Merge staging-next into staging

.github/workflows/check-format.yml

···
     paths:
       - .github/workflows/check-format.yml
   pull_request_target:
-    types: [opened, synchronize, reopened, edited]
 
 permissions: {}
 

.github/workflows/codeowners-v2.yml

···
     paths:
       - .github/workflows/codeowners-v2.yml
   pull_request_target:
-    types: [opened, ready_for_review, synchronize, reopened, edited]
+    types: [opened, ready_for_review, synchronize, reopened]
 
 permissions: {}
 

.github/workflows/edited.yml

···
+# Some workflows depend on the base branch of the PR, but changing the base branch is not included in the default trigger events, which would be `opened`, `synchronize` or `reopened`.
+# Instead it causes an `edited` event.
+# Since `edited` is also triggered when PR title/body is changed, we use this wrapper workflow, to run the other workflows conditionally only.
+# There are already feature requests for adding a `base_changed` event:
+# - https://github.com/orgs/community/discussions/35058
+# - https://github.com/orgs/community/discussions/64119
+#
+# Instead of adding this to each workflow's pull_request_target event, we trigger this in a separate workflow.
+# This has the advantage, that we can actually skip running those jobs for simple edits like changing the title or description.
+# The actual trigger happens by closing and re-opening the pull request, which triggers the default pull_request_target events.
+# This is much simpler and reliable than other approaches.
+
+name: "Edited base branch"
+
+on:
+  pull_request_target:
+    types: [edited]
+
+permissions: {}
+
+jobs:
+  base:
+    name: Trigger jobs
+    runs-on: ubuntu-24.04
+    if: github.event.changes.base.ref.from && github.event.changes.base.ref.from != github.event.pull_request.base.ref
+    steps:
+      # Use a GitHub App to create the PR so that CI gets triggered
+      # The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
+      # We only need Pull Requests: write here, but the app is also used for backports.
+      - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
+        id: app-token
+        with:
+          app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
+          private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
+          permission-pull-requests: write
+
+      - env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          REPOSITORY: ${{ github.repository }}
+          NUMBER: ${{ github.event.number }}
+        run: |
+          gh api \
+            --method PATCH \
+            /repos/"$REPOSITORY"/pulls/"$NUMBER" \
+            -f "state=closed"
+          gh api \
+            --method PATCH \
+            /repos/"$REPOSITORY"/pulls/"$NUMBER" \
+            -f "state=open"

.github/workflows/labels.yml

···
 
 on:
   pull_request_target:
-    types: [edited, opened, synchronize, reopened]
 
 permissions:
   contents: read

.github/workflows/nixpkgs-vet.yml

···
     paths:
       - .github/workflows/nixpkgs-vet.yml
   pull_request_target:
-    # This workflow depends on the base branch of the PR, but changing the base branch is not included in the default trigger events, which would be `opened`, `synchronize` or `reopened`.
-    # Instead it causes an `edited` event, so we need to add it explicitly here.
-    # While `edited` is also triggered when the PR title/body is changed, this PR action is fairly quick, and PRs don't get edited **that** often, so it shouldn't be a problem.
-    # There is a feature request for adding a `base_changed` event: https://github.com/orgs/community/discussions/35058
-    types: [opened, synchronize, reopened, edited]
 
 permissions: {}
 

.github/workflows/no-channel.yml

···
     paths:
       - .github/workflows/no-channel.yml
   pull_request_target:
-    # Re-run should be triggered when the base branch is updated, instead of silently failing
-    types: [opened, synchronize, reopened, edited]
 
 permissions: {}
 

ci/eval/default.nix

···
   procps,
   nixVersions,
   jq,
-  sta,
   python3,
 }:
 
···
           rm "$chunkOutputDir"/stats/"$seq_end"
         fi
 
-        # Make sure the glob doesn't break when there's no files
-        shopt -s nullglob
         cat "$chunkOutputDir"/result/* > $out/paths
-        cat "$chunkOutputDir"/stats/* > $out/stats.jsonstream
       '';
 
   combine =
···
       {
         nativeBuildInputs = [
           jq
-          sta
         ];
       }
       ''
···
                   end) | from_entries}
             ) | from_entries
           ' > $out/outpaths.json
-
-        # Computes min, mean, error, etc. for a list of values and outputs a JSON from that
-        statistics() {
-          local stat=$1
-          sta --transpose |
-            jq --raw-input --argjson stat "$stat" -n '
-              [
-                inputs |
-                  split("\t") |
-                  { key: .[0], value: (.[1] | fromjson) }
-              ] |
-                from_entries |
-                {
-                  key: ($stat | join(".")),
-                  value: .
-                }'
-        }
-
-        # Gets all available number stats (without .sizes because those are constant and not interesting)
-        readarray -t stats < <(jq -cs '.[0] | del(.sizes) | paths(type == "number")' ${resultsDir}/*/stats.jsonstream)
-
-        # Combines the statistics from all evaluations
-        {
-          echo "{ \"key\": \"minAvailMemory\", \"value\": $(cat ${resultsDir}/*/min-avail-memory | sta --brief --min) }"
-          echo "{ \"key\": \"minFreeSwap\", \"value\": $(cat ${resultsDir}/*/min-free-swap | sta --brief --min) }"
-          cat ${resultsDir}/*/total-time | statistics '["totalTime"]'
-          for stat in "''${stats[@]}"; do
-            cat ${resultsDir}/*/stats.jsonstream |
-              jq --argjson stat "$stat" 'getpath($stat)' |
-              statistics "$stat"
-          done
-        } |
-          jq -s from_entries > $out/stats.json
 
         mkdir -p $out/stats
 

doc/release-notes/rl-2505.section.md

···
 
 - The default GHC version has been updated from 9.6 to 9.8.
   `haskellPackages` also uses Stackage LTS 23 (instead of LTS 22) as a baseline.
+  We aim to remove the old GHC versions 8.10, 9.0 and 9.2 in the next release in accordance with [the new GHC deprecation policy](https://discourse.nixos.org/t/nixpkgs-ghc-deprecation-policy-user-feedback-necessary/64153).
 
 - LLVM has been updated from LLVM 16 (on Darwin) and LLVM 18 (on other platforms) to LLVM 19.
   This introduces some backwards‐incompatible changes; see the [upstream release notes](https://releases.llvm.org/) for details.

doc/release-notes/rl-2511.section.md

···
 ## Highlights {#sec-nixpkgs-release-25.11-highlights}
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- Added `allowVariants` to gate availability of package sets like `pkgsLLVM`, `pkgsMusl`, `pkgsZig`, etc.
+- Added `allowVariants` to gate availability of package sets like `pkgsLLVM`, `pkgsMusl`, `pkgsZig`, etc. This option will be removed in a future release.
 
 ## Backward Incompatibilities {#sec-nixpkgs-release-25.11-incompatibilities}
 

nixos/doc/manual/installation/upgrading.chapter.md

···
 automatically from NixOS's Git repository after certain tests have
 passed and all packages have been built. These channels are:
 
--   *Stable channels*, such as [`nixos-24.11`](https://channels.nixos.org/nixos-24.11).
+-   *Stable channels*, such as [`nixos-25.05`](https://channels.nixos.org/nixos-25.05).
     These only get conservative bug fixes and package upgrades. For
     instance, a channel update may cause the Linux kernel on your system
     to be upgraded from 4.19.34 to 4.19.38 (a minor bug fix), but not
···
     radical changes between channel updates. It's not recommended for
     production systems.
 
--   *Small channels*, such as [`nixos-24.11-small`](https://channels.nixos.org/nixos-24.11-small)
+-   *Small channels*, such as [`nixos-25.05-small`](https://channels.nixos.org/nixos-25.05-small)
     or [`nixos-unstable-small`](https://channels.nixos.org/nixos-unstable-small).
     These are identical to the stable and unstable channels described above,
     except that they contain fewer binary packages. This means they get updated
···
 
 When you first install NixOS, you're automatically subscribed to the
 NixOS channel that corresponds to your installation source. For
-instance, if you installed from a 24.11 ISO, you will be subscribed to
-the `nixos-24.11` channel. To see which NixOS channel you're subscribed
+instance, if you installed from a 25.05 ISO, you will be subscribed to
+the `nixos-25.05` channel. To see which NixOS channel you're subscribed
 to, run the following as root:
 
 ```ShellSession
···
 ```
 
 (Be sure to include the `nixos` parameter at the end.) For instance, to
-use the NixOS 24.11 stable channel:
+use the NixOS 25.05 stable channel:
 
 ```ShellSession
-# nix-channel --add https://channels.nixos.org/nixos-24.11 nixos
+# nix-channel --add https://channels.nixos.org/nixos-25.05 nixos
 ```
 
 If you have a server, you may want to use the "small" channel instead:
 
 ```ShellSession
-# nix-channel --add https://channels.nixos.org/nixos-24.11-small nixos
+# nix-channel --add https://channels.nixos.org/nixos-25.05-small nixos
 ```
 
 And if you want to live on the bleeding edge:
···
 
 ```nix
 {
-  system.autoUpgrade.channel = "https://channels.nixos.org/nixos-24.11";
+  system.autoUpgrade.channel = "https://channels.nixos.org/nixos-25.05";
 }
 ```

nixos/doc/manual/release-notes/rl-2505.section.md

···
   Names are now known at evaluation time and customizable via the new options `image.baseName`, `image.extension`, `image.fileName` and `image.filePath` with the latter returning a path relative to the derivations out path (e.g. `iso/${image.fileName` for iso images).
 
   | `system.build` Option    | Old Filename                                               | New Filename                                                    |
-  |--------------------------+------------------------------------------------------------+-----------------------------------------------------------------|
+  | ------------------------ | ---------------------------------------------------------- | ----------------------------------------------------------------|
   | amazonImage              | nixos-amazon-image-25.05pre-git-x86_64-linux.vhd           | nixos-image-amazon-25.05pre-git-x86_64-linux.vhd                |
   | azureImage               | disk.vhd                                                   | nixos-image-azure-25.05pre-git-x86_64-linux.vhd                 |
   | digitalOceanImage        | nixos.qcow2.gz                                             | nixos-image-digital-ocean-25.05pre-git-x86_64-linux.qcow2.gz    |

pkgs/applications/emulators/wine/sources.nix

···
 
   unstable = fetchurl rec {
     # NOTE: Don't forget to change the hash for staging as well.
-    version = "10.5";
+    version = "10.7";
     url = "https://dl.winehq.org/wine/source/10.x/wine-${version}.tar.xz";
-    hash = "sha256-wDbsHvR2dHdKX5lFgwIuni62j+j8GLOox55oWzvsibw=";
+    hash = "sha256-dRNnoxCZkNcD5ZDi21MBh8Th39Lo5hNzq4S0L+EbGPo=";
 
     patches = [
       # Also look for root certificates at $NIX_SSL_CERT_FILE
···
     # see https://gitlab.winehq.org/wine/wine-staging
     staging = fetchFromGitLab {
       inherit version;
-      hash = "sha256-rXA/55rwQSJR247E4H7cQdTtXRmjomRbls7THV3jfcE=";
+      hash = "sha256-4doo7B3eEoQaml6KX02OhcLGGiLcgNhYq4ry/iB7kLc=";
       domain = "gitlab.winehq.org";
       owner = "wine";
       repo = "wine-staging";

pkgs/applications/misc/pagefind/default.nix

···
   npmHooks,
   python3,
   rustc,
+  versionCheckHook,
   wasm-bindgen-cli_0_2_92,
   wasm-pack,
 }:
···
     hash = "sha256-xFVMWX3q3za1w8v58Eysk6vclPd4qpCuQMjMcwwHoh0=";
   };
 
+  env.GIT_VERSION = version;
+
   postPatch = ''
+    # Set the correct version, e.g. for `pagefind --version`
+    node .backstage/version.cjs
+
     # Tricky way to run npmConfigHook multiple times
     (
       local postPatchHooks=() # written to by npmConfigHook
···
   '';
 
   buildFeatures = [ "extended" ];
+
+  doInstallCheck = true;
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
 
   meta = {
     description = "Generate low-bandwidth search index for your static website";

pkgs/applications/science/misc/golly/default.nix

···
   libX11,
   SDL2,
 }:
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "golly";
   version = "4.3";
 
   src = fetchurl {
     hash = "sha256-UdJHgGPn7FDN4rYTgfPBAoYE5FGC43TP8OFBmYIqCB0=";
-    url = "mirror://sourceforge/project/golly/golly/golly-${version}/golly-${version}-src.tar.gz";
+    url = "mirror://sourceforge/project/golly/golly/golly-${finalAttrs.version}/golly-${finalAttrs.version}-src.tar.gz";
   };
 
   buildInputs = [
···
     wrapGAppsHook3
   ];
 
+  # fails nondeterministically on darwin
+  enableParallelBuilding = false;
+
   setSourceRoot = ''
     sourceRoot=$(echo */gui-wx)
   '';
 
-  postPatch = ''
-    sed -e 's@PYTHON_SHLIB@${python3}/lib/libpython3.so@' -i wxprefs.cpp
-    ! grep _SHLIB *.cpp
-
-    grep /lib/libpython wxprefs.cpp
-  '';
+  postPatch =
+    ''
+      substituteInPlace wxprefs.cpp \
+        --replace-fail 'PYTHON_SHLIB' '${python3}/lib/libpython3.so'
+    ''
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      substituteInPlace makefile-gtk \
+        --replace-fail '-Wl,--as-needed' "" \
+        --replace-fail '-lGL ' "" \
+        --replace-fail '-lGLU' ""
+    '';
 
   makeFlags = [
     "-f"
     "makefile-gtk"
     "ENABLE_SOUND=1"
     "GOLLYDIR=${placeholder "out"}/share/golly"
+    "CC=${stdenv.cc.targetPrefix}cc"
+    "CXX=${stdenv.cc.targetPrefix}c++"
+    "CXXC=${stdenv.cc.targetPrefix}c++"
+    "LD=${stdenv.cc.targetPrefix}c++"
+    "WX_CONFIG=${lib.getExe' (lib.getDev wxGTK) "wx-config"}"
   ];
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p "$out/bin"
     cp ../golly ../bgolly "$out/bin"
 
···
 
     mkdir -p "$out/share/golly"
     cp -r ../{Help,Patterns,Scripts,Rules} "$out/share/golly"
+
+    runHook postInstall
   '';
 
   meta = {
     description = "Cellular automata simulation program";
-    license = lib.licenses.gpl2;
-    maintainers = [ lib.maintainers.raskin ];
-    platforms = lib.platforms.linux;
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [
+      raskin
+      siraben
+    ];
+    platforms = lib.platforms.unix;
+    homepage = "https://golly.sourceforge.io/";
     downloadPage = "https://sourceforge.net/projects/golly/files/golly";
   };
-}
+})

pkgs/build-support/trivial-builders/default.nix

···
         ''
       );
 
-  # Remove after 25.05 branch-off
-  writeReferencesToFile = throw "writeReferencesToFile has been removed. Use writeClosure instead.";
-
   # Docs in doc/build-helpers/trivial-build-helpers.chapter.md
   # See https://nixos.org/manual/nixpkgs/unstable/#trivial-builder-writeClosure
   writeClosure =

pkgs/by-name/ag/agate/package.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "agate";
-  version = "3.3.14";
+  version = "3.3.16";
 
   src = fetchFromGitHub {
     owner = "mbrubeck";
     repo = "agate";
     rev = "v${version}";
-    hash = "sha256-3IVl11eG9gSriOddgzgF0FecdldBxEOE/UXlFDKGyic=";
+    hash = "sha256-TLLmoQXrvgDskmH9sKxUi5AqYrCR0ZaJJdbOV03IbMc=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-pVxXUFuHyQ7YBJ6cBv3wPK5aZOs2QIhKf9awwY/y1hw=";
+  cargoHash = "sha256-HA1h06ZlWvq7z5hJFqKxGtXNk8/GHxUivigaVqWQCvA=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/al/all-the-package-names/package.nix

···
 
 buildNpmPackage rec {
   pname = "all-the-package-names";
-  version = "2.0.2147";
+  version = "2.0.2154";
 
   src = fetchFromGitHub {
     owner = "nice-registry";
     repo = "all-the-package-names";
     tag = "v${version}";
-    hash = "sha256-SVZV9/eAPp7IxWhNxKuDgxFaW/nQiLZkRrqCgRbU9hQ=";
+    hash = "sha256-JAWD64CTQACKH8uGyGcbWqTkCQxmRvtQIyco4rK3l6Y=";
   };
 
-  npmDepsHash = "sha256-pJZpgmo3yNo9xGHC4U2XDBm+EFdFCP8BCSlmRnHUUVo=";
+  npmDepsHash = "sha256-yzjW4m0gHKfWulgAIR04IkWDnHvfCohF/wHi6Wu42cY=";
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/du/dua/package.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "dua";
-  version = "2.29.4";
+  version = "2.30.1";
 
   src = fetchFromGitHub {
     owner = "Byron";
     repo = "dua-cli";
     tag = "v${version}";
-    hash = "sha256-TVwRz5bAdJMtmhhzfZZ/NuV+YrLcnuK6d86Oj/JmgW4=";
+    hash = "sha256-TJiy9ki2k9sgruMFPF3xElOJaco6G8Jx/g43WYwF22U=";
     # Remove unicode file names which leads to different checksums on HFS+
     # vs. other filesystems because of unicode normalisation.
     postFetch = ''
···
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-I8Is6jjBgxcqHkLrA/hesa7z3rrDVK6sjyw2/mQoRVs=";
+  cargoHash = "sha256-LOtZyH6eO8IgHrZfyBInEeXI9CxkjLrMfMWuTUMF+FU=";
 
   checkFlags = [
     # Skip interactive tests

pkgs/by-name/fl/flattenReferencesGraph/src/flatten_references_graph/popularity_contest.py

···
 # and how deep in the tree they live. Equally-"popular" paths are then
 # sorted by name.
 #
-# The existing writeReferencesToFile prints the paths in a simple
-# ascii-based sorting of the paths.
+# The existing writeClosure prints the paths in a simple ascii-based sorting of the paths.
 #
 # Sorting the paths by graph improves the chances that the difference
 # between two builds appear near the end of the list, instead of near

pkgs/by-name/fl/fleet/package.nix

···
 
 buildGoModule (finalAttrs: {
   pname = "fleet";
-  version = "4.67.3";
+  version = "4.68.0";
 
   src = fetchFromGitHub {
     owner = "fleetdm";
     repo = "fleet";
     tag = "fleet-v${finalAttrs.version}";
-    hash = "sha256-d574YSeMbb/+1wxEMAN0URfpb58NpG8NuOHGQs0GyLk=";
+    hash = "sha256-C+rIRbeCdfQIAfAXSbvCGBFl16e7HhHPvNdJhLY82z8=";
   };
-  vendorHash = "sha256-UkdHwjCcxNX7maI4QClLm5WWaLXwGlEu80eZXVoYy60=";
+  vendorHash = "sha256-ZdkpgZbXchDp5kiEgCsSsd3/ltltSRjOuTPOhiBEloc=";
 
   subPackages = [
     "cmd/fleet"

pkgs/by-name/li/librewolf-bin-unwrapped/package.nix

···
 
   pname = "librewolf-bin-unwrapped";
 
-  version = "138.0.1-2";
+  version = "138.0.4-1";
 in
 
 stdenv.mkDerivation {
···
     url = "https://gitlab.com/api/v4/projects/44042130/packages/generic/librewolf/${version}/librewolf-${version}-${arch}-package.tar.xz";
     hash =
       {
-        i686-linux = "sha256-sr4qnFpWubAsdBr18xLSMwBCkCX6JB0VnwiJxu4b+Dc=";
-        x86_64-linux = "sha256-BW8CirLL8YJl+aXwGWo3n3RN04LWs3ca4Isy5Krrjpg=";
-        aarch64-linux = "sha256-LLUQ87HcsnxYfTvniKIHVY+pqTWpdqN1a7gRQn3Ll7Y=";
+        i686-linux = "sha256-9lHQQ9DGfIIjMhvtorrFTHjjt+qCFRdhgLmkDYn5/sI=";
+        x86_64-linux = "sha256-N4MmZgYtezRzofuxPreWM+MrPZbgrh/jhBtDqHndFzw=";
+        aarch64-linux = "sha256-y4wR6RgtEesvogy+fRtVwY6dMMrrC/bPjH35N/ARI2U=";
       }
       .${stdenv.hostPlatform.system} or throwSystem;
   };

pkgs/by-name/ma/matrix-conduit/package.nix

···
   rust-jemalloc-sys,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "matrix-conduit";
-  version = "0.9.0";
+  version = "0.10.3";
 
   src = fetchFromGitLab {
     owner = "famedly";
     repo = "conduit";
-    rev = "v${version}";
-    hash = "sha256-mQLfRAun2G/LDnw3jyFGJbOqpxh2PL8IGzFELRfAgAI=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-cLPfgRchYLJXA13Xr1Yg3v+O/7SvxWYIAxaKvnsm7HM=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-r7fOzTug0cKQUGrpXDn1JKb6/lLQDgnA3/colmldA4c=";
+  cargoHash = "sha256-i/x6V/0WgMUuZoG8znREmAnLqw/9lYPk4F5i2SA5mmo=";
 
   # Conduit enables rusqlite's bundled feature by default, but we'd rather use our copy of SQLite.
   preBuild = ''
-    substituteInPlace Cargo.toml --replace "features = [\"bundled\"]" "features = []"
+    substituteInPlace Cargo.toml --replace-fail "features = [\"bundled\"]" "features = []"
     cargo update --offline -p rusqlite
   '';
 
···
   buildInputs = [
     sqlite
     rust-jemalloc-sys
+    rocksdb
   ];
 
   env = {
···
     inherit (nixosTests) matrix-conduit;
   };
 
-  meta = with lib; {
+  meta = {
     description = "Matrix homeserver written in Rust";
     homepage = "https://conduit.rs/";
-    license = licenses.asl20;
-    maintainers = with maintainers; [
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
       pstn
       pimeys
     ];
     mainProgram = "conduit";
   };
-}
+})

pkgs/by-name/op/open62541pp/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "open62541pp";
-  version = "0.18.0";
+  version = "0.19.0";
 
   src = fetchFromGitHub {
     owner = "open62541pp";
     repo = "open62541pp";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-xFiL+biDETGNwWzbTcfAi3GF1Dj9vvXEj2wJ+GoFz1Q=";
+    hash = "sha256-aXEYGSwVYr9+mTE7ZF9xFA990k1qrKlV+1KvHz/fB6U=";
   };
 
   cmakeFlags = [

pkgs/by-name/pr/primecount/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "primecount";
-  version = "7.16";
+  version = "7.18";
 
   src = fetchFromGitHub {
     owner = "kimwalisch";
     repo = "primecount";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-wmq2AmpmDNJE7AEbn+sFbmLYR/ewdVQeEyWkmq16U9o=";
+    hash = "sha256-iVRkgVeNO0AxwfyM9Dw5B0GoAf4GlrTtC+1npKlaV3E=";
   };
 
   outputs = [

pkgs/by-name/pr/primesieve/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "primesieve";
-  version = "12.8";
+  version = "12.9";
 
   src = fetchFromGitHub {
     owner = "kimwalisch";
     repo = "primesieve";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-1jy4cfH/z4fwuuonoRHtrKUVNX9mD9A2sBaUTtAUA8M=";
+    hash = "sha256-xEGpMQ6kxby3nq3RBv6s6ZrTwC9KRKr3II1VQHGaAXk=";
   };
 
   outputs = [

pkgs/by-name/rl/rlama/package.nix

···
   buildGoModule,
   fetchFromGitHub,
   pkg-config,
-  makeWrapper,
+  makeBinaryWrapper,
   poppler-utils,
   tesseract,
   catdoc,
+  unrtf,
   python3Packages,
-  versionCheckHook,
   nix-update-script,
+  writableTmpDirAsHomeHook,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "rlama";
-  version = "0.1.30";
+  version = "0.1.36";
 
   src = fetchFromGitHub {
     owner = "dontizi";
     repo = "rlama";
-    tag = "v${version}";
-    hash = "sha256-J4FTRWQfdmWXMhlwINQgqj7sCvF3+0YZwcZFW8y1CgY=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-SzrnpAkh+SMzF9xOAxZXondRulwPRUZYHrhe3rf06bA=";
   };
 
-  vendorHash = "sha256-XZVMnkv+WqUqM6jbgrO3P5CSDACH3vLFJ4Y79EOnD08=";
+  vendorHash = "sha256-GHmLCgL79BdGw/5zz50Y1kR/6JYNalvOj2zjIHQ9IF0=";
 
   env.CGO_ENABLED = "0";
 
···
 
   nativeBuildInputs = [
     pkg-config
-    makeWrapper
+    makeBinaryWrapper
   ];
 
+  # Run only unit tests for core packages; skip e2e tests that require Ollama
+  checkPhase = ''
+    runHook preCheck
+
+    go test -v ./internal/domain/... ./pkg/vector/... ./internal/repository/...
+
+    runHook postCheck
+  '';
+
   postInstall = ''
     wrapProgram $out/bin/rlama \
       --prefix PATH : ${
···
           poppler-utils
           tesseract
           catdoc
+          unrtf
           python3Packages.pdfminer-six
           python3Packages.docx2txt
           python3Packages.xlsx2csv
+          python3Packages.torch
+          python3Packages.transformers
         ]
       }
   '';
 
   nativeInstallCheckInputs = [
-    versionCheckHook
+    writableTmpDirAsHomeHook
   ];
-  versionCheckProgramArg = "--version";
+
   doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    VERSION=$($out/bin/rlama --version | grep -o "${finalAttrs.version}" || true)
+    if [ -z "$VERSION" ]; then
+        echo "Version check failed: expected ${finalAttrs.version}, got: $($out/bin/rlama --version)"
+      else
+        echo "$VERSION"
+    fi
+
+    runHook postInstallCheck
+  '';
 
   passthru = {
     updateScript = nix-update-script { };
···
   meta = {
     description = "Retrieval-Augmented Language Model Adapter";
     homepage = "https://github.com/dontizi/rlama";
-    changelog = "https://github.com/dontizi/rlama/releases/tag/v${version}";
+    changelog = "https://github.com/dontizi/rlama/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ liberodark ];
     mainProgram = "rlama";
   };
-}
+})

pkgs/by-name/ro/rocksdb/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rocksdb";
-  version = "9.10.0";
+  version = "10.2.1";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "rocksdb";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-G+DlQwEUyd7JOCjS1Hg1cKWmA/qAiK8UpUIKcP+riGQ=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-v8kZShgz0O3nHZwWjTvhcM56qAs/le1XgMVYyvVd4tg=";
   };
 
   patches = lib.optional (

pkgs/by-name/ru/ruff/package.nix

···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ruff";
-  version = "0.11.10";
+  version = "0.11.11";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "ruff";
     tag = finalAttrs.version;
-    hash = "sha256-8psRFBhOzcFYYOU1aLf2tQwSZeWyn3TjUtfMR8HJ4FE=";
+    hash = "sha256-PPryfsdge0kOb7RyEkGl7c3pFucRzt0+9tACet3nDGM=";
   };
 
   cargoBuildFlags = [ "--package=ruff" ];
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-KwTqm345bRwn5PXn/bTakiBNNjJCIstkXGpqtyCiK4k=";
+  cargoHash = "sha256-LAEuoGTvSXXtx74t1OX+TaGxgvI8UAB3bM+fwiSfFws=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/st/stalwart-mail/package.nix

···
   stalwartEnterprise ? false,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "stalwart-mail" + (lib.optionalString stalwartEnterprise "-enterprise");
   version = "0.11.8";
 
   src = fetchFromGitHub {
     owner = "stalwartlabs";
     repo = "mail-server";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-VqGosbSQxNeOS+kGtvXAmz6vyz5mJlXvKZM57B1Xue4=";
   };
 
···
 
   doCheck = !(stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64);
 
+  # Allow network access during tests on Darwin/macOS
+  __darwinAllowLocalNetworking = true;
+
   passthru = {
     inherit rocksdb; # make used rocksdb version available (e.g., for backup scripts)
     webadmin = callPackage ./webadmin.nix { };
···
       pandapip1
     ];
   };
-}
+})

pkgs/by-name/ta/tailwindcss-language-server/package.nix

···
   nodejs_latest,
   pnpm_9,
   cacert,
+  nix-update-script,
 }:
 
-let
-  version = "0.14.4";
-in
 stdenv.mkDerivation (finalAttrs: {
   pname = "tailwindcss-language-server";
-  inherit version;
+  version = "0.14.18";
 
   src = fetchFromGitHub {
     owner = "tailwindlabs";
     repo = "tailwindcss-intellisense";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-ZSKvD0OnI+/i5MHHlrgYbcaa8g95fVwjb2oryaEParQ=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-CdjlioWLDvEG1G76zZ9lPmOPV1Y88VdwTXxrdIr28fE=";
   };
 
   pnpmDeps = pnpm_9.fetchDeps {
···
       pnpmWorkspaces
       prePnpmInstall
       ;
-    hash = "sha256-f7eNBQl6/qLE7heoCFnYpjq57cjZ9pwT9Td4WmY1oag=";
+    hash = "sha256-TxWaapm/nkyMi3JCj6TE56DhJYPBWBDGXOnzgB9uPjs=";
   };
 
   nativeBuildInputs = [
···
     pnpm_9.configHook
   ];
 
-  buildInputs = [
-    nodejs_latest
-  ];
+  buildInputs = [ nodejs_latest ];
 
   pnpmWorkspaces = [ "@tailwindcss/language-server..." ];
   prePnpmInstall = ''
···
     runHook postInstall
   '';
 
-  meta = with lib; {
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     description = "Tailwind CSS Language Server";
     homepage = "https://github.com/tailwindlabs/tailwindcss-intellisense";
-    license = licenses.mit;
-    maintainers = with maintainers; [ happysalada ];
+    changelog = "https://github.com/tailwindlabs/tailwindcss-intellisense/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ happysalada ];
     mainProgram = "tailwindcss-language-server";
-    platforms = platforms.all;
+    platforms = lib.platforms.all;
   };
 })

pkgs/by-name/va/vault-bin/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "vault-bin";
-  version = "1.19.3";
+  version = "1.19.4";
 
   src =
     let
···
         aarch64-darwin = "darwin_arm64";
       };
       hash = selectSystem {
-        x86_64-linux = "sha256-tdDMyvZHH9Lh4ZP0umGeWOQ01F4O7eq0n+8zz18/zlQ=";
-        aarch64-linux = "sha256-WXRElEsmEQsk2CEno1oHk+e6UPcbE15uHrAgZkLS8Oc=";
-        i686-linux = "sha256-+XDdrhHVLsaVqqYedp99uIKgfNiw7wHjZg6BTuiWAGw=";
-        x86_64-darwin = "sha256-rXqAR/bnuwNjmt+KmbixV4RFC04ZRF9BNwM9uYYLGTI=";
-        aarch64-darwin = "sha256-roHDJmgv8GfebhQnYeNrBc/pvwS2yoSB0YJwy/6eHVk=";
+        x86_64-linux = "sha256-i9BLwgaQSPprQQRSw9Df1M4XgqldBK/r4lSHrOI65uU=";
+        aarch64-linux = "sha256-f8tdRbyQpkRSoLZQ715+gApZBol/ZcFPiIpbzCaUbag=";
+        i686-linux = "sha256-6X2eR8URSqQGDgpWfx1FR4bRFDScnAsxskPBJNFWlJ8=";
+        x86_64-darwin = "sha256-u0E/uI1h1z46WRhjAydgxfSXwsXKXeLz6lSZmTWGwKU=";
+        aarch64-darwin = "sha256-VB2hanB432cPeAVx/zXJCT1Mmj4u+xjsm6jCUw0dpiE=";
       };
     in
     fetchzip {

pkgs/by-name/va/vault/package.nix

···
 
 buildGoModule rec {
   pname = "vault";
-  version = "1.19.3";
+  version = "1.19.4";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = "vault";
     rev = "v${version}";
-    hash = "sha256-Mh9cRSLvx//ePSI1RMcSA7s56MAw+XuAJvbP7BFNZZw=";
+    hash = "sha256-IF67/aWBUMFjAyC0TloKOJUa3zenk47QaCTBKwOltvw=";
   };
 
-  vendorHash = "sha256-F86lDf9AYvVL/sNNstRINe5+O/kGA0SuRjkXM4C99TU=";
+  vendorHash = "sha256-tVCSEqAlyogwFSBWtFEzDl5ziteoBexqQ0xaGmk8F+k=";
 
   proxyVendor = true;
 

pkgs/by-name/ve/vectorcode/package.nix

···
 
 python3Packages.buildPythonApplication rec {
   pname = "vectorcode";
-  version = "0.6.7";
+  version = "0.6.9";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Davidyz";
     repo = "VectorCode";
     tag = version;
-    hash = "sha256-BDDvALeQSBVld2gEmcnlpf3GDpdEs64nFyE6cNKpeww=";
+    hash = "sha256-qXrXNt5uI/gePFyJ79y+zksSekq7BzsbL+1tvMQ/zKM=";
   };
 
   build-system = with python3Packages; [
···
   meta = {
     description = "Code repository indexing tool to supercharge your LLM experience";
     homepage = "https://github.com/Davidyz/VectorCode";
-    changelog = "https://github.com/Davidyz/VectorCode/releases/tag/${version}";
+    changelog = "https://github.com/Davidyz/VectorCode/releases/tag/${src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ GaetanLepage ];
     mainProgram = "vectorcode";

pkgs/by-name/vi/video-downloader/package.nix

···
 
 python3Packages.buildPythonApplication rec {
   pname = "video-downloader";
-  version = "0.12.25";
+  version = "0.12.26";
   pyproject = false; # Built with meson
 
   src = fetchFromGitHub {
     owner = "Unrud";
     repo = "video-downloader";
     tag = "v${version}";
-    hash = "sha256-1riIOYXtiC06n2M/eFjsydqrkCvBtrGkHKEJWiTJ8/8=";
+    hash = "sha256-DwnWKqg4ggtE1GSLtjIYFAIupmY0uQ3wCqgvsYerw0g=";
   };
 
   propagatedBuildInputs = with python3Packages; [

pkgs/development/python-modules/cx-freeze/default.nix

···
   filelock,
   packaging,
   tomli,
-  typing-extensions,
 
   distutils,
   pythonOlder,
···
 
 buildPythonPackage rec {
   pname = "cx-freeze";
-  version = "8.2.0";
+  version = "8.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "marcelotduarte";
     repo = "cx_Freeze";
     tag = version;
-    hash = "sha256-xrSMW7z3XblwAuaC18Rju/XuBZvU+5+xAW+MO6u32EE=";
+    hash = "sha256-PhUzHSn9IqUcb11D0kRT8zhmZ/KusTBDpAempiDN4Rc=";
   };
 
   patches = [
···
     ./fix-tests-relative-path.patch
   ];
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "setuptools>=77.0.3,<=80.4.0" "setuptools>=77.0.3"
+  '';
+
   build-system = [
     setuptools
   ];
···
     ]
     ++ lib.optionals (pythonOlder "3.11") [
       tomli
-    ]
-    ++ lib.optionals (pythonOlder "3.10") [
-      typing-extensions
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       dmgbuild
···
   disabledTests =
     [
       # Require internet access
+      "test_bdist_appimage_download_appimagetool"
       "test_bdist_appimage_target_name"
       "test_bdist_appimage_target_name_and_version"
       "test_bdist_appimage_target_name_and_version_none"
···
   meta = {
     description = "Set of scripts and modules for freezing Python scripts into executables";
     homepage = "https://marcelotduarte.github.io/cx_Freeze";
-    changelog = "https://github.com/marcelotduarte/cx_Freeze/releases/tag/${version}";
+    changelog = "https://github.com/marcelotduarte/cx_Freeze/releases/tag/${src.tag}";
     license = lib.licenses.psfl;
     maintainers = [ ];
     mainProgram = "cxfreeze";

pkgs/development/python-modules/cypari2/default.nix

···
 buildPythonPackage rec {
   pname = "cypari2";
   # upgrade may break sage, please test the sage build or ping @timokau on upgrade
-  version = "2.2.1";
+  version = "2.2.2";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-qqAXpqKAWBkC9zz1zhaVcStlmKAyvhTPq4H5fEdfg7g=";
+    hash = "sha256-E6M4c16iIcEGj4/EFVYb93fYxoclcCvHSVRyZP0JFyA=";
   };
 
   preBuild = ''

pkgs/development/python-modules/elevenlabs/default.nix

···
   httpx,
   lib,
   poetry-core,
+  pyaudio,
   pydantic,
   pydantic-core,
   requests,
···
 }:
 
 let
-  version = "1.59.0";
+  version = "2.0.0";
   tag = "v${version}";
 in
 buildPythonPackage {
···
     owner = "elevenlabs";
     repo = "elevenlabs-python";
     inherit tag;
-    hash = "sha256-d1QnBAMTOlOlApHYAKt0fG7zV+3enIVkg78ShyrL6kM=";
+    hash = "sha256-QiV/B0ikXxEGs9UQUeqkPqdgxPwQi6UQ+tj6KT30Rv8=";
   };
 
   build-system = [ poetry-core ];
···
     typing-extensions
     websockets
   ];
+
+  optional-dependencies = {
+    pyaudio = [ pyaudio ];
+  };
 
   pythonImportsCheck = [ "elevenlabs" ];
 

pkgs/development/python-modules/firebase-admin/default.nix

···
   buildPythonPackage,
   fetchFromGitHub,
   setuptools,
-  hatchling,
   cachecontrol,
   cryptography,
   google-api-python-client,
···
   pyjwt,
   requests,
   pytestCheckHook,
+  pytest-asyncio,
   pytest-localserver,
   pytest-mock,
 }:
···
 
   nativeCheckInputs = [
     pytestCheckHook
+    pytest-asyncio
     pytest-localserver
     pytest-mock
   ];
 
   __darwinAllowLocalNetworking = true;
 
-  disabledTests = [
-    # Flaky (AssertionError)
-    # >       assert delta <= timedelta(seconds=15)
-    # E       assert datetime.timedelta(seconds=17, microseconds=28239) <= datetime.timedelta(seconds=15)
-    "test_task_options"
-  ];
+  disabledTests =
+    [
+      # Flaky (AssertionError)
+      # >       assert delta <= timedelta(seconds=15)
+      # E       assert datetime.timedelta(seconds=17, microseconds=28239) <= datetime.timedelta(seconds=15)
+      "test_task_options"
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      # Flaky / timing sensitive
+      "test_expired_cookie_with_tolerance"
+      "test_expired_token_with_tolerance"
+    ];
 
   meta = {
     description = "Firebase Admin Python SDK";
     homepage = "https://github.com/firebase/firebase-admin-python";
     changelog = "https://github.com/firebase/firebase-admin-python/releases/tag/${src.tag}";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ jhahn ];
+    maintainers = with lib.maintainers; [
+      jhahn
+      sarahec
+    ];
   };
 }

pkgs/development/python-modules/fritzconnection/default.nix

···
 {
   lib,
   buildPythonPackage,
-  pythonOlder,
   fetchFromGitHub,
   pytestCheckHook,
   requests,
···
 
 buildPythonPackage rec {
   pname = "fritzconnection";
-  version = "1.14.0";
+  version = "1.15.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
-
   src = fetchFromGitHub {
     owner = "kbr";
     repo = "fritzconnection";
     tag = version;
-    hash = "sha256-1LLfSEOKqUIhWIR/RQEG0Bp41d908hAKDlslJlWCHys=";
+    hash = "sha256-ulY+nh9CSnxrktTlFSXAWJALkS4GwP/3dRIG07jQCWs=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/keras/default.nix

···
 
 buildPythonPackage rec {
   pname = "keras";
-  version = "3.9.2";
+  version = "3.10.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "keras-team";
     repo = "keras";
     tag = "v${version}";
-    hash = "sha256-mxQHqApyxO57zo/lK8p9xWEdEgkXF89yX/+pPBUlbwE=";
+    hash = "sha256-N0RlXnmSYJvD4/a47U4EjMczw1VIyereZoPicjgEkAI=";
   };
 
   build-system = [

pkgs/development/python-modules/pymilvus/default.nix

···
 
 buildPythonPackage rec {
   pname = "pymilvus";
-  version = "2.5.8";
+  version = "2.5.9";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "milvus-io";
     repo = "pymilvus";
     tag = "v${version}";
-    hash = "sha256-AsbUt5dyVsrbWYzjsqe7bMs4E/npkKTetfHrDK4kt6I=";
+    hash = "sha256-x9qAZay5DoNyfQOpzjfy7/3cyjHwEJiQ441Y+sRyGLw=";
   };
 
   build-system = [

pkgs/development/python-modules/rich-click/default.nix

···
 
 buildPythonPackage rec {
   pname = "rich-click";
-  version = "1.8.8";
+  version = "1.8.9";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
···
     owner = "ewels";
     repo = "rich-click";
     tag = "v${version}";
-    hash = "sha256-938YQMpq7v2iGNVoaVU1H2nuTmteZwKDfZI3anfrpcw=";
+    hash = "sha256-uFb4Pcor9o4BPM/xx/sAKu9DoXvGO/RZg/3dVhbjgk0=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/torch/source/default.nix

···
       substituteInPlace cmake/public/LoadHIP.cmake \
         --replace "set(ROCM_PATH \$ENV{ROCM_PATH})" \
           "set(ROCM_PATH \$ENV{ROCM_PATH})''\nset(ROCM_VERSION ${lib.concatStrings (lib.intersperse "0" (lib.splitVersion rocmPackages.clr.version))})"
+
+      # Use composable kernel as dependency, rather than built-in third-party
+      substituteInPlace aten/src/ATen/CMakeLists.txt \
+        --replace-fail "list(APPEND ATen_HIP_INCLUDE \''${CMAKE_CURRENT_SOURCE_DIR}/../../../third_party/composable_kernel/include)" "" \
+        --replace-fail "list(APPEND ATen_HIP_INCLUDE \''${CMAKE_CURRENT_SOURCE_DIR}/../../../third_party/composable_kernel/library/include)" ""
     ''
     # Detection of NCCL version doesn't work particularly well when using the static binary.
     + lib.optionalString cudaSupport ''

pkgs/development/python-modules/transformers/default.nix

···
 
 buildPythonPackage rec {
   pname = "transformers";
-  version = "4.52.2";
+  version = "4.52.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "huggingface";
     repo = "transformers";
     tag = "v${version}";
-    hash = "sha256-fSU6xXNKl465QvEbAy+LsleIi/I2hWXF0Q4HBaKtXoU=";
+    hash = "sha256-esKAw2zie0xtDWYEx+xAYnx9oCO9UEWH9lSTIJoUTaw=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/wadler-lindig/default.nix

···
 
 buildPythonPackage rec {
   pname = "wadler-lindig";
-  version = "0.1.5";
+  version = "0.1.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "patrick-kidger";
     repo = "wadler_lindig";
     tag = "v${version}";
-    hash = "sha256-owqtKooc7b7RRJglDC5K5M88pxAepHRr+lZCsOOzw7E=";
+    hash = "sha256-EO47eYZk3Hr4328liDmRfCbwi5NDJ4V9NUzk3bpY9IM=";
   };
 
   build-system = [
···
   meta = {
     description = "Wadler--Lindig pretty printer for Python";
     homepage = "https://github.com/patrick-kidger/wadler_lindig";
-    changelog = "https://github.com/patrick-kidger/wadler_lindig/releases/tag/v${version}";
+    changelog = "https://github.com/patrick-kidger/wadler_lindig/releases/tag/${src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ GaetanLepage ];
   };