Merge staging-next into staging

doc/languages-frameworks/javascript.section.md

···
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "...";
+    fetcherVersion = 2;
   };
 })
 ```
···
 
 In this example, `prePnpmInstall` will be run by both `pnpm.configHook` and by the `pnpm.fetchDeps` builder.
 
+#### PNPM `fetcherVersion` {#javascript-pnpm-fetcherVersion}
+
+This is the version of the output of `pnpm.fetchDeps`, if you haven't set it already, you can use `1` with your current hash:
+
+```nix
+{
+  # ...
+  pnpmDeps = pnpm.fetchDeps {
+    # ...
+    hash = "..."; # you can use your already set hash here
+    fetcherVersion = 1;
+  };
+}
+```
+
+After upgrading to a newer `fetcherVersion`, you need to regenerate the hash:
+
+```nix
+{
+  # ...
+  pnpmDeps = pnpm.fetchDeps {
+    # ...
+    hash = "..."; # clear this hash and generate a new one
+    fetcherVersion = 2;
+  };
+}
+```
+
+This variable ensures that we can make changes to the output of `pnpm.fetchDeps` without breaking existing hashes.
+Changes can include workarounds or bug fixes to existing PNPM issues.
+
+##### Version history {#javascript-pnpm-fetcherVersion-versionHistory}
+
+- 1: Initial version, nothing special
+- 2: [Ensure consistent permissions](https://github.com/NixOS/nixpkgs/pull/422975)
 
 ### Yarn {#javascript-yarn}
 

doc/redirects.json

···
   "javascript-pnpm-extraCommands": [
     "index.html#javascript-pnpm-extraCommands"
   ],
+  "javascript-pnpm-fetcherVersion": [
+    "index.html#javascript-pnpm-fetcherVersion"
+  ],
+  "javascript-pnpm-fetcherVersion-versionHistory": [
+    "index.html#javascript-pnpm-fetcherVersion-versionHistory"
+  ],
   "javascript-yarn": [
     "index.html#javascript-yarn"
   ],

nixos/modules/services/mail/spamassassin.nix

···
           # loadplugin Mail::SpamAssassin::Plugin::Shortcircuit
           loadplugin Mail::SpamAssassin::Plugin::SpamCop
           loadplugin Mail::SpamAssassin::Plugin::SPF
-          #loadplugin Mail::SpamAssassin::Plugin::TextCat
+          loadplugin Mail::SpamAssassin::Plugin::TextCat
           # loadplugin Mail::SpamAssassin::Plugin::TxRep
           loadplugin Mail::SpamAssassin::Plugin::URIDetail
           loadplugin Mail::SpamAssassin::Plugin::URIDNSBL
···
       after = [
         "network.target"
         "sa-update.service"
+      ];
+
+      reloadTriggers = [
+        config.environment.etc."mail/spamassassin/init.pre".source
+        config.environment.etc."mail/spamassassin/local.cf".source
       ];
 
       serviceConfig = {

nixos/modules/services/misc/redlib.nix

···
       environment = mapAttrs (_: v: if isBool v then boolToString' v else toString v) cfg.settings;
       serviceConfig =
         {
+          # Hardening
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          NoNewPrivileges = true;
+          PrivateDevices = true;
+          PrivateIPC = true;
+          PrivateTmp = true;
+          ProcSubset = "pid";
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectProc = "invisible";
+          ProtectSystem = "full";
+          RemoveIPC = true;
+          RestrictAddressFamilies = [
+            "AF_INET"
+            "AF_INET6"
+          ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [
+            "~@mount"
+            "~@swap"
+            "~@resources"
+            "~@reboot"
+            "~@raw-io"
+            "~@obsolete"
+            "~@module"
+            "~@debug"
+            "~@cpu-emulation"
+            "~@clock"
+            "~@privileged"
+          ];
+          UMask = "0027";
+
           ExecStart = [
             ""
             "${lib.getExe cfg.package} ${args}"
···
               # A private user cannot have process capabilities on the host's user
               # namespace and thus CAP_NET_BIND_SERVICE has no effect.
               PrivateUsers = true;
+              CapabilityBoundingSet = false;
             }
         );
     };

nixos/modules/services/web-apps/froide-govplan.nix

···
             StateDirectory = lib.mkIf (cfg.dataDir == "/var/lib/froide-govplan") "froide-govplan";
             User = "govplan";
             Group = "govplan";
+            TimeoutStartSec = "5m";
           };
           after = [
             "postgresql.target"
···
           wantedBy = [ "multi-user.target" ];
           environment =
             {
-              PYTHONPATH = pkg.pythonPath;
+              PYTHONPATH = "${pkg.pythonPath}:${pkg}/${pkg.python.sitePackages}";
               GDAL_LIBRARY_PATH = "${pkgs.gdal}/lib/libgdal.so";
               GEOS_LIBRARY_PATH = "${pkgs.geos}/lib/libgeos_c.so";
             }

nixos/modules/system/boot/systemd/oomd.nix

···
       "systemd-oomd.service"
       "systemd-oomd.socket"
     ];
+    # TODO: Added upstream in upcoming systemd release. Good to drop once we use v258 or later
+    systemd.services.systemd-oomd.after = [ "systemd-sysusers.service" ];
     systemd.services.systemd-oomd.wantedBy = [ "multi-user.target" ];
 
     environment.etc."systemd/oomd.conf".text = lib.generators.toINI { } {

pkgs/applications/audio/youtube-music/default.nix

···
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-xIQyTetHU37gTxCcQp4VCqzGdIfVQGy/aORCVba6YQ0=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/applications/editors/vscode/extensions/amazonwebservices.amazon-q-vscode/default.nix

···
   mktplcRef = {
     name = "amazon-q-vscode";
     publisher = "AmazonWebServices";
-    version = "1.81.0";
-    hash = "sha256-zuE+KR0iLEkQrxxS835ZYq20yxWgV1S14bay4shqVWg=";
+    version = "1.83.0";
+    hash = "sha256-BicMVFpCmG3/NnBJUG5w8B/5039SWx6kAv8SC+Vaj5c=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/default.nix

···
         mktplcRef = {
           name = "vscode-vibrancy-continued";
           publisher = "illixion";
-          version = "1.1.54";
-          hash = "sha256-CzhDStBa/LB/bzgzrFCUEcVDeBluWJPblneUbHdIcRE=";
+          version = "1.1.57";
+          hash = "sha256-UJn+RFBlQXmPqKkFIBiD4AblnX4s0O2IK747fG+UC/0=";
         };
         meta = {
           downloadPage = "https://marketplace.visualstudio.com/items?itemName=illixion.vscode-vibrancy-continued";

pkgs/applications/editors/vscode/extensions/ms-windows-ai-studio.windows-ai-studio/default.nix

···
   mktplcRef = {
     name = "windows-ai-studio";
     publisher = "ms-windows-ai-studio";
-    version = "0.16.0";
-    hash = "sha256-JBHdwvlJ4BHlphABT2ViR03R4zRVSwkHkOw1n3bNzAQ=";
+    version = "0.16.1";
+    hash = "sha256-uhAUSXB7ULNmkRSHqfbo3T3AZ3TiUaIqEZL4YwkWxtY=";
   };
 
   meta = {

pkgs/applications/gis/qmapshack/default.nix

···
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  cmake,
-  wrapQtAppsHook,
-  qtscript,
-  qtwebengine,
-  gdal,
-  proj,
-  routino,
-  quazip,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "qmapshack";
-  version = "1.17.1";
-
-  src = fetchFromGitHub {
-    owner = "Maproom";
-    repo = "qmapshack";
-    rev = "V_${version}";
-    hash = "sha256-wqztKmaUxY3qd7IgPM7kV7x0BsrTMTX3DbcdM+lsarI=";
-  };
-
-  nativeBuildInputs = [
-    cmake
-    wrapQtAppsHook
-  ];
-
-  buildInputs = [
-    qtscript
-    qtwebengine
-    gdal
-    proj
-    routino
-    quazip
-  ];
-
-  cmakeFlags = [
-    "-DROUTINO_XML_PATH=${routino}/share/routino"
-  ];
-
-  qtWrapperArgs = [
-    "--suffix PATH : ${
-      lib.makeBinPath [
-        gdal
-        routino
-      ]
-    }"
-  ];
-
-  meta = {
-    description = "Consumer grade GIS software";
-    homepage = "https://github.com/Maproom/qmapshack";
-    changelog = "https://github.com/Maproom/qmapshack/blob/V_${version}/changelog.txt";
-    license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [
-      dotlambda
-      sikmir
-    ];
-    platforms = with lib.platforms; linux;
-  };
-}

pkgs/applications/video/mpv/scripts/quality-menu.nix

···
 
 buildLua rec {
   pname = "mpv-quality-menu";
-  version = "4.2.0";
+  version = "4.2.1";
 
   src = fetchFromGitHub {
     owner = "christoph-heinrich";
     repo = "mpv-quality-menu";
     rev = "v${version}";
-    hash = "sha256-uaU4W72P7zhHzxmfr59icCAl1mJ3ycLGzkGcYasHllI=";
+    hash = "sha256-W+6OYjh0S7nYrNC/P9sF7t6p1Rt/awOtO865cr6qtR0=";
   };
   passthru.updateScript = gitUpdater { rev-prefix = "v"; };
 

pkgs/by-name/ao/aonsoku/package.nix

···
   pnpmDeps = pnpm_8.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-h1rcM+H2c0lk7bpGeQT5ue9bQIggrCFHkj4o7KxnH08=";
+    fetcherVersion = 1;
   };
 
   cargoRoot = "src-tauri";

pkgs/by-name/ap/apache-answer/package.nix

···
       inherit src version pname;
       sourceRoot = "${src.name}/ui";
       hash = "sha256-/se6IWeHdazqS7PzOpgtT4IxCJ1WptqBzZ/BdmGb4BA=";
+      fetcherVersion = 1;
     };
 
     nativeBuildInputs = [

pkgs/by-name/ap/aporetic-bin/package.nix

···
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "aporetic-bin";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "protesilaos";
     repo = "aporetic";
     tag = finalAttrs.version;
-    hash = "sha256-5lPViAo9SztOdds6HEmKJpT17tgcxmU/voXDffxTMDI=";
+    hash = "sha256-1BbuC/mWEcXJxzDppvsukhNtdOLz0QosD6QqI/93Khc=";
   };
 
   installPhase = ''

pkgs/by-name/ap/aporetic/package.nix

···
     "serif"
   ];
   pname = "aporetic";
-  version = "1.1.0";
+  version = "1.2.0";
   src = fetchFromGitHub {
     owner = "protesilaos";
     repo = "aporetic";
     tag = version;
-    hash = "sha256-5lPViAo9SztOdds6HEmKJpT17tgcxmU/voXDffxTMDI=";
+    hash = "sha256-1BbuC/mWEcXJxzDppvsukhNtdOLz0QosD6QqI/93Khc=";
   };
   privateBuildPlan = src.outPath + "/private-build-plans.toml";
   makeIosevkaFont =
···
             src = fetchFromGitHub {
               owner = "be5invis";
               repo = "iosevka";
-              tag = "v32.5.0";
-              hash = "sha256-MzsAkq5l4TP19UJNPW/8hvIqsJd94pADrrv8wLG6NMQ=";
+              tag = "v33.2.2";
+              hash = "sha256-dhMTcceHru/uLHRY4eWzFV+73ckCBBnDlizP3iY5w5w=";
             };
 
-            npmDepsHash = "sha256-HeqwpZyHLHdMhd/UfXVBonMu+PhStrLCxAMuP/KuTT8=";
+            npmDepsHash = "sha256-5DcMV9N16pyQxRaK6RCoeghZqAvM5EY1jftceT/bP+o=";
           }
         );
     });

pkgs/by-name/ar/artalk/package.nix

···
     pnpmDeps = pnpm_9.fetchDeps {
       inherit (finalAttrs) pname version src;
       hash = "sha256-QIfadS2gNPtH006O86EndY/Hx2ml2FoKfUXJF5qoluw=";
+      fetcherVersion = 1;
     };
 
     buildPhase = ''

pkgs/by-name/as/astro-language-server/package.nix

···
       prePnpmInstall
       ;
     hash = "sha256-tlpk+wbLjJqt37lu67p2A2RZAR1ZfnZFiYoqIQwvWPQ=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/au/autobrr/package.nix

···
         sourceRoot
         ;
       hash = "sha256-TbdRJqLdNI7wchUsx2Kw1LlDyv50XlCiKyn6rhZyN1U=";
+      fetcherVersion = 1;
     };
 
     postBuild = ''

pkgs/by-name/au/autoprefixer/package.nix

···
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-zb/BwL//i0oly5HEXN20E3RzZXdaOn+G2yIWRas3PB4=";
+    fetcherVersion = 1;
   };
 
   installPhase = ''

pkgs/by-name/ba/backrest/package.nix

···
     pnpmDeps = pnpm_9.fetchDeps {
       inherit (finalAttrs) pname version src;
       hash = "sha256-q7VMQb/FRT953yT2cyGMxUPp8p8XkA9mvqGI7S7Eifg=";
+      fetcherVersion = 1;
     };
 
     buildPhase = ''

pkgs/by-name/ba/bash-language-server/package.nix

···
       pnpmWorkspaces
       ;
     hash = "sha256-NvyqPv5OKgZi3hW98Da8LhsYatmrzrPX8kLOfLr+BrI=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/bf/bfscripts/package.nix

···
 {
-  stdenv,
   fetchFromGitHub,
+  git,
   lib,
   python3,
+  rpm,
+  stdenv,
 }:
 
 let
···
 in
 stdenv.mkDerivation {
   pname = "bfscripts";
-  version = "unstable-2023-05-15";
+  version = "unstable-2025-06-27";
 
   src = fetchFromGitHub {
     owner = "Mellanox";
     repo = "bfscripts";
-    rev = "1da79f3ece7cdf99b2571c00e8b14d2e112504a4";
-    hash = "sha256-pTubrnZKEFmtAj/omycFYeYwrCog39zBDEszoCrsQNQ=";
+    rev = "ed8ede79fa002a2d83719a1bef6fbe0f7dcf37a4";
+    hash = "sha256-x+hpH6D5HTl39zD0vYj6wRFw881M4AcfM+ePcgXMst8=";
   };
 
   buildInputs = [
     python3
   ];
 
+  nativeBuildInputs = [
+    git
+    rpm
+  ];
+
   installPhase = ''
     ${lib.concatStringsSep "\n" (map (b: "install -D ${b} $out/bin/${b}") binaries)}
   '';
···
     homepage = "https://github.com/Mellanox/bfscripts";
     license = licenses.bsd2;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ nikstur ];
+    maintainers = with maintainers; [
+      nikstur
+      thillux
+    ];
   };
 }

pkgs/by-name/bu/bumpp/package.nix

···
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-duxpym1DlJM4q5j0wmrubYiAHQ3cDEFfeD9Gyic6mbI=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/ca/capnproto/package.nix

···
 # See: https://gerrit.lix.systems/c/lix/+/1874
 clangStdenv.mkDerivation rec {
   pname = "capnproto";
-  version = "1.1.0";
+  version = "1.2.0";
 
   # release tarballs are missing some ekam rules
   src = fetchFromGitHub {
     owner = "capnproto";
     repo = "capnproto";
     rev = "v${version}";
-    hash = "sha256-gxkko7LFyJNlxpTS+CWOd/p9x/778/kNIXfpDGiKM2A=";
+    hash = "sha256-aDcn4bLZGq8915/NPPQsN5Jv8FRWd8cAspkG3078psc=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/ca/cargo-tauri/test-app.nix

···
       ;
 
     hash = "sha256-plANa/+9YEQ4ipgdQ7QzPyxgz6eDCBhO7qFlxK6Ab58=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/cd/cdxgen/package.nix

···
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-7NrDYd4H0cPQs8w4lWlB0BhqcYZVo6/9zf0ujPjBzsE=";
+    fetcherVersion = 1;
   };
 
   buildPhase = ''

pkgs/by-name/cl/clash-verge-rev/unwrapped.nix

···
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
     hash = pnpm-hash;
+    fetcherVersion = 1;
   };
 
   env = {

pkgs/by-name/co/code-cursor/package.nix

···
 
   sources = {
     x86_64-linux = fetchurl {
-      url = "https://downloads.cursor.com/production/031e7e0ff1e2eda9c1a0f5df67d44053b059c5df/linux/x64/Cursor-1.2.1-x86_64.AppImage";
-      hash = "sha256-2rOs5+85crKO/N9dCQLFfUXTfP9JVVR1s/g0bK2E78s=";
+      url = "https://downloads.cursor.com/production/faa03b17cce93e8a80b7d62d57f5eda6bb6ab9fa/linux/x64/Cursor-1.2.2-x86_64.AppImage";
+      hash = "sha256-mQr1QMw4wP+kHvE9RWPkCKtHObbr0jpyOxNw3LfTPfc=";
     };
     aarch64-linux = fetchurl {
-      url = "https://downloads.cursor.com/production/031e7e0ff1e2eda9c1a0f5df67d44053b059c5df/linux/arm64/Cursor-1.2.1-aarch64.AppImage";
-      hash = "sha256-Otg+NyW1DmrqIb0xqZCfJ4ys61/DBOQNgaAR8PMOCfg=";
+      url = "https://downloads.cursor.com/production/faa03b17cce93e8a80b7d62d57f5eda6bb6ab9fa/linux/arm64/Cursor-1.2.2-aarch64.AppImage";
+      hash = "sha256-EGvm/VW+NDTmOB1o2j3dpq4ckWbroFWEbF9Pezr8SZQ=";
     };
     x86_64-darwin = fetchurl {
-      url = "https://downloads.cursor.com/production/031e7e0ff1e2eda9c1a0f5df67d44053b059c5df/darwin/x64/Cursor-darwin-x64.dmg";
-      hash = "sha256-Rh1erFG7UtGwO1NaM5+tq17mI5WdIX750pIzeO9AK+Q=";
+      url = "https://downloads.cursor.com/production/faa03b17cce93e8a80b7d62d57f5eda6bb6ab9fa/darwin/x64/Cursor-darwin-x64.dmg";
+      hash = "sha256-IDJklB8wMfrPpc2SO02iVBBE9d7fLN7JotVpPyCQkyE=";
     };
     aarch64-darwin = fetchurl {
-      url = "https://downloads.cursor.com/production/031e7e0ff1e2eda9c1a0f5df67d44053b059c5df/darwin/arm64/Cursor-darwin-arm64.dmg";
-      hash = "sha256-k/j3hJnHIdtfK9+T0aq2gFkRM+JulDt4FpU7n4HGEYM=";
+      url = "https://downloads.cursor.com/production/faa03b17cce93e8a80b7d62d57f5eda6bb6ab9fa/darwin/arm64/Cursor-darwin-arm64.dmg";
+      hash = "sha256-GxiNf58Kf5/l01eBhXRWMLMxAnj1txDQwSe5ei6nTgg=";
     };
   };
 
···
   inherit useVSCodeRipgrep;
   commandLineArgs = finalCommandLineArgs;
 
-  version = "1.2.1";
+  version = "1.2.2";
   pname = "cursor";
 
   # You can find the current VSCode version in the About dialog:

pkgs/by-name/co/codipack/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "codipack";
-  version = "2.3.2";
+  version = "3.0.0";
 
   src = fetchFromGitHub {
     owner = "SciCompKL";
     repo = "CoDiPack";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-feYtPDV0t7b49NIL5s6ZoBttRG2Bkwc0gOX6R6xDIbs=";
+    hash = "sha256-dGzLPU8YOrBdXPwUnEElqfxzbUdkAQxtv2+7+itNsyI=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/co/comic-neue/package.nix

···
   version = "2.51";
 
   src = fetchzip {
-    url = "http://comicneue.com/${pname}-${version}.zip";
-    sha256 = "sha256-DjRZtFnJOtZnxhfpgU5ihZFAonRK608/BQztCAExIU0=";
-    stripRoot = false; # because it comes with a __MACOSX directory
+    url = "https://github.com/crozynski/comicneue/releases/download/${version}/comicneue-master.zip";
+    hash = "sha256-Xkw+Yd36ffptKsS8RSEP9BPX6eQI7TZn2NgU49rdo80=";
   };
 
   installPhase = ''
     mkdir -pv $out/share/{doc/${pname}-${version},fonts/{opentype,truetype,WOFF,WOFF2}}
-    cp -v ${pname}-${version}/{FONTLOG,OFL-FAQ,OFL}.txt $out/share/doc/
-    cp -v ${pname}-${version}/Booklet-ComicNeue.pdf $out/share/doc/
-    cp -v ${pname}-${version}/OTF/ComicNeue-Angular/*.otf $out/share/fonts/opentype
-    cp -v ${pname}-${version}/OTF/ComicNeue/*.otf $out/share/fonts/opentype
-    cp -v ${pname}-${version}/TTF/ComicNeue-Angular/*.ttf $out/share/fonts/truetype
-    cp -v ${pname}-${version}/TTF/ComicNeue/*.ttf $out/share/fonts/truetype
-    cp -v ${pname}-${version}/WebFonts/*.woff $out/share/fonts/WOFF
-    cp -v ${pname}-${version}/WebFonts/*.woff2 $out/share/fonts/WOFF2
+    cp -v {FONTLOG,OFL-FAQ,OFL}.txt $out/share/doc/
+    cp -v Booklet-ComicNeue.pdf $out/share/doc/
+    cp -v Fonts/OTF/ComicNeue-Angular/*.otf $out/share/fonts/opentype
+    cp -v Fonts/OTF/ComicNeue/*.otf $out/share/fonts/opentype
+    cp -v Fonts/TTF/ComicNeue-Angular/*.ttf $out/share/fonts/truetype
+    cp -v Fonts/TTF/ComicNeue/*.ttf $out/share/fonts/truetype
+    cp -v Fonts/WebFonts/*.woff $out/share/fonts/WOFF
+    cp -v Fonts/WebFonts/*.woff2 $out/share/fonts/WOFF2
   '';
 
   meta = with lib; {

pkgs/by-name/co/concurrently/package.nix

···
       patches
       ;
     hash = "sha256-F1teWIABkK0mqZcK3RdGNKmexI/C59QWSrrD1jYbHt0=";
+    fetcherVersion = 1;
   };
 
   patches = [

pkgs/by-name/cr/crowdin-cli/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "crowdin-cli";
-  version = "4.8.0";
+  version = "4.9.0";
 
   src = fetchurl {
     url = "https://github.com/crowdin/crowdin-cli/releases/download/${finalAttrs.version}/crowdin-cli.zip";
-    hash = "sha256-4+D1O+/32aYbZs1aKAEPuKq3IDmZho7oX+zERRrGMpw=";
+    hash = "sha256-fPgcr0Gg0uIgDhnfowFp6K+NhtKdjThLd4yzjcZ78K4=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/da/daed/package.nix

···
     pnpmDeps = pnpm_9.fetchDeps {
       inherit pname version src;
       hash = "sha256-+yLpSbDzr1OV/bmUUg6drOvK1ok3cBd+RRV7Qrrlp+Q=";
+      fetcherVersion = 1;
     };
 
     nativeBuildInputs = [

pkgs/by-name/db/dbeaver-bin/package.nix

···
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "dbeaver-bin";
-  version = "25.1.1";
+  version = "25.1.2";
 
   src =
     let
···
         aarch64-darwin = "macos-aarch64.dmg";
       };
       hash = selectSystem {
-        x86_64-linux = "sha256-PFY1eZFG8mvbG6D7pDJBBbsySeNmw6/DlxSyNvCJcSI=";
-        aarch64-linux = "sha256-Fny8+XA7N3rmXqP2UfTPYFIwHHSZTLbABjm+ESMoFJ4=";
-        x86_64-darwin = "sha256-/U8lcvJotAB+K0pQWpy6RIRqbfJzqVefS67qF9arzw0=";
-        aarch64-darwin = "sha256-lfz+B2ZHaBoyDKduDn45ocSTMAsS/bBXrByBeIZb0Ew=";
+        x86_64-linux = "sha256-jyqUIar/RnUvcnXOB3/c7F5BAcpUVL3ufnGuKNGHq0M=";
+        aarch64-linux = "sha256-1aEbrgPVIaWG3rUwHQCcnVTQtRgS2ksjqH5l13eR7NY=";
+        x86_64-darwin = "sha256-n6cu7wzC4GowWGUMF2vg+kA+tiOWzgaWLcUw0I/fCXU=";
+        aarch64-darwin = "sha256-XRFg11t6kiBTPhX8wZbVkHotacjRu3BK1MMGaHDJs6s=";
       };
     in
     fetchurl {

pkgs/by-name/de/deltachat-desktop/package.nix

···
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-PBCmyNmlH88y5s7+8WHcei8SP3Q0lIAAnAQn9uaFxLc=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs =

pkgs/by-name/do/dorion/package.nix

···
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-xBonUzA4+1zbViEsKap6CaG6ZRldW1LjNYIB+FmVRFs=";
+    fetcherVersion = 1;
   };
 
   # CMake (webkit extension)

pkgs/by-name/do/dotbot/package.nix

···
 
 python3Packages.buildPythonApplication rec {
   pname = "dotbot";
-  version = "1.22.0";
+  version = "1.23.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "anishathalye";
     repo = "dotbot";
     tag = "v${version}";
-    hash = "sha256-3U8lIsqy95Ulxa5f2hHGFmuAqQ7WZtikvgaplX6GTF0=";
+    hash = "sha256-Bv9nvS8DxmpMB5Bo4Sw2+rVbrnQIcnc/hQZiq0qeJxc=";
   };
 
   preCheck = ''

pkgs/by-name/em/emmet-language-server/package.nix

···
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-hh5PEtmSHPs6QBgwWHS0laGU21e82JckIP3mB/P9/vE=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/en/en-croissant/package.nix

···
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
     hash = "sha256-hvWXSegUWJvwCU5NLb2vqnl+FIWpCLxw96s9NUIgJTI=";
+    fetcherVersion = 1;
   };
 
   cargoRoot = "src-tauri";

pkgs/by-name/eq/equibop/package.nix

···
       patches
       ;
     hash = "sha256-laTyxRh54x3iopGVgoFtcgaV7R6IKux1O/+tzGEy0Fg=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/eq/equicord/package.nix

···
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-fjfzBy1Z7AUKA53yjjCQ6yasHc5QMaOBtXtXA5fNK5s=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/et/etherpad-lite/package.nix

···
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-n7LolizpKng7zzccytYoCwJ7uGQbMagsgYPDuq0mdxU=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/ev/evince/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "evince";
-  version = "48.0";
+  version = "48.1";
 
   outputs = [
     "out"
···
 
   src = fetchurl {
     url = "mirror://gnome/sources/evince/${lib.versions.major finalAttrs.version}/evince-${finalAttrs.version}.tar.xz";
-    hash = "sha256-zS9lg1X6kHX9+eW0SqCvOn4JKMVWFOsQQrNhds9FESY=";
+    hash = "sha256-fYuab6OgXT9bkEiFkCdojHOniP9ukjvDlFEmiElD+hA=";
   };
 
   depsBuildBuild = [

pkgs/by-name/fe/fedistar/package.nix

···
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-xXVsjAXmrsOp+mXrYAxSKz4vX5JApLZ+Rh6hrYlnJDI=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/fi/filebrowser/package.nix

···
       inherit (finalAttrs) pname version src;
       sourceRoot = "${src.name}/frontend";
       hash = "sha256-vLOtVeGFeHXgQglvKsih4lj1uIs6wipwfo374viIq4I=";
+      fetcherVersion = 1;
     };
 
     installPhase = ''

pkgs/by-name/fi/firezone-gui-client/package.nix

···
       inherit pname version;
       src = "${src}/rust/gui-client";
       hash = "sha256-ttbTYBuUv0vyiYzrFATF4x/zngsRXjuLPfL3qW2HEe4=";
+      fetcherVersion = 1;
     };
     pnpmRoot = "rust/gui-client";
 

pkgs/by-name/fi/firezone-server/package.nix

···
     inherit pname version;
     src = "${src}/apps/web/assets";
     hash = "sha256-ejyBppFtKeyVhAWmssglbpLleOnbw9d4B+iM5Vtx47A=";
+    fetcherVersion = 1;
   };
   pnpmRoot = "apps/web/assets";
 

pkgs/by-name/fl/flood/package.nix

···
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
     hash = "sha256-E2VxRcOMLvvCQb9gCAGcBTsly571zh/HWM6Q1Zd2eVw=";
+    fetcherVersion = 1;
   };
 
   passthru = {

pkgs/by-name/fo/follow/package.nix

···
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
     hash = "sha256-xNGLYzEz1G5sZSqmji+ItJ9D1vvZcwkkygnDeuypcIM=";
+    fetcherVersion = 1;
   };
 
   env = {

pkgs/by-name/fr/froide-govplan/package.nix

···
 let
   python = python3Packages.python.override {
     packageOverrides = self: super: {
-      django = super.django.override { withGdal = true; };
+      django_5 = super.django_5.override { withGdal = true; };
+      django = super.django_5;
     };
   };
 in
 python.pkgs.buildPythonApplication rec {
   pname = "froide-govplan";
-  version = "0-unstable-2025-01-27";
+  version = "0-unstable-2025-06-25";
   pyproject = true;
 
   src = fetchFromGitHub {
···
     repo = "froide-govplan";
     # No tagged release yet
     # https://github.com/okfde/froide-govplan/issues/15
-    rev = "f1763807614b8c54a9214359a2a1e442ca58cb6d";
-    hash = "sha256-Y7/qjhu3y9E55ZDmDf5HUk9JVcUTvi9KnqavqwNixTM=";
+    rev = "9c325e70a84f26fea37b5a34f24d19fd82ea62ff";
+    hash = "sha256-OD4vvKt0FLuiAVGwpspWLB2ZuM1UJkZdv2YcbKKYk9A=";
   };
 
   patches = [
···
   build-inputs = [ gdal ];
 
   dependencies = with python.pkgs; [
-    bleach
     django-admin-sortable2
     django-cms
     django-filer
···
         };
       })
     ))
+    nh3
     psycopg
   ];
 
···
     cp -r project $out/${python.sitePackages}/froide_govplan/
     cp -r froide_govplan/locale $out/${python.sitePackages}/froide_govplan/
     makeWrapper $out/${python.sitePackages}/froide_govplan/manage.py $out/bin/froide-govplan \
-      --prefix PYTHONPATH : "$PYTHONPATH" \
+      --prefix PYTHONPATH : ${passthru.pythonPath}:$out/${python.sitePackages} \
       --set GDAL_LIBRARY_PATH "${gdal}/lib/libgdal.so" \
       --set GEOS_LIBRARY_PATH "${geos}/lib/libgeos_c.so"
   '';
···
     tests = {
       inherit (nixosTests) froide-govplan;
     };
-    python = python;
-    pythonPath = "${python.pkgs.makePythonPath dependencies}:${froide-govplan}/${python.sitePackages}";
+    inherit python;
+    pythonPath = "${python.pkgs.makePythonPath dependencies}";
   };
 
   meta = {

pkgs/by-name/fr/froide/package.nix

···
 let
 
   python = python3Packages.python.override {
-    packageOverrides = self: super: { django = super.django.override { withGdal = true; }; };
+    packageOverrides = self: super: {
+      django_5 = super.django_5.override { withGdal = true; };
+      django = super.django_5;
+      # custom python module part of froide
+      dogtail = super.buildPythonPackage {
+        pname = "dogtail";
+        version = "0-unstable-2024-11-27";
+        pyproject = true;
+
+        src = fetchFromGitHub {
+          owner = "okfde";
+          repo = "dogtail";
+          rev = "d2f341cab0f05ef4e193f0158fe5a64aadc5bae6";
+          hash = "sha256-2lQZgvFXAz6q/3NpBcwckUologWxKmwXI0ZG5nylajg=";
+        };
+
+        build-system = with super; [ setuptools ];
+      };
+    };
   };
 
 in
 python.pkgs.buildPythonApplication rec {
   pname = "froide";
-  version = "0-unstable-2025-04-25";
+  version = "0-unstable-2025-07-01";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "okfde";
     repo = "froide";
-    rev = "9e4838fc5f17a0506af42ad5fd1ebc66cff4b92a";
-    hash = "sha256-0EC6oCaiK7gw5ikemskiK3qOlflGHzlG4giDQNj9tBQ=";
+    rev = "362bddb5a8fdfe762d59cdebd29016568c9531b2";
+    hash = "sha256-c8I/FvXQSkAeacxMQJCpCMKFueNEnLI4R0ElqRbVbNg=";
   };
 
   patches = [ ./django_42_storages.patch ];
···
   ];
 
   dependencies = with python.pkgs; [
-    bleach
     celery
     celery-singleton
     channels
-    coreapi
     dj-database-url
     django
     django-celery-beat
···
     django-elasticsearch-dsl
     django-filingcabinet
     django-filter
-    # Project discontinued upstream
-    # https://github.com/okfde/froide/issues/893
-    django-fsm
     django-json-widget
     django-leaflet
     django-mfa3
···
     geoip2
     icalendar
     markdown
+    nh3
     phonenumbers
     pillow
     pikepdf
···
 
   pnpmDeps = pnpm.fetchDeps {
     inherit pname version src;
-    hash = "sha256-IeuQoiI/r9AKLZgKkZx0C+qE9ueWuC39Y77MB08zSAc=";
+    hash = "sha256-g7YX2fVXGmb3Qq9NNCb294bk4/0khcIZVSskYbE8Mdw=";
+    fetcherVersion = 1;
   };
 
   postBuild = ''
···
   postInstall = ''
     cp -r build manage.py $out/${python.sitePackages}/froide/
     makeWrapper $out/${python.sitePackages}/froide/manage.py $out/bin/froide \
-      --prefix PYTHONPATH : "$PYTHONPATH" \
+      --prefix PYTHONPATH : "${python3Packages.makePythonPath dependencies}" \
       --set GDAL_LIBRARY_PATH "${gdal}/lib/libgdal.so" \
       --set GEOS_LIBRARY_PATH "${geos}/lib/libgeos_c.so"
   '';
···
 
   checkInputs = with python.pkgs; [
     beautifulsoup4
+    pytest-asyncio
     pytest-factoryboy
     time-machine
   ];
···
     "test_bouncing_email"
     "test_multiple_partial"
     "test_logfile_rotation"
+    # Test hangs
+    "test_collapsed_menu"
+    "test_make_request_logged_out_with_existing_account"
   ];
 
   preCheck =

pkgs/by-name/gi/gitbutler/package.nix

···
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
     hash = "sha256-5NtfstUuIYyntt09Mu9GAFAOImfO6VMmJ7g15kvGaLE=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/gi/gitify/package.nix

···
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-eIvqZ9a+foYH+jXuqGz1m/4C+0Xq8mTvm7ZajKeOw58=";
+    fetcherVersion = 1;
   };
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = 1;

pkgs/by-name/gl/glycin-loaders/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "glycin-loaders";
-  version = "1.2.1";
+  version = "1.2.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/glycin/${lib.versions.majorMinor finalAttrs.version}/glycin-${finalAttrs.version}.tar.xz";
-    hash = "sha256-zMV46aPoPQ3BU1c30f2gm6qVxxZ/Xl7LFfeGZUCU7tU=";
+    hash = "sha256-SrRG1YsQx2KDInplSHuLvbdLpQCentIwRfz6i6P7KGE=";
   };
 
   patches = [

pkgs/by-name/gn/gnome-builder/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-builder";
-  version = "48.0";
+  version = "48.2";
 
   outputs = [
     "out"
···
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-builder/${lib.versions.major finalAttrs.version}/gnome-builder-${finalAttrs.version}.tar.xz";
-    hash = "sha256-ev6aejs8ZiF2i8RqYdaY3XiLNlP7RqcII4vcz03me6Q=";
+    hash = "sha256-7BKA1H6BSjE7dMuSfVoFk4BUSqD1bodVKXg5fWx0zGM=";
   };
 
   patches = [

pkgs/by-name/gn/gnome-online-accounts/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-online-accounts";
-  version = "3.54.3";
+  version = "3.54.4";
 
   outputs =
     [
···
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-online-accounts/${lib.versions.majorMinor finalAttrs.version}/gnome-online-accounts-${finalAttrs.version}.tar.xz";
-    hash = "sha256-vPZV3R3cIrwleTtoQNoZ9crXugtyJ/+WntnCUvA2qsU=";
+    hash = "sha256-VXOZQ+dH3LSIXqYHpMJ2fYAC9xKV4a/+pi6jb20c9ZM=";
   };
 
   mesonFlags = [

pkgs/by-name/gn/gnome-shell-extensions/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-shell-extensions";
-  version = "48.2";
+  version = "48.3";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-shell-extensions/${lib.versions.major finalAttrs.version}/gnome-shell-extensions-${finalAttrs.version}.tar.xz";
-    hash = "sha256-6Sh+hjSJ5fpqLFWuW+ocqRCuQBbe6zQXNiZ4sEqR7P8=";
+    hash = "sha256-rd40wI9AtjQRvm8dF+I1VQoAkElIceZIHDEpidf0otQ=";
   };
 
   patches = [

pkgs/by-name/gn/gnome-shell/package.nix

···
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-shell";
-  version = "48.2";
+  version = "48.3";
 
   outputs = [
     "out"
···
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-shell/${lib.versions.major finalAttrs.version}/gnome-shell-${finalAttrs.version}.tar.xz";
-    hash = "sha256-XSbMfvymNIW33bbHo5Msoa+fqPy+OLjJnqP0qyFzpqk=";
+    hash = "sha256-+wID/HSFk/FOUXMmGOHwQlJf1xl2Sg/bDuP2/kE6mys=";
   };
 
   patches = [

pkgs/by-name/gn/gnome-software/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-software";
-  version = "48.2";
+  version = "48.3";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-software/${lib.versions.major finalAttrs.version}/gnome-software-${finalAttrs.version}.tar.xz";
-    hash = "sha256-q/0wZDqGxl9IhrZ2XrO7YhXJ6gmBfWvRZcUAVokIIsk=";
+    hash = "sha256-Emlx6LwADdwgAXjI+sj3EU7tQt5KTiASugaz/+cH4jo=";
   };
 
   patches = [

pkgs/by-name/gn/gnome-user-share/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-user-share";
-  version = "48.0";
+  version = "48.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-user-share/${lib.versions.major finalAttrs.version}/gnome-user-share-${finalAttrs.version}.tar.xz";
-    hash = "sha256-tVgFBwGVwvZYQVuc0shbLNFOqYHWGCOlANTWK4v4OAE=";
+    hash = "sha256-grz9TvPqf9eyr3+6mkW0dOF03NgowcS/5/+KLvhYunc=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {

pkgs/by-name/go/goofcord/package.nix

···
   pnpmDeps = pnpm'.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-8dSyU9arSvISc2kDWbg/CP6L4sZjZi/Zv7TZN4ONOjQ=";
+    fetcherVersion = 1;
   };
 
   env = {

pkgs/by-name/gu/gui-for-clash/package.nix

···
       inherit (finalAttrs) pname version src;
       sourceRoot = "${finalAttrs.src.name}/frontend";
       hash = "sha256-5tz1FItH9AvZhJjka8i5Kz22yf/tEmRPkDhz6iswZzc=";
+      fetcherVersion = 1;
     };
 
     sourceRoot = "${finalAttrs.src.name}/frontend";

pkgs/by-name/gu/gui-for-singbox/package.nix

···
       inherit (finalAttrs) pname version src;
       sourceRoot = "${finalAttrs.src.name}/frontend";
       hash = "sha256-5tz1FItH9AvZhJjka8i5Kz22yf/tEmRPkDhz6iswZzc=";
+      fetcherVersion = 1;
     };
 
     sourceRoot = "${finalAttrs.src.name}/frontend";

pkgs/by-name/he/heroic-unwrapped/package.nix

···
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-9WCIdQ91IU8pfq6kpbmmn6APBTNwpCi9ovgRuWYUad8=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/ho/homebox/package.nix

···
     inherit pname version;
     src = "${src}/frontend";
     hash = "sha256-6Q+tIY5dl5jCQyv1F8btLdJg0oEUGs0Wyu/joVdVhf8=";
+    fetcherVersion = 1;
   };
   pnpmRoot = "../frontend";
 

pkgs/by-name/ho/homepage-dashboard/package.nix

···
       patches
       ;
     hash = "sha256-aPkXHKG3vDsfYqYx9q9+2wZhuFqmPcXdoBqOfAvW9oA=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/ho/homer/package.nix

···
       patches
       ;
     hash = "sha256-y1R+rlaOtFOHHAgEHPBl40536U10Ft0iUSfGcfXS08Y=";
+    fetcherVersion = 1;
   };
 
   # Enables specifying a custom Sass compiler binary path via `SASS_EMBEDDED_BIN_PATH` environment variable.

pkgs/by-name/it/it-tools/package.nix

···
   pnpmDeps = pnpm_8.fetchDeps {
     inherit pname version src;
     hash = "sha256-m1eXBE5rakcq8NGnPC9clAAvNJQrN5RuSQ94zfgGZxw=";
+    fetcherVersion = 1;
   };
 
   buildPhase = ''

pkgs/by-name/je/jellyseerr/package.nix

···
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-Ym16jPHMHKmojMQOuMamDsW/u+oP1UhbCP5dooTUzFQ=";
+    fetcherVersion = 1;
   };
 
   buildInputs = [ sqlite ];

pkgs/by-name/ju/jumpy/package.nix

···
   lib,
   rustPlatform,
   fetchFromGitHub,
+  fetchpatch2,
   makeWrapper,
   pkg-config,
   zstd,
···
   xorg,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "jumpy";
-  version = "0.8.0";
+  version = "0.12.2";
 
   src = fetchFromGitHub {
     owner = "fishfolk";
     repo = "jumpy";
-    rev = "v${version}";
-    sha256 = "sha256-ggePJH2kKJ17aOWRKUnLyolIdSzlc6Axf5Iw74iFfek=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-g/CpSycTCM1i6O7Mir+3huabvr4EXghDApquEUNny8c=";
   };
 
+  # This patch may be removed in the next release
+  cargoPatches = [
+    (fetchpatch2 {
+      url = "https://github.com/fishfolk/jumpy/commit/8234e6d2c0b33c75e2112596ded1734fdba50fb8.patch?full_index=1";
+      hash = "sha256-IWjBw1Wj/6CT/x6xm6vfpUMfk7A5/EsdbPDvWywRFc8=";
+    })
+  ];
+
   useFetchCargoVendor = true;
-  cargoHash = "sha256-hVEpTNTXwOQoxlhOewUvHyfBh+APnx8Fox90CmdMRQ4=";
+  cargoHash = "sha256-2I9s1zH94GRqXGBxZYyXOQwNeYrpV1UhUSKGCs9Ce9Q=";
 
   nativeBuildInputs = [
     makeWrapper
···
   meta = {
     description = "Tactical 2D shooter played by up to 4 players online or on a shared screen";
     mainProgram = "jumpy";
-    homepage = "https://fishfight.org/";
-    changelog = "https://github.com/fishfolk/jumpy/releases/tag/v${version}";
+    homepage = "https://fishfolk.org/games/jumpy";
+    changelog = "https://github.com/fishfolk/jumpy/releases/tag/v${finalAttrs.version}";
     license = with lib.licenses; [
       mit # or
       asl20
+      # Assets
+      cc-by-nc-40
     ];
     maintainers = with lib.maintainers; [ figsoda ];
   };
-}
+})

pkgs/by-name/ka/karakeep/package.nix

···
     };
 
     hash = "sha256-yf8A0oZ0Y4A5k7gfinIU02Lbqp/ygyvIBlldS0pv5+0=";
+    fetcherVersion = 1;
   };
   buildPhase = ''
     runHook preBuild

pkgs/by-name/le/legcord/package.nix

···
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-nobOORfhwlGEvNt+MfDKd3rXor6tJHDulz5oD1BGY4I=";
+    fetcherVersion = 1;
   };
 
   buildPhase = ''

pkgs/by-name/li/libdex/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libdex";
-  version = "0.10.0";
+  version = "0.10.1";
 
   outputs = [
     "out"
···
 
   src = fetchurl {
     url = "mirror://gnome/sources/libdex/${lib.versions.majorMinor finalAttrs.version}/libdex-${finalAttrs.version}.tar.xz";
-    hash = "sha256-mKaWJqp2Rq1FW+p6f5LSof+kfkVZoVShv+mMFvpxHuE=";
+    hash = "sha256-dHLogJDbKyKDB1Be3rpEg+hyaBNAywQErmSsPaW+0KY=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/li/libglycin/package.nix

···
   gtk4,
   gobject-introspection,
   gnome,
+  common-updater-scripts,
+  _experimental-update-script-combinators,
   buildPackages,
   withIntrospection ?
     lib.meta.availableOn stdenv.hostPlatform gobject-introspection
···
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "libglycin";
-  version = "1.2.1";
+  version = "1.2.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "GNOME";
     repo = "glycin";
     tag = finalAttrs.version;
-    hash = "sha256-M4DcWLE40OPB7zIkv4uLj6xTac3LTDcZ2uAO2S/cUz4=";
+    hash = "sha256-K+cR+0a/zRpOvMsX1ZljjJYYOXbHkyDGE9Q9vY1qJBg=";
   };
 
   nativeBuildInputs =
···
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-iNSpLvIi3oZKSRlkwkDJp5i8MdixRvmWIOCzbFHIdHw=";
+    hash = "sha256-zGDmmRbaR2boaf9lLzvW/H7xgMo9uHTmlC0oNupLUos=";
   };
 
   buildInputs = [
···
   ];
 
   passthru = {
-    updateScript = gnome.updateScript {
-      attrPath = "libglycin";
-      packageName = "glycin";
-    };
+    updateScript =
+      let
+        updateSource = gnome.updateScript {
+          attrPath = "libglycin";
+          packageName = "glycin";
+        };
+        updateLockfile = {
+          command = [
+            "sh"
+            "-c"
+            ''
+              PATH=${
+                lib.makeBinPath [
+                  common-updater-scripts
+                ]
+              }
+              update-source-version libglycin --ignore-same-version --source-key=cargoDeps.vendorStaging > /dev/null
+            ''
+          ];
+          # Experimental feature: do not copy!
+          supportedFeatures = [ "silent" ];
+        };
+      in
+      _experimental-update-script-combinators.sequence [
+        updateSource
+        updateLockfile
+      ];
   };
 
   meta = {

pkgs/by-name/ma/mark/package.nix

···
 # https://github.com/kovetskiy/mark/pull/581#issuecomment-2797872996
 buildGoModule rec {
   pname = "mark";
-  version = "14.1.0";
+  version = "14.1.1";
 
   src = fetchFromGitHub {
     owner = "kovetskiy";
     repo = "mark";
     rev = "${version}";
-    sha256 = "sha256-TQU49rPpHCDQEOIfC3R89kdtVMVJrisOXF5DhbRgJQ0=";
+    sha256 = "sha256-jKc5QugqfdjSQjK7SbLG02a9+YdFcweS+91LhdR0Dzg=";
   };
 
-  vendorHash = "sha256-y5WCpL0bJE48iVUO2hPy7AvAx9KEVQJUK6vVwFfob/M=";
+  vendorHash = "sha256-AHtIVp2n5v4YoYfWAsE7eD1QcEFKdjSqzGIlR7+mnxg=";
 
   ldflags = [
     "-s"

pkgs/by-name/me/memos/package.nix

···
       inherit (finalAttrs) pname version src;
       sourceRoot = "${finalAttrs.src.name}/web";
       hash = "sha256-AyQYY1vtBB6DTcieC7nw5aOOVuwESJSDs8qU6PGyaTw=";
+      fetcherVersion = 1;
     };
     pnpmRoot = "web";
     nativeBuildInputs = [

pkgs/by-name/me/metacubexd/package.nix

···
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-Ct/YLnpZb0YBXVaghd5W1bmDcjVRladwQNRoLagHgJo=";
+    fetcherVersion = 1;
   };
 
   buildPhase = ''

pkgs/by-name/mi/misskey/package.nix

···
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-T8LwpEjeWNmkIo3Dn1BCFHBsTzA/Dt6/pk/NMtvT0N4=";
+    fetcherVersion = 1;
   };
 
   buildPhase = ''

pkgs/by-name/ml/mlxbf-bootctl/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "mlxbf-bootctl";
-  version = "1.1-6";
+  version = "unstable-2025-01-16";
 
   src = fetchFromGitHub {
     owner = "Mellanox";
     repo = "mlxbf-bootctl";
-    rev = "mlxbf-bootctl-${version}";
-    hash = "sha256-F49ZZtty+NARXA/doAFLhsQn4XkPW6GWLXGy4waIaM0=";
+    rev = "278160ca8e08251cff5e7989e5a1010bd247a6ae";
+    hash = "sha256-qS35wCb8zvuF2Zs/5hPZkoZAapr7fwKQ/0ZOBPtrkRQ=";
   };
 
   installPhase = ''
···
     # This package is supposed to only run on a BlueField. Thus aarch64-linux
     # is the only relevant platform.
     platforms = [ "aarch64-linux" ];
-    maintainers = with lib.maintainers; [ nikstur ];
+    maintainers = with lib.maintainers; [
+      nikstur
+      thillux
+    ];
   };
 }

pkgs/by-name/ml/mlxbf-bootimages/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "mlxbf-bootimages";
-  version = "4.10.0-13520";
+  version = "4.11.0-13611";
 
   src = fetchurl {
     url = "https://linux.mellanox.com/public/repo/bluefield/${version}/bootimages/prod/${pname}-signed_${version}_arm64.deb";
-    hash = "sha256-lPclxhKmn1hvGXWI1A+Q1yXK7FZzKUcOtBoXG6KRsCA=";
+    hash = "sha256-bZpZ6qnC3Q/BuOngS4ZoU6vjeekPjVom0KdDoJF5iko=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/mo/models-dev/package.nix

···
+{
+  lib,
+  stdenvNoCC,
+  bun,
+  fetchFromGitHub,
+  nix-update-script,
+  writableTmpDirAsHomeHook,
+}:
+
+let
+  models-dev-node-modules-hash = {
+    "aarch64-darwin" = "sha256-2EVW5zQTcqH9zBYAegWj/Wtb0lYHZwA7Bbqs3gRjcx0=";
+    "aarch64-linux" = "sha256-nJgFnszwvknqA21uaqlGQQ1x+4ztKx0/tEvcNrv1LJg=";
+    "x86_64-darwin" = "sha256-Un6UxmvsmBuDdUwcWnu4qb0nPN1V1PFJi4VGVkNh/YU=";
+    "x86_64-linux" = "sha256-nlL+Ayacxz4fm404cABORSVGQcNxb3cB4mOezkrI90U=";
+  };
+in
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "models-dev";
+  version = "0-unstable-2025-07-14";
+  src = fetchFromGitHub {
+    owner = "sst";
+    repo = "models.dev";
+    rev = "2b0849aa20d48c28e2bac1fa3762aec867a2e7c7";
+    hash = "sha256-SC2yOy+6xjiGgRuRJY6wCtzWjFJm/DUy+gSlMXXDgAk=";
+  };
+
+  node_modules = stdenvNoCC.mkDerivation {
+    pname = "models-dev-node_modules";
+    inherit (finalAttrs) version src;
+
+    impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [
+      "GIT_PROXY_COMMAND"
+      "SOCKS_SERVER"
+    ];
+
+    nativeBuildInputs = [
+      bun
+      writableTmpDirAsHomeHook
+    ];
+
+    dontConfigure = true;
+
+    buildPhase = ''
+      runHook preBuild
+
+       export BUN_INSTALL_CACHE_DIR=$(mktemp -d)
+
+       bun install \
+         --force \
+         --frozen-lockfile \
+         --no-progress
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/node_modules
+      cp -R ./node_modules $out
+
+      runHook postInstall
+    '';
+
+    # Required else we get errors that our fixed-output derivation references store paths
+    dontFixup = true;
+
+    outputHash = models-dev-node-modules-hash.${stdenvNoCC.hostPlatform.system};
+    outputHashAlgo = "sha256";
+    outputHashMode = "recursive";
+  };
+
+  nativeBuildInputs = [ bun ];
+
+  configurePhase = ''
+    runHook preConfigure
+
+    cp -R ${finalAttrs.node_modules}/node_modules .
+
+    runHook postConfigure
+  '';
+
+  preBuild = ''
+    patchShebangs packages/web/script/build.ts
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    cd packages/web
+    bun run build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/dist
+    cp -R ./dist $out
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch" ];
+  };
+
+  meta = {
+    description = "Comprehensive open-source database of AI model specifications, pricing, and capabilities";
+    homepage = "https://github.com/sst/models-dev";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ delafthi ];
+  };
+})

pkgs/by-name/mo/modrinth-app-unwrapped/package.nix

···
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-Q6e942R+3+511qFe4oehxdquw1TgaWMyOGOmP3me54o=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/mo/moonfire-nvr/package.nix

···
       inherit (finalAttrs) pname version src;
       sourceRoot = "${finalAttrs.src.name}/ui";
       hash = "sha256-7fMhUFlV5lz+A9VG8IdWoc49C2CTdLYQlEgBSBqJvtw=";
+      fetcherVersion = 1;
     };
     installPhase = ''
       runHook preInstall

pkgs/by-name/mo/moonlight/package.nix

···
     buildInputs = [ nodejs_22 ];
 
     hash = "sha256-vrSfrAnLc30kba+8VOPawdp8KaQVUhsD6mUq+YdAJTY=";
+    fetcherVersion = 1;
   };
 
   env = {

pkgs/by-name/mu/mutter/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mutter";
-  version = "48.3.1";
+  version = "48.4";
 
   outputs = [
     "out"
···
 
   src = fetchurl {
     url = "mirror://gnome/sources/mutter/${lib.versions.major finalAttrs.version}/mutter-${finalAttrs.version}.tar.xz";
-    hash = "sha256-BvimrX/0+HOa9q8uF1PJHfp7mDl+UpRmMloQGMeVCmo=";
+    hash = "sha256-EYnPfmPMh8/dHzqG6PFNl8M9ap2iVPI+gWVVSbbFDZM=";
   };
 
   mesonFlags = [

pkgs/by-name/n8/n8n/package.nix

···
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-HzJej2Mt110n+1KX0wzuAn6j69zQOzI42EGxQB6PYbc=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs =

pkgs/by-name/na/nautilus/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nautilus";
-  version = "48.2";
+  version = "48.3";
 
   outputs = [
     "out"
···
 
   src = fetchurl {
     url = "mirror://gnome/sources/nautilus/${lib.versions.major finalAttrs.version}/nautilus-${finalAttrs.version}.tar.xz";
-    hash = "sha256-oDD2Fj+KaAZPrlqeieN/Gcuyk94uEqGd1eIQlW0N9LU=";
+    hash = "sha256-IaKuoAUWDbCDx6HU0sCYm4RcxyLATvnrtgElp+xbOT0=";
   };
 
   patches = [

pkgs/by-name/ni/ni/package.nix

···
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-gDBjAwut217mdbWyk/dSU4JOkoRbOk4Czlb/lXhWqRU=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/oc/ocis/package.nix

···
     inherit pname version src;
     sourceRoot = "${src.name}/services/idp";
     hash = "sha256-gNlN+u/bobnTsXrsOmkDcWs67D/trH3inT5AVQs3Brs=";
+    fetcherVersion = 1;
   };
   pnpmRoot = "services/idp";
 

pkgs/by-name/oc/ocis/web.nix

···
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
     hash = "sha256-3Erva6srdkX1YQ727trx34Ufx524nz19MUyaDQToz6M=";
+    fetcherVersion = 1;
   };
 
   meta = {

pkgs/by-name/op/opencloud/idp-web.nix

···
     inherit (finalAttrs) pname version src;
     sourceRoot = "${finalAttrs.src.name}/${finalAttrs.pnpmRoot}";
     hash = "sha256-yseRO1tClLTRpQj5BzMscElUlgLEzj1u8ndT1+di2+Y=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/op/opencloud/web.nix

···
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-7wwviWveMf+xnYmO05MI3XuPVZ/pcSqQi4sGjrEdjGc=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/op/opencode/package.nix

···
 
 let
   opencode-node-modules-hash = {
-    "aarch64-darwin" = "sha256-+eXXWskZg0CIY12+Ee4Y3uwpB5I92grDiZ600Whzx/I=";
-    "aarch64-linux" = "sha256-rxLPrYAIiKDh6de/GACPfcYXY7nIskqAu1Xi12y5DpU=";
-    "x86_64-darwin" = "sha256-LOz7N6gMRaZLPks+y5fDIMOuUCXTWpHIss1v0LHPnqw=";
-    "x86_64-linux" = "sha256-GKLR+T+lCa7GFQr6HqSisfa4uf8F2b79RICZmePmCBE=";
+    "aarch64-darwin" = "sha256-uk8HQfHCKTAW54rNHZ1Rr0piZzeJdx6i4o0+xKjfFZs=";
+    "aarch64-linux" = "sha256-gDQh8gfFKl0rAujtos1XsCUnxC2Vjyq9xH5FLZoNW5s=";
+    "x86_64-darwin" = "sha256-H5+qa7vxhwNYRXUo4v8IFUToVXtyXzU3veIqu4idAbU=";
+    "x86_64-linux" = "sha256-1ZxetDrrRdNNOfDOW2uMwMwpEs5S3BLF+SejWcRdtik=";
   };
   bun-target = {
     "aarch64-darwin" = "bun-darwin-arm64";
···
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "opencode";
-  version = "0.1.194";
+  version = "0.2.33";
   src = fetchFromGitHub {
     owner = "sst";
     repo = "opencode";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-51Mc0Qrg3C0JTpXl2OECKEUvle+6X+j9+/Blu8Nu9Ao=";
+    hash = "sha256-l/V9YHwuIPN73ieMT++enL1O5vecA9L0qBDGr8eRVxY=";
   };
 
   tui = buildGoModule {
···
     inherit (finalAttrs) version;
     src = "${finalAttrs.src}/packages/tui";
 
-    vendorHash = "sha256-hxtQHlaV2Em8CyTK3BNaoo/LgnGbMjj5XafbleF+p9I=";
+    vendorHash = "sha256-0vf4fOk32BLF9/904W8g+5m0vpe6i6tUFRXqDHVcMIQ=";
 
     subPackages = [ "cmd/opencode" ];
 
···
 
   nativeBuildInputs = [ bun ];
 
-  patches = [ ./fix-models-macro.patch ];
+  patches = [
+    # Patch `packages/opencode/src/provider/models-macro.ts` to load the prefetched `models.dev/api.json`
+    # from the `MODELS_JSON` environment variable instead of fetching it at build time.
+    ./fix-models-macro.patch
+  ];
 
   configurePhase = ''
     runHook preConfigure
···
   installPhase = ''
     runHook preInstall
 
-    mkdir -p $out/bin
     install -Dm755 opencode $out/bin/opencode
 
     runHook postInstall

pkgs/by-name/op/openlist/frontend.nix

···
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-PTZ+Vhg3hNnORnulkzuVg6TF/jY0PvUWYja9z7S4GdM=";
+    fetcherVersion = 1;
   };
 
   buildPhase = ''

pkgs/by-name/or/orthanc/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "orthanc";
-  version = "1.12.7";
+  version = "1.12.8";
 
   src = fetchhg {
     url = "https://orthanc.uclouvain.be/hg/orthanc/";
     rev = "Orthanc-${finalAttrs.version}";
-    hash = "sha256-aWUA8cCnWff5Tl8PWGJJtERlGh4GX4a8hTG9E2ADG9k=";
+    hash = "sha256-ktfTqCid/0aYAp5HPB7niZ1sw+zMNmd5mhZrXRbMGyk=";
   };
 
   outputs = [

pkgs/by-name/ov/overlayed/package.nix

···
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
     hash = "sha256-+yyxoodcDfqJ2pkosd6sMk77/71RDsGthedo1Oigwto=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/pa/paperless-ngx/package.nix

···
       pnpmDeps = pnpm.fetchDeps {
         inherit pname version src;
         hash = "sha256-VtYYwpMXPAC3g1OESnw3dzLTwiGqJBQcicFZskEucok=";
+        fetcherVersion = 1;
       };
 
       nativeBuildInputs =
···
       concurrent-log-handler
       dateparser
       django
-      django-allauth
+      # django-allauth version 65.9.X not yet supported
+      # See https://github.com/paperless-ngx/paperless-ngx/issues/10336
+      (django-allauth.overrideAttrs (
+        new: prev: rec {
+          version = "65.7.0";
+          src = prev.src.override {
+            tag = version;
+            hash = "sha256-1HmEJ5E4Vp/CoyzUegqQXpzKUuz3dLx2EEv7dk8fq8w=";
+          };
+        }
+      ))
       django-auditlog
       django-celery-results
       django-compression-middleware

pkgs/by-name/pa/parallel-disk-usage/package.nix

···
 }:
 rustPlatform.buildRustPackage rec {
   pname = "parallel-disk-usage";
-  version = "0.12.0";
+  version = "0.13.1";
 
   src = fetchFromGitHub {
     owner = "KSXGitHub";
     repo = "parallel-disk-usage";
     rev = version;
-    hash = "sha256-Wj19lWepCrZe36njX+NMdpwXeRRh3ml9jKbbi7irrpg=";
+    hash = "sha256-gzjNi7ujYe7OZKYyrYk1xqqo/k8yBJdIwRoNASm5Db4=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-UK+jonM/ZBGoCKFcQlCo5OqYtKeU0VIWtx83oBh3lJQ=";
+  cargoHash = "sha256-3U61AkCicX7VNh1bf0IHPH5YX7qAtp4PvWi8FRKoBQI=";
 
   meta = with lib; {
     description = "Highly parallelized, blazing fast directory tree analyzer";

pkgs/by-name/pa/parca/package.nix

···
     pnpmDeps = pnpm_9.fetchDeps {
       inherit (finalAttrs) pname src version;
       hash = "sha256-gczEkCU9xESn9T1eVOmGAufh+24mOsYCMO6f5tcbdmQ=";
+      fetcherVersion = 1;
     };
 
     nativeBuildInputs = [

pkgs/by-name/pd/pds/package.nix

···
       sourceRoot
       ;
     hash = "sha256-KyHa7pZaCgyqzivI0Y7E6Y4yBRllYdYLnk1s0o0dyHY=";
+    fetcherVersion = 1;
   };
 
   buildPhase = ''

pkgs/by-name/pg/pgrok/package.nix

···
   env.pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
     hash = "sha256-o6wxO8EGRmhcYggJnfxDkH+nbt+isc8bfHji8Hu9YKg=";
+    fetcherVersion = 1;
   };
 
   vendorHash = "sha256-nIxsG1O5RG+PDSWBcUWpk+4aFq2cYaxpkgOoDqLjY90=";

pkgs/by-name/pi/piped/package.nix

···
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
     hash = "sha256-WtZfRZFRV9I1iBlAoV69GGFjdiQhTSBG/iiEadPVcys=";
+    fetcherVersion = 1;
   };
 
   passthru.updateScript = unstableGitUpdater { };

pkgs/by-name/po/podman-desktop/package.nix

···
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-8lNmCLfuAkXK1Du4iYYasRTozZf0HoAttf8Dfc6Jglw=";
+    fetcherVersion = 1;
   };
 
   patches = [

pkgs/by-name/po/porn-vault/package.nix

···
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-Xr9tRiP1hW+aFs9FnPvPkeJ0/LtJI57cjWY5bZQaRTQ=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/po/pot/package.nix

···
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-iYQNGRWqXYBU+WIH/Xm8qndgOQ6RKYCtAyi93kb7xrQ=";
+    fetcherVersion = 1;
   };
 
   cargoRoot = "src-tauri";

pkgs/by-name/pr/presenterm/package.nix

···
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "presenterm";
-  version = "0.14.0";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "mfontanini";
     repo = "presenterm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vBEHk0gQe4kUTtH4qtc0jVfDvYGabnkJrwPxmxt10hs=";
+    hash = "sha256-6ziPuWbPOsSwlnqVN1cKaOvxVk3axFnPBsnCIZz2iTg=";
   };
 
   nativeBuildInputs =
···
   ];
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-u0wOWKAfzi1Fxmx6x2ckrIv/PKgtqKrDiDauD4/BY24=";
+  cargoHash = "sha256-UOPX5+RnnAStrsvBbL211m5NzYFjqbpIG/sdvoej1Rc=";
 
   env = lib.optionalAttrs (isDarwin && isx86_64) {
     NIX_CFLAGS_LINK = "-fuse-ld=lld";

pkgs/by-name/pr/prisma/package.nix

···
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-dhEpn0oaqZqeiRMfcSiaqhud/RsKd6Wm5RR5iyQp1I8=";
+    fetcherVersion = 1;
   };
 
   patchPhase = ''

pkgs/by-name/pr/proxysql/makefiles.patch

···
 diff --git a/Makefile b/Makefile
-index dd6b8c44..7a703858 100644
+index b9ad6f71..60e71a86 100644
 --- a/Makefile
 +++ b/Makefile
-@@ -73,10 +73,7 @@ endif
+@@ -81,10 +81,7 @@ endif
  export MAKEOPT := -j${NPROCS}
  
  ### systemd
···
  
  ### check user/group
  USERCHECK := $(shell getent passwd proxysql)
-@@ -238,7 +235,7 @@ build_tap_test_debug: build_tap_tests_debug
- build_tap_tests_debug: build_src_debug
- 	cd test/tap && OPTZ="${O0} -ggdb -DDEBUG" CC=${CC} CXX=${CXX} ${MAKE} debug
- 
--# ClickHouse build targets are now default build targets. 
-+# ClickHouse build targets are now default build targets.
- # To maintain backward compatibility, ClickHouse targets are still available.
- .PHONY: build_deps_clickhouse
- build_deps_clickhouse: build_deps_default
-@@ -382,16 +379,10 @@ cleanbuild:
+@@ -415,16 +412,10 @@ cleanbuild:
  
  .PHONY: install
  install: src/proxysql
···
  	install -m 0755 etc/init.d/proxysql /etc/init.d
  ifeq ($(DISTRO),"CentOS Linux")
 diff --git a/deps/Makefile b/deps/Makefile
-index 25bcc603..8fafc224 100644
+index 7c8fcc85..4ae0aba1 100644
 --- a/deps/Makefile
 +++ b/deps/Makefile
-@@ -54,10 +54,7 @@ default: $(targets)
+@@ -61,27 +61,22 @@ default: $(targets)
  ### deps targets
  
  libinjection/libinjection/src/libinjection.a:
···
 -	cd libinjection/libinjection && patch -p1 < ../update-build-py3.diff
  	cd libinjection/libinjection && patch -p1 < ../libinjection_sqli.c.patch
  endif
- ifeq ($(SYS_KERN),Darwin)
-@@ -71,11 +68,7 @@ libinjection: libinjection/libinjection/src/libinjection.a
- 
+ ifeq ($(UNAME_S),Darwin)
+ 	sed -i '' 's/CC=/CC?=/' libinjection/libinjection/src/Makefile
+ else
+ 	sed -i -e 's/CC=/CC?=/' libinjection/libinjection/src/Makefile
+ endif
+ 	cd libinjection/libinjection && CC=${CC} CXX=${CXX} ${MAKE}
  
- libssl/openssl/libssl.a:
--	cd libssl && rm -rf openssl-openssl-*/ openssl-3*/ || true
--	cd libssl && tar -zxf openssl-*.tar.gz
- 	cd libssl && ./verify-bio_st-match.sh
--#	cd libssl/openssl && patch crypto/ec/curve448/curve448.c < ../curve448.c-multiplication-overflow.patch
--#	cd libssl/openssl && patch crypto/asn1/a_time.c < ../a_time.c-multiplication-overflow.patch
- 	cd libssl/openssl && ./config no-ssl3 no-tests
- 	cd libssl/openssl && CC=${CC} CXX=${CXX} ${MAKE}
- 	cd libssl/openssl && ln -fs ./ lib # curl wants this path
-@@ -84,8 +77,6 @@ libssl: libssl/openssl/libssl.a
+ libinjection: libinjection/libinjection/src/libinjection.a
  
+ include ../common_mk/openssl_flags.mk
+ include ../common_mk/openssl_version_check.mk
  
  libhttpserver/libhttpserver/build/src/.libs/libhttpserver.a: libmicrohttpd/libmicrohttpd/src/microhttpd/.libs/libmicrohttpd.a re2/re2/obj/libre2.a
 -	cd libhttpserver && rm -rf libhttpserver-*/ || true
···
  	cd libhttpserver/libhttpserver && patch -p1 < ../noexcept.patch
  	cd libhttpserver/libhttpserver && patch -p1 < ../re2_regex.patch
  	cd libhttpserver/libhttpserver && patch -p1 < ../final_val_post_process.patch
-@@ -103,8 +94,6 @@ libhttpserver: libhttpserver/libhttpserver/build/src/.libs/libhttpserver.a
+@@ -99,58 +94,49 @@ libhttpserver: libhttpserver/libhttpserver/build/src/.libs/libhttpserver.a
  
  
  libev/libev/.libs/libev.a:
···
  	cd libev/libev && patch ev.c < ../ev.c-multiplication-overflow.patch
  	cd libev/libev && ./configure
  	cd libev/libev && CC=${CC} CXX=${CXX} ${MAKE}
-@@ -121,8 +110,6 @@ coredumper/coredumper/src/libcoredumper.a:
+ 
+ ev: libev/libev/.libs/libev.a
+ 
+ 
+ coredumper/coredumper/src/libcoredumper.a:
+ 	cd coredumper && rm -rf coredumper-*/ || true
+ 	cd coredumper && tar -zxf coredumper-*.tar.gz
+ 	cd coredumper/coredumper && patch -p1 < ../includes.patch
+ 	cd coredumper/coredumper && cmake . -DBUILD_TESTING=OFF -DBUILD_SHARED_LIBS=OFF -DCMAKE_BUILD_TYPE=Debug
+ 	cd coredumper/coredumper && CC=${CC} CXX=${CXX} ${MAKE}
  coredumper: coredumper/coredumper/src/libcoredumper.a
  
- curl/curl/lib/.libs/libcurl.a: libssl/openssl/libssl.a
+ curl/curl/lib/.libs/libcurl.a:
 -	cd curl && rm -rf curl-*/ || true
 -	cd curl && tar -zxf curl-*.tar.gz
  #	cd curl/curl && ./configure --disable-debug --disable-ftp --disable-ldap --disable-ldaps --disable-rtsp --disable-proxy --disable-dict --disable-telnet --disable-tftp --disable-pop3 --disable-imap --disable-smb --disable-smtp --disable-gopher --disable-manual --disable-ipv6 --disable-sspi --disable-crypto-auth --disable-ntlm-wb --disable-tls-srp --without-nghttp2 --without-libidn2 --without-libssh2 --without-brotli --with-ssl=$(shell pwd)/../../libssl/openssl/ && CC=${CC} CXX=${CXX} ${MAKE}
  	cd curl/curl && autoreconf -fi
- ifeq ($(SYS_KERN),Darwin)
-@@ -134,9 +121,6 @@ curl: curl/curl/lib/.libs/libcurl.a
+ ifeq ($(UNAME_S),Darwin)
+ 	cd curl/curl && patch configure < ../configure.patch
+ endif
+ 	cd curl/curl && CPPFLAGS="-I$(SSL_IDIR)" LDFLAGS="$(LIB_SSL_PATH) $(LIB_CRYPTO_PATH)" ./configure --disable-debug --disable-ftp --disable-ldap --disable-ldaps --disable-rtsp --disable-proxy --disable-dict --disable-telnet --disable-tftp --disable-pop3 --disable-imap --disable-smb --disable-smtp --disable-gopher --disable-manual --disable-ipv6 --disable-sspi --disable-ntlm-wb --disable-tls-srp --without-nghttp2 --without-libidn2 --without-libssh2 --without-brotli --without-librtmp --without-libpsl --without-zstd --with-ssl --enable-shared=yes
+ 	cd curl/curl && CFLAGS=-fPIC CC=${CC} CXX=${CXX} ${MAKE}
+ 
+ curl: curl/curl/lib/.libs/libcurl.a
  
  
  libmicrohttpd/libmicrohttpd/src/microhttpd/.libs/libmicrohttpd.a:
···
  	cd libmicrohttpd/libmicrohttpd && ./configure --enable-https && CC=${CC} CXX=${CXX} ${MAKE}
  
  microhttpd: libmicrohttpd/libmicrohttpd/src/microhttpd/.libs/libmicrohttpd.a
-@@ -152,8 +136,6 @@ cityhash: cityhash/cityhash/src/.libs/libcityhash.a
+ 
+ 
+ cityhash/cityhash/src/.libs/libcityhash.a:
+ 	cd cityhash && rm -rf cityhash-*/ || true
+ 	cd cityhash && tar -zxf cityhash-*.tar.gz
+ 	cd cityhash/cityhash && cp ../config.guess . && chmod +x config.guess && cp ../config.sub . && chmod +x config.sub
+ 	cd cityhash/cityhash && ./configure && CC=${CC} CXX=${CXX} ${MAKE}
+ 
+ cityhash: cityhash/cityhash/src/.libs/libcityhash.a
  
  
  lz4/lz4/lib/liblz4.a:
···
  	cd lz4/lz4 && CC=${CC} CXX=${CXX} ${MAKE}
  
  lz4: lz4/lz4/lib/liblz4.a
-@@ -171,8 +153,6 @@ clickhouse-cpp: clickhouse-cpp/clickhouse-cpp/clickhouse/libclickhouse-cpp-lib-s
+@@ -168,8 +154,6 @@ clickhouse-cpp: clickhouse-cpp/clickhouse-cpp/clickhouse/libclickhouse-cpp-lib-s
  
  
  libdaemon/libdaemon/libdaemon/.libs/libdaemon.a:
···
  	cd libdaemon/libdaemon && patch -p0 < ../daemon_fork_umask.patch
  	cd libdaemon/libdaemon && cp ../config.guess . && chmod +x config.guess && cp ../config.sub . && chmod +x config.sub && ./configure --disable-examples
  	cd libdaemon/libdaemon && CC=${CC} CXX=${CXX} ${MAKE}
-@@ -256,8 +236,6 @@ sqlite3: sqlite3/sqlite3/sqlite3.o
- 
+@@ -253,18 +237,13 @@ sqlite3/sqlite3/sqlite3.o:
+ sqlite3: sqlite3/sqlite3/sqlite3.o
  
  libconfig/libconfig/lib/.libs/libconfig++.a:
 -	cd libconfig && rm -rf libconfig-*/ || true
···
  	cd libconfig/libconfig && ./configure --disable-examples
  	cd libconfig/libconfig && CC=${CC} CXX=${CXX} ${MAKE}
  
-@@ -265,9 +243,6 @@ libconfig: libconfig/libconfig/lib/.libs/libconfig++.a
+ libconfig: libconfig/libconfig/lib/.libs/libconfig++.a
  
  
  prometheus-cpp/prometheus-cpp/lib/libprometheus-cpp-core.a:
···
  	cd prometheus-cpp/prometheus-cpp && patch -p1 < ../serial_exposer.patch
  	cd prometheus-cpp/prometheus-cpp && patch -p1 < ../registry_counters_reset.patch
  	cd prometheus-cpp/prometheus-cpp && patch -p1 < ../fix_old_distros.patch
-@@ -296,8 +271,6 @@ re2: re2/re2/obj/libre2.a
+@@ -293,17 +272,13 @@ re2: re2/re2/obj/libre2.a
  
  
  pcre/pcre/.libs/libpcre.a:
···
  	cd pcre/pcre && patch pcretest.c < ../pcretest.c-multiplication-overflow.patch
  	cd pcre/pcre && ./configure
  	cd pcre/pcre && CC=${CC} CXX=${CXX} ${MAKE}
-@@ -334,4 +307,3 @@ cleanall:
- 	cd cityhash && rm -rf cityhash-*/ || true
- 	cd coredumper && rm -rf coredumper-*/ || true
+ 
+ pcre: pcre/pcre/.libs/libpcre.a
+ 
+ postgresql/postgresql/src/interfaces/libpq/libpq.a:
+-	cd postgresql && rm -rf postgresql-*/ || true
+-	cd postgresql && tar -zxf postgresql-*.tar.gz
+ 	cd postgresql/postgresql && patch -p0 < ../get_result_from_pgconn.patch
+ 	cd postgresql/postgresql && patch -p0 < ../handle_row_data.patch
+ 	#cd postgresql/postgresql && LD_LIBRARY_PATH="$(shell pwd)/libssl/openssl" ./configure --with-ssl=openssl --with-includes="$(shell pwd)/libssl/openssl/include/" --with-libraries="$(shell pwd)/libssl/openssl/" --without-readline --enable-debug  CFLAGS="-ggdb -O0 -fno-omit-frame-pointer" CPPFLAGS="-g -O0"
+@@ -360,4 +335,3 @@ cleanall:
+ 	cd libusual && rm -rf libusual-*/ || true
+ 	cd libscram && rm -rf lib/* obj/* || true
  .PHONY: cleanall
 -

pkgs/by-name/pr/proxysql/package.nix

···
   automake,
   bison,
   cmake,
+  pkg-config,
   libtool,
   civetweb,
   coreutils,
···
   prometheus-cpp,
   zlib,
   texinfo,
+  postgresql_16,
+  icu,
+  libevent,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "proxysql";
-  version = "2.7.1";
+  version = "3.0.1";
 
   src = fetchFromGitHub {
     owner = "sysown";
     repo = "proxysql";
-    rev = finalAttrs.version;
-    hash = "sha256-Ouz1SSc35gQaJcVQO95azkxNgLxuY712ELAwM5buEtY=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-yGxn46Vm8YdtIvvoTlOHQ1aAP2J/h/kFqr4ehruDsTw=";
   };
 
   patches = [
···
     cmake
     libtool
     perl
+    pkg-config
     python3
     texinfo # for makeinfo
   ];
···
     curl
     flex
     gnutls
+    icu
+    libevent
     libgcrypt
     libuuid
+    openssl
     zlib
   ];
 
···
                 p = libmicrohttpd;
               }
               {
-                f = "libssl";
-                p = openssl;
-              }
-              {
                 f = "lz4";
                 p = lz4;
               }
···
                   }
                 );
               }
+              {
+                f = "postgresql";
+                p = postgresql_16;
+              }
             ]
         )
       }
···
       pushd prometheus-cpp/prometheus-cpp/3rdparty
       replace_dep . "${civetweb.src}" civetweb
       popd
-
-      sed -i s_/usr/bin/env_${coreutils}/bin/env_g libssl/openssl/config
 
       pushd libmicrohttpd/libmicrohttpd
       autoreconf

pkgs/by-name/qm/qmapshack/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  qt6,
+  qt6Packages,
+  alglib,
+  gdal,
+  proj,
+  routino,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "qmapshack";
+  version = "1.18.0";
+
+  src = fetchFromGitHub {
+    owner = "Maproom";
+    repo = "qmapshack";
+    tag = "V_${finalAttrs.version}";
+    hash = "sha256-+M76EZeZOsBQ7RXtVplsrbrDgU0plRAht4/jz/GpIhM=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    qt6.qttools
+    qt6.wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    alglib
+    gdal
+    proj
+    routino
+    qt6.qtwebengine
+    qt6Packages.quazip
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeFeature "ALGLIB_INCLUDE_DIRS" "${alglib}/include/alglib")
+    (lib.cmakeFeature "ALGLIB_LIBRARIES" "alglib3")
+    (lib.cmakeFeature "ROUTINO_XML_PATH" "${routino}/share/routino")
+  ];
+
+  qtWrapperArgs = [
+    "--suffix PATH : ${
+      lib.makeBinPath [
+        gdal
+        routino
+      ]
+    }"
+  ];
+
+  meta = {
+    description = "Consumer grade GIS software";
+    homepage = "https://github.com/Maproom/qmapshack";
+    changelog = "https://github.com/Maproom/qmapshack/blob/V_${finalAttrs.version}/changelog.txt";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [
+      dotlambda
+      sikmir
+    ];
+    platforms = lib.platforms.linux;
+  };
+})

pkgs/by-name/qu/quantframe/package.nix

···
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-3IHwwbl1aH3Pzh9xq2Jfev9hj6/LXZaVaIJOPbgsquE=";
+    fetcherVersion = 1;
   };
 
   useFetchCargoVendor = true;

pkgs/by-name/re/readest/package.nix

···
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-lez75n3dIM4efpP+qPuDteCfMnC6wPD+L2173iJbTZM=";
+    fetcherVersion = 1;
   };
 
   pnpmRoot = "../..";

pkgs/by-name/re/renovate/package.nix

···
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-XOlFJFFyzbx8Bg92HXhVFFCI51j2GUK7+LJKfqVOQyU=";
+    fetcherVersion = 1;
   };
 
   env.COREPACK_ENABLE_STRICT = 0;

pkgs/by-name/rm/rmfakecloud/package.nix

···
     sourceRoot = "${src.name}/ui";
     pnpmLock = "${src}/ui/pnpm-lock.yaml";
     hash = "sha256-VNmCT4um2W2ii8jAm+KjQSjixYEKoZkw7CeRwErff/o=";
+    fetcherVersion = 1;
   };
   preBuild = lib.optionals enableWebui ''
     # using sass-embedded fails at executing node_modules/sass-embedded-linux-x64/dart-sass/src/dart

pkgs/by-name/rq/rquickshare/package.nix

···
       ;
     postPatch = "cd ${pnpmRoot}";
     hash = app-type-either "sha256-V46V/VPwCKEe3sAp8zK0UUU5YigqgYh1GIOorqIAiNE=" "sha256-8QRigYNtxirXidFFnTzA6rP0+L64M/iakPqe2lZKegs=";
+    fetcherVersion = 1;
   };
 
   useFetchCargoVendor = true;

pkgs/by-name/rs/rshim-user-space/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "rshim-user-space";
-  version = "2.2.4";
+  version = "2.4.2";
 
   src = fetchFromGitHub {
     owner = "Mellanox";
     repo = "rshim-user-space";
     rev = "rshim-${version}";
-    hash = "sha256-z0Uk520vsBERbeVtxBqXPXSWhO0sLD5GCQy1dQsJdEg=";
+    hash = "sha256-J/gCACqpUY+KraVOLWpd+UVyZ1f2o77EfpAgUVtZL9w=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/rs/rsshub/package.nix

···
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-7qh6YZbIH/kHVssDZxHY7X8bytrnMcUq0MiJzWZYItc=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/sa/satisfactorymodmanager/package.nix

···
       inherit pname version src;
       sourceRoot = "${src.name}/frontend";
       hash = "sha256-OP+3zsNlvqLFwvm2cnBd2bj2Kc3EghQZE3hpotoqqrQ=";
+      fetcherVersion = 1;
     };
 
     pnpmRoot = "frontend";

pkgs/by-name/sh/shadcn/package.nix

···
       pnpmWorkspaces
       ;
     hash = "sha256-/80LJm65ZRqyfhsNqGl83bsI2wjgVkvrA6Ij4v8rtoQ=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/sh/sharkey/package.nix

···
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-S8LxawbtguFOEZyYbS1FQWw/TcRm4Z6mG7dUhfXbf1c=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs =

pkgs/by-name/si/signal-desktop/package.nix

···
     pnpmDeps = pnpm.fetchDeps {
       inherit (finalAttrs) pname src version;
       hash = "sha256-cT7Ixl/V/mesPHvJUsG63Y/wXwKjbjkjdjP3S7uEOa0=";
+      fetcherVersion = 1;
     };
 
     strictDeps = true;
···
         "sha256-ry7s9fbKx4e1LR8DlI2LIJY9GQrxmU7JQt+3apJGw/M="
       else
         "sha256-AkrfugpNvk4KgesRLQbso8p5b96Dg174R9/xuP4JtJg=";
+    fetcherVersion = 1;
   };
 
   env = {

pkgs/by-name/si/signal-desktop/signal-sqlcipher.nix

···
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-regaYG+SDvIgdnHQVR1GG1A1FSBXpzFfLuyTEdMt1kQ=";
+    fetcherVersion = 1;
   };
 
   cargoRoot = "deps/extension";

pkgs/by-name/si/siyuan/package.nix

···
       postPatch
       ;
     hash = "sha256-eSf4mpKBm1G4K9+V6VXEiPrIVQMyru7o9BGVIUycQaQ=";
+    fetcherVersion = 1;
   };
 
   sourceRoot = "${finalAttrs.src.name}/app";

pkgs/by-name/sk/sketchybar-app-font/package.nix

···
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-NGAgueJ+cuK/csjdf94KNklu+Xf91BHoWKVgEctX6eA=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/sl/slimevr/package.nix

···
     pname = "${pname}-pnpm-deps";
     inherit version src;
     hash = "sha256-lh5IKdBXuH9GZFUTrzaQFDWCEYj0UJhKwCdPmsiwfCs=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/sm/smartgit/package.nix

···
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "smartgit";
-  version = "24.1.3";
+  version = "24.1.4";
 
   src = fetchurl {
     url = "https://www.syntevo.com/downloads/smartgit/smartgit-linux-${
       builtins.replaceStrings [ "." ] [ "_" ] finalAttrs.version
     }.tar.gz";
-    hash = "sha256-YhgE1Y0L8lzefJnvswKwIFnx6XIo40DszAr/cxOoOds=";
+    hash = "sha256-1JKFSIGUE8b1yWBg41x+HRWgmg5prZF2+ND/SId4NVs=";
   };
 
   nativeBuildInputs = [ wrapGAppsHook3 ];

pkgs/by-name/sp/splayer/package.nix

···
   pnpmDeps = final.pnpm.fetchDeps {
     inherit (final) pname version src;
     hash = "sha256-mC1iJtkZpTd2Vte5DLI3ntZ7vSO5Gka2qOk7ihQd3Gs=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/st/stylelint-lsp/package.nix

···
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-PVA6sXbiuxqvi9u3sPoeVIJSSpSbFQHQQnTFO3w31WE=";
+    fetcherVersion = 1;
   };
 
   buildPhase = ''

pkgs/by-name/su/surrealist/package.nix

···
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-oreeV9g16/F7JGLApi0Uq+vTqNhIg7Lg1Z4k00RUOYI=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/sy/synchrony/package.nix

···
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-+hS4UK7sncCxv6o5Yl72AeY+LSGLnUTnKosAYB6QsP0=";
+    fetcherVersion = 1;
   };
 
   buildPhase = ''

pkgs/by-name/sy/syncyomi/package.nix

···
         sourceRoot
         ;
       hash = "sha256-edcZIqshnvM3jJpZWIR/UncI0VCMLq26h/n3VvV/384=";
+      fetcherVersion = 1;
     };
 
     nativeBuildInputs = [

pkgs/by-name/ta/tabby-agent/package.nix

···
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-SiJJxRzmKQxqw3UESN7q+3qkU1nK+7z6K5RpIMRRces=";
+    fetcherVersion = 1;
   };
 
   passthru.updateScript = nix-update-script {

pkgs/by-name/ta/tailwindcss-language-server/package.nix

···
       pnpmWorkspaces
       ;
     hash = "sha256-SUEq20gZCiTDkFuNgMc5McHBPgW++8P9Q1MJb7a7pY8=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/ta/taler-wallet-core/package.nix

···
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-pLe5smsXdzSBgz/OYNO5FVEI2L6y/p+jMxEkzqUaX34=";
+    fetcherVersion = 1;
   };
 
   buildInputs = [ nodejs_20 ];

pkgs/by-name/ta/tana/package.nix

···
     stdenv.cc.cc
     stdenv.cc.libc
   ];
-  version = "1.0.36";
+  version = "1.0.37";
 in
 stdenv.mkDerivation {
   pname = "tana";
···
 
   src = fetchurl {
     url = "https://github.com/tanainc/tana-desktop-releases/releases/download/v${version}/tana_${version}_amd64.deb";
-    hash = "sha256-dDB2RcTk58IQGqNGepaIvxGhR0/soWWDbBXxnSEYkdw=";
+    hash = "sha256-S7aihKoeP1zJpMd+mdb6D9QEtFBghyVU+K0nSzGd2ew=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ta/taze/package.nix

···
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-aUMV2REINp5LDcj1s8bgQAj/4508UEewu+ebD+JT0+M=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/te/teleport/package.nix

···
     pnpmDeps = pnpm_10.fetchDeps {
       inherit src pname version;
       hash = pnpmHash;
+      fetcherVersion = 1;
     };
 
     nativeBuildInputs = [

pkgs/by-name/ts/tsx/package.nix

···
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
     hash = "sha256-57KDZ9cHb7uqnypC0auIltmYMmIhs4PWyf0HTRWEFiU=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/ty/typespec/package.nix

···
       postPatch
       ;
     hash = "sha256-9RQZ2ycu78W3Ie6MLpo6x7Sa/iYsUdq5bYed56mOPxs=";
+    fetcherVersion = 1;
   };
 
   postPatch = ''

pkgs/by-name/ve/vencord/package.nix

···
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname src;
     hash = "sha256-hO6QKRr4jTfesRDAEGcpFeJmGTGLGMw6EgIvD23DNzw=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/ve/vesktop/package.nix

···
       patches
       ;
     hash = "sha256-C05rDd5bcbR18O6ACgzS0pQdWzB99ulceOBpW+4Zbqw=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs =

pkgs/by-name/vi/vikunja/package.nix

···
         sourceRoot
         ;
       hash = "sha256-94ZlywOZYmW/NsvE0dtEA81MeBWGUrJsBXTUauuOmZM=";
+      fetcherVersion = 1;
     };
 
     nativeBuildInputs = [

pkgs/by-name/vo/voicevox/package.nix

···
     ];
 
     hash = "sha256-RKgqFmHQnjHS7yeUIbH9awpNozDOCCHplc/bmfxmMyg=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs =

pkgs/by-name/vt/vte/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vte";
-  version = "0.80.2";
+  version = "0.80.3";
 
   outputs = [
     "out"
···
 
   src = fetchurl {
     url = "mirror://gnome/sources/vte/${lib.versions.majorMinor finalAttrs.version}/vte-${finalAttrs.version}.tar.xz";
-    hash = "sha256-siW+vQQ2M71JHy6hcTdNDz+d5i3+wHZTBTvAjE+s5G8=";
+    hash = "sha256-Lllv0/vqu3FTFmIiTnH2osN/aEQmE21ihUYnJ2709pk=";
   };
 
   patches = [

pkgs/by-name/vt/vtsls/package.nix

···
       version
       ;
     hash = "sha256-SdqeTYRH60CyU522+nBo0uCDnzxDP48eWBAtGTL/pqg=";
+    fetcherVersion = 1;
   };
 
   # Patches to get submodule sha from file instead of 'git submodule status'

pkgs/by-name/we/wealthfolio/package.nix

···
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) src pname version;
     hash = "sha256-KupqObdNrnWbbt9C4NNmgmQCfJ2O4FjJBwGy6XQhhHg=";
+    fetcherVersion = 1;
   };
 
   cargoRoot = "src-tauri";

pkgs/by-name/wl/wlvncc/package.nix

···
 
 stdenv.mkDerivation {
   pname = "wlvncc";
-  version = "0-unstable-2025-04-20";
+  version = "0-unstable-2025-07-07";
 
   src = fetchFromGitHub {
     owner = "any1";
     repo = "wlvncc";
-    rev = "a6a5463a9c69ce4db04d8d699dd58e1ba8560a0a";
-    hash = "sha256-8p2IOQvcjOV5xe0c/RWP6aRHtQnu9tYI7QgcC13sg4k=";
+    rev = "bc6063aeacd4fbe9ac8f58f4ba3c5388b3e1f1f2";
+    hash = "sha256-Udu/CtrNBqnlgZCK2cS8VWNTfHJGXdijTnNIWnAW2Nw=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/wo/wox/package.nix

···
         sourceRoot
         ;
       hash = "sha256-4Xj6doUHFoZSwel+cPnr2m3rfvlxNmQCppm5gXGIEtU=";
+      fetcherVersion = 1;
     };
 
     buildPhase = ''

pkgs/by-name/wr/wrangler/package.nix

···
       postPatch
       ;
     hash = "sha256-r3QswmqP6CNufnsFM0KeKojm/HjHogrfYO/TdL3SrmA=";
+    fetcherVersion = 1;
   };
   # pnpm packageManager version in workers-sdk root package.json may not match nixpkgs
   postPatch = ''

pkgs/by-name/xp/xpipe/package.nix

···
 
   hash =
     {
-      x86_64-linux = "sha256-BQNynZwQevXl+PlAi+OhaIUIf9TaNW5JowD3mLGgJxE=";
+      x86_64-linux = "sha256-2ZkFVhOTBfGWsyDTWRCFq0FXzuewWOsuZ9lH/0q8jEw=";
     }
     .${system} or throwSystem;
 
···
 in
 stdenvNoCC.mkDerivation rec {
   pname = "xpipe";
-  version = "16.6";
+  version = "16.7";
 
   src = fetchzip {
     url = "https://github.com/xpipe-io/xpipe/releases/download/${version}/xpipe-portable-linux-${arch}.tar.gz";

pkgs/by-name/za/zammad/package.nix

···
     inherit pname src;
 
     hash = "sha256-mfdzb/LXQYL8kaQpWi9wD3OOroOOonDlJrhy9Dwl1no";
+    fetcherVersion = 1;
   };
 
   buildPhase = ''

pkgs/by-name/za/zashboard/package.nix

···
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-aiSZS6FEs7kqGXxC9Tx6Rngv3qrPMi5gOuh5Z3/oZyc=";
+    fetcherVersion = 1;
   };
 
   buildPhase = ''

pkgs/by-name/ze/zed-editor/package.nix

···
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "0.193.3";
+  version = "0.194.3";
 
   outputs =
     [ "out" ]
···
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6/WRuO0UgQFtV0nK8/u3mZPYfAqVzemi3LzuCprOSgY=";
+    hash = "sha256-KF83XTCOWi78Uq720YSpJ6+JzllhqJQKLCqzq2WFS/U=";
   };
 
   patches = [
···
     '';
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-FG2JFnruGqUbIbCeBCqhuzrT/pwDv1tqpAYRMnmvxHk=";
+  cargoHash = "sha256-gSM3Qd87rhtG/oPLe3b1ItJmz9G4AEJY5h81lTz9Kl0=";
 
   nativeBuildInputs =
     [

pkgs/by-name/ze/zenn-cli/package.nix

···
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-AjdXclrNl1AHJ4LXq9I5Rk6KGyDaWXW187o2uLwRy/o=";
+    fetcherVersion = 1;
   };
 
   preBuild =

pkgs/by-name/zi/zigbee2mqtt_2/package.nix

···
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-OPfs9WiUehKPaAqqgMOiIELoCPVBFYpNKeesfmA8Db0=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/by-name/zi/zipline/package.nix

···
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-kIneqtLPZ29PzluKUGO4XbQYHbNddu0kTfoP4C22k7U=";
+    fetcherVersion = 1;
   };
 
   buildInputs = [

pkgs/development/compilers/llvm/default.nix

···
     "19.1.7".officialRelease.sha256 = "sha256-cZAB5vZjeTsXt9QHbP5xluWNQnAHByHtHnAhVDV0E6I=";
     "20.1.6".officialRelease.sha256 = "sha256-PfCzECiCM+k0hHqEUSr1TSpnII5nqIxg+Z8ICjmMj0Y=";
     "21.0.0-git".gitRelease = {
-      rev = "be4cd9f4da981af3b93a180239cd631910b542d8";
-      rev-version = "21.0.0-unstable-2025-07-06";
-      sha256 = "sha256-cNJL0374m1LL5G7aS9CO/ufild5wfvhXcqwhqJXUZYA=";
+      rev = "e08833443256f8dde2f864853fa9491ffa7112d5";
+      rev-version = "21.0.0-unstable-2025-07-13";
+      sha256 = "sha256-O0mh9Kq6PHvGiCigjb5rDDqHNFBhy5Dv+IP67TstX8U=";
     };
   } // llvmVersions;
 

pkgs/development/compilers/zulu/24.nix

···
 }@args:
 
 let
-  # For 24 JDK FX is newer than regular JDK?
-  zuluVersion = if enableJavaFX then "24.28.85" else "24.28.83";
+  # For 24 JDK FX is newer than regular JDK
+  zuluVersion = if enableJavaFX then "24.30.13" else "24.30.11";
 in
 callPackage ./common.nix (
   {
···
     dists = {
       x86_64-linux = {
         inherit zuluVersion;
-        jdkVersion = "24.0.0";
+        jdkVersion = "24.0.1";
         hash =
           if enableJavaFX then
-            "sha256-y8jiE5yECh96pHYZFM0Q/JTiVcm5a0PONYJDLYydCT0="
+            "sha256-jbpWNE+X5GJABQERq126ediyzGRQE9NZy9oMW/sPUa0="
           else
-            "sha256-Kf6gF8A8ZFIhujEgjlENeuSPVzW6QWnVZcRst35/ZvI=";
+            "sha256-EvaVfDoqdNNtaSz+467rlJ8VtdgNrQi/DT7ZMNZthlk=";
       };
 
       aarch64-linux = {
         inherit zuluVersion;
-        jdkVersion = "24.0.0";
+        jdkVersion = "24.0.1";
         hash =
           if enableJavaFX then
-            "sha256-H6YD8uhk9rTpd+3/S1+7QVzpCi6jykWKyu7RPxMx/sI="
+            "sha256-N9VOweloyX/2bFPH3L+Iw7nTkbiE7LvDNnTNM1b8Ghc="
           else
-            "sha256-6J7szd/ax9xCMNA9efw9Bhgv/VwQFXz5glWIoj+UYIc=";
+            "sha256-4R5K5XTgpR9kq9WWE3SgvqVTq8CFvyb943zAiSsq3k0=";
       };
 
       x86_64-darwin = {
         inherit zuluVersion;
-        jdkVersion = "24.0.0";
+        jdkVersion = "24.0.1";
         hash =
           if enableJavaFX then
-            "sha256-lMdbPkUdXyNcye8uMxGIhZTErrTI0P0SnqMS+8+Rjqg="
+            "sha256-c6Gwj8ol2YLfo4sMeCMGfYQvtDz7029L0Yj1dqVQvsw="
           else
-            "sha256-e7KJtJ9+mFFSdKCj68thfTXguWH5zXaSSb9phzXf/lQ=";
+            "sha256-VhGOiZaspXeVVLEp0MJZXxj/+ovGgmy+gRb2BZ9OuhY=";
       };
 
       aarch64-darwin = {
         inherit zuluVersion;
-        jdkVersion = "24.0.0";
+        jdkVersion = "24.0.1";
         hash =
           if enableJavaFX then
-            "sha256-oR2x0vphBGgh3KkEkLAcmtIMNONny9/b32z9jLR98X0="
+            "sha256-Sac+DxNyGqsiStpc/wZYd2K7rvPEjo901kOYERYi+Sw="
           else
-            "sha256-7yXLOJCK0RZ8V1vsexOGxGR9NAwi/pCl95BlO8E8nGU=";
+            "sha256-pJsq2gKcTy44zbFbSAj6Kd5VZi095jKGkZqd8ceIz7E=";
       };
     };
   }

pkgs/development/haskell-modules/configuration-common.nix

···
   HerbiePlugin = dontCheck super.HerbiePlugin;
   wai-cors = dontCheck super.wai-cors;
 
+  # Apply patch fixing an incorrect QuickCheck property which occasionally causes false negatives
+  # https://github.com/Philonous/xml-picklers/issues/5
+  xml-picklers = appendPatch (pkgs.fetchpatch {
+    name = "xml-picklers-fix-prop-xp-attribute.patch";
+    url = "https://github.com/Philonous/xml-picklers/commit/887e5416b5e61c589cadf775d82013eb87751ea2.patch";
+    sha256 = "sha256-EAyTVkAqCvJ0lRD0+q/htzBJ8iD5qP47j5i2fKhRrlw=";
+  }) super.xml-picklers;
+
   # 2024-05-18: Upstream tests against a different pandoc version
   pandoc-crossref = dontCheck super.pandoc-crossref;
 

pkgs/development/libraries/kde-frameworks/kimageformats.nix

···
   buildInputs = [
     karchive
     openexr
-    libavif
+    # FIXME: cmake files are broken, disabled for now
+    # libavif
     libheif
     libjxl
     libraw

pkgs/development/php-packages/castor/default.nix

···
 
 php.buildComposerProject2 (finalAttrs: {
   pname = "castor";
-  version = "0.25.0";
+  version = "0.26.0";
 
   src = fetchFromGitHub {
     owner = "jolicode";
     repo = "castor";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qHCW/VHHMk8+/RL2HEW+RyaZaq7MsxB9RePwmgYHpDI=";
+    hash = "sha256-Aktr7mU2KP8Io6H0qXii1sVYkgb8wArYIgJ+OFb+/ao=";
   };
 
-  vendorHash = "sha256-DJ8iHhkLfe1GNf7eJHeE8ORt9cyRFLr0gLGeHENiASw=";
+  vendorHash = "sha256-CAsDHwv+oLoiLJ4pUdVvq4w8wD0QsIfYG/AIXASETqI=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/development/php-packages/spx/default.nix

···
 }:
 
 let
-  version = "0.4.18";
+  version = "0.4.20";
 in
 buildPecl {
   inherit version;
···
     owner = "NoiseByNorthwest";
     repo = "php-spx";
     rev = "v${version}";
-    hash = "sha256-Dcv8ncYPIug7e24mvL1gn0x0CeLNAck8djm/r/yiPe8=";
+    hash = "sha256-2MOl9waWY3zK5NzQ19TJKK8kE7xC4K+e9AwV+wyAHZc=";
   };
 
-  configureFlags = [ "--with-zlib-dir=${zlib.dev}" ];
-
-  preConfigure = ''
-    substituteInPlace Makefile.frag \
-      --replace '$(INSTALL_ROOT)$(prefix)/share/misc/php-spx/assets/web-ui' '${placeholder "out"}/share/misc/php-spx/assets/web-ui'
-  '';
+  configureFlags = [
+    "--with-zlib-dir=${zlib.dev}"
+    "--with-spx-assets-dir=${placeholder "out"}/share/misc/php-spx/assets/"
+  ];
 
   meta = {
     changelog = "https://github.com/NoiseByNorthwest/php-spx/releases/tag/${version}";

pkgs/development/python-modules/dj-rest-auth/default.nix

···
   responses,
   setuptools,
   unittest-xml-reporting,
+  pytestCheckHook,
+  pytest-django,
 }:
 
 buildPythonPackage rec {
···
       url = "https://github.com/iMerica/dj-rest-auth/commit/cc5587e4e3f327697709f3f0d491650bff5464e7.diff";
       hash = "sha256-2LahibxuNECAfjqsbNs2ezaWt1VH0ZBNwSNWCZwIe8I=";
     })
+    # Add compatibility with django-allauth v65.4
+    # See https://github.com/iMerica/dj-rest-auth/pull/681
+    (fetchpatch {
+      name = "django-allauth_65.4_compatibility.patch";
+      url = "https://github.com/iMerica/dj-rest-auth/commit/59b8cab7e2f4e3f2fdc11ab3b027a32cad45deef.patch";
+      hash = "sha256-CH85vB3EOQvFxx+ZP2LYI4LEvaZ+ccLdXZGuAvEfStc=";
+    })
   ];
 
   postPatch = ''
···
     unittest-xml-reporting
   ] ++ optional-dependencies.with_social;
 
+  checkInputs = [
+    pytestCheckHook
+    pytest-django
+  ];
+
+  env.DJANGO_SETTINGS_MODULE = "dj_rest_auth.tests.settings";
+
   preCheck = ''
-    # Test connects to graph.facebook.com
-    substituteInPlace dj_rest_auth/tests/test_serializers.py \
-      --replace-fail "def test_http_error" "def dont_test_http_error"
+    # Make tests module available for the checkPhase
+    export PYTHONPATH=$out/${python.sitePackages}/dj_rest_auth:$PYTHONPATH
   '';
 
-  checkPhase = ''
-    runHook preCheck
-    ${python.interpreter} runtests.py
-    runHook postCheck
-  '';
+  disabledTests = [
+    # Test connects to graph.facebook.com
+    "TestSocialLoginSerializer"
+  ];
+
+  disabledTestPaths = [
+    # Test fails with > django-allauth 65.4
+    # See: https://github.com/iMerica/dj-rest-auth/pull/681#issuecomment-3034953311
+    "dj_rest_auth/tests/test_social.py"
+  ];
 
   pythonImportsCheck = [ "dj_rest_auth" ];
 
-  meta = with lib; {
+  meta = {
     description = "Authentication for Django Rest Framework";
     homepage = "https://github.com/iMerica/dj-rest-auth";
     changelog = "https://github.com/iMerica/dj-rest-auth/releases/tag/${version}";
-    license = licenses.mit;
-    maintainers = [ ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ onny ];
   };
 }

pkgs/development/python-modules/django-allauth/default.nix

···
 {
   lib,
   buildPythonPackage,
-  fetchFromGitHub,
+  fetchFromGitea,
   pythonOlder,
   python,
 
···
 
 buildPythonPackage rec {
   pname = "django-allauth";
-  version = "65.7.0";
+  version = "65.9.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
-  src = fetchFromGitHub {
-    owner = "pennersr";
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "allauth";
     repo = "django-allauth";
     tag = version;
-    hash = "sha256-1HmEJ5E4Vp/CoyzUegqQXpzKUuz3dLx2EEv7dk8fq8w=";
+    hash = "sha256-gusA9TnsgSSnWBPwHsNYeESD9nX5DWh4HqMgcsoJRw0=";
   };
 
   nativeBuildInputs = [ gettext ];
···
   passthru.tests = { inherit dj-rest-auth; };
 
   meta = {
-    changelog = "https://github.com/pennersr/django-allauth/blob/${version}/ChangeLog.rst";
     description = "Integrated set of Django applications addressing authentication, registration, account management as well as 3rd party (social) account authentication";
-    downloadPage = "https://github.com/pennersr/django-allauth";
-    homepage = "https://www.intenct.nl/projects/django-allauth";
+    changelog = "https://codeberg.org/allauth/django-allauth/src/tag/${version}/ChangeLog.rst";
+    downloadPage = "https://codeberg.org/allauth/django-allauth";
+    homepage = "https://allauth.org";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ derdennisop ];
   };

pkgs/development/python-modules/django-filingcabinet/default.nix

···
 
 buildPythonPackage rec {
   pname = "django-filingcabinet";
-  version = "0.17-unstable-2025-04-10";
+  version = "0.17-unstable-2025-07-01";
   pyproject = true;
 
   src = fetchFromGitHub {
···
     repo = "django-filingcabinet";
     # No release tagged yet on GitHub
     # https://github.com/okfde/django-filingcabinet/issues/69
-    rev = "64b7b4ad804067e2f16e8a0f165c139e3ffe5fb5";
-    hash = "sha256-48Peui/5N/GfzWS1EJ5uKeKEoPjX+fPEXzG2owxsDaE=";
+    rev = "ff39722209acf70bc73fa7074c16ed8a787fceea";
+    hash = "sha256-9SrMWBTk7RQCbVPHOU5rB/pi286hb6UONaLmBOtx6X0=";
   };
 
   postPatch = ''
···
 
   pnpmDeps = pnpm.fetchDeps {
     inherit pname version src;
-    hash = "sha256-uMO2iEOi9ACYdIM8Thf7+y1KpHQEqVxO3yxZ8RaGFXA=";
+    hash = "sha256-kvLV/pCX/wQHG0ttrjSro7/CoQ5K1T0aFChafQOwvNw=";
+    fetcherVersion = 1;
   };
 
   postBuild = ''

pkgs/development/python-modules/django-mfa3/default.nix

···
   django,
   setuptools,
   pyotp,
-  fido2,
+  fido2_2,
   qrcode,
   python,
 }:
 
 buildPythonPackage rec {
   pname = "django-mfa3";
-  version = "0.15.1";
+  version = "1.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "xi";
     repo = "django-mfa3";
     tag = version;
-    hash = "sha256-HcurgGSzPnKVRpL9NVq0vkCmYDvj/HoWYVbnIrK5pSI=";
+    hash = "sha256-bgIzrSM8KP6uQHvn393NWYw9DODdHLMqKn6pgw3EG/w=";
   };
 
   build-system = [ setuptools ];
···
   dependencies = [
     django
     pyotp
-    fido2
+    fido2_2
     qrcode
   ];
 

pkgs/development/python-modules/fido2/2.nix

···
+{
+  lib,
+  buildPythonPackage,
+  cryptography,
+  fetchPypi,
+  poetry-core,
+  pyscard,
+  pythonOlder,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "fido2";
+  version = "2.0.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-MGHNBec7Og72r8O4A9V8gmqi1qlzLRar1ydzYfWOeWQ=";
+  };
+
+  build-system = [ poetry-core ];
+
+  pythonRelaxDeps = [ "cryptography" ];
+
+  dependencies = [ cryptography ];
+
+  optional-dependencies = {
+    pcsc = [ pyscard ];
+  };
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  unittestFlagsArray = [ "-v" ];
+
+  # Disable tests which require physical device
+  pytestFlagsArray = [ "--no-device" ];
+
+  pythonImportsCheck = [ "fido2" ];
+
+  meta = {
+    description = "Provides library functionality for FIDO 2.0, including communication with a device over USB";
+    homepage = "https://github.com/Yubico/python-fido2";
+    changelog = "https://github.com/Yubico/python-fido2/releases/tag/${version}";
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ prusnak ];
+  };
+}

pkgs/development/python-modules/gradio/default.nix

···
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
     hash = "sha256-h3ulPik0Uf8X687Se3J7h3+8jYzwXtbO6obsO27zyfA=";
+    fetcherVersion = 1;
   };
 
   pythonRelaxDeps = [

pkgs/development/python-modules/jupyter-collaboration/default.nix

···
 
 buildPythonPackage rec {
   pname = "jupyter-collaboration";
-  version = "4.0.2";
+  version = "4.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jupyterlab";
     repo = "jupyter-collaboration";
     tag = "v${version}";
-    hash = "sha256-BCvTtrlP45YC9G/m/e8Nvbls7AugIaQzO2Gect1EmGE=";
+    hash = "sha256-PnfUWtOXdXYG5qfzAW5kATSQr2sWKDBNiINA8/G4ZX4=";
   };
 
   sourceRoot = "${src.name}/projects/jupyter-collaboration";
···
   meta = {
     description = "JupyterLab Extension enabling Real-Time Collaboration";
     homepage = "https://github.com/jupyterlab/jupyter_collaboration";
-    changelog = "https://github.com/jupyterlab/jupyter_collaboration/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/jupyterlab/jupyter_collaboration/blob/${src.tag}/CHANGELOG.md";
     license = lib.licenses.bsd3;
     teams = [ lib.teams.jupyter ];
   };

pkgs/development/python-modules/langchain-mistralai/default.nix

···
 
 buildPythonPackage rec {
   pname = "langchain-mistralai";
-  version = "0.2.10";
+  version = "0.2.11";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
     tag = "langchain-mistralai==${version}";
-    hash = "sha256-1oH9GRvjYv/YzedKXeWgw5nwNgMQ9mSNkmZ2xwPekXc=";
+    hash = "sha256-14mYvW7j2hxAFZanRhuuo1seX6E4+tAuEPExDbdwHKg=";
   };
 
   sourceRoot = "${src.name}/libs/partners/mistralai";

pkgs/development/python-modules/langchain-ollama/default.nix

···
 
 buildPythonPackage rec {
   pname = "langchain-ollama";
-  version = "0.3.3";
+  version = "0.3.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
     tag = "langchain-ollama==${version}";
-    hash = "sha256-YxcxVyiPEZPvO4NyeDp8nTVfbxlOCLClWCmAlL5PPi0=";
+    hash = "sha256-biPQAYF9VfF6z0244v1+iXaqX0IAiKCuJ+XyXzxD/Jg=";
   };
 
   sourceRoot = "${src.name}/libs/partners/ollama";

pkgs/development/python-modules/metaflow/default.nix

···
 
 buildPythonPackage rec {
   pname = "metaflow";
-  version = "2.15.18";
+  version = "2.15.20";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Netflix";
     repo = "metaflow";
     tag = version;
-    hash = "sha256-Yg5DoFPn5uInLf8roHhIKXvK+/K6TWATdG8uK8XOUyg=";
+    hash = "sha256-D4Pf2/xhEJ22kDmmxYS0PiT5k2BJ3CBfTJZ4GrvkI58=";
   };
 
   build-system = [

pkgs/development/python-modules/mkdocs-mermaid2-plugin/default.nix

···
 
 buildPythonPackage rec {
   pname = "mkdocs-mermaid2-plugin";
-  version = "1.1.0";
+  version = "1.2.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
···
     owner = "fralau";
     repo = "mkdocs-mermaid2-plugin";
     tag = "v${version}";
-    hash = "sha256-9vYLkGUnL+rnmZntcgFzOvXQdf6angb9DRsmrBjnPUY=";
+    hash = "sha256-LKPjhCPozz/+UV2658qWOIjpMt6w+UDBXsg1fqyg48M=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/rapidocr-onnxruntime/default.nix

···
   requests,
 }:
 let
-  version = "1.4.4";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "RapidAI";
     repo = "RapidOCR";
     tag = "v${version}";
-    hash = "sha256-x0VELDKOffxbV3v0aDFJFuDC4YfsGM548XWgINmRc3M=";
+    hash = "sha256-4R2rOCfnhElII0+a5hnvbn+kKQLEtH1jBvfFdxpLEBk=";
   };
 
   models =
···
 
   pythonImportsCheck = [ "rapidocr_onnxruntime" ];
 
-  nativeCheckInputs = [
-    pytestCheckHook
-    requests
-  ];
-
-  # These are tests for different backends.
-  disabledTestPaths = [
-    "tests/test_vino.py"
-    "tests/test_paddle.py"
-  ];
-
-  disabledTests = [
-    # Needs Internet access
-    "test_long_img"
-  ];
+  # As of version 2.1.0, 61 out of 70 tests require internet access.
+  # It's just not plausible to manually pick out ones that actually work
+  # in a hermetic build environment anymore :(
+  doCheck = false;
 
   meta = {
     # This seems to be related to https://github.com/microsoft/onnxruntime/issues/10038

pkgs/development/python-modules/robotframework/default.nix

···
 
 buildPythonPackage rec {
   pname = "robotframework";
-  version = "7.3.1";
+  version = "7.3.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
···
     owner = "robotframework";
     repo = "robotframework";
     tag = "v${version}";
-    hash = "sha256-gcmHud5HPDwRSXX3VD+mpeD2ySdV6BIhfPfvDdz9OsQ=";
+    hash = "sha256-JxZI0i9Aj/TX4BkIi+jeBdTy0ckv5Fdy5tHRI9vQ8Ss=";
   };
 
   build-system = [ setuptools ];

pkgs/development/tools/pnpm/fetch-deps/default.nix

···
       pnpmWorkspaces ? [ ],
       prePnpmInstall ? "",
       pnpmInstallFlags ? [ ],
+      fetcherVersion ? null,
       ...
     }@args:
     let
···
     # pnpmWorkspace was deprecated, so throw if it's used.
     assert (lib.throwIf (args ? pnpmWorkspace)
       "pnpm.fetchDeps: `pnpmWorkspace` is no longer supported, please migrate to `pnpmWorkspaces`."
+    ) true;
+
+    assert (lib.throwIf (fetcherVersion == null)
+      "pnpm.fetchDeps: `fetcherVersion` is not set, see https://nixos.org/manual/nixpkgs/stable/#javascript-pnpm-fetcherVersion."
     ) true;
 
     stdenvNoCC.mkDerivation (
···
                 --registry="$NIX_NPM_REGISTRY" \
                 --frozen-lockfile
 
+            # Store newer fetcherVersion in case pnpm.configHook also needs it
+            if [[ ${toString fetcherVersion} -gt 1 ]]; then
+              echo ${toString fetcherVersion} > $out/.fetcher-version
+            fi
+
             runHook postInstall
           '';
 
···
             for f in $(find $out -name "*.json"); do
               jq --sort-keys "del(.. | .checkedAt?)" $f | sponge $f
             done
+
+            # Ensure consistent permissions
+            # NOTE: For reasons not yet fully understood, pnpm might create files with
+            # inconsistent permissions, for example inside the ubuntu-24.04
+            # github actions runner.
+            # To ensure stable derivations, we need to set permissions
+            # consistently, namely:
+            # * All files with `-exec` suffix have 555.
+            # * All other files have 444.
+            # * All folders have 555.
+            # See https://github.com/NixOS/nixpkgs/pull/350063
+            # See https://github.com/NixOS/nixpkgs/issues/422889
+            if [[ ${toString fetcherVersion} -ge 2 ]]; then
+              find $out -type f -name "*-exec" -print0 | xargs -0 chmod 555
+              find $out -type f -not -name "*-exec" -print0 | xargs -0 chmod 444
+              find $out -type d -print0 | xargs -0 chmod 555
+            fi
 
             runHook postFixup
           '';

pkgs/development/tools/pnpm/fetch-deps/pnpm-config-hook.sh

···
       exit 1
     fi
 
+    fetcherVersion=1
+    if [[ -e "${pnpmDeps}/.fetcher-version" ]]; then
+      fetcherVersion=$(cat "${pnpmDeps}/.fetcher-version")
+    fi
+
+    echo "Using fetcherVersion: $fetcherVersion"
+
     echo "Configuring pnpm store"
 
     export HOME=$(mktemp -d)

pkgs/os-specific/linux/mstflint_access/default.nix

···
 
   enableParallelBuilding = true;
 
-  installPhase = ''
-    runHook preInstall
-
-    install -D ${pname}.ko $out/lib/modules/${kernel.modDirVersion}/extra/${pname}.ko
-
-    runHook postInstall
-  '';
+  installTargets = [ "modules_install" ];
+  installFlags = [
+    "-C"
+    "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "INSTALL_MOD_PATH=${placeholder "out"}"
+    "M=$(PWD)"
+  ] ++ makeFlags;
 
   meta = with lib; {
     description = "Kernel module for Nvidia NIC firmware update";

pkgs/servers/authelia/web.nix

···
       sourceRoot
       ;
     hash = pnpmDepsHash;
+    fetcherVersion = 1;
   };
 
   postPatch = ''

pkgs/servers/home-assistant/custom-components/lednetwf_ble/package.nix

···
   nix-update-script,
 }:
 let
-  version = "0.0.14.2";
+  version = "0.0.15";
 in
 buildHomeAssistantComponent {
   owner = "8none1";
···
   src = fetchFromGitHub {
     owner = "8none1";
     repo = "lednetwf_ble";
-    tag = "v.${version}";
-    hash = "sha256-FgLUBCIYsmvrU8auraFVJ+hnl/p6KHpEeIWMT4KGJBM=";
+    tag = "v${version}";
+    hash = "sha256-Ir3a6mr9OmBiiHRJktrv6HirHcVzKhc730aq6lynTmg=";
   };
 
   dependencies = [
···
   meta = {
     description = "Home Assistant custom integration for LEDnetWF devices";
     homepage = "https://github.com/8none1/lednetwf_ble";
-    changelog = "https://github.com/8none1/lednetwf_ble/releases/tag/v.${version}";
+    changelog = "https://github.com/8none1/lednetwf_ble/releases/tag/v${version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ blenderfreaky ];
   };

pkgs/servers/home-assistant/custom-lovelace-modules/advanced-camera-card/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "advanced-camera-card";
-  version = "7.14.1";
+  version = "7.14.2";
 
   src = fetchzip {
     url = "https://github.com/dermotduffy/advanced-camera-card/releases/download/v${version}/advanced-camera-card.zip";
-    hash = "sha256-SBUDM4+uayW5MJFs7arHXs1WzBmlHntVlE2hDBtGlAI=";
+    hash = "sha256-I4ZrkhrwP+b7IHNWbGpGPmlH9CP7o2mFTfN5J1fOY/E=";
   };
 
   # TODO: build from source once yarn berry support lands in nixpkgs

pkgs/servers/home-assistant/custom-lovelace-modules/custom-sidebar/package.nix

···
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-ZWh2R6wr7FH2RfoFAE81Kl+wHnUeNjUbFG3KIk8ZN3g=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [

pkgs/servers/home-assistant/custom-lovelace-modules/restriction-card/package.nix

···
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+}:
+
+buildNpmPackage (finalAttrs: {
+  pname = "restriction-card";
+  version = "1.2.19";
+
+  src = fetchFromGitHub {
+    owner = "iantrich";
+    repo = "restriction-card";
+    tag = finalAttrs.version;
+    hash = "sha256-2scUSEpDPrMoos/QuOqXARAf1IL8P4gJaga7LRQ/67U=";
+  };
+
+  npmDepsHash = "sha256-9Hz+7Q4i5baIWxVIo6e8d5isvZWnJW2947q5Uk0Gm9w=";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir $out
+    install -m0644 dist/restriction-card.js $out
+
+    runHook postInstall
+  '';
+
+  meta = {
+    changelog = "https://github.com/iantrich/restriction-card/releases/tag/${finalAttrs.src.tag}";
+    description = "Apply restrictions to Lovelace cards";
+    homepage = "https://github.com/iantrich/restriction-card";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jfly ];
+  };
+})

pkgs/servers/http/angie/console-light.nix

···
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.4.0";
+  version = "1.8.0";
   pname = "angie-console-light";
 
   src = fetchurl {
     url = "https://download.angie.software/files/${pname}/${pname}-${version}.tar.gz";
-    hash = "sha256-Oz+FdMrIGNmJKHl/wOVZCP1b0AJODcURvDUKz4gCqYU=";
+    hash = "sha256-8btNEsh8Me/MQyLY0iIJal3UnZHzoHq6QpqyVYJvO84=";
   };
 
   outputs = [

pkgs/servers/web-apps/discourse/default.nix

···
       pname = "discourse-assets";
       inherit version src;
       hash = "sha256-WyRBnuKCl5NJLtqy3HK/sJcrpMkh0PjbasGPNDV6+7Y=";
+      fetcherVersion = 1;
     };
 
     nativeBuildInputs = runtimeDeps ++ [

pkgs/servers/web-apps/lemmy/ui.nix

···
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = pinData.uiPNPMDepsHash;
+    fetcherVersion = 1;
   };
 
   buildPhase = ''

pkgs/tools/networking/flannel/default.nix

···
 
 buildGoModule rec {
   pname = "flannel";
-  version = "0.27.0";
+  version = "0.27.1";
   rev = "v${version}";
 
-  vendorHash = "sha256-vwv7B3G9v9FNDS/RWTZwA5uqW2/GQLtUgylFsi0Dldo=";
+  vendorHash = "sha256-FR9jeHVZS87Tlv1jtO4h5ZDqKIRLfa4xGlpCj1IWoXU=";
 
   src = fetchFromGitHub {
     inherit rev;
     owner = "flannel-io";
     repo = "flannel";
-    sha256 = "sha256-GVbDmRXyZjWXHi9eHiQ28RDi1N//ro3AnKb0txvA8yA=";
+    sha256 = "sha256-xmKXemr/qSLsBOwLhJIewF7Iu/ERpZX8kUFgotz4Yyw=";
   };
 
   ldflags = [ "-X github.com/flannel-io/flannel/pkg/version.Version=${rev}" ];

pkgs/tools/virtualization/cloud-init/0002-fix-test-logs-on-nixos.patch

···
+diff --git a/tests/unittests/cmd/devel/test_logs.py b/tests/unittests/cmd/devel/test_logs.py
+index 78466e8d0..cc2b7246d 100644
+--- a/tests/unittests/cmd/devel/test_logs.py
++++ b/tests/unittests/cmd/devel/test_logs.py
+@@ -179,7 +179,7 @@ class TestCollectLogs:
+ 
+         for to_write in to_collect:
+             write_file(
+-                tmp_path / to_write, pathlib.Path(to_write).name, mode=0x700
++                tmp_path / to_write, pathlib.Path(to_write).name
+             )
+ 
+         collect_dir = tmp_path / "collect"
+@@ -225,7 +225,7 @@ class TestCollectLogs:
+ 
+         for to_write in to_collect:
+             write_file(
+-                tmp_path / to_write, pathlib.Path(to_write).name, mode=0x700
++                tmp_path / to_write, pathlib.Path(to_write).name
+             )
+ 
+         collect_dir = tmp_path / "collect"

pkgs/tools/virtualization/cloud-init/default.nix

···
 
 python3.pkgs.buildPythonApplication rec {
   pname = "cloud-init";
-  version = "24.2";
+  version = "25.1.4";
   pyproject = true;
 
   namePrefix = "";
···
     owner = "canonical";
     repo = "cloud-init";
     tag = version;
-    hash = "sha256-BhTcOeSKZ1XRIx+xJQkqkSw9M8ilr+BRKXDy5MUXB6E=";
+    hash = "sha256-Ubu0uhpRrr4eV4ztOq/l004/+B2kjBWjRNwYcuHCfbU=";
   };
 
   patches = [
     ./0001-add-nixos-support.patch
+    ./0002-fix-test-logs-on-nixos.patch
   ];
 
   prePatch = ''

pkgs/top-level/all-packages.nix

···
 
   qgis = callPackage ../applications/gis/qgis { };
 
-  qmapshack = libsForQt5.callPackage ../applications/gis/qmapshack { };
-
   spatialite-gui = callPackage ../by-name/sp/spatialite-gui/package.nix {
     wxGTK = wxGTK32;
   };

pkgs/top-level/python-packages.nix

···
 
   fido2 = callPackage ../development/python-modules/fido2 { };
 
+  fido2_2 = callPackage ../development/python-modules/fido2/2.nix { };
+
   fields = callPackage ../development/python-modules/fields { };
 
   file-read-backwards = callPackage ../development/python-modules/file-read-backwards { };