Merge remote-tracking branch 'origin/staging-next' into staging

.github/workflows/check-cherry-picks.yml

···
                 repo: context.repo.repo,
                 pull_number: context.payload.pull_request.number
               })).filter(review =>
-                review.user.login == 'github-actions[bot]' &&
-                review.state == 'CHANGES_REQUESTED'
+                review.user.login == 'github-actions[bot]'
               ).map(async (review) => {
-                await github.rest.pulls.dismissReview({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  pull_number: context.payload.pull_request.number,
-                  review_id: review.id,
-                  message: 'All cherry-picks are good now, thank you!'
-                })
+                if (review.state == 'CHANGES_REQUESTED') {
+                  await github.rest.pulls.dismissReview({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    pull_number: context.payload.pull_request.number,
+                    review_id: review.id,
+                    message: 'All cherry-picks are good now, thank you!'
+                  })
+                }
                 await github.graphql(`mutation($node_id:ID!) {
                   minimizeComment(input: {
                     classifier: RESOLVED,

.github/workflows/check-format.yml

···
         with:
           merged-as-untrusted: true
 
-      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
+      - uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31
         with:
           extra_nix_config: sandbox = true
 

.github/workflows/check-shell.yml

···
         with:
           merged-as-untrusted: true
 
-      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
+      - uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31
 
       - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
         with:

.github/workflows/codeowners-v2.yml

···
   check:
     name: Check
     runs-on: ubuntu-24.04-arm
-    if: github.repository_owner == 'NixOS'
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
···
           merged-as-untrusted: true
           target-as-trusted: true
 
-      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
+      - uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31
 
       - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
         with:
···
         run: nix-build trusted/ci -A codeownersValidator
 
       - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
-        if: vars.OWNER_RO_APP_ID
+        if: github.event_name == 'pull_request_target' && vars.OWNER_RO_APP_ID
         id: app-token
         with:
           app-id: ${{ vars.OWNER_RO_APP_ID }}
···
   request:
     name: Request
     runs-on: ubuntu-24.04-arm
-    if: github.repository_owner == 'NixOS'
     steps:
-      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
+      - uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31
 
       # Important: Because we use pull_request_target, this checks out the base branch of the PR, not the PR head.
       # This is intentional, because we need to request the review of owners as declared in the base branch.
···
         with:
           path: trusted
 
+      - name: Build review request package
+        run: nix-build trusted/ci -A requestReviews
+
       - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
-        if: vars.OWNER_APP_ID
+        if: github.event_name == 'pull_request_target' && vars.OWNER_APP_ID
         id: app-token
         with:
           app-id: ${{ vars.OWNER_APP_ID }}
···
           permission-administration: read
           permission-members: read
           permission-pull-requests: write
-
-      - name: Build review request package
-        run: nix-build trusted/ci -A requestReviews
 
       - name: Request reviews
         if: steps.app-token.outputs.token

.github/workflows/eval-aliases.yml

···
           merged-as-untrusted: true
 
       - name: Install Nix
-        uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
+        uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31
         with:
           extra_nix_config: sandbox = true
 

.github/workflows/eval.yml

···
   pull_request:
     paths:
       - .github/workflows/eval.yml
-      - .github/workflows/reviews.yml # needs eval results from the same event type
+      - .github/workflows/reviewers.yml # needs eval results from the same event type
   pull_request_target:
   push:
     # Keep this synced with ci/request-reviews/dev-branches.txt
···
           path: untrusted
 
       - name: Install Nix
-        uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
+        uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31
         with:
           extra_nix_config: sandbox = true
 
···
           path: trusted
 
       - name: Install Nix
-        uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
+        uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31
         with:
           extra_nix_config: sandbox = true
 

.github/workflows/lib-tests.yml

···
         with:
           merged-as-untrusted: true
 
-      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
+      - uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31
         with:
           extra_nix_config: sandbox = true
 

.github/workflows/manual-nixos-v2.yml

···
         with:
           merged-as-untrusted: true
 
-      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
+      - uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31
         with:
           extra_nix_config: sandbox = true
 

.github/workflows/manual-nixpkgs-v2.yml

···
         with:
           merged-as-untrusted: true
 
-      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
+      - uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31
         with:
           extra_nix_config: sandbox = true
 

.github/workflows/nix-parse-v2.yml

···
         with:
           merged-as-untrusted: true
 
-      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
+      - uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31
         with:
           extra_nix_config: sandbox = true
           nix_path: nixpkgs=channel:nixpkgs-unstable

.github/workflows/nixpkgs-vet.yml

···
           merged-as-untrusted: true
           target-as-trusted: true
 
-      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
+      - uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31
 
       - name: Running nixpkgs-vet
         env:

.github/workflows/reviewers.yml

···
           sparse-checkout: ci
 
       - name: Install Nix
-        uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
+        uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31
         with:
           extra_nix_config: sandbox = true
 
···
       # See ./codeowners-v2.yml, reuse the same App because we need the same permissions
       # Can't use the token received from permissions above, because it can't get enough permissions
       - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
-        if: vars.OWNER_APP_ID
+        if: github.event_name == 'pull_request_target' && vars.OWNER_APP_ID
         id: app-token
         with:
           app-id: ${{ vars.OWNER_APP_ID }}

ci/nixpkgs-vet.nix

···
     env.NIXPKGS_VET_NIX_PACKAGE = nix;
   }
   ''
+    export NIX_STATE_DIR=$(mktemp -d)
+
     nixpkgs-vet --base ${filtered base} ${filtered head}
 
     touch $out

doc/languages-frameworks/haskell.section.md

···
 
 <!-- TODO(@maralorn) Link to package set generation docs in the contributors guide below. -->
 
+### GHC Deprecation Policy {#ghc-deprecation-policy}
+
+We remove GHC versions according to the following policy:
+
+#### Major GHC versions {#major-ghc-deprecation}
+
+We keep the following GHC major versions:
+1. The current Stackage LTS as the default and all later major versions.
+2. The two latest major versions older than our default.
+3. The currently recommended GHCup version and all later major versions.
+
+Older GHC versions might be kept longer, if there are in-tree consumers. We will coordinate with the maintainers of those dependencies to find a way forward.
+
+#### Minor GHC versions {#minor-ghc-deprecation}
+
+Every major version has a default minor version. The default minor version will be updated as soon as viable without breakage.
+
+Older minor versions for a supported major version will only be kept, if they are the last supported version of a major Stackage LTS release.
+
+<!-- Policy introduced here: https://discourse.nixos.org/t/nixpkgs-ghc-deprecation-policy-user-feedback-necessary/64153 -->
+
 ## `haskellPackages.mkDerivation` {#haskell-mkderivation}
 
 Every haskell package set has its own haskell-aware `mkDerivation` which is used

doc/languages-frameworks/rust.section.md

···
 directory.  In such cases, the `cargoRoot` attribute can be used to
 specify the crate's directory relative to `sourceRoot`. In the
 following example, the crate is in `src/rust`, as specified in the
-`cargoRoot` attribute. Note that we also need to specify the correct
-path for `fetchCargoVendor`.
+`cargoRoot` attribute. Note that we also need to pass in `cargoRoot`
+to `fetchCargoVendor`.
 
 ```nix
 {
···
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit pname version src;
-    sourceRoot = "${pname}-${version}/${cargoRoot}";
+    inherit
+      pname
+      version
+      src
+      cargoRoot
+      ;
     hash = "sha256-ctUt8maCjnGddKPf+Ii++wKsAXA1h+JM6zKQNXXwJqQ=";
   };
 

doc/redirects.json

···
   "ex-testEqualArrayOrMap-test-function-add-cowbell": [
     "index.html#ex-testEqualArrayOrMap-test-function-add-cowbell"
   ],
+  "ghc-deprecation-policy": [
+    "index.html#ghc-deprecation-policy"
+  ],
   "inkscape-plugins": [
     "index.html#inkscape-plugins"
+  ],
+  "major-ghc-deprecation": [
+    "index.html#major-ghc-deprecation"
+  ],
+  "minor-ghc-deprecation": [
+    "index.html#minor-ghc-deprecation"
   ],
   "neovim": [
     "index.html#neovim"

doc/release-notes/rl-2511.section.md

···
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- The `boot.readOnlyNixStore` has been removed. Control over bind mount options on `/nix/store` is now offered by the `boot.nixStoreMountOpts` option.
+- The `offrss` package was removed due to lack of upstream maintenance since 2012. It's recommended for users to migrate to another RSS reader
 
 ## Other Notable Changes {#sec-nixpkgs-release-25.11-notable-changes}
 

maintainers/maintainer-list.nix

···
     githubId = 1131571;
     name = "naelstrof";
   };
+  naggie = {
+    name = "Cal Bryant";
+    email = "[e-mail]";
+    github = "naggie";
+    githubId = 208440;
+  };
   nagisa = {
     name = "Simonas Kazlauskas";
     email = "[e-mail]";

nixos/doc/manual/release-notes/rl-2511.section.md

···
 
 - `renovate` was updated to v40. See the [upstream release notes](https://github.com/renovatebot/renovate/releases/tag/40.0.0) for breaking changes.
 
+- The `boot.readOnlyNixStore` has been removed. Control over bind mount options on `/nix/store` is now offered by the `boot.nixStoreMountOpts` option.
+
 ## Other Notable Changes {#sec-release-25.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

nixos/modules/programs/nix-required-mounts.nix

···
           }
         '';
         example.require-ipfs.paths = [ "/ipfs" ];
-        example.require-ipfs.onFeatures = [ "ifps" ];
+        example.require-ipfs.onFeatures = [ "ipfs" ];
       };
     extraWrapperArgs = lib.mkOption {
       type = with lib.types; listOf str;

nixos/modules/services/home-automation/wyoming/satellite.nix

···
     ;
 
   finalPackage = cfg.package.overridePythonAttrs (oldAttrs: {
-    propagatedBuildInputs =
-      oldAttrs.propagatedBuildInputs
+    dependencies =
+      oldAttrs.dependencies
       # for audio enhancements like auto-gain, noise suppression
       ++ cfg.package.optional-dependencies.webrtc
       # vad is currently optional, because it is broken on aarch64-linux

nixos/modules/services/networking/dsnet.md

···
+# dsnet {#module-services-dsnet}
+
+dsnet is a CLI tool to manage a centralised wireguard server. It allows easy
+generation of client configuration, handling key generation, IP allocation etc.
+
+It keeps its own configuration at `/etc/dsnetconfig.json`, which is more of a
+database. It contains key material too.
+
+The way this module works is to patch this database with whatever is configured
+in the nix service instantiation. This happens automatically when required.
+
+This way it is possible to decide what to let dnset manage and what parts you
+want to keep declaratively.
+
+```
+services.dsnet = {
+  enable = true;
+  settings = {
+    ExternalHostname = "vpn.example.com";
+    Network = "10.171.90.0/24";
+    Network6 = "";
+    IP = "10.171.90.1";
+    IP6 = "";
+    DNS = "10.171.90.1";
+    Networks = [ "0.0.0.0/0" ];
+  };
+
+```
+
+
+See <https://github.com/naggie/dsnet> for more information.

nixos/modules/services/networking/dsnet.nix

···
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.dsnet;
+  settingsFormat = pkgs.formats.json { };
+  patchFile = settingsFormat.generate "dsnet-patch.json" cfg.settings;
+in
+{
+  options.services.dsnet = {
+    enable = lib.mkEnableOption "dsnet, a centralised Wireguard VPN manager";
+
+    package = lib.mkPackageOption pkgs "dsnet" { };
+
+    settings = lib.mkOption {
+      type = lib.types.submodule {
+
+        freeformType = settingsFormat.type;
+
+        options = {
+          ExternalHostname = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            example = "vpn.example.com";
+            description = ''
+              The hostname that clients should use to connect to this server.
+              This is used to generate the client configuration files.
+
+              This is preferred over ExternalIP, as it allows for IPv4 and
+              IPv6, as well as enabling the ability tp change IP.
+            '';
+          };
+
+          ExternalIP = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            example = "192.0.2.1";
+            description = ''
+              The external IP address of the server. This is used to generate
+              the client configuration files for when an ExternalHostname is not set.
+
+              Leaving this empty will cause dsnet to use the IP address of
+              what looks like the WAN interface.
+            '';
+          };
+
+          ExternalIP6 = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            example = "2001:db8::1";
+            description = ''
+              The external IPv6 address of the server. This is used to generate
+              the client configuration files for when an ExternalHostname is
+              not set. Used in preference to ExternalIP.
+
+              Leaving this empty will cause dsnet to use the IP address of
+              what looks like the WAN interface.
+            '';
+          };
+
+          Network = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            example = "172.18.0.0/24";
+            description = ''
+              The IPv4 network that the server will use to allocate IPs on the network.
+              Leave this empty to let dsnet choose a network.
+            '';
+          };
+
+          Network6 = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            example = "2001:db8::1/64";
+            description = ''
+              The IPv6 network that the server will use to allocate IPs on the
+              network.
+              Leave this empty to let dsnet choose a network.
+            '';
+          };
+
+          IP = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            example = "172.18.0.1";
+            description = ''
+              The IPv4 address that the server will use on the network.
+              Leave this empty to let dsnet choose an address.
+            '';
+          };
+
+          IP6 = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            example = "2001:db8::1";
+            description = ''
+              The IPv6 address that the server will use on the network
+              Leave this empty to let dsnet choose an address.
+            '';
+          };
+
+          Networks = lib.mkOption {
+            type = lib.types.nullOr (lib.types.listOf lib.types.str);
+            default = null;
+            example = [
+              "0.0.0.0/0"
+              "192.168.0.0/24"
+            ];
+            description = ''
+              The CIDR networks that should route through this server. Clients
+              will be configured to route traffic for these networks through
+              the server peer.
+            '';
+          };
+        };
+      };
+
+      default = { };
+      description = ''
+        The settings to use for dsnet. This will be converted to a JSON
+        object that will be passed to dsnet as a patch, using the patch
+        command when the service is started. See the dsnet documentation for
+        more information on the additional options.
+
+        Note that the resulting /etc/dsnetconfg.json is more of a database
+        than it is a configuration file. It is therefore recommended that
+        system specific values are configured here, rather than the full
+        configuration including peers.
+
+        Peers may be managed via the dsnet add/remove commands, negating the
+        need to manage key material and cumbersom configuration with nix. If
+        you want peer configuration in nix, you may as well use the regular
+        wireguard module.
+      '';
+      example = {
+        ExternalHostname = "vpn.example.com";
+        ExternalIP = "127.0.0.1";
+        ExternalIP6 = "";
+        ListenPort = 51820;
+        Network = "10.3.148.0/22";
+        Network6 = "";
+        IP = "10.3.148.1";
+        IP6 = "";
+        DNS = "8.8.8.8";
+        Networks = [ "0.0.0.0/0" ];
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+
+    systemd.services.dsnet = {
+      description = "dsnet VPN Management";
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+      preStart = ''
+        test ! -f /etc/dsnetconfig.json && ${lib.getExe cfg.package} init
+        ${lib.getExe cfg.package} patch < ${patchFile}
+      '';
+      serviceConfig = {
+        ExecStart = "${lib.getExe cfg.package} up";
+        ExecStop = "${lib.getExe cfg.package} down";
+        Type = "oneshot";
+        # consider the service to be active after process exits, so it can be
+        # reloaded
+        RemainAfterExit = true;
+      };
+
+      reload = ''
+        ${lib.getExe cfg.package} patch < ${patchFile}
+        ${lib.getExe cfg.package} sync < ${patchFile}
+      '';
+
+      # reload _instead_ of restarting on change
+      reloadIfChanged = true;
+    };
+  };
+}

nixos/modules/services/networking/murmur.nix

···
   ...
 }:
 
-with lib;
-
 let
   cfg = config.services.murmur;
   forking = cfg.logFile != null;
···
     database=${cfg.stateDir}/murmur.sqlite
     dbDriver=QSQLITE
 
-    autobanAttempts=${toString cfg.autobanAttempts}
-    autobanTimeframe=${toString cfg.autobanTimeframe}
-    autobanTime=${toString cfg.autobanTime}
+    autobanAttempts=${lib.toString cfg.autobanAttempts}
+    autobanTimeframe=${lib.toString cfg.autobanTimeframe}
+    autobanTime=${lib.toString cfg.autobanTime}
 
-    logfile=${optionalString (cfg.logFile != null) cfg.logFile}
-    ${optionalString forking "pidfile=/run/murmur/murmurd.pid"}
+    logfile=${lib.optionalString (cfg.logFile != null) cfg.logFile}
+    ${lib.optionalString forking "pidfile=/run/murmur/murmurd.pid"}
 
     welcometext="${cfg.welcometext}"
-    port=${toString cfg.port}
+    port=${lib.toString cfg.port}
 
-    ${optionalString (cfg.hostName != "") "host=${cfg.hostName}"}
-    ${optionalString (cfg.password != "") "serverpassword=${cfg.password}"}
+    ${lib.optionalString (cfg.hostName != "") "host=${cfg.hostName}"}
+    ${lib.optionalString (cfg.password != "") "serverpassword=${cfg.password}"}
 
-    bandwidth=${toString cfg.bandwidth}
-    users=${toString cfg.users}
+    bandwidth=${lib.toString cfg.bandwidth}
+    users=${lib.toString cfg.users}
 
-    textmessagelength=${toString cfg.textMsgLength}
-    imagemessagelength=${toString cfg.imgMsgLength}
-    allowhtml=${boolToString cfg.allowHtml}
-    logdays=${toString cfg.logDays}
-    bonjour=${boolToString cfg.bonjour}
-    sendversion=${boolToString cfg.sendVersion}
+    textmessagelength=${lib.toString cfg.textMsgLength}
+    imagemessagelength=${lib.toString cfg.imgMsgLength}
+    allowhtml=${lib.boolToString cfg.allowHtml}
+    logdays=${lib.toString cfg.logDays}
+    bonjour=${lib.boolToString cfg.bonjour}
+    sendversion=${lib.boolToString cfg.sendVersion}
 
-    ${optionalString (cfg.registerName != "") "registerName=${cfg.registerName}"}
-    ${optionalString (cfg.registerPassword != "") "registerPassword=${cfg.registerPassword}"}
-    ${optionalString (cfg.registerUrl != "") "registerUrl=${cfg.registerUrl}"}
-    ${optionalString (cfg.registerHostname != "") "registerHostname=${cfg.registerHostname}"}
+    ${lib.optionalString (cfg.registerName != "") "registerName=${cfg.registerName}"}
+    ${lib.optionalString (cfg.registerPassword != "") "registerPassword=${cfg.registerPassword}"}
+    ${lib.optionalString (cfg.registerUrl != "") "registerUrl=${cfg.registerUrl}"}
+    ${lib.optionalString (cfg.registerHostname != "") "registerHostname=${cfg.registerHostname}"}
 
-    certrequired=${boolToString cfg.clientCertRequired}
-    ${optionalString (cfg.sslCert != "") "sslCert=${cfg.sslCert}"}
-    ${optionalString (cfg.sslKey != "") "sslKey=${cfg.sslKey}"}
-    ${optionalString (cfg.sslCa != "") "sslCA=${cfg.sslCa}"}
+    certrequired=${lib.boolToString cfg.clientCertRequired}
+    ${lib.optionalString (cfg.sslCert != "") "sslCert=${cfg.sslCert}"}
+    ${lib.optionalString (cfg.sslKey != "") "sslKey=${cfg.sslKey}"}
+    ${lib.optionalString (cfg.sslCa != "") "sslCA=${cfg.sslCa}"}
 
-    ${optionalString (cfg.dbus != null) "dbus=${cfg.dbus}"}
+    ${lib.optionalString (cfg.dbus != null) "dbus=${cfg.dbus}"}
 
     ${cfg.extraConfig}
   '';
 in
 {
-  imports = [
-    (mkRenamedOptionModule [ "services" "murmur" "welcome" ] [ "services" "murmur" "welcometext" ])
-    (mkRemovedOptionModule [ "services" "murmur" "pidfile" ] "Hardcoded to /run/murmur/murmurd.pid now")
-  ];
-
   options = {
     services.murmur = {
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-        description = "If enabled, start the Murmur Mumble server.";
-      };
+      enable = lib.mkEnableOption "Mumble server";
 
-      openFirewall = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Open ports in the firewall for the Murmur Mumble server.
-        '';
-      };
+      openFirewall = lib.mkEnableOption "opening ports in the firewall for the Mumble server";
 
-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
         default = "murmur";
         description = ''
           The name of an existing user to use to run the service.
···
         '';
       };
 
-      group = mkOption {
-        type = types.str;
+      group = lib.mkOption {
+        type = lib.types.str;
         default = "murmur";
         description = ''
           The name of an existing group to use to run the service.
···
         '';
       };
 
-      stateDir = mkOption {
-        type = types.path;
+      stateDir = lib.mkOption {
+        type = lib.types.path;
         default = "/var/lib/murmur";
         description = ''
           Directory to store data for the server.
         '';
       };
 
-      autobanAttempts = mkOption {
-        type = types.int;
+      autobanAttempts = lib.mkOption {
+        type = lib.types.int;
         default = 10;
         description = ''
           Number of attempts a client is allowed to make in
···
         '';
       };
 
-      autobanTimeframe = mkOption {
-        type = types.int;
+      autobanTimeframe = lib.mkOption {
+        type = lib.types.int;
         default = 120;
         description = ''
           Timeframe in which a client can connect without being banned
···
         '';
       };
 
-      autobanTime = mkOption {
-        type = types.int;
+      autobanTime = lib.mkOption {
+        type = lib.types.int;
         default = 300;
         description = "The amount of time an IP ban lasts (in seconds).";
       };
 
-      logFile = mkOption {
-        type = types.nullOr types.path;
+      logFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
         default = null;
         example = "/var/log/murmur/murmurd.log";
         description = "Path to the log file for Murmur daemon. Empty means log to journald.";
       };
 
-      welcometext = mkOption {
-        type = types.str;
+      welcometext = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = "Welcome message for connected clients.";
       };
 
-      port = mkOption {
-        type = types.port;
+      port = lib.mkOption {
+        type = lib.types.port;
         default = 64738;
         description = "Ports to bind to (UDP and TCP).";
       };
 
-      hostName = mkOption {
-        type = types.str;
+      hostName = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = "Host to bind to. Defaults binding on all addresses.";
       };
 
-      package = mkPackageOption pkgs "murmur" { };
+      package = lib.mkPackageOption pkgs "murmur" { };
 
-      password = mkOption {
-        type = types.str;
+      password = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = "Required password to join server, if specified.";
       };
 
-      bandwidth = mkOption {
-        type = types.int;
+      bandwidth = lib.mkOption {
+        type = lib.types.int;
         default = 72000;
         description = ''
           Maximum bandwidth (in bits per second) that clients may send
···
         '';
       };
 
-      users = mkOption {
-        type = types.int;
+      users = lib.mkOption {
+        type = lib.types.int;
         default = 100;
         description = "Maximum number of concurrent clients allowed.";
       };
 
-      textMsgLength = mkOption {
-        type = types.int;
+      textMsgLength = lib.mkOption {
+        type = lib.types.int;
         default = 5000;
         description = "Max length of text messages. Set 0 for no limit.";
       };
 
-      imgMsgLength = mkOption {
-        type = types.int;
+      imgMsgLength = lib.mkOption {
+        type = lib.types.int;
         default = 131072;
         description = "Max length of image messages. Set 0 for no limit.";
       };
 
-      allowHtml = mkOption {
-        type = types.bool;
+      allowHtml = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = ''
           Allow HTML in client messages, comments, and channel
···
         '';
       };
 
-      logDays = mkOption {
-        type = types.int;
+      logDays = lib.mkOption {
+        type = lib.types.int;
         default = 31;
         description = ''
           How long to store RPC logs for in the database. Set 0 to
···
         '';
       };
 
-      bonjour = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Enable Bonjour auto-discovery, which allows clients over
-          your LAN to automatically discover Murmur servers.
-        '';
-      };
+      bonjour = lib.mkEnableOption "Bonjour auto-discovery, which allows clients over your LAN to automatically discover Mumble servers";
 
-      sendVersion = mkOption {
-        type = types.bool;
+      sendVersion = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = "Send Murmur version in UDP response.";
       };
 
-      registerName = mkOption {
-        type = types.str;
+      registerName = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = ''
           Public server registration name, and also the name of the
···
         '';
       };
 
-      registerPassword = mkOption {
-        type = types.str;
+      registerPassword = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = ''
           Public server registry password, used authenticate your
···
         '';
       };
 
-      registerUrl = mkOption {
-        type = types.str;
+      registerUrl = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = "URL website for your server.";
       };
 
-      registerHostname = mkOption {
-        type = types.str;
+      registerHostname = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = ''
           DNS hostname where your server can be reached. This is only
···
         '';
       };
 
-      clientCertRequired = mkOption {
-        type = types.bool;
-        default = false;
-        description = "Require clients to authenticate via certificates.";
-      };
+      clientCertRequired = lib.mkEnableOption "requiring clients to authenticate via certificates";
 
-      sslCert = mkOption {
-        type = types.str;
+      sslCert = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = "Path to your SSL certificate.";
       };
 
-      sslKey = mkOption {
-        type = types.str;
+      sslKey = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = "Path to your SSL key.";
       };
 
-      sslCa = mkOption {
-        type = types.str;
+      sslCa = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = "Path to your SSL CA certificate.";
       };
 
-      extraConfig = mkOption {
-        type = types.lines;
+      extraConfig = lib.mkOption {
+        type = lib.types.lines;
         default = "";
         description = "Extra configuration to put into murmur.ini.";
       };
 
-      environmentFile = mkOption {
-        type = types.nullOr types.path;
+      environmentFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
         default = null;
-        example = literalExpression ''"''${config.services.murmur.stateDir}/murmurd.env"'';
+        example = lib.literalExpression ''"''${config.services.murmur.stateDir}/murmurd.env"'';
         description = ''
           Environment file as defined in {manpage}`systemd.exec(5)`.
 
···
         '';
       };
 
-      dbus = mkOption {
-        type = types.enum [
+      dbus = lib.mkOption {
+        type = lib.types.enum [
           null
           "session"
           "system"
···
     };
   };
 
-  config = mkIf cfg.enable {
-    users.users.murmur = mkIf (cfg.user == "murmur") {
+  config = lib.mkIf cfg.enable {
+    users.users.murmur = lib.mkIf (cfg.user == "murmur") {
       description = "Murmur Service user";
       home = cfg.stateDir;
       createHome = true;
       uid = config.ids.uids.murmur;
       group = cfg.group;
     };
-    users.groups.murmur = mkIf (cfg.group == "murmur") {
+    users.groups.murmur = lib.mkIf (cfg.group == "murmur") {
       gid = config.ids.gids.murmur;
     };
 
-    networking.firewall = mkIf cfg.openFirewall {
+    networking.firewall = lib.mkIf cfg.openFirewall {
       allowedTCPPorts = [ cfg.port ];
       allowedUDPPorts = [ cfg.port ];
     };
···
       serviceConfig = {
         # murmurd doesn't fork when logging to the console.
         Type = if forking then "forking" else "simple";
-        PIDFile = mkIf forking "/run/murmur/murmurd.pid";
-        EnvironmentFile = mkIf (cfg.environmentFile != null) cfg.environmentFile;
+        PIDFile = lib.mkIf forking "/run/murmur/murmurd.pid";
+        EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
         ExecStart = "${cfg.package}/bin/mumble-server -ini /run/murmur/murmurd.ini";
         Restart = "always";
         RuntimeDirectory = "murmur";
···
 
     # currently not included in upstream package, addition requested at
     # https://github.com/mumble-voip/mumble/issues/6078
-    services.dbus.packages = mkIf (cfg.dbus == "system") [
+    services.dbus.packages = lib.mkIf (cfg.dbus == "system") [
       (pkgs.writeTextFile {
         name = "murmur-dbus-policy";
         text = ''
···
           r /run/murmur/murmurd.ini,
           r ${configFile},
       ''
-      + optionalString (cfg.logFile != null) ''
+      + lib.optionalString (cfg.logFile != null) ''
         rw ${cfg.logFile},
       ''
-      + optionalString (cfg.sslCert != "") ''
+      + lib.optionalString (cfg.sslCert != "") ''
         r ${cfg.sslCert},
       ''
-      + optionalString (cfg.sslKey != "") ''
+      + lib.optionalString (cfg.sslKey != "") ''
         r ${cfg.sslKey},
       ''
-      + optionalString (cfg.sslCa != "") ''
+      + lib.optionalString (cfg.sslCa != "") ''
         r ${cfg.sslCa},
       ''
-      + optionalString (cfg.dbus != null) ''
+      + lib.optionalString (cfg.dbus != null) ''
         dbus bus=${cfg.dbus}
       ''
       + ''

nixos/modules/services/web-apps/lasuite-docs.nix

···
   inherit (lib)
     getExe
     mapAttrs
+    match
     mkEnableOption
     mkIf
     mkPackageOption
···
     else
       toString value
   ) cfg.settings;
+
+  proxySuffix = if match "unix:.*" cfg.bind != null then ":" else "";
 
   commonServiceConfig = {
     RuntimeDirectory = "lasuite-docs";
···
             type = types.str;
             default = if cfg.enableNginx then "localhost,127.0.0.1,${cfg.domain}" else "";
             defaultText = lib.literalExpression ''
-              if cfg.enableNginx then "localhost,127.0.0.1,$${cfg.domain}" else ""
+              if cfg.enableNginx then "localhost,127.0.0.1,''${cfg.domain}" else ""
             '';
             description = "Comma-separated list of hosts that are able to connect to the server";
           };
···
       wantedBy = [ "multi-user.target" ];
 
       preStart = ''
-        ln -sfT ${cfg.backendPackage}/share/static /var/lib/lasuite-docs/static
-
         if [ ! -f .version ]; then
           touch .version
         fi
···
       environment = pythonEnvironment;
 
       serviceConfig = {
+        BindReadOnlyPaths = "${cfg.backendPackage}/share/static:/var/lib/lasuite-docs/static";
+
         ExecStart = utils.escapeSystemdExecArgs (
           [
             (lib.getExe' cfg.backendPackage "gunicorn")
···
         };
 
         locations."/media-auth" = {
-          proxyPass = "http://${cfg.bind}";
+          proxyPass = "http://${cfg.bind}${proxySuffix}/api/v1.0/documents/media-auth/";
           recommendedProxySettings = true;
           extraConfig = ''
-            rewrite $/(.*)^ /api/v1.0/documents/$1 break;
             proxy_set_header X-Original-URL $request_uri;
             proxy_pass_request_body off;
             proxy_set_header Content-Length "";
···
 
         locations."/media/" = {
           proxyPass = cfg.s3Url;
-          recommendedProxySettings = true;
           extraConfig = ''
             auth_request /media-auth;
             auth_request_set $authHeader $upstream_http_authorization;

nixos/tests/minio.nix

···
 
     # Create a test bucket on the server
     machine.succeed(
-        "mc config host add minio http://localhost:9000 ${accessKey} ${secretKey} --api s3v4"
+        "mc alias set minio http://localhost:9000 ${accessKey} ${secretKey} --api s3v4"
     )
     machine.succeed("mc mb minio/test-bucket")
     machine.succeed("${minioPythonScript}")
···
 
     # Create a test bucket on the server
     machine.succeed(
-        "mc config host add minio https://localhost:9000 ${accessKey} ${secretKey} --api s3v4"
+        "mc alias set minio https://localhost:9000 ${accessKey} ${secretKey} --api s3v4"
     )
     machine.succeed("mc --insecure mb minio/test-bucket")
     machine.succeed("${minioPythonScript} tls")

pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix

···
   pkgs,
 }:
 let
-  version = "0.0.23-unstable-2025-05-30";
+  version = "0.0.23-unstable-2025-06-02";
   src = fetchFromGitHub {
     owner = "yetone";
     repo = "avante.nvim";
-    rev = "22418bff8bcac4377ebf975cd48f716823867979";
-    hash = "sha256-qyeiDDjeReOr+TvgCWnKhb8FBN9t1YPFGvVqPvxXr0k=";
+    rev = "647a459a2b87e5c9b2987cb44150b71beffdfb10";
+    hash = "sha256-GgLOcVp2IuMBr4aBRWJTvrAuWWiMEIHmec/S97piBaM=";
   };
   avante-nvim-lib = rustPlatform.buildRustPackage {
     pname = "avante-nvim-lib";

pkgs/applications/editors/vim/plugins/non-generated/sonarlint-nvim/default.nix

···
 }:
 vimUtils.buildVimPlugin {
   pname = "sonarlint.nvim";
-  version = "0-unstable-2025-05-16";
+  version = "0-unstable-2025-05-30";
 
   src = fetchFromGitLab {
     owner = "schrieveslaach";
     repo = "sonarlint.nvim";
-    rev = "2aa7a9fd9d8022d1c8d472fb63ce62e021d70130";
-    hash = "sha256-RfQthodqF6r24I6EJxlewjYiX3jLAIb/RMAOVnWs73s=";
+    rev = "060df51352f9fb876d4ff43b8cd4b669a6bdfd89";
+    hash = "sha256-2MAi0nZIvAly+5p5fWKMi3tGSzMJgMnAzWnsr0rt+NM=";
   };
 
   passthru.updateScript = nix-update-script {

pkgs/applications/editors/vscode/extensions/default.nix

···
         mktplcRef = {
           name = "language-julia";
           publisher = "julialang";
-          version = "1.140.2";
-          hash = "sha256-YQwJq3QSzb2pAOLyy0w8RtrjAlxudBGN52fQtj+OmOk=";
+          version = "1.141.2";
+          hash = "sha256-i5mY037rs65BKiQLvUbu9Lup2ljhZI0owqjZ0AUsXMw=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/julialang.language-julia/changelog";
···
         mktplcRef = {
           name = "tabnine-vscode";
           publisher = "tabnine";
-          version = "3.283.0";
-          hash = "sha256-zn58iml+uN6K1qneLqnikaL5Gyk4rmNXo8TKKlO88jA=";
+          version = "3.287.0";
+          hash = "sha256-E4ew40NNuOW9e7ZIsJjkO/4r6gbbC2IsghFbO+n27cg=";
         };
         meta = {
           license = lib.licenses.mit;

pkgs/applications/graphics/gimp/default.nix

···
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gimp";
-  version = "3.0.2";
+  version = "3.0.4";
 
   outputs = [
     "out"
···
 
   src = fetchurl {
     url = "https://download.gimp.org/gimp/v${lib.versions.majorMinor finalAttrs.version}/gimp-${finalAttrs.version}.tar.xz";
-    hash = "sha256-VG3cMMstDnkSPH/LTXghHh7npqrOkaagrYy8v26lcaI=";
+    hash = "sha256-jKouwnW/CTJldWVKwnavwIP4SR58ykXRnPKeaWrsqyU=";
   };
 
   patches = [
···
   };
 
   postPatch = ''
-    patchShebangs \
-      app/tests/create_test_env.sh \
-      tools/gimp-mkenums
+    patchShebangs tools/gimp-mkenums
 
     # GIMP is executed at build time so we need to fix this.
     # TODO: Look into if we can fix the interp thing.

pkgs/applications/misc/openbangla-keyboard/default.nix

···
     ];
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit src;
-    postPatch = ''
-      cp ${./Cargo.lock} Cargo.lock
-    '';
-    sourceRoot = "${src.name}/${cargoRoot}";
+    inherit src cargoRoot postPatch;
     hash = "sha256-qZMTZi7eqEp5kSmVx7qdS7eDKOzSv9fMjWT0h/MGyeY=";
   };
 

pkgs/applications/networking/browsers/chromium/info.json

···
 {
   "chromium": {
-    "version": "137.0.7151.55",
+    "version": "137.0.7151.68",
     "chromedriver": {
-      "version": "137.0.7151.56",
-      "hash_darwin": "sha256-z4GTPrONaXARP0d8vInJdFxR052PuuI6IJy1PEv2RNg=",
-      "hash_darwin_aarch64": "sha256-wlSDfCiBTdLWwabpHwOiM8Y3asn7ueHGSMh2AANaE+A="
+      "version": "137.0.7151.69",
+      "hash_darwin": "sha256-G88jte6xraXrrfEvCj7zndpQ7nxyzappuu4oZ79XY8U=",
+      "hash_darwin_aarch64": "sha256-wbOD/sVjLVcpPzrbAGu8b8YMbUOKkOt7eNxJDLKRjxo="
     },
     "deps": {
       "depot_tools": {
···
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "254bc711794d7ad269495f3d419a209935b78cad",
-        "hash": "sha256-dB81lgjgVK0qXWgAddB7G4L7rsJpZp+0VsjDKvGugEs=",
+        "rev": "2989ffee9373ea8b8623bd98b3cb350a8e95cadc",
+        "hash": "sha256-lPmmXVCNUa9of8d52hUejImPSEfOz7v7PlovZS4cfIE=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
···
       },
       "src/third_party/devtools-frontend/src": {
         "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "a54ed1df191a9e2aff2e9ef453ee6fdc959dd125",
-        "hash": "sha256-E6sx2ioDZRWJljbS17ztRwz+gsDhIHiluvkUx1rRZcw="
+        "rev": "fdc8ca697612f90e7ddf2621dffbc43733d2d238",
+        "hash": "sha256-jKYldgZJwJeTQavmcM9enTdGN8+zt/EG7K1E9wQYIBA="
       },
       "src/third_party/dom_distiller_js/dist": {
         "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
···
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "44fdd9108308773dd3f4fa040de5f4f75edf671f",
-        "hash": "sha256-BkLOmb97p2NcAIuQiDjIoVAe49h9iv79rC5G8wyD1as="
+        "rev": "e398f9bf6d5c8a768ab736f46146d7349cf31547",
+        "hash": "sha256-cJx8IgUB3UA3jEPvb5aDvHLYmAnHydK1qR11q6Y5PnA="
       }
     }
   },

pkgs/applications/networking/cluster/terraform-providers/providers.json

···
     "vendorHash": null
   },
   "aws": {
-    "hash": "sha256-gBVJx6rk7rjrvyLaDJrHUmLRUbvgy60c/uQwsFXuQzA=",
+    "hash": "sha256-asrIQrhSSHjuOBFomgq9lbHc8rmkcy3OjJ5ig9I7XbU=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/aws",
     "owner": "hashicorp",
     "repo": "terraform-provider-aws",
-    "rev": "v5.98.0",
+    "rev": "v5.99.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-OxyOD/um7hOpYpsZCyNnbdvo5K/r/L7JlWvXQBncIDw="
+    "vendorHash": "sha256-low0aq3i3pmqbadYg1VZra+ZzoV6nqyGutf8xzaces0="
   },
   "azuread": {
     "hash": "sha256-lNjU/206yS+smSe1SYlz0TOqHRlvSQKqhJ67fswNlIQ=",
···
     "vendorHash": "sha256-arLGaa/o9X0MYg/qIl6qhpBqcduu5Bu06FteR5KGSPw="
   },
   "buildkite": {
-    "hash": "sha256-+9gxJjLVExnpWtcF1NRQoKPg0jn1zGNSkmim5YFgs4w=",
+    "hash": "sha256-u2BkD6h12drlz6MQIjoi/EFSj7l1dBWBjHVSmL+hB4g=",
     "homepage": "https://registry.terraform.io/providers/buildkite/buildkite",
     "owner": "buildkite",
     "repo": "terraform-provider-buildkite",
-    "rev": "v1.18.0",
+    "rev": "v1.19.0",
     "spdx": "MIT",
     "vendorHash": "sha256-bhPpFPn1hdpSJYTvO1HWTrFRBvcm8gIDmMEGOaFjM6c="
   },
···
     "vendorHash": "sha256-xu5t7VaLvbwo/Q7Xb4mkNt7UjU+hzfk7NgfFlxwbIhU="
   },
   "dnsimple": {
-    "hash": "sha256-CkfgHBNtYCFZIMoXpX0ivkm1dyIs4mKSrHaiQ3qt/+w=",
+    "hash": "sha256-7o8shnWECaCLTCvmXrJ2eYloxtln2A2No8OK8Ig36qE=",
     "homepage": "https://registry.terraform.io/providers/dnsimple/dnsimple",
     "owner": "dnsimple",
     "repo": "terraform-provider-dnsimple",
-    "rev": "v1.9.0",
+    "rev": "v1.9.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-WZqwBkVXoFmDikIyt9GWszLA/9YBoQHAdBuWbGKZBZw="
+    "vendorHash": "sha256-0axKIqF1t4AW1PPi+fHfsFQLRrjhpsloQIZ9clR+8Gc="
   },
   "docker": {
     "hash": "sha256-sPeX1bupACBSmt8ppyxQKyD+FXIPdCBWn8cnOAvNHwQ=",
···
     "vendorHash": "sha256-X0vbtUIKYzCeRD/BbMj3VPVAwx6d7gkbHV8j9JXlaFM="
   },
   "google": {
-    "hash": "sha256-q/BFHpA3ig0QfB0mhJGqr/uQYs/SH5YX8QgWCyjcSio=",
+    "hash": "sha256-TSDkXXYkneTsY10WV5cSFzOX04kFdFVHJPgpKt5hBSE=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google",
     "owner": "hashicorp",
     "repo": "terraform-provider-google",
-    "rev": "v6.36.1",
+    "rev": "v6.37.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-rGpnPH8ebHXasvelGoJEUU4YbeGJY4adFBbgAHJ8vSs="
+    "vendorHash": "sha256-YZI6zhxXU2aABARP6GcTMeU98F4+imbL1vKIEMzsJHM="
   },
   "google-beta": {
     "hash": "sha256-VpfIfzIG1h5qnvEqogCK359LLLSgdgxg0DtRGvdZtLU=",
···
     "vendorHash": "sha256-7AU79r4OQbmrMI385KVIHon/4pWk6J9qnH+zQRrWtJI="
   },
   "mongodbatlas": {
-    "hash": "sha256-JQW9y1EfrEInmz2+Er8BE0+6ZdcrO/w1y+czg7jPeRE=",
+    "hash": "sha256-+JYvL6xGA2zIOg2fl8Bl7CYU4x9N4aVJpIl/6PYdyPU=",
     "homepage": "https://registry.terraform.io/providers/mongodb/mongodbatlas",
     "owner": "mongodb",
     "repo": "terraform-provider-mongodbatlas",
-    "rev": "v1.34.0",
+    "rev": "v1.35.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-y9dhiG0zyOcvjgygLEW2o+GPXUug0ibxC2aLvfcY260="
+    "vendorHash": "sha256-fz6e/QEcWQY7ZrWyUbk8M/+RPB8dwN3NHPLmNLyGVhQ="
   },
   "namecheap": {
     "hash": "sha256-fHH9sHI1mqQ9q9nX9DHJ0qfEfmDB4/2uzyVvUuIAF18=",
···
     "vendorHash": "sha256-j+3qtGlueKZgf0LuNps4Wc9G3EmpSgl8ZNSLqslyizI="
   },
   "rancher2": {
-    "hash": "sha256-H6ZdGvKSYRlDsCKIHlPHdEv1+6aa1rll/73IeJ+PDhc=",
+    "hash": "sha256-5NkvGETjJ5eoZC5Ohnoq2y1DQVs2WTrh/wEVO1HQsOA=",
     "homepage": "https://registry.terraform.io/providers/rancher/rancher2",
     "owner": "rancher",
     "repo": "terraform-provider-rancher2",
-    "rev": "v7.0.0",
+    "rev": "v7.2.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-M2lJKmIR66lQKFkInjizn68ax2Gq4sim5Y3vZKyDhZ8="
   },
···
     "vendorHash": "sha256-xo0alLK3fccbKRG5bN1G7orDsP47I3ySAzpZ9O0f2Fg="
   },
   "rootly": {
-    "hash": "sha256-SwZm4XCQUf3TQ6m77fAnhHMoW6ckpO5XSnjpEYuNyec=",
+    "hash": "sha256-2TVqXQYiCMsMQJtZMWtYiPbeOOsPck5Hpu6cmo9ZaIM=",
     "homepage": "https://registry.terraform.io/providers/rootlyhq/rootly",
     "owner": "rootlyhq",
     "repo": "terraform-provider-rootly",
-    "rev": "v2.27.1",
+    "rev": "v2.27.2",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-KezwDRmQQj0MnmsVlrX1OhNG6oMgw8fCxX5VFGdUynw="
   },
···
     "vendorHash": "sha256-HBdvXWZNPPAqPEKodwG0ZeiJOhfJHe9HRCcuozKpwVs="
   },
   "tencentcloud": {
-    "hash": "sha256-CHYuiAgzFIAApK8wZ75DtgVf8sAEVwrXP7l/l+VxB1o=",
+    "hash": "sha256-JMLuH/NDCNiByLh65NQH/goaN7/J7MGfsUNKfHJ3LFQ=",
     "homepage": "https://registry.terraform.io/providers/tencentcloudstack/tencentcloud",
     "owner": "tencentcloudstack",
     "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.81.194",
+    "rev": "v1.81.197",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
   "tfe": {
-    "hash": "sha256-hMpCuLAnwwAb8ugKxKDuFvtII2k/lcwYYL0sCvZewOY=",
+    "hash": "sha256-w66HR1X/EUloz3W/6aBNvTsC5vWuAZytd2ej7DHVMU0=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/tfe",
     "owner": "hashicorp",
     "repo": "terraform-provider-tfe",
-    "rev": "v0.65.2",
+    "rev": "v0.66.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-PSUob2u8hue5ii+kV4bGcvexkIQxzWsHbbEbYO0celU="
+    "vendorHash": "sha256-z1gbeYR+UFl+sBgehLgBITc9VwxEV6bRpN9A/4Fp7Oc="
   },
   "thunder": {
     "hash": "sha256-2i1DSOSt/vbFs0QCPogEBvADhLJFKbrQzwZ20ChCQMk=",

pkgs/applications/networking/cluster/timoni/default.nix

···
 
 buildGoModule rec {
   pname = "timoni";
-  version = "0.24.0";
+  version = "0.25.0";
 
   src = fetchFromGitHub {
     owner = "stefanprodan";
     repo = "timoni";
     rev = "v${version}";
-    hash = "sha256-nI0yy/zhsJUvisHo+C+/uNRF96ZQ1Ve8VWpE8ZvUeJc=";
+    hash = "sha256-Obx8I8n2UY6sTHKQ0qFNQ50XI+ajrbQtjQ7PCVwrSTI=";
   };
 
-  vendorHash = "sha256-YpwESaR+X2eOyaPdR+I3mURD7yvwzmpPmgPoSPrXjH8=";
+  vendorHash = "sha256-hCvFe27DdX/pAeyfSEDx5oiLEZjhldOVDz6ElsUPjJs=";
 
   subPackages = [ "cmd/timoni" ];
   nativeBuildInputs = [ installShellFiles ];

pkgs/applications/science/electronics/librepcb/default.nix

···
   buildInputs = [ qtbase ];
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit src;
-    sourceRoot = "source/${cargoRoot}";
+    inherit src cargoRoot;
     hash = "sha256-1td3WjxbDq2lX7c0trpYRhO82ChNAG/ZABBRsekYtq4=";
   };
 

pkgs/applications/video/animdl/default.nix pkgs/by-name/an/animdl/package.nix

···
 {
   lib,
-  buildPythonApplication,
   fetchFromGitHub,
-  poetry-core,
-  anchor-kr,
-  anitopy,
-  click,
-  cssselect,
-  httpx,
-  lxml,
-  packaging,
-  pkginfo,
-  pycryptodomex,
-  pyyaml,
-  regex,
-  rich,
-  tqdm,
-  yarl,
+  python3Packages,
 }:
-buildPythonApplication {
+python3Packages.buildPythonApplication {
   pname = "animdl";
   version = "1.7.27";
-  format = "pyproject";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "justfoolingaround";
···
   pythonRemoveDeps = [
     "comtypes" # windows only
   ];
+
   pythonRelaxDeps = [
+    "cssselect"
     "httpx"
     "lxml"
     "packaging"
···
     "yarl"
   ];
 
-  nativeBuildInputs = [
+  build-system = with python3Packages; [
     poetry-core
   ];
-  propagatedBuildInputs = [
+
+  dependencies = with python3Packages; [
     anchor-kr
     anitopy
     click

pkgs/applications/video/obs-studio/plugins/default.nix

···
 
   obs-advanced-masks = callPackage ./obs-advanced-masks.nix { };
 
+  obs-aitum-multistream = qt6Packages.callPackage ./obs-aitum-multistream.nix { };
+
   obs-backgroundremoval = callPackage ./obs-backgroundremoval { };
 
   obs-color-monitor = qt6Packages.callPackage ./obs-color-monitor.nix { };
···
   obs-command-source = callPackage ./obs-command-source.nix { };
 
   obs-composite-blur = callPackage ./obs-composite-blur.nix { };
+
+  obs-dir-watch-media = callPackage ./obs-dir-watch-media.nix { };
 
   obs-dvd-screensaver = callPackage ./obs-dvd-screensaver.nix { };
 
···
 
   obs-livesplit-one = callPackage ./obs-livesplit-one { };
 
+  obs-markdown = callPackage ./obs-markdown.nix { };
+
   obs-media-controls = qt6Packages.callPackage ./obs-media-controls.nix { };
 
   obs-move-transition = callPackage ./obs-move-transition.nix { };
···
   obs-recursion-effect = callPackage ./obs-recursion-effect.nix { };
 
   obs-replay-source = qt6Packages.callPackage ./obs-replay-source.nix { };
+
+  obs-retro-effects = callPackage ./obs-retro-effects.nix { };
 
   obs-rgb-levels = callPackage ./obs-rgb-levels.nix { };
 

pkgs/applications/video/obs-studio/plugins/obs-aitum-multistream.nix

···
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  curl,
+  obs-studio,
+  qtbase,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "obs-aitum-multistream";
+  version = "1.0.7";
+
+  src = fetchFromGitHub {
+    owner = "Aitum";
+    repo = "obs-aitum-multistream";
+    tag = version;
+    hash = "sha256-TqddyTBRWLyfwYi9I0nQE8Z19YL2RwkZqUwi7F9XpwQ=";
+  };
+
+  # Fix FTBFS with Qt >= 6.8
+  prePatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail 'find_qt(COMPONENTS Widgets Core)' 'find_package(Qt6 REQUIRED COMPONENTS Core Widgets)'
+  '';
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [
+    curl
+    obs-studio
+    qtbase
+  ];
+  dontWrapQtApps = true;
+
+  cmakeFlags = [
+    # Prevent deprecation warnings from failing the build
+    (lib.cmakeOptionType "string" "CMAKE_CXX_FLAGS" "-Wno-error=deprecated-declarations")
+  ];
+
+  meta = {
+    description = "Plugin to stream everywhere from a single instance of OBS";
+    homepage = "https://github.com/Aitum/obs-aitum-multistream";
+    maintainers = with lib.maintainers; [ flexiondotorg ];
+    license = lib.licenses.gpl2Plus;
+    platforms = [
+      "x86_64-linux"
+      "i686-linux"
+    ];
+  };
+}

pkgs/applications/video/obs-studio/plugins/obs-dir-watch-media.nix

···
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  obs-studio,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "obs-dir-watch-media";
+  version = "0.7.0";
+
+  src = fetchFromGitHub {
+    owner = "exeldro";
+    repo = "obs-dir-watch-media";
+    rev = version;
+    sha256 = "sha256-zvg8Bu5wlcQe91ggteEj7G9Kx+mY1R6EN64T13vp7pc=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ obs-studio ];
+
+  postInstall = ''
+    rm -rf $out/obs-plugins $out/data
+  '';
+
+  meta = with lib; {
+    description = "Plugin for OBS Studio adding a filter that can watch a directory for media files";
+    homepage = "https://github.com/exeldro/obs-dir-watch-media";
+    maintainers = with maintainers; [ flexiondotorg ];
+    license = licenses.gpl2Only;
+    platforms = [
+      "x86_64-linux"
+      "i686-linux"
+    ];
+  };
+}

pkgs/applications/video/obs-studio/plugins/obs-markdown.nix

···
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  obs-studio,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "obs-markdown";
+  version = "0.2.7";
+
+  src = fetchFromGitHub {
+    owner = "exeldro";
+    repo = "obs-markdown";
+    rev = version;
+    sha256 = "sha256-5ajX/cEa0n12Putx1k3ctl1v9wRzJRhyJNDlmjSMbeU=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ obs-studio ];
+
+  postInstall = ''
+    rm -rf $out/obs-plugins $out/data
+  '';
+
+  meta = with lib; {
+    description = "Plugin for OBS Studio to add Markdown sources";
+    homepage = "https://github.com/exeldro/obs-markdown";
+    maintainers = with maintainers; [ flexiondotorg ];
+    license = licenses.gpl2Only;
+    platforms = [
+      "x86_64-linux"
+      "i686-linux"
+    ];
+  };
+}

pkgs/applications/video/obs-studio/plugins/obs-retro-effects.nix

···
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  obs-studio,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "obs-retro-effects";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "FiniteSingularity";
+    repo = "obs-retro-effects";
+    rev = "${version}";
+    sha256 = "sha256-+dg5ySleMb9abT9kIM7HvRSRx9V08B9XPjfoAVe+tWY=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ obs-studio ];
+
+  postFixup = ''
+    mv $out/data/obs-plugins/${pname}/shaders $out/share/obs/obs-plugins/${pname}/
+    rm -rf $out/obs-plugins
+    rm -rf $out/data
+  '';
+
+  meta = with lib; {
+    description = "A collection of OBS filters to give your stream that retro feel.";
+    homepage = "https://github.com/FiniteSingularity/obs-retro-effects";
+    maintainers = with maintainers; [ flexiondotorg ];
+    license = licenses.gpl2Plus;
+    platforms = [
+      "x86_64-linux"
+      "i686-linux"
+    ];
+  };
+}

pkgs/build-support/fetchgit/tests.nix

···
     rev = "9d9dbe6ed05854e03811c361a3380e09183f4f4a";
     fetchTags = true;
     leaveDotGit = true;
-    sha256 = "sha256-2vfZnYjZlnC8ODz6B6aOqAqtb1Wbjojnn/5TmzwUrmo=";
+    sha256 = "sha256-y7l+46lVP2pzJwGON5qEV0EoxWofRoWAym5q9VXvpc8=";
     postFetch = ''
       cd $out && git describe --tags --always > describe-output.txt 2>&1 || echo "git describe failed" > describe-output.txt
+      # See https://github.com/NixOS/nixpkgs/issues/412967#issuecomment-2927452118
+      rm -rf .git
     '';
   };
 }

pkgs/by-name/ac/act/package.nix

···
 }:
 
 let
-  version = "0.2.77";
+  version = "0.2.78";
 in
 buildGoModule {
   pname = "act";
···
     owner = "nektos";
     repo = "act";
     tag = "v${version}";
-    hash = "sha256-bcqHj40lySE2xXGuUbXbH5cjQ5NoJCvjE/uX8HaKVho=";
+    hash = "sha256-S4Ev7MszuvlsUstnjOltYnZTuhzeqP/GDqMEWsFLe5Y=";
   };
 
   vendorHash = "sha256-YH5SIZ73VYqg7+sSJpvqkIlBUy1rs3uNEWiEBDRdkQw=";

pkgs/by-name/al/alertmanager-ntfy/package.nix

···
 
 buildGoModule {
   pname = "alertmanager-ntfy";
-  version = "0-unstable-2025-05-04";
+  version = "0-unstable-2025-05-31";
 
   src = fetchFromGitHub {
     owner = "alexbakker";
     repo = "alertmanager-ntfy";
-    rev = "f05e3c029bab3bdfb9aefbddbfc6bd9c7d4aa80f";
-    hash = "sha256-rKCJnffsBEXmTg2s0nqQf8BuHQnSgcwVBhC7gRzg4ew=";
+    rev = "76d5f772f70d6915c89da00414c20009b03cc361";
+    hash = "sha256-newJ1fCMEE3gsZncWU899Q6cS6llPNwJlHT7HdLQZf8=";
   };
 
   vendorHash = "sha256-e1JAoDNm2+xB/bZcEGr5l4+va8GIg1R8pdj3d+/Y+UY=";

pkgs/by-name/bo/bootspec/package.nix

···
   lib,
   rustPlatform,
   fetchFromGitHub,
-  fetchpatch,
 }:
 rustPlatform.buildRustPackage rec {
   pname = "bootspec";
-  version = "1.0.0";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "DeterminateSystems";
     repo = "bootspec";
     rev = "v${version}";
-    hash = "sha256-5IGSMHeL0eKfl7teDejAckYQjc8aeLwfwIQSzQ8YaAg=";
+    hash = "sha256-0MO+SqG7Gjq+fmMJkIFvaKsfTmC7z3lGfi7bbBv7iBE=";
   };
 
-  patches = [
-    # https://github.com/DeterminateSystems/bootspec/pull/127
-    # Fixes the synthesize tool for aarch64-linux
-    (fetchpatch {
-      name = "aarch64-support.patch";
-      url = "https://github.com/DeterminateSystems/bootspec/commit/1d0e925f360f0199f13422fb7541225fd162fd4f.patch";
-      sha256 = "sha256-wU/jWnOqVBrU2swANdXbQfzRpNd/JIS4cxSyCvixZM0=";
-    })
-
-  ];
-
   useFetchCargoVendor = true;
-  cargoHash = "sha256-65jk8UlXZgQoxuwRcGlMnI4e+LpCJuP2TaqK+Kn4GnQ=";
+  cargoHash = "sha256-fKbF5SyI0UlZTWsygdE8BGWuOoNSU4jx+CGdJoJFhZs=";
 
   meta = with lib; {
     description = "Implementation of RFC-0125's datatype and synthesis tooling";

pkgs/by-name/bu/burpsuite/package.nix

···
 }:
 
 let
-  version = "2025.4.2";
+  version = "2025.5.1";
 
   product =
     if proEdition then
       {
         productName = "pro";
         productDesktop = "Burp Suite Professional Edition";
-        hash = "sha256-wtCZ3/7JvygSCka4i3Il2ajpSuuTPTwHeVJa4gGFDPw=";
+        hash = "sha256-1AXAVXselQKqKsjTRJVN3rBQpSReTH3d0ulIahp9QCc=";
       }
     else
       {
         productName = "community";
         productDesktop = "Burp Suite Community Edition";
-        hash = "sha256-+1aTq7XKacsi/gzUpeZvSuwpKPDMo6H3C81pxWCC4w8=";
+        hash = "sha256-zX5QJz996WgKvDA6p5dRtmbZTRsgCl0URn302MkhVew=";
       };
 
   src = fetchurl {
···
     ${lib.getBin unzip}/bin/unzip -p ${src} resources/Media/icon64${product.productName}.png > "$out/share/pixmaps/burpsuite.png"
     cp -r ${desktopItem}/share/applications $out/share
   '';
+
+  passthru.updateScript = ./update.sh;
 
   meta = with lib; {
     inherit description;

pkgs/by-name/bu/burpsuite/update.sh

···
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq xxd gnused diffutils
+set -eu -o pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" &>/dev/null && pwd)"
+
+curl -s 'https://portswigger.net/burp/releases/data' |
+  jq -r '
+      [[
+        .ResultSet.Results[]
+        | select(
+            (.categories | sort) == (["Professional","Community"] | sort)
+            and .releaseChannels == ["Early Adopter"]
+          )
+      ][0].builds[]
+      | select(.ProductPlatform == "Jar")
+    ]' >latest.json
+
+version=$(jq -r '.[0].Version' latest.json)
+
+comm_hex=$(jq -r '.[] | select(.ProductId=="community") .Sha256Checksum' latest.json)
+pro_hex=$(jq -r '.[] | select(.ProductId=="pro") .Sha256Checksum' latest.json)
+
+comm_sri="sha256-$(printf %s "$comm_hex" | xxd -r -p | base64 -w0)"
+pro_sri="sha256-$(printf %s "$pro_hex" | xxd -r -p | base64 -w0)"
+
+sed -i \
+  -e "s|^\(\s*version = \)\"[^\"]*\";|\1\"$version\";|" \
+  -e "/productName = \"community\"/,/hash =/ {
+        s|sha256-[^\"]*|$comm_sri|
+     }" \
+  -e "/productName = \"pro\"/,/hash =/ {
+        s|sha256-[^\"]*|$pro_sri|
+     }" \
+  $SCRIPT_DIR/package.nix
+
+echo "burpsuite → $version"
+echo "  community: $comm_sri"
+echo "  pro      : $pro_sri"

pkgs/by-name/cc/ccextractor/package.nix

···
   cargoRoot = "src/rust";
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
-    sourceRoot = "${finalAttrs.src.name}/${finalAttrs.cargoRoot}";
+    inherit (finalAttrs) src cargoRoot;
     patches = [ ./use-rsmpeg-0.15.patch ];
-    patchFlags = [ "-p3" ];
     hash = "sha256-7v3gQghByUDWZLJRRGa/7X2ivUumirq6BbexNQcCXCk=";
   };
 

pkgs/by-name/cd/cdncheck/package.nix

···
 
 buildGoModule rec {
   pname = "cdncheck";
-  version = "1.1.20";
+  version = "1.1.21";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "cdncheck";
     tag = "v${version}";
-    hash = "sha256-qL2SNVHsAH+Z0A5Vv+kBa1O9VgdR7eZ29Z19s5GuTXA=";
+    hash = "sha256-GTYgo5rx4PrWLytqdH3LrasgyEAr1FuPyI26tGRaV0A=";
   };
 
   vendorHash = "sha256-/1REkZ5+sz/H4T4lXhloz7fu5cLv1GoaD3dlttN+Qd4=";

pkgs/by-name/ch/chart-testing/package.nix

···
 
 buildGoModule rec {
   pname = "chart-testing";
-  version = "3.12.0";
+  version = "3.13.0";
 
   src = fetchFromGitHub {
     owner = "helm";
     repo = "chart-testing";
     rev = "v${version}";
-    hash = "sha256-q56ZM+YzL7RRC3RD3xO3K0hIDomKun5xmSKuiDTq1cU=";
+    hash = "sha256-59a86yR/TDAWGCsj3pbDjXJGMvyHYnjsnxzjWr61PuU=";
   };
 
-  vendorHash = "sha256-kTlqGZVOppf+WMcFw0T9FVbu9eOWAWzotR8fPPyo2Ms=";
+  vendorHash = "sha256-aVXISRthJxxvtrfC0DpewLHCiJPh4tO+SKl3Q9uP14k=";
 
   postPatch = ''
     substituteInPlace pkg/config/config.go \

pkgs/by-name/ch/chirp/package.nix

···
 
 python3Packages.buildPythonApplication {
   pname = "chirp";
-  version = "0.4.0-unstable-2025-05-14";
+  version = "0.4.0-unstable-2025-05-29";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kk7ds";
     repo = "chirp";
-    rev = "eb4e4547b517c3d10ede760bcd31eeb448c455dc";
-    hash = "sha256-e10WFYpIy6JnPAqUcapli9Q6R0GxNwb1YjnE4cu+xfk=";
+    rev = "db838b0c1ae9b0964efcd625c415a76ff9fbea4a";
+    hash = "sha256-C8sicZ4krALpsRFbX8Ls5GZc7FUimg2Ix6WsQP2oMvw=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/cl/clorinde/package.nix

···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "clorinde";
-  version = "0.15.1";
+  version = "0.15.2";
 
   src = fetchFromGitHub {
     owner = "halcyonnouveau";
     repo = "clorinde";
     tag = "clorinde-v${finalAttrs.version}";
-    hash = "sha256-Ynz1pdgckQzMLuUJUGSzNRNwWZKrEZuYgrrT/BxAxzc=";
+    hash = "sha256-CrgJtgFX5RBNfFFr2ZZ0d3oKfryyLAHva7g2JyBFiB8=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-g3pWvoTq1DlKlIDJq79IJrvDiLR0HZRPIt4K1YUPsvM=";
+  cargoHash = "sha256-jUtkhOAosrxHGRbAdzdrgLzL5Xp2YhxcrG/dcwUhdLg=";
 
   cargoBuildFlags = [ "--package=clorinde" ];
 

pkgs/by-name/cl/clouddrive2/package.nix

···
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "clouddrive2";
-  version = "0.8.19";
+  version = "0.8.20";
 
   src = fetchurl {
     url = "https://github.com/cloud-fs/cloud-fs.github.io/releases/download/v${finalAttrs.version}/clouddrive-2-${os}-${arch}-${finalAttrs.version}.tgz";
     hash =
       {
-        x86_64-linux = "sha256-pLimn6OfqByOyFIDYq0VD4yQ0BpL+st5VwYBKP5zSug=";
-        aarch64-linux = "sha256-Xr3locwzuCg0LRPvNBphhleHFZOnXLi9Md8R17k4vWU=";
-        x86_64-darwin = "sha256-klwicOa/jbjsGL09HR6v2CTA+vhHd1EjCbblAmEPqWQ=";
-        aarch64-darwin = "sha256-47AbC8SHDb1hRlePF6CszHqf2gpwIxsOhJK4+PMCHbQ=";
+        x86_64-linux = "sha256-pDZmrPLIppMMj8KqNGQLUM4ue43vSwVyEKCYrN0G2LM=";
+        aarch64-linux = "sha256-GraqtexpHN+bpArA1HQDYC7DG2QHK1P7o9QDXyFEir4=";
+        x86_64-darwin = "sha256-X/Gf4OipbUM8FwAYfA1+yMBVbsZK5UYz4HFiOYYaTdA=";
+        aarch64-darwin = "sha256-jmsj1VPpxTgly0xIB5pxl79NBZe1zp9rqAYePScMe80=";
       }
       .${stdenv.hostPlatform.system} or (throw "unsupported system ${stdenv.hostPlatform.system}");
   };

pkgs/by-name/di/diffoscope/package.nix

···
 # Note: when upgrading this package, please run the list-missing-tools.sh script as described below!
 python.pkgs.buildPythonApplication rec {
   pname = "diffoscope";
-  version = "295";
+  version = "297";
 
   src = fetchurl {
     url = "https://diffoscope.org/archive/diffoscope-${version}.tar.bz2";
-    hash = "sha256-BxyE14vXS7lGFwWsruDAcdXMRsoETFwXPQxfMpSh1+E=";
+    hash = "sha256-3dEZb7XZluTi+sUTgSqwLzCdNMJwekt1Em0XEDSAY/E=";
   };
 
   outputs = [

pkgs/by-name/di/distroshelf/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "distroshelf";
-  version = "1.0.7";
+  version = "1.0.8";
 
   src = fetchFromGitHub {
     owner = "ranfdev";
     repo = "DistroShelf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4xiqdLSmO9LXfVwF/QRJL8BhZDsNistdGVVT4YDdt4A=";
+    hash = "sha256-UZP/VohgYUe6Ly89oD9WlYyiAfQmTK1lXnf5TipoiNI=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {

pkgs/by-name/dp/dprint/plugins/dprint-plugin-typescript.nix

···
 { mkDprintPlugin }:
 mkDprintPlugin {
   description = "TypeScript/JavaScript code formatter.";
-  hash = "sha256-g41K7aTCZZc1zRoc9k1oG8rk88ZwJJH3jnnX+MKQ9mE=";
+  hash = "sha256-sn10yaYbp6VWspqEMKCd7HbDvKi35AW5Xn8FGzzN3kM=";
   initConfig = {
     configExcludes = [ "**/node_modules" ];
     configKey = "typescript";
···
   };
   pname = "dprint-plugin-typescript";
   updateUrl = "https://plugins.dprint.dev/dprint/typescript/latest.json";
-  url = "https://plugins.dprint.dev/typescript-0.95.4.wasm";
-  version = "0.95.4";
+  url = "https://plugins.dprint.dev/typescript-0.95.5.wasm";
+  version = "0.95.5";
 }

pkgs/by-name/dr/dracula-theme/package.nix

···
 
 let
   themeName = "Dracula";
-  version = "4.0.0-unstable-2025-04-27";
+  version = "4.0.0-unstable-2025-05-24";
 in
 stdenvNoCC.mkDerivation {
   pname = "dracula-theme";
···
   src = fetchFromGitHub {
     owner = "dracula";
     repo = "gtk";
-    rev = "3834a1bac175b226cff6b1c94faac9aba2819bd5";
-    hash = "sha256-T0X0h4Bz3sy5jqtB1PkpjFnB8jO3CehOxgRwPPG54Ds=";
+    rev = "74255b110e7e5f50a07f500f739bc59c2cbee472";
+    hash = "sha256-0NA/MTmcgRlR6JEOFz1+SgyoRwRygygEWAQDrpznA5w=";
   };
 
   propagatedUserEnvPkgs = [

pkgs/by-name/ds/dsnet/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  buildGoModule,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "dsnet";
+  version = "0.8.1";
+
+  src = fetchFromGitHub {
+    owner = "naggie";
+    repo = "dsnet";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-CKDtILZMWFeSU5nTSguM2fi0BCFdvR2LqELIZ6LYOMk=";
+  };
+  vendorHash = "sha256-Q2Ipj9yZ+/GUBEmDvgwFLLww7EXnbvdvj/shGQnh1G8=";
+
+  subPackages = [ "cmd" ];
+
+  postInstall = ''
+    mv $out/bin/cmd $out/bin/dsnet
+  '';
+
+  # The ldflags reduce the executable size by stripping some debug stuff.
+  # The other variables are set so that the output of dsnet version shows the
+  # git ref and the release version from github.
+  # Ref <https://github.com/NixOS/nixpkgs/pull/87383#discussion_r432097657>
+  ldflags = [
+    "-w"
+    "-s"
+    "-X github.com/naggie/dsnet.VERSION=${finalAttrs.src.tag}"
+    "-X github.com/naggie/dsnet.GIT_COMMIT=${finalAttrs.src.tag}"
+  ];
+
+  meta = {
+    description = "Fast command to manage a centralised Wireguard VPN";
+    homepage = "https://github.com/naggie/dsnet";
+    changelog = "https://github.com/naggie/dsnet/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
+    maintainers = [ lib.maintainers.naggie ];
+    mainProgram = "dsnet";
+  };
+
+})

pkgs/by-name/fl/flaresolverr/package.nix

···
   '';
 
   installPhase = ''
-    mkdir -p $out/{bin,share/${finalAttrs.pname}-${finalAttrs.version}}
-    cp -r * $out/share/${finalAttrs.pname}-${finalAttrs.version}/.
+    mkdir -p $out/{bin,share/flaresolverr-${finalAttrs.version}}
+    cp -r * $out/share/flaresolverr-${finalAttrs.version}/.
 
     makeWrapper ${python}/bin/python $out/bin/flaresolverr \
-      --add-flags "$out/share/${finalAttrs.pname}-${finalAttrs.version}/src/flaresolverr.py" \
+      --add-flags "$out/share/flaresolverr-${finalAttrs.version}/src/flaresolverr.py" \
       --prefix PATH : "${lib.makeBinPath [ xorg.xvfb ]}"
   '';
 

pkgs/by-name/ge/geoclock/package.nix

···
   };
 
   cargoHash = "sha256-7mApZj3Ksy8Av0W+0+UZQCkH281bSBd4xo8/7JowmHs=";
-  cargoDepsName = finalAttrs.pname;
+  cargoDepsName = "geoclock";
 
   meta = {
     description = "Displays time as calculated by your longitude";

pkgs/by-name/gi/gildas/package.nix

···
 in
 
 stdenv.mkDerivation rec {
-  srcVersion = "may25a";
-  version = "20250501_a";
+  srcVersion = "jun25a";
+  version = "20250601_a";
   pname = "gildas";
 
   src = fetchurl {
···
       "http://www.iram.fr/~gildas/dist/gildas-src-${srcVersion}.tar.xz"
       "http://www.iram.fr/~gildas/dist/archive/gildas/gildas-src-${srcVersion}.tar.xz"
     ];
-    hash = "sha256-ofcuwc4vIKLbY/2uRqWG4sdrm9N0hpqz6zYwkZyySWo=";
+    hash = "sha256-DhUGaG96bsZ1NGfDQEujtiM0AUwZBMD42uRpRWI5DX0=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/gi/gitleaks/package.nix

···
 
 buildGoModule rec {
   pname = "gitleaks";
-  version = "8.26.0";
+  version = "8.27.0";
 
   src = fetchFromGitHub {
     owner = "zricethezav";
     repo = "gitleaks";
     tag = "v${version}";
-    hash = "sha256-lBIoEUjAllhUTS9PRSqdWUeBhEGs6wOHOWivj0PC9Is=";
+    hash = "sha256-62Tcj5NiEk4uaGpiallCjDzpkFbuTazfMiemEe+ATLg=";
   };
 
-  vendorHash = "sha256-MSF9N9kXsIM2WKsjKAVztYypwGPng2EElHx7p6vADqc=";
+  vendorHash = "sha256-vd39TbooEdmYa6QZGEnYOmYU9p+9mV+SrLKVY+h/PEM=";
 
   ldflags = [
     "-s"

pkgs/by-name/gl/gleam/package.nix

···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "gleam";
-  version = "1.10.0";
+  version = "1.11.0";
 
   src = fetchFromGitHub {
     owner = "gleam-lang";
     repo = "gleam";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0qK9dWkKnoXbIIBMN3p5noPEke/bgC8Bjtmf6lwtyr4=";
+    hash = "sha256-oxzFAqPZ+ZHd/+GwofDg0gA4NIFYWi2v8fOjMn8ixSU=";
   };
 
-  cargoHash = "sha256-EoRu8p6cUe1li54nVUkf+3qywIsDXh4ptIVLluJ3eFs=";
+  cargoHash = "sha256-9kk7w85imYIhywBuAgJS8wYAIEM3hXoHymGgMMmrgnI=";
 
   nativeBuildInputs = [
     git
···
     homepage = "https://gleam.run/";
     changelog = "https://github.com/gleam-lang/gleam/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.asl20;
-    maintainers = [ lib.maintainers.philtaken ];
+    maintainers = with lib.maintainers; [
+      philtaken
+      llakala
+    ];
     teams = [ lib.teams.beam ];
   };
 })

pkgs/by-name/go/gopher/int_main.patch

···
-diff --git a/configure b/configure
-index 1b20711..79ce215 100644
---- a/configure
-+++ b/configure
-@@ -679,7 +679,7 @@ cat > conftest.$ac_ext << EOF
- #line 680 "configure"
- #include "confdefs.h"
- 
--main(){return(0);}
-+int main(){return(0);}
- EOF
- if { (eval echo configure:685: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
-   ac_cv_prog_cc_works=yes

pkgs/by-name/go/gopher/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "gopher";
-  version = "3.0.18";
+  version = "3.0.19";
 
   src = fetchFromGitHub {
     owner = "jgoerzen";
     repo = "gopher";
     rev = "release/${version}";
-    sha256 = "sha256-YAcpEV3SbiUZ4nqYk6k1M41YWdTGSSH7rNB15gv31qQ=";
+    sha256 = "sha256-8J63TnC3Yq7+64PPLrlPEueMa9D/eWkPsb08t1+rPAA=";
   };
 
   buildInputs = [ ncurses ];
-
-  patches = [
-    ./int_main.patch # https://github.com/jgoerzen/gopher/pull/8
-  ];
 
   preConfigure = "export LIBS=-lncurses";
 

pkgs/by-name/he/helm-ls/package.nix

···
 
 buildGoModule rec {
   pname = "helm-ls";
-  version = "0.2.2";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "mrjosh";
     repo = "helm-ls";
     rev = "v${version}";
-    hash = "sha256-NI9qtbt0Ci300DhDR+yjFThTGLXKrbsc1wuLPpC1l9o=";
+    hash = "sha256-OxrPqDa2g5jmm+XtLE0YCnVhkvVK60xxrO49Gl8VT60=";
   };
 
-  vendorHash = "sha256-1BO/0Ous4mclainPV+nqk5K+tHKgRnaxMtsI4xAhZF4=";
+  vendorHash = "sha256-w/BWPbpSYum0SU8PJj76XiLUjTWO4zNQY+khuLRK0O8=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/hy/hyprls/package.nix

···
 }:
 buildGoModule rec {
   pname = "hyprls";
-  version = "0.6.0";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "hyprland-community";
     repo = "hyprls";
     rev = "v${version}";
-    hash = "sha256-sXC/JMd2NYc74k19DxZyldH+QLZ6W8dVHy0uyqyuCmg=";
+    hash = "sha256-cJDDyF44nD/XvxtaGPYCk2MC574HDBHP1ByhVwqatvQ=";
   };
 
-  vendorHash = "sha256-rG+oGJOABA9ee5nIpC5/U0mMsPhwvVtQvJBlQWfxi5Y=";
+  vendorHash = "sha256-WTdwIAC3gDWgCKlVuOtMyl0ZfdZ9RhlpqUl2S2d65HA=";
 
   checkFlags = [
     # Not yet implemented

pkgs/by-name/ik/ike-scan/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "ike-scan";
-  version = "1.9.5";
+  version = "1.9.5-unstable-2024-09-15";
 
   src = fetchFromGitHub {
     owner = "royhills";
     repo = "ike-scan";
-    rev = version;
-    sha256 = "sha256-mbfg8p3y4aKoXpmLuF9GXAMPEqV5CsvetwGCRDJ9UNY=";
+    rev = "c74c01fd22d9a3aae3d8ba9a0bd2eb1a2146ac6f";
+    hash = "sha256-+eicvirqzZrAJiaGaVjqZlSpU2+jTG/MRPv50P+1Tpc=";
   };
 
-  nativeBuildInputs = [
-    autoreconfHook
-    openssl
-  ];
-
-  configureFlags = [ "--with-openssl=${openssl.dev}" ];
-
   patches = [
     # Using the same patches as for the Fedora RPM
     (fetchpatch {
       # Memory leaks, https://github.com/royhills/ike-scan/pull/15
       url = "https://github.com/royhills/ike-scan/pull/15/commits/d864811de08dcddd65ac9b8d0f2acf5d7ddb9dea.patch";
-      sha256 = "0wbrq89dl8js7cdivd0c45hckmflan33cpgc3qm5s3az6r4mjljm";
+      hash = "sha256-VVJZSTZfDV0qHuxdNoZV1NXJYCEMtB0bO1oi2hLCeXE=";
     })
   ];
 
+  nativeBuildInputs = [
+    autoreconfHook
+    openssl
+  ];
+
+  configureFlags = [ "--with-openssl=${openssl.dev}" ];
+
   meta = with lib; {
     description = "Tool to discover, fingerprint and test IPsec VPN servers";
     longDescription = ''
···
       fingerprint and test IPsec VPN servers.
     '';
     homepage = "https://github.com/royhills/ike-scan";
-    license = with licenses; [ gpl3Plus ];
+    license = licenses.gpl3Plus;
     platforms = platforms.linux;
     maintainers = with maintainers; [ fab ];
   };

pkgs/by-name/ko/kool/package.nix

···
 
 buildGoModule rec {
   pname = "kool";
-  version = "3.5.0";
+  version = "3.5.2";
 
   src = fetchFromGitHub {
     owner = "kool-dev";
     repo = "kool";
     rev = version;
-    hash = "sha256-iB/9owaBNQVzdA4edrx0zl+COs7yVLs61Mij5kfjEhg=";
+    hash = "sha256-yUJbuMOLEa9LVRltskSwD0XBdmwwLcEaLYUHsSQOiCk=";
   };
 
   vendorHash = "sha256-IqUkIf0uk4iUTedTO5xRzjmJwHS+p6apo4E0WEEU6cc=";

pkgs/by-name/kr/krapslog/package.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "krapslog";
-  version = "0.6.0";
+  version = "0.6.1";
 
   src = fetchFromGitHub {
     owner = "acj";
     repo = "krapslog-rs";
     rev = version;
-    sha256 = "sha256-wRziLNMwLZBCn330FNC9x6loCCyuC+31Kh51ZI/j1Cc=";
+    sha256 = "sha256-c/Zh4fOsSKY0XopaklRbFEh4QM5jjUcj0zhAx5v9amI=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Mv0wTuTWCsBGjlr4BhLezBOCtgQ0qq2kwLcZxU1nREM=";
+  cargoHash = "sha256-cXK7YZ9i/eKXTHPYnJcvcKyzFlZDnqmCBrEa75Mxfqc=";
 
   buildInputs = lib.optional stdenv.hostPlatform.isDarwin libiconv;
 

pkgs/by-name/kr/krillinai/package.nix

···
 
 buildGoModule (finalAttrs: {
   pname = "krillinai";
-  version = "1.1.5";
+  version = "1.2.1-hotfix-2";
 
   src = fetchFromGitHub {
     owner = "krillinai";
     repo = "KrillinAI";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jQlgkpQ+UTzn6MqGa+yVQ9v04IGGlMQQim3s0Oc9Zts=";
+    hash = "sha256-Dw30Lsf4pHMDlrLmdoU+4v5SJfzx5UId6v/OocrsiS4=";
   };
 
-  vendorHash = "sha256-mpvypCZmvVVljftGpcV1aea3s7Xmhr0jLfKZIZ0nkX8=";
+  vendorHash = "sha256-14YNdIfylUpcWqHhrpgmjxBHYRXaoR59jb1QdTckuLY=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/li/libfaketime/0001-Remove-unsupported-clang-flags.patch

···
-diff --git a/src/Makefile b/src/Makefile
-index 2af4804..bcff809 100644
---- a/src/Makefile
-+++ b/src/Makefile
-@@ -80,7 +80,7 @@ PREFIX ?= /usr/local
- LIBDIRNAME ?= /lib/faketime
- PLATFORM ?=$(shell uname)
- 
--CFLAGS += -std=gnu99 -Wall -Wextra -Werror -Wno-nonnull-compare -DFAKE_PTHREAD -DFAKE_STAT -DFAKE_UTIME -DFAKE_SLEEP -DFAKE_TIMERS -DFAKE_INTERNAL_CALLS -fPIC -DPREFIX='"'$(PREFIX)'"' -DLIBDIRNAME='"'$(LIBDIRNAME)'"' $(FAKETIME_COMPILE_CFLAGS)
-+CFLAGS += -std=gnu99 -Wall -Wextra -DFAKE_PTHREAD -DFAKE_STAT -DFAKE_UTIME -DFAKE_SLEEP -DFAKE_TIMERS -DFAKE_INTERNAL_CALLS -fPIC -DPREFIX='"'$(PREFIX)'"' -DLIBDIRNAME='"'$(LIBDIRNAME)'"' $(FAKETIME_COMPILE_CFLAGS)
- ifeq ($(PLATFORM),SunOS)
- CFLAGS += -D__EXTENSIONS__ -D_XOPEN_SOURCE=600
- endif

pkgs/by-name/li/libfaketime/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "libfaketime";
-  version = "0.9.10";
+  version = "0.9.11";
 
   src = fetchFromGitHub {
     owner = "wolfcw";
     repo = "libfaketime";
     rev = "v${version}";
-    sha256 = "sha256-DYRuQmIhQu0CNEboBAtHOr/NnWxoXecuPMSR/UQ/VIQ=";
+    sha256 = "sha256-a0TjHYzwbkRQyvr9Sj/DqjgLBnE1Z8kjsTQxTfGqLjE=";
   };
 
-  patches =
-    [
-      ./nix-store-date.patch
-      (fetchpatch {
-        name = "0001-libfaketime.c-wrap-timespec_get-in-TIME_UTC-macro.patch";
-        url = "https://github.com/wolfcw/libfaketime/commit/e0e6b79568d36a8fd2b3c41f7214769221182128.patch";
-        sha256 = "sha256-KwwP76v0DXNW73p/YBvwUOPdKMAcVdbQSKexD/uFOYo=";
-      })
-      (fetchpatch {
-        name = "LFS64.patch";
-        url = "https://github.com/wolfcw/libfaketime/commit/f32986867addc9d22b0fab29c1c927f079d44ac1.patch";
-        hash = "sha256-fIXuxxcV9J2IcgwcwSrMo4maObkH9WYv1DC/wdtbq/g=";
-      })
-    ]
-    ++ (lib.optionals stdenv.cc.isClang [
-      # https://github.com/wolfcw/libfaketime/issues/277
-      ./0001-Remove-unsupported-clang-flags.patch
-    ]);
+  patches = [
+    ./nix-store-date.patch
+  ];
 
   postPatch = ''
     patchShebangs test src
     for a in test/functests/test_exclude_mono.sh src/faketime.c ; do
       substituteInPlace $a \
-        --replace /bin/bash ${stdenv.shell}
+        --replace-fail /bin/bash ${stdenv.shell}
     done
-    substituteInPlace src/faketime.c --replace @DATE_CMD@ ${coreutils}/bin/date
+    substituteInPlace src/faketime.c --replace-fail @DATE_CMD@ ${coreutils}/bin/date
   '';
 
   PREFIX = placeholder "out";

pkgs/by-name/li/libkate/package.nix

···
 {
   lib,
   stdenv,
-  fetchurl,
+  fetchFromGitLab,
+  autoreconfHook,
+  bison,
+  flex,
   libogg,
   libpng,
+  pkg-config,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libkate";
-  version = "0.4.1";
+  version = "0.4.3";
 
-  src = fetchurl {
-    url = "https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/libkate/${pname}-${version}.tar.gz";
-    sha256 = "0s3vr2nxfxlf1k75iqpp4l78yf4gil3f0v778kvlngbchvaq23n4";
+  src = fetchFromGitLab {
+    domain = "gitlab.xiph.org/";
+    owner = "xiph";
+    repo = "kate";
+    tag = "kate-${finalAttrs.version}";
+    hash = "sha256-HwDahmjDC+O321Ba7MnHoQdHOFUMpFzaNdLHQeEg11Q=";
   };
 
+  nativeBuildInputs = [
+    autoreconfHook
+    bison
+    flex
+    pkg-config # provides macro PKG_CHECK_MODULES
+  ];
+
   buildInputs = [
     libogg
     libpng
   ];
 
-  meta = with lib; {
+  enableParallelBuilding = true;
+
+  meta = {
     description = "Library for encoding and decoding Kate streams";
     longDescription = ''
       This is libkate, the reference implementation of a codec for the Kate
       bitstream format. Kate is a karaoke and text codec meant for encapsulation
       in an Ogg container. It can carry Unicode text, images, and animate
       them.'';
-    homepage = "https://code.google.com/archive/p/libkate/";
-    platforms = platforms.unix;
-    license = licenses.bsd3;
+    homepage = "https://wiki.xiph.org/index.php/OggKate";
+    platforms = lib.platforms.unix;
+    license = lib.licenses.bsd3;
   };
-}
+})

pkgs/by-name/lo/logdy/package.nix

···
 
 buildGoModule rec {
   pname = "logdy";
-  version = "0.16.0";
+  version = "0.17.0";
 
   src = fetchFromGitHub {
     owner = "logdyhq";
     repo = "logdy-core";
     tag = "v${version}";
-    hash = "sha256-OpG9jgm/A++PBDQH5IYY6PyXx87QvihyZqnwhdBWZGg=";
+    hash = "sha256-779ZO9WhE3IKbHJLchCfrIepMH+GOrlQJALLpoNZvbc=";
   };
 
   vendorHash = "sha256-kFhcbBMymzlJ+2zw7l09LJfCdps26Id+VzOehqrLDWU=";

pkgs/by-name/ma/manga-tui/package.nix

···
   nix-update-script,
 }:
 let
-  version = "0.7.0";
+  version = "0.8.0";
 in
 rustPlatform.buildRustPackage {
   pname = "manga-tui";
···
     owner = "josueBarretogit";
     repo = "manga-tui";
     rev = "v${version}";
-    hash = "sha256-1WFg2hG3UnOO9+HpUcdPkZNhsNYa2QG1PhzLZ4bQiQM=";
+    hash = "sha256-81P5LwL9njxA0qx4FvqgrHdqVgUXkZTTzAXLdRTftS4=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-1nERwIZCR/afgfGdronpy145GnDkbsB7YjF6XyDcfEY=";
+  cargoHash = "sha256-dne0sJ0K/UVXGaj/vUM9O++ZS0hu69bdLnV8VAr3tbM=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/mi/minio-client/package.nix

···
 
 buildGoModule rec {
   pname = "minio-client";
-  version = "2025-04-16T18-13-26Z";
+  version = "2025-05-21T01-59-54Z";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "mc";
     rev = "RELEASE.${version}";
-    sha256 = "sha256-23shNQWVIuTLL0FLM00919JaT2QR4R0ou5ZA2/mQ4PA=";
+    sha256 = "sha256-ss/GqOJz9FNrQzYABb8ePCMcmNVTYVji/Id1WOuu24M=";
   };
 
   vendorHash = "sha256-MpLQZFrf2sBAweXtYeFi5j6p6GaXuN99x+r4UK8D9xM=";

pkgs/by-name/ne/ne/package.nix

···
   ghostscript,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "ne";
   version = "3.3.4";
 
   src = fetchFromGitHub {
     owner = "vigna";
     repo = "ne";
-    rev = version;
-    sha256 = "sha256-n8PERQD9G4jmW4avQjbFofrSapyRoSbQ2k1LzVt0i1o=";
+    tag = finalAttrs.version;
+    hash = "sha256-n8PERQD9G4jmW4avQjbFofrSapyRoSbQ2k1LzVt0i1o=";
   };
 
   postPatch = ''
-    substituteInPlace makefile --replace "./version.pl" "perl version.pl"
-    substituteInPlace src/makefile --replace "-lcurses" "-lncurses"
+    substituteInPlace makefile --replace-fail "./version.pl" "perl version.pl"
+    substituteInPlace src/makefile --replace-fail "-lcurses" "-lncurses"
   '';
+
+  strictDeps = true;
 
   nativeBuildInputs = [
     texliveMedium
···
 
   makeFlags = [ "PREFIX=${placeholder "out"}" ];
 
-  meta = with lib; {
+  meta = {
     description = "Nice editor";
     homepage = "https://ne.di.unimi.it/";
+    changelog = "https://github.com/vigna/ne/releases/tag/${finalAttrs.version}";
+    downloadPage = "https://github.com/vigna/ne";
     longDescription = ''
       ne is a free (GPL'd) text editor based on the POSIX standard that runs
       (we hope) on almost any UN*X machine.  ne is easy to use for the beginner,
       but powerful and fully configurable for the wizard, and most sparing in its
       resource usage.  See the manual for some highlights of ne's features.
     '';
-    license = licenses.gpl3;
-    platforms = platforms.unix;
-    maintainers = with maintainers; [ geri1701 ];
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ geri1701 ];
     mainProgram = "ne";
   };
-}
+})

pkgs/by-name/of/offrss/package.nix

···
-{
-  lib,
-  stdenv,
-  fetchurl,
-  curl,
-  libmrss,
-  podofo,
-  libiconv,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "offrss";
-  version = "1.3";
-
-  installPhase = ''
-    mkdir -p $out/bin
-    cp offrss $out/bin
-  '';
-
-  buildInputs =
-    [
-      curl
-      libmrss
-    ]
-    ++ lib.optional (stdenv.hostPlatform == stdenv.buildPlatform) podofo
-    ++ lib.optional (!stdenv.hostPlatform.isLinux) libiconv;
-
-  # Workaround build failure on -fno-common toolchains:
-  #   ld: serve_pdf.o:offrss.h:75: multiple definition of `cgi_url_path';
-  #     offrss.o:offrss.h:75: first defined here
-  env.NIX_CFLAGS_COMPILE = "-fcommon -Wno-error=implicit-function-declaration";
-
-  configurePhase =
-    ''
-      substituteInPlace Makefile \
-        --replace '$(CC) $(CFLAGS) $(LDFLAGS)' '$(CXX) $(CFLAGS) $(LDFLAGS)'
-    ''
-    + lib.optionalString (!stdenv.hostPlatform.isLinux) ''
-      sed 's/#EXTRA/EXTRA/' -i Makefile
-    ''
-    + lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
-      sed 's/^PDF/#PDF/' -i Makefile
-    '';
-
-  src = fetchurl {
-    url = "http://vicerveza.homeunix.net/~viric/soft/offrss/offrss-${finalAttrs.version}.tar.gz";
-    hash = "sha256-5oIiDLdFrnEfPfSiwCv3inIcxK+bbgbMT1VISVAPfKo=";
-  };
-
-  meta = {
-    homepage = "http://vicerveza.homeunix.net/~viric/cgi-bin/offrss";
-    description = "Offline RSS/Atom reader";
-    license = lib.licenses.agpl3Plus;
-    maintainers = [ ];
-    platforms = lib.platforms.linux;
-    mainProgram = "offrss";
-  };
-})

pkgs/by-name/og/ogen/package.nix

···
 
 buildGoModule rec {
   pname = "ogen";
-  version = "1.13.0";
+  version = "1.14.0";
 
   src = fetchFromGitHub {
     owner = "ogen-go";
     repo = "ogen";
     tag = "v${version}";
-    hash = "sha256-M2xKxaf+iWXTq+vMXsucMmVqs9BarCoyG6prmwcL8KI=";
+    hash = "sha256-w3h65MNXBgsH8PCHfoPqY+XNI6TMbLUAMI4Y3WWLEJM=";
   };
 
-  vendorHash = "sha256-TVnTg+SbTmpdfxWSr3KIPioQ/0OlUxCuCfyn5oMWPu8=";
+  vendorHash = "sha256-PQ2ZrigS9jZY1oL3Dsuc2RZwedZLzLKUqhMYfWiZ854=";
 
   patches = [ ./modify-version-handling.patch ];
 

pkgs/by-name/ol/olivetin/package.nix

···
 
   {
     pname = "olivetin";
-    version = "2025.5.26";
+    version = "2025.6.1";
 
     src = fetchFromGitHub {
       owner = "OliveTin";
       repo = "OliveTin";
       tag = finalAttrs.version;
-      hash = "sha256-BD52MxIHE56y3oWuRTCYmrEYMge70/MXt4B6g84ahF0=";
+      hash = "sha256-Bd+zxVEhP7LZk74Mfai/MkML1pKlPBKm4kh4jAkC/kQ=";
     };
 
     modRoot = "service";
 
-    vendorHash = "sha256-kfk4QFG+l+XKkKoOs2C1B6ZuMeeDz9DrzzR46S8Qnyk=";
+    vendorHash = "sha256-8rPJoB75de2Y56iyIwdI9HPk7OlCgfMPy28TW1i7+sU=";
 
     ldflags = [
       "-s"

pkgs/by-name/ol/ollama/package.nix

···
 goBuild (finalAttrs: {
   pname = "ollama";
   # don't forget to invalidate all hashes each update
-  version = "0.7.1";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "ollama";
     repo = "ollama";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ee2MkvdVDQaSFJDDuXEwedqOB2DUl3MIfp5tRxqbL8A=";
+    hash = "sha256-+8UHE9M2JWUARuuIRdKwNkn1hoxtuitVH7do5V5uEg0=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/op/opengamepadui/package.nix

···
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
-    sourceRoot = "source/${finalAttrs.cargoRoot}";
+    inherit (finalAttrs) src cargoRoot;
     hash = "sha256-T79G2bShJuFRfaCqG3IDHqW0s68yAdGyv58kdDYg6kg=";
   };
   cargoRoot = "extensions";

pkgs/by-name/ph/phrase-cli/package.nix

···
 
 buildGoModule rec {
   pname = "phrase-cli";
-  version = "2.40.0";
+  version = "2.42.0";
 
   src = fetchFromGitHub {
     owner = "phrase";
     repo = "phrase-cli";
     rev = version;
-    sha256 = "sha256-d/B5XzEAM1GlpQxshy0kEJexF01FlF99hnoctKDXhp0=";
+    sha256 = "sha256-dLdgJdR2faxpfHmYhhzn7nQxTrXDhF6XqOIKFLXDEj4=";
   };
 
-  vendorHash = "sha256-VV4ctHj9fPosAgqBOfkqOKETSeGJXFPPP+kBMgqV2nk=";
+  vendorHash = "sha256-zVIxBZ2zTXk407piA4dXxKfyD7Ke8RIq7lYogr/+rcs=";
 
   ldflags = [ "-X=github.com/phrase/phrase-cli/cmd.PHRASE_CLIENT_VERSION=${version}" ];
 

pkgs/by-name/po/podman-desktop/package.nix

···
   passthru.updateScript = _experimental-update-script-combinators.sequence [
     (nix-update-script { })
     (lib.getExe (writeShellApplication {
-      name = "${finalAttrs.pname}-dependencies-updater";
+      name = "podman-desktop-dependencies-updater";
       runtimeInputs = [
         nix
         jq
         gnugrep
       ];
       runtimeEnv = {
-        PNAME = finalAttrs.pname;
+        PNAME = "podman-desktop";
         PKG_FILE = builtins.toString ./package.nix;
       };
       text = ''

pkgs/by-name/pr/prelink/package.nix

···
   autoreconfHook,
   libelf,
   libiberty,
+  unstableGitUpdater,
 }:
 
 stdenv.mkDerivation {
   pname = "prelink";
-  version = "unstable-2019-06-24";
+  version = "20151030-unstable-2024-07-02";
 
   src = fetchgit {
-    url = "https://git.yoctoproject.org/git/prelink-cross";
+    url = "https://git.yoctoproject.org/prelink-cross";
     branchName = "cross_prelink";
-    rev = "f9975537dbfd9ade0fc813bd5cf5fcbe41753a37";
-    sha256 = "sha256-O9/oZooLRyUBBZX3SFcB6LFMmi2vQqkUlqtZnrq5oZc=";
+    rev = "ff2561c02ade96c5d4d56ddd4e27ff064840a176";
+    sha256 = "sha256-wmX7ybrZDWEop9fiInZMvgK/fpEk3sq+Wu8DSWWIvQY=";
   };
 
   strictDeps = true;
···
   doCheck = false;
 
   enableParallelBuilding = true;
+
+  passthru.updateScript = unstableGitUpdater { };
 
   meta = with lib; {
     description = "ELF prelinking utility to speed up dynamic linking";

pkgs/by-name/pr/protoc-gen-es/package.nix

···
 
 buildNpmPackage rec {
   pname = "protoc-gen-es";
-  version = "2.5.0";
+  version = "2.5.1";
 
   src = fetchFromGitHub {
     owner = "bufbuild";
     repo = "protobuf-es";
     tag = "v${version}";
-    hash = "sha256-wllLeX7veCbpb/mTAIs0cf/hcVItEmw2HW/UR4k0Epc=";
+    hash = "sha256-afCfRi9YSQS8BoYrDR66FBW7sbfYvSxVSpxYM8F6CRw=";
 
     postFetch = ''
       ${lib.getExe npm-lockfile-fix} $out/package-lock.json
     '';
   };
 
-  npmDepsHash = "sha256-PGieFyPgb2ERTdQc3HH5mg/uh5xj7nkUa0qwmgxofVY=";
+  npmDepsHash = "sha256-DDFMQqWoixZZ9u8MLOEaKiPAOB3pEGnsF7el8AIOPrc=";
 
   npmWorkspace = "packages/protoc-gen-es";
 

pkgs/by-name/pr/protolint/package.nix

···
 }:
 buildGoModule rec {
   pname = "protolint";
-  version = "0.55.5";
+  version = "0.55.6";
 
   src = fetchFromGitHub {
     owner = "yoheimuta";
     repo = "protolint";
     rev = "v${version}";
-    hash = "sha256-uim4M1C51VVCOhcE/dyCLzx/Bks0h50+haw5mbAfiN8=";
+    hash = "sha256-RTej9zVQz6GESAoAAChidiolGEoHabUYlEZSV2gc8KQ=";
   };
 
-  vendorHash = "sha256-Zt1HbmdUpQmmK+404tfSs6qfZxZEqHIgQBoN63Els3M=";
+  vendorHash = "sha256-RS0t7n6pLYVKHluQtXsMjYL1SvN7IZFdKmkxOI8wFoE=";
 
   # Something about the way we run tests causes issues. It doesn't happen
   # when using "go test" directly:

pkgs/by-name/pr/protols/package.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "protols";
-  version = "0.12.0";
+  version = "0.12.5";
 
   src = fetchFromGitHub {
     owner = "coder3101";
     repo = "protols";
     tag = version;
-    hash = "sha256-v4ROQVoJmrukHFrxykr6EuBFXRuaBnPZ7f36ly7rPhg=";
+    hash = "sha256-zs78TKZU35UGAmEXK3EA9B6zRCqeCtNexHVAJERKyX8=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-fmsPkXwu8qy+SRyP5w940gqNmXg0V/p/vDSI7EIFrh0=";
+  cargoHash = "sha256-Lh6KJ5zclT650tPIpMJBALLj4gnis+fglhewiZ5mpMs=";
 
   meta = {
     description = "Protocol Buffers language server written in Rust";

pkgs/by-name/py/pykickstart/package.nix

···
   meta = {
     description = "Python package to interact with Kickstart files commonly found in the RPM world";
     homepage = "https://github.com/pykickstart/pykickstart";
-    changelog = "https://github.com/pykickstart/pykickstart/releases/tag/r${src.tag}";
+    changelog = "https://github.com/pykickstart/pykickstart/releases/tag/${src.tag}";
     license = lib.licenses.gpl2Only;
     maintainers = with lib.maintainers; [
       thefossguy

pkgs/by-name/qm/qmk/package.nix

···
 
 python3.pkgs.buildPythonApplication rec {
   pname = "qmk";
-  version = "1.1.7";
+  version = "1.1.8";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-4Qhzsa5GAAeSgt7FZsRWIVO1ZB+010WtBv9SV38Xgto=";
+    hash = "sha256-C0Jra/IK61tngGsuEnMD4mySRc/iZVgdYEbMXtwpBZ0=";
   };
 
   nativeBuildInputs = with python3.pkgs; [

pkgs/by-name/re/renode-dts2repl/package.nix

···
 
 python3.pkgs.buildPythonApplication {
   pname = "renode-dts2repl";
-  version = "0-unstable-2025-05-20";
+  version = "0-unstable-2025-05-28";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "antmicro";
     repo = "dts2repl";
-    rev = "be40a3764a727a7a22eebb481b1fd3e0f70fca8c";
-    hash = "sha256-r+7J7AgWpBZuGpPU7EBn0KxM5ksHC6aED4oLe4oZzfQ=";
+    rev = "8413c5a08ed53867493b2a08fd4c730d7b419ee7";
+    hash = "sha256-Dl/JzkUP/mNBxz20C4qH5B3qpXjd4/q/r5n0RO3ga+U=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/sl/slirp4netns/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "slirp4netns";
-  version = "1.3.2";
+  version = "1.3.3";
 
   src = fetchFromGitHub {
     owner = "rootless-containers";
     repo = "slirp4netns";
     rev = "v${version}";
-    sha256 = "sha256-1OiomraQ4wfrBPihGrf9sq8hPJUB45gvf7Y5j7iN8/E=";
+    sha256 = "sha256-dPhUr9GdujTpUsnfvZDp8eOBQwlzqwtwziII2QWD4JA=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/sn/snipaste/package.nix

···
 }:
 let
   pname = "snipaste";
-  version = "2.10.6";
+  version = "2.10.7";
   src = fetchurl {
     url = "https://download.snipaste.com/archives/Snipaste-${version}-x86_64.AppImage";
-    hash = "sha256-lkP3YN4ZNbtM2beQEIWPxBE6JXToRBW48QAMLw/TBzQ=";
+    hash = "sha256-WzCSI0BfjolbWbj/mLhRj75tW/CvlbzQtFuBizg8xl4=";
   };
   contents = appimageTools.extract { inherit pname version src; };
 in

pkgs/by-name/sn/snort/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "snort";
-  version = "3.7.4.0";
+  version = "3.8.1.0";
 
   src = fetchFromGitHub {
     owner = "snort3";
     repo = "snort3";
     tag = finalAttrs.version;
-    hash = "sha256-c5GVFzZOeaI2te49m9crt9I0E/awHjcDR621tvDVgSQ=";
+    hash = "sha256-+59e6rLMvLQ+LNxwRRG6nLXqjMsbn3bdykfMpwPgSpA=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/sr/srb2/cmake.patch

···
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 80a3bdcd6..380a1573a 100644
+index a4c631102..13b5743ca 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -61,7 +61,7 @@ option(
- 	"Link dependencies using CMake's find_package and do not use internal builds"
- 	${SRB2_CONFIG_SYSTEM_LIBRARIES_DEFAULT}
- )
--option(SRB2_CONFIG_ENABLE_TESTS "Build the test suite" ON)
-+option(SRB2_CONFIG_ENABLE_TESTS "Build the test suite" OFF)
- # This option isn't recommended for distribution builds and probably won't work (yet).
- cmake_dependent_option(
- 	SRB2_CONFIG_SHARED_INTERNAL_LIBRARIES
-@@ -80,25 +80,6 @@ option(SRB2_CONFIG_ZDEBUG "Compile with ZDEBUG defined." OFF)
- option(SRB2_CONFIG_PROFILEMODE "Compile for profiling (GCC only)." OFF)
- set(SRB2_CONFIG_ASSET_DIRECTORY "" CACHE PATH "Path to directory that contains all asset files for the installer. If set, assets will be part of installation and cpack.")
- 
--if(SRB2_CONFIG_ENABLE_TESTS)
--	# https://github.com/catchorg/Catch2
--	CPMAddPackage(
--		NAME Catch2
--		VERSION 3.4.0
--		GITHUB_REPOSITORY catchorg/Catch2
--		OPTIONS
--			"CATCH_INSTALL_DOCS OFF"
--	)
--	list(APPEND CMAKE_MODULE_PATH "${Catch2_SOURCE_DIR}/extras")
--	include(CTest)
--	include(Catch)
--	add_executable(srb2tests)
--	# To add tests, use target_sources to add individual test files to the target in subdirs.
--	target_link_libraries(srb2tests PRIVATE Catch2::Catch2 Catch2::Catch2WithMain)
--	target_compile_features(srb2tests PRIVATE c_std_11 cxx_std_17)
--	catch_discover_tests(srb2tests)
--endif()
--
- # Enable CCache
- # (Set USE_CCACHE=ON to use, CCACHE_OPTIONS for options)
- if("${CMAKE_HOST_SYSTEM_NAME}" STREQUAL Windows)
-@@ -113,12 +94,6 @@ if("${CMAKE_HOST_SYSTEM_NAME}" STREQUAL Windows)
- 			message(WARNING "USE_CCACHE was set but ccache is not found (set CCACHE_TOOL_PATH)")
- 		endif()
- 	endif()
--else()
--	CPMAddPackage(
--		NAME Ccache.cmake
--		GITHUB_REPOSITORY TheLartians/Ccache.cmake
--		VERSION 1.2
--	)
- endif()
- 
- # Dependencies
-@@ -179,7 +154,7 @@ include(GitUtilities)
+@@ -141,7 +141,7 @@ include(GitUtilities)
  if("${SRB2_SDL2_EXE_NAME}" STREQUAL "")
  	# cause a reconfigure if the branch changes
  	get_git_dir(SRB2_GIT_DIR)

pkgs/by-name/sr/srb2/package.nix

···
   curl,
   nasm,
   libopenmpt,
+  miniupnpc,
   game-music-emu,
-  libGLU,
   libpng,
   SDL2,
   SDL2_mixer,
···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "srb2";
-  version = "2.2.13";
+  version = "2.2.15";
 
   src = fetchFromGitHub {
     owner = "STJr";
     repo = "SRB2";
     rev = "SRB2_release_${finalAttrs.version}";
-    hash = "sha256-OSkkjCz7ZW5+0vh6l7+TpnHLzXmd/5QvTidRQSHJYX8=";
+    hash = "sha256-eJ0GYe3Rw6qQXj+jtyt8MkP87DaCiO9ffChg+SpQqaI=";
   };
 
   nativeBuildInputs = [
···
     game-music-emu
     libpng
     libopenmpt
+    miniupnpc
     SDL2
     SDL2_mixer
     zlib
···
     src = fetchgit {
       url = "https://git.do.srb2.org/STJr/srb2assets-public";
       rev = "SRB2_release_${finalAttrs.version}";
-      hash = "sha256-OXvO5ZlujIYmYevc62Dtx192dxoujQMNFUCrH5quBBg=";
+      hash = "sha256-1kwhWHzL2TbSx1rhFExbMhXqn0HMBRhR6LZiuoRx+iI=";
       fetchLFS = true;
     };
 
···
   ];
 
   patches = [
-    # Make the build work without internet connectivity
-    # See: https://build.opensuse.org/request/show/1109889
     ./cmake.patch
-    ./thirdparty.patch
   ];
-
-  postPatch = ''
-    substituteInPlace ./src/sdl/ogl_sdl.c \
-      --replace libGLU.so.1 ${libGLU}/lib/libGLU.so.1
-  '';
 
   desktopItems = [
     (makeDesktopItem rec {

pkgs/by-name/sr/srb2/thirdparty.patch

···
-diff --git a/thirdparty/CMakeLists.txt b/thirdparty/CMakeLists.txt
-index f33b3bf3f..1214f179c 100644
---- a/thirdparty/CMakeLists.txt
-+++ b/thirdparty/CMakeLists.txt
-@@ -16,6 +16,5 @@ if(NOT "${SRB2_CONFIG_SYSTEM_LIBRARIES}")
- 	include("cpm-png.cmake")
- 	include("cpm-curl.cmake")
- 	include("cpm-openmpt.cmake")
-+	include("cpm-libgme.cmake")
- endif()
--
--include("cpm-libgme.cmake")

pkgs/by-name/su/surrealist/package.nix

···
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
-    sourceRoot = "${finalAttrs.src.name}/${finalAttrs.cargoRoot}";
+    inherit (finalAttrs) src cargoRoot;
     hash = "sha256-Su9ZOPIskV5poeS8pgtri+sZANBpdgnuCsQqE4WKFdA=";
   };
 

pkgs/by-name/sy/synapse-admin-etkecc/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "synapse-admin-etkecc";
-  version = "0.11.0-etke42";
+  version = "0.11.1-etke43";
 
   src = fetchFromGitHub {
     owner = "etkecc";
     repo = "synapse-admin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HWhyG/dVP9M84OOYH95RPLqiXDYOs+QOxwLM8pPl1vA=";
+    hash = "sha256-mubONaT4qnbPlnYY15UtHGEp45k5mIxWt1shHRdwwTA=";
   };
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-GO5m+7fcm/XO38XlsQq6fwKslzdZkE6WleP3GHNKuPU=";
+    hash = "sha256-WFE2mtyK3xBOVIgJ0ODsv1C0pjpGdBM3+TtIiZUpj58=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/te/terramate/package.nix

···
 
 buildGoModule rec {
   pname = "terramate";
-  version = "0.13.1";
+  version = "0.13.2";
 
   src = fetchFromGitHub {
     owner = "terramate-io";
     repo = "terramate";
     rev = "v${version}";
-    hash = "sha256-lIYtNvluKRufV0bXi2z2/8F7221Sum20usA0j0pHU7I=";
+    hash = "sha256-NN7M4ZJ67YwguDzSHkluW1wbwVbn+7otMQm+ot2el5I=";
   };
 
-  vendorHash = "sha256-84xlUXCJhsZjNxdWQ/Tr/WA4/+gP8NlqQQHnA8R8nz8=";
+  vendorHash = "sha256-Ldl4TGmfMLk9DJgoVUYCpjX5TyAwZyCSrOKdb6uo4eM=";
 
   # required for version info
   nativeBuildInputs = [ git ];

pkgs/by-name/ti/tigerbeetle/package.nix

···
   platform =
     if stdenvNoCC.hostPlatform.isDarwin then "universal-macos" else stdenvNoCC.hostPlatform.system;
   hash = builtins.getAttr platform {
-    "universal-macos" = "sha256-RSP9nJ2dmLGci4v2iPRzE//QzAY1m7ZdzCkN43k3w8A=";
-    "x86_64-linux" = "sha256-Xy3kGShqaTbuf9BLx4fUahZrrby2r04+nmuHwDxENMo=";
-    "aarch64-linux" = "sha256-98BAH7yb6I1kG7j/zJyoFEwS1jBjF3oEM/YKk32bbZY=";
+    "universal-macos" = "sha256-1U24bdd4tvkzZmsRrrc4AUwxm9IhxHNAcPtxxX5ZO2w=";
+    "x86_64-linux" = "sha256-DCEqAePHkNj0bfgW5l83DyZG5+bre6C6C7AMbhxwytQ=";
+    "aarch64-linux" = "sha256-jKpt7hqCbgcBv9npR7IhryaCgrdOlX40Icq9T10/Af0=";
   };
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "tigerbeetle";
-  version = "0.16.41";
+  version = "0.16.42";
 
   src = fetchzip {
     url = "https://github.com/tigerbeetle/tigerbeetle/releases/download/${finalAttrs.version}/tigerbeetle-${platform}.zip";

pkgs/by-name/tr/treesheets/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "treesheets";
-  version = "0-unstable-2025-05-19";
+  version = "0-unstable-2025-06-02";
 
   src = fetchFromGitHub {
     owner = "aardappel";
     repo = "treesheets";
-    rev = "a64445212a224b48c3daf054433a7ff68906670a";
-    hash = "sha256-o2En1E6MaYZcQLRPl4uU3isM2Q3aiu7mQ88ZJq1vrmo=";
+    rev = "1e6604b6257b41ba518907bfa21c24fa8245c46f";
+    hash = "sha256-zSZ7tMjG5/kSzHifMSA7Wsypv0/x+Oir6jx0I5Fyk2c=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ty/ty/package.nix

···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ty";
-  version = "0.0.1-alpha.7";
+  version = "0.0.1-alpha.8";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "ty";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-aonCRtXi9MZWhZO3SjMxAxsTm8iZZdrm36psGArFz/I=";
+    hash = "sha256-w/UEENP9tqwqFX/oCvI67DDMSmXzlCazAIP2wfmdDSs=";
   };
 
   # For Darwin platforms, remove the integration test for file notifications,
···
 
   cargoBuildFlags = [ "--package=ty" ];
 
-  cargoHash = "sha256-pYv99huRgqcFcnkMkfFoejmZmVkb9q/VVlYfylPXo4o=";
+  cargoHash = "sha256-XISRy7Ncy0lTlsCFYmJBcgGiDJfdygTDF4f9O9ZlzDU=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/wa/waagent/package.nix

···
 in
 python.pkgs.buildPythonApplication rec {
   pname = "waagent";
-  version = "2.13.1.1";
+  version = "2.14.0.0";
   src = fetchFromGitHub {
     owner = "Azure";
     repo = "WALinuxAgent";
-    tag = "v${version}";
-    hash = "sha256-W2NXxQOxRhJD/D/w58xknA9X8YYnQxwIhhjXzlCVVWA=";
+    tag = "pre-v${version}";
+    hash = "sha256-nJZXyqdsSQgW+nGqyTS9XSW4z5mGRHtCYsDHKDw/eiM=";
   };
   patches = [
     # Suppress the following error when waagent tries to configure sshd:

pkgs/by-name/we/wealthfolio/package.nix

···
   buildAndTestSubdir = finalAttrs.cargoRoot;
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) pname version src;
-    sourceRoot = "${finalAttrs.src.name}/${finalAttrs.cargoRoot}";
+    inherit (finalAttrs)
+      pname
+      version
+      src
+      cargoRoot
+      ;
     hash = "sha256-MmdvEutdkX98DgX1aVuxs4gabuMX5aM8yC4eqgvd8Q4=";
   };
 

pkgs/by-name/we/web-ext/package.nix

···
 
 buildNpmPackage rec {
   pname = "web-ext";
-  version = "8.7.0";
+  version = "8.7.1";
 
   src = fetchFromGitHub {
     owner = "mozilla";
     repo = "web-ext";
     rev = version;
-    hash = "sha256-k/S9YBU7D7FoXLK9aufBQfD4ZjCdlhGeDBnvfOk5H6Y=";
+    hash = "sha256-B0wlGOg4ZfFRBVrHdERHMv3BPKfLX28YYtdyDphQTcE=";
   };
 
-  npmDepsHash = "sha256-sykNWATICiPz3naZyzl6+b0g0v0D1AsfGYT5bahTlBI=";
+  npmDepsHash = "sha256-J7uDivhLjdMVQyuejcrCL7m7EsAs/DeeKD7r1Cv81qQ=";
 
   npmBuildFlags = [ "--production" ];
 

pkgs/by-name/wi/windowmaker/package.nix

···
     license = lib.licenses.gpl2Plus;
     mainProgram = "wmaker";
     maintainers = [ ];
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.unix;
   };
 })

pkgs/by-name/ya/yandex-music/package.nix

···
 assert lib.assertMsg (vibeAnimationMaxFps >= 0) "Vibe animation max FPS must be greater then 0";
 stdenvNoCC.mkDerivation rec {
   pname = "yandex-music";
-  version = "5.51.1";
+  version = "5.52.0";
 
   src = fetchFromGitHub {
     owner = "cucumber-sp";
     repo = "yandex-music-linux";
     rev = "v${version}";
-    hash = "sha256-jk/u0a6rnLDANHebtJ9yTAeFSIPg/CEIqm0oZnGdD0k=";
+    hash = "sha256-39aVY2D8fM243Uhr4i3d9OdBKRqb4MNnkSjKOH3tF4s=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ya/yandex-music/ym_info.json

···
 {
-  "version": "5.51.1",
-  "exe_name": "Yandex_Music_x64_5.51.1.exe",
-  "exe_link": "https://music-desktop-application.s3.yandex.net/stable/Yandex_Music_x64_5.51.1.exe",
-  "exe_hash": "sha256-iu7DqcFs9/4aw46eIgWKIYyZ6fIzoW6XkiqdpERup/M="
+  "version": "5.52.0",
+  "exe_name": "Yandex_Music_x64_5.53.1.exe",
+  "exe_link": "https://music-desktop-application.s3.yandex.net/stable/Yandex_Music_x64_5.53.1.exe",
+  "exe_hash": "sha256-aTl3sF8n0v17TeAyQwjrXUDKK/MaCtoHQ34IHDEeme8="
 }

pkgs/by-name/ya/yazi/plugins/bypass/default.nix

···
 }:
 mkYaziPlugin {
   pname = "bypass.yazi";
-  version = "25.3.2-unstable-2025-05-30";
+  version = "25.3.2-unstable-2025-06-01";
 
   src = fetchFromGitHub {
     owner = "Rolv-Apneseth";
     repo = "bypass.yazi";
-    rev = "381fb89a21a58605c555c109f190309b2d116d30";
-    hash = "sha256-04cyOlG843Ot+jRT8GNFjJOzV4YdPBpI9XqbaK6KXu0=";
+    rev = "c1e5fcf6eeed0bfceb57b9738da6db9d0fb8af56";
+    hash = "sha256-ZndDtTMkEwuIMXG4SGe4B95Nw4fChfFhxJHj+IY30Kc=";
   };
 
   meta = {

pkgs/by-name/ya/yazi/plugins/ouch/default.nix

···
 }:
 mkYaziPlugin {
   pname = "ouch.yazi";
-  version = "0-unstable-2025-04-12";
+  version = "0-unstable-2025-06-01";
 
   src = fetchFromGitHub {
     owner = "ndtoan96";
     repo = "ouch.yazi";
-    rev = "2496cd9ac2d1fb52597b22ae84f3af06c826a86d";
-    hash = "sha256-OsNfR7rtnq+ceBTiFjbz+NFMSV/6cQ1THxEFzI4oPJk=";
+    rev = "10b462765f37502065555e83c68a72bb26870fe2";
+    hash = "sha256-mtXl76a54Deg4cyrD0wr++sD/5b/kCsnJ+ngM6OokTc=";
   };
 
   meta = {

pkgs/development/interpreters/ruby/default.nix

···
           cargoDeps =
             if yjitSupport then
               rustPlatform.fetchCargoVendor {
-                inherit (finalAttrs) src;
-                sourceRoot = "${finalAttrs.pname}-${version}/${finalAttrs.cargoRoot}";
+                inherit (finalAttrs) src cargoRoot;
                 hash =
                   assert cargoHash != null;
                   cargoHash;

pkgs/development/python-modules/aioairq/default.nix

···
 
 buildPythonPackage rec {
   pname = "aioairq";
-  version = "0.4.4";
+  version = "0.4.6";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
···
     owner = "CorantGmbH";
     repo = "aioairq";
     tag = "v${version}";
-    hash = "sha256-RwkqhPAKbNZ/RrVxJchtqGDpbmS9eusv1X/B3NseAFk=";
+    hash = "sha256-XlOVCDWbcdh8VjNxlEcVNttRN3mw19AXlIIQJ1II144=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/aiohomekit/default.nix

···
 
 buildPythonPackage rec {
   pname = "aiohomekit";
-  version = "3.2.14";
+  version = "3.2.15";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
···
     owner = "Jc2k";
     repo = "aiohomekit";
     tag = version;
-    hash = "sha256-TP5YW4pIWO0xHV1EY5hDa80MrBOvkZLyQTNP7m0x+AU=";
+    hash = "sha256-UAFiYTAz5TZVviwoCFzeSGi9acVytQU9hgVVVVecOBU=";
   };
 
   build-system = [ poetry-core ];

pkgs/development/python-modules/bcrypt/default.nix

···
 
   cargoRoot = "src/_bcrypt";
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit pname version src;
-    sourceRoot = "${pname}-${version}/${cargoRoot}";
+    inherit
+      pname
+      version
+      src
+      cargoRoot
+      ;
     hash = "sha256-HgHvfMBspPsSYhllnKBg5XZB6zxFIqJj+4//xKG8HwA=";
   };
 

pkgs/development/python-modules/biliass/default.nix

···
       pname
       version
       src
+      sourceRoot
+      cargoRoot
       ;
-    sourceRoot = "${sourceRoot}/${cargoRoot}";
     hash = "sha256-tkHl6z0En+od//fCGJXK/p8Dz5KDOXltHrXhxHmHL6U=";
   };
 

pkgs/development/python-modules/caldav/default.nix

···
 
 buildPythonPackage rec {
   pname = "caldav";
-  version = "1.5.0";
+  version = "1.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "python-caldav";
     repo = "caldav";
     tag = "v${version}";
-    hash = "sha256-SYjfQG4muuBcnVeu9cl00Zb2fGUhw157LLxA5/N5EJ0=";
+    hash = "sha256-SWecaXiXp8DSOLVWzgPsbL7UGCtTBfNXYmuDQGdyqbQ=";
   };
 
   build-system = [

pkgs/development/python-modules/command-runner/default.nix

···
 
 buildPythonPackage rec {
   pname = "command-runner";
-  version = "1.7.3";
+  version = "1.7.4";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
···
     owner = "netinvent";
     repo = "command_runner";
     tag = "v${version}";
-    hash = "sha256-BNjMMs44eDnGmcFXiMydJIU0RpsFOyd2TjH7BOGQP2E=";
+    hash = "sha256-i5VWoXHCdZtf4tJGgYvBqcMaBSSruCOkIl5ntZoSHio=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/curl-cffi/default.nix

···
 
 buildPythonPackage rec {
   pname = "curl-cffi";
-  version = "0.7.4";
+  version = "0.10.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lexiforest";
     repo = "curl_cffi";
     tag = "v${version}";
-    hash = "sha256-Q1VppzQ1Go+ia1D1BemTf40o9wV0miWyoGy/tY+95qE==";
+    hash = "sha256-h7PPlxjIVT6T9x7gKBSifuWl8wzUNDwRcaUifUS0icM=";
   };
 
   patches = [ ./use-system-libs.patch ];

pkgs/development/python-modules/duckduckgo-search/default.nix

···
 
 buildPythonPackage rec {
   pname = "duckduckgo-search";
-  version = "8.0.0";
+  version = "8.0.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
···
     owner = "deedy5";
     repo = "duckduckgo_search";
     tag = "v${version}";
-    hash = "sha256-FoGBVHxEXM9Mt0wpy7GctrlqUfhZb8DlK3UhlHld7E0=";
+    hash = "sha256-Hbhrm++F6aVvJ//WAgyLNsJe+KS0cjnQ83I1ba72Ows=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/fontparts/default.nix

···
 
 buildPythonPackage rec {
   pname = "fontparts";
-  version = "0.12.5";
+  version = "0.12.7";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-cD7ppaYLnKOLyBMlSlF+ham74yid8MBunxgVkyE3I0I=";
+    hash = "sha256-zg8QkiHh4UhhXdTRhDKulB+Q2E6GZyD0fnPIm6fWZGc=";
     extension = "zip";
   };
 

pkgs/development/python-modules/garth/default.nix

···
 
 buildPythonPackage rec {
   pname = "garth";
-  version = "0.5.10";
+  version = "0.5.12";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-IGBJNEGD+XgQQJG3sBh6t0CMZH9eRhJIfHE0+4Jx0H0=";
+    hash = "sha256-bzEPHhIg6F/WQOUoXuaVlZGxn9PU8VdevA/DQuQ7fBw=";
   };
 
   pythonRelaxDeps = [ "requests-oauthlib" ];

pkgs/development/python-modules/gflanguages/default.nix

···
 
 buildPythonPackage rec {
   pname = "gflanguages";
-  version = "0.7.4";
+  version = "0.7.5";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-d/Q5Kh/ApXP0AcNOuATy8GyssLcNUjboQPEj1Q48tuA=";
+    hash = "sha256-jc48DKUp3ai6AxcveyvR7TF80wmVLWfG58W2xR/HIsE=";
   };
 
   # Relax the dependency on protobuf 3. Other packages in the Google Fonts

pkgs/development/python-modules/ghome-foyer-api/default.nix

···
 
 buildPythonPackage rec {
   pname = "ghome-foyer-api";
-  version = "1.1.1";
+  version = "1.2.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "KapJI";
     repo = "ghome-foyer-api";
     tag = "v${version}";
-    hash = "sha256-sup+j9GFGTR+HimpkpvvAqtgYWtJt2qCPZzLvMG8hzI=";
+    hash = "sha256-Y8TfQ0cvmKyLw0UOoLbkXk2vSj+Qb11fCVfNrC1iYao=";
   };
 
   buildInputs = [
···
   meta = {
     description = "Generated Python protobuf stubs for Google Home internal API";
     homepage = "https://github.com/KapJI/ghome-foyer-api";
-    changelog = "https://github.com/KapJI/ghome-foyer-api/releases/tag/v${version}";
+    changelog = "https://github.com/KapJI/ghome-foyer-api/releases/tag/${src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       hensoko

pkgs/development/python-modules/gphoto2/default.nix

···
 {
   lib,
-  fetchPypi,
+  fetchFromGitHub,
   buildPythonPackage,
   pkg-config,
   libgphoto2,
+  pytestCheckHook,
   setuptools,
   toml,
 }:
 
 buildPythonPackage rec {
   pname = "gphoto2";
-  version = "2.5.1";
+  version = "2.6.0";
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-Jgh7ff+iUaeNQtBsXw2Jm+2gj1ctvrY3oahGrbxx3uE=";
+  src = fetchFromGitHub {
+    owner = "jim-easterbrook";
+    repo = "python-gphoto2";
+    tag = "v${version}";
+    hash = "sha256-S/uMP2kRXJDetpXT4+MmCvb35xSxEbzhtKJ0PbHIOIU=";
   };
 
+  build-system = [
+    setuptools
+    toml
+  ];
+
   nativeBuildInputs = [
     pkg-config
-    setuptools
-    toml
   ];
 
   buildInputs = [ libgphoto2 ];
 
-  doCheck = false; # No tests available
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
   pythonImportsCheck = [ "gphoto2" ];
 
-  meta = with lib; {
+  meta = {
+    changelog = "https://github.com/jim-easterbrook/python-gphoto2/blob/${src.tag}/CHANGELOG.txt";
     description = "Python interface to libgphoto2";
     homepage = "https://github.com/jim-easterbrook/python-gphoto2";
-    license = licenses.gpl3;
+    license = lib.licenses.lgpl3Plus;
     maintainers = [ ];
   };
 }

pkgs/development/python-modules/ha-mqtt-discoverable/default.nix

···
 
 buildPythonPackage rec {
   pname = "ha-mqtt-discoverable";
-  version = "0.19.1";
+  version = "0.19.2";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
···
     owner = "unixorn";
     repo = "ha-mqtt-discoverable";
     tag = "v${version}";
-    hash = "sha256-zQ3ABrKhuWBZhRPM5tH8VmYErM+mP26rNweFOpoSeEg=";
+    hash = "sha256-LRXgB85jo0Frmdsq5cHQKQ60bYzuVPXsjPeGLj5uyNU=";
   };
 
   pythonRelaxDeps = [

pkgs/development/python-modules/hyperion-py/default.nix

···
   aiohttp,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch,
-  pytestCheckHook,
-  pythonOlder,
   poetry-core,
   pytest-aiohttp,
   pytest-asyncio,
+  pytest-cov-stub,
+  pytest-timeout,
+  pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "hyperion-py";
-  version = "0.7.5";
-  disabled = pythonOlder "3.8";
-  format = "pyproject";
+  version = "0.7.6";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "dermotduffy";
     repo = "hyperion-py";
-    rev = "v${version}";
-    hash = "sha256-arcnpCQsRuiWCrAz/t4TCjTe8DRDtRuzYp8k7nnjGDk=";
+    tag = "v${version}";
+    hash = "sha256-14taFSrtmgTBiie0eY2fSRkZndJSZ4GJNRx3MonrTzs=";
   };
 
-  patches = [
-    (fetchpatch {
-      # python3.10 compat: Drop loop kwarg in asyncio.sleep call
-      url = "https://github.com/dermotduffy/hyperion-py/commit/f02af52fcce17888984c99bfc03935e372011394.patch";
-      hash = "sha256-4nfsQVxd77VV9INwNxTyFRDlAjwdTYqfSGuF487hFCs=";
-    })
-  ];
-
-  nativeBuildInputs = [ poetry-core ];
+  build-system = [ poetry-core ];
 
-  propagatedBuildInputs = [ aiohttp ];
+  dependencies = [ aiohttp ];
 
   nativeCheckInputs = [
     pytest-asyncio
     pytest-aiohttp
+    pytest-cov-stub
+    pytest-timeout
     pytestCheckHook
   ];
 
-  pytestFlagsArray = [
-    # pytest-asyncio 0.17.0 compat
-    "--asyncio-mode=auto"
-  ];
-
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace " --timeout=9 --cov=hyperion" ""
-  '';
-
   pythonImportsCheck = [ "hyperion" ];
 
   meta = with lib; {
     description = "Python package for Hyperion Ambient Lighting";
     homepage = "https://github.com/dermotduffy/hyperion-py";
+    changelog = "https://github.com/dermotduffy/hyperion-py/releases/tag/${src.tag}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };

pkgs/development/python-modules/ical/default.nix

···
 
 buildPythonPackage rec {
   pname = "ical";
-  version = "9.2.5";
+  version = "10.0.0";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
···
     owner = "allenporter";
     repo = "ical";
     tag = version;
-    hash = "sha256-db7xwNN7xAoeqPngZNJxQNM2wLVcr7VpuG2IWswLCEE=";
+    hash = "sha256-vEVhZ7UBftXsB5xq1LhwitV2Gl6kcR5P0ReJ+71SQFY=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/langfuse/default.nix

···
 
 buildPythonPackage rec {
   pname = "langfuse";
-  version = "2.60.5";
+  version = "2.60.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langfuse";
     repo = "langfuse-python";
     tag = "v${version}";
-    hash = "sha256-DpfbebbONJ8+7mVouvULRbGs9t1cGjOZHhk3KvaY+gM=";
+    hash = "sha256-8IlqHO46Kzz+ifmIu2y5SxshNv/lpZO74b1KTE2Opk4=";
   };
 
   build-system = [ poetry-core ];

pkgs/development/python-modules/libcst/default.nix

···
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit pname version src;
-    sourceRoot = "${src.name}/${cargoRoot}";
+    inherit
+      pname
+      version
+      src
+      cargoRoot
+      ;
     hash = "sha256-K8hug7JeLPIvrqgVaONKfixu8XRvn+pnqS0fHV+nTqg=";
   };
 

pkgs/development/python-modules/mautrix/default.nix

···
 
 buildPythonPackage rec {
   pname = "mautrix";
-  version = "0.20.7";
+  version = "0.20.8";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
···
     owner = "mautrix";
     repo = "python";
     tag = "v${version}";
-    hash = "sha256-tOX/KQrECeEV3/0q3tpO4brUdalmw6IincF6pHzsEE8=";
+    hash = "sha256-giK8JZ6nzsA8SV6CzDNEbJmbwDju9t6fLJr/oXNjvKs=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/numpy-groupies/default.nix

···
 
 buildPythonPackage rec {
   pname = "numpy-groupies";
-  version = "0.11.2";
+  version = "0.11.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ml31415";
     repo = "numpy-groupies";
     tag = "v${version}";
-    hash = "sha256-Eu+5SR28jIasKe1p7rvbq2yo3PGZRQWWdG3A5vGhnyM=";
+    hash = "sha256-pg9hOtIgS8pB/Y9Xqto9Omsdg8TxaA5ZGE1Qh1DCceU=";
   };
 
   build-system = [
···
 
   meta = {
     homepage = "https://github.com/ml31415/numpy-groupies";
-    changelog = "https://github.com/ml31415/numpy-groupies/releases/tag/v${version}";
+    changelog = "https://github.com/ml31415/numpy-groupies/releases/tag/${src.tag}";
     description = "Optimised tools for group-indexing operations: aggregated sum and more";
     license = lib.licenses.bsd2;
     maintainers = with lib.maintainers; [ berquist ];

pkgs/development/python-modules/primp/default.nix

···
     modRoot = "./src";
     patches = [
       # A patch required to build boringssl compatible with `boring-sys2`.
-      # See https://github.com/0x676e67/boring2/blob/1a0f1cd24e728aac100df68027c820f858199224/boring-sys/build/main.rs#L486-L489
+      # See https://github.com/0x676e67/boring2/blob/refs/tags/v4.15.11/boring-sys/build/main.rs#L486-L489
       (fetchpatch {
         name = "boringssl-44b3df6f03d85c901767250329c571db405122d5.patch";
-        url = "https://raw.githubusercontent.com/0x676e67/boring2/4edbff8cade24d5d83cc372c4502b59c5192b5a1/boring-sys/patches/boringssl-44b3df6f03d85c901767250329c571db405122d5.patch";
-        hash = "sha256-lM+2lLvfDHnxLl+OgZ6R8Y4Z6JfA9AiDqboT1mbxmao=";
+        url = "https://raw.githubusercontent.com/0x676e67/boring2/refs/tags/v4.15.11/boring-sys/patches/boringssl-44b3df6f03d85c901767250329c571db405122d5.patch";
+        hash = "sha256-JRRATcCXo0HBQTzgCAuLpxC3NEGrTw1cEmC0VHOgO2M=";
       })
     ];
 
···
       oa.env.NIX_CFLAGS_COMPILE
       + " "
       + toString (
-        lib.optionals stdenv.cc.isGNU [
+        lib.optionals stdenv.cc.isClang [
+          "-Wno-error=reorder-ctor"
+        ]
+        ++ lib.optionals stdenv.cc.isGNU [
+          "-Wno-error=reorder"
           "-Wno-error=ignored-attributes"
         ]
       );
···
 in
 buildPythonPackage rec {
   pname = "primp";
-  version = "0.14.0";
+  version = "0.15.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "deedy5";
     repo = "primp";
     tag = "v${version}";
-    hash = "sha256-LrSygeioJlccOH1oyagw02ankkZK+H6Mzrgy8tB83mo=";
+    hash = "sha256-13o0Ni0dvZaoKgYy2cFQhebwKAJGm5Z2s+gVAddxYxU=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-iPf25DMGNHrWYByNTylB6bPpLfzs0ADwgkjfhVxiiXA=";
+    hash = "sha256-UBpf9f3wJgbizHERsm83cuKHiMixj/8JX/IGvteySIo=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/py-sucks/default.nix

···
 
 buildPythonPackage rec {
   pname = "py-sucks";
-  version = "0.9.10";
+  version = "0.9.11";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mib1185";
     repo = "py-sucks";
     tag = "v${version}";
-    hash = "sha256-MjlE5HdxChAgV/O7cD3foqkmKie7FgRRxvOcW+NAtfA=";
+    hash = "sha256-srj/3x04R9KgbdC6IgbQdgUz+srAx0OttB6Ndb2+Nh4=";
   };
 
   build-system = [ setuptools ];
 
   dependencies = [
-    click
-    pycountry-convert
     pycryptodome
     requests
     sleekxmppfs
   ];
 
+  optional-dependencies = {
+    cli = [
+      click
+      pycountry-convert
+    ];
+  };
+
   pythonImportsCheck = [ "sucks" ];
 
   nativeCheckInputs = [
     requests-mock
     pytestCheckHook
-  ];
+  ] ++ lib.flatten (lib.attrValues optional-dependencies);
 
   disabledTests = [
     # assumes $HOME is at a specific place
···
   ];
 
   meta = {
-    changelog = "https://github.com/mib1185/py-sucks/releases/tag/v${version}";
+    changelog = "https://github.com/mib1185/py-sucks/releases/tag/${src.tag}";
     description = "Library for controlling certain robot vacuums";
     homepage = "https://github.com/mib1185/py-sucks";
     license = lib.licenses.gpl3Only;

pkgs/development/python-modules/pynitrokey/default.nix

···
 
 let
   pname = "pynitrokey";
-  version = "0.8.4";
+  version = "0.8.5";
   mainProgram = "nitropy";
 in
 
···
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Sr3ecKyIjsemM2G72BQR0S5YzfXA0nK9i29yKNie9Ys=";
+    hash = "sha256-mPhH4IdpKKA9d8sJOGMWpGerzki5qZHFHe4u4ao2RgE=";
   };
 
   nativeBuildInputs = [ installShellFiles ];

pkgs/development/python-modules/python-debian/default.nix

···
 
 buildPythonPackage rec {
   pname = "python-debian";
-  version = "0.1.52";
+  version = "1.0.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
···
     owner = "python-debian-team";
     repo = "python-debian";
     tag = version;
-    hash = "sha256-+c+AiUCnpasOLbY6K4cuKUb6Ojwn0py78fL5W24WRwU=";
+    hash = "sha256-lSKtlBqAa8cJZZHMVb90eYIGem4DwVZLldaYSAJBNek=";
   };
 
   build-system = [

pkgs/development/python-modules/pytubefix/default.nix

···
 
 buildPythonPackage rec {
   pname = "pytubefix";
-  version = "9.0.1";
+  version = "9.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "JuanBindez";
     repo = "pytubefix";
     tag = "v${version}";
-    hash = "sha256-TIrt20FAQumtDisscY9jcJY+Cuh1zA92hU3HVmwr4Bk=";
+    hash = "sha256-OKOP1kDPYXMQkVOITSxYqMYQvtVom8VCaLnCBYEhgR8=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/pyyaml-ft/default.nix

···
 }:
 
 buildPythonPackage rec {
-  pname = "pyyaml";
+  pname = "pyyaml-ft";
   version = "7.0.1";
   pyproject = true;
 

pkgs/development/python-modules/redshift-connector/default.nix

···
 
 buildPythonPackage rec {
   pname = "redshift-connector";
-  version = "2.1.6";
+  version = "2.1.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
···
     owner = "aws";
     repo = "amazon-redshift-python-driver";
     tag = "v${version}";
-    hash = "sha256-+tZMg0AmfmAFOqUQhOl+vHQVF1DApZbVNjGV4BkGRTg=";
+    hash = "sha256-OMi8788F2qjMOVDLuJLVReqNv7c/DpXTy1UpqoKRmnQ=";
   };
 
   # remove addops as they add test directory and coverage parameters to pytest

pkgs/development/python-modules/simsimd/default.nix

···
 
 buildPythonPackage rec {
   pname = "simsimd";
-  version = "6.4.4";
+  version = "6.4.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ashvardanian";
     repo = "simsimd";
     tag = "v${version}";
-    hash = "sha256-lOE8ZQlUZ0Y+3Lpm4H/ps4o0YO9k245lADxrfR3oI1E=";
+    hash = "sha256-FM1ge3opt0hwVSjNQWOAYeG6tDIwVLSbu9mZOJBxvJY=";
   };
 
   build-system = [

pkgs/development/python-modules/sse-starlette/default.nix

···
 
 buildPythonPackage rec {
   pname = "sse-starlette";
-  version = "2.3.5";
+  version = "2.3.6";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
···
     owner = "sysid";
     repo = "sse-starlette";
     tag = "v${version}";
-    hash = "sha256-KTq8NwV4YhyfTLpsaF5jyrD3kyBcJ/xXtOwx4WvDFOo=";
+    hash = "sha256-7FlyV+TsVKGFsecONPm/Z50cCnyuUsr6pimPdc4Cs6c=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/temporalio/default.nix

···
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit pname version src;
-    sourceRoot = "${src.name}/${cargoRoot}";
+    inherit
+      pname
+      version
+      src
+      cargoRoot
+      ;
     hash = "sha256-9hP+zN6jcRmRhPmcZ4Zgp61IeS7gDPfsOvweAxKHnHM=";
   };
 

pkgs/development/python-modules/tencentcloud-sdk-python/default.nix

···
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1390";
+  version = "3.0.1391";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
···
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = version;
-    hash = "sha256-UOJ1NCWKFqcrU2uMX4qTy8ooFEy6TIrb1YTIthHspuM=";
+    hash = "sha256-bzxaCN2fXoZT2W8zpTg7DrBTmRfyUi2aVhrg+/Y1YkU=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/yara-python/default.nix

···
 
 buildPythonPackage rec {
   pname = "yara-python";
-  version = "4.5.2";
+  version = "4.5.4";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
···
     owner = "VirusTotal";
     repo = "yara-python";
     tag = "v${version}";
-    hash = "sha256-RXqazMg78eGxA4JPUqSx0PTcNDmrGjBt5m6OJTmshNU=";
+    hash = "sha256-2ZwLpkT46KNTQ1ymvMGjnrfHQaIy/rXid0kXoCBixXA=";
   };
 
   # undefined symbol: yr_finalize

pkgs/kde/gear/akonadi-search/default.nix

···
   cargoRoot = "agent/rs/htmlparser";
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit pname version;
+    inherit pname version cargoRoot;
     src = sources.${pname};
-    sourceRoot = "${pname}-${version}/${cargoRoot}";
     hash = "sha256-hdm4LfQcs4TTfBLzlZYJ0uzqfLxMXuYQExLGJg81W2U=";
   };
 

pkgs/kde/gear/kdepim-addons/default.nix

···
   cargoRoot = "plugins/webengineurlinterceptor/adblock";
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit pname version;
+    inherit pname version cargoRoot;
     src = sources.${pname};
-    sourceRoot = "${pname}-${version}/${cargoRoot}";
     hash = "sha256-66FqoD3JoPbtg6zc32uaPYaTo4zHxywiN8wPI2jtcjc=";
   };
 

pkgs/servers/home-assistant/custom-components/oref_alert/package.nix

···
   lib,
   buildHomeAssistantComponent,
   fetchFromGitHub,
+  aiofiles,
   shapely,
   pytestCheckHook,
   pytest-homeassistant-custom-component,
···
 buildHomeAssistantComponent rec {
   owner = "amitfin";
   domain = "oref_alert";
-  version = "2.20.1";
+  version = "2.21.1";
 
   src = fetchFromGitHub {
     owner = "amitfin";
     repo = "oref_alert";
     tag = "v${version}";
-    hash = "sha256-EsDGH7/newjHRYu4Lr5UkJ3qaaNupqlhe5CdffEpIVg=";
+    hash = "sha256-ov/smP7rflRfQMqYduTxDAYj5xQkpZJSzIQZrP0YADQ=";
   };
 
   dependencies = [
+    aiofiles
     shapely
   ];
 

pkgs/servers/home-assistant/custom-lovelace-modules/universal-remote-card/package.nix

···
 
 buildNpmPackage rec {
   pname = "universal-remote-card";
-  version = "4.5.2";
+  version = "4.5.3";
 
   src = fetchFromGitHub {
     owner = "Nerwyn";
     repo = "android-tv-card";
     rev = version;
-    hash = "sha256-woplybqlpx+xJdLJ0RWgDp3mR1l8Ntt+JA0SVyFaDQA=";
+    hash = "sha256-AxPpKp7SjeSB8VqclDJgkArC9zmjIkLQx+RBWQX0sLM=";
   };
 
   patches = [ ./dont-call-git.patch ];
 
-  npmDepsHash = "sha256-YN+Ftv5gEwXHqoO7KAyijZMS6g6i3bKbEnvoVLakrTQ=";
+  npmDepsHash = "sha256-KFgo1sKwCLmW0Il4tK2L+giF3th+YvVUWG3n+3HkRg4=";
 
   installPhase = ''
     runHook preInstall

pkgs/servers/http/tomcat/tomcat-native.nix

···
 
 stdenv.mkDerivation rec {
   pname = "tomcat-native";
-  version = "2.0.8";
+  version = "2.0.9";
 
   src = fetchurl {
     url = "mirror://apache/tomcat/tomcat-connectors/native/${version}/source/${pname}-${version}-src.tar.gz";
-    hash = "sha256-x8U4L8taZHpc5v7QuWch6UGY+i9XJc9RJPW2URsF3+8=";
+    hash = "sha256-iu0N70FNf0m2iOgmeXUT6VGC7L17b4tvAl5Se4UGXAI=";
   };
 
   sourceRoot = "${pname}-${version}-src/native";

pkgs/tools/filesystems/ceph/default.nix

···
           };
           cargoRoot = "src/_bcrypt";
           cargoDeps = rustPlatform.fetchCargoVendor {
-            inherit pname version src;
-            sourceRoot = "${pname}-${version}/${cargoRoot}";
+            inherit
+              pname
+              version
+              src
+              cargoRoot
+              ;
             hash = "sha256-8PyCgh/rUO8uynzGdgylAsb5k55dP9fCnf40UOTCR/M=";
           };
         });

pkgs/tools/filesystems/ceph/old-python-packages/cryptography.nix

···
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit pname version src;
-    sourceRoot = "${pname}-${version}/${cargoRoot}";
+    inherit
+      pname
+      version
+      src
+      cargoRoot
+      ;
     hash = "sha256-pZHu3Oo9DWRAtldU0UvrH1FIg0bEvyfizPUhj9IBL58=";
   };
 

pkgs/top-level/aliases.nix

···
   oauth2_proxy = throw "'oauth2_proxy' has been renamed to/replaced by 'oauth2-proxy'"; # Converted to throw 2024-10-17
   ocis-bin = throw "ocis-bin has been renamed to ocis_5-bin'. Future major.minor versions will be made available as separate packages"; # Added 2025-03-30
   odoo15 = throw "odoo15 has been removed from nixpkgs as it is unsupported; migrate to a newer version of odoo"; # Added 2025-05-06
+  offrss = throw "offrss has been removed due to lack of upstream maintenance; consider using another rss reader"; # Added 2025-06-01
   oil = lib.warnOnInstantiate "Oil has been replaced with the faster native C++ version and renamed to 'oils-for-unix'. See also https://github.com/oils-for-unix/oils/wiki/Oils-Deployments" oils-for-unix; # Added 2024-10-22
   onevpl-intel-gpu = lib.warnOnInstantiate "onevpl-intel-gpu has been renamed to vpl-gpu-rt" vpl-gpu-rt; # Added 2024-06-04
   openai-whisper-cpp = whisper-cpp; # Added 2024-12-13

pkgs/top-level/all-packages.nix

···
 
   yaziPlugins = recurseIntoAttrs (callPackage ../by-name/ya/yazi/plugins { });
 
-  animdl = python3Packages.callPackage ../applications/video/animdl { };
-
   dillo = callPackage ../by-name/di/dillo/package.nix {
     fltk = fltk13;
   };