Merge master into staging-next

nixos/doc/manual/release-notes/rl-2511.section.md

···
 
 - [Draupnir](https://github.com/the-draupnir-project/draupnir), a Matrix moderation bot. Available as [services.draupnir](#opt-services.draupnir.enable).
 
+- [postfix-tlspol](https://github.com/Zuplu/postfix-tlspol), MTA-STS and DANE resolver and TLS policy server for Postfix. Available as [services.postfix-tlspol](#opt-services.postfix-tlspol.enable).
+
 - [SuiteNumérique Docs](https://github.com/suitenumerique/docs), a collaborative note taking, wiki and documentation web platform and alternative to Notion or Outline. Available as [services.lasuite-docs](#opt-services.lasuite-docs.enable).
 
 [dwl](https://codeberg.org/dwl/dwl), a compact, hackable compositor for Wayland based on wlroots. Available as [programs.dwl](#opt-programs.dwl.enable).

nixos/modules/misc/ids.nix

···
 # https://github.com/NixOS/rfcs/blob/master/rfcs/0052-dynamic-ids.md
 #
 # Use of static ids is deprecated within NixOS. Dynamic allocation is
-# required, barring special circumstacnes. Please check if the service
+# required, barring special circumstances. Please check if the service
 # is applicable for systemd's DynamicUser option and does not need a
-# uid/gid allocation at all.  Systemd can also change ownership of
-# service directories using the RuntimeDirectory/StateDirectory
-# options.
+# uid/gid allocation at all. If DynamicUser is problematic consider
+# making a `isSystemUser=true` user with the uid and gid unset and let
+# NixOS pick dynamic persistent ids on activation. These IDs are persisted
+# locally on the host in the event that the user is removed and added back.
+# Systemd will also change ownership of service directories using the
+# RuntimeDirectory/StateDirectory options just in case a change happens.
+# It's only for special circumstances like for example the ids being hardcoded
+# in the application or the ids having to be consistent across multiple hosts
+# that configuring static ids in this file makes sense.
 
 { lib, ... }:
 

nixos/modules/module-list.nix

···
   ./services/mail/opendkim.nix
   ./services/mail/opensmtpd.nix
   ./services/mail/pfix-srsd.nix
+  ./services/mail/postfix-tlspol.nix
   ./services/mail/postfix.nix
   ./services/mail/postfixadmin.nix
   ./services/mail/postgrey.nix

nixos/modules/services/mail/postfix-tlspol.nix

···
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib)
+    hasPrefix
+    mkEnableOption
+    mkIf
+    mkOption
+    mkPackageOption
+    types
+    ;
+
+  cfg = config.services.postfix-tlspol;
+
+  format = pkgs.formats.yaml_1_2 { };
+in
+
+{
+  options.services.postfix-tlspol = {
+    enable = mkEnableOption "postfix-tlspol";
+
+    package = mkPackageOption pkgs "postfix-tlspol" { };
+
+    settings = mkOption {
+      type = types.submodule {
+        freeformType = format.type;
+        options = {
+          server = {
+            address = mkOption {
+              type = types.str;
+              default = "unix:/run/postfix-tlspol/tlspol.sock";
+              example = "127.0.0.1:8642";
+              description = ''
+                Path or address/port where postfix-tlspol binds its socket to.
+              '';
+            };
+
+            socket-permissions = mkOption {
+              type = types.str;
+              default = "0660";
+              readOnly = true;
+              description = ''
+                Permissions to the UNIX socket, if configured.
+
+                ::: {.note}
+                Due to hardening on the systemd unit the socket can never be created world readable/writable.
+                :::
+              '';
+              apply = value: (builtins.fromTOML "v=0o${value}").v;
+            };
+
+            log-level = mkOption {
+              type = types.enum [
+                "debug"
+                "info"
+                "warn"
+                "error"
+              ];
+              default = "info";
+              example = "warn";
+              description = ''
+                Log level
+              '';
+            };
+
+            prefetch = mkOption {
+              type = types.bool;
+              default = true;
+              example = false;
+              description = ''
+                Whether to prefetch DNS records when the TTL of a cached record is about to expire.
+              '';
+            };
+
+            cache-file = mkOption {
+              type = types.path;
+              default = "/var/cache/postfix-tlspol/cache.db";
+              readOnly = true;
+              description = ''
+                Path to the cache file.
+              '';
+            };
+          };
+
+          dns = {
+            server = mkOption {
+              type = types.str;
+              default = "127.0.0.1:53";
+              description = ''
+                IP and port to your DNS resolver
+
+                ::: {.note}
+                The configured DNS resolver must validate DNSSEC signatures.
+                :::
+              '';
+            };
+          };
+        };
+      };
+
+      default = { };
+      description = ''
+        The postfix-tlspol configuration file as a Nix attribute set.
+
+        See the reference documentation for possible options.
+        <https://github.com/Zuplu/postfix-tlspol/blob/main/configs/config.default.yaml>
+      '';
+    };
+
+    configurePostfix = mkOption {
+      type = types.bool;
+      default = true;
+      description = ''
+        Whether to configure the required settings to use postfix-tlspol in the local Postfix instance.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment.etc."postfix-tlspol/config.yaml".source =
+      format.generate "postfix-tlspol.yaml" cfg.settings;
+
+    environment.systemPackages = [ cfg.package ];
+
+    # https://github.com/Zuplu/postfix-tlspol#postfix-configuration
+    services.postfix.config = mkIf (config.services.postfix.enable && cfg.configurePostfix) {
+      smtp_dns_support_level = "dnssec";
+      smtp_tls_security_level = "dane";
+      smtp_tls_policy_maps =
+        let
+          address =
+            if (hasPrefix "unix:" cfg.settings.server.address) then
+              cfg.settings.server.address
+            else
+              "inet:${cfg.settings.server.address}";
+        in
+        [ "socketmap:${address}:QUERYwithTLSRPT" ];
+    };
+
+    systemd.services.postfix-tlspol = {
+      after = [
+        "nss-lookup.target"
+        "network-online.target"
+      ];
+      wants = [
+        "nss-lookup.target"
+        "network-online.target"
+      ];
+      wantedBy = [ "multi-user.target" ];
+
+      description = "Postfix DANE/MTA-STS TLS policy socketmap service";
+      documentation = [ "https://github.com/Zuplu/postfix-tlspol" ];
+
+      # https://github.com/Zuplu/postfix-tlspol/blob/main/init/postfix-tlspol.service
+      serviceConfig = {
+        ExecStart = toString [
+          (lib.getExe cfg.package)
+          "-config"
+          "/etc/postfix-tlspol/config.yaml"
+        ];
+        ExecReload = "${lib.getExe' pkgs.util-linux "kill"} -HUP $MAINPID";
+        Restart = "always";
+        RestartSec = 5;
+
+        DynamicUser = true;
+
+        CacheDirectory = "postfix-tlspol";
+        CapabilityBoundingSet = [ "" ];
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        ReadOnlyPaths = [ "/etc/postfix-tlspol/config.yaml" ];
+        RemoveIPC = true;
+        RestrictAddressFamilies =
+          [
+            "AF_INET"
+            "AF_INET6"
+          ]
+          ++ lib.optionals (lib.hasPrefix "unix:" cfg.settings.server.address) [
+            "AF_UNIX"
+          ];
+        RestrictNamespace = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged @resources"
+        ];
+        SystemCallErrorNumber = "EPERM";
+        SecureBits = [
+          "noroot"
+          "noroot-locked"
+        ];
+        RuntimeDirectory = "postfix-tlspol";
+        RuntimeDirectoryMode = "1750";
+        WorkingDirectory = "/var/cache/postfix-tlspol";
+        UMask = "0117";
+      };
+    };
+  };
+}

nixos/modules/services/monitoring/prometheus/exporters.nix

···
 
   meta = {
     doc = ./exporters.md;
-    maintainers = [ maintainers.willibutz ];
+    maintainers = [ ];
   };
 }

nixos/modules/services/web-apps/nextcloud.nix

···
   mysqlLocal = cfg.database.createLocally && cfg.config.dbtype == "mysql";
   pgsqlLocal = cfg.database.createLocally && cfg.config.dbtype == "pgsql";
 
-  nextcloudGreaterOrEqualThan = versionAtLeast overridePackage.version;
-  nextcloudOlderThan = versionOlder overridePackage.version;
-
-  # https://github.com/nextcloud/documentation/pull/11179
-  ocmProviderIsNotAStaticDirAnymore =
-    nextcloudGreaterOrEqualThan "27.1.2"
-    || (nextcloudOlderThan "27.0.0" && nextcloudGreaterOrEqualThan "26.0.8");
-
   overrideConfig =
     let
       c = cfg.config;
···
             ] ++ runtimeSystemdCredentials;
             # On Nextcloud ≥ 26, it is not necessary to patch the database files to prevent
             # an automatic creation of the database user.
-            environment.NC_setup_create_db_user = lib.mkIf (nextcloudGreaterOrEqualThan "26") "false";
+            environment.NC_setup_create_db_user = "false";
           };
         nextcloud-cron = {
           after = [ "nextcloud-setup.service" ];
···
             priority = 500;
             extraConfig = ''
               # legacy support (i.e. static files and directories in cfg.package)
-              rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[s${
-                optionalString (!ocmProviderIsNotAStaticDirAnymore) "m"
-              }]-provider\/.+|.+\/richdocumentscode\/proxy) /index.php$request_uri;
+              rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|ocs-provider\/.+|.+\/richdocumentscode\/proxy) /index.php$request_uri;
               include ${config.services.nginx.package}/conf/fastcgi.conf;
               fastcgi_split_path_info ^(.+?\.php)(\\/.*)$;
               set $path_info $fastcgi_path_info;
···
                 default_type application/wasm;
               }
             '';
-          "~ ^\\/(?:updater|ocs-provider${
-            optionalString (!ocmProviderIsNotAStaticDirAnymore) "|ocm-provider"
-          })(?:$|\\/)".extraConfig =
-            ''
-              try_files $uri/ =404;
-              index index.php;
-            '';
+          "~ ^\\/(?:updater|ocs-provider)(?:$|\\/)".extraConfig = ''
+            try_files $uri/ =404;
+            index index.php;
+          '';
           "/remote" = {
             priority = 1500;
             extraConfig = ''

nixos/tests/all-tests.nix

···
   postfix-raise-smtpd-tls-security-level =
     handleTest ./postfix-raise-smtpd-tls-security-level.nix
       { };
+  postfix-tlspol = runTest ./postfix-tlspol.nix;
   postfixadmin = runTest ./postfixadmin.nix;
   postgres-websockets = runTest ./postgres-websockets.nix;
   postgresql = handleTest ./postgresql { };

nixos/tests/grafana/basic.nix

···
   {
     name = "grafana-basic";
 
-    meta = with maintainers; {
-      maintainers = [ willibutz ];
-    };
+    meta.maintainers = [ ];
 
     inherit nodes;
 

nixos/tests/grafana/provision/default.nix

···
   {
     name = "grafana-provision";
 
-    meta = with maintainers; {
-      maintainers = [ willibutz ];
-    };
+    meta.maintainers = [ ];
 
     inherit nodes;
 

nixos/tests/hedgedoc.nix

···
 {
   name = "hedgedoc";
 
-  meta = with lib.maintainers; {
-    maintainers = [ willibutz ];
-  };
-
+  meta.maintainers = [ ];
   nodes = {
     hedgedocSqlite =
       { ... }:

nixos/tests/initrd-network-ssh/default.nix

···
   {
     name = "initrd-network-ssh";
     meta.maintainers = with lib.maintainers; [
-      willibutz
       emily
     ];
 

nixos/tests/loki.nix

···
 {
   name = "loki";
 
-  meta = with lib.maintainers; {
-    maintainers = [ willibutz ];
-  };
+  meta.maintainers = [ ];
 
   nodes.machine =
     { ... }:

nixos/tests/postfix-tlspol.nix

···
+{
+  lib,
+  ...
+}:
+{
+  name = "postfix-tlspol";
+
+  meta.maintainers = with lib.maintainers; [ hexa ];
+
+  nodes.machine = {
+    services.postfix-tlspol.enable = true;
+  };
+
+  enableOCR = true;
+
+  testScript = ''
+    import json
+
+    machine.wait_for_unit("postfix-tlspol.service")
+
+    with subtest("Interact with the service"):
+      machine.succeed("postfix-tlspol -purge")
+
+      response = json.loads((machine.succeed("postfix-tlspol -query localhost")))
+      machine.log(json.dumps(response, indent=2))
+
+  '';
+
+}

nixos/tests/postgresql/pgjwt.nix

···
       meta = with lib.maintainers; {
         maintainers = [
           spinus
-          willibutz
         ];
       };
 

nixos/tests/prometheus-exporters.nix

···
         ${nodeName}.shutdown()
       '';
 
-      meta = with maintainers; {
-        maintainers = [ willibutz ];
-      };
+      meta.maintainers = [ ];
     }
   ))
 ) exporterTests

nixos/tests/wireguard/default.nix

···
     flip mapAttrsToList tests (
       name: test:
       nameValuePair "wireguard-${name}-linux-${v'}" (test {
-        kernelPackages = pkgs."linuxPackages_${v'}";
+        kernelPackages =
+          if v' == "latest" then pkgs.linuxPackages_latest else pkgs.linuxKernel.packages."linux_${v'}";
       })
     )
   )

nixos/tests/wstunnel.nix

···
-{ lib, ... }:
-
 let
   certs = import ./common/acme/server/snakeoil-certs.nix;
   domain = certs.domain;

pkgs/applications/emulators/libretro/cores/easyrpg.nix

···
 {
   lib,
   fetchFromGitHub,
+  mkLibretroCore,
+  nix-update-script,
+  asciidoctor,
   cmake,
-  fetchpatch,
+  doxygen,
+  pkg-config,
+  flac,
+  fluidsynth,
   fmt,
   freetype,
+  glib,
   harfbuzz,
+  lhasa,
   liblcf,
   libpng,
   libsndfile,
+  libsysprof-capture,
   libvorbis,
   libxmp,
-  mkLibretroCore,
   mpg123,
+  nlohmann_json,
   opusfile,
-  pcre,
+  pcre2,
   pixman,
-  pkg-config,
   speexdsp,
+  wildmidi,
 }:
-mkLibretroCore {
+mkLibretroCore rec {
   core = "easyrpg";
-  version = "0.8-unstable-2023-04-29";
+  # liblcf needs to be updated before this.
+  version = "0.8.1.1";
 
   src = fetchFromGitHub {
     owner = "EasyRPG";
     repo = "Player";
-    rev = "f8e41f43b619413f95847536412b56f85307d378";
-    hash = "sha256-nvWM4czTv/GxY9raomBEn7dmKBeLtSA9nvjMJxc3Q8s=";
+    rev = version;
+    hash = "sha256-2a8IdYP6Suc8a+Np5G+xoNzuPxkk9gAgR+sjdKUf89M=";
     fetchSubmodules = true;
   };
 
   extraNativeBuildInputs = [
+    asciidoctor
     cmake
+    doxygen
     pkg-config
   ];
   extraBuildInputs = [
+    flac # needed by libsndfile
+    fluidsynth
     fmt
     freetype
+    glib
     harfbuzz
+    lhasa
     liblcf
     libpng
     libsndfile
+    libsysprof-capture # needed by glib
     libvorbis
     libxmp
     mpg123
+    nlohmann_json
     opusfile
-    pcre
+    pcre2 # needed by glib
     pixman
     speexdsp
-  ];
-  patches = [
-    # The following patch is shared with easyrpg-player.
-    # Update when new versions of liblcf and easyrpg-player are released.
-    # See easyrpg-player expression for details.
-    (fetchpatch {
-      name = "0001-Fix-building-with-fmtlib-10.patch";
-      url = "https://github.com/EasyRPG/Player/commit/ab6286f6d01bada649ea52d1f0881dde7db7e0cf.patch";
-      hash = "sha256-GdSdVFEG1OJCdf2ZIzTP+hSrz+ddhTMBvOPjvYQHy54=";
-    })
+    wildmidi
   ];
   cmakeFlags = [
     "-DBUILD_SHARED_LIBS=ON"
···
   ];
   makefile = "Makefile";
 
-  # Do not update automatically since we want to pin a specific version
-  passthru.updateScript = null;
+  # Since liblcf needs to be updated before this, we should not
+  # use the default unstableGitUpdater.
+  passthru.updateScript = nix-update-script { };
 
   meta = {
     description = "EasyRPG Player libretro port";
     homepage = "https://github.com/EasyRPG/Player";
-    license = lib.licenses.gpl3Only;
+    license = lib.licenses.gpl3Plus;
   };
 }

pkgs/applications/graphics/drawio/default.nix

···
     export HOME="$TMPDIR"
     yarn config --offline set yarn-offline-mirror "$offlineCache"
     fixup-yarn-lock yarn.lock
+    # Ensure that the node_modules folder is created by yarn install.
+    # See https://github.com/yarnpkg/yarn/issues/5500#issuecomment-1221456246
+    echo "nodeLinker: node-modules" > .yarnrc.yml
     yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
     patchShebangs node_modules/
 

pkgs/applications/graphics/feh/default.nix

···
     maintainers = with maintainers; [
       gepbird
       globin
-      willibutz
     ];
     platforms = platforms.unix;
     mainProgram = "feh";

pkgs/applications/networking/browsers/chromium/info.json

···
     }
   },
   "ungoogled-chromium": {
-    "version": "137.0.7151.68",
+    "version": "137.0.7151.103",
     "deps": {
       "depot_tools": {
         "rev": "1fcc527019d786502b02f71b8b764ee674a40953",
···
         "hash": "sha256-+nKP2hBUKIqdNfDz1vGggXSdCuttOt0GwyGUQ3Z1ZHI="
       },
       "ungoogled-patches": {
-        "rev": "137.0.7151.68-1",
-        "hash": "sha256-oPYNvnBuBKBb1SRNQkQeApmPVDoV+bFVjCh9HKa4A8o="
+        "rev": "137.0.7151.103-1",
+        "hash": "sha256-KMzO25yruwrT7rpqbQ56FMGxkVZOwDSsvFqCZbUUM5Y="
       },
       "npmHash": "sha256-I6MsfAhrLRmgiRJ13LSejfy2N63C3Oug5tOOXA622j4="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "2989ffee9373ea8b8623bd98b3cb350a8e95cadc",
-        "hash": "sha256-lPmmXVCNUa9of8d52hUejImPSEfOz7v7PlovZS4cfIE=",
+        "rev": "3dcc738117a3439068c9773ccd31f9858923fc4a",
+        "hash": "sha256-MIEjHLpfKIBiTFh+bO+NUf6iDpizTP9yfXQqbHfiDwo=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
···
       },
       "src/third_party/devtools-frontend/src": {
         "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "fdc8ca697612f90e7ddf2621dffbc43733d2d238",
-        "hash": "sha256-jKYldgZJwJeTQavmcM9enTdGN8+zt/EG7K1E9wQYIBA="
+        "rev": "e423961606946be24c8c1ec0d1ec91511efbabc5",
+        "hash": "sha256-MhooXuF6aw+ixPzvVCBl+6T+79cTReCYx86qqXAZ6bg="
       },
       "src/third_party/dom_distiller_js/dist": {
         "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
···
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "e398f9bf6d5c8a768ab736f46146d7349cf31547",
-        "hash": "sha256-cJx8IgUB3UA3jEPvb5aDvHLYmAnHydK1qR11q6Y5PnA="
+        "rev": "41f53aba7095888c959932bd8f2ee8b4e16af223",
+        "hash": "sha256-ICrdvHA6fe2CUphRgPdlofazr0L+NFypWDNOI5e5QIM="
       }
     }
   }

pkgs/applications/networking/cluster/terraform/default.nix

···
   mkTerraform = attrs: pluggable (generic attrs);
 
   terraform_1 = mkTerraform {
-    version = "1.12.1";
-    hash = "sha256-ikpSkcP4zt91Lf9gziytlZ4P27A0IP2qL+H2Lp9Cspg=";
+    version = "1.12.2";
+    hash = "sha256-ilQ1rscGD66OT6lHsBgWELayC24B2D7l6iH6vtvqzFI=";
     vendorHash = "sha256-zWNLIurNP5e/AWr84kQCb2+gZIn6EAsuvr0ZnfSq7Zw=";
     patches = [ ./provider-path-0_15.patch ];
     passthru = {

pkgs/applications/networking/irc/weechat/scripts/wee-slack/default.nix

···
   meta = with lib; {
     homepage = "https://github.com/wee-slack/wee-slack";
     license = licenses.mit;
-    maintainers = with maintainers; [ willibutz ];
+    maintainers = [ ];
     description = ''
       A WeeChat plugin for Slack.com. Synchronizes read markers, provides typing notification, search, etc..
     '';

pkgs/applications/networking/sniffers/wireshark/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "wireshark-${if withQt then "qt" else "cli"}";
-  version = "4.4.6";
+  version = "4.4.7";
 
   outputs = [
     "out"
···
     repo = "wireshark";
     owner = "wireshark";
     rev = "v${version}";
-    hash = "sha256-dzVlHxrXVCSMP4ZfyUq4N9UvL941C50Zto6Mb78LnfQ=";
+    hash = "sha256-9h25vfjw8QIrRZ6APTsvhW4D5O6fkhkiy/1bj7hGwwY=";
   };
 
   patches = [

pkgs/applications/version-management/git-review/default.nix

···
 {
   lib,
-  fetchFromGitea,
   buildPythonApplication,
+  fetchgit,
   pbr,
   requests,
   setuptools,
···
 
 buildPythonApplication rec {
   pname = "git-review";
-  version = "2.4.0";
+  version = "2.5.0";
 
   # Manually set version because prb wants to get it from the git
   # upstream repository (and we are installing from tarball instead)
   PBR_VERSION = version;
 
-  src = fetchFromGitea {
-    domain = "opendev.org";
-    owner = "opendev";
-    repo = "git-review";
-    rev = version;
-    hash = "sha256-UfYc662NqnQt0+CKc+18jXnNTOcZv8urCNBsWd6x0VQ=";
+  # fetchFromGitea fails trying to download archive file
+  src = fetchgit {
+    url = "https://opendev.org/opendev/git-review";
+    tag = version;
+    hash = "sha256-RE5XAUS46Y/jtI0/csR59B9l1gYpHuwGQkbWqoTfxPk=";
   };
 
   outputs = [
···
   meta = with lib; {
     description = "Tool to submit code to Gerrit";
     homepage = "https://opendev.org/opendev/git-review";
+    changelog = "https://docs.opendev.org/opendev/git-review/latest/releasenotes.html#relnotes-${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ kira-bruneau ];
     mainProgram = "git-review";

pkgs/applications/virtualization/lkl/default.nix pkgs/by-name/lk/lkl/package.nix

···
   python3,
   bison,
   flex,
-  fuse,
+  fuse3,
   libarchive,
   buildPackages,
 
···
 stdenv.mkDerivation {
   pname = "lkl";
 
-  # NOTE: pinned to the last known version that doesn't have a hang in cptofs.
-  # Please verify `nix build -f nixos/release-combined.nix nixos.ova` works
-  # before attempting to update again.
-  # ref: https://github.com/NixOS/nixpkgs/pull/219434
-  version = "2022-08-08";
+  version = "2025-03-20";
 
   outputs = [
     "dev"
···
   src = fetchFromGitHub {
     owner = "lkl";
     repo = "linux";
-    rev = "ffbb4aa67b3e0a64f6963f59385a200d08cb2d8b";
-    sha256 = "sha256-24sNREdnhkF+P+3P0qEh2tF1jHKF7KcbFSn/rPK2zWs=";
+    rev = "fd33ab3d21a99a31683ebada5bd3db3a54a58800";
+    sha256 = "sha256-3uPkOyL/hoA/H2gKrEEDsuJvwOE2x27vxY5Y2DyNNxU=";
   };
 
   nativeBuildInputs = [
···
   ];
 
   buildInputs = [
-    fuse
+    fuse3
     libarchive
   ];
 
···
     platforms = platforms.linux; # Darwin probably works too but I haven't tested it
     license = licenses.gpl2;
     maintainers = with maintainers; [
-      raitobezarius
+      timschumi
     ];
   };
 }

pkgs/by-name/am/amnezia-vpn/package.nix

···
   stdenv,
   fetchFromGitHub,
   fetchpatch,
+  fetchurl,
   cmake,
   pkg-config,
   kdePackages,
···
       vendorHash = "sha256-zArdGj5yeRxU0X4jNgT5YBI9SJUyrANDaqNPAPH3d5M=";
     }
   );
+
+  amneziaPremiumConfig = fetchurl {
+    url = "https://raw.githubusercontent.com/amnezia-vpn/amnezia-client-lite/f45d6b242c1ac635208a72914e8df76ccb3aa44c/macos-signed-build.sh";
+    hash = "sha256-PnaPVPlyglUphhknWwP7ziuwRz+WOz0k9WRw6Q0nG2c=";
+    postFetch = ''
+      sed -nri '/PROD_AGW_PUBLIC_KEY|PROD_S3_ENDPOINT/p' $out
+    '';
+  };
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "amnezia-vpn";
···
     qt6.qtbase
     qt6.qttools
   ];
+
+  preConfigure = ''
+    source ${amneziaPremiumConfig}
+  '';
 
   installPhase = ''
     runHook preInstall

pkgs/by-name/an/ants/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ANTs";
-  version = "2.6.1";
+  version = "2.6.2";
 
   src = fetchFromGitHub {
     owner = "ANTsX";
     repo = "ANTs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-H/5X6cCjv+7KuZGJ7D4d5VxlpOqbO80U+7CoYnY/dsU=";
+    hash = "sha256-TQR3HghaFBBiHl5oz3vmu7DIGT8UY5/CxY0pP0bLZx4=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/au/audacity/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "audacity";
-  version = "3.7.3";
+  version = "3.7.4";
 
   src = fetchFromGitHub {
     owner = "audacity";
     repo = "audacity";
     rev = "Audacity-${finalAttrs.version}";
-    hash = "sha256-j3rbcUUHXAQmn/7SzpKHvpxGZ3bBhIYrNOFLc7jMPlc=";
+    hash = "sha256-kESKpIke9Xi4A55i3mUu1JkDjp8voBJBixiAK8pUkKA=";
   };
 
   postPatch =

pkgs/by-name/bl/blueutil/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "blueutil";
-  version = "2.10.0";
+  version = "2.12.0";
 
   src = fetchFromGitHub {
     owner = "toy";
     repo = "blueutil";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-x2khx8Y0PolpMiyrBatT2aHHyacrQVU/02Z4Dz9fBtI=";
+    hash = "sha256-JwX3NHXbGgEj+ZCyu9gWp2TCihokaAw5oHCrlmpy6HA=";
   };
 
   env.NIX_CFLAGS_COMPILE = "-Wall -Wextra -Werror -mmacosx-version-min=10.9 -framework Foundation -framework IOBluetooth";

pkgs/by-name/br/bruno/package.nix

···
 
 buildNpmPackage rec {
   pname = "bruno";
-  version = "2.4.0";
+  version = "2.5.0";
 
   src = fetchFromGitHub {
     owner = "usebruno";
     repo = "bruno";
     tag = "v${version}";
-    hash = "sha256-fE4WwgdwTB4s8NYQclUeDWJ132HJO0/3Hmesp9yvzGg=";
+    hash = "sha256-5kCYKktD71LdknIITSXzl/r5IRUyBUCKL9mmjsMwYRI=";
 
     postFetch = ''
       ${lib.getExe npm-lockfile-fix} $out/package-lock.json
     '';
   };
 
-  npmDepsHash = "sha256-ZUZZWnp10Z4vQTZTTPenAXXpez6WbmB/S1VBiARuNP4=";
+  npmDepsHash = "sha256-AA+f6xVd1hmZUum7AlhHivqNez7xP1kEd/GXd798QCI=";
   npmFlags = [ "--legacy-peer-deps" ];
 
   nativeBuildInputs =

pkgs/by-name/ca/cassowary/package.nix

···
 
 buildGoModule rec {
   pname = "cassowary";
-  version = "0.18.0";
+  version = "0.19.0";
 
   src = fetchFromGitHub {
     owner = "rogerwelin";
     repo = "cassowary";
     rev = "v${version}";
-    sha256 = "sha256-zaG4HrdTGXTalMFz/huRW32RZBQx55AvUi29tz6vFD8=";
+    sha256 = "sha256-27sEexOGLQ42qWY+vCiPTt5XR66TSUvKsuGgtkbMgE4=";
   };
 
   vendorHash = "sha256-YP9q9lL2A9ERhzbJBIFKsYsgvy5xYeUO3ekyQdh97f8=";

pkgs/by-name/cl/cloudfoundry-cli/package.nix

···
 
 buildGoModule rec {
   pname = "cloudfoundry-cli";
-  version = "8.14.0";
+  version = "8.14.1";
 
   src = fetchFromGitHub {
     owner = "cloudfoundry";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-vlDq7Wme8undaZ6HNd84QsWW8Vz0Tev+9nSTbn+NLic=";
+    sha256 = "sha256-gkwiDLtd7pPJY5iliTPg2/5KITps9LohHPnBYUxfaPs=";
   };
-  vendorHash = "sha256-TWVnUdqVIqTRn5tgO+DgCY421riyYkrQS8AkTVYszZ4=";
+  vendorHash = "sha256-ygRb87WjA0e+mBwK3JLh0b7dbib7tM91hq7eD2f2AAU=";
 
   subPackages = [ "." ];
 

pkgs/by-name/do/dotenvx/package.nix

···
 
 buildNpmPackage rec {
   pname = "dotenvx";
-  version = "1.44.1";
+  version = "1.44.2";
 
   src = fetchFromGitHub {
     owner = "dotenvx";
     repo = "dotenvx";
     tag = "v${version}";
-    hash = "sha256-uzEZfzGAwA/boDft/Z3Toq3gUG0n3nqREtLjgmIO1Kw=";
+    hash = "sha256-1G0byz6kaW60yz+eN6TyFxTzyp72RfAWC9y8ZHe0FAQ=";
   };
 
-  npmDepsHash = "sha256-kWOj/78yurII4O9XYzcvC2JflCWRbbqIOU4WkdbX5AM=";
+  npmDepsHash = "sha256-OQJZ9yicdF2xdiomyKDcrmeqXxPtPO/DNtpdQJaSls8=";
 
   dontNpmBuild = true;
 

pkgs/by-name/do/dovecot_exporter/package.nix

···
     mainProgram = "dovecot_exporter";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [
-      willibutz
       globin
     ];
   };

pkgs/by-name/ea/easyrpg-player/package.nix

···
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
+  asciidoctor,
   cmake,
   doxygen,
   pkg-config,
+  alsa-lib,
+  flac,
+  fluidsynth,
+  fmt,
   freetype,
-  fmt,
   glib,
   harfbuzz,
+  lhasa,
+  libdecor,
   liblcf,
   libpng,
   libsndfile,
+  libsysprof-capture,
   libvorbis,
-  libxmp,
   libXcursor,
   libXext,
   libXi,
   libXinerama,
+  libxmp,
   libXrandr,
   libXScrnSaver,
   libXxf86vm,
   mpg123,
+  nlohmann_json,
   opusfile,
-  pcre,
+  pcre2,
   pixman,
-  SDL2,
+  sdl3,
   speexdsp,
   wildmidi,
   zlib,
-  libdecor,
-  alsa-lib,
-  asciidoctor,
 }:
 
 stdenv.mkDerivation rec {
   pname = "easyrpg-player";
-  version = "0.8";
+  # liblcf needs to be updated before this.
+  version = "0.8.1.1";
 
   src = fetchFromGitHub {
     owner = "EasyRPG";
     repo = "Player";
     rev = version;
-    hash = "sha256-t0sa9ONVVfsiTy+us06vU2bMa4QmmQeYxU395g0WS6w=";
+    hash = "sha256-fYSpFhqETkQhRK1/Uws0fWWdCr35+1J4vCPX9ZiQ3ZA=";
   };
 
-  patches = [
-    # Fixed compatibility with fmt > 9
-    # Remove when version > 0.8
-    (fetchpatch {
-      name = "0001-Fix-building-with-fmtlib-10.patch";
-      url = "https://github.com/EasyRPG/Player/commit/ab6286f6d01bada649ea52d1f0881dde7db7e0cf.patch";
-      hash = "sha256-GdSdVFEG1OJCdf2ZIzTP+hSrz+ddhTMBvOPjvYQHy54=";
-    })
-  ];
-
   strictDeps = true;
 
   nativeBuildInputs = [
···
 
   buildInputs =
     [
+      flac # needed by libsndfile
+      fluidsynth
       fmt
       freetype
       glib
       harfbuzz
+      lhasa
       liblcf
       libpng
       libsndfile
+      libsysprof-capture # needed by glib
       libvorbis
       libxmp
       mpg123
+      nlohmann_json
       opusfile
-      pcre
+      pcre2 # needed by glib
       pixman
-      SDL2
+      sdl3
       speexdsp
+      wildmidi
       zlib
     ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
···
       libXScrnSaver
       libXxf86vm
       libdecor
-      wildmidi # until packaged on Darwin
     ];
 
   cmakeFlags = [
     "-DPLAYER_ENABLE_TESTS=${lib.boolToString doCheck}"
+    # TODO: remove the below once SDL3 becomes default next major release
+    "-DPLAYER_TARGET_PLATFORM=SDL3"
   ];
 
   makeFlags = [
···
     ln -s $out/{Applications/EasyRPG\ Player.app/Contents/MacOS,bin}/EasyRPG\ Player
   '';
 
+  enableParallelChecking = true;
   doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
-
-  enableParallelChecking = true;
 
   meta = with lib; {
     description = "RPG Maker 2000/2003 and EasyRPG games interpreter";
     homepage = "https://easyrpg.org/";
-    license = licenses.gpl3;
+    license = licenses.gpl3Plus;
     maintainers = [ ];
     platforms = platforms.all;
     mainProgram = lib.optionalString stdenv.hostPlatform.isDarwin "EasyRPG Player";

pkgs/by-name/fi/files-cli/package.nix

···
 
 buildGoModule rec {
   pname = "files-cli";
-  version = "2.15.16";
+  version = "2.15.25";
 
   src = fetchFromGitHub {
     repo = "files-cli";
     owner = "files-com";
     rev = "v${version}";
-    hash = "sha256-5PLR6If13f6n6v4MuT9XUCIr2QfW6aZ97lvSoLrO+wM=";
+    hash = "sha256-pdUvxWdFeL2whTgP+iqJ5spxHW5xMjSpIMf+0VbqPwI=";
   };
 
-  vendorHash = "sha256-IbOxMNmOOH2qUFlpyhwVdWFcD9gfMxKSF5paZ9L6qYM=";
+  vendorHash = "sha256-bDoomu7zyoTb6yAXwYlLTbw94gTIM0ELbey/AXgov48=";
 
   ldflags = [
     "-s"

pkgs/by-name/fi/fileshelter/package.nix

···
     homepage = "https://github.com/epoupon/fileshelter";
     description = "FileShelter is a 'one-click' file sharing web application";
     mainProgram = "fileshelter";
-    maintainers = [ lib.maintainers.willibutz ];
+    maintainers = [ ];
     license = lib.licenses.gpl3;
     platforms = [ "x86_64-linux" ];
   };

pkgs/by-name/fl/flashmq/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "flashmq";
-  version = "1.21.1";
+  version = "1.22.0";
 
   src = fetchFromGitHub {
     owner = "halfgaar";
     repo = "FlashMQ";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ccTarrInS9Af9fT43dgRTuHVuHbWlYzDAEh31myHUvY=";
+    hash = "sha256-yFoyErmBvitBRQ2bNOPY62FaV6YJNAXx8dqkIw2ACm4=";
   };
 
   nativeBuildInputs = [
···
     description = "Fast light-weight MQTT broker/server";
     mainProgram = "flashmq";
     homepage = "https://www.flashmq.org/";
-    license = lib.licenses.agpl3Only;
+    license = lib.licenses.osl3;
     maintainers = with lib.maintainers; [ sikmir ];
     platforms = lib.platforms.linux;
   };

pkgs/by-name/fr/freeradius/package.nix

···
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [
       sheenobu
-      willibutz
     ];
     platforms = with platforms; linux;
   };

pkgs/by-name/ge/geteduroam-cli/package.nix

···
 }:
 buildGoModule (finalAttrs: {
   pname = "geteduroam-cli";
-  version = "0.11";
+  version = "0.12";
 
   src = fetchFromGitHub {
     owner = "geteduroam";
     repo = "linux-app";
     tag = finalAttrs.version;
-    hash = "sha256-CbgQn6mf1125DYKBDId+BmFMcfdWNW2M4/iLoiELOAY=";
+    hash = "sha256-+3mluLby3R0xVU9fIG+1B1A4yM1IfyUvw4wclwnV5s8=";
   };
 
-  vendorHash = "sha256-b06wnqT88J7etNTFJ6nE9Uo0gOQOGvvs0vPNnJr6r4Q=";
+  vendorHash = "sha256-l9hge1TS+7ix9/6LKWq+lTMjNM4/Lnw8gNrWB6hWCTk=";
 
   subPackages = [
     "cmd/geteduroam-cli"

pkgs/by-name/gi/gitu/package.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "gitu";
-  version = "0.32.0";
+  version = "0.33.0";
 
   src = fetchFromGitHub {
     owner = "altsem";
     repo = "gitu";
     rev = "v${version}";
-    hash = "sha256-ER+k+yOJP+pgoD785wddsVaTf7/E3iysjkeGq4slgF0=";
+    hash = "sha256-9rJa6nXz9gzEVAVkvIghMaND7MY84dLHLV6Kr/ApEnU=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-fSaTuDa3cRxpoduKRMuMPagBGfY3vSYtvEuvwlMk2HA=";
+  cargoHash = "sha256-QN+AU9Qsqx2l2vwpANkMhycv2qFzjCQoxFgbP9WVpOk=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/gi/gixy/package.nix

···
     homepage = "https://github.com/yandex/gixy";
     sourceProvenance = [ lib.sourceTypes.fromSource ];
     license = lib.licenses.mpl20;
-    maintainers = [ lib.maintainers.willibutz ];
+    maintainers = [ ];
     platforms = lib.platforms.unix;
   };
 }

pkgs/by-name/go/gotree/package.nix

···
 
 buildGoModule rec {
   pname = "gotree";
-  version = "1.4.1";
+  version = "1.4.3";
 
   src = fetchFromGitHub {
     owner = "elbachir-one";
     repo = "gt";
     rev = "v${version}";
-    hash = "sha256-sWKqfDWwMfj4shg/MxHu7Zr4WE5pxAzHHmsjU3jQY10=";
+    hash = "sha256-0wYuIaGkJHSD8La1yfBYNPDB8ETtID8e5lgahqQgjLM=";
   };
 
   vendorHash = null;

pkgs/by-name/gr/grafana-loki/package.nix

···
     homepage = "https://grafana.com/oss/loki/";
     changelog = "https://github.com/grafana/loki/releases/tag/v${version}";
     maintainers = with lib.maintainers; [
-      willibutz
       globin
       mmahut
       emilylange

pkgs/by-name/hy/hylafaxplus/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hylafaxplus";
-  version = "7.0.10";
+  version = "7.0.11";
   src = fetchurl {
     url = "mirror://sourceforge/hylafax/hylafax-${finalAttrs.version}.tar.gz";
-    hash = "sha512-6HdYMHq4cLbS06UXs+FEg3XtsMRyXflrgn/NEsgyMFkTS/MoGW8RVXgbXxAhcArpFvMsY0NUPLE3jdbqqWWQCw==";
+    hash = "sha512-JRuJdE17VBrlhVz5GBc2dKBtwzPjljeropcug0bsRvO/8SJvP5PzIP5gbBLpMQKGb77SNp2iNCCOroBOUOn57A==";
   };
   patches = [
     # adjust configure check to work with libtiff > 4.1

pkgs/by-name/ig/igraph/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "igraph";
-  version = "0.10.15";
+  version = "0.10.16";
 
   src = fetchFromGitHub {
     owner = "igraph";
     repo = "igraph";
     rev = finalAttrs.version;
-    hash = "sha256-TSAVRLeOWh3IQ9X0Zr4CQS+h1vTeUZnzMp/IYujGMn0=";
+    hash = "sha256-Qs2WXAiAQhQ077KEtkapr8ckw6Jlbxj6qwyiplsEaLY=";
   };
 
   postPatch = ''

pkgs/by-name/ji/jikespg/package.nix

···
-{
-  lib,
-  stdenv,
-  fetchurl,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "jikespg";
-  version = "1.3";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/jikes/${pname}-${version}.tar.gz";
-    sha256 = "083ibfxaiw1abxmv1crccx1g6sixkbyhxn2hsrlf6fwii08s6rgw";
-  };
-
-  postPatch = ''
-    substituteInPlace Makefile --replace-fail "gcc" "${stdenv.cc.targetPrefix}cc ${lib.optionalString stdenv.hostPlatform.isDarwin "-std=c89"}"
-  '';
-
-  sourceRoot = "jikespg/src";
-
-  installPhase = ''
-    install -Dm755 -t $out/bin jikespg
-  '';
-
-  meta = with lib; {
-    homepage = "https://jikes.sourceforge.net/";
-    description = "Jikes Parser Generator";
-    mainProgram = "jikespg";
-    platforms = platforms.all;
-    license = licenses.ipl10;
-    maintainers = with maintainers; [ pSub ];
-  };
-}

pkgs/by-name/ka/kanidm/1_6.nix

···
 import ./generic.nix {
-  version = "1.6.3";
-  hash = "sha256-oZU7XgGpkPAwuUVVjpiKApOiQN692CRFjmWzE9hcqPY=";
-  cargoHash = "sha256-cgTCLTcPXjGdvremw1afyRGHwnBvqNGXr1D8Xgxv4uA=";
+  version = "1.6.4";
+  hash = "sha256-ui3w1HDHXHARsjQ3WtJfZbM7Xgg3ODnUneXJMQwaOMw=";
+  cargoHash = "sha256-KJGELBzScwsLd6g3GR9Vk0nfDU2EjZBfXwlXJ+bZb1k=";
   patchDir = ./patches/1_6;
 }

pkgs/by-name/kr/krakenx/package.nix

···
     description = "Python script to control NZXT cooler Kraken X52/X62/X72";
     homepage = "https://github.com/KsenijaS/krakenx";
     license = licenses.gpl2Only;
-    maintainers = [ maintainers.willibutz ];
+    maintainers = [ ];
     platforms = platforms.linux;
   };
 }

pkgs/by-name/li/libevdevplus/package.nix

···
     inherit (src.meta) homepage;
     description = "Easy-to-use event device library in C++";
     license = licenses.mit;
-    maintainers = with maintainers; [ willibutz ];
+    maintainers = [ ];
     platforms = with platforms; linux;
   };
 }

pkgs/by-name/li/liblcf/package.nix

···
   lib,
   stdenv,
   fetchFromGitHub,
+  nix-update-script,
   autoreconfHook,
   pkg-config,
   expat,
   icu74,
+  inih,
 }:
 
 stdenv.mkDerivation rec {
   pname = "liblcf";
-  version = "0.8";
+  # When updating this package, you should probably also update
+  # easyrpg-player and libretro.easyrpg
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "EasyRPG";
     repo = "liblcf";
     rev = version;
-    hash = "sha256-jJGIsNw7wplTL5FBWGL8osb9255o9ZaWgl77R+RLDMM=";
+    hash = "sha256-jIk55+n8wSk3Z3FPR18SE7U3OuWwmp2zJgvSZQBB2l0=";
   };
 
-  dtrictDeps = true;
+  strictDeps = true;
 
   nativeBuildInputs = [
     autoreconfHook
···
   propagatedBuildInputs = [
     expat
     icu74
+    inih
   ];
 
   enableParallelBuilding = true;
   enableParallelChecking = true;
 
   doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+
+  passthru.updateScript = nix-update-script { };
 
   meta = with lib; {
     description = "Library to handle RPG Maker 2000/2003 and EasyRPG projects";

pkgs/by-name/li/libtorrent/package.nix

···
   lib,
   stdenv,
   fetchFromGitHub,
-  autoconf-archive,
   autoreconfHook,
   cppunit,
   openssl,
···
   gitUpdater,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "rakshasa-libtorrent";
-  version = "0.15.1";
+  version = "0.15.4";
 
   src = fetchFromGitHub {
     owner = "rakshasa";
     repo = "libtorrent";
-    rev = "v${version}";
-    hash = "sha256-ejDne7vaV+GYP6M0n3VAEva4UHuxRGwfc2rgxf7U/EM=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-EtT1g8fo2XRVO7pGUThoEklxpYKPI7OWwCZ2vVV73k4=";
   };
 
   nativeBuildInputs = [
-    autoconf-archive
     autoreconfHook
     pkg-config
   ];
···
     ];
     platforms = lib.platforms.unix;
   };
-}
+})

pkgs/by-name/li/libuinputplus/package.nix

···
     inherit (src.meta) homepage;
     description = "Easy-to-use uinput library in C++";
     license = licenses.mit;
-    maintainers = with maintainers; [ willibutz ];
+    maintainers = [ ];
     platforms = with platforms; linux;
   };
 }

pkgs/by-name/ln/lnd/package.nix

···
 
 buildGoModule rec {
   pname = "lnd";
-  version = "0.19.0-beta";
+  version = "0.19.1-beta";
 
   src = fetchFromGitHub {
     owner = "lightningnetwork";
     repo = "lnd";
     rev = "v${version}";
-    hash = "sha256-eKRgkD/kUz0MkK624R3OahTHOrdP18nBuSZP1volHq8=";
+    hash = "sha256-ifxEUEQUhy1msMsP+rIx0s1GkI+569kMR9LwymeSPkY=";
   };
 
-  vendorHash = "sha256-A7veNDrPke1N+1Ctg4cMqjPhTwyVfbkGMi/YP1xIUqY=";
+  vendorHash = "sha256-FYyjCNiHKoG7/uvxhHKnEz3J4GuKwEJcjrFXYqCxTtc=";
 
   subPackages = [
     "cmd/lncli"

pkgs/by-name/me/megatools/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "megatools";
-  version = "1.11.1";
+  version = "1.11.4";
 
   src = fetchgit {
-    url = "https://megous.com/git/megatools";
+    url = "https://xff.cz/git/megatools";
     rev = version;
-    sha256 = "sha256-AdvQqaRTsKTqdfNfFiWtA9mIPVGuui+Ru9TUARVG0+Q=";
+    hash = "sha256-pF87bphrlI0VYFXD8RMztGr+NqBSL6np/cldCbHiK7A=";
   };
 
   nativeBuildInputs = [
···
   enableParallelBuilding = true;
   strictDeps = true;
 
-  meta = with lib; {
+  meta = {
     description = "Command line client for Mega.co.nz";
-    homepage = "https://megatools.megous.com/";
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ viric ];
-    platforms = platforms.unix;
+    homepage = "https://xff.cz/megatools/";
+    changelog = "https://xff.cz/megatools/builds/NEWS";
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [
+      viric
+      vji
+    ];
+    platforms = lib.platforms.unix;
   };
 }

pkgs/by-name/mt/mtail/package.nix

···
 
 buildGoModule rec {
   pname = "mtail";
-  version = "3.2.4";
+  version = "3.2.5";
 
   src = fetchFromGitHub {
     owner = "jaqx0r";
     repo = "mtail";
     rev = "v${version}";
-    hash = "sha256-3ox+EXd5/Rh3N/7GbX+JUmH4C9j/Er+REkUHZndTxw0=";
+    hash = "sha256-T81eLshaHqbLj4X0feWJE+VEWItmOxcVCQX04zl3jeA=";
   };
 
-  vendorHash = "sha256-7EQFO7dlVhBwHdY6c3WmxJo4WdCUJbWKw5P4fL6jBsA=";
+  vendorHash = "sha256-Q3Fj73sQAmZQ9OF5hI0t1iPkY8u189PZ4LlzW34NQx0=";
 
   nativeBuildInputs = [
     gotools # goyacc

pkgs/by-name/na/nasm/package.nix

···
     platforms = platforms.unix;
     maintainers = with maintainers; [
       pSub
-      willibutz
     ];
     license = licenses.bsd2;
   };

pkgs/by-name/oc/octoprint/package.nix

···
       (self: super: {
         octoprint = self.buildPythonPackage rec {
           pname = "OctoPrint";
-          version = "1.11.1";
+          version = "1.11.2";
 
           src = fetchFromGitHub {
             owner = "OctoPrint";
             repo = "OctoPrint";
             rev = version;
-            hash = "sha256-eH5AWeER2spiWgtRM5zMp40OakpM5TMXO07WjdY7gNU=";
+            hash = "sha256-D6lIEa7ee44DWavMLaXIo7RsKwaMneYqOBQk626pI20=";
           };
 
           propagatedBuildInputs =

pkgs/by-name/op/opsdroid/package.nix

···
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [
       globin
-      willibutz
     ];
     platforms = lib.platforms.unix;
     mainProgram = "opsdroid";

pkgs/by-name/po/postfix-tlspol/package.nix

···
   lib,
   buildGoModule,
   fetchFromGitHub,
+  nixosTests,
 }:
 
 buildGoModule rec {
···
   doCheck = false;
 
   ldflags = [ "-X main.Version=${version}" ];
+
+  passthru.tests = {
+    inherit (nixosTests) postfix-tlspol;
+  };
 
   meta = {
     description = "Lightweight MTA-STS + DANE/TLSA resolver and TLS policy server for Postfix, prioritizing DANE.";

pkgs/by-name/pr/prometheus/package.nix

···
     license = licenses.asl20;
     maintainers = with maintainers; [
       fpletz
-      willibutz
       Frostman
     ];
   };

pkgs/by-name/qu/quiet/package.nix

···
 
 appimageTools.wrapType2 rec {
   pname = "quiet";
-  version = "5.0.1";
+  version = "5.1.2";
 
   src = fetchurl {
     url = "https://github.com/TryQuiet/quiet/releases/download/@quiet/desktop@${version}/Quiet-${version}.AppImage";
-    hash = "sha256-RZ1YTSNNxCmon8+UR8NlqlYisQZRnzDUIV+oUGAWhuk=";
+    hash = "sha256-ahJUBvQVfU8CtGq5p+S8avpHRkXSn9kQv9HPN7TvJiM=";
   };
 
   meta = {

pkgs/by-name/ra/raycast/package.nix

···
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "raycast";
-  version = "1.99.2";
+  version = "1.100.0";
 
   src =
     {
       aarch64-darwin = fetchurl {
         name = "Raycast.dmg";
         url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=arm";
-        hash = "sha256-VtZy1pUayK4r8L74llguBid5VJ1UcanNg8rWcOswVh4=";
+        hash = "sha256-uoROEh0ERGpvO4lX/ni5gn+fqwMNOzk7CoPgEnL7ktE=";
       };
       x86_64-darwin = fetchurl {
         name = "Raycast.dmg";
         url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=x86_64";
-        hash = "sha256-PoR7bln88TtfNixhHnBCIA8ddesjQTin2o6nZ4dXPms=";
+        hash = "sha256-LdGVNWgQ8bxgqHSvnVizbWeXnHe7JSk47Kn5jGsrNbs=";
       };
     }
     .${stdenvNoCC.system} or (throw "raycast: ${stdenvNoCC.system} is unsupported.");

pkgs/by-name/rs/rspamd/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "rspamd";
-  version = "3.11.1";
+  version = "3.12.0";
 
   src = fetchFromGitHub {
     owner = "rspamd";
     repo = "rspamd";
     rev = version;
-    hash = "sha256-vG52R8jYJlCgQqhA8zbZLMES1UxfxknAVOt87nhcflM=";
+    hash = "sha256-4C+bhUkqdn9RelHf6LfcfxVCIiBUCt4BxuI9TGdlIMc=";
   };
 
   hardeningEnable = [ "pie" ];

pkgs/by-name/rt/rtorrent/package.nix

···
 {
   lib,
   stdenv,
-  autoconf-archive,
   autoreconfHook,
   cppunit,
   curl,
···
   gitUpdater,
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "rakshasa-rtorrent";
-  version = "0.15.1";
+  version = "0.15.4";
 
   src = fetchFromGitHub {
     owner = "rakshasa";
     repo = "rtorrent";
-    rev = "68fdb86c723a0ae67ebaffec416af99fec41dcbc";
-    hash = "sha256-/GWC28LsY7GcUH+SBzi01sOWVfA1lyM0r9OdUDTYbT8=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-0OnDxmfliVP3GF2xzUZkURippzCGUwLebuyjb7nz/vs=";
   };
 
   outputs = [
···
   };
 
   nativeBuildInputs = [
-    autoconf-archive
     autoreconfHook
     installShellFiles
     pkg-config
···
     platforms = lib.platforms.unix;
     mainProgram = "rtorrent";
   };
-}
+})

pkgs/by-name/te/tempo/package.nix

···
     description = "High volume, minimal dependency trace storage";
     license = licenses.asl20;
     homepage = "https://grafana.com/oss/tempo/";
-    maintainers = with maintainers; [ willibutz ];
+    maintainers = [ ];
   };
 }

pkgs/by-name/te/testkube/package.nix

···
 }:
 buildGoModule rec {
   pname = "testkube";
-  version = "2.1.154";
+  version = "2.1.157";
 
   src = fetchFromGitHub {
     owner = "kubeshop";
     repo = "testkube";
     rev = "v${version}";
-    hash = "sha256-vMARS8EWEjkrBIx4rpTQjtEshMAsXLPBztCE+HbwuX8=";
+    hash = "sha256-VI03scPMjTwLEO07kFj9SwNx2NunBBrkxpwUiOZEkNE=";
   };
 
-  vendorHash = "sha256-Bzk4+sG5Zf2qZzVyw0xRx4WuZsWtHRasDtLnTyq++HY=";
+  vendorHash = "sha256-gfJBj4LJRe/bHjWOrNrANdPKQ57AFpwzojxg5y0/Y2o=";
 
   ldflags = [
     "-X main.version=${version}"

pkgs/by-name/ti/tilt/assets.nix

···
     dontInstall = true;
 
     outputHashAlgo = "sha256";
-    outputHash = "sha256-1poTBB9cm0EHeIvXhan6/kaxr22LXvhHD4Y+JBocioE=";
+    outputHash = "sha256-twc8mtBPizQrA9kRtQpSXG8Q404sbGVs5ay4MHitPgg=";
     outputHashMode = "recursive";
   };
 

pkgs/by-name/ti/tilt/package.nix

···
       running in development environment and try to serve assets from the
       source tree, which is not there once build completes.
     */
-    version = "0.33.21";
+    version = "0.34.5";
 
     src = fetchFromGitHub {
       owner = "tilt-dev";
       repo = "tilt";
-      rev = "v${version}";
-      hash = "sha256-3LFsTaz47QAIDGId/Tl3G7xP5b9gc25X+ZeMaVhXf8w=";
+      tag = "v${version}";
+      hash = "sha256-UCQN1DKscBOhta4Ok5ZeqAUQIqbn8G7aLIeYExCqg1o=";
     };
   };
 

pkgs/by-name/ve/velocity/package.nix

···
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "velocity";
-  version = "3.4.0-unstable-2025-05-21";
+  version = "3.4.0-unstable-2025-06-11";
 
   src = fetchFromGitHub {
     owner = "PaperMC";
     repo = "Velocity";
-    rev = "678c7aa3a42aaf64b8b1b7df75e787cbec9fe2ad";
-    hash = "sha256-///JQxm+YlQQFyokqCoApxYCNVhvCK+XxwXM7psa+us=";
+    rev = "669fda298c670c55686f34d868383052b192518d";
+    hash = "sha256-UI6SqVAaM4NANf9cGvsIgYO1jSkWDOk5ysyufrPWTgg=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/vp/vpl-gpu-rt/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "vpl-gpu-rt";
-  version = "25.2.3";
+  version = "25.2.4";
 
   outputs = [
     "out"
···
     owner = "intel";
     repo = "vpl-gpu-rt";
     rev = "intel-onevpl-${version}";
-    hash = "sha256-59OG/1tS4SiPZk3ep508m/ULLMU7fJ7Bj9tYe9Do5AY=";
+    hash = "sha256-XLXnQNkeOjuLv+MgX6xgHyVPJ5r9HL4QS6v7j7dRqBY=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/wi/wireguard-tools/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "wireguard-tools";
-  version = "1.0.20210914";
+  version = "1.0.20250521";
 
   src = fetchzip {
     url = "https://git.zx2c4.com/wireguard-tools/snapshot/wireguard-tools-${version}.tar.xz";
-    sha256 = "sha256-eGGkTVdPPTWK6iEyowW11F4ywRhd+0IXJTZCqY3OZws=";
+    sha256 = "sha256-V9yKf4ZvxpOoVCFkFk18+130YBMhyeMt0641tn0O0e0=";
   };
 
   outputs = [

pkgs/by-name/ws/wstunnel/package.nix

···
 }:
 
 let
-  version = "10.3.0";
+  version = "10.4.2";
 in
 
 rustPlatform.buildRustPackage {
···
     owner = "erebe";
     repo = "wstunnel";
     tag = "v${version}";
-    hash = "sha256-Eq5d80hLg0ZkXtnObDQXmC+weUq9eN5SIQ6teVxB3a4=";
+    hash = "sha256-T4FciAusu1NHxMcHhhu7+WSubGohjpfN4sS5FnQBAZo=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-V5ohlS+dTrmhsvxpXW9JA7YpH/LWiyepUwEdBRrHiYE=";
+  cargoHash = "sha256-EOTEk3B49rfTri/CpJwKlvXuSErPoaRwwtpeaCZMfw4=";
 
   cargoBuildFlags = [ "--package wstunnel-cli" ];
 

pkgs/by-name/xm/xmrig-mo/package.nix

···
 
 xmrig.overrideAttrs (oldAttrs: rec {
   pname = "xmrig-mo";
-  version = "6.22.2-mo1";
+  version = "6.22.3-mo1";
 
   src = fetchFromGitHub {
     owner = "MoneroOcean";
     repo = "xmrig";
     rev = "v${version}";
-    hash = "sha256-pJ4NTdpWCt7C98k1EqGoiU0Lup25Frdm1kFJuwTfXgY=";
+    hash = "sha256-jmdlIFTXm5bLScRCYPTe7cDDRyNR29wu5+09Vj6G/Pc=";
   };
 
   meta = with lib; {

pkgs/by-name/xv/xva-img/package.nix

···
   ];
 
   meta = {
-    maintainers = with lib.maintainers; [ willibutz ];
+    maintainers = [ ];
     description = "Tool for converting Xen images to raw and back";
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.unix;

pkgs/by-name/ya/yazi/plugins/mount/default.nix

···
 }:
 mkYaziPlugin {
   pname = "mount.yazi";
-  version = "25.5.28-unstable-2025-05-28";
+  version = "25.5.28-unstable-2025-06-11";
 
   src = fetchFromGitHub {
     owner = "yazi-rs";
     repo = "plugins";
-    rev = "f9b3f8876eaa74d8b76e5b8356aca7e6a81c0fb7";
-    hash = "sha256-EoIrbyC7WgRzrEtvso2Sr6HnNW91c5E+RZGqnjEi6Zo=";
+    rev = "c1d638374c76655896c06e9bc91cdb39857b7f15";
+    hash = "sha256-cj2RjeW4/9ZRCd/H4PxrIQWW9kSOxtdi72f+8o13aPI=";
   };
 
   meta = {

pkgs/by-name/ya/yazi/plugins/ouch/default.nix

···
 }:
 mkYaziPlugin {
   pname = "ouch.yazi";
-  version = "0-unstable-2025-06-01";
+  version = "0-unstable-2025-06-10";
 
   src = fetchFromGitHub {
     owner = "ndtoan96";
     repo = "ouch.yazi";
-    rev = "10b462765f37502065555e83c68a72bb26870fe2";
-    hash = "sha256-mtXl76a54Deg4cyrD0wr++sD/5b/kCsnJ+ngM6OokTc=";
+    rev = "1ee69a56da3c4b90ec8716dd9dd6b82e7a944614";
+    hash = "sha256-4KZeDkMXlhUV0Zh+VGBtz9kFPGOWCexYVuKUSCN463o=";
   };
 
   meta = {

pkgs/by-name/ya/yazi/plugins/rsync/default.nix

···
 }:
 mkYaziPlugin {
   pname = "rsync.yazi";
-  version = "0-unstable-2025-06-07";
+  version = "0-unstable-2025-06-09";
   src = fetchFromGitHub {
     owner = "GianniBYoung";
     repo = "rsync.yazi";
-    rev = "782481e58316f4b422f5c259f07c63b940555246";
-    hash = "sha256-ZrvaJl3nf/CGavvk1QEyOMUbfKQ/JYSmZguvbXIIw9M=";
+    rev = "55631aaaa7654b86469a07bbedf62a5561caa2c9";
+    hash = "sha256-4U6tYAZboMV5YguQIBpcZtcLWwF3TYYFFUXLtVxYxwU=";
   };
 
   meta = {

pkgs/by-name/ya/yazi/plugins/yatline/default.nix

···
 }:
 mkYaziPlugin {
   pname = "yatline.yazi";
-  version = "0-unstable-2025-05-31";
+  version = "0-unstable-2025-06-11";
 
   src = fetchFromGitHub {
     owner = "imsi32";
     repo = "yatline.yazi";
-    rev = "4872af0da53023358154c8233ab698581de5b2b2";
-    hash = "sha256-7uk8QXAlck0/4bynPdh/m7Os2ayW1UXbELmusPqRmf4=";
+    rev = "73bce63ffb454ea108a96f316e2a8c2e16a35262";
+    hash = "sha256-pIaqnxEGKiWvtFZJm0e7GSbbIc2qaTCB+czHLcVuVzY=";
   };
 
   meta = {

pkgs/by-name/yd/ydotool/package.nix

···
     license = lib.licenses.agpl3Plus;
     mainProgram = "ydotool";
     maintainers = with lib.maintainers; [
-      willibutz
       kraem
     ];
     platforms = lib.platforms.linux;

pkgs/by-name/ze/zenoh-c/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  cargo,
+  rustPlatform,
+  rustc,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "zenoh-c";
+  version = "1.4.0"; # nixpkgs-update: no auto update
+
+  src = fetchFromGitHub {
+    owner = "eclipse-zenoh";
+    repo = "zenoh-c";
+    tag = version;
+    hash = "sha256-Mn3diwJgMkYXP9Dn5AqquN1UJ+P+b4QadiXqzzYZK+o=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit src pname version;
+    hash = "sha256-Z9xKC7svGPSuQm4KCKOfGAFOdWgSjBK+/LFT3rAebTg=";
+  };
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    cargo
+    rustPlatform.cargoSetupHook
+    rustc
+  ];
+
+  postInstall = ''
+    substituteInPlace $out/lib/pkgconfig/zenohc.pc \
+      --replace-fail "\''${prefix}/" ""
+  '';
+
+  meta = {
+    description = "C API for zenoh";
+    homepage = "https://github.com/eclipse-zenoh/zenoh-c";
+    license = with lib.licenses; [
+      asl20
+      epl20
+    ];
+    maintainers = with lib.maintainers; [ markuskowa ];
+  };
+}

pkgs/by-name/ze/zenoh-cpp/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  zenoh-c,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "zenoh-cpp";
+  version = "1.4.0"; # nixpkgs-update: no auto update
+
+  src = fetchFromGitHub {
+    owner = "eclipse-zenoh";
+    repo = "zenoh-cpp";
+    tag = version;
+    hash = "sha256-rznvif87UZbYzZB4yHG4R850qm6Z3beJ1NSG4wrf58M=";
+  };
+
+  cmakeFlags = [
+    "-DZENOHCXX_ZENOHC=ON"
+    "-DZENOHCXX_ZENOHPICO=OFF"
+  ];
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  propagatedBuildInputs = [
+    zenoh-c
+  ];
+
+  postInstall = ''
+    substituteInPlace $out/lib/pkgconfig/zenohcxx.pc \
+      --replace-fail "\''${prefix}/" ""
+  '';
+
+  meta = {
+    description = "C++ API for zenoh";
+    homepage = "https://github.com/eclipse-zenoh/zenoh-cpp";
+    license = with lib.licenses; [
+      asl20
+      epl20
+    ];
+    maintainers = with lib.maintainers; [ markuskowa ];
+  };
+}

pkgs/development/ocaml-modules/ocamlformat/generic.nix

···
   stdio,
   uuseg,
   uutf,
-  janeStreet_0_15,
   ...
 }:
 
···
 
   cmdliner_v = if lib.versionAtLeast version "0.21.0" then cmdliner_1_1 else cmdliner_1_0;
 
-  base_v = if lib.versionAtLeast version "0.25.1" then base else janeStreet_0_15.base;
-
-  stdio_v = if lib.versionAtLeast version "0.25.1" then stdio else janeStreet_0_15.stdio;
-
   library_deps =
     [
-      base_v
+      base
       cmdliner_v
       dune-build-info
       fix
···
       menhirLib
       menhirSdk
       ocp-indent
-      stdio_v
+      stdio
       uuseg
       uutf
     ]

pkgs/development/ocaml-modules/ocamlformat/ocamlformat.nix

···
 lib.throwIf
   (
     lib.versionAtLeast ocaml.version "5.0" && !lib.versionAtLeast version "0.23"
+    || lib.versionAtLeast ocaml.version "5.1" && !lib.versionAtLeast version "0.25"
     || lib.versionAtLeast ocaml.version "5.2" && !lib.versionAtLeast version "0.26.2"
     || lib.versionAtLeast ocaml.version "5.3" && !lib.versionAtLeast version "0.27"
   )

pkgs/development/python-modules/apsw/default.nix

···
 {
   lib,
   buildPythonPackage,
-  fetchFromGitHub,
-  pythonOlder,
+  fetchurl,
   setuptools,
   sqlite,
 }:
 
 buildPythonPackage rec {
   pname = "apsw";
-  version = "3.46.1.0";
+  version = "3.48.0.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
-
-  src = fetchFromGitHub {
-    owner = "rogerbinns";
-    repo = "apsw";
-    tag = version;
-    hash = "sha256-/MMCwdd2juFbv/lrYwuO2mdWm0+v+YFn6h9CwdQMTpg=";
+  # https://github.com/rogerbinns/apsw/issues/548
+  src = fetchurl {
+    url = "https://github.com/rogerbinns/apsw/releases/download/${version}/apsw-${version}.tar.gz";
+    hash = "sha256-iwvUW6vOQu2EiUuYWVaz5D3ePSLrj81fmLxoGRaTzRk=";
   };
 
   build-system = [ setuptools ];
···
 
   pythonImportsCheck = [ "apsw" ];
 
-  meta = with lib; {
-    changelog = "https://github.com/rogerbinns/apsw/blob/${src.rev}/doc/changes.rst";
+  meta = {
+    changelog = "https://github.com/rogerbinns/apsw/blob/${version}/doc/changes.rst";
     description = "Python wrapper for the SQLite embedded relational database engine";
     homepage = "https://github.com/rogerbinns/apsw";
-    license = licenses.zlib;
-    maintainers = with maintainers; [ gador ];
+    license = lib.licenses.zlib;
+    maintainers = with lib.maintainers; [ gador ];
   };
 }

pkgs/development/python-modules/auth0-python/default.nix

···
 
 buildPythonPackage rec {
   pname = "auth0-python";
-  version = "4.9.0";
+  version = "4.10.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
···
     owner = "auth0";
     repo = "auth0-python";
     tag = version;
-    hash = "sha256-xmA1VbXTDSnkiciyMJidzc3HPwD0OySrByJvzqiaDy4=";
+    hash = "sha256-qQbZBuwn2P2ocDjwGeVR7z7rKNHud/gfzNItiliW1P8=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/configargparse/default.nix

···
     homepage = "https://github.com/bw2/ConfigArgParse";
     changelog = "https://github.com/bw2/ConfigArgParse/releases/tag/${version}";
     license = licenses.mit;
-    maintainers = with maintainers; [ willibutz ];
+    maintainers = [ ];
   };
 }

pkgs/development/python-modules/igraph/default.nix

···
 {
   lib,
   buildPythonPackage,
-  pythonOlder,
   fetchFromGitHub,
   pkg-config,
+  cmake,
   setuptools,
   igraph,
   texttable,
···
 
 buildPythonPackage rec {
   pname = "igraph";
-  version = "0.11.8";
-
-  disabled = pythonOlder "3.8";
+  version = "0.11.9";
 
   pyproject = true;
 
···
       # export-subst prevents reproducability
       rm $out/.git_archival.json
     '';
-    hash = "sha256-FEp9kwUAPSAnGcAuxApAq1AXiT0klXuXE2M6xNVilRg=";
+    hash = "sha256-rmIICiIyEr5JCmkDAzcdisVaaKDraTQEquPHjK4d7oU=";
   };
 
   postPatch = ''
     rm -r vendor
-
-    # TODO remove starting with 0.11.9
-    substituteInPlace pyproject.toml \
-      --replace-fail "setuptools>=64,<72.2.0" setuptools
   '';
 
   nativeBuildInputs = [ pkg-config ];
 
-  build-system = [ setuptools ];
+  build-system = [
+    cmake
+    setuptools
+  ];
+
+  dontUseCmakeConfigure = true;
 
   buildInputs = [ igraph ];
 

pkgs/development/tools/mysql-shell/8.nix

···
     pyyaml
   ];
 
-  mysqlShellVersion = "8.4.4";
-  mysqlServerVersion = "8.4.4";
+  mysqlShellVersion = "8.4.5";
+  mysqlServerVersion = "8.4.5";
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "mysql-shell";
···
   srcs = [
     (fetchurl {
       url = "https://dev.mysql.com/get/Downloads/MySQL-${lib.versions.majorMinor mysqlServerVersion}/mysql-${mysqlServerVersion}.tar.gz";
-      hash = "sha256-+ykO90iJRDQIUknDG8pSrHGFMSREarIYuzvFAr8AgqU=";
+      hash = "sha256-U2OVkqcgpxn9+t8skhuUfqyGwG4zMgLkdmeFKleBvRo=";
     })
     (fetchurl {
       url = "https://dev.mysql.com/get/Downloads/MySQL-Shell/mysql-shell-${finalAttrs.version}-src.tar.gz";
-      hash = "sha256-wl57vU3YbWvtmzew801k8WHohY6Fjy59Uyy2pdYaHuw=";
+      hash = "sha256-OLU27mLd46pC6mfvBTRmC0mJ8nlwQuHPNWPkTQw3t8w=";
     })
   ];
 

pkgs/development/tools/mysql-shell/innovation.nix

···
     pyyaml
   ];
 
-  mysqlShellVersion = "9.2.0";
-  mysqlServerVersion = "9.2.0";
+  mysqlShellVersion = "9.3.0";
+  mysqlServerVersion = "9.3.0";
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "mysql-shell-innovation";
···
   srcs = [
     (fetchurl {
       url = "https://dev.mysql.com/get/Downloads/MySQL-${lib.versions.majorMinor mysqlServerVersion}/mysql-${mysqlServerVersion}.tar.gz";
-      hash = "sha256-o50R/fbPjRsDtwjVN6kTLeS5mp601hApOTfwaHzTehI=";
+      hash = "sha256-Gj7iNvHarF74l8YyXJsOCq5IY4m+G4AB3rP/d85oLWA=";
     })
     (fetchurl {
       url = "https://dev.mysql.com/get/Downloads/MySQL-Shell/mysql-shell-${finalAttrs.version}-src.tar.gz";
-      hash = "sha256-xuKXV8YllhDo7+6i5UYHAH7m7Jn5E/k0YdeN5MZSzl8=";
+      hash = "sha256-26bhtMNuaEnsW/TygbyhejlHbtSnh+EwrEdHaDqyv5s=";
     })
   ];
 

pkgs/os-specific/linux/nullfs/default.nix

···
 }:
 stdenv.mkDerivation rec {
   pname = "nullfs";
-  version = "0.18";
+  version = "0.19";
 
   src = fetchFromGitHub {
     owner = "abbbi";
     repo = "nullfsvfs";
     rev = "v${version}";
-    sha256 = "sha256-tfa0SPhTm9vvv4CiwcDyz6KssJqD9F2SlWB4rwZpGoY=";
+    sha256 = "sha256-nEwLxcELLBd+BN7OHYLJZCpie0rG0a1wj0RCOKpZkRU=";
   };
 
   hardeningDisable = [ "pic" ];

pkgs/pkgs-lib/formats.nix

···
               (listOf valueType)
             ])
             // {
-              description = "YAML value";
+              description = "YAML 1.1 value";
+            };
+        in
+        valueType;
+
+    };
+
+  yaml_1_2 =
+    { }:
+    {
+      generate =
+        name: value:
+        pkgs.callPackage (
+          { runCommand, remarshal }:
+          runCommand name
+            {
+              nativeBuildInputs = [ remarshal ];
+              value = builtins.toJSON value;
+              passAsFile = [ "value" ];
+              preferLocalBuild = true;
+            }
+            ''
+              json2yaml "$valuePath" "$out"
+            ''
+        ) { };
+
+      type =
+        let
+          valueType =
+            nullOr (oneOf [
+              bool
+              int
+              float
+              str
+              path
+              (attrsOf valueType)
+              (listOf valueType)
+            ])
+            // {
+              description = "YAML 1.2 value";
             };
         in
         valueType;

pkgs/pkgs-lib/tests/formats.nix

···
   };
 
   yaml_1_1Atoms = shouldPass {
-    format = formats.yaml { };
+    format = formats.yaml_1_1 { };
     input = {
       null = null;
       false = false;
···
       path: ${./testfile}
       str: foo
       time: '22:30:00'
+      'true': true
+    '';
+  };
+
+  yaml_1_2Atoms = shouldPass {
+    format = formats.yaml_1_2 { };
+    input = {
+      null = null;
+      false = false;
+      true = true;
+      float = 3.141;
+      str = "foo";
+      attrs.foo = null;
+      list = [
+        null
+        null
+      ];
+      path = ./testfile;
+      no = "no";
+      time = "22:30:00";
+    };
+    expected = ''
+      attrs:
+        foo: null
+      'false': false
+      float: 3.141
+      list:
+      - null
+      - null
+      no: no
+      'null': null
+      path: ${./testfile}
+      str: foo
+      time: 22:30:00
       'true': true
     '';
   };

pkgs/servers/home-assistant/custom-lovelace-modules/advanced-camera-card/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "advanced-camera-card";
-  version = "7.11.0";
+  version = "7.14.1";
 
   src = fetchzip {
     url = "https://github.com/dermotduffy/advanced-camera-card/releases/download/v${version}/advanced-camera-card.zip";
-    hash = "sha256-ZxRokID9U3igUZTf3Rz2jTqs7Sb+en+KAV3DFKNg5Rk=";
+    hash = "sha256-SBUDM4+uayW5MJFs7arHXs1WzBmlHntVlE2hDBtGlAI=";
   };
 
   # TODO: build from source once yarn berry support lands in nixpkgs

pkgs/servers/monitoring/grafana/default.nix

···
     maintainers = with maintainers; [
       offline
       fpletz
-      willibutz
       globin
       ma27
       Frostman

pkgs/servers/monitoring/prometheus/blackbox-exporter.nix

···
     maintainers = with maintainers; [
       globin
       fpletz
-      willibutz
       Frostman
       ma27
     ];

pkgs/servers/monitoring/prometheus/dnsmasq-exporter.nix

···
     mainProgram = "dnsmasq_exporter";
     license = licenses.asl20;
     maintainers = with maintainers; [
-      willibutz
       globin
     ];
     # Broken on darwin for Go toolchain > 1.22, with error:

pkgs/servers/monitoring/prometheus/json-exporter.nix

···
     description = "Prometheus exporter which scrapes remote JSON by JSONPath";
     homepage = "https://github.com/prometheus-community/json_exporter";
     license = licenses.asl20;
-    maintainers = with maintainers; [ willibutz ];
+    maintainers = [ ];
     mainProgram = "json_exporter";
   };
 }

pkgs/servers/monitoring/prometheus/mail-exporter.nix

···
     homepage = "https://github.com/cherti/mailexporter";
     license = licenses.gpl3;
     maintainers = with maintainers; [
-      willibutz
       globin
     ];
     platforms = platforms.linux;

pkgs/servers/monitoring/prometheus/nextcloud-exporter.nix

···
     description = "Prometheus exporter for Nextcloud servers";
     homepage = "https://github.com/xperimental/nextcloud-exporter";
     license = licenses.mit;
-    maintainers = with maintainers; [ willibutz ];
+    maintainers = [ ];
     mainProgram = "nextcloud-exporter";
   };
 }

pkgs/servers/monitoring/prometheus/nginx-exporter.nix

···
     maintainers = with maintainers; [
       benley
       fpletz
-      willibutz
       globin
     ];
   };

pkgs/servers/monitoring/prometheus/postfix-exporter.nix

···
     mainProgram = "postfix_exporter";
     license = licenses.asl20;
     maintainers = with maintainers; [
-      willibutz
       globin
     ];
   };

pkgs/servers/monitoring/prometheus/postgres-exporter.nix

···
     maintainers = with maintainers; [
       fpletz
       globin
-      willibutz
       ma27
     ];
   };

pkgs/servers/sql/postgresql/ext/pgtap.nix

···
       as well as the ability to integrate with other TAP-emitting test frameworks.
       It can also be used in the xUnit testing style.
     '';
-    maintainers = with lib.maintainers; [ willibutz ];
+    maintainers = [ ];
     homepage = "https://pgtap.org";
     inherit (postgresql.meta) platforms;
     license = lib.licenses.mit;

pkgs/tools/system/nvtop/build-nvtop.nix

···
     license = licenses.gpl3Only;
     platforms = if apple then platforms.darwin else platforms.linux;
     maintainers = with maintainers; [
-      willibutz
       gbtb
       anthonyroussel
       moni

pkgs/tools/text/highlight/default.nix

···
       mainProgram = "highlight";
       homepage = "http://www.andre-simon.de/doku/highlight/en/highlight.php";
       platforms = platforms.unix;
-      maintainers = with maintainers; [ willibutz ];
+      maintainers = [ ];
     };
   };
 

pkgs/top-level/aliases.nix

···
   javacard-devkit = throw "javacard-devkit was dropped due to having a dependency on the Oracle JDK, as well as being several years out-of-date."; # Added 2024-11-01
   jd-cli = throw "jd-cli has been removed due to upstream being unmaintained since 2019. Other Java decompilers in Nixpkgs include bytecode-viewer (GUI), cfr (CLI), and procyon (CLI)."; # Added 2024-10-30
   jd-gui = throw "jd-gui has been removed due to a dependency on the dead JCenter Bintray. Other Java decompilers in Nixpkgs include bytecode-viewer (GUI), cfr (CLI), and procyon (CLI)."; # Added 2024-10-30
+  jikespg = throw "'jikespg' has been removed due to of maintenance upstream."; # Added 2025-06-10
   jsawk = throw "'jsawk' has been removed because it is unmaintained upstream"; # Added 2028-08-07
 
   # Julia

pkgs/top-level/all-packages.nix

···
 
   projecteur = libsForQt5.callPackage ../os-specific/linux/projecteur { };
 
-  lkl = callPackage ../applications/virtualization/lkl { };
-  lklWithFirewall = callPackage ../applications/virtualization/lkl { firewallSupport = true; };
+  lklWithFirewall = lkl.override { firewallSupport = true; };
 
   inherit (callPackages ../os-specific/linux/kernel-headers { inherit (pkgsBuildBuild) elf-header; })
     linuxHeaders