nixos/llama-swap: remove ProcSubset pid limitation from service config for new performance monitoring feature

New versions of llama-swap have a performance monitoring feature that
needs access to read /proc/meminfo.

(cherry picked from commit 03db034022)

.github/labeler-no-sync.yml

@@ -33,4 +33,15 @@
               - maintainers/github-teams.json
       - base-branch: ['master']
 
+"backport release-26.05":
+  - all:
+      - changed-files:
+          - any-glob-to-any-file:
+              - .github/actions/**/*
+              - .github/workflows/*
+              - .github/labeler*.yml
+              - ci/**/*.*
+              - maintainers/github-teams.json
+      - base-branch: ['master']
+
 # keep-sorted end

.github/workflows/backport.yml

@@ -21,7 +21,7 @@ defaults:
 jobs:
   backport:
     name: Backport Pull Request
-    if: vars.NIXPKGS_CI_APP_ID && github.event.pull_request.merged == true && (github.event.action != 'labeled' || startsWith(github.event.label.name, 'backport'))
+    if: vars.NIXPKGS_CI_CLIENT_ID && github.event.pull_request.merged == true && (github.event.action != 'labeled' || startsWith(github.event.label.name, 'backport'))
     runs-on: ubuntu-slim
     timeout-minutes: 3
     steps:
@@ -30,7 +30,7 @@ jobs:
       - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         id: app-token
         with:
-          app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
+          client-id: ${{ vars.NIXPKGS_CI_CLIENT_ID }}
           private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
           permission-contents: write
           permission-pull-requests: write

.github/workflows/bot.yml

@@ -57,10 +57,10 @@ jobs:
 
       # Use a GitHub App, because it has much higher rate limits: 12,500 instead of 5,000 req / hour.
       - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        if: github.event_name != 'pull_request' && vars.NIXPKGS_CI_APP_ID
+        if: github.event_name != 'pull_request' && vars.NIXPKGS_CI_CLIENT_ID
         id: app-token
         with:
-          app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
+          client-id: ${{ vars.NIXPKGS_CI_CLIENT_ID }}
           private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
           permission-administration: read
           permission-contents: write

.github/workflows/comment.yml

@@ -31,10 +31,10 @@ jobs:
 
       # Use the GitHub App to make sure the reaction happens with the same user who will later merge.
       - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        if: github.event_name != 'pull_request' && vars.NIXPKGS_CI_APP_ID
+        if: github.event_name != 'pull_request' && vars.NIXPKGS_CI_CLIENT_ID
         id: app-token
         with:
-          app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
+          client-id: ${{ vars.NIXPKGS_CI_CLIENT_ID }}
           private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
           permission-pull-requests: write
 

.github/workflows/edited.yml

@@ -39,7 +39,7 @@ jobs:
       - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         id: app-token
         with:
-          app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
+          client-id: ${{ vars.NIXPKGS_CI_CLIENT_ID }}
           private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
           permission-pull-requests: write
 

.github/workflows/periodic-merge-24h.yml

@@ -22,7 +22,7 @@ defaults:
 
 jobs:
   periodic-merge:
-    if: github.repository_owner == 'NixOS'
+    if: github.repository_owner == 'NixOS' || github.event_name == 'workflow_dispatch'
     strategy:
       # don't fail fast, so that all pairs are tried
       fail-fast: false
@@ -35,7 +35,7 @@ jobs:
             into: staging-next-25.11
           - from: staging-next-25.11
             into: staging-25.11
-          - from: master
+          - from: release-26.05
             into: staging-next-26.05
           - from: staging-next-26.05
             into: staging-26.05
@@ -49,3 +49,34 @@ jobs:
     name: ${{ matrix.pairs.name || format('{0} → {1}', matrix.pairs.from, matrix.pairs.into) }}
     secrets:
       NIXPKGS_CI_APP_PRIVATE_KEY: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
+
+  # Resets the target branch of the current haskell-updates PR.
+  # This makes GitHub hide all the commits that are already part of staging and gives us a much clearer PR view.
+  haskell-updates:
+    needs: periodic-merge
+    runs-on: ubuntu-slim
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Find PR and update target branch
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            // There will at most be a single haskell-updates PR anyway, so no need to paginate.
+            await Promise.all(
+              (
+                await github.rest.pulls.list({
+                  ...context.repo,
+                  state: 'open',
+                  head: `${context.repo.owner}:haskell-updates`,
+                })
+              ).data.map((pr) =>
+                github.rest.pulls.update({
+                  ...context.repo,
+                  pull_number: pr.number,
+                  // Just updating to the same branch to trigger a UI update.
+                  // This is staging most of the time, but could be staging-next in rare cases.
+                  base: pr.base.ref,
+                }),
+              ),
+            )

.github/workflows/periodic-merge-6h.yml

@@ -22,7 +22,7 @@ defaults:
 
 jobs:
   periodic-merge:
-    if: github.repository_owner == 'NixOS'
+    if: github.repository_owner == 'NixOS' || github.event_name == 'workflow_dispatch'
     strategy:
       # don't fail fast, so that all pairs are tried
       fail-fast: false

.github/workflows/periodic-merge.yml

@@ -29,7 +29,7 @@ jobs:
       - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         id: app-token
         with:
-          app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
+          client-id: ${{ vars.NIXPKGS_CI_CLIENT_ID }}
           private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
           permission-contents: write
           permission-pull-requests: write

.github/workflows/review.yml

@@ -28,10 +28,10 @@ jobs:
 
       # Use the GitHub App to make sure the reaction happens with the same user who will later merge.
       - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        if: github.event_name != 'pull_request' && vars.NIXPKGS_CI_APP_ID
+        if: github.event_name != 'pull_request' && vars.NIXPKGS_CI_CLIENT_ID
         id: app-token
         with:
-          app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
+          client-id: ${{ vars.NIXPKGS_CI_CLIENT_ID }}
           private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
           permission-pull-requests: write
 

.github/workflows/teams.yml

@@ -22,7 +22,7 @@ jobs:
       - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         id: app-token
         with:
-          app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
+          client-id: ${{ vars.NIXPKGS_CI_CLIENT_ID }}
           private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
           permission-administration: read
           permission-contents: write

doc/languages-frameworks/texlive.section.md

@@ -2,9 +2,7 @@
 
 There is a TeX Live packaging that lives entirely under attribute `texlive`.
 
-## User's guide (experimental new interface) {#sec-language-texlive-user-guide-experimental}
-
-Release 23.11 ships with a new interface that will eventually replace `texlive.combine`.
+## User's guide {#sec-language-texlive-user-guide}
 
 - For basic usage, use some of the prebuilt environments available at the top level, such as `texliveBasic`, `texliveSmall`. For the full list of prebuilt environments, inspect `texlive.schemes`.
 
@@ -24,7 +22,7 @@ Release 23.11 ships with a new interface that will eventually replace `texlive.c
 
 - `texlive.withPackages` uses the same logic as `buildEnv`. Only parts of a package are installed in an environment: its 'runtime' files (`tex` output), binaries (`out` output), and support files (`tlpkg` output). Moreover, man and info pages are assembled into separate `man` and `info` outputs. To add only the TeX files of a package, or its documentation (`texdoc` output), just specify the outputs:
   ```nix
-  texlive.withPackages (
+  texliveBasic.withPackages (
     ps: with ps; [
       texdoc # recommended package to navigate the documentation
       perlPackages.LaTeXML.tex # tex files of LaTeXML, omit binaries
@@ -34,64 +32,19 @@ Release 23.11 ships with a new interface that will eventually replace `texlive.c
   )
   ```
 
+- To add the documentation for all packages in the environment, use
+  ```nix
+  texliveSmall.overrideAttrs { withDocs = true; }
+  ```
+  This can be applied before or after calling `withPackages`. The parameter `withSources` adds all source containers.
+
 - All packages distributed by TeX Live, which contains most of CTAN, are available and can be found under `texlive.pkgs`:
   ```ShellSession
   $ nix repl
   nix-repl> :l <nixpkgs>
   nix-repl> texlive.pkgs.[TAB]
   ```
-  Note that the packages in `texlive.pkgs` are only provided for search purposes and must not be used directly.
-
-- **Experimental and subject to change without notice:** to add the documentation for all packages in the environment, use
-  ```nix
-  texliveSmall.__overrideTeXConfig { withDocs = true; }
-  ```
-  This can be applied before or after calling `withPackages`.
-
-  The function currently supports the parameters `withDocs`, `withSources`, and `requireTeXPackages`.
-
-## User's guide {#sec-language-texlive-user-guide}
-
-- For basic usage just pull `texlive.combined.scheme-basic` for an environment with basic LaTeX support.
-
-- It typically won't work to use separately installed packages together. Instead, you can build a custom set of packages like this. Most CTAN packages should be available:
-
-  ```nix
-  texlive.combine {
-    inherit (texlive)
-      scheme-small
-      collection-langkorean
-      algorithms
-      cm-super
-      ;
-  }
-  ```
-
-- There are all the schemes, collections and a few thousand packages, as defined upstream (perhaps with tiny differences).
-
-- By default you only get executables and files needed during runtime, and a little documentation for the core packages. To change that, you need to add `pkgFilter` function to `combine`.
-
-  ```nix
-  texlive.combine {
-    # inherit (texlive) whatever-you-want;
-    pkgFilter =
-      pkg: pkg.tlType == "run" || pkg.tlType == "bin" || pkg.hasManpages || pkg.pname == "cm-super";
-    # elem tlType [ "run" "bin" "doc" "source" ]
-    # there are also other attributes: version, name
-  }
-  ```
-
-- You can list packages e.g. by `nix repl`.
-
-  ```ShellSession
-  $ nix repl
-  nix-repl> :l <nixpkgs>
-  nix-repl> texlive.collection-[TAB]
-  ```
-
-- Note that the wrapper assumes that the result has a chance to be useful. For example, the core executables should be present, as well as some core data files. The supported way of ensuring this is by including some scheme, for example, `scheme-basic`, into the combination.
-
-- TeX Live packages are also available under `texlive.pkgs` as derivations with outputs `out`, `tex`, `texdoc`, `texsource`, `tlpkg`, `man`, `info`. They cannot be installed outside of `texlive.combine` but are available for other uses. To repackage a font, for instance, use
+  These are derivations with outputs `out`, `tex`, `texdoc`, `texsource`, `tlpkg`, `man`, `info`. They cannot be installed outside of `texlive.withPackages` but are available for other uses. To repackage a font, for instance, use
 
   ```nix
   stdenvNoCC.mkDerivation (finalAttrs: {
@@ -112,9 +65,9 @@ Release 23.11 ships with a new interface that will eventually replace `texlive.c
 
 ## Custom packages {#sec-language-texlive-custom-packages}
 
-You may find that you need to use an external TeX package. A derivation for such package has to provide the contents of the "texmf" directory in its `"tex"` output, according to the [TeX Directory Structure](https://tug.ctan.org/tds/tds.html). Dependencies on other TeX packages can be listed in the attribute `tlDeps`.
+You may find that you need to use an external TeX package. A derivation for such package has to provide the contents of the "texmf" directory in its `"tex"` output, according to the [TeX Directory Structure](https://tug.ctan.org/tds/tds.html). Dependencies on other TeX packages can be listed in the attribute `passthru.tlDeps`, which is a function taking a package set and returning a list of packages.
 
-The functions `texlive.combine` and `texlive.withPackages` recognise the following outputs:
+The function `texlive.withPackages` recognise the following outputs:
 
 - `"out"`: contents are linked in the TeX Live environment, and binaries in the `$out/bin` folder are wrapped;
 - `"tex"`: linked in `$TEXMFDIST`; files should follow the TDS (for instance `$tex/tex/latex/foiltex/foiltex.cls`);
@@ -122,8 +75,6 @@ The functions `texlive.combine` and `texlive.withPackages` recognise the followi
 - `"tlpkg"`: linked in `$TEXMFROOT/tlpkg`;
 - `"man"`, `"info"`, ...: the other outputs are combined into separate outputs.
 
-When using `pkgFilter`, `texlive.combine` will assign `tlType` respectively `"bin"`, `"run"`, `"doc"`, `"source"`, `"tlpkg"` to the above outputs.
-
 Here is a (very verbose) example. See also the packages `auctex`, `eukleides`, `mftrace` for more examples.
 
 ```nix
@@ -138,7 +89,7 @@ let
       "tex"
       "texdoc"
     ];
-    passthru.tlDeps = with texlive; [ latex ];
+    passthru.tlDeps = ps: [ ps.latex ];
 
     srcs = [
       (fetchurl {
@@ -169,13 +120,14 @@ let
           latexmk
         ]
       ))
-      # multiple-outputs.sh fails if $out is not defined
-      (writeShellScript "force-tex-output.sh" ''
-        out="''${tex-}"
-      '')
       writableTmpDirAsHomeHook # Need a writable $HOME for latexmk
     ];
 
+    # multiple-outputs.sh fails if $out is not defined
+    preHook = ''
+      out="''${tex-}"
+    '';
+
     dontConfigure = true;
 
     buildPhase = ''

doc/redirects.json

@@ -4428,11 +4428,9 @@
   "sec-language-texlive": [
     "index.html#sec-language-texlive"
   ],
-  "sec-language-texlive-user-guide-experimental": [
-    "index.html#sec-language-texlive-user-guide-experimental"
-  ],
   "sec-language-texlive-user-guide": [
-    "index.html#sec-language-texlive-user-guide"
+    "index.html#sec-language-texlive-user-guide",
+    "index.html#sec-language-texlive-user-guide-experimental"
   ],
   "sec-language-texlive-custom-packages": [
     "index.html#sec-language-texlive-custom-packages"

doc/release-notes/rl-2605.section.md

@@ -197,6 +197,8 @@
 
 - `python3Packages.pikepdf` no longer builds with mupdf support by default, which may be nice in Jupyter and iPython. Build with `withMupdf = true` if this is required.
 
+- `olive-editor` has been dropped as upstream development ceased and no longer builds.
+
 - `python3Packages.django-mdeditor` has been removed, as it was unmaintained upstream and the latest release was vulnerable to a [critical security vulnerability](https://github.com/NixOS/nixpkgs/issues/515462).
 
 - `vicinae` has been updated to v0.20. This includes, among several other breaking changes, a complete overhaul of the configuration system. For update instructions, see the [upstream configuration documentation](https://docs.vicinae.com/config#migration-from-v0-16-x-to-v0-17-x).
@@ -366,6 +368,8 @@
 
 - We now use the upstream wrapper script for Gradle, supporting both the `JAVA_HOME` and `GRADLE_OPTS` environment variables.
 
+- Updated `gonic` to 0.21.0. A full ("slow") scan is recommended after upgrading to v0.21.0 to pick up the newly scanned fields (contributors, ISRCs, record labels, per-track years, ARTIST_CREDIT).
+
 - the `autossh-ng` NixOS module was introduced as a simpler alternative to the existing `autossh` module.
 
 - Added `haskell.packages.microhs`, a set of Haskell packages built with MicroHs.

maintainers/maintainer-list.nix

@@ -5058,12 +5058,6 @@
     github = "cigrainger";
     githubId = 3984794;
   };
-  ciil = {
-    email = "simon@lackerbauer.com";
-    github = "ciil";
-    githubId = 3956062;
-    name = "Simon Lackerbauer";
-  };
   cilki = {
     github = "cilki";
     githubId = 10459406;
@@ -7360,12 +7354,6 @@
     github = "DSeeLP";
     githubId = 46624152;
   };
-  dsferruzza = {
-    email = "david.sferruzza@gmail.com";
-    github = "dsferruzza";
-    githubId = 1931963;
-    name = "David Sferruzza";
-  };
   dsluijk = {
     name = "Dany Sluijk";
     email = "nix@dany.dev";
@@ -18260,6 +18248,12 @@
     githubId = 16974598;
     name = "Mike Playle";
   };
+  mkannwischer = {
+    email = "matthias@kannwischer.eu";
+    github = "mkannwischer";
+    githubId = 3984960;
+    name = "Matthias Kannwischer";
+  };
   mkez = {
     email = "matias+nix@zwinger.fi";
     github = "mk3z";
@@ -19250,6 +19244,12 @@
     name = "Naufal Fikri";
     keys = [ { fingerprint = "1575 D651 E31EC 6117A CF0AA C1A3B 8BBC A515 8835"; } ];
   };
+  naurissteins = {
+    name = "Nauris Steins";
+    email = "me@naurissteins.com";
+    github = "naurissteins";
+    githubId = 5653746;
+  };
   naxdy = {
     name = "Naxdy";
     email = "naxdy@naxdy.org";

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -220,9 +220,22 @@
 
 - `services.mattermost` now defaults to version 11, which has dropped support for MySQL in favor of Postgres. As a result, all support for MySQL has been removed from the module.
   See the [migration steps](https://docs.mattermost.com/deployment-guide/manual-postgres-migration.html) if you were not running Postgres.
+  Note that version 11 also restricts the user limit to 250 [by default](https://forum.mattermost.com/t/clarification-request-on-user-limits-max-250-user-server-v-11/25309);
+  see the `pkgs.mattermost` removeUserLimit and removeFreeBadge options combined with `services.mattermost.package` to change this behavior. For example:
+
+```nix
+{
+  services.mattermost.package = pkgs.mattermost.override {
+    removeUserLimit = true;
+    removeFreeBadge = true;
+  };
+}
+```
 
 - `post-resume.target` has been removed. See {manpage}`systemd.special(7)` about `sleep.target` for instructions on ordering a process after resume with `ExecStop=`.
 
+- `services.vsftpd` no longer automatically configures a PAM module.  This means configurations using `services.vsftpd.localUsers` will no longer work unless `services.vsftpd.enableVirtualUsers` and `services.vsftpd.userDbPath` are also configured.  The old behaviour can be restored by setting `security.pam.services.vsftpd.enable = true`, although this only ever worked by accident and may not be secure.
+
 - `services.kubernetes.addons.dns.coredns` has been renamed to `services.kubernetes.addons.dns.corednsImage` and now expects a
 package instead of attrs. Now, by default, nixpkgs.coredns in conjunction with dockerTools.buildImage is used, instead
 of pulling the upstream container image from Docker Hub. If you want the old behavior, you can set:

nixos/modules/config/nix-channel.nix

@@ -70,7 +70,7 @@ in
       defaultChannel = mkOption {
         internal = true;
         type = types.str;
-        default = "https://channels.nixos.org/nixos-unstable";
+        default = "https://channels.nixos.org/nixos-26.05";
         description = "Default NixOS channel to which the root user is subscribed.";
       };
     };

nixos/modules/misc/version.nix

@@ -51,6 +51,7 @@ let
       VENDOR_URL = optionalString isNixos "https://nixos.org/";
       DOCUMENTATION_URL = optionalString isNixos "https://nixos.org/learn.html";
       SUPPORT_URL = optionalString isNixos "https://nixos.org/community.html";
+      SUPPORT_END = "2026-12-31";
       BUG_REPORT_URL = optionalString isNixos "https://github.com/NixOS/nixpkgs/issues";
       ANSI_COLOR = optionalString isNixos "0;38;2;126;186;228";
       IMAGE_ID = optionalString (config.system.image.id != null) config.system.image.id;

nixos/modules/programs/command-not-found/command-not-found.nix

@@ -33,7 +33,10 @@ in
 
     enable = lib.mkOption {
       type = lib.types.bool;
-      default = false;
+      default = builtins.pathExists config.programs.command-not-found.dbPath;
+      defaultText = lib.literalExpression ''
+        builtins.pathExists config.programs.command-not-found.dbPath
+      '';
       description = ''
         Whether interactive shells should show which Nix package (if
         any) provides a missing command.
@@ -45,6 +48,11 @@ in
     };
 
     dbPath = lib.mkOption {
+      type = lib.types.path;
+      default = pkgs.path + "/programs.sqlite";
+      defaultText = lib.literalExpression ''
+        pkgs.path + "/programs.sqlite"
+      '';
       description = ''
         Absolute path to `programs.sqlite`, which contains mappings from binary names to package names.
 
@@ -54,39 +62,29 @@ in
         `/nix/var/nix/profiles/per-user/root/channels/nixos/programs.sqlite`.
         If you do so, you can update it with `sudo nix-channels --update`.
       '';
-      type = lib.types.path;
     };
   };
 
-  config = lib.mkMerge [
-    {
-      programs.command-not-found = {
-        enable = lib.mkDefault (builtins.pathExists cfg.dbPath);
-        dbPath = pkgs.path + "/programs.sqlite";
-      };
-    }
+  config = lib.mkIf cfg.enable {
+    programs.bash.interactiveShellInit = ''
+      command_not_found_handle() {
+        '${commandNotFound}/bin/command-not-found' "$@"
+      }
+    '';
 
-    (lib.mkIf cfg.enable {
-      programs.bash.interactiveShellInit = ''
-        command_not_found_handle() {
-          '${commandNotFound}/bin/command-not-found' "$@"
-        }
-      '';
+    programs.zsh.interactiveShellInit = ''
+      command_not_found_handler() {
+        '${commandNotFound}/bin/command-not-found' "$@"
+      }
+    '';
 
-      programs.zsh.interactiveShellInit = ''
-        command_not_found_handler() {
-          '${commandNotFound}/bin/command-not-found' "$@"
-        }
-      '';
+    # NOTE: Fish by itself checks for nixos command-not-found, let's instead makes it explicit.
+    programs.fish.interactiveShellInit = ''
+      function fish_command_not_found
+         "${commandNotFound}/bin/command-not-found" $argv
+      end
+    '';
 
-      # NOTE: Fish by itself checks for nixos command-not-found, let's instead makes it explicit.
-      programs.fish.interactiveShellInit = ''
-        function fish_command_not_found
-           "${commandNotFound}/bin/command-not-found" $argv
-        end
-      '';
-
-      environment.systemPackages = [ commandNotFound ];
-    })
-  ];
+    environment.systemPackages = [ commandNotFound ];
+  };
 }

nixos/modules/programs/lix.nix

@@ -47,6 +47,9 @@ in
 
 {
   config = lib.mkIf (cfg.enable && nixPackage.pname == "lix") {
+    # Require the tun kernel module for pasta, can be disabled if pasta is not used.
+    boot.kernelModules.tun = lib.mkDefault true;
+
     environment.systemPackages = [
       nixPackage
       pkgs.nix-info

nixos/modules/security/wrappers/default.nix

@@ -245,156 +245,134 @@ in
   };
 
   ###### implementation
-  config = lib.mkMerge [
-    {
-      warnings = lib.optional (wrappers != { } && !config.security.enableWrappers) ''
-        security.enableWrappers is set to false, but the following wrappers are still enabled and will be silently ignored: ${lib.concatStringsSep ", " (lib.attrNames wrappers)}. This might prevent fundamental functionalities, like PAM authentication. To avoid this warning, either set security.enableWrappers = true, or explicitly disable each wrapper with `enable = false`.
-      '';
-      assertions = [
-        {
-          assertion =
-            !(
-              !config.security.enableWrappers && lib.any (u: u.isNormalUser) (lib.attrValues config.users.users)
-            );
-          message = ''
-            security.enableWrappers is disabled but normal users are defined
-            (${
-              lib.concatStringsSep ", " (
-                lib.mapAttrsToList (n: _: n) (lib.filterAttrs (_: u: u.isNormalUser) config.users.users)
-              )
-            }). Without SUID wrappers, users cannot login. Either enable wrappers or remove all normal user accounts.
-          '';
-        }
-      ];
-    }
-    (lib.mkIf config.security.enableWrappers {
-      assertions = lib.mapAttrsToList (name: opts: {
-        assertion = opts.setuid || opts.setgid -> opts.capabilities == "";
-        message = ''
-          The security.wrappers.${name} wrapper is not valid:
-              setuid/setgid and capabilities are mutually exclusive.
-        '';
-      }) wrappers;
+  config = lib.mkIf config.security.enableWrappers {
 
-      security.wrappers =
-        let
-          mkSetuidRoot = source: {
-            setuid = true;
-            owner = "root";
-            group = "root";
-            inherit source;
-          };
-        in
-        {
-          # These are mount related wrappers that require the +s permission.
-          mount = mkSetuidRoot "${lib.getBin pkgs.util-linux}/bin/mount";
-          umount = mkSetuidRoot "${lib.getBin pkgs.util-linux}/bin/umount";
+    assertions = lib.mapAttrsToList (name: opts: {
+      assertion = opts.setuid || opts.setgid -> opts.capabilities == "";
+      message = ''
+        The security.wrappers.${name} wrapper is not valid:
+            setuid/setgid and capabilities are mutually exclusive.
+      '';
+    }) wrappers;
+
+    security.wrappers =
+      let
+        mkSetuidRoot = source: {
+          setuid = true;
+          owner = "root";
+          group = "root";
+          inherit source;
         };
-
-      # Make sure our wrapperDir exports to the PATH env variable when
-      # initializing the shell
-      environment.extraInit = ''
-        # Wrappers override other bin directories.
-        export PATH="${wrapperDir}:$PATH"
-      '';
-
-      security.apparmor.includes = lib.mapAttrs' (
-        wrapName: wrap:
-        lib.nameValuePair "nixos/security.wrappers/${wrapName}" ''
-          include "${
-            pkgs.apparmorRulesFromClosure { name = "security.wrappers.${wrapName}"; } [
-              (securityWrapper wrap.source)
-            ]
-          }"
-          mrpx ${wrap.source},
-        ''
-      ) wrappers;
-
-      systemd.mounts = [
-        {
-          where = parentWrapperDir;
-          what = "tmpfs";
-          type = "tmpfs";
-          options = lib.concatStringsSep "," [
-            "nodev"
-            "mode=755"
-            "size=${config.security.wrapperDirSize}"
-          ];
-        }
-      ];
-
-      systemd.services.suid-sgid-wrappers = {
-        description = "Create SUID/SGID Wrappers";
-        wantedBy = [ "sysinit.target" ];
-        before = [
-          "sysinit.target"
-          "shutdown.target"
-        ];
-        conflicts = [ "shutdown.target" ];
-        after = [ "systemd-sysusers.service" ];
-        unitConfig.DefaultDependencies = false;
-        unitConfig.RequiresMountsFor = [
-          "/nix/store"
-          "/run/wrappers"
-        ];
-        serviceConfig.RestrictSUIDSGID = false;
-        serviceConfig.Type = "oneshot";
-        script = ''
-          chmod 755 "${parentWrapperDir}"
-
-          # We want to place the tmpdirs for the wrappers to the parent dir.
-          wrapperDir=$(mktemp --directory --tmpdir="${parentWrapperDir}" wrappers.XXXXXXXXXX)
-          chmod a+rx "$wrapperDir"
-
-          ${lib.concatStringsSep "\n" mkWrappedPrograms}
-
-          if [ -L ${wrapperDir} ]; then
-            # Atomically replace the symlink
-            # See https://axialcorps.com/2013/07/03/atomically-replacing-files-and-directories/
-            old=$(readlink -f ${wrapperDir})
-            if [ -e "${wrapperDir}-tmp" ]; then
-              rm --force --recursive "${wrapperDir}-tmp"
-            fi
-            ln --symbolic --force --no-dereference "$wrapperDir" "${wrapperDir}-tmp"
-            mv --no-target-directory "${wrapperDir}-tmp" "${wrapperDir}"
-            rm --force --recursive "$old"
-          else
-            # For initial setup
-            ln --symbolic "$wrapperDir" "${wrapperDir}"
-          fi
-        '';
+      in
+      {
+        # These are mount related wrappers that require the +s permission.
+        mount = mkSetuidRoot "${lib.getBin pkgs.util-linux}/bin/mount";
+        umount = mkSetuidRoot "${lib.getBin pkgs.util-linux}/bin/umount";
       };
 
-      ###### wrappers consistency checks
-      system.checks = lib.singleton (
-        pkgs.runCommand "ensure-all-wrappers-paths-exist"
-          {
-            preferLocalBuild = true;
-          }
-          ''
-            # make sure we produce output
-            mkdir -p $out
+    # Make sure our wrapperDir exports to the PATH env variable when
+    # initializing the shell
+    environment.extraInit = ''
+      # Wrappers override other bin directories.
+      export PATH="${wrapperDir}:$PATH"
+    '';
 
-            echo -n "Checking that Nix store paths of all wrapped programs exist... "
+    security.apparmor.includes = lib.mapAttrs' (
+      wrapName: wrap:
+      lib.nameValuePair "nixos/security.wrappers/${wrapName}" ''
+        include "${
+          pkgs.apparmorRulesFromClosure { name = "security.wrappers.${wrapName}"; } [
+            (securityWrapper wrap.source)
+          ]
+        }"
+        mrpx ${wrap.source},
+      ''
+    ) wrappers;
 
-            declare -A wrappers
-            ${lib.concatStringsSep "\n" (lib.mapAttrsToList (n: v: "wrappers['${n}']='${v.source}'") wrappers)}
+    systemd.mounts = [
+      {
+        where = parentWrapperDir;
+        what = "tmpfs";
+        type = "tmpfs";
+        options = lib.concatStringsSep "," [
+          "nodev"
+          "mode=755"
+          "size=${config.security.wrapperDirSize}"
+        ];
+      }
+    ];
 
-            for name in "''${!wrappers[@]}"; do
-              path="''${wrappers[$name]}"
-              if [[ "$path" =~ /nix/store ]] && [ ! -e "$path" ]; then
-                test -t 1 && echo -ne '\033[1;31m'
-                echo "FAIL"
-                echo "The path $path does not exist!"
-                echo 'Please, check the value of `security.wrappers."'$name'".source`.'
-                test -t 1 && echo -ne '\033[0m'
-                exit 1
-              fi
-            done
+    systemd.services.suid-sgid-wrappers = {
+      description = "Create SUID/SGID Wrappers";
+      wantedBy = [ "sysinit.target" ];
+      before = [
+        "sysinit.target"
+        "shutdown.target"
+      ];
+      conflicts = [ "shutdown.target" ];
+      after = [ "systemd-sysusers.service" ];
+      unitConfig.DefaultDependencies = false;
+      unitConfig.RequiresMountsFor = [
+        "/nix/store"
+        "/run/wrappers"
+      ];
+      serviceConfig.RestrictSUIDSGID = false;
+      serviceConfig.Type = "oneshot";
+      script = ''
+        chmod 755 "${parentWrapperDir}"
 
-            echo "OK"
-          ''
-      );
-    })
-  ];
+        # We want to place the tmpdirs for the wrappers to the parent dir.
+        wrapperDir=$(mktemp --directory --tmpdir="${parentWrapperDir}" wrappers.XXXXXXXXXX)
+        chmod a+rx "$wrapperDir"
+
+        ${lib.concatStringsSep "\n" mkWrappedPrograms}
+
+        if [ -L ${wrapperDir} ]; then
+          # Atomically replace the symlink
+          # See https://axialcorps.com/2013/07/03/atomically-replacing-files-and-directories/
+          old=$(readlink -f ${wrapperDir})
+          if [ -e "${wrapperDir}-tmp" ]; then
+            rm --force --recursive "${wrapperDir}-tmp"
+          fi
+          ln --symbolic --force --no-dereference "$wrapperDir" "${wrapperDir}-tmp"
+          mv --no-target-directory "${wrapperDir}-tmp" "${wrapperDir}"
+          rm --force --recursive "$old"
+        else
+          # For initial setup
+          ln --symbolic "$wrapperDir" "${wrapperDir}"
+        fi
+      '';
+    };
+
+    ###### wrappers consistency checks
+    system.checks = lib.singleton (
+      pkgs.runCommand "ensure-all-wrappers-paths-exist"
+        {
+          preferLocalBuild = true;
+        }
+        ''
+          # make sure we produce output
+          mkdir -p $out
+
+          echo -n "Checking that Nix store paths of all wrapped programs exist... "
+
+          declare -A wrappers
+          ${lib.concatStringsSep "\n" (lib.mapAttrsToList (n: v: "wrappers['${n}']='${v.source}'") wrappers)}
+
+          for name in "''${!wrappers[@]}"; do
+            path="''${wrappers[$name]}"
+            if [[ "$path" =~ /nix/store ]] && [ ! -e "$path" ]; then
+              test -t 1 && echo -ne '\033[1;31m'
+              echo "FAIL"
+              echo "The path $path does not exist!"
+              echo 'Please, check the value of `security.wrappers."'$name'".source`.'
+              test -t 1 && echo -ne '\033[0m'
+              exit 1
+            fi
+          done
+
+          echo "OK"
+        ''
+    );
+  };
 }

nixos/modules/services/audio/music-assistant.nix

@@ -155,7 +155,8 @@ in
         CapabilityBoundingSet = [ "" ];
         DevicePolicy = "closed";
         LockPersonality = true;
-        MemoryDenyWriteExecute = !useYTMusic;
+        # breaks pyopenssl's cffi calls, used in remote access feature
+        MemoryDenyWriteExecute = false;
         ProcSubset = "pid";
         ProtectClock = true;
         ProtectControlGroups = true;

nixos/modules/services/continuous-integration/github-runner/options.nix

@@ -289,7 +289,6 @@
                   "node24"
                 ]);
               default = [
-                "node20"
                 "node24"
               ];
               description = ''

nixos/modules/services/desktops/seatd.nix

@@ -40,6 +40,7 @@ in
   config = lib.mkIf cfg.enable {
     environment.systemPackages = with pkgs; [
       seatd
+      sdnotify-wrapper
     ];
     users.groups.seat = lib.mkIf (cfg.group == "seat") { };
 
@@ -54,7 +55,7 @@ in
         Type = "notify";
         NotifyAccess = "all";
         SyslogIdentifier = "seatd";
-        ExecStart = "${lib.getExe' pkgs.s6 "s6-notify-socket-from-fd"} ${pkgs.seatd.bin}/bin/seatd -n 1 -u ${cfg.user} -g ${cfg.group} -l ${cfg.logLevel}";
+        ExecStart = "${pkgs.sdnotify-wrapper}/bin/sdnotify-wrapper ${pkgs.seatd.bin}/bin/seatd -n 1 -u ${cfg.user} -g ${cfg.group} -l ${cfg.logLevel}";
         RestartSec = 1;
         Restart = "always";
       };

nixos/modules/services/networking/fastnetmon-advanced.nix

@@ -207,6 +207,10 @@ in
           AmbientCapabilities = "cap_net_bind_service";
         };
       };
+
+      services.fastnetmon-advanced.hostgroups = {
+        global = { };
+      };
     })
 
     (lib.mkIf (cfg.enable && cfg.enableAdvancedTrafficPersistence) {

nixos/modules/services/networking/llama-swap.nix

@@ -166,7 +166,6 @@ in
         SystemCallErrorNumber = "EPERM";
         ProtectProc = "invisible";
         ProtectHostname = true;
-        ProcSubset = "pid";
         WorkingDirectory = "/tmp";
       };
     };

nixos/modules/services/web-apps/immich.nix

@@ -380,6 +380,8 @@ in
       MACHINE_LEARNING_WORKERS = "1";
       MACHINE_LEARNING_WORKER_TIMEOUT = "120";
       MACHINE_LEARNING_CACHE_FOLDER = "/var/cache/immich";
+      # TODO: drop when insightface no longer unconditionally imports matplotlib
+      MPLCONFIGDIR = "/var/cache/immich";
       XDG_CACHE_HOME = "/var/cache/immich";
       IMMICH_HOST = "localhost";
       IMMICH_PORT = "3003";

nixos/modules/virtualisation/nixos-containers.nix

@@ -607,14 +607,16 @@ in
                                 boot.isNspawnContainer = true;
                                 networking.hostName = mkDefault name;
                                 networking.useDHCP = false;
-                                networking.interfaces = lib.mkIf config.privateNetwork {
-                                  eth0.ipv4.addresses = lib.optional (config.localAddress != null) (
-                                    ipv4FromString config.localAddress
-                                  );
-                                  eth0.ipv6.addresses = lib.optional (config.localAddress6 != null) (
-                                    lib.network.ipv6.fromString config.localAddress6
-                                  );
-                                };
+                                networking.interfaces = lib.mkIf config.privateNetwork (
+                                  lib.mkMerge [
+                                    (lib.mkIf (config.localAddress != null) {
+                                      eth0.ipv4.addresses = [ (ipv4FromString config.localAddress) ];
+                                    })
+                                    (lib.mkIf (config.localAddress6 != null) {
+                                      eth0.ipv6.addresses = [ (lib.network.ipv6.fromString config.localAddress6) ];
+                                    })
+                                  ]
+                                );
                                 assertions = [
                                   {
                                     assertion =

nixos/release.nix

@@ -30,7 +30,8 @@ let
 
   version = fileContents ../.version;
   versionSuffix =
-    (if stableBranch then "." else "pre") + "${toString nixpkgs.revCount}.${nixpkgs.shortRev}";
+    (if stableBranch then "." else "beta")
+    + "${toString (nixpkgs.revCount - 1004291)}.${nixpkgs.shortRev}";
 
   # Run the tests for each platform.  You can run a test by doing
   # e.g. ‘nix-build release.nix -A tests.login.x86_64-linux’,

nixos/tests/evcc.nix

@@ -7,7 +7,7 @@ in
   name = "evcc";
   meta.maintainers = with lib.maintainers; [ hexa ];
 
-  nodes = {
+  containers = {
     machine = {
       services.evcc = {
         enable = true;

nixos/tests/fastnetmon-advanced.nix

@@ -62,7 +62,7 @@
       bird.wait_for_unit("bird.service")
 
       fnm.wait_until_succeeds('journalctl -eu fastnetmon.service | grep "BGP daemon restarted correctly"')
-      fnm.wait_until_succeeds("journalctl -eu gobgp.service | grep BGP_FSM_OPENCONFIRM")
+      fnm.wait_until_succeeds('journalctl -eu gobgp.service | grep "Peer Up"')
       bird.wait_until_succeeds("birdc show protocol fnm | grep Estab")
       fnm.wait_until_succeeds('journalctl -eu fastnetmon.service | grep "API server listening"')
       fnm.succeed("fcli set blackhole 172.23.42.123")

nixos/tests/mattermost/default.nix

@@ -58,11 +58,20 @@ import ../make-test-python.nix (
                   UserNoticesEnabled = false;
                 };
               };
+              package = pkgs.mattermost.override {
+                removeFreeBadge = true;
+                removeUserLimit = true;
+              };
             } mattermostConfig;
 
             # Upgrade to the latest Mattermost.
             specialisation.latest.configuration = {
-              services.mattermost.package = lib.mkForce pkgs.mattermostLatest;
+              services.mattermost.package = lib.mkForce (
+                pkgs.mattermostLatest.override {
+                  removeFreeBadge = true;
+                  removeUserLimit = true;
+                }
+              );
               system.stateVersion = lib.mkVMOverride (lib.versions.majorMinor lib.version);
             };
           }

nixos/tests/pam/zfs-key.nix

@@ -11,6 +11,7 @@ in
     { ... }:
     {
       boot.supportedFilesystems = [ "zfs" ];
+      boot.zfs.forceImportRoot = false;
 
       networking.hostId = "12345678";
 
@@ -42,10 +43,10 @@ in
         machine.succeed("truncate -s 64M /testpool.img")
         machine.succeed("zpool create -O canmount=off '${pool}' /testpool.img")
         machine.succeed("zfs create -o canmount=off -p '${homes}'")
-        machine.succeed("echo ${userPassword} | zfs create -o canmount=noauto -o encryption=on -o keyformat=passphrase '${homes}/alice'")
-        machine.succeed("zfs unload-key '${homes}/alice'")
-        machine.succeed("echo ${mismatchPass} | zfs create -o canmount=noauto -o encryption=on -o keyformat=passphrase '${homes}/bob'")
-        machine.succeed("zfs unload-key '${homes}/bob'")
+        machine.succeed("echo ${userPassword} | zfs create -o encryption=on -o keyformat=passphrase '${homes}/alice'")
+        machine.succeed("zfs unmount '${homes}/alice' && zfs unload-key '${homes}/alice'")
+        machine.succeed("echo ${mismatchPass} | zfs create -o encryption=on -o keyformat=passphrase '${homes}/bob'")
+        machine.succeed("zfs unmount '${homes}/bob' && zfs unload-key '${homes}/bob'")
 
       with subtest("Switch to tty2"):
         machine.fail("pgrep -f 'agetty.*tty2'")

nixos/tests/pinnwand.nix

@@ -12,7 +12,7 @@ in
     maintainers = [ hexa ];
   };
 
-  nodes = {
+  containers = {
     server =
       { config, ... }:
       {

nixos/tests/postfix-tlspol.nix

@@ -7,7 +7,7 @@
 
   meta.maintainers = with lib.maintainers; [ hexa ];
 
-  nodes.machine = {
+  containers.machine = {
     services.postfix.enable = true;
     services.postfix-tlspol.enable = true;
 

nixos/tests/vsftpd.nix

@@ -4,6 +4,8 @@
 
   nodes = {
     server = {
+      security.pam.services.vsftpd.enable = true;
+
       services.vsftpd = {
         enable = true;
         userlistDeny = false;

nixos/tests/zigbee2mqtt.nix

@@ -6,7 +6,7 @@
 
 {
   name = "zigbee2mqtt";
-  nodes.machine = {
+  containers.machine = {
     systemd.services.dummy-serial = {
       wantedBy = [
         "multi-user.target"

pkgs/applications/editors/android-studio/default.nix

@@ -21,14 +21,14 @@ let
     url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2025.3.4.7/android-studio-panda4-patch1-linux.tar.gz";
   };
   betaVersion = {
-    version = "2025.3.4.5"; # "Android Studio Panda 4 | 2025.3.4 RC 1"
-    sha256Hash = "sha256-NiNq1j+rzPU4KsLKYymfi5/Vx2Bn3hK8I3OVIUFloX0=";
-    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2025.3.4.5/android-studio-panda4-rc1-linux.tar.gz";
+    version = "2026.1.1.6"; # "Android Studio Quail 1 | 2026.1.1 RC 1"
+    sha256Hash = "sha256-b6PVgBTTjIgm6BI171RL7T6GJD9ApnTWGOTqvt703PQ=";
+    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.1.6/android-studio-quail1-rc1-linux.tar.gz";
   };
   latestVersion = {
-    version = "2026.1.1.5"; # "Android Studio Quail 1 | 2026.1.1 Canary 5"
-    sha256Hash = "sha256-k4rM0MyTh0wnpsK8m6Hs1nSdwYpqUiQ+z7oiO6hn9YQ=";
-    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.1.5/android-studio-quail1-canary5-linux.tar.gz";
+    version = "2026.1.2.2"; # "Android Studio Quail 2 | 2026.1.2 Canary 2"
+    sha256Hash = "sha256-+FmW72k48GF71yzCdpIAl//qi6w26Qg8gZUW5/Nuh58=";
+    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.2.2/android-studio-quail2-canary2-linux.tar.gz";
   };
 in
 {

pkgs/applications/misc/cura/plugins.nix

@@ -1,84 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  python3Packages,
-  libspnav,
-  jq,
-}:
-
-let
-
-  self = {
-
-    octoprint = stdenv.mkDerivation {
-      pname = "Cura-OctoPrintPlugin";
-      version = "3.5.18";
-
-      src = fetchFromGitHub {
-        owner = "fieldOfView";
-        repo = "Cura-OctoPrintPlugin";
-        rev = "7bd73946fbf22d18337dc900a81a011ece26bee0";
-        sha256 = "057b2f5f49p96lkh2wsr9w6yh2003x4a85irqsgbzp6igmk8imdn";
-      };
-
-      propagatedBuildInputs = with python3Packages; [
-        netifaces
-      ];
-
-      installPhase = ''
-        mkdir -p $out/lib/cura/plugins/OctoPrintPlugin
-        cp -rv . $out/lib/cura/plugins/OctoPrintPlugin/
-      '';
-
-      meta = {
-        description = "Enables printing directly to OctoPrint and monitoring the process";
-        homepage = "https://github.com/fieldOfView/Cura-OctoPrintPlugin";
-        license = lib.licenses.agpl3Plus;
-        maintainers = [ ];
-      };
-    };
-
-    rawmouse = stdenv.mkDerivation rec {
-      pname = "RawMouse";
-      version = "1.1.0";
-
-      src = fetchFromGitHub {
-        owner = "smartavionics";
-        repo = "RawMouse";
-        rev = version;
-        sha256 = "0hvi7qwd4xfnqnhbj9dgfjmvv9df7s42asf3fdfxv43n6nx74scw";
-      };
-
-      nativeBuildInputs = [ jq ];
-
-      propagatedBuildInputs = with python3Packages; [
-        hidapi
-      ];
-
-      buildPhase = ''
-        jq 'del(.devices) | .libspnav="${libspnav}/lib/libspnav.so"' \
-          <RawMouse/config.json >RawMouse/config.json.new
-        mv RawMouse/config.json.new RawMouse/config.json
-
-        # remove prebuilt binaries
-        rm -r RawMouse/hidapi
-      '';
-
-      installPhase = ''
-        mkdir -p $out/lib/cura/plugins/RawMouse
-        cp -rv . $out/lib/cura/plugins/RawMouse/
-      '';
-
-      meta = {
-        description = "Cura plugin for HID mice such as 3Dconnexion spacemouse";
-        homepage = "https://github.com/smartavionics/RawMouse";
-        license = lib.licenses.agpl3Plus;
-        maintainers = [ ];
-      };
-    };
-
-  };
-
-in
-self

pkgs/applications/misc/curaengine/default.nix

@@ -1,49 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  cmake,
-  libarcus,
-  stb,
-  protobuf,
-  fetchpatch,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "curaengine";
-  version = "4.13.1";
-
-  src = fetchFromGitHub {
-    owner = "Ultimaker";
-    repo = "CuraEngine";
-    rev = finalAttrs.version;
-    sha256 = "sha256-dx0Q6cuA66lG4nwR7quW5Tvs9sdxjdV4gtpxXirI4nY=";
-  };
-
-  nativeBuildInputs = [ cmake ];
-  buildInputs = [
-    libarcus
-    stb
-    protobuf
-  ];
-
-  cmakeFlags = [ "-DCURA_ENGINE_VERSION=${finalAttrs.version}" ];
-
-  # TODO already fixed in master, remove in next release
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/Ultimaker/CuraEngine/commit/de60e86a6ea11cb7d121471b5dd192e5deac0f3d.patch";
-      hash = "sha256-/gT9yErIDDYAXvZ6vX5TGlwljy31K563+sqkm1UGljQ=";
-      includes = [ "src/utils/math.h" ];
-    })
-  ];
-
-  meta = {
-    description = "Powerful, fast and robust engine for processing 3D models into 3D printing instruction";
-    homepage = "https://github.com/Ultimaker/CuraEngine";
-    license = lib.licenses.agpl3Only;
-    platforms = lib.platforms.linux;
-    maintainers = [ ];
-    mainProgram = "CuraEngine";
-  };
-})

pkgs/applications/networking/browsers/firefox/packages/firefox.nix

@@ -9,10 +9,10 @@
 
 buildMozillaMach rec {
   pname = "firefox";
-  version = "151.0.1";
+  version = "151.0.2";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "8492a1bb956b38373153938bd18b0e18e3a4ad0d2abc2017b45e02bc2768c8f468d5c06329a32485a03a67bb9c22102e6abff1e73080c77764735d430dc77277";
+    sha512 = "87308953ed354a2799a9a45be40033bf9ff8d80fa220f034aacfbd6e754716901d4164c37fa56032c659b259116603e0ba2b566c1f3651ab9cc0835d502cd739";
   };
 
   meta = {

pkgs/applications/networking/browsers/firefox/wrapper.nix

@@ -166,36 +166,34 @@ let
           ) (lib.optionals usesNixExtensions nixExtensions);
 
       enterprisePolicies = {
-        policies = {
-          DisableAppUpdate = true;
-        }
-        // lib.optionalAttrs usesNixExtensions {
-          ExtensionSettings = {
-            "*" = {
-              blocked_install_message = "You can't have manual extension mixed with nix extensions";
-              installation_mode = "blocked";
-            };
-          }
-          // lib.foldr (
-            e: ret:
-            ret
-            // {
-              "${e.extid}" = {
-                installation_mode = "allowed";
+        policies =
+          lib.optionalAttrs usesNixExtensions {
+            ExtensionSettings = {
+              "*" = {
+                blocked_install_message = "You can't have manual extension mixed with nix extensions";
+                installation_mode = "blocked";
               };
             }
-          ) { } extensions;
+            // lib.foldr (
+              e: ret:
+              ret
+              // {
+                "${e.extid}" = {
+                  installation_mode = "allowed";
+                };
+              }
+            ) { } extensions;
 
-          Extensions = {
-            Install = lib.foldr (e: ret: ret ++ [ "${e.outPath}/${e.extid}.xpi" ]) [ ] extensions;
-          };
-        }
-        // lib.optionalAttrs smartcardSupport {
-          SecurityDevices = {
-            "OpenSC PKCS#11 Module" = "opensc-pkcs11.so";
-          };
-        }
-        // extraPolicies;
+            Extensions = {
+              Install = lib.foldr (e: ret: ret ++ [ "${e.outPath}/${e.extid}.xpi" ]) [ ] extensions;
+            };
+          }
+          // lib.optionalAttrs smartcardSupport {
+            SecurityDevices = {
+              "OpenSC PKCS#11 Module" = "opensc-pkcs11.so";
+            };
+          }
+          // extraPolicies;
       };
 
       mozillaCfg = ''
@@ -414,6 +412,9 @@ let
             ln -sfT "$target" "$out/$l"
           done
 
+          # Disable update checks
+          touch $out/${libDir}/is-packaged-app
+
           cd "$out"
 
         ''

pkgs/applications/networking/instant-messengers/gajim/default.nix

@@ -31,7 +31,7 @@
   enableRST ? true,
   docutils,
   enableSpelling ? true,
-  gspell,
+  libspelling,
   enableUPnP ? true,
   gupnp-igd,
   enableAppIndicator ? true,
@@ -70,7 +70,7 @@ python3.pkgs.buildPythonApplication rec {
     libnice
   ]
   ++ lib.optional enableSecrets libsecret
-  ++ lib.optional enableSpelling gspell
+  ++ lib.optional enableSpelling libspelling
   ++ lib.optional enableUPnP gupnp-igd
   ++ lib.optional enableAppIndicator libappindicator-gtk3
   ++ lib.optional enableSoundNotifications gsound;

pkgs/applications/networking/mailreaders/thunderbird/packages.nix

@@ -30,12 +30,16 @@ let
         (if lib.versionOlder version "140" then ./no-buildconfig.patch else ./no-buildconfig-tb140.patch)
       ];
       # FIXME: let's hope that upstream will fix this soon and we can drop this hack again.
-      # https://bugzilla.mozilla.org/show_bug.cgi?id=2006630
+      # https://bugzilla.mozilla.org/show_bug.cgi?id=2040877
       extraPostPatch =
-        lib.optionalString (lib.versionAtLeast version "147" && lib.versionOlder version "149")
-          ''
-            find . -name .cargo-checksum.json | xargs sed 's/"[^"]*\.gitmodules":"[a-z0-9]*",//g' -i
-          '';
+        lib.optionalString (lib.versionAtLeast version "151" && lib.versionOlder version "152") ''
+          echo https://hg.mozilla.org/releases/comm-release/rev/becfb8fb2c70f1603882a2787e2170d5d8013949 >> sourcestamp.txt
+          echo https://hg.mozilla.org/releases/mozilla-release/rev/fc12dc911f904307729760a817deb829cbf8feb4 >> sourcestamp.txt
+        ''
+        # https://bugzilla.mozilla.org/show_bug.cgi?id=2006630
+        + lib.optionalString (lib.versionAtLeast version "140.8" && lib.versionOlder version "151") ''
+          find . -name .cargo-checksum.json | xargs sed 's/"[^"]*\.gitmodules":"[a-z0-9]*",//g' -i
+        '';
 
       meta = {
         changelog = "https://www.thunderbird.net/en-US/thunderbird/${version}/releasenotes/";
@@ -73,8 +77,8 @@ rec {
   thunderbird = thunderbird-latest;
 
   thunderbird-latest = common {
-    version = "150.0.2";
-    sha512 = "3e52220ff34aa6cd1bf46a910dba1f30d0abf7d19ed7f501ffeeb8f5901b8d97fdc0adb0cceb434ef8e83c7f7b83f28024b872280237af72ff2da9d89fafe065";
+    version = "151.0.1";
+    sha512 = "a09c1e18faa8d7fdccf39e905542c21e817230e68c7cc6050beec048d0fec0f8eb92e51278d2ccd8d8cfa842762662235517e20238b555a4ad48ee5648dc3589";
 
     updateScript = callPackage ./update.nix {
       attrPath = "thunderbirdPackages.thunderbird-latest";
@@ -87,8 +91,8 @@ rec {
   thunderbird-140 = common {
     applicationName = "Thunderbird ESR";
 
-    version = "140.7.2esr";
-    sha512 = "513bcaa496f987d0f3906aeb6fe3ea651331470646b0c58479c91bb2c8eb52e389bc8aa646437a03b611ab78bda1df7252545960ffe38086d1fc462e65421819";
+    version = "140.11.1esr";
+    sha512 = "93dfdd26e6f4c7dd2f7dcc2e4994980d017868341c60c93775721467abd9192b815f2de63928e7d10c965fc045ed72ca5b49ed6502a61e50104ee5cd00941d1e";
 
     updateScript = callPackage ./update.nix {
       attrPath = "thunderbirdPackages.thunderbird-140";

pkgs/applications/office/activitywatch/aw-notify-desktop-notifier-6.patch

@@ -0,0 +1,72 @@
+diff --git a/aw_notify/main.py b/aw_notify/main.py
+index c749725..44dce5a 100644
+--- a/aw_notify/main.py
++++ b/aw_notify/main.py
+@@ -3,6 +3,7 @@
+ and send notifications to the user on predefined conditions.
+ """
+ 
++import asyncio
+ import logging
+ import sys
+ import threading
+@@ -23,7 +24,7 @@
+ import aw_client.queries
+ import click
+ from aw_core.log import setup_logging
+-from desktop_notifier import DesktopNotifier
++from desktop_notifier import DesktopNotifier, Icon
+ from typing_extensions import TypeAlias
+ 
+ logger = logging.getLogger(__name__)
+@@ -149,11 +150,20 @@ def notify(title: str, msg: str):
+     if notifier is None:
+         notifier = DesktopNotifier(
+             app_name="AW",
+-            app_icon=f"file://{icon_path}",
++            app_icon=Icon(uri=f"file://{icon_path}"),
+             notification_limit=10,
+         )
+ 
+     logger.info(f'Showing: "{title} - {msg}"')
+-    notifier.send_sync(title=title, message=msg)
++
++    # Get or create event loop
++    try:
++        loop = asyncio.get_running_loop()
++    except RuntimeError:
++        loop = asyncio.new_event_loop()
++        asyncio.set_event_loop(loop)
++
++    # Send notification
++    loop.run_until_complete(notifier.send(title=title, message=msg))
+ 
+ 
+ class CategoryAlert:
+diff --git a/pyproject.toml b/pyproject.toml
+index 314fe2f..0d6d5a9 100644
+--- a/pyproject.toml
++++ b/pyproject.toml
+@@ -13,15 +13,15 @@ packages = [{include = "aw_notify"}]
+ aw-notify = "aw_notify.main:main"
+ 
+ [tool.poetry.dependencies]
+-python = "^3.9,<3.12"
+-aw-client = "^0.5.13"
+-desktop-notifier = "^3.4.2"
+-rubicon-objc = { version = "^0.4.0", platform = "darwin" }
++python = ">=3.9,<3.14"
++aw-client = "^0.5.15"
++desktop-notifier = "^6.0.0"
++rubicon-objc = { version = "^0.5.0", platform = "darwin" }
+ 
+ [tool.poetry.group.dev.dependencies]
+ black = "*"
+ mypy = "*"
+-pyinstaller = "^6.6"
+-pytest = "^7.4"
++pyinstaller = "^6.12.0"
++pytest = "*"
+ 
+ [build-system]
+ requires = ["poetry-core"]

pkgs/applications/office/activitywatch/default.nix

@@ -14,6 +14,7 @@
   qtsvg,
   xdg-utils,
   replaceVars,
+  nodejs_22,
   buildNpmPackage,
 }:
 
@@ -159,6 +160,12 @@ rec {
     pyproject = true;
     build-system = [ python3Packages.poetry-core ];
 
+    patches = [
+      # Backport desktop-notifier 6 / rubicon-objc 0.5 support.
+      # https://github.com/ActivityWatch/aw-notify/pull/10
+      ./aw-notify-desktop-notifier-6.patch
+    ];
+
     dependencies = with python3Packages; [
       aw-client
       desktop-notifier
@@ -228,6 +235,7 @@ rec {
 
     src = "${sources}/aw-server-rust/aw-webui";
 
+    nodejs = nodejs_22;
     npmDepsHash = "sha256-fPk7UpKuO3nEN1w+cf9DIZIG1+XRUk6PJfVmtpC30XE=";
 
     makeCacheWritable = true;

pkgs/applications/science/logic/abella/default.nix

@@ -54,10 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     homepage = "https://abella-prover.org";
     license = lib.licenses.gpl3;
-    maintainers = with lib.maintainers; [
-      bcdarwin
-      ciil
-    ];
+    maintainers = [ lib.maintainers.bcdarwin ];
     platforms = lib.platforms.unix;
   };
 })

pkgs/applications/science/logic/hol_light/default.nix

@@ -9,6 +9,7 @@
   zarith,
   camlp5,
   camlp-streams,
+  pcre2,
   bash,
 }:
 
@@ -19,6 +20,7 @@ let
       ''
         -I ${zarith}/lib/ocaml/${ocaml.version}/site-lib/zarith \
         -I ${zarith}/lib/ocaml/${ocaml.version}/site-lib/stublibs \
+        -I ${pcre2}/lib/ocaml/${ocaml.version}/site-lib/stublibs \
       ''
     else
       lib.optionalString (num != null) ''
@@ -64,6 +66,7 @@ stdenv.mkDerivation {
   ];
   propagatedBuildInputs = [
     camlp-streams
+    pcre2
     (if use_zarith then zarith else num)
   ];
 

pkgs/applications/science/math/R/default.nix

@@ -16,7 +16,6 @@
   perl,
   readline,
   tcl,
-  texlive,
   texliveSmall,
   tk,
   xz,
@@ -198,23 +197,20 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
 
-  # make tex output available to texlive.combine
-  passthru.pkgs = [ finalAttrs.finalPackage.tex ];
-  passthru.tlType = "run";
   # dependencies (based on \RequirePackage in jss.cls, Rd.sty, Sweave.sty)
-  passthru.tlDeps = with texlive; [
-    amsfonts
-    amsmath
-    fancyvrb
-    graphics
-    hyperref
-    iftex
-    jknapltx
-    latex
-    lm
-    tools
-    upquote
-    url
+  passthru.tlDeps = ps: [
+    ps.amsfonts
+    ps.amsmath
+    ps.fancyvrb
+    ps.graphics
+    ps.hyperref
+    ps.iftex
+    ps.jknapltx
+    ps.latex
+    ps.lm
+    ps.tools
+    ps.upquote
+    ps.url
   ];
 
   meta = {

pkgs/applications/virtualization/docker/default.nix

@@ -400,7 +400,7 @@ in
   # https://github.com/moby/moby/tree/${mobyRev}/Dockerfile
   docker_25 =
     let
-      version = "25.0.13";
+      version = "25.0.16";
     in
     callPackage dockerGen {
       inherit version;
@@ -409,7 +409,7 @@ in
       cliRev = "43987fca488a535d810c429f75743d8c7b63bf4f";
       cliHash = "sha256-OwufdfuUPbPtgqfPeiKrQVkOOacU2g4ommHb770gV40=";
       mobyRev = "v${version}";
-      mobyHash = "sha256-X+1QG/toJt+VNLktR5vun8sG3PRoTVBAcekFXxocJdU=";
+      mobyHash = "sha256-St5yLoxo8QUTu7PjNcblS/EzZm98T189RPl1y+pAyHA=";
       runcRev = "v1.2.5";
       runcHash = "sha256-J/QmOZxYnMPpzm87HhPTkYdt+fN+yeSUu2sv6aUeTY4=";
       containerdRev = "v1.7.27";

pkgs/build-support/build-mozilla-mach/140-bindgen-string-view.patch

@@ -0,0 +1,15 @@
+diff --git a/tools/profiler/rust-api/build.rs b/tools/profiler/rust-api/build.rs
+index 9bb27eb83e5e..3f09f7f01bcb 100644
+--- a/tools/profiler/rust-api/build.rs
++++ b/tools/profiler/rust-api/build.rs
+@@ -88,6 +88,10 @@ fn generate_bindings() {
+         // successfully. Otherwise, it fails to build because MarkerSchema has
+         // some std::strings as its fields.
+         .opaque_type("std::string")
++        .blocklist_type(".*basic_string_view.*")
++        .opaque_type(".*basic_string_view.*")
++        .blocklist_type(".*basic_string___self_view.*")
++        .opaque_type(".*basic_string___self_view.*")
+         // std::vector needs to be converted to an opaque type because, if it's
+         // not an opaque type, bindgen can't find its size properly and
+         // MarkerSchema's total size reduces. That causes a heap buffer overflow.

pkgs/build-support/build-mozilla-mach/default.nix

@@ -332,6 +332,14 @@ buildStdenv.mkDerivation {
       # https://hg-edge.mozilla.org/mozilla-central/rev/aa8a29bd1fb9
       ./139-wayland-drag-animation.patch
     ]
+    ++ lib.optionals (lib.versionAtLeast version "140" && lib.versionOlder version "144") [
+      # Versions before 144 vendor bindgen 0.69. On Darwin, libc++ 21 changed
+      # basic_string::__self_view from a typedef to an attributed using alias;
+      # bindgen then emits it without its template parameter, producing invalid
+      # Rust. Vendored bindgen was updated in:
+      # https://bugzilla.mozilla.org/show_bug.cgi?id=1985509
+      ./140-bindgen-string-view.patch
+    ]
     ++ extraPatches;
 
   postPatch = ''

pkgs/build-support/fetchgit/nix-prefetch-git

@@ -123,6 +123,10 @@ fi
 init_remote(){
     local url=$1
     clean_git init --initial-branch=master
+    # Disable maintenance: it's not useful for a short-lived clone, and
+    # background maintenance causes non-deterministic builds.
+    # https://github.com/NixOS/nixpkgs/issues/524215
+    clean_git config maintenance.auto false
     clean_git remote add origin "$url"
     if [ -n "$sparseCheckout" ]; then
         git config remote.origin.partialclonefilter "blob:none"

pkgs/build-support/rust/import-cargo-lock.nix

@@ -130,7 +130,10 @@ let
     };
 
   registries = {
-    "https://github.com/rust-lang/crates.io-index" = "https://crates.io/api/v1/crates";
+    # Use static.crates.io (CDN) instead of crates.io/api to avoid the 1 req/sec
+    # rate limit on the API servers, which currently returns intermittent 403s.
+    # See https://github.com/rust-lang/crates.io/issues/13482
+    "https://github.com/rust-lang/crates.io-index" = "https://static.crates.io/crates";
   }
   // extraRegistries;
 

pkgs/by-name/ac/acl2/0002-sbcl-fp-trap-fallback.patch

@@ -0,0 +1,53 @@
+diff --git a/acl2.lisp b/acl2.lisp
+index 036657d902..c2b7e4fad9 100644
+--- a/acl2.lisp
++++ b/acl2.lisp
+@@ -1963,11 +1963,7 @@ ACL2 from scratch.")
+                (* *my-most-positive-double-float*
+                   *my-most-positive-double-float*)
+                (error () 0.0d0))
+-              'double-float))
+-     #+sbcl
+-     (member :overflow
+-             (cadr (member :traps
+-                           (sb-int:get-floating-point-modes)))))
++              'double-float)))
+   (error "This Lisp is unsuitable for ACL2, because it failed ~%a check that ~
+           floating-point overflow causes an error."))
+ 
+diff --git a/float-raw.lisp b/float-raw.lisp
+index 1364491fdf..e6d0417971 100644
+--- a/float-raw.lisp
++++ b/float-raw.lisp
+@@ -46,13 +46,13 @@
+ ; #.*infinity-double* and #.*negative-infinity-double*), so we do so, but we
+ ; don't bother testing for Nan in LispWorks.
+ 
+-; We return form unchanged in other than Allegro CL and LispWorks, because we
++; We return form unchanged in other than Allegro CL, LispWorks, and SBCL, because we
+ ; already know that an error is signalled on overflow for other Lisps that host
+ ; ACL2; see break-on-overflow-and-nan.
+ 
+-  #-(or allegro lispworks)
++  #-(or allegro lispworks sbcl)
+   (declare (ignore op))
+-  #-(or allegro lispworks)
++  #-(or allegro lispworks sbcl)
+   form
+   #+allegro
+   `(let ((result ,form))
+@@ -65,6 +65,14 @@
+      (when (or (= result +1D++0) (= result -1D++0))
+        (error "Floating-point overflow for a call of ~s"
+               ',op))
++     result)
++  #+sbcl
++  `(let ((result ,form))
++     (when (or (sb-ext:float-nan-p result)
++               (= result sb-ext:double-float-positive-infinity)
++               (= result sb-ext:double-float-negative-infinity))
++       (error "Floating-point exception for a call of ~s"
++              ',op))
+      result))
+ 
+ (defmacro defun-df-binary (name op)

pkgs/by-name/ac/acl2/package.nix

@@ -62,6 +62,13 @@ stdenv.mkDerivation rec {
       libssl = "${lib.getLib openssl}/lib/libssl${stdenv.hostPlatform.extensions.sharedLibrary}";
       libcrypto = "${lib.getLib openssl}/lib/libcrypto${stdenv.hostPlatform.extensions.sharedLibrary}";
     })
+  ]
+  ++ lib.optionals (stdenv.hostPlatform.system == "aarch64-linux") [
+    # ACL2 8.6 assumes SBCL can enable floating-point traps. On
+    # aarch64-linux, SBCL can leave :TRAPS NIL after enabling them, so use
+    # ACL2's existing exceptional-float checking path instead. See:
+    # https://github.com/acl2-devel/acl2-devel/commit/0632b37adffb6b5fd71d8438d519133281f837ec
+    ./0002-sbcl-fp-trap-fallback.patch
   ];
 
   # We need the timestamps on the source tree to be stable for certification to

pkgs/by-name/ad/adguardhome/package.nix

@@ -9,15 +9,15 @@
 
 buildGoModule (finalAttrs: {
   pname = "adguardhome";
-  version = "0.107.74";
+  version = "0.107.76";
   src = fetchFromGitHub {
     owner = "AdguardTeam";
     repo = "AdGuardHome";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cAuthACY/rBVRTSv/UIarhScm+EoTUhnkQ0RUtvhAFg=";
+    hash = "sha256-CF1Ieu7oCnzvXwoHzX5126gQGcgXL+giMtUciKBZ2ZU=";
   };
 
-  vendorHash = "sha256-o4hpiqQEt8gkYFeAkxPDisvLWbi7WOBZ7xMXrPt6Cdo=";
+  vendorHash = "sha256-tHabP5I7PZtDkVucF95StRyXGEsfbuc6Z3AhQZ/g2f8=";
 
   dashboard = buildNpmPackage {
     inherit (finalAttrs) src version;
@@ -25,7 +25,7 @@ buildGoModule (finalAttrs: {
     postPatch = ''
       cd client
     '';
-    npmDepsHash = "sha256-SOHmXvGLpjs8h0X+AJ6/jAYpxzoizhwRjIzx4SqJOCo=";
+    npmDepsHash = "sha256-Yyv8dTKhZ9IlIW/x/57cl/+cpvjjycaFLSyOR0IiIPk=";
     npmBuildScript = "build-prod";
     postBuild = ''
       mkdir -p $out/build/

pkgs/by-name/ag/age-plugin-fido2prf/package.nix

@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   libfido2,
@@ -26,6 +27,24 @@ buildGoModule (finalAttrs: {
 
   buildInputs = [ libfido2 ];
 
+  postConfigure = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    chmod -R +w vendor/github.com/keys-pub/go-libfido2
+    substituteInPlace vendor/github.com/keys-pub/go-libfido2/fido2_static_arm64.go \
+      --replace-fail \
+        '/opt/homebrew/opt/libfido2/lib/libfido2.a /opt/homebrew/opt/openssl@3/lib/libcrypto.a ''${SRCDIR}/darwin/arm64/lib/libcbor.a' \
+        '-lfido2' \
+      --replace-fail \
+        '-I/opt/homebrew/opt/libfido2/include -I/opt/homebrew/opt/openssl@3/include' \
+        '-I${libfido2.dev}/include'
+    substituteInPlace vendor/github.com/keys-pub/go-libfido2/fido2_static_amd64.go \
+      --replace-fail \
+        '/usr/local/lib/libfido2.a /usr/local/opt/openssl@3/lib/libcrypto.a ''${SRCDIR}/darwin/amd64/lib/libcbor.a' \
+        '-lfido2' \
+      --replace-fail \
+        '-I/usr/local/opt/libfido2/include -I/usr/local/opt/openssl@3/include' \
+        '-I${libfido2.dev}/include'
+  '';
+
   meta = {
     description = "Age plugin to encrypt files with FIDO2 tokens in a way compatible to typage";
     homepage = "https://github.com/FiloSottile/typage/";

pkgs/by-name/ak/akkoma-admin-fe/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitea,
+  cctools,
   yarn-berry_3,
   nodejs,
   python311,
@@ -42,7 +43,10 @@ stdenv.mkDerivation (finalAttrs: {
     python311
     libsass
   ]
-  ++ lib.optional stdenv.hostPlatform.isDarwin xcbuild;
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    xcbuild
+    cctools.libtool
+  ];
 
   buildPhase = ''
     runHook preBuild

pkgs/by-name/al/alliance/package.nix

@@ -48,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   # To avoid compiler error in LoadDataBase.c:366:27
-  env.NIX_CFLAGS_COMPILE = "-Wno-incompatible-pointer-types";
+  env.NIX_CFLAGS_COMPILE = "-std=gnu99 -Wno-incompatible-pointer-types";
 
   postPatch = ''
     # texlive for docs seems extreme
@@ -77,6 +77,5 @@ stdenv.mkDerivation (finalAttrs: {
     license = with lib.licenses; gpl2Plus;
     maintainers = [ ];
     platforms = with lib.platforms; linux;
-    broken = true;
   };
 })

pkgs/by-name/ap/applgrid/TFileStringLinkDef.h

@@ -0,0 +1,6 @@
+#ifdef __CLING__
+#pragma link off all globals;
+#pragma link off all classes;
+#pragma link off all functions;
+#pragma link C++ class TFileString+;
+#endif

pkgs/by-name/ap/applgrid/TFileVectorLinkDef.h

@@ -0,0 +1,6 @@
+#ifdef __CLING__
+#pragma link off all globals;
+#pragma link off all classes;
+#pragma link off all functions;
+#pragma link C++ class TFileVector+;
+#endif

pkgs/by-name/ap/applgrid/no-m64.patch

@@ -0,0 +1,10 @@
+--- a/configure
++++ b/configure
+@@ -16130,7 +16130,6 @@
+ $as_echo "$as_me: WARNING: ****************************************************************" >&2;}
+ fi
+ 
+-( echo $CXXFLAGS | grep -q "m64" ) || CXXFLAGS+=" -m64 "
+ 
+ 
+ 

pkgs/by-name/ap/applgrid/package.nix

@@ -18,7 +18,26 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-h+ZNGj33FIwg4fOCyfGJrUKM2vDDQl76JcLhtboAOtc=";
   };
 
+  patches = [
+    # Upstream's configure unconditionally injects `-m64` into CXXFLAGS, which is
+    # invalid on aarch64 (and redundant on x86_64). The line was added in r1946
+    # for applgrid 1.6.17 with the commit message "add default m64 compilation".
+    # There is no public bug tracker upstream, and the line is still present in
+    # trunk. We patch only the generated `configure` (not `configure.ac`) so
+    # that make doesn't try to re-run autotools during the build.
+    ./no-m64.patch
+
+    # ROOT 6.40 made rootcling fail when no selection rules are provided
+    # (https://root.cern/doc/v640/release-notes.html#core-libraries). The patch
+    # appends $*LinkDef.h to the dictionary pattern rule so rootcint picks up
+    # the LinkDef.h files we drop into src/ in postPatch.
+    ./rootcling-linkdef.patch
+  ];
+
   postPatch = ''
+    cp ${./TFileStringLinkDef.h} src/TFileStringLinkDef.h
+    cp ${./TFileVectorLinkDef.h} src/TFileVectorLinkDef.h
+
     sed -i appl_grid/serialise_base.h -e '1i#include <cstdint>'
   '';
 

pkgs/by-name/ap/applgrid/rootcling-linkdef.patch

@@ -0,0 +1,11 @@
+--- a/src/Makefile.in
++++ b/src/Makefile.in
+@@ -1027,7 +1027,7 @@
+ 	$(CC) $(AM_CFLAGS) -c $<
+ 
+ @USE_ROOT_TRUE@%Dict.cxx : %.h %.cxx
+-@USE_ROOT_TRUE@	$(CINT) -f $@ -c $< -I.. 
++@USE_ROOT_TRUE@	$(CINT) -f $@ -c $< -I.. $*LinkDef.h
+ 
+ #../appl_grid/$*LinkDef.h
+ 

pkgs/by-name/au/auctex/package.nix

@@ -7,50 +7,43 @@
   ghostscript,
 }:
 
-let
-  auctex = stdenv.mkDerivation rec {
-    # Make this a valid tex(live-new) package;
-    # the pkgs attribute is provided with a hack below.
-    pname = "auctex";
-    version = "13.2";
-    tlType = "run";
+stdenv.mkDerivation rec {
+  pname = "auctex";
+  version = "13.2";
 
-    outputs = [
-      "out"
-      "tex"
-    ];
+  outputs = [
+    "out"
+    "tex"
+  ];
 
-    src = fetchurl {
-      url = "mirror://gnu/auctex/auctex-${version}.tar.gz";
-      hash = "sha256-Hn5AKrz4RmlOuncZklvwlcI+8zpeZgIgHHS2ymCUQDU=";
-    };
-
-    buildInputs = [
-      emacs
-      ghostscript
-      (texliveBasic.withPackages (ps: [
-        ps.etoolbox
-        ps.hypdoc
-      ]))
-    ];
-
-    preConfigure = ''
-      mkdir -p "$tex"
-      export HOME=$(mktemp -d)
-    '';
-
-    configureFlags = [
-      "--with-lispdir=\${out}/share/emacs/site-lisp"
-      "--with-texmf-dir=\${tex}"
-    ];
-
-    meta = {
-      homepage = "https://www.gnu.org/software/auctex";
-      description = "Extensible package for writing and formatting TeX files in GNU Emacs and XEmacs";
-      license = lib.licenses.gpl3Plus;
-      platforms = lib.platforms.unix;
-    };
+  src = fetchurl {
+    url = "mirror://gnu/auctex/auctex-${version}.tar.gz";
+    hash = "sha256-Hn5AKrz4RmlOuncZklvwlcI+8zpeZgIgHHS2ymCUQDU=";
   };
 
-in
-auctex // { pkgs = [ auctex.tex ]; }
+  buildInputs = [
+    emacs
+    ghostscript
+    (texliveBasic.withPackages (ps: [
+      ps.etoolbox
+      ps.hypdoc
+    ]))
+  ];
+
+  preConfigure = ''
+    mkdir -p "$tex"
+    export HOME=$(mktemp -d)
+  '';
+
+  configureFlags = [
+    "--with-lispdir=\${out}/share/emacs/site-lisp"
+    "--with-texmf-dir=\${tex}"
+  ];
+
+  meta = {
+    homepage = "https://www.gnu.org/software/auctex";
+    description = "Extensible package for writing and formatting TeX files in GNU Emacs and XEmacs";
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.unix;
+  };
+}

pkgs/by-name/au/authelia/package.nix

@@ -4,9 +4,9 @@
   nodejs,
   fetchPnpmDeps,
   pnpmConfigHook,
-  pnpm_10,
+  pnpm_11,
   fetchFromGitHub,
-  buildGo125Module,
+  buildGo126Module,
   installShellFiles,
   callPackage,
   nixosTests,
@@ -15,16 +15,16 @@
       nodejs
       fetchPnpmDeps
       pnpmConfigHook
-      pnpm_10
+      pnpm_11
       fetchFromGitHub
       ;
   },
 }:
 
 let
-  pnpm = pnpm_10;
+  pnpm = pnpm_11;
 
-  buildGoModule = buildGo125Module;
+  buildGoModule = buildGo126Module;
 
   inherit (import ./sources.nix { inherit fetchFromGitHub; })
     pname
@@ -66,11 +66,6 @@ buildGoModule (finalAttrs: {
       "-X ${p}.BuildExtra=nixpkgs"
     ];
 
-  # It is required to set this to avoid a change in the
-  # handling of sync map in go 1.24+
-  # Upstream issue: https://github.com/authelia/authelia/issues/8980
-  env.GOEXPERIMENT = "nosynchashtriemap";
-
   # several tests with networking and several that want chromium
   doCheck = false;
 

pkgs/by-name/au/authelia/sources.nix

@@ -1,14 +1,14 @@
 { fetchFromGitHub }:
 rec {
   pname = "authelia";
-  version = "4.39.19";
+  version = "4.39.20";
 
   src = fetchFromGitHub {
     owner = "authelia";
     repo = "authelia";
     rev = "v${version}";
-    hash = "sha256-wMOurdgdjykFekn0Pej3meM6WSzq9tJ+kZV9sVDvRwM=";
+    hash = "sha256-JjpfNQsqtmSKXj14fQUJsiTgfkAlSHDfqUC/x+bE+fc=";
   };
-  vendorHash = "sha256-ZDsLRMip2B8PPZu8VxW+91FVvwC2rXzohhAZFifT26g=";
-  pnpmDepsHash = "sha256-HMrC5V+Ak2dF1uPtbh8kgFc8kZI2FPMmZHJciWRYx9w=";
+  vendorHash = "sha256-dZjsYqw/ABEn1y6tZgSjbmqamO4U20Ljj/dQMFruVjU=";
+  pnpmDepsHash = "sha256-syfPg62JrTh496xi39xW/CnIwpJYo+iU5sCPP3bD2Ys=";
 }

pkgs/by-name/au/authelia/web.nix

@@ -3,12 +3,12 @@
   nodejs,
   fetchPnpmDeps,
   pnpmConfigHook,
-  pnpm_10,
+  pnpm_11,
   fetchFromGitHub,
 }:
 
 let
-  pnpm = pnpm_10;
+  pnpm = pnpm_11;
 
   inherit (import ./sources.nix { inherit fetchFromGitHub; })
     pname

pkgs/by-name/au/authentik/package.nix

@@ -20,13 +20,13 @@
 let
   nodejs = nodejs_24;
 
-  version = "2025.12.4";
+  version = "2025.12.5";
 
   src = fetchFromGitHub {
     owner = "goauthentik";
     repo = "authentik";
     tag = "version/${version}";
-    hash = "sha256-alTyrMBbjZbw4jhEna8saabf93sqSrZCu+Z5xH3pZ7M=";
+    hash = "sha256-LPGAhbtmuztDQ4CVhUXb+vBU5HjvNZ7JicI5r3lr1QQ=";
   };
 
   meta = {
@@ -52,7 +52,7 @@ let
     src = fetchFromGitHub {
       owner = "goauthentik";
       repo = "client-go";
-      tag = "v3.${version}";
+      tag = "v3.2025.12.4";
       hash = "sha256-+/CfOE2HkBU+ZddvdXGenB/z8xNFk8cujpZpMXyh3cY=";
     };
 
@@ -137,8 +137,8 @@ let
 
     outputHash =
       {
-        "aarch64-linux" = "sha256-GL5FPIBnoEXYtw8DPJpRPe3tT3qioN4AdoeOmCoiYsM=";
-        "x86_64-linux" = "sha256-AnceTipq6uUvTbOAZanVshAbAJ9LS1kwImbttTOcWxc=";
+        "aarch64-linux" = "sha256-smm9x29z7gOI7Wq0NvP45KHtBbT6p1lH6IjEf9LRuGs=";
+        "x86_64-linux" = "sha256-K86wnn50svP+QG3i0mggH8RQgfoIqEmyQTouz35xzw8=";
       }
       .${stdenvNoCC.hostPlatform.system} or (throw "authentik-website-deps: unsupported host platform");
 
@@ -208,8 +208,8 @@ let
 
     outputHash =
       {
-        "aarch64-linux" = "sha256-eZZ5Ynj81KwFsU5emPtYZ2CxO8MFvWbJnCHs+L88KQQ=";
-        "x86_64-linux" = "sha256-yUAyyO1NFav1EptrRYGSzC8dxCxYVj0FmzHk8IckFZM=";
+        "aarch64-linux" = "sha256-J9wGQe7iMfKznNk3woqi0VNVNA/dE6TGi2f44DOlG1c=";
+        "x86_64-linux" = "sha256-9Q590Rw0mk3q5osxOKGWU7+XtKwkTyA+CLC2LxAA/3g=";
       }
       .${stdenvNoCC.hostPlatform.system} or (throw "authentik-webui-deps: unsupported host platform");
     outputHashMode = "recursive";

pkgs/by-name/au/auto-multiple-choice/package.nix

@@ -145,11 +145,6 @@ stdenv.mkDerivation (finalAttrs: {
     perlWithPackages
   ];
 
-  passthru = {
-    tlType = "run";
-    pkgs = [ finalAttrs.finalPackage ];
-  };
-
   meta = {
     description = "Create and manage multiple choice questionnaires with automated marking";
     mainProgram = "auto-multiple-choice";

pkgs/by-name/ba/bambu-studio/package.nix

@@ -192,7 +192,15 @@ stdenv.mkDerivation (finalAttrs: {
     description = "PC Software for BambuLab's 3D printers";
     homepage = "https://github.com/bambulab/BambuStudio";
     changelog = "https://github.com/bambulab/BambuStudio/releases/tag/v${finalAttrs.version}";
-    license = lib.licenses.agpl3Plus;
+    license = with lib.licenses; [
+      agpl3Plus
+      # Bambu Studio downloads and dlopens a proprietary networking library
+      # at first launch whose corresponding source is not provided. SFC ruled
+      # this an ongoing AGPLv3 violation; see:
+      # https://github.com/NixOS/nixpkgs/issues/415821
+      # https://sfconservancy.org/news/2026/may/18/bambu-studio-3d-printer-agpl-violation-response/
+      unfree
+    ];
     maintainers = with lib.maintainers; [
       zhaofengli
       dsluijk

pkgs/by-name/bi/bird2/package.nix

@@ -12,14 +12,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bird";
-  version = "2.18.1";
+  version = "2.19.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.nic.cz";
     owner = "labs";
     repo = "bird";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tYICTipTzugtb7kv/zwsChM8v+zJ2TVsotEkJDcZCto=";
+    hash = "sha256-xk3z5kkjnInmIwtE6Q7kCJ5P5Njt/Oz1+HPO0vcr93E=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/bi/bird3/package.nix

@@ -12,14 +12,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bird";
-  version = "3.2.1";
+  version = "3.3.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.nic.cz";
     owner = "labs";
     repo = "bird";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-FkrVrjT4Q9zLeauP2GOX38a7a4q7h2aQbEe/kmfKB3A=";
+    hash = "sha256-mH9CM9Emie2B9c5PeW4DKUQUzvgxTExPBGG06YbWqGo=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/bl/blahtexml/package.nix

@@ -3,7 +3,8 @@
   lib,
   stdenv,
   libiconv,
-  texliveFull,
+  libxslt,
+  texliveBasic,
   xercesc,
 }:
 
@@ -21,13 +22,13 @@ stdenv.mkDerivation (finalAttrs: {
   postPatch =
     lib.optionalString stdenv.cc.isClang ''
       substituteInPlace makefile \
-        --replace "\$(CXX)" "\$(CXX) -std=c++98"
+        --replace-fail "\$(CXX)" "\$(CXX) -std=c++98"
     ''
     +
     # fix the doc build on TeX Live 2023
     ''
       substituteInPlace Documentation/manual.tex \
-        --replace '\usepackage[utf8x]{inputenc}' '\usepackage[utf8]{inputenc}'
+        --replace-fail '\usepackage[utf8x]{inputenc}' '\usepackage[utf8]{inputenc}'
     '';
 
   outputs = [
@@ -35,7 +36,13 @@ stdenv.mkDerivation (finalAttrs: {
     "doc"
   ];
 
-  nativeBuildInputs = [ texliveFull ]; # scheme-full needed for ucs package
+  nativeBuildInputs = [
+    libxslt
+    (texliveBasic.withPackages (ps: [
+      ps.cm-super
+      ps.ucs
+    ]))
+  ];
   buildInputs = [ xercesc ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ libiconv ];
 
   buildFlags = [

pkgs/by-name/br/brainflow/package.nix

@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "brainflow";
-  version = "5.22.1";
+  version = "5.22.2";
 
   src = fetchFromGitHub {
     owner = "brainflow-dev";
     repo = "brainflow";
     tag = finalAttrs.version;
-    hash = "sha256-z2EoWjQfDY8eSP+YMZtY9Um7iwoGTi+9ZGJOEZozPoo=";
+    hash = "sha256-TOBttlEl7fPiGH+cGEuxozT4S1Jr/X6mKMiMtNU0NXA=";
   };
 
   patches = [ ];

pkgs/by-name/bu/buf/package.nix

@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "buf";
-  version = "1.69.0";
+  version = "1.70.0";
 
   src = fetchFromGitHub {
     owner = "bufbuild";
     repo = "buf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-x8Dj4xl67Jq0ViWu+Tz+3lAnfIpE926dIr+oe4ul0gI=";
+    hash = "sha256-C06/5a4icjgI35ADQKvlZ6JmCCyW/9e0aF9VIpLCqn0=";
   };
 
-  vendorHash = "sha256-zhXpWpYd/bim5f4EQJujVm072LPgBusjCFGYAwK10HE=";
+  vendorHash = "sha256-Vveg7rBno66IPinVs9RJtzVJdtAJE55QZfWA3WIXGDQ=";
 
   patches = [
     # Skip a test that requires networking to be available to work.

pkgs/by-name/ca/caprine/package.nix

@@ -27,14 +27,15 @@ buildNpmPackage rec {
   nativeBuildInputs = [ copyDesktopItems ];
 
   postBuild = ''
-    cp -r ${electron.dist} electron-dist
-    chmod -R u+w electron-dist
+    electron_dist="$(mktemp -d)"
+    cp -r ${electron.dist}/. "$electron_dist"
+    chmod -R u+w "$electron_dist"
 
     npm exec electron-builder -- \
         --dir \
         -c.npmRebuild=true \
         -c.asarUnpack="**/*.node" \
-        -c.electronDist=electron-dist \
+        -c.electronDist="$electron_dist" \
         -c.electronVersion=${electron.version}
   '';
 

pkgs/by-name/ca/cargo-codspeed/package.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-codspeed";
-  version = "4.6.0";
+  version = "4.7.0";
 
   src = fetchFromGitHub {
     owner = "CodSpeedHQ";
     repo = "codspeed-rust";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Hfqh9kKTiRTWhKbsdXAK/DqBeAKxXQaYdWoZN55lcLo=";
+    hash = "sha256-6XSKAPLcxgnshkMuiSmw13tsE4keJ9h5DpxwidqMLbg=";
   };
 
-  cargoHash = "sha256-ix8Q+GbazKC5HIIUUVYjLTlufOQLxppqmVGznbTAXEI=";
+  cargoHash = "sha256-1AjODDI114CL/L8ZDFWDfPwxxxY9vgT/miSVsMLLSgE=";
 
   nativeBuildInputs = [
     curl

pkgs/by-name/cc/cccc/cccc.patch

@@ -1,24 +0,0 @@
-diff --git a/cccc/cccc_tbl.cc b/cccc/cccc_tbl.cc
-index df98e2b..59f2572 100644
---- a/cccc/cccc_tbl.cc
-+++ b/cccc/cccc_tbl.cc
-@@ -96,7 +96,7 @@ bool CCCC_Table<T>::remove(T* old_item_ptr)
-   typename map_t::iterator value_iterator=map_t::find(old_item_ptr->key());
-   if(value_iterator!=map_t::end())
-     {
--      erase(value_iterator);
-+      map_t::erase(value_iterator);
-       retval=true;
-     }
-   return retval;
-diff --git a/makefile b/makefile
-index 23ad004..2cca469 100644
---- a/makefile
-+++ b/makefile
-@@ -20,5 +20,5 @@ test :
- 	cd test ; make -f posix.mak
- 
- install : 
--	cd install ; su root -c "make -f install.mak" 
-+	cd install ; make -f install.mak
- 

pkgs/by-name/cc/cccc/package.nix

@@ -1,31 +1,38 @@
 {
   lib,
   stdenv,
-  fetchurl,
+  fetchFromGitHub,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "cccc";
-  version = "3.1.4";
+  version = "3.2.0";
 
-  src = fetchurl {
-    url = "mirror://sourceforge/cccc/${version}/cccc-${version}.tar.gz";
-    sha256 = "1gsdzzisrk95kajs3gfxks3bjvfd9g680fin6a9pjrism2lyrcr7";
+  src = fetchFromGitHub {
+    owner = "sarnold";
+    repo = "cccc";
+    tag = finalAttrs.version;
+    sha256 = "sha256-5UgCz9zURD+LsMB3kLSdkS1zFOTCuU16hK253GFu9HU";
   };
 
   hardeningDisable = [ "format" ];
 
-  patches = [ ./cccc.patch ];
-
-  preConfigure = ''
-    substituteInPlace install/install.mak --replace /usr/local/bin $out/bin
-    substituteInPlace install/install.mak --replace MKDIR=mkdir "MKDIR=mkdir -p"
-  '';
   buildFlags = [
     "CCC=c++"
     "LD=c++"
   ];
 
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp cccc/cccc $out/bin/
+
+    runHook postInstall
+  '';
+
+  env.NIX_CFLAGS_COMPILE = "-Wno-register " + lib.optionalString stdenv.cc.isGNU "-std=gnu17";
+
   meta = {
     description = "C and C++ Code Counter";
     mainProgram = "cccc";
@@ -34,13 +41,9 @@ stdenv.mkDerivation rec {
       on various metrics of the code. Metrics supported include lines of code, McCabe's
       complexity and metrics proposed by Chidamber&Kemerer and Henry&Kafura.
     '';
-    homepage = "https://cccc.sourceforge.net/";
+    homepage = "https://github.com/sarnold/cccc";
     license = lib.licenses.gpl2;
     platforms = lib.platforms.unix;
-    maintainers = [ ];
-    # The last successful Darwin Hydra build was in 2023
-    # On linux fails to build on gcc-15, needs porting to c23, but
-    # the upstream code did not update since 2006.
-    broken = true;
+    maintainers = with lib.maintainers; [ tbutter ];
   };
-}
+})

pkgs/by-name/ch/chhoto-url/package.nix

@@ -8,13 +8,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "chhoto-url";
-  version = "7.0.4";
+  version = "7.1.5";
 
   src = fetchFromGitHub {
     owner = "SinTan1729";
     repo = "chhoto-url";
     tag = finalAttrs.version;
-    hash = "sha256-ntI2jWV1kS8ojbkhLaZhxkjK5ZNYOp9MIbzHpnCyEu0=";
+    hash = "sha256-TREBriuK7k3ZBDkdQ5gGdptWCG/5UOdhoWcOj1Ppd/8=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/actix";
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail "./resources/" "${placeholder "out"}/share/chhoto-url/resources/"
   '';
 
-  cargoHash = "sha256-tkPMlJqkQzFYItPPYW5kqLiymlNZPkwj0j/2Zj4Ysc8=";
+  cargoHash = "sha256-S+fWxhPRB+JZPjWQkww9VYtYfc9vnXCZgUZTu+ND1So=";
 
   postInstall = ''
     mkdir -p $out/share/chhoto-url

pkgs/by-name/cl/clorinde/package.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "clorinde";
-  version = "1.4.1";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "halcyonnouveau";
     repo = "clorinde";
     tag = "clorinde-v${finalAttrs.version}";
-    hash = "sha256-eqLY3iOunTdTZn7lfM8lLYk2e6EI1jW81BnRg/NaGuY=";
+    hash = "sha256-eWgFcyr9shcgUU4DlXl6SThbbRTMuvYOjY6hA4CCnQo=";
   };
 
-  cargoHash = "sha256-OacfUdCtRyewr8OZFBh6NphccDwQ6diWA5JqPhtMi54=";
+  cargoHash = "sha256-p/ZqG1syI6ujgNbNnSSwUz7XpvHK7ua2zH0p3P3Ngec=";
 
   cargoBuildFlags = [ "--package=clorinde" ];
 

pkgs/by-name/co/corkscrew/package.nix

@@ -17,6 +17,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [ autoreconfHook ];
 
+  env.NIX_CFLAGS_COMPILE = "-DANSI_FUNC";
+
   meta = {
     homepage = "https://github.com/bryanpkc/corkscrew";
     description = "Tool for tunneling SSH through HTTP proxies";

pkgs/by-name/cu/cura/package.nix

@@ -1,93 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  cmake,
-  python3,
-  libsForQt5,
-  curaengine,
-  plugins ? [ ],
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "cura";
-  version = "4.13.1";
-
-  src = fetchFromGitHub {
-    owner = "Ultimaker";
-    repo = "Cura";
-    rev = finalAttrs.version;
-    sha256 = "sha256-R88SdAxx3tkQCDInrFTKad1tPSDTSYaVAPUVmdk94Xk=";
-  };
-
-  materials = fetchFromGitHub {
-    owner = "Ultimaker";
-    repo = "fdm_materials";
-    rev = "4.13.2";
-    sha256 = "sha256-7y4OcbeQHv+loJ4cMgPU0e818Zsv90EwARdztNWS8zM=";
-  };
-
-  buildInputs = [
-    libsForQt5.qtbase
-    libsForQt5.qtquickcontrols2
-    libsForQt5.qtgraphicaleffects
-  ];
-  propagatedBuildInputs =
-    with python3.pkgs;
-    [
-      libsavitar
-      numpy-stl
-      pyserial
-      requests
-      uranium
-      zeroconf
-      pynest2d
-      sentry-sdk
-      trimesh
-      keyring
-    ]
-    ++ plugins;
-  nativeBuildInputs = [
-    cmake
-    python3.pkgs.wrapPython
-    libsForQt5.wrapQtAppsHook
-  ];
-
-  cmakeFlags = [
-    "-DURANIUM_DIR=${python3.pkgs.uranium.src}"
-    "-DCURA_VERSION=${finalAttrs.version}"
-  ];
-
-  makeWrapperArgs = [
-    # hacky workaround for https://github.com/NixOS/nixpkgs/issues/59901
-    "--set OMP_NUM_THREADS 1"
-  ];
-
-  postPatch = ''
-    sed -i 's,/python''${PYTHON_VERSION_MAJOR}/dist-packages,/python''${PYTHON_VERSION_MAJOR}.''${PYTHON_VERSION_MINOR}/site-packages,g' CMakeLists.txt
-    sed -i 's, executable_name = .*, executable_name = "${curaengine}/bin/CuraEngine",' plugins/CuraEngineBackend/CuraEngineBackend.py
-  '';
-
-  postInstall = ''
-    mkdir -p $out/share/cura/resources/materials
-    cp ${finalAttrs.materials}/*.fdm_material $out/share/cura/resources/materials/
-    mkdir -p $out/lib/cura/plugins
-    for plugin in ${toString plugins}; do
-      ln -s $plugin/lib/cura/plugins/* $out/lib/cura/plugins
-    done
-  '';
-
-  postFixup = ''
-    wrapPythonPrograms
-    wrapQtApp $out/bin/cura
-  '';
-
-  meta = {
-    description = "3D printer / slicing GUI built on top of the Uranium framework";
-    mainProgram = "cura";
-    homepage = "https://github.com/Ultimaker/Cura";
-    license = lib.licenses.lgpl3Plus;
-    platforms = lib.platforms.linux;
-    maintainers = [ ];
-  };
-})

pkgs/by-name/cv/cvc5/package.nix

@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cvc5";
-  version = "1.3.3";
+  version = "1.3.4";
 
   src = fetchFromGitHub {
     owner = "cvc5";
     repo = "cvc5";
     tag = "cvc5-${finalAttrs.version}";
-    hash = "sha256-tXhOMrf/sZwEZFWB2Amp9lApWEsfuPqaj9H7RmI733o=";
+    hash = "sha256-PZcOArSTyJzyd2DKT8K0aFC4RlVXgTCnkoU0f08KPfY=";
   };
 
   __structuredAttrs = true;

pkgs/by-name/dd/ddcutil/package.nix

@@ -12,15 +12,17 @@
   libdrm,
   libxrandr,
   libxext,
+  acl,
+  dbus,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ddcutil";
-  version = "2.2.6";
+  version = "2.2.7";
 
   src = fetchurl {
     url = "https://www.ddcutil.com/tarballs/ddcutil-${finalAttrs.version}.tar.gz";
-    hash = "sha256-5LaRkcC0UK6iOjSlks88WPAn/hRiAgF5BwzJLV7K7Yg=";
+    hash = "sha256-GaxmBM8Rd7pWZm+KaCWB5x6Jc70Gx8jc8DNnTkqqpkg=";
   };
 
   nativeBuildInputs = [
@@ -29,14 +31,16 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
+    acl
+    dbus
     glib
     jansson
     libdrm
     libgudev
     libusb1
-    udev
     libxext
     libxrandr
+    udev
   ];
 
   enableParallelBuilding = true;

pkgs/by-name/dr/dropbear/package.nix

@@ -20,11 +20,11 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dropbear";
-  version = "2025.89";
+  version = "2026.91";
 
   src = fetchurl {
     url = "https://matt.ucc.asn.au/dropbear/releases/dropbear-${finalAttrs.version}.tar.bz2";
-    sha256 = "sha256-DR98pxHPwzbcioXmcsq5z9giOgL+LaCkp661jJ4RNjQ=";
+    sha256 = "sha256-3vqSRHWr9rwedKvAAXPka/3IBL1Hyq+hT1pO8Mx22jQ=";
   };
 
   env.CFLAGS = lib.pipe (lib.attrNames dflags) [

pkgs/by-name/ea/easyeffects/package.nix

@@ -61,13 +61,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "easyeffects";
-  version = "8.2.2";
+  version = "8.2.4";
 
   src = fetchFromGitHub {
     owner = "wwmm";
     repo = "easyeffects";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rdg7XvrJU7HH9aGd/TwMqqexmFeLOMBldh1XQakQSeM=";
+    hash = "sha256-hhQVfUXjobQmrSYFquxbkIuCdBYaExAtjtwbyVqyVUg=";
   };
 
   nativeBuildInputs = [
@@ -114,8 +114,10 @@ stdenv.mkDerivation (finalAttrs: {
     speexdsp'
     onetbb
     webrtc-audio-processing
-    x42-plugins
     zita-convolver
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isx86 [
+    x42-plugins
   ];
 
   preFixup =
@@ -124,8 +126,10 @@ stdenv.mkDerivation (finalAttrs: {
         calf # compressor exciter, bass enhancer and others
         lsp-plugins # delay, limiter, multiband compressor
         mda_lv2 # loudness
-        x42-plugins # autotune
         zam-plugins # maximizer
+      ]
+      ++ lib.optionals stdenv.hostPlatform.isx86 [
+        x42-plugins # autotune
       ];
 
       ladspaPlugins = [

pkgs/by-name/es/esphome/package.nix

@@ -33,14 +33,14 @@ let
 in
 python.pkgs.buildPythonApplication (finalAttrs: {
   pname = "esphome";
-  version = "2026.5.0";
+  version = "2026.5.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "esphome";
     repo = "esphome";
     tag = finalAttrs.version;
-    hash = "sha256-oWlzpBzDOSrXv+gOnFSL7TQqDZJc3oN2RoAW2ywFCGo=";
+    hash = "sha256-faW44FhAymqGQG4khAUEcv6QoAn49KPSghi3YcXttNk=";
   };
 
   patches = [

pkgs/by-name/eu/eukleides/package.nix

@@ -9,7 +9,6 @@
   getopt,
   readline,
   texinfo,
-  texlive,
   versionCheckHook,
 }:
 
@@ -91,17 +90,13 @@ stdenv.mkDerivation (finalAttrs: {
     "tex"
   ];
 
-  passthru = {
-    tlType = "run";
-    # packages needed by euktoeps, euktopdf and eukleides.sty
-    tlDeps = with texlive; [
-      collection-pstricks
-      epstopdf
-      iftex
-      moreverb
-    ];
-    pkgs = [ finalAttrs.finalPackage.tex ];
-  };
+  # packages needed by euktoeps, euktopdf and eukleides.sty
+  passthru.tlDeps = ps: [
+    ps.collection-pstricks
+    ps.epstopdf
+    ps.iftex
+    ps.moreverb
+  ];
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];

pkgs/by-name/ev/evcc/package.nix

@@ -17,16 +17,16 @@
 }:
 
 let
-  version = "0.307.0";
+  version = "0.307.1";
 
   src = fetchFromGitHub {
     owner = "evcc-io";
     repo = "evcc";
     tag = version;
-    hash = "sha256-G6+8cJF+So9kePDpNlFGuvsTU5+KXg9dlgaMnElWwL8=";
+    hash = "sha256-ED+mRcnkerdPFjEhxH3fBr8GcH0geLVnjnejpNqNBdI=";
   };
 
-  vendorHash = "sha256-ie5wCRgGj8DeotYD/GrDP9qTnonTJsMqj1fBqHNR84M=";
+  vendorHash = "sha256-sOyx1Ev0UfoI6mOQAWide19Sg/MWJ8VUVftN9psNq5U=";
 
   commonMeta = {
     license = lib.licenses.mit;
@@ -40,7 +40,7 @@ buildGo126Module rec {
 
   npmDeps = fetchNpmDeps {
     inherit src;
-    hash = "sha256-CtZoPtpENUfaVvs2zozBWsMYD8ZJFAXig7sYcNNLwzY=";
+    hash = "sha256-U7gcAkfw7a0skM91mSAZJIPUPBRfSkyJYVjjVyEyZ4E=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/fa/fastnetmon-advanced/package.nix

@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "fastnetmon-advanced";
-  version = "2.0.372";
+  version = "2.0.380";
 
   src = fetchurl {
-    url = "https://repo.fastnetmon.com/fastnetmon_ubuntu_jammy/pool/fastnetmon/f/fastnetmon/fastnetmon_${version}_amd64.deb";
-    hash = "sha256-FwYAbTBkk+AciDVxTIimswsB0M3gbzKX+03PD0fLMsY=";
+    url = "https://repo.fastnetmon.com/fastnetmon_ubuntu_noble/pool/fastnetmon/f/fastnetmon/fastnetmon_${version}_amd64.deb";
+    hash = "sha256-4hCrDaFat0kEbyzKg6nHdV+LlqCBYYJEojyvXyPYKD0=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/fa/fauna-shell/package-lock-fix.patch

@@ -1,154 +0,0 @@
-diff --git i/package-lock.json w/package-lock.json
-index 07428d0..4901a94 100644
---- i/package-lock.json
-+++ w/package-lock.json
-@@ -3 +3 @@
--  "version": "4.0.0-beta",
-+  "version": "4.0.0",
-@@ -9 +9 @@
--      "version": "4.0.0-beta",
-+      "version": "4.0.0",
-@@ -131,0 +132,2 @@
-+      "resolved": "https://registry.npmjs.org/@eslint-community/eslint-utils/-/eslint-utils-4.4.0.tgz",
-+      "integrity": "sha512-1/sA4dwrzBAyeUoQ6oxahHKmrZvsnLCg4RfxW3ZFGGmQkSNQPFNLV9CUEFQP1x9EYXHTo5p6xdhZM1Ne9p/AfA==",
-@@ -144,0 +147,2 @@
-+      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-3.4.3.tgz",
-+      "integrity": "sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag==",
-@@ -154,0 +159,2 @@
-+      "resolved": "https://registry.npmjs.org/@eslint-community/regexpp/-/regexpp-4.11.1.tgz",
-+      "integrity": "sha512-m4DVN9ZqskZoLU5GlWZadwDnYo3vAEydiUayB9widCl9ffWx2IvPnp6n3on5rJmziJSw9Bv+Z3ChDVdMwXCY8Q==",
-@@ -161,0 +168,2 @@
-+      "resolved": "https://registry.npmjs.org/@eslint/config-array/-/config-array-0.18.0.tgz",
-+      "integrity": "sha512-fTxvnS1sRMu3+JjXwJG0j/i4RT9u4qJ+lqS/yCGap4lH4zZGzQ7tu+xZqQmcMZq5OBZDL4QRxQzRjkWcGt8IVw==",
-@@ -173,0 +182,2 @@
-+      "resolved": "https://registry.npmjs.org/@eslint/core/-/core-0.6.0.tgz",
-+      "integrity": "sha512-8I2Q8ykA4J0x0o7cg67FPVnehcqWTBehu/lmY+bolPFHGjh49YzGBMXTvpqVgEbBdvNCSxj6iFgiIyHzf03lzg==",
-@@ -180,0 +191,2 @@
-+      "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-3.1.0.tgz",
-+      "integrity": "sha512-4Bfj15dVJdoy3RfZmmo86RK1Fwzn6SstsvK9JS+BaVKqC6QQQQyXekNaC+g+LKNgkQ+2VhGAzm6hO40AhMR3zQ==",
-@@ -223,0 +236,2 @@
-+      "resolved": "https://registry.npmjs.org/@eslint/object-schema/-/object-schema-2.1.4.tgz",
-+      "integrity": "sha512-BsWiH1yFGjXXS2yvrf5LyuoSIIbPrGUWob917o+BTKuZ7qJdxX8aJLRxs1fS9n6r7vESrq1OUqb68dANcFXuQQ==",
-@@ -260,0 +275,2 @@
-+      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.0.tgz",
-+      "integrity": "sha512-2cbWIHbZVEweE853g8jymffCA+NCMiuqeECeBBLm8dg2oFdjuGJhgN4UAbI+6v0CKbbhvtXA4qV8YR5Ji86nmw==",
-@@ -267,0 +284,2 @@
-+      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.5.tgz",
-+      "integrity": "sha512-KSPA4umqSG4LHYRodq31VDwKAvaTF4xmVlzM8Aeh4PlU1JQ3IG0wiA8C25d3RQ9nJyM3mBHyI53K06VVL/oFFg==",
-@@ -304,0 +323,2 @@
-+      "resolved": "https://registry.npmjs.org/@inquirer/checkbox/-/checkbox-4.0.0.tgz",
-+      "integrity": "sha512-TNd+u1fAG8vf8YMgXzK2BI0u0xsphFv//T5rpF1eZ+8AAXby5Ll1qptr4/XVS45dvWDIzuBmmWIpVJRvnaNqzQ==",
-@@ -318,0 +339,2 @@
-+      "resolved": "https://registry.npmjs.org/@inquirer/confirm/-/confirm-5.0.0.tgz",
-+      "integrity": "sha512-6QEzj6bZg8atviRIL+pR0tODC854cYSjvZxkyCarr8DVaOJPEyuGys7GmEG3W0Rb8kKSQec7P6okt0sJvNneFw==",
-@@ -329,0 +352,2 @@
-+      "resolved": "https://registry.npmjs.org/@inquirer/core/-/core-10.0.0.tgz",
-+      "integrity": "sha512-7dwoKCGvgZGHWTZfOj2KLmbIAIdiXP9NTrwGaTO/XDfKMEmyBahZpnombiG6JDHmiOrmK3GLEJRXrWExXCDLmQ==",
-@@ -373,0 +398,2 @@
-+      "resolved": "https://registry.npmjs.org/@inquirer/editor/-/editor-4.0.0.tgz",
-+      "integrity": "sha512-bhHAP7hIOxUjiTZrpjyAYD+2RFRa+PNutWeW7JdDPcWWG3GVRiFsu3pBGw9kN2PktoiilDWFGSR0dwXBzGQang==",
-@@ -385,0 +412,2 @@
-+      "resolved": "https://registry.npmjs.org/@inquirer/expand/-/expand-4.0.0.tgz",
-+      "integrity": "sha512-mR7JHNIvCB4o12f75KN42he7s1O9tmcSN4wJ6l04oymfXKLn+lYJFI7z9lbe4/Ald6fm8nuF38fuY5hNPl3B+A==",
-@@ -397,0 +426,2 @@
-+      "resolved": "https://registry.npmjs.org/@inquirer/figures/-/figures-1.0.7.tgz",
-+      "integrity": "sha512-m+Trk77mp54Zma6xLkLuY+mvanPxlE4A7yNKs2HBiyZ4UkVs28Mv5c/pgWrHeInx+USHeX/WEPzjrWrcJiQgjw==",
-@@ -404,0 +435,2 @@
-+      "resolved": "https://registry.npmjs.org/@inquirer/input/-/input-4.0.0.tgz",
-+      "integrity": "sha512-LD7MNzaX+q2OpU4Fn0i/SedhnnBCAnEzRr6L0MP6ohofFFlx9kp5EXX7flbRZlUnh8icOwC3NFmXTyP76hvo0g==",
-@@ -415,0 +448,2 @@
-+      "resolved": "https://registry.npmjs.org/@inquirer/number/-/number-3.0.0.tgz",
-+      "integrity": "sha512-DUYfROyQNWm3q+JXL3S6s1/y/cOWRstnmt5zDXhdYNJ5N8TgCnHcDXKwW/dRZL7eBZupmDVHxdKCWZDUYUqmeg==",
-@@ -426,0 +461,2 @@
-+      "resolved": "https://registry.npmjs.org/@inquirer/password/-/password-4.0.0.tgz",
-+      "integrity": "sha512-W4QRSzJDMKIvWSvQWOIhs6qba1MJ6yIoy+sazSFhl2QIwn58B0Yw3iZ/zLk3QqVcCsTmKcyrSNVWUJ5RVDLStw==",
-@@ -438,0 +475,2 @@
-+      "resolved": "https://registry.npmjs.org/@inquirer/prompts/-/prompts-7.0.0.tgz",
-+      "integrity": "sha512-y8kX/TmyBqV0H1i3cWbhiTljcuBtgVgyVXAVub3ba1j5/G+dxhYohK1JLRkaosPGKKf3LnEJsYK+GPabpfnaHw==",
-@@ -457,0 +496,2 @@
-+      "resolved": "https://registry.npmjs.org/@inquirer/rawlist/-/rawlist-4.0.0.tgz",
-+      "integrity": "sha512-frzJNoMsQBO1fxLXrtpxt2c8hUy/ASEmBpIOEnXY2CjylPnLsVyxrEq7hcOIqVJKHn1tIPfplfiSPowOTrrUDg==",
-@@ -469,0 +510,2 @@
-+      "resolved": "https://registry.npmjs.org/@inquirer/search/-/search-3.0.0.tgz",
-+      "integrity": "sha512-AT9vkC2KD/PLHZZXIW5Tn/FnJzEU3xEZMLxNo9OggKoreDEKfTOKVM1LkYbDg6UQUOOjntXd0SsrvoHfCzS8cw==",
-@@ -482,0 +525,2 @@
-+      "resolved": "https://registry.npmjs.org/@inquirer/select/-/select-4.0.0.tgz",
-+      "integrity": "sha512-XTN4AIFusWbNCBU1Xm2YDxbtH94e/FOrC27U3QargSsoDT1mRm+aLfqE+oOZnUuxwtTnInRT8UHRU3MVOu52wg==",
-@@ -496,0 +541,2 @@
-+      "resolved": "https://registry.npmjs.org/@inquirer/testing/-/testing-2.1.35.tgz",
-+      "integrity": "sha512-DUMxGJP6Y7QTrjk4hE6kunQUfMDxCphJaO0xCsH+AmaTPbvIW2HV+7ZQTCFQXrOTFuvLssF9lbbnC0keGYbVgA==",
-@@ -523,0 +570,2 @@
-+      "resolved": "https://registry.npmjs.org/@inquirer/type/-/type-3.0.0.tgz",
-+      "integrity": "sha512-YYykfbw/lefC7yKj7nanzQXILM7r3suIvyFlCcMskc99axmsSewXWkAfXKwMbgxL76iAFVmRwmYdwNZNc8gjog==",
-@@ -728,0 +777,2 @@
-+      "resolved": "https://registry.npmjs.org/@sinonjs/fake-timers/-/fake-timers-13.0.2.tgz",
-+      "integrity": "sha512-4Bb+oqXZTSTZ1q27Izly9lv8B9dlV61CROxPiVtywwzv5SnytJqhvYe6FclHYuXml4cd1VHPo1zd5PmTeJozvA==",
-@@ -765,0 +816,2 @@
-+      "resolved": "https://registry.npmjs.org/@types/chai/-/chai-5.0.0.tgz",
-+      "integrity": "sha512-+DwhEHAaFPPdJ2ral3kNHFQXnTfscEEFsUxzD+d7nlcLrFK23JtNjH71RGasTcHb88b4vVi4mTyfpf8u2L8bdA==",
-@@ -828,0 +881,2 @@
-+      "resolved": "https://registry.npmjs.org/@types/mocha/-/mocha-10.0.9.tgz",
-+      "integrity": "sha512-sicdRoWtYevwxjOHNMPTl3vSfJM6oyW8o1wXeI7uww6b6xHg8eBznQDNSGBCDJmsE8UMxP05JgZRtsKbTqt//Q==",
-@@ -833,0 +888,2 @@
-+      "resolved": "https://registry.npmjs.org/@types/node/-/node-22.7.5.tgz",
-+      "integrity": "sha512-jML7s2NAzMWc//QSJ1a3prpk78cOPchGvXJsC3C6R6PSMoooztvRVQEz89gmBTBY1SPMaqo5teB4uNHPdetShQ==",
-@@ -886,0 +943,2 @@
-+      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.12.1.tgz",
-+      "integrity": "sha512-tcpGyI9zbizT9JbV6oYE477V6mTlXvvi0T0G3SNIYE2apm/G5huBa1+K89VGeovbg+jycCrfhl3ADxErOuO6Jg==",
-@@ -1049,0 +1108,2 @@
-+      "resolved": "https://registry.npmjs.org/awilix/-/awilix-12.0.2.tgz",
-+      "integrity": "sha512-BoXlUZmTJc2j+uCDAMglNnWNf1b9KDEGmrgYs3vnOldK+bkiAiJnisgbIJWvGC1MFt/uYd3tG+Esd/0VmLreKw==",
-@@ -1293,0 +1354,2 @@
-+      "resolved": "https://registry.npmjs.org/chai/-/chai-5.1.1.tgz",
-+      "integrity": "sha512-pT1ZgP8rPNqUgieVaEY+ryQr6Q4HXNg8Ei9UnLUrjN4IA7dvQC5JB+/kxVcPNDHyBcc/26CXPkbNzq3qwrOEKA==",
-@@ -1569,0 +1632,2 @@
-+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.7.tgz",
-+      "integrity": "sha512-Er2nc/H7RrMXZBFCEim6TCmMk02Z8vLC2Rbi1KEBggpo0fS6l0S1nnapwmIi3yW/+GOJap1Krg4w0Hg80oCqgQ==",
-@@ -1851,0 +1916,2 @@
-+      "resolved": "https://registry.npmjs.org/eslint/-/eslint-9.12.0.tgz",
-+      "integrity": "sha512-UVIOlTEWxwIopRL1wgSQYdnVDcEvs2wyaO6DGo5mXqe3r16IoCNWkR29iHhyaP4cICWjbgbmFUGAhh0GJRuGZw==",
-@@ -1932,0 +1999,2 @@
-+      "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-8.1.0.tgz",
-+      "integrity": "sha512-14dSvlhaVhKKsa9Fx1l8A17s7ah7Ef7wCakJ10LYk6+GYmP9yDti2oq2SEwcyndt6knfcZyhyxwY3i9yL78EQw==",
-@@ -1946,0 +2015,2 @@
-+      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-4.1.0.tgz",
-+      "integrity": "sha512-Q7lok0mqMUSf5a/AdAZkA5a/gHcO6snwQClVNNvFKCAVlxXucdU8pKydU5ZVZjBx5xr37vGbFFWtLQYreLzrZg==",
-@@ -1993,0 +2064,2 @@
-+      "resolved": "https://registry.npmjs.org/espree/-/espree-10.2.0.tgz",
-+      "integrity": "sha512-upbkBJbckcCNBDBDXEbuhjbP68n+scUd3k/U2EkyM9nw+I/jPiL4cLF/Al06CF96wRltFda16sxDFrxsI1v0/g==",
-@@ -2227,0 +2300,2 @@
-+      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.3.1.tgz",
-+      "integrity": "sha512-X8cqMLLie7KsNUDSdzeN8FYK9rEt4Dt67OsG/DNGnYTSDBG4uFAJFBnUeiV+zCVAvwFy56IjM9sH51jVaEhNxw==",
-@@ -2367,0 +2442,2 @@
-+      "resolved": "https://registry.npmjs.org/globals/-/globals-15.11.0.tgz",
-+      "integrity": "sha512-yeyNSjdbyVaWurlwCpcA6XNBrHTMIeDdj0/hnvX/OLJ9ekOXYbLsLinH/MucQyGvNnXhidTdNhTtJaffL2sMfw==",
-@@ -2581,0 +2658,2 @@
-+      "resolved": "https://registry.npmjs.org/inquirer/-/inquirer-12.0.0.tgz",
-+      "integrity": "sha512-W3mwgzLtWIqHndtAb82zCHbRfdPit3jcqEyYkAjM/4p15g/1tOoduYydx6IJ3sh31FHT82YoqYZB8RoTwoMy7w==",
-@@ -2874,0 +2953,2 @@
-+      "resolved": "https://registry.npmjs.org/ky/-/ky-1.7.2.tgz",
-+      "integrity": "sha512-OzIvbHKKDpi60TnF9t7UUVAF1B4mcqc02z5PIvrm08Wyb+yOcz63GRvEuVxNT18a9E1SrNouhB4W2NNLeD7Ykg==",
-@@ -3210,0 +3291,2 @@
-+      "resolved": "https://registry.npmjs.org/mocha/-/mocha-10.7.3.tgz",
-+      "integrity": "sha512-uQWxAu44wwiACGqjbPYmjo7Lg8sFrS3dQe7PP2FQI+woptP4vZXSMcfMyFL/e1yFEeEpV4RtyTpZROOKmxis+A==",
-@@ -3707,0 +3790,2 @@
-+      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.3.3.tgz",
-+      "integrity": "sha512-i2tDNA0O5IrMO757lfrdQZCc2jPNDVntV0m/+4whiDfWaTKfMNgR7Qz0NAeGz/nRqF4m5/6CLzbP4/liHt12Ew==",
-@@ -3899,0 +3984,2 @@
-+      "resolved": "https://registry.npmjs.org/registry-auth-token/-/registry-auth-token-5.0.2.tgz",
-+      "integrity": "sha512-o/3ikDxtXaA59BmZuZrJZDJv8NMDGSj+6j6XaeBmHw8eY1i1qd9+6H+LjVvQXx3HN6aRCGa1cUdJ9RaJZUugnQ==",
-@@ -4319,0 +4406,2 @@
-+      "resolved": "https://registry.npmjs.org/text-table/-/text-table-0.2.0.tgz",
-+      "integrity": "sha512-N+8UisAXDGk8PFXP4HAzVR9nbfmVJ3zYLAWiTIoqC5v5isinhr+r5uaO8+7r3BMfuNIufIsA7RdpVgacC2cSpw==",
-@@ -4373,0 +4462,2 @@
-+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.7.0.tgz",
-+      "integrity": "sha512-gLXCKdN1/j47AiHiOkJN69hJmcbGTHI0ImLmbYLHykhgeN0jVGola9yVjFgzCUklsZQMW55o+dW7IXv3RCXDzA==",
-@@ -4405,0 +4496,2 @@
-+      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-4.26.1.tgz",
-+      "integrity": "sha512-yOGpmOAL7CkKe/91I5O3gPICmJNLJ1G4zFYVAsRHg7M64biSnPtRj0WNQt++bRkjYOqjWXrhnUw1utzmVErAdg==",
-@@ -4415,0 +4508,2 @@
-+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.6.3.tgz",
-+      "integrity": "sha512-hjcS1mhfuyi4WW8IWtjP7brDrG2cuDZukyrYrSauoXGNgx0S7zceP07adYkJycEr56BOUTNPzbInooiN3fn1qw==",
-@@ -4427,0 +4522,2 @@
-+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.19.8.tgz",
-+      "integrity": "sha512-ve2KP6f/JnbPBFyobGHuerC9g1FYGn/F8n1LWTwNxCEzd6IfqTwUQcNXgEtmmQ6DlRrC1hrSrBnCZPokRrDHjw==",

pkgs/by-name/fa/fauna-shell/package.nix

@@ -4,6 +4,7 @@
   fetchFromGitHub,
   esbuild,
   buildGoModule,
+  nodejs_22,
 }:
 let
   esbuild' = esbuild.override {
@@ -36,19 +37,22 @@ buildNpmPackage (finalAttrs: {
     hash = "sha256-JbTS54e1pNxoqTAlEdOqKqkEyAzFJLI6he7/jivVPzI=";
   };
 
-  patches = [
-    ./package-lock-fix.patch
-  ];
+  # upstream's package-lock.json is missing entries needed by npm >= 11
+  postPatch = ''
+    cp ${./package-lock.json} package-lock.json
+  '';
 
-  npmDepsHash = "sha256-RNgx3Oorc/+nHHZHdOmyA9Q3fCW7yaAzX0DqHbCMqt0=";
+  npmDepsHash = "sha256-OH/ippCHRy7glq+wXBwnHIVCO6yL5CItng/vCKv+0fQ=";
+
+  nodejs = nodejs_22;
 
   npmFlags = [ "--ignore-scripts" ];
 
   env.ESBUILD_BINARY_PATH = lib.getExe esbuild';
 
-  # While this errors, it makes the build complete successfully. Therefore, ????
+  # ssh2's optional cpu-features native module needs node-gyp building to satisfy esbuild's bundler
   preBuild = ''
-    npm rebuild --verbose cpu-features
+    npm rebuild cpu-features
   '';
 
   npmBuildScript = "build:app";

pkgs/by-name/fa/fauna-shell/update.sh

@@ -19,9 +19,10 @@ fi
 git clone "https://github.com/fauna/fauna-shell" -b "v$NEW_VERSION" "$WORKDIR/src"
 pushd "$WORKDIR/src"
 npx --yes npm-package-lock-add-resolved
+npm install --package-lock-only --ignore-scripts
 
-# Update package-lock patch
-git diff -U0 >"$PACKAGE_DIR/package-lock-fix.patch"
+# Update vendored lock file
+cp package-lock.json "$PACKAGE_DIR/package-lock.json"
 popd
 
 # Run nix-update

pkgs/by-name/fe/fence/package.nix

@@ -25,6 +25,10 @@ buildGoModule (finalAttrs: {
 
   vendorHash = "sha256-sEGLnYC4gMo5jPCZxBXra3pmRigaq4bDcVFd52ru7rQ=";
 
+  subPackages = [
+    "cmd/fence"
+  ];
+
   ldflags = [
     "-s"
     "-w"

pkgs/by-name/fi/field-monitor/package.nix

@@ -34,7 +34,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "field-monitor";
-  version = "50.0";
+  version = "50.1";
 
   strictDeps = true;
 
@@ -42,12 +42,12 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "theCapypara";
     repo = "field-monitor";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-IVHzMUjjVZHDTI6Jjq7i8wrENPerKzEiDT15otPFx9A=";
+    hash = "sha256-waMa70oLKvIoljvE+MjWWKVL1Cd0xnasVeB17tfMQW8=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src;
-    hash = "sha256-c4ANjQ1OoDMMifAUpU8iNE9lSBamAR+XbEmYrYphixU=";
+    hash = "sha256-fsrczFhoIilxgZRH2PVXC67YdkMsIjA6zTfix57TTzo=";
   };
 
   mesonBuildType = "release";