOX_STORAGE_PREFIX_PATH = "data";
         HBOX_DATABASE_DRIVER = "sqlite3";
         HBOX_DATABASE_SQLITE_PATH = "/var/lib/homebox/data/homebox.db?_pragma=busy_timeout=999&_pragma=journal_mode=WAL&_fk=1";
@@ -134,10 +135,8 @@ in
         HBOX_MODE = "production";
         # Fix this startup issue:
         #   failed to create modcache index dir: mkdir /var/empty/.cache: read-only file system
+        # TODO: remove once https://github.com/golang/tools/commit/03cb4551c662c0e078502fe5f317ca4114b89cd8 is available
         HOME = "/var/lib/homebox";
-        # Fix uploading/saving attachments/images:
-        # [...] rename /tmp/ced4804c80b1ed1f6e88060f6d829db421e6dbf3a189715265900b5d6b0243ed.1889b3d16ab36e22.tmp /var/lib/homebox/data/5f42f81b-e9ad-4495-b6a6-9e9f704db30e/documents/ced4804c80b1ed1f6e88060f6d829db421e6dbf3a189715265900b5d6b0243ed: invalid cross-device link" [...]
-        TMPDIR = "/var/lib/homebox/tmp";
       })
 
       (mkIf cfg.database.createLocally {

nixos/tests/all-tests.nix

@@ -1322,6 +1322,9 @@ in
   nixos-rebuild-target-host = runTest {
     imports = [ ./nixos-rebuild-target-host.nix ];
   };
+  nixos-rebuild-target-host-interrupted = runTest {
+    imports = [ ./nixos-rebuild-target-host-interrupted.nix ];
+  };
   nixpkgs = pkgs.callPackage ../modules/misc/nixpkgs/test.nix { inherit evalMinimalConfig; };
   nixpkgs-config-allow-unfree =
     pkgs.callPackage ../modules/misc/nixpkgs/test-nixpkgs-config-allow-unfree.nix

nixos/tests/homebox.nix

@@ -14,6 +14,8 @@ in
           services.homebox = {
             enable = true;
             settings.HBOX_WEB_PORT = port;
+            settings.HBOX_OPTIONS_ALLOW_REGISTRATION = "true";
+            settings.HBOX_LOG_LEVEL = "trace";
           };
         };
 
@@ -50,6 +52,7 @@ in
     in
     self;
   testScript = ''
+    import json
     def test_homebox(node):
       node.wait_for_unit("homebox.service")
       node.wait_for_open_port(${port})
@@ -57,6 +60,29 @@ in
       node.succeed("curl --fail -X GET 'http://localhost:${port}/'")
       out = node.succeed("curl --fail 'http://localhost:${port}/api/v1/status'")
       assert '"health":true' in out
+      node.succeed("curl --request POST --fail 'http://localhost:${port}/api/v1/users/register' \
+        --data '{\"email\":\"a@b.c\",\"name\":\"test\",\"password\":\"password\"}' \
+      ")
+      login = node.succeed("curl --request POST --fail 'http://localhost:${port}/api/v1/users/login' \
+        --data-urlencode 'password=password' \
+        --data-urlencode 'username=a@b.c' \
+      ")
+      login_data = json.loads(login)
+      token = login_data["token"]
+      locations = node.succeed(f"curl --request GET --fail 'http://localhost:${port}/api/v1/entities?isLocation=true' \
+        --header 'Authorization: {token}' \
+      ")
+      location_id = json.loads(locations)["items"][0]["id"]
+      item = node.succeed(f"curl --request POST --fail 'http://localhost:${port}/api/v1/entities' \
+        --header 'Authorization: {token}' \
+        --data '{{\"name\":\"testitem\",\"parentId\":\"{location_id}\"}}' \
+      ")
+      item_id = json.loads(item)["id"]
+      node.succeed(f"curl --request POST --fail 'http://localhost:${port}/api/v1/entities/{item_id}/attachments' \
+        --header 'Authorization: {token}' \
+        --form 'file=test;type=text/plain;filename=test.txt' \
+        --form name=test.txt \
+      ")
 
     test_homebox(simple)
     simple.send_monitor_command("quit")

nixos/tests/nebula/connectivity.nix

@@ -1,6 +1,9 @@
-{ pkgs, lib, ... }:
+{
+  pkgs,
+  lib,
+  ...
+}:
 let
-
   # We'll need to be able to trade cert files between nodes via scp.
   inherit (import ../ssh-keys.nix pkgs)
     snakeOilPrivateKey
@@ -44,13 +47,11 @@ let
       }
       extraConfig
     ];
-
 in
 {
   name = "nebula";
 
   nodes = {
-
     lighthouse =
       { ... }@args:
       makeNebulaNode args "lighthouse" {
@@ -97,6 +98,24 @@ in
             };
           };
         };
+
+        # A lighthouse can run without a tun interface, no device name = skip length check pr 565501
+        services.nebula.networks.tunless = {
+          ca = "/etc/nebula/ca.crt";
+          cert = "/etc/nebula/lighthouse.crt";
+          key = "/etc/nebula/lighthouse.key";
+          isLighthouse = true;
+          listen = {
+            host = "0.0.0.0";
+            port = 4243;
+          };
+          tun = {
+            disable = true;
+            device = "nebula.tunless-too-long";
+          };
+          user = "nebula-smoke";
+          group = "nebula-smoke";
+        };
       };
 
     allowAny =
@@ -265,12 +284,10 @@ in
           };
         };
       };
-
   };
 
   testScript =
     let
-
       setUpPrivateKey = name: ''
         ${name}.start()
         ${name}.succeed(
@@ -379,6 +396,11 @@ in
       lighthouse.wait_until_succeeds("ping -c1 -W1 10.0.100.1", timeout=10)
       lighthouse.wait_until_succeeds("ping -c1 -W1 2001:db8::1", timeout=10)
 
+      # The tunless network starts without a tun device despite its (deliberately over-long) configured device name. pr 565501
+      lighthouse.wait_for_unit("nebula@tunless.service")
+      lighthouse.wait_until_succeeds("ss -lun | grep -q ':4243'", timeout=10)
+      lighthouse.fail("ip link show nebula.tunless-too-long")
+
       # Start all the machines to be set up
       allowAny.start()
       allowFromLighthouse.start()

nixos/tests/nix-required-mounts/default.nix

@@ -12,10 +12,12 @@ in
     {
       virtualisation.writableStore = true;
       system.extraDependencies = [ (pkgs.runCommand "deps" { } "mkdir $out").inputDerivation ];
-      nix.nixPath = [ "nixpkgs=${../../..}" ];
-      nix.settings.substituters = lib.mkForce [ ];
-      nix.settings.system-features = [ "supported-feature" ];
-      nix.settings.experimental-features = [ "nix-command" ];
+      nix.settings = {
+        experimental-features = [ "nix-command" ];
+        nix-path = [ "nixpkgs=${../../..}" ];
+        substituters = lib.mkForce [ ];
+        system-features = [ "supported-feature" ];
+      };
       nix.enable = true; # disabled by default. See all-tests.nix / tag(no-nix-by-default)
       programs.nix-required-mounts.enable = true;
       programs.nix-required-mounts.allowedPatterns.supported-feature = {

nixos/tests/nixos-rebuild-target-host-interrupted.nix

@@ -0,0 +1,236 @@
+{ hostPkgs, ... }:
+
+# This test recreates a remote deployment scenario where the connection
+# between deployer and target is closed during the deployment - in this
+# case because the connection goes over a 'reverse ssh' tunnel service
+# that has changes that are being deployed.
+
+# This is not seamless (the deployer doesn't get to see the logs after
+# the disconnect), but is a lot better than the old behaviour, where
+# the switch was aborted and the connection never restored.
+
+{
+  name = "nixos-rebuild-target-host-interrupted";
+
+  # TODO: remove overlay from  nixos/modules/profiles/installation-device.nix
+  #        make it a _small package instead, then remove pkgsReadOnly = false;.
+  node.pkgsReadOnly = false;
+
+  # disabled by default. See all-tests.nix / tag(no-nix-by-default)
+  defaults.nix.enable = true;
+
+  nodes = {
+    deployer =
+      {
+        nodes,
+        lib,
+        pkgs,
+        ...
+      }:
+      let
+        inherit (import ./ssh-keys.nix pkgs) snakeOilPrivateKey snakeOilPublicKey;
+      in
+      {
+        imports = [
+          ../modules/profiles/installation-device.nix
+        ];
+
+        nix.settings = {
+          substituters = lib.mkForce [ ];
+          hashed-mirrors = null;
+          connect-timeout = 1;
+        };
+
+        system.includeBuildDependencies = true;
+
+        virtualisation = {
+          cores = 2;
+          memorySize = 3072;
+        };
+
+        services.openssh.enable = true;
+        users.users.root.openssh.authorizedKeys.keys = [ nodes.target.system.build.publicKey ];
+
+        system.build.privateKey = snakeOilPrivateKey;
+        system.build.publicKey = snakeOilPublicKey;
+        system.switch.enable = true;
+
+        services.getty.autologinUser = lib.mkForce "root";
+      };
+
+    target =
+      {
+        nodes,
+        lib,
+        pkgs,
+        ...
+      }:
+      let
+        inherit (import ./ssh-keys.nix pkgs) snakeOilPrivateKey snakeOilPublicKey;
+        targetConfig = {
+          documentation.enable = false;
+          services.openssh.enable = true;
+          system.build.privateKey = snakeOilPrivateKey;
+          system.build.publicKey = snakeOilPublicKey;
+
+          users.users.root.openssh.authorizedKeys.keys = [ nodes.deployer.system.build.publicKey ];
+          users.users.alice.openssh.authorizedKeys.keys = [ nodes.deployer.system.build.publicKey ];
+          users.users.bob.openssh.authorizedKeys.keys = [ nodes.deployer.system.build.publicKey ];
+
+          users.users.alice.extraGroups = [ "wheel" ];
+          users.users.bob.extraGroups = [ "wheel" ];
+
+          # Disable sudo for root to ensure sudo isn't called without `--sudo`
+          security.sudo.extraRules = lib.mkForce [
+            {
+              groups = [ "wheel" ];
+              commands = [ { command = "ALL"; } ];
+            }
+            {
+              users = [ "alice" ];
+              commands = [
+                {
+                  command = "ALL";
+                  options = [ "NOPASSWD" ];
+                }
+              ];
+            }
+          ];
+
+          nix.settings.trusted-users = [ "@wheel" ];
+
+          environment.etc."autossh-identity.key" = {
+            source = nodes.target.system.build.privateKey;
+            mode = "0600";
+          };
+
+          services.autossh-ng.sessions.will-be-interrupted-by-rebuild = {
+            user = "root";
+            destination = "deployer";
+            extraArguments = "-R2222:localhost:22 -i/etc/autossh-identity.key";
+            hostKeyChecking = false;
+          };
+          # Faster retry to avoid slow test
+          systemd.services.autossh-ng-will-be-interrupted-by-rebuild.serviceConfig.RestartSec =
+            lib.mkForce "1s";
+        };
+      in
+      {
+        imports = [ ./common/user-account.nix ];
+
+        config = lib.mkMerge [
+          targetConfig
+          {
+            system.build = {
+              inherit targetConfig;
+            };
+            system.switch.enable = true;
+
+            networking.hostName = "target";
+          }
+        ];
+      };
+  };
+
+  testScript =
+    { nodes, ... }:
+    let
+      sshConfig = builtins.toFile "ssh.conf" ''
+        UserKnownHostsFile=/dev/null
+        StrictHostKeyChecking=no
+      '';
+
+      targetConfigJSON = hostPkgs.writeText "target-configuration.json" (
+        builtins.toJSON nodes.target.system.build.targetConfig
+      );
+
+      targetNetworkJSON = hostPkgs.writeText "target-network.json" (
+        builtins.toJSON nodes.target.system.build.networkConfig
+      );
+
+      configFile =
+        hostname:
+        hostPkgs.writeText "configuration.nix" # nix
+          ''
+            { lib, pkgs, modulesPath, ... }: {
+              imports = [
+                (modulesPath + "/virtualisation/qemu-vm.nix")
+                (modulesPath + "/virtualisation/guest-networking-options.nix")
+                (modulesPath + "/testing/test-instrumentation.nix")
+                (modulesPath + "/../tests/common/user-account.nix")
+                (lib.modules.importJSON ./target-configuration.json)
+                (lib.modules.importJSON ./target-network.json)
+                ./hardware-configuration.nix
+              ];
+
+              boot.loader.grub = {
+                enable = true;
+                device = "/dev/vda";
+                forceInstall = true;
+              };
+
+              # We're changing the '-E' parameter to the new hostname here,
+              # not because we care about the logs, but because we want to
+              # force the scenario where the connection is broken during the
+              # deployment (because the autossh-ng service is stopped and
+              # started):
+              services.autossh-ng.sessions.will-be-interrupted-by-rebuild.extraArguments = "-R2222:localhost:22 -i/etc/autossh-identity.key -E ${hostname}";
+
+              # this will be asserted to validate the switch happened:
+              networking.hostName = "${hostname}";
+            }
+          '';
+    in
+    # python
+    ''
+      start_all()
+      target.wait_for_open_port(22)
+
+      deployer.wait_until_succeeds("ping -c1 target")
+      deployer.succeed("install -Dm 600 ${nodes.deployer.system.build.privateKey} ~root/.ssh/id_ecdsa")
+      deployer.succeed("install ${sshConfig} ~root/.ssh/config")
+
+      target.succeed("nixos-generate-config")
+      deployer.succeed("scp alice@target:/etc/nixos/hardware-configuration.nix /root/hardware-configuration.nix")
+      target.wait_for_unit("autossh-ng-will-be-interrupted-by-rebuild.service")
+
+      deployer.copy_from_host("${configFile "config-1-deployed"}", "/root/configuration-1.nix")
+      deployer.copy_from_host("${configFile "config-2-deployed"}", "/root/configuration-2.nix")
+      deployer.copy_from_host("${targetNetworkJSON}", "/root/target-network.json")
+      deployer.copy_from_host("${targetConfigJSON}", "/root/target-configuration.json")
+
+      with subtest("Deploy to alice@target via reverse ssh"):
+        deployer.wait_for_unit("multi-user.target")
+        # Uses TTY/send_chars instead of deployer.succeed to set NIX_SSHOPTS
+        deployer.send_chars("NIX_SSHOPTS=\"-p 2222\" nixos-rebuild switch -I nixos-config=/root/configuration-1.nix --target-host alice@localhost --sudo\n")
+
+        # the connection breaks, but the 'switch' should now continue in the background:
+        deployer.wait_until_tty_matches("1", "error: while running command with remote sudo")
+
+        def deployed(last_try: bool) -> bool:
+            target_hostname = deployer.succeed("ssh alice@target cat /etc/hostname", timeout=20).rstrip()
+            if last_try:
+                print(f"Still seeing hostname {target_hostname}")
+            return target_hostname == "config-1-deployed"
+        retry(deployed)
+
+      with subtest("Deploy to bob@target via reverse ssh with password-based sudo"):
+        deployer.wait_for_unit("multi-user.target")
+        # Uses TTY/send_chars instead of deployer.succeed to set NIX_SSHOPTS and for ask-sudo-password
+        deployer.send_chars("""NIX_SSHOPTS="-p 2222" nixos-rebuild switch -I nixos-config=/root/configuration-2.nix --target-host bob@localhost --ask-sudo-password; printf '%s\\n' "$?" > /tmp/bob-rebuild-status\n""")
+        deployer.wait_until_tty_matches("1", "password for bob")
+        deployer.send_chars("${nodes.target.users.users.bob.password}\n")
+
+        # the connection breaks, but the 'switch' should now continue in the background:
+        deployer.wait_for_file("/tmp/bob-rebuild-status")
+        status = deployer.succeed("cat /tmp/bob-rebuild-status").strip()
+        assert status != "0", "Expected the interrupted SSH deployment to report failure"
+
+        def deployed(last_try: bool) -> bool:
+            target_hostname = deployer.succeed("ssh alice@target cat /etc/hostname", timeout=20).rstrip()
+            if last_try:
+                print(f"Still seeing hostname {target_hostname}")
+            return target_hostname == "config-2-deployed"
+        retry(deployed)
+    '';
+}

nixos/tests/postgresql/wal2json.nix

@@ -22,6 +22,7 @@ let
               wal_level = "logical";
               max_replication_slots = "10";
               max_wal_senders = "10";
+              output_plugin_libraries = "wal2json";
             };
           };
         };

nixos/tests/systemd-shutdown.nix

@@ -13,24 +13,32 @@ in
 
   nodes.machine = {
     imports = [ ../modules/profiles/minimal.nix ];
+    systemd.shutdown.pre-exitrd = pkgs.writeShellScript "pre-exitrd" ''
+      echo pre-exitrd > /run/initramfs/test.txt
+    '';
     systemd.shutdownRamfs.contents."/etc/systemd/system-shutdown/shutdown-message".source =
       pkgs.writeShellScript "shutdown-message" ''
-        echo "${msg}" > /dev/kmsg
+        if test -e /test.txt; then
+          # Test should only pass if both scripts run.
+          echo "${msg}" > /dev/kmsg
+        fi
       '';
     boot.initrd.systemd.enable = systemdStage1;
   };
 
   testScript = ''
+    import datetime as dt
+
     # Check that 'generate-shutdown-ramfs.service' is started
     # automatically and that 'systemd-shutdown' runs our script.
     machine.wait_for_unit("multi-user.target")
     # .shutdown() would wait for the machine to power off
     machine.execute("systemctl poweroff", check_return=False)
     # Message printed by systemd-shutdown
-    machine.wait_for_console_text("Unmounting '/oldroot'")
-    machine.wait_for_console_text("${msg}")
+    machine.wait_for_console_text("Unmounting '/oldroot'", timeout=dt.timedelta(seconds=60))
+    machine.wait_for_console_text("${msg}", timeout=dt.timedelta(seconds=5))
     # Don't try to sync filesystems
-    machine.wait_for_shutdown()
+    machine.wait_for_shutdown(timeout=dt.timedelta(seconds=5))
 
     # In a separate boot, start 'generate-shutdown-ramfs.service'
     # manually in order to check the permissions on '/run/initramfs'.

pkgs/applications/backup/timeshift/unwrapped.nix

@@ -18,7 +18,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "timeshift";
-  version = "25.12.4";
+  version = "26.09.0";
   outputs = [
     "out"
     "man"
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "linuxmint";
     repo = "timeshift";
     tag = finalAttrs.version;
-    hash = "sha256-4iK9RngcqwR0sYo9AXcTwEQ1eoPQPbAmwM5k/rcgU9s=";
+    hash = "sha256-mMG3rMC4wH8bpwfEntEJfFhn8gXoZf7iLraxTysttQ8=";
   };
 
   postPatch = ''

pkgs/applications/emulators/wine/sources.nix

@@ -151,9 +151,9 @@ rec {
 
   unstable = fetchurl rec {
     # NOTE: Don't forget to change the hash for staging as well.
-    version = "11.16";
+    version = "11.18";
     url = "https://dl.winehq.org/wine/source/11.x/wine-${version}.tar.xz";
-    hash = "sha256-xm4gkDQ9zXJ/f3/S+H7gv7CxGHkMHXRat7ikw6QZfy8=";
+    hash = "sha256-xigvbU2uzxHzq5+aK2xZj2e+fijDY7osroo8RLYR56Q=";
 
     patches = [
       # Also look for root certificates at $NIX_SSL_CERT_FILE
@@ -163,7 +163,7 @@ rec {
     # see https://gitlab.winehq.org/wine/wine-staging
     staging = fetchFromGitLab {
       inherit version;
-      hash = "sha256-14VEZMMlWCsStm2AJNO+wBPPO67EGDsQyNiFBBtIcUg=";
+      hash = "sha256-KZCkra0y3XFNrbD2lZ+YUCLyq1POC30Sd4sGCJZuwgQ=";
       domain = "gitlab.winehq.org";
       owner = "wine";
       repo = "wine-staging";

pkgs/applications/networking/browsers/brave/packages/brave-origin.nix

@@ -1,21 +1,21 @@
 # Expression generated by update.py; do not edit it by hand!
 rec {
   pname = "brave-origin";
-  version = "1.95.104";
+  version = "1.96.59";
   flavor = "origin";
 
   archives = {
     aarch64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-origin_${version}_arm64.deb";
-      sha256 = "3efe3d4325b241a19449348a3e32af574be9842b2b0fae1eb942a87bb50333a7";
+      sha256 = "b088a568b3d98893b737a2bfdd5a3769ebb67798100b413e6cce555d42d65f57";
     };
     x86_64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-origin_${version}_amd64.deb";
-      sha256 = "fe6a88b3301eb8a08ed062d32bde01786d1b666e5ab842b5625c854eb11f2886";
+      sha256 = "447bc5ac4b2a2bfa71260cdf9d52d2fab694f59e15a4b9a907980f5b3ec45613";
     };
     aarch64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/Brave-Origin-arm64.dmg";
-      sha256 = "2f59547e4b53ac300450cb4f56f292bcbf508b20fdfa06c6341e5fd976d66859";
+      sha256 = "71f88f231526d99c7eb18d809dfe56a04899a97a3713c0a4476df2fe4132cdbd";
     };
   };
 }

pkgs/applications/networking/browsers/brave/packages/brave.nix

@@ -1,20 +1,20 @@
 # Expression generated by update.py; do not edit it by hand!
 rec {
   pname = "brave";
-  version = "1.95.104";
+  version = "1.96.59";
 
   archives = {
     aarch64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_arm64.deb";
-      sha256 = "251ee83fa383db6106ae6140df0975689b226d15ceb96cdb4147cb90cd7c25ba";
+      sha256 = "b82a7a488c9bc0c7b18fea1a2da8acb49f42b4a856493d6a4ce75a0b9a49fee3";
     };
     x86_64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-      sha256 = "e09e3c3e9fc84f75e65048a0be830c7c4907744a402b5790530d2206b276426e";
+      sha256 = "b05129c6907670b2029e2f01773d192c8b87c3075b25873ea3bc226bb0f15f1e";
     };
     aarch64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/Brave-Browser-arm64.dmg";
-      sha256 = "f6823d53b3e9a287b8f8830b728ba9b34fe2d4a9f6ee4e05b3bcd4a21ee25eaf";
+      sha256 = "57690cf24e5ce5e15768b220d46621e575e0caabd3d651bdad5afc2b184f118a";
     };
   };
 }

pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix

@@ -29,6 +29,10 @@ buildMozillaMach rec {
     maxSilent = 14400; # 4h, double the default of 7200s (c.f. #129212, #129115)
     license = lib.licenses.mpl20;
     mainProgram = binaryName;
+    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "mozilla" version // {
+      product = "firefox";
+      sw_edition = "beta";
+    };
   };
   tests = {
     inherit (nixosTests) firefox-beta;

pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix

@@ -42,6 +42,11 @@
     maxSilent = 14400; # 4h, double the default of 7200s (c.f. #129212, #129115)
     license = lib.licenses.mpl20;
     mainProgram = binaryName;
+    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "mozilla" version // {
+      product = "firefox";
+      sw_edition = "devedition";
+    };
+
   };
   tests = {
     inherit (nixosTests) firefox-devedition;

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -27,13 +27,13 @@
     "vendorHash": null
   },
   "aiven_aiven": {
-    "hash": "sha256-OOEtFEs8EBOlvAoAOVKS1yFCYBzJ/75G7arDkkjS5LA=",
+    "hash": "sha256-By/CEi2DEZSvrfyV9KTBp6VlaIK1m4xF71KEpJbtrG8=",
     "homepage": "https://registry.terraform.io/providers/aiven/aiven",
     "owner": "aiven",
     "repo": "terraform-provider-aiven",
-    "rev": "v4.62.0",
+    "rev": "v4.63.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-TXeJPVyb3+t1wJyHXNbmy6iPrPTG47bedHB0UyEUv98="
+    "vendorHash": "sha256-jrr657aGldXtq4XHfYYpgr1HQpe+cg1mWa7gwRj30io="
   },
   "akamai_akamai": {
     "hash": "sha256-ui8w8z9kROptw0tCvtT645bbNJV/BRd10aVomwhl+hI=",
@@ -598,13 +598,13 @@
     "vendorHash": "sha256-9DiGgBQyN2lv7w4IkjMuWGNo9oTIvdK1qcdEpKpy5NE="
   },
   "hashicorp_google-beta": {
-    "hash": "sha256-EvcjgQupjAPKkbPObTTXNUsyyo7Udwc6rriD4/K7UhE=",
+    "hash": "sha256-JNPZ9nL5mkoqH0HNQr6mNWNadtnK1iZlMhy1UDds/v8=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
     "owner": "hashicorp",
     "repo": "terraform-provider-google-beta",
-    "rev": "v8.3.0",
+    "rev": "v8.4.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-t3lzDRh0v6vMbw8qLXTOjKNUtaBlXOZkqNO+mJyP9NQ="
+    "vendorHash": "sha256-KI1hUXlJVoKGRyDODIfHJCBmN08Hml5JK+BSYiWGeXQ="
   },
   "hashicorp_helm": {
     "hash": "sha256-O3QcQf+TBmSB/mY5wybk/8BUG5RTjLhJYU+9jOOUqBI=",
@@ -851,11 +851,11 @@
     "vendorHash": "sha256-BFhxDYfbHNY4omovikg01UDqt2oxCtg9Q85DPuHSUeE="
   },
   "launchdarkly_launchdarkly": {
-    "hash": "sha256-DVpsm3adZEwWzgvIFu8pXUGVTch18oW4UdXPQ8XZZb0=",
+    "hash": "sha256-4n7QRhQd/9juZ+qdO3G9Qs+uwokmia82/xJ254A+9q0=",
     "homepage": "https://registry.terraform.io/providers/launchdarkly/launchdarkly",
     "owner": "launchdarkly",
     "repo": "terraform-provider-launchdarkly",
-    "rev": "v3.1.5",
+    "rev": "v3.1.6",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-d8RQfuLRNGTUzA2Ygy3QEis5j5Ape5kmcnZSs77c84M="
   },

pkgs/applications/networking/instant-messengers/jackline/default.nix

@@ -8,7 +8,7 @@ with ocamlPackages;
 
 buildDunePackage {
   pname = "jackline";
-  version = "unstable-2024-10-21";
+  version = "0.1.0-unstable-2024-10-21";
 
   minimalOCamlVersion = "4.13";
 

pkgs/applications/networking/mailreaders/thunderbird/packages.nix

@@ -85,8 +85,8 @@ rec {
   thunderbird = thunderbird-latest;
 
   thunderbird-latest = common {
-    version = "156.0";
-    sha512 = "8fd524f9d622f007e9bd5e8bcc440f185427a928a04d3aae14fc476e011ff1c15b68607292624ea4c4e4d596722193dda88e233cdfb6bbf5d05bd180870532ba";
+    version = "156.0.1";
+    sha512 = "e9262a4666e0107c7bc45fc2ad4bac4d6e5db4bfd3325d1d1c418f00adee777db969f8c12d8f310f45fdfda61b26e31bd0eea8b7d64ed1ee0050b5ee9235cfb0";
 
     updateScript = callPackage ./update.nix {
       attrPath = "thunderbirdPackages.thunderbird-latest";

pkgs/by-name/ad/adminerevo/package.nix

@@ -64,7 +64,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Database management in a single PHP file";
-    homepage = "https://docs.adminerevo.org";
+    homepage = "https://github.com/adminerevo/adminerevo";
     license = with lib.licenses; [
       asl20
       gpl2Only

pkgs/by-name/ai/aiken/package.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "aiken";
-  version = "1.1.23";
+  version = "1.1.24";
 
   src = fetchFromGitHub {
     owner = "aiken-lang";
     repo = "aiken";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9CPwIqUoOih4711vSEeV3AX1T1GGQ/AeYj7HnWI5UO8=";
+    hash = "sha256-yG96JwZ/H4/MrLkrmsResRg3HGUfh1Kz3kA6qv0Y62c=";
   };
 
-  cargoHash = "sha256-98oyeVo3z49DGikhSBMB7QSiz6+I7GkvqJIpOusuEz4=";
+  cargoHash = "sha256-BDe1GQtKzE2fyKPDdOEriF4wUxONe/jLfnyHiF/dUh4=";
 
   buildInputs = [ openssl ];
 

pkgs/by-name/an/analog/package.nix

@@ -47,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   meta = {
-    homepage = "https://www.c-amie.co.uk/software/analog/";
+    homepage = "https://github.com/c-amie/analog-ce";
     license = lib.licenses.gpl2Only;
     description = "Powerful tool to generate web server statistics";
     platforms = lib.platforms.all;

pkgs/by-name/ap/appium-inspector/package.nix

@@ -2,7 +2,7 @@
   lib,
   buildNpmPackage,
   copyDesktopItems,
-  electron_43,
+  electron_44,
   fetchFromGitHub,
   makeDesktopItem,
   makeWrapper,
@@ -14,21 +14,21 @@
 }:
 
 let
-  electron = electron_43;
+  electron = electron_44;
 in
 
 buildNpmPackage (finalAttrs: {
   pname = "appium-inspector";
-  version = "2026.7.1";
+  version = "2026.9.2";
 
   src = fetchFromGitHub {
     owner = "appium";
     repo = "appium-inspector";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7pxXlY/aifrg4cuGZSgxONF+RPL8P7JcZ6Gobqv2nz4=";
+    hash = "sha256-ePHLOHEXaigZwoCrZG18K7oYVeFEg3ZhZIKJJHyFQe8=";
   };
 
-  npmDepsHash = "sha256-W9FWIHhtS2d9xBpIEGB8sWmDfcdyphL+0eCk1+8pu2s=";
+  npmDepsHash = "sha256-MvDKtSx/1w3s8NjQczEzvxSE6SmJrWb5CUpPYhSX7Ts=";
   npmFlags = [ "--ignore-scripts" ];
 
   nativeBuildInputs = [

pkgs/by-name/ar/argus-clients/package.nix

@@ -57,7 +57,7 @@ stdenv.mkDerivation (finalAttrs: {
       know what is going on in your network, right now or historically,
       you will find Argus a useful tool.
     '';
-    homepage = "http://qosient.com/argus";
+    homepage = "https://openargus.org";
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.linux;
   };

pkgs/by-name/ar/argus/package.nix

@@ -69,7 +69,7 @@ stdenv.mkDerivation (finalAttrs: {
       know what is going on in your network, right now or historically,
       you will find Argus a useful tool.
     '';
-    homepage = "http://qosient.com/argus";
+    homepage = "https://openargus.org";
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.linux;
   };

pkgs/by-name/ar/ariang-native/package.nix

@@ -0,0 +1,76 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+  nix-update-script,
+  copyDesktopItems,
+  icoutils,
+  makeWrapper,
+  makeDesktopItem,
+  electron,
+}:
+
+buildNpmPackage (finalAttrs: {
+  pname = "ariang-native";
+  version = "1.3.14";
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "mayswind";
+    repo = "AriaNg-Native";
+    tag = finalAttrs.version;
+    hash = "sha256-ByQPAZVQEqqjD7th0wq06NdOsAR7YchWpV3LHu4QzTk=";
+  };
+
+  dontNpmBuild = true;
+  npmDepsFetcherVersion = 2;
+  npmDepsHash = "sha256-mTu/QcsPq7YoUSuKtS34P+y38oIoB3zyuDL9ELQDoBQ=";
+  npmFlags = [ "--ignore-scripts" ];
+
+  nativeBuildInputs = [
+    copyDesktopItems
+    icoutils
+    makeWrapper
+  ];
+
+  desktopItems = with finalAttrs; [
+    (makeDesktopItem {
+      name = pname;
+      desktopName = "AriaNg Native";
+      genericName = meta.description;
+      comment = meta.description;
+      icon = pname;
+      exec = "${pname} %U";
+      mimeTypes = [ "x-scheme-handler/magnet" ];
+      categories = [ "Network" ];
+      startupWMClass = pname;
+    })
+  ];
+
+  postInstall = with finalAttrs; ''
+    # Create desktop icons
+    icotool -x assets/AriaNg.ico
+    ls *.png | sort -V | while read -r file; do
+      size=$(echo "$file" | awk -F '_' '{print $3}' | cut -d 'x' -f 1)
+      mkdir -p "$out/share/icons/hicolor/''${size}x''${size}/apps"
+      mv "$file" "$out/share/icons/hicolor/''${size}x''${size}/apps/${pname}.png"
+    done
+
+    makeWrapper ${lib.getExe electron} $out/bin/${pname} \
+      --inherit-argv0 \
+      --add-flags "$out/lib/node_modules/${pname}"
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Aria2 desktop frontend based on AriaNg with additional desktop features";
+    homepage = "https://github.com/mayswind/AriaNg-Native";
+    changelog = "https://github.com/mayswind/AriaNg-Native/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ProxyVT ];
+    mainProgram = finalAttrs.pname;
+    platforms = lib.platforms.linux;
+  };
+})

pkgs/by-name/au/audiality2/package.nix

@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Realtime scripted modular audio engine for video games and musical applications";
     mainProgram = "a2play";
-    homepage = "http://audiality.org";
+    homepage = "https://olofson.github.io/audiality2/";
     license = lib.licenses.zlib;
     platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [ fgaz ];

pkgs/by-name/ba/badness/package.nix

@@ -9,7 +9,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "badness";
-  version = "0.23.0";
+  version = "0.24.0";
 
   __structuredAttrs = true;
 
@@ -17,10 +17,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "jolars";
     repo = "badness";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rPIdpescZTHCDZffevgJbh83NjuDZjxzx3EXSa/I/6U=";
+    hash = "sha256-kc+gM3Vr2gyySwXLBunuL5uihlkYhPi6VW4IhpkigMs=";
   };
 
-  cargoHash = "sha256-Mi6/2ijc43wkzJzxTJafqh8+gygf3HJnyAq/uVcn3hY=";
+  cargoHash = "sha256-IeYGMF+iG/gSPs4HSaqm0ekZ1WMeKuf1qjNF6EMWvsI=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/bi/bibata-caelestia/package.nix

@@ -0,0 +1,94 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  makeWrapper,
+  python3,
+  gobject-introspection,
+  librsvg,
+  hyprcursor,
+  nix-update-script,
+}:
+
+let
+  pythonEnv = python3.withPackages (ps: [
+    ps.pygobject3
+    ps.pycairo
+    ps.pillow
+  ]);
+in
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "bibata-caelestia";
+  version = "0-unstable-2026-09-05";
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "dim-ghub";
+    repo = "Bibata-Caelestia";
+    rev = "8b808e86b617ecc94ae500b1c32b804cc11dd57f";
+    hash = "sha256-Mjiwo1M28ghRmLDQzJc83irc9RDI/lYIh9A81V8M8qI=";
+  };
+
+  nativeBuildInputs = [
+    makeWrapper
+    gobject-introspection
+    hyprcursor
+    pythonEnv
+  ];
+
+  buildInputs = [
+    librsvg
+  ];
+
+  postPatch = ''
+    substituteInPlace builder.py \
+      --replace-fail 'search_dirs.append(Path(__file__).parent / "templates")' \
+                     'search_dirs.append(Path(__file__).parent / "templates"); search_dirs.append(Path(os.environ.get("BIBATA_TEMPLATES_DIR", Path(__file__).resolve().parent.parent / "share/bibata-caelestia/templates")))'
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    export HOME="$TMPDIR"
+    python3 builder.py build --dest "$TMPDIR/Bibata-Caelestia" --size 24
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -dm 0755 "$out/share/icons"
+    cp -rf "$TMPDIR/Bibata-Caelestia" "$out/share/icons/"
+
+    install -dm 0755 "$out/share/bibata-caelestia/templates"
+    cp -rf templates/*.svg "$out/share/bibata-caelestia/templates/"
+
+    install -Dm 0755 builder.py "$out/bin/bibata-caelestia-builder"
+    wrapProgram "$out/bin/bibata-caelestia-builder" \
+      --prefix PATH : "${
+        lib.makeBinPath [
+          hyprcursor
+          pythonEnv
+        ]
+      }" \
+      --prefix GI_TYPELIB_PATH : "${lib.makeSearchPath "lib/girepository-1.0" [ librsvg ]}" \
+      --set BIBATA_TEMPLATES_DIR "$out/share/bibata-caelestia/templates"
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch" ];
+  };
+
+  meta = {
+    description = "Dynamic Material You themeable cursor theme based on Bibata Modern Classic for Caelestia";
+    homepage = "https://github.com/dim-ghub/Bibata-Caelestia";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ rachalaraj ];
+    mainProgram = "bibata-caelestia-builder";
+    platforms = lib.platforms.linux;
+  };
+})

pkgs/by-name/bi/bitbake-setup/package.nix

@@ -0,0 +1,63 @@
+{
+  lib,
+  python3Packages,
+  fetchPypi,
+
+  git,
+
+  nix-update-script,
+  versionCheckHook,
+}:
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "bitbake-setup";
+  version = "2.19.0";
+  format = "wheel";
+
+  __structuredAttrs = true;
+
+  src = fetchPypi {
+    pname = "bitbake_setup";
+    inherit (finalAttrs) version;
+    format = "wheel";
+    dist = "py3";
+    python = "py3";
+    hash = "sha256-tq53r8I02HL4mTgnIxcVf4VTYhRngYgl232/cDgLzdI=";
+  };
+
+  makeWrapperArgs = [
+    "--prefix"
+    "PATH"
+    ":"
+    (lib.makeBinPath [ git ])
+  ];
+
+  pythonImportsCheck = [ "bitbake_setup" ];
+
+  versionCheckProgramArg = "--version";
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--url"
+      "mirror://pypi/b/bitbake_setup/"
+    ];
+  };
+
+  meta = {
+    description = "Command that sets up a BitBake build environment from a published configuration";
+    homepage = "https://git.openembedded.org/bitbake/";
+    downloadPage = "https://pypi.org/project/bitbake-setup/";
+    license = with lib.licenses; [
+      gpl2Only
+      mit
+      psfl
+      zlib
+      lgpl21Plus
+      bsd3Clear
+    ];
+    mainProgram = "bitbake-setup";
+    maintainers = with lib.maintainers; [ otavio ];
+    platforms = lib.platforms.linux;
+  };
+})

pkgs/by-name/bl/blender-oneapi/package.nix

@@ -0,0 +1,3 @@
+{ blender }:
+
+blender.override { oneapiSupport = true; }

pkgs/by-name/bl/blender/package.nix

@@ -86,6 +86,12 @@
   waylandSupport ? stdenv.hostPlatform.isLinux,
   zlib,
   zstd,
+  level-zero,
+  intel-compute-runtime,
+  intel-llvm,
+  intel-graphics-compiler,
+  oneapiSupport ? false,
+  opencl-headers,
 }:
 
 let
@@ -121,6 +127,9 @@ stdenv'.mkDerivation (finalAttrs: {
   pname = "blender";
   version = "5.2.2";
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   src = fetchzip {
     name = "source";
     url = "https://download.blender.org/source/blender-${finalAttrs.version}.tar.xz";
@@ -158,6 +167,10 @@ stdenv'.mkDerivation (finalAttrs: {
   + (lib.optionalString rocmSupport ''
     substituteInPlace extern/hipew/src/hipew.c --replace-fail '"/opt/rocm/hip/lib/libamdhip64.so.${lib.versions.major rocmPackages.clr.version}"' '"${rocmPackages.clr}/lib/libamdhip64.so"'
     substituteInPlace extern/hipew/src/hipew.c --replace-fail '"opt/rocm/hip/bin"' '"${rocmPackages.clr}/bin"'
+  '')
+  + (lib.optionalString oneapiSupport ''
+    substituteInPlace intern/cycles/kernel/device/oneapi/CMakeLists.txt \
+      --replace-fail ''\'''${cycles_kernel_runtime_lib_target_path}' '"''${CMAKE_INSTALL_LIBDIR}"'
   '');
 
   env.NIX_CFLAGS_COMPILE = "-I${python3}/include/${python3.libPrefix}";
@@ -177,7 +190,8 @@ stdenv'.mkDerivation (finalAttrs: {
     (lib.cmakeBool "WITH_CPU_CHECK" false)
     (lib.cmakeBool "WITH_CYCLES_CUDA_BINARIES" cudaSupport)
     (lib.cmakeBool "WITH_CYCLES_DEVICE_HIP" rocmSupport)
-    (lib.cmakeBool "WITH_CYCLES_DEVICE_ONEAPI" false)
+    (lib.cmakeBool "WITH_CYCLES_DEVICE_ONEAPI" oneapiSupport)
+    (lib.cmakeBool "WITH_CYCLES_ONEAPI_BINARIES" oneapiSupport)
     (lib.cmakeBool "WITH_CYCLES_DEVICE_OPTIX" cudaSupport)
     (lib.cmakeBool "WITH_CYCLES_EMBREE" embreeSupport)
     (lib.cmakeBool "WITH_CYCLES_OSL" true)
@@ -205,6 +219,13 @@ stdenv'.mkDerivation (finalAttrs: {
     (lib.cmakeFeature "OPTIX_ROOT_DIR" "${optix}")
     (lib.cmakeBool "WITH_CYCLES_CUDA_BINARIES" true)
   ]
+  ++ lib.optionals oneapiSupport [
+    (lib.cmakeFeature "SYCL_ROOT_DIR" "${intel-llvm}")
+    (lib.cmakeFeature "LEVEL_ZERO_ROOT_DIR" "${level-zero}")
+    (lib.cmakeFeature "OCLOC_INSTALL_DIR" "${intel-compute-runtime}")
+    (lib.cmakeFeature "IGC_INSTALL_DIR" "${intel-graphics-compiler}")
+    (lib.cmakeFeature "SYCL_CPP_FLAGS" "--verbose")
+  ]
   ++ lib.optionals rocmSupport [
     (lib.cmakeBool "WITH_CYCLES_DEVICE_HIPRT" false)
     (lib.cmakeBool "WITH_CYCLES_HIP_BINARIES" true)
@@ -236,17 +257,15 @@ stdenv'.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     cmake
-    llvmPackages.llvm.dev
     makeWrapper
+    pkg-config
     python3Packages.wrapPython
+    python3
   ]
+  ++ lib.optional oneapiSupport addDriverRunpath
   ++ lib.optionals cudaSupport [
     addDriverRunpath
     cudaPackages.cuda_nvcc
-  ]
-  ++ lib.optionals waylandSupport [
-    pkg-config
-    wayland-scanner
   ];
 
   buildInputs = [
@@ -283,13 +302,18 @@ stdenv'.mkDerivation (finalAttrs: {
     openxr-loader
     potrace
     pugixml
-    python3
     python3Packages.materialx
     python3Packages.openshadinglanguage
     rubberband
     zlib
     zstd
   ]
+  ++ lib.optionals oneapiSupport [
+    intel-compute-runtime
+    intel-llvm
+    opencl-headers
+  ]
+  ++ lib.optional (!oneapiSupport) llvmPackages.llvm
   ++ lib.optional embreeSupport embree
   ++ lib.optional rocmSupport rocmPackages.clr
   ++ lib.optional openImageDenoiseSupport (openimagedenoise.override { inherit cudaSupport; })
@@ -325,6 +349,7 @@ stdenv'.mkDerivation (finalAttrs: {
     libxkbcommon
     wayland
     wayland-protocols
+    wayland-scanner
   ]
   ++ lib.optional jackaudioSupport libjack2
   ++ lib.optional spaceNavSupport libspnav
@@ -370,10 +395,10 @@ stdenv'.mkDerivation (finalAttrs: {
         --add-flags '--python-use-system-env'
     '';
 
-  # Set RUNPATH so that libcuda and libnvrtc in /run/opengl-driver(-32)/lib can be
+  # Set RUNPATH so that libs in /run/opengl-driver(-32)/lib can be
   # found. See the explanation in libglvnd.
   postFixup =
-    lib.optionalString cudaSupport ''
+    lib.optionalString (cudaSupport || oneapiSupport) ''
       for program in $out/bin/blender $out/bin/.blender-wrapped; do
         addDriverRunpath "$program"
       done

pkgs/by-name/bo/bootdev-cli/package.nix

@@ -12,13 +12,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "bootdev-cli";
-  version = "1.32.4";
+  version = "1.32.5";
 
   src = fetchFromGitHub {
     owner = "bootdotdev";
     repo = "bootdev";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-MWK/1hscAky6ampB4n8NQTVchDT0EADRtub+8sgAYXg=";
+    hash = "sha256-TaZfb3ykSX7MqdTW+LuE8Ta/nwHQQW3jV3PIlv3UxrU=";
   };
 
   vendorHash = "sha256-LCvJDsg4MANhQ0V/ymP1heCN5rFNgeOYCYILsPdXYag=";

pkgs/by-name/bo/bossa/package.nix

@@ -84,7 +84,7 @@ stdenv.mkDerivation (finalAttrs: {
       Atmel's SAM-BA software. BOSSA is an acronym for Basic Open
       Source SAM-BA Application to reflect that goal.
     '';
-    homepage = "http://www.shumatech.com/web/products/bossa";
+    homepage = "https://github.com/shumatech/BOSSA";
     license = lib.licenses.bsd3;
     platforms = lib.platforms.unix;
   };

pkgs/by-name/br/brutalmaze/package.nix

@@ -36,7 +36,7 @@ python312Packages.buildPythonApplication (finalAttrs: {
   meta = {
     description = "Minimalist thrilling shoot 'em up game";
     mainProgram = "brutalmaze";
-    homepage = "https://brutalmaze.rtfd.io";
+    homepage = "https://brutalmaze.readthedocs.io";
     license = lib.licenses.agpl3Plus;
     maintainers = [ lib.maintainers.McSinyx ];
   };

pkgs/by-name/ca/cabin/package.nix

@@ -38,7 +38,7 @@ stdenvNoCC.mkDerivation rec {
       adjusted. The curved stem endings have a 10 degree angle. E and F have
       shorter center arms. M is splashed.
     '';
-    homepage = "http://www.impallari.com/cabin";
+    homepage = "https://github.com/impallari/Cabin";
     license = lib.licenses.ofl;
     maintainers = [ ];
     platforms = lib.platforms.all;

pkgs/by-name/ca/cargo-generate/package.nix

@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-generate";
-  version = "0.23.9";
+  version = "0.25.0";
 
   src = fetchFromGitHub {
     owner = "cargo-generate";
     repo = "cargo-generate";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-myakseKwLEjQa9GgcxdWZJWdjMFXh7Wi64CwrN2ZwSU=";
+    hash = "sha256-x0UkYgYJ1xe6ensm3yU5SEW+nnxHmnN+CbGCJXth8WQ=";
   };
 
-  cargoHash = "sha256-IAUgpk3HD9znLORCQKNw+AO6NG9GEVWMU/cez3B+CKc=";
+  cargoHash = "sha256-cXPks2uTUVnVyBXP9JT5Xm87pFkCvPHQy86R7vd2/zU=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/ca/cargo-tarpaulin/package.nix

@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-tarpaulin";
-  version = "0.37.2";
+  version = "0.37.5";
 
   src = fetchFromGitHub {
     owner = "xd009642";
     repo = "tarpaulin";
     tag = finalAttrs.version;
-    hash = "sha256-oD8k/M5PChKzG1ek1uH8UP7PoaL9LYot3HCO4Hmetsw=";
+    hash = "sha256-m3z4hBoktmFZTOhXmsQW9tsmbBGQwL1Pi9163tabjcY=";
   };
 
-  cargoHash = "sha256-lZ4wRI1PEcHDxGe8R1mnp/Gk0IDzqXLvosfzkZOIhug=";
+  cargoHash = "sha256-3dbDxnPTjSsU242gSiEUhhLCRuqsHLFN0ZVJ7oKROeo=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/ca/catt/package.nix

@@ -7,7 +7,7 @@
 }:
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "catt";
-  version = "0.13.2";
+  version = "0.13.3";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -15,7 +15,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "skorokithakis";
     repo = "catt";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VjwYfaBoQ7HMKG6BztAB3mmQps42MoHSAiC2jHbRS/Q=";
+    hash = "sha256-UiO46HNzeO2wg41Zn89bUdl34UeZZmWjekGxxsLgGwQ=";
   };
 
   build-system = [

pkgs/by-name/ch/chatzone-desktop/package.nix

@@ -30,7 +30,7 @@ stdenvNoCC.mkDerivation {
   desktopItems = [
     (makeDesktopItem {
       name = "chatzone";
-      exec = "chatzone-desktop";
+      exec = "chatzone-desktop %U";
       icon = "chatzone-desktop";
       terminal = false;
       desktopName = "Chatzone";
@@ -42,7 +42,10 @@ stdenvNoCC.mkDerivation {
         "Chat"
       ];
       startupWMClass = "Chatzone";
-      mimeTypes = [ "x-scheme-handler/mattermost" ];
+      mimeTypes = [
+        "x-scheme-handler/mattermost"
+        "x-scheme-handler/chatzone"
+      ];
     })
   ];
 

pkgs/by-name/ch/cheat/package.nix

@@ -1,48 +1,44 @@
 {
+  stdenv,
   lib,
   fetchFromGitHub,
   buildGoModule,
   installShellFiles,
+  git,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "cheat";
-  version = "4.5.0";
+  version = "5.1.0";
 
   src = fetchFromGitHub {
     owner = "cheat";
     repo = "cheat";
     tag = finalAttrs.version;
-    sha256 = "sha256-RDfOdyQL9QICXZmgYCmz532iTuPdCW8GixajvEXmaUQ=";
+    hash = "sha256-0c8NZzzLxssMJffEWBI5L3leWWOU/Y0slPIg6bPKzfI=";
   };
 
-  subPackages = [ "cmd/cheat" ];
-
   nativeBuildInputs = [ installShellFiles ];
 
-  patches = [
-    (builtins.toFile "fix-zsh-completion.patch" ''
-      diff --git a/scripts/cheat.zsh b/scripts/cheat.zsh
-      index befe1b2..675c9f8 100755
-      --- a/scripts/cheat.zsh
-      +++ b/scripts/cheat.zsh
-      @@ -62,4 +62,4 @@ _cheat() {
-         esac
-       }
-
-      -compdef _cheat cheat
-      +_cheat "$@"
-    '')
+  nativeCheckInputs = [
+    git
   ];
 
   postInstall = ''
     installManPage doc/cheat.1
-    installShellCompletion scripts/cheat.{bash,fish,zsh}
+  ''
+  + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd cheat \
+      --bash <($out/bin/cheat --completion bash) \
+      --fish <($out/bin/cheat --completion fish) \
+      --zsh <($out/bin/cheat --completion zsh)
   '';
 
   vendorHash = null;
 
-  doCheck = false;
+  doCheck = true;
+
+  env.EDITOR = "cat";
 
   meta = {
     description = "Create and view interactive cheatsheets on the command-line";

pkgs/by-name/ch/chromaprint/package.nix

@@ -10,7 +10,6 @@
   testers,
   validatePkgConfig,
   nix-update-script,
-  withExamples ? true,
   withTools ? true,
 }:
 
@@ -80,6 +79,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://acoustid.org/chromaprint";
     description = "AcoustID audio fingerprinting library";
     license = lib.licenses.lgpl21Plus;
+    maintainers = [ lib.maintainers.quantenzitrone ];
     platforms = lib.platforms.unix;
     pkgConfigModules = [ "libchromaprint" ];
   }

pkgs/by-name/ch/chunkfs/fuse3.diff

@@ -0,0 +1,157 @@
+--- a/Makefile
++++ b/Makefile
+@@ -3,8 +3,11 @@ PREFIX?=/usr/local
+ 
+ VERSION=0.8
+ 
+-CFLAGS=-std=c99 -DVERSION='"$(VERSION)"' -O2 -Wall
+-LDFLAGS=-s -lfuse
++FUSE_CFLAGS:=$(shell pkg-config --cflags fuse3)
++CFLAGS=-std=c99 -DVERSION='"$(VERSION)"' -O2 -Wall $(FUSE_CFLAGS)
++LDFLAGS=-s
++FUSE_LIBS:=$(shell pkg-config --libs fuse3)
++LDLIBS=$(FUSE_LIBS)
+ 
+ all: chunkfs unchunkfs chunkfs.1.gz
+ 
+diff --git a/chunkfs.c b/chunkfs.c
+index 825553d..09b5e19 100644
+--- a/chunkfs.c
++++ b/chunkfs.c
+@@ -19,7 +19,7 @@
+ 
+ #define _FILE_OFFSET_BITS 64
+ #define _XOPEN_SOURCE 500
+-#define FUSE_USE_VERSION 25
++#define FUSE_USE_VERSION 317
+ 
+ #include <sys/types.h>
+ #include <unistd.h>
+@@ -87,7 +87,7 @@ static int resolve_path(const char *path,struct chunk_stat *st){
+ 	return 0;
+ }
+ 
+-static int chunkfs_getattr(const char *path,struct stat *buf){
++static int chunkfs_getattr(const char *path,struct stat *buf, struct fuse_file_info *fileinfo){
+ 	int r;
+ 	struct chunk_stat st;
+ 
+@@ -109,7 +109,7 @@ static int chunkfs_getattr(const char *path,struct stat *buf){
+ 	return 0;
+ }
+ 
+-static int chunkfs_readdir(const char *path,void *buf,fuse_fill_dir_t filler,off_t offset,struct fuse_file_info *fi){
++static int chunkfs_readdir(const char *path,void *buf,fuse_fill_dir_t filler,off_t offset,struct fuse_file_info *fi, enum fuse_readdir_flags flags){
+ 	int r;
+ 	struct chunk_stat st;
+ 	uint64_t chunks_per_entry;
+@@ -117,12 +117,12 @@ static int chunkfs_readdir(const char *path,void *buf,fuse_fill_dir_t filler,off
+ 	if((r=resolve_path(path,&st))<0)return r;
+ 	if(!S_ISDIR(st.mode))return -ENOTDIR;
+ 	chunks_per_entry=1ULL<<((8-1-st.level)*8);
+-	filler(buf,".",NULL,0);
+-	filler(buf,"..",NULL,0);
++	filler(buf,".",NULL,0,FUSE_FILL_DIR_DEFAULTS);
++	filler(buf,"..",NULL,0,FUSE_FILL_DIR_DEFAULTS);
+ 	for(uint64_t x=0;x<256&&(uint64_t)st.chunk+x*chunks_per_entry<(uint64_t)image_chunks;x++){
+ 		char nbuf[3];
+ 		sprintf(nbuf,"%02" PRIx64,x);
+-		filler(buf,nbuf,NULL,0);
++		filler(buf,nbuf,NULL,0,FUSE_FILL_DIR_DEFAULTS);
+ 	}
+ 	return 0;
+ }
+@@ -203,13 +203,13 @@ int main(int argc,char **argv){
+ 			"    -V                     print version\n"
+ 			"\n",
+ 			*argv);
+-		fake_argv[1]="-ho";
+-		fuse_main(2,fake_argv,&chunkfs_ops);
++		fake_argv[1]="--help";
++		fuse_main(2,fake_argv,&chunkfs_ops,NULL);
+ 		ret=validation_error;
+ 	}else if(show_version){
+ 		fprintf(stderr,"ChunkFS v" VERSION "\n");
+ 		fake_argv[1]="-V";
+-		fuse_main(2,fake_argv,&chunkfs_ops);
++		fuse_main(2,fake_argv,&chunkfs_ops,NULL);
+ 	}else{
+ 		errno=0;
+ 		chunk_size=strtoll(argv[optind],&end,10);
+@@ -228,7 +228,7 @@ int main(int argc,char **argv){
+ 		if(image_size%chunk_size)image_chunks++;
+ 		argv[optind]=argv[optind+2];
+ 		argc-=2;
+-		ret=fuse_main(argc,argv,&chunkfs_ops);
++		ret=fuse_main(argc,argv,&chunkfs_ops,NULL);
+ 	}
+ 	return ret;
+ }
+diff --git a/unchunkfs.c b/unchunkfs.c
+index 6302019..b8293e2 100644
+--- a/unchunkfs.c
++++ b/unchunkfs.c
+@@ -19,7 +19,7 @@
+ 
+ #define _FILE_OFFSET_BITS 64
+ #define _XOPEN_SOURCE 500
+-#define FUSE_USE_VERSION 25
++#define FUSE_USE_VERSION 317
+ 
+ #include <sys/types.h>
+ #include <unistd.h>
+@@ -72,7 +72,7 @@ static void gen_chunk_name(char *buf,off_t num){
+ 	}
+ }
+ 
+-static int unchunkfs_getattr(const char *path,struct stat *buf){
++static int unchunkfs_getattr(const char *path,struct stat *buf, struct fuse_file_info *fileinfo){
+ 	int r;
+ 	mode_t mode;
+ 
+@@ -94,15 +94,15 @@ static int unchunkfs_getattr(const char *path,struct stat *buf){
+ 	return 0;
+ }
+ 
+-static int unchunkfs_readdir(const char *path,void *buf,fuse_fill_dir_t filler,off_t offset,struct fuse_file_info *fi){
++static int unchunkfs_readdir(const char *path,void *buf,fuse_fill_dir_t filler,off_t offset,struct fuse_file_info *fi, enum fuse_readdir_flags flags){
+ 	int r;
+ 	mode_t mode;
+ 
+ 	if((r=resolve_path(path,&mode))<0)return r;
+ 	if(!S_ISDIR(mode))return -ENOTDIR;
+-	filler(buf,".",NULL,0);
+-	filler(buf,"..",NULL,0);
+-	filler(buf,"image",NULL,0);
++	filler(buf,".",NULL,0,FUSE_FILL_DIR_DEFAULTS);
++	filler(buf,"..",NULL,0,FUSE_FILL_DIR_DEFAULTS);
++	filler(buf,"image",NULL,0,FUSE_FILL_DIR_DEFAULTS);
+ 	return 0;
+ }
+ 
+@@ -190,13 +190,13 @@ int main(int argc,char **argv){
+ 			"    -V                     print version\n"
+ 			"\n",
+ 			*argv);
+-		fake_argv[1]="-ho";
+-		fuse_main(2,fake_argv,&unchunkfs_ops);
++		fake_argv[1]="--help";
++		fuse_main(2,fake_argv,&unchunkfs_ops,NULL);
+ 		ret=validation_error;
+ 	}else if(show_version){
+ 		fprintf(stderr,"UnChunkFS v" VERSION "\n");
+ 		fake_argv[1]="-V";
+-		fuse_main(2,fake_argv,&unchunkfs_ops);
++		fuse_main(2,fake_argv,&unchunkfs_ops,NULL);
+ 	}else{
+ 		if((cwd_fd=open(".",O_RDONLY))<0)die(true,"open(.)");
+ 		if((chunkdir_fd=open(argv[optind],O_RDONLY))<0)die(true,"open(<chunk dir>)");
+@@ -226,7 +226,7 @@ int main(int argc,char **argv){
+ 		argv[optind]=argv[optind+1];
+ 		argc--;
+ 		if(fchdir(cwd_fd)<0)die(true,"fchdir(<start cwd>)");
+-		ret=fuse_main(argc,argv,&unchunkfs_ops);
++		ret=fuse_main(argc,argv,&unchunkfs_ops,NULL);
+ 	}
+ 	return ret;
+ }

pkgs/by-name/ch/chunkfs/package.nix

@@ -3,21 +3,30 @@
   stdenv,
   fetchurl,
   perl,
-  fuse,
+  fuse3,
+  pkg-config,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "chunkfs";
   version = "0.8";
 
+  patches = [
+    ./fuse3.diff
+  ];
+
   src = fetchurl {
     url = "https://chunkfs.florz.de/chunkfs_${finalAttrs.version}.tar.xz";
     hash = "sha256-HFv51ta2eNW9Qt9CUp2oTTlC8Lpwc1XKR/uYzMDfd88=";
   };
 
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
   buildInputs = [
     perl
-    fuse
+    fuse3
   ];
 
   makeFlags = [
@@ -25,6 +34,8 @@ stdenv.mkDerivation (finalAttrs: {
     "PREFIX="
   ];
 
+  enableParallelBuilding = true;
+
   preInstall = ''
     mkdir -p $out/bin
     mkdir -p $out/share/man/man1

pkgs/by-name/cl/clifm/package.nix

@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "clifm";
-  version = "1.28";
+  version = "1.29";
 
   src = fetchFromGitHub {
     owner = "leo-arch";
     repo = "clifm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-w2hUwyQvGlYrSfpKNkUhs7WHsn+WgBk2t7t9dUOGST4=";
+    hash = "sha256-SOsyKaAYy32FIy4I63NRZJ1RawDAlAub/W9+7AZA1XA=";
   };
 
   buildInputs = [

pkgs/by-name/co/cockpit/package.nix

@@ -47,13 +47,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "cockpit";
-  version = "367";
+  version = "368";
 
   src = fetchFromGitHub {
     owner = "cockpit-project";
     repo = "cockpit";
     tag = finalAttrs.version;
-    hash = "sha256-TWB39cnhU9zgr/FP4FfXEzdMEnjXOs/HamYjSXLVadY=";
+    hash = "sha256-2bFQwK5L0S84nLSkUeHmbNgBkjBJIxR88t/21h5jmps=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/co/codex-security/package.nix

@@ -0,0 +1,151 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchurl,
+  fetchPnpmDeps,
+  pnpm_11,
+  nodejs,
+  pnpmConfigHook,
+  makeWrapper,
+  autoPatchelfHook,
+  git,
+  ncurses,
+  python3,
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
+  nix-update-script,
+}:
+
+let
+  nativePluginTarget =
+    {
+      aarch64-darwin = "darwin-arm64";
+      aarch64-linux = "linux-arm64-gnu";
+      x86_64-darwin = "darwin-x64";
+      x86_64-linux = "linux-x64-gnu";
+    }
+    .${stdenv.hostPlatform.system};
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "codex-security";
+  version = "0.1.31";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "openai";
+    repo = "codex-security";
+    tag = "npm-v${finalAttrs.version}";
+    hash = "sha256-TA0dxV9VYvvmPU2ZqI5i0XGHaIzNYhqlkLPztZMbtCQ=";
+  };
+
+  npmPackage = fetchurl {
+    url = "https://registry.npmjs.org/@openai/codex-security/-/codex-security-${finalAttrs.version}.tgz";
+    hash = "sha512-XdxIQ+JQH3iysFPW2VdFcKAJJo+M+G4hR9x/KlVimMcbmocDVtQT+trjjfNPqZUdb2ZHrW7HHGepeRhMbMvCHQ==";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/sdk/typescript";
+
+  pnpmDeps = fetchPnpmDeps {
+    inherit (finalAttrs)
+      pname
+      version
+      src
+      sourceRoot
+      ;
+    pnpm = pnpm_11;
+    fetcherVersion = 4;
+    hash = "sha256-7gu3a76l+5XgIbpjr2NFt5Wcp/+LRjUNAaxZ0cW8T8c=";
+  };
+
+  nativeBuildInputs = [
+    nodejs
+    pnpm_11
+    pnpmConfigHook
+    makeWrapper
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [ autoPatchelfHook ];
+
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    stdenv.cc.cc.lib
+    ncurses
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    pnpm run build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    # Reinstall with only the production dependencies to keep the closure small.
+    rm -rf node_modules
+    pnpm install --force --offline --prod --ignore-scripts --frozen-lockfile
+
+    mkdir -p "$out/lib/codex-security"
+    cp -r bin dist node_modules package.json LICENSE README.md \
+      "$out/lib/codex-security/"
+
+    # The plugin bundle is generated during npm prepack and is not in the source tag.
+    tar --extract --gzip --file=${finalAttrs.npmPackage} \
+      --directory="$out/lib/codex-security" --strip-components=1 \
+      package/_bundled_plugin
+
+    find "$out/lib/codex-security/_bundled_plugin/mcp/native" \
+      -mindepth 1 -maxdepth 1 -type d \
+      ! -name licenses ! -name ${lib.escapeShellArg nativePluginTarget} \
+      -exec rm --recursive --force {} +
+
+    find "$out/lib/codex-security/node_modules" -name "*.android*" -delete
+
+    makeWrapper "${lib.getExe nodejs}" "$out/bin/codex-security" \
+      --add-flags "$out/lib/codex-security/bin/codex-security.mjs" \
+      --prefix PATH : "${
+        lib.makeBinPath [
+          git
+          python3
+        ]
+      }"
+
+    runHook postInstall
+  '';
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
+  ];
+  versionCheckProgramArg = "--version";
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "npm-v(.*)"
+    ];
+  };
+
+  meta = {
+    description = "CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities in your code";
+    homepage = "https://github.com/openai/codex-security";
+    changelog = "https://github.com/openai/codex-security/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ sheeeng ];
+    mainProgram = "codex-security";
+    platforms = [
+      "aarch64-darwin"
+      "aarch64-linux"
+      "x86_64-darwin"
+      "x86_64-linux"
+    ];
+    sourceProvenance = with lib.sourceTypes; [
+      fromSource
+      binaryNativeCode
+    ];
+  };
+})

pkgs/by-name/co/colloid-cursors/package.nix

@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "colloid-cursors";
-  version = "2025-07-19";
+  version = "2026-08-10";
 
   src = fetchFromGitHub {
     owner = "vinceliuice";
     repo = "Colloid-icon-theme";
     tag = finalAttrs.version;
-    hash = "sha256-x2SSaIkKm1415avO7R6TPkpghM30HmMdjMFUUyPWZsk=";
+    hash = "sha256-JNnTcHIvRf9Ymox2POjatY2gYvkPD6+nd/cN48tC6X4=";
   };
 
   installPhase = ''

pkgs/by-name/co/common-proxies/package.nix

@@ -5,21 +5,24 @@
 }:
 
 buildGoModule (finalAttrs: {
-  pname = "unifiedpush-common-proxies";
+  pname = "common-proxies";
   version = "3.1.0";
 
   src = fetchFromCodeberg {
     owner = "UnifiedPush";
     repo = "common-proxies";
     rev = finalAttrs.version;
-    sha256 = "sha256-VRxwEsQt1LlcMIMEkGqkVtMrqJ7f4tYh3OExE9VITh4=";
+    hash = "sha256-VRxwEsQt1LlcMIMEkGqkVtMrqJ7f4tYh3OExE9VITh4=";
   };
 
   vendorHash = "sha256-rGsSuO7cnb9e4A1SnIwfgfz4vu18JzxKtLnDfCSQqck=";
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
   meta = {
     description = "Set of rewrite proxies and gateways for UnifiedPush";
-    homepage = "https://github.com/UnifiedPush/common-proxies";
+    homepage = "https://codeberg.org/UnifiedPush/common-proxies";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.zimward ];
     mainProgram = "common-proxies";

pkgs/by-name/ct/ctx7/package.nix

@@ -17,7 +17,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "ctx7";
-  version = "0.5.10";
+  version = "0.5.12";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -26,7 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "upstash";
     repo = "context7";
     tag = "${finalAttrs.pname}@${finalAttrs.version}";
-    hash = "sha256-XN6lGp135VdRFlYhgZzOjLo3+QyzEP4Q8O6QMSR2wyw=";
+    hash = "sha256-Dkk8wErUQksHySW4kbRGnY96X4by+Jrgc/mxchuuum0=";
   };
 
   nativeBuildInputs = [
@@ -44,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-3CaLAMU4WdmGt2YF1XQ7fc1dQh6ENP792Q9idKNYDYs=";
+    hash = "sha256-lgFTZ2HvGrCdN//s4brHq1o26vTopyvVhZyzwiSSW9Y=";
   };
 
   buildPhase = ''

pkgs/by-name/cu/cubicsdr/package.nix

@@ -65,7 +65,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   meta = {
-    homepage = "https://cubicsdr.com";
+    homepage = "https://github.com/cjcliffe/CubicSDR";
     description = "Software Defined Radio application";
     license = lib.licenses.gpl2Plus;
     maintainers = with lib.maintainers; [ lasandell ];

pkgs/by-name/da/dae/package.nix

@@ -10,17 +10,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "dae";
-  version = "2.0.0";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "daeuniverse";
     repo = "dae";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hzX3b86BHvxXQZotSteiHoyBMF/P4WubeuJ6xpxa8ac=";
+    hash = "sha256-+Gls/lFhOjzfPisgWS96mEevI0mMtQ139Zf4NIik2X8=";
     fetchSubmodules = true;
   };
 
-  vendorHash = "sha256-S2dNFvMeZqGhzu+sIBGeaET4bQXfeucao6XR4QSTpog=";
+  vendorHash = "sha256-N2noQXRV9Vewie4PiWkjDeX6U2+kF1kQ9L10kZ5X/LI=";
 
   proxyVendor = true;
 

pkgs/by-name/da/davs2/package.nix

@@ -66,5 +66,6 @@ stdenv.mkDerivation (finalAttrs: {
     pkgConfigModules = [ "davs2" ];
     maintainers = with lib.maintainers; [ jopejoe1 ];
     platforms = lib.platforms.all;
+    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "davs2_project" finalAttrs.version;
   };
 })

pkgs/by-name/db/dbus-glib/package.nix

@@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
   version = "0.114";
 
   src = fetchurl {
-    url = "${finalAttrs.meta.homepage}/releases/dbus-glib/dbus-glib-${finalAttrs.version}.tar.gz";
+    url = "https://dbus.freedesktop.org/releases/dbus-glib/dbus-glib-${finalAttrs.version}.tar.gz";
     sha256 = "sha256-wJxcCFsqDjkbjufXg6HWP+RE6WcXzBgU1htej8KCenw=";
   };
 

pkgs/by-name/de/defuddle/package.nix

@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "defuddle";
-  version = "0.19.3";
+  version = "0.19.4";
 
   src = fetchFromGitHub {
     owner = "kepano";
     repo = "defuddle";
     tag = version;
-    hash = "sha256-fSJsNWShWjv1Riiq0DxkUnmUDlM2rQoqgdM9eD9aMts=";
+    hash = "sha256-H6/hZVe5nj6GNv00RMu1tKDRhCTvB7PX5gc70JWh9ik=";
   };
 
-  npmDepsHash = "sha256-BxGIVt2gkNQkWXQyLnPQQAtCNFJKlXmTctKVAxFzjfM=";
+  npmDepsHash = "sha256-B5uX7lIfII9nlCHn6d3zchsokpZFOuP1fuRRLJb7g1M=";
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/di/discord-canary/package.nix

@@ -0,0 +1,6 @@
+{
+  discord,
+  ...
+}@args:
+
+discord.override ({ pname = "discord-canary"; } // removeAttrs args [ "discord" ])

pkgs/by-name/di/discord-development/package.nix

@@ -0,0 +1,6 @@
+{
+  discord,
+  ...
+}@args:
+
+discord.override ({ pname = "discord-development"; } // removeAttrs args [ "discord" ])