Merge master into staging-next

.github/workflows/backport.yml

···
     steps:
       # Use a GitHub App to create the PR so that CI gets triggered
       # The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
-      - uses: actions/create-github-app-token@af35edadc00be37caa72ed9f3e6d5f7801bfdf09 # v1.11.7
+      - uses: actions/create-github-app-token@3ff1caaa28b64c9cc276ce0a02e2ff584f3900c5 # v2.0.2
         id: app-token
         with:
           app-id: ${{ vars.NIXPKGS_CI_APP_ID }}

.github/workflows/codeowners-v2.yml

···
       - name: Build codeowners validator
         run: nix-build base/ci -A codeownersValidator
 
-      - uses: actions/create-github-app-token@af35edadc00be37caa72ed9f3e6d5f7801bfdf09 # v1.11.7
+      - uses: actions/create-github-app-token@3ff1caaa28b64c9cc276ce0a02e2ff584f3900c5 # v2.0.2
         id: app-token
         with:
           app-id: ${{ vars.OWNER_RO_APP_ID }}
···
       # This is intentional, because we need to request the review of owners as declared in the base branch.
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-      - uses: actions/create-github-app-token@af35edadc00be37caa72ed9f3e6d5f7801bfdf09 # v1.11.7
+      - uses: actions/create-github-app-token@3ff1caaa28b64c9cc276ce0a02e2ff584f3900c5 # v2.0.2
         id: app-token
         with:
           app-id: ${{ vars.OWNER_APP_ID }}

.github/workflows/eval.yml

···
     steps:
       # See ./codeowners-v2.yml, reuse the same App because we need the same permissions
       # Can't use the token received from permissions above, because it can't get enough permissions
-      - uses: actions/create-github-app-token@af35edadc00be37caa72ed9f3e6d5f7801bfdf09 # v1.11.7
+      - uses: actions/create-github-app-token@3ff1caaa28b64c9cc276ce0a02e2ff584f3900c5 # v2.0.2
         id: app-token
         with:
           app-id: ${{ vars.OWNER_APP_ID }}

.github/workflows/periodic-merge.yml

···
     steps:
       # Use a GitHub App to create the PR so that CI gets triggered
       # The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
-      - uses: actions/create-github-app-token@af35edadc00be37caa72ed9f3e6d5f7801bfdf09 # v1.11.7
+      - uses: actions/create-github-app-token@3ff1caaa28b64c9cc276ce0a02e2ff584f3900c5 # v2.0.2
         id: app-token
         with:
           app-id: ${{ vars.NIXPKGS_CI_APP_ID }}

maintainers/maintainer-list.nix

···
     githubId = 6874204;
     name = "Jason Carr";
   };
+  jasoncrevier = {
+    email = "[e-mail]";
+    github = "jasoncrevier";
+    githubId = 106266438;
+    name = "Jason Crevier";
+  };
   jasonodoom = {
     email = "[e-mail]";
     github = "jasonodoom";
···
     githubId = 13087841;
     name = "Johan Larsson";
     keys = [ { fingerprint = "F0D6 BDE7 C7D1 6B3F 7883  73E7 2A41 C0FE DD6F F540"; } ];
+  };
+  jolheiser = {
+    email = "[e-mail]";
+    github = "jolheiser";
+    githubId = 42128690;
+    name = "John Olheiser";
   };
   jonaenz = {
     name = "Jona Enzinger";
···
     github = "oluceps";
     githubId = 35628088;
     name = "oluceps";
+  };
+  oluchitheanalyst = {
+    name = "ndukauba maryjane oluchi";
+    email = "[e-mail]";
+    github = "oluchitheanalyst";
+    githubId = 152318870;
   };
   olynch = {
     email = "[e-mail]";

pkgs/applications/emulators/libretro/cores/fbneo.nix

···
 }:
 mkLibretroCore {
   core = "fbneo";
-  version = "0-unstable-2025-03-26";
+  version = "0-unstable-2025-04-05";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "fbneo";
-    rev = "ad3b6536f57ec189defabc8aa0fe9d854d167d67";
-    hash = "sha256-Nyzzr6XFQmtRVWxATIIONn3tnwwS6jLbbwHxoYXUDGU=";
+    rev = "c21c0a0393a1cc68db7250022d18039a30de51f4";
+    hash = "sha256-AZyYUftVHlxR+QHCsIcNI2hTIEDYeInYPdmum++EtpU=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/flycast.nix

···
 }:
 mkLibretroCore {
   core = "flycast";
-  version = "0-unstable-2025-03-22";
+  version = "0-unstable-2025-04-05";
 
   src = fetchFromGitHub {
     owner = "flyinghead";
     repo = "flycast";
-    rev = "305cae496fe009a523e1a43cc6a11141531626ef";
-    hash = "sha256-L91RS+GzNA0IpVh1ANkS7V2wWJqdXyioxJuCP+f5SEA=";
+    rev = "3114394019fc0f772c29d0a1f5493fbdce4745b0";
+    hash = "sha256-bp10601cfcsb62Vy88zIjFZ/yBUGVODEt96Me7XX5kY=";
     fetchSubmodules = true;
   };
 

pkgs/applications/emulators/libretro/cores/ppsspp.nix

···
 }:
 mkLibretroCore {
   core = "ppsspp";
-  version = "0-unstable-2025-03-26";
+  version = "0-unstable-2025-04-06";
 
   src = fetchFromGitHub {
     owner = "hrydgard";
     repo = "ppsspp";
-    rev = "e4a492b6a2d72582e0d32ffd05b7f37d3312657c";
-    hash = "sha256-2WuKxfOmlNcPIbwVjCbGfvWIwd5/WYb7pFGMnzg3fZQ=";
+    rev = "031421ba4de8559f8bbdbd9367b29be28f6a45cb";
+    hash = "sha256-eaXR/w0Iz9tmTgZKHVcZYXJbXaVPnYudSal0vcsQ9a0=";
     fetchSubmodules = true;
   };
 

pkgs/applications/emulators/libretro/cores/snes9x.nix

···
 }:
 mkLibretroCore {
   core = "snes9x";
-  version = "0-unstable-2025-02-24";
+  version = "0-unstable-2025-04-06";
 
   src = fetchFromGitHub {
     owner = "snes9xgit";
     repo = "snes9x";
-    rev = "0525ea043ea173ec6af1c6c8dade820036376430";
-    hash = "sha256-BB65aYfkNqM/Lb3/dGMrPBpuR0tjewA45xnIXHaqWsA=";
+    rev = "2c78e77617c65025342e1c4da8187ef5ee2cbad4";
+    hash = "sha256-95ScIvZeBNrf6hvGWf7XI95pyPzGzlBgfd+CDllcIUQ=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/stella.nix

···
 }:
 mkLibretroCore {
   core = "stella";
-  version = "0-unstable-2025-03-17";
+  version = "0-unstable-2025-03-29";
 
   src = fetchFromGitHub {
     owner = "stella-emu";
     repo = "stella";
-    rev = "aaa6c154750119905190da49569fa9e2de7bb97b";
-    hash = "sha256-QephycS6p6KCAR5ryc8Nhx8jnFGHaY7kObT13RNU42Q=";
+    rev = "b753f6eefa4bf02af20eacae98caab7d5aabc4a8";
+    hash = "sha256-uPRNa7Ofaonyp1ErFel12DyKox9ETYGoT1s3aG96VkU=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/vice.nix

···
 }:
 mkLibretroCore {
   core = "vice-${type}";
-  version = "0-unstable-2025-02-23";
+  version = "0-unstable-2025-03-28";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "vice-libretro";
-    rev = "50cd8c29c8abab29e8d55e8fab8e131fadfbe98c";
-    hash = "sha256-Vj7clLLkYyesnP9lL0Z4sy2kvxTsatKzuW6XBg21Jrw=";
+    rev = "9b201cdd612bfb12c8d86696656b79eaf25924ab";
+    hash = "sha256-YilHxQLZC8MVnZ9EekCqtU8rgOB/0FH2vKFdn6l3i5Q=";
   };
 
   makefile = "Makefile";

pkgs/applications/networking/cluster/rke2/builder.nix

···
   nixosTests,
   testers,
 }:
-let
-  rke2 = buildGoModule rec {
-    pname = "rke2";
-    version = rke2Version;
+buildGoModule (finalAttrs: {
+  pname = "rke2";
+  version = rke2Version;
 
-    src = fetchzip {
-      url = "https://github.com/rancher/rke2/archive/refs/tags/v${rke2Version}.tar.gz";
-      hash = "${rke2TarballHash}";
-    };
+  src = fetchzip {
+    url = "https://github.com/rancher/rke2/archive/refs/tags/v${rke2Version}.tar.gz";
+    hash = "${rke2TarballHash}";
+  };
 
-    vendorHash = rke2VendorHash;
+  vendorHash = rke2VendorHash;
 
-    nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
-    # Important utilities used by the kubelet.
-    # See: https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-237202494
-    # Notice the list in that issue is stale, but as a redundancy reservation.
-    buildInputs = [
-      procps # pidof pkill
-      coreutils # uname touch env nice du
-      util-linux # lsblk fsck mkfs nsenter mount umount
-      ethtool # ethtool
-      socat # socat
-      iptables # iptables iptables-restore iptables-save
-      bridge-utils # brctl
-      iproute2 # ip tc
-      kmod # modprobe
-      lvm2 # dmsetup
-    ];
+  # Important utilities used by the kubelet.
+  # See: https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-237202494
+  # Notice the list in that issue is stale, but as a redundancy reservation.
+  buildInputs = [
+    procps # pidof pkill
+    coreutils # uname touch env nice du
+    util-linux # lsblk fsck mkfs nsenter mount umount
+    ethtool # ethtool
+    socat # socat
+    iptables # iptables iptables-restore iptables-save
+    bridge-utils # brctl
+    iproute2 # ip tc
+    kmod # modprobe
+    lvm2 # dmsetup
+  ];
 
-    # Passing boringcrypto to GOEXPERIMENT variable to build with goboring library
-    GOEXPERIMENT = "boringcrypto";
+  # Passing boringcrypto to GOEXPERIMENT variable to build with goboring library
+  GOEXPERIMENT = "boringcrypto";
 
-    # See: https://github.com/rancher/rke2/blob/e7f87c6dd56fdd76a7dab58900aeea8946b2c008/scripts/build-binary#L27-L38
-    ldflags = [
-      "-w"
-      "-X github.com/k3s-io/k3s/pkg/version.GitCommit=${lib.substring 0 6 rke2Commit}"
-      "-X github.com/k3s-io/k3s/pkg/version.Program=${pname}"
-      "-X github.com/k3s-io/k3s/pkg/version.Version=v${version}"
-      "-X github.com/k3s-io/k3s/pkg/version.UpstreamGolang=go${go.version}"
-      "-X github.com/rancher/rke2/pkg/images.DefaultRegistry=docker.io"
-      "-X github.com/rancher/rke2/pkg/images.DefaultEtcdImage=rancher/hardened-etcd:${etcdVersion}"
-      "-X github.com/rancher/rke2/pkg/images.DefaultKubernetesImage=rancher/hardened-kubernetes:${k8sImageTag}"
-      "-X github.com/rancher/rke2/pkg/images.DefaultPauseImage=rancher/mirrored-pause:${pauseVersion}"
-      "-X github.com/rancher/rke2/pkg/images.DefaultRuntimeImage=rancher/rke2-runtime:${dockerizedVersion}"
-      "-X github.com/rancher/rke2/pkg/images.DefaultCloudControllerManagerImage=rancher/rke2-cloud-provider:${ccmVersion}"
-    ];
+  # See: https://github.com/rancher/rke2/blob/e7f87c6dd56fdd76a7dab58900aeea8946b2c008/scripts/build-binary#L27-L38
+  ldflags = [
+    "-w"
+    "-X github.com/k3s-io/k3s/pkg/version.GitCommit=${lib.substring 0 6 rke2Commit}"
+    "-X github.com/k3s-io/k3s/pkg/version.Program=${finalAttrs.pname}"
+    "-X github.com/k3s-io/k3s/pkg/version.Version=v${finalAttrs.version}"
+    "-X github.com/k3s-io/k3s/pkg/version.UpstreamGolang=go${go.version}"
+    "-X github.com/rancher/rke2/pkg/images.DefaultRegistry=docker.io"
+    "-X github.com/rancher/rke2/pkg/images.DefaultEtcdImage=rancher/hardened-etcd:${etcdVersion}"
+    "-X github.com/rancher/rke2/pkg/images.DefaultKubernetesImage=rancher/hardened-kubernetes:${k8sImageTag}"
+    "-X github.com/rancher/rke2/pkg/images.DefaultPauseImage=rancher/mirrored-pause:${pauseVersion}"
+    "-X github.com/rancher/rke2/pkg/images.DefaultRuntimeImage=rancher/rke2-runtime:${dockerizedVersion}"
+    "-X github.com/rancher/rke2/pkg/images.DefaultCloudControllerManagerImage=rancher/rke2-cloud-provider:${ccmVersion}"
+  ];
 
-    tags = [
-      "no_cri_dockerd"
-      "no_embedded_executor"
-      "no_stage"
-      "sqlite_omit_load_extension"
-      "selinux"
-      "netgo"
-      "osusergo"
-    ];
+  tags = [
+    "no_cri_dockerd"
+    "no_embedded_executor"
+    "no_stage"
+    "sqlite_omit_load_extension"
+    "selinux"
+    "netgo"
+    "osusergo"
+  ];
 
-    subPackages = [ "." ];
+  subPackages = [ "." ];
 
-    installPhase = ''
-      install -D $GOPATH/bin/rke2 $out/bin/rke2
-      wrapProgram $out/bin/rke2 \
-        --prefix PATH : ${lib.makeBinPath buildInputs}
+  installPhase = ''
+    install -D $GOPATH/bin/rke2 $out/bin/rke2
+    wrapProgram $out/bin/rke2 \
+      --prefix PATH : ${lib.makeBinPath finalAttrs.buildInputs}
 
-      install -D ./bundle/bin/rke2-killall.sh $out/bin/rke2-killall.sh
-      wrapProgram $out/bin/rke2-killall.sh \
-        --prefix PATH : ${
-          lib.makeBinPath [
-            systemd
-            gnugrep
-            gnused
-          ]
-        } \
-        --prefix PATH : ${lib.makeBinPath buildInputs}
-    '';
+    install -D ./bundle/bin/rke2-killall.sh $out/bin/rke2-killall.sh
+    wrapProgram $out/bin/rke2-killall.sh \
+      --prefix PATH : ${
+        lib.makeBinPath [
+          systemd
+          gnugrep
+          gnused
+        ]
+      } \
+      --prefix PATH : ${lib.makeBinPath finalAttrs.buildInputs}
+  '';
 
-    doCheck = false;
+  doCheck = false;
 
-    doInstallCheck = true;
-    installCheckPhase = ''
-      runHook preInstallCheck
-      # Verify that the binary uses BoringCrypto
-      go tool nm $out/bin/.rke2-wrapped | grep '_Cfunc__goboringcrypto_' > /dev/null
-      runHook postInstallCheck
-    '';
+  doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+    # Verify that the binary uses BoringCrypto
+    go tool nm $out/bin/.rke2-wrapped | grep '_Cfunc__goboringcrypto_' > /dev/null
+    runHook postInstallCheck
+  '';
 
-    passthru = {
-      inherit updateScript;
-      tests =
-        let
-          moduleTests =
-            let
-              package_version =
-                "rke2_" + lib.replaceStrings [ "." ] [ "_" ] (lib.versions.majorMinor rke2Version);
-            in
-            lib.mapAttrs (name: value: nixosTests.rke2.${name}.${package_version}) nixosTests.rke2;
-        in
-        {
-          version = testers.testVersion {
-            package = rke2;
-            version = "v${version}";
-          };
-        }
-        // moduleTests;
-    } // (lib.mapAttrs (_: value: fetchurl value) imagesVersions);
+  passthru = {
+    inherit updateScript;
+    tests =
+      let
+        moduleTests =
+          let
+            package_version =
+              "rke2_" + lib.replaceStrings [ "." ] [ "_" ] (lib.versions.majorMinor rke2Version);
+          in
+          lib.mapAttrs (name: value: nixosTests.rke2.${name}.${package_version}) nixosTests.rke2;
+      in
+      {
+        version = testers.testVersion {
+          package = finalAttrs.finalPackage;
+          version = "v${finalAttrs.version}";
+        };
+      }
+      // moduleTests;
+  } // (lib.mapAttrs (_: value: fetchurl value) imagesVersions);
 
-    meta = with lib; {
-      homepage = "https://github.com/rancher/rke2";
-      description = "RKE2, also known as RKE Government, is Rancher's next-generation Kubernetes distribution";
-      changelog = "https://github.com/rancher/rke2/releases/tag/v${version}";
-      license = licenses.asl20;
-      maintainers = with maintainers; [
-        rorosen
-        zimbatm
-        zygot
-      ];
-      mainProgram = "rke2";
-      platforms = platforms.linux;
-    };
+  meta = with lib; {
+    homepage = "https://github.com/rancher/rke2";
+    description = "RKE2, also known as RKE Government, is Rancher's next-generation Kubernetes distribution";
+    changelog = "https://github.com/rancher/rke2/releases/tag/v${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [
+      rorosen
+      zimbatm
+      zygot
+    ];
+    mainProgram = "rke2";
+    platforms = platforms.linux;
   };
-in
-rke2
+})

pkgs/applications/networking/mailreaders/thunderbird/packages.nix

···
   thunderbird = thunderbird-latest;
 
   thunderbird-latest = common {
-    version = "136.0.1";
-    sha512 = "cc217f3e07620442714337ea396a7146d9d80cc973de862990a9fac7c4343e900419b71ff8c6575e563deda6daff90bec5809a9a94376cbf1019c834f4e1b1e7";
+    version = "137.0.1";
+    sha512 = "387f04aff9380c7261c574e7ef2e4972d63ebfb2768e25aa41a5ee2f3a755780a84099532cf4c1b5635db3412ab543e9b17b0a0476ec06c547b2dc678f19795f";
 
     updateScript = callPackage ./update.nix {
       attrPath = "thunderbirdPackages.thunderbird-latest";

pkgs/applications/video/memento/default.nix

···
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "memento";
-  version = "1.5.0";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "ripose-jp";
     repo = "Memento";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-8kgMEHDLb2EtwmIOs6WQO3a1QSypwN1FX/f2n7uRBFs=";
+    hash = "sha256-IvzvlToSyA20FWU0x+wgE3rT0dYbuY6xyaGgz1D1f6Q=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/al/alive2/package.nix

···
   llvm_18,
   cmake,
   ninja,
+  nix-update-script,
 }:
 
 clangStdenv.mkDerivation (finalAttrs: {
   pname = "alive2";
-  version = "0-unstable-2024-09-23";
+  version = "20.0";
 
   src = fetchFromGitHub {
     owner = "AliveToolkit";
     repo = "alive2";
-    rev = "05a964284056b38a6dc1f807e7acad64a0308328";
-    sha256 = "sha256-okKKUU7WLXLD9Hvsfoz+1HQWoyQ/bqRpBk5ogr7kSJA=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-4QNrBRGH+rxXwb7zTRYAixxipN3ybcXuWCmO+BLU9r4=";
   };
 
   nativeBuildInputs = [
···
     runHook postInstall
   '';
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Automatic verification of LLVM optimizations";
     homepage = "https://github.com/AliveToolkit/alive2";
     license = lib.licenses.mit;
     platforms = lib.platforms.all;
-    maintainers = with lib.maintainers; [ shogo ];
+    maintainers = with lib.maintainers; [ shogo ] ++ lib.teams.ngi.members;
     mainProgram = "alive";
   };
 })

pkgs/by-name/an/ansible-navigator/package.nix

···
 }:
 python3Packages.buildPythonApplication rec {
   pname = "ansible-navigator";
-  version = "25.1.0";
+  version = "25.4.0";
   pyproject = true;
 
   disabled = python3Packages.pythonOlder "3.10";
···
   src = fetchPypi {
     inherit version;
     pname = "ansible_navigator";
-    hash = "sha256-WcA14CiUUNXa+yR1IzoyQ7LWBXFI8yzV+xpRj2W8lzQ=";
+    hash = "sha256-nZmL7AExd7lkg6U3XNZxF5lbP2GMxNhbKf3zuU3kkgc=";
   };
 
   build-system = with python3Packages; [

pkgs/by-name/an/anthy/package.nix

···
 
   postPatch = lib.optionalString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     # for cross builds, copy build tools from the native package
-    cp -r "${buildPackages.anthy}"/lib/internals/{mkdepgraph,.libs} depgraph/
-    cp -r "${buildPackages.anthy}"/lib/internals/{mkworddic,.libs} mkworddic/
-    cp -r "${buildPackages.anthy}"/lib/internals/{calctrans,.libs} calctrans/
-    cp -r "${buildPackages.anthy}"/lib/internals/{mkfiledic,.libs} mkanthydic/
+    cp -r "${buildPackages.anthy.dev}"/lib/internals/{mkdepgraph,.libs} depgraph/
+    cp -r "${buildPackages.anthy.dev}"/lib/internals/{mkworddic,.libs} mkworddic/
+    cp -r "${buildPackages.anthy.dev}"/lib/internals/{calctrans,.libs} calctrans/
+    cp -r "${buildPackages.anthy.dev}"/lib/internals/{mkfiledic,.libs} mkanthydic/
     substituteInPlace mkworddic/Makefile.in \
       --replace-fail 'anthy.wdic : mkworddic' 'anthy.wdic : ' \
       --replace-fail 'all: ' 'all: anthy.wdic #'
···
       --replace-fail 'all-am: Makefile $(PROGRAMS) $(SCRIPTS) $(DATA)' 'all-am: $(DATA)'
   '';
 
+  outputs = [
+    "out"
+    "dev"
+  ];
+
   meta = with lib; {
     description = "Hiragana text to Kana Kanji mixed text Japanese input method";
     homepage = "https://anthy.osdn.jp/";
···
   };
 
   postFixup = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
-    mkdir "$out/lib/internals"
-    cp -r depgraph/{mkdepgraph,.libs} mkworddic/{mkworddic,.libs} calctrans/{calctrans,.libs} mkanthydic/{mkfiledic,.libs} "$out/lib/internals"
+    # not relevant for installed package
+    mkdir "$dev/lib/internals"
+    cp -r depgraph/{mkdepgraph,.libs} mkworddic/{mkworddic,.libs} calctrans/{calctrans,.libs} mkanthydic/{mkfiledic,.libs} "$dev/lib/internals"
   '';
 
   src = fetchurl {

pkgs/by-name/bu/buildstream/package.nix

···
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+
+  # buildInputs
+  buildbox,
+  fuse3,
+  lzip,
+  patch,
+
+  # tests
+  addBinToPathHook,
+  gitMinimal,
+  versionCheckHook,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "buildstream";
+  version = "2.4.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "apache";
+    repo = "buildstream";
+    tag = version;
+    hash = "sha256-6a0VzYO5yj7EHvAb0xa4xZ0dgBKjFcwKv2F4o93oahY=";
+  };
+
+  build-system = with python3Packages; [
+    cython
+    pdm-pep517
+    setuptools
+    setuptools-scm
+  ];
+
+  dependencies = with python3Packages; [
+    click
+    dulwich
+    grpcio
+    jinja2
+    markupsafe
+    packaging
+    pluginbase
+    protobuf
+    psutil
+    pyroaring
+    requests
+    ruamel-yaml
+    ruamel-yaml-clib
+    tomlkit
+    ujson
+  ];
+
+  buildInputs = [
+    buildbox
+    fuse3
+    lzip
+    patch
+  ];
+
+  pythonImportsCheck = [ "buildstream" ];
+
+  nativeCheckInputs = [
+    addBinToPathHook
+    buildbox
+    gitMinimal
+    python3Packages.pexpect
+    python3Packages.pyftpdlib
+    python3Packages.pytest-datafiles
+    python3Packages.pytest-env
+    python3Packages.pytest-timeout
+    python3Packages.pytest-xdist
+    python3Packages.pytestCheckHook
+    versionCheckHook
+  ];
+
+  disabledTests = [
+    # ValueError: Unexpected comparison between all and ''
+    "test_help"
+
+    # Error loading project: project.conf [line 37 column 2]: Failed to load source-mirror plugin 'mirror': No package metadata was found for sample-plugins
+    "test_source_mirror_plugin"
+
+    # AssertionError: assert '1a5528cad211...0bbe5ee314c14' == '2ccfee62a657...52dbc47203a88'
+    "test_fixed_cas_import"
+    "test_random_cas_import"
+
+    # Runtime error: The FUSE stager child process unexpectedly died with exit code 2
+    "test_patch_sources_cached_1"
+    "test_patch_sources_cached_2"
+    "test_source_cache_key"
+    "test_custom_transform_source"
+
+    # Blob not found in the local CAS
+    "test_source_pull_partial_fallback_fetch"
+  ];
+
+  disabledTestPaths = [
+    # FileNotFoundError: [Errno 2] No such file or directory: '/build/source/tmp/popen-gw1/test_report_when_cascache_exit0/buildbox-casd'
+    "tests/internals/cascache.py"
+  ];
+
+  versionCheckProgram = "${placeholder "out"}/bin/bst";
+  versionCheckProgramArg = "--version";
+
+  meta = {
+    description = "Powerful software integration tool";
+    downloadPage = "https://buildstream.build/install.html";
+    homepage = "https://buildstream.build";
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.linux;
+    mainProgram = "bst";
+    maintainers = with lib.maintainers; [ shymega ];
+  };
+}

pkgs/by-name/ca/caido/package.nix

···
     "cli"
     "desktop"
   ];
-  version = "0.45.1";
+  version = "0.47.1";
   cli = fetchurl {
     url = "https://caido.download/releases/v${version}/caido-cli-v${version}-linux-x86_64.tar.gz";
-    hash = "sha256-tudXyf9wwWABMGwfsxaLJtkZPKImlgjzfJJYFtimQOE=";
+    hash = "sha256-T+NOp5UEKcP8slDddQ9vyrrpoZVGEChJ379Da5E7pVw=";
   };
   desktop = fetchurl {
     url = "https://caido.download/releases/v${version}/caido-desktop-v${version}-linux-x86_64.AppImage";
-    hash = "sha256-meNB1KCtxApsP95476ggL2gbCxu2fdold6BQ2dlZqFc=";
+    hash = "sha256-J2FvEdLy77uO52KNlugZZ+flsraKatXT2n17npMYo9M=";
   };
   appimageContents = appimageTools.extractType2 {
     inherit pname version;

pkgs/by-name/ca/cargo-temp/package.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-temp";
-  version = "0.3.2";
+  version = "0.3.3";
 
   src = fetchFromGitHub {
     owner = "yozhgoor";
     repo = "cargo-temp";
     rev = "v${version}";
-    hash = "sha256-ejcqgfnvIGUhidhJpAh6uJrm8oFb8rS98wRI3iQBP9I=";
+    hash = "sha256-71kAlZKSBnROZ8wXe4kQa8nNug5/hk6NKsqHoQU5pWc=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-lfahdQtv35VH9XTApcu/GIR2QOqXKlb8Gpy6X58LmpA=";
+  cargoHash = "sha256-rHTEWc3JAnsz5z+NmTb84VSXHSR6nNlb5C+n9VxvnUQ=";
 
   meta = with lib; {
     description = "CLI tool that allow you to create a temporary new Rust project using cargo with already installed dependencies";

pkgs/by-name/cn/cnsprcy/package.nix

···
   sqlite,
 }:
 
-rustPlatform.buildRustPackage {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cnsprcy";
-  version = "0.2.0";
+  version = "0.3.2";
 
   src = fetchFromSourcehut {
     owner = "~xaos";
     repo = "cnsprcy";
-    rev = "v0.2.0";
-    hash = "sha256-f+DauSU4bT3EljY8/ig7jLnUgyDPEo2NSBQcPN0iKx0=";
+    rev = "cnspr/v${finalAttrs.version}";
+    hash = "sha256-wwsemwN87YsNRLkr0UNbzSLF2WDaKY6IFXew64g4QoU=";
   };
 
+  sourceRoot = "${finalAttrs.src.name}/v${finalAttrs.version}";
+
   useFetchCargoVendor = true;
-  cargoHash = "sha256-lPTufjKOXMvPy+cP1UyVCTfRXkOmzZqDR6yraIgk+Dg=";
 
-  RUSTC_BOOTSTRAP = true;
+  cargoHash = "sha256-8hNuF5tD1PwdIJB0q3wxDOGDcppo0ac+zol3AHWGv0s=";
 
+  passthru.updateScript = lib.mkUpdateScript {
+    extraFetchers = [ fetchFromSourcehut ];
+  };
+
+  RUSTC_BOOTSTRAP = true;
   buildInputs = [ sqlite ];
 
   meta = {
     description = "End to end encrypted connections between trusted devices";
     homepage = "https://git.sr.ht/~xaos/cnsprcy";
     license = lib.licenses.gpl3;
-    maintainers = with lib.maintainers; [ supinie ];
+    maintainers =
+      with lib.maintainers;
+      [
+        supinie
+        oluchitheanalyst
+      ]
+      ++ lib.teams.ngi.members;
     mainProgram = "cnspr";
     platforms = lib.platforms.linux;
   };
-}
+})

pkgs/by-name/dm/dmitry/implicit-function-declaration.patch

···
+---
+ src/dmitry.c | 1 +
+ src/file.c   | 2 ++
+ 2 files changed, 3 insertions(+)
+
+diff --git a/src/dmitry.c b/src/dmitry.c
+index d47f231..567482d 100644
+--- a/src/dmitry.c
++++ b/src/dmitry.c
+@@ -9,6 +9,7 @@
+ #include <ctype.h>
+ #include <string.h>
+ #include <signal.h>
++#include <stdlib.h>
+ #include <sys/types.h>
+ #include <sys/socket.h>
+ #include <netinet/in.h>
+diff --git a/src/file.c b/src/file.c
+index f4ad48b..3714786 100644
+--- a/src/file.c
++++ b/src/file.c
+@@ -1,4 +1,6 @@
+ #include "includes/file.h"
++#include <string.h>
++#include <stdlib.h>
+ int file_prep()
+ {
+ 	outputfile[strlen(outputfile)] = '\0';

pkgs/by-name/dm/dmitry/package.nix

···
     hash = "sha256-cYFeBM8xFMaLXYk6Rg+5JvfbbIJI9F3mefzCX3+XbB0=";
   };
 
+  patches = [ ./implicit-function-declaration.patch ];
+
   nativeBuildInputs = [ autoreconfHook ];
 
   env.NIX_CFLAGS_COMPILE = toString [ "-fcommon" ];
 
-  meta = with lib; {
+  meta = {
     description = "Deepmagic Information Gathering Tool";
     mainProgram = "dmitry";
     homepage = "https://github.com/jaygreig86/dmitry";
-    maintainers = with maintainers; [ d3vil0p3r ];
-    platforms = platforms.linux;
-    license = licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ d3vil0p3r ];
+    platforms = lib.platforms.linux;
+    license = lib.licenses.gpl2Plus;
   };
 }

pkgs/by-name/do/docfd/package.nix

···
 in
 buildDunePackage' rec {
   pname = "docfd";
-  version = "8.0.3";
+  version = "10.1.3";
 
   minimalOCamlVersion = "5.1";
 
···
     owner = "darrenldl";
     repo = "docfd";
     rev = version;
-    hash = "sha256-890/3iBruaQtWwlcvwuz4ujp7+P+5y1/2Axx4Iuik8Q=";
+    hash = "sha256-ZD1nKl/hfidlTGdBnNINt2EmlUmFWaJjSvY3wkyJJcg=";
   };
 
   nativeBuildInputs = [
···
     cmdliner
     containers-data
     decompress
+    diet
     digestif
     eio_main
     lwd
     nottui
     notty
+    ocaml_sqlite3
     ocolor
     oseq
     ppx_deriving
     ppxlib
+    progress
     re
     spelll
     timedesc
+    uuseg
     yojson
   ];
 

pkgs/by-name/do/dokieli/package.json

···
-{
-  "name": "dokieli",
-  "version": "0.3.1417",
-  "description": "dokieli is a clientside editor for decentralised article publishing, annotations, and social interactions.",
-  "main": "./src/dokieli.js",
-  "type": "module",
-  "scripts": {
-    "build-dist": "webpack --progress --color",
-    "build": "yarn build-dist",
-    "test": "TZ=UTC node --experimental-vm-modules node_modules/jest/bin/jest.js --silent",
-    "test:e2e": "playwright test",
-    "watch": "webpack --progress --color --watch",
-    "minify": "webpack --progress --color --env minimize",
-    "postinstall": "patch-package",
-    "lint": "eslint ."
-  },
-  "repository": "https://github.com/linkeddata/dokieli",
-  "keywords": [
-    "activitystreams",
-    "activitypub",
-    "annotations",
-    "authoring",
-    "decentralized",
-    "editor",
-    "knowledge graph",
-    "linked data",
-    "notifications",
-    "publishing",
-    "social web",
-    "web standards"
-  ],
-  "author": "dokieli team",
-  "license": "Apache-2.0",
-  "bugs": {
-    "url": "https://github.com/linkeddata/dokieli/issues"
-  },
-  "homepage": "https://dokie.li/",
-  "engines": {
-    "node": ">=18.0.0"
-  },
-  "dependencies": {
-    "buffer": "^6.0.3",
-    "d3-force": "^3.0.0",
-    "d3-selection": "^3.0.0",
-    "diff": "^5.2.0",
-    "dompurify": "^3.1.5",
-    "fs": "^0.0.1-security",
-    "http-link-header": "^1.1.3",
-    "leaflet": "^1.9.4",
-    "leaflet-gpx": "^1.7.0",
-    "medium-editor": "^5.23.3",
-    "medium-editor-tables": "^0.6.1",
-    "micromark": "^4.0.0",
-    "micromark-extension-gfm": "^3.0.0",
-    "micromark-extension-gfm-tagfilter": "^2.0.0",
-    "rdf-parser-rdfa": "https://github.com/rdf-ext/rdf-parser-rdfa.git#master",
-    "rdf-store-ldp": "^0.3.1",
-    "shower": "https://github.com/shower/core.git#main",
-    "simplerdf": "^0.2.14",
-    "simplerdf-parse": "^0.1.3",
-    "solid-auth-client": "^2.5.6"
-  },
-  "devDependencies": {
-    "@axe-core/playwright": "^4.9.1",
-    "@playwright/test": "^1.44.1",
-    "babel-eslint": "^10.1.0",
-    "dotenv": "^16.4.5",
-    "eslint": "^9.10.0",
-    "eslint-plugin-jest": "^27.9.0",
-    "husky": "^9.0.11",
-    "jest": "^29.0.3",
-    "jest-environment-jsdom": "^29.0.3",
-    "patch-package": "^8.0.0",
-    "process": "^0.11.10",
-    "terser-webpack-plugin": "^5.3.3",
-    "webpack": "5.94.0",
-    "webpack-cli": "^5.0.1"
-  },
-  "resolutions": {
-    "ansi-regex": "^5.0.0",
-    "xmldom": "https://github.com/xmldom/xmldom.git#master",
-    "green-turtle": "https://github.com/csarven/green-turtle#master",
-    "json5": "^1.0.2",
-    "http-cache-semantics": "^4.1.1",
-    "jsonld": "^5.0.0",
-    "xml2js": "^0.6.2",
-    "semver": "^7.6.2",
-    "lru-cache": "^8.0.0",
-    "micromatch": "^4.0.8"
-  },
-  "standard": {
-    "globals": [
-      "DO",
-      "SimpleRDF",
-      "ld",
-      "describe",
-      "it",
-      "before",
-      "beforeEach",
-      "after",
-      "afterEach"
-    ]
-  }
-}

pkgs/by-name/do/dokieli/package.nix

···
 {
   lib,
-  mkYarnPackage,
+  stdenv,
   fetchFromGitHub,
   fetchYarnDeps,
+  yarnConfigHook,
   makeWrapper,
+  yarnBuildHook,
+  yarnInstallHook,
   nodejs,
   xsel,
 }:
 
-mkYarnPackage rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "dokieli";
-  version = "0-unstable-2024-09-23";
+  version = "0-unstable-2024-12-12";
 
+  # Can't update newer versions currently because newer versions require yarn-berry, and it's not in nixpkgs, yet.
   src = fetchFromGitHub {
     owner = "linkeddata";
     repo = "dokieli";
-    rev = "40ebbc60ba48d8b08f763b07befba96382c5f027";
-    hash = "sha256-lc96jOR8uXLcZFhN3wpSd9O5cUdKxllB8WWCh2oWuEw=";
+    rev = "d8dc72c81b84ec12f791892a6377a7f6ec46ed3b";
+    hash = "sha256-CzSyQVyeJVOP8NCsa7ST3atG87V1KPSBzTRi0brMFYw=";
   };
 
   offlineCache = fetchYarnDeps {
-    yarnLock = src + "/yarn.lock";
-    hash = "sha256-TEXCCLFhpwHZJ8zRGsC7J6EwNaFpIi+CZ3L5uilebK4=";
+    yarnLock = "${finalAttrs.src}/yarn.lock";
+    hash =
+      if stdenv.hostPlatform.isDarwin then
+        "sha256-bw5HszcHZ60qgYgm4qfhZEYXjJAQ2DXhWU0Reqb9VpQ="
+      else
+        "sha256-rwHBDBWZe4cdTyL7lNkB4nlpd5MWzbTU6kzdLBWcq0M=";
   };
-
-  packageJSON = ./package.json;
 
   installPhase = ''
     mkdir -p $out/bin
     cp -r * $out
   '';
 
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [
+    makeWrapper
+    yarnConfigHook
+    yarnBuildHook
+    yarnInstallHook
+    # Needed for executing package.json scripts
+    nodejs
+  ];
 
   postFixup = ''
     makeWrapper ${nodejs}/bin/npx $out/bin/dokieli           \
···
     homepage = "https://github.com/linkeddata/dokieli";
     license = lib.licenses.mit;
     platforms = lib.platforms.all;
-    maintainers = with lib.maintainers; [ shogo ];
+    maintainers = with lib.maintainers; [ shogo ] ++ lib.teams.ngi.members;
     mainProgram = "dokieli";
   };
-}
+})

pkgs/by-name/er/erofs-utils/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "erofs-utils";
-  version = "1.8.5";
+  version = "1.8.6";
   outputs = [
     "out"
     "man"
···
 
   src = fetchurl {
     url = "https://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs-utils.git/snapshot/erofs-utils-${finalAttrs.version}.tar.gz";
-    hash = "sha256-zYYRJw6chv4GL2RxA8pq2p7XEORDD91ZYNUUd3kZIA0=";
+    hash = "sha256-WyIdw/1tFRQlswU07eRvt6kNwjOoZZy6A3J5awoGZUc=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/gc/gclient2nix/gclient2nix.py

···
 logger = logging.getLogger(__name__)
 click_log.basic_config(logger)
 
-nixpkgs_path = "@nixpkgs_path@"
+nixpkgs_path = "<nixpkgs>"
 
 memory: Memory = Memory(user_cache_dir("gclient2nix"), verbose=0)
 

pkgs/by-name/gc/gclient2nix/package.nix

···
   python3,
   runCommand,
   makeWrapper,
-  path,
   fetchgit,
   nurl,
   writers,
···
     buildInputs = [ python ];
 
     # substitutions
-    nixpkgs_path = if builtins.pathExists (path + "/.git") then lib.cleanSource path else path;
     depot_tools_checkout = fetchgit {
       url = "https://chromium.googlesource.com/chromium/tools/depot_tools";
       rev = "452fe3be37f78fbecefa1b4b0d359531bcd70d0d";

pkgs/by-name/gi/git-pr/package.nix

···
 
 buildGoModule rec {
   pname = "git-pr";
-  version = "0.0.2";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "picosh";
     repo = "git-pr";
     rev = "v${version}";
-    hash = "sha256-7Ka8p5X8nQBXKiT6QsWOWMQJL8rePKrHz/LZU1W+oQ8=";
+    hash = "sha256-2A2rP7yr8faVoIYAWprr+t7MwDPerhsuOjWWEl1mhXw=";
   };
 
-  vendorHash = "sha256-tu5C7hz6UTgn/jCCotXzZHlUmGVNERhA7Osxi31Domk=";
+  vendorHash = "sha256-7aHr5CWZVmhBiuCXaK49zYJXMufCxZBnS917mF0QJlg=";
+
+  subPackages = [
+    "cmd/ssh"
+    "cmd/web"
+  ];
+
+  env.CGO_ENABLED = 0;
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
 
   postInstall = ''
     mv $out/bin/ssh $out/bin/git-ssh
+    mv $out/bin/web $out/bin/git-web
   '';
 
   meta = {
     homepage = "https://pr.pico.sh";
     description = "Simple git collaboration tool";
-    license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ sigmanificient ];
-    mainProgram = "git-pr";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      sigmanificient
+      jolheiser
+    ];
+    mainProgram = "git-ssh";
   };
 }

pkgs/by-name/gi/gitlab-runner/package.nix

···
 {
   lib,
+  stdenv,
+  bash,
   buildGoModule,
   fetchFromGitLab,
-  bash,
+  nix-update-script,
+  versionCheckHook,
 }:
 
-let
-  version = "17.2.0";
-in
-buildGoModule rec {
-  inherit version;
+buildGoModule (finalAttrs: {
   pname = "gitlab-runner";
-
-  commonPackagePath = "gitlab.com/gitlab-org/gitlab-runner/common";
-  ldflags = [
-    "-X ${commonPackagePath}.NAME=gitlab-runner"
-    "-X ${commonPackagePath}.VERSION=${version}"
-    "-X ${commonPackagePath}.REVISION=v${version}"
-  ];
-
-  # For patchShebangs
-  buildInputs = [ bash ];
-
-  vendorHash = "sha256-1MwHss76apA9KoFhEU6lYiUACrPMGYzjhds6nTyNuJI=";
+  version = "17.2.0";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-runner";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-a2Igy4DS3fYTvPW1vvDrH/DjMQ4lG9cm/P3mFr+y9s4=";
   };
 
+  vendorHash = "sha256-1MwHss76apA9KoFhEU6lYiUACrPMGYzjhds6nTyNuJI=";
+
+  # For patchShebangs
+  nativeBuildInputs = [ bash ];
+
   patches = [
     ./fix-shell-path.patch
     ./remove-bash-test.patch
   ];
 
-  prePatch = ''
-    # Remove some tests that can't work during a nix build
+  prePatch =
+    ''
+      # Remove some tests that can't work during a nix build
 
-    # Requires to run in a git repo
-    sed -i "s/func TestCacheArchiverAddingUntrackedFiles/func OFF_TestCacheArchiverAddingUntrackedFiles/" commands/helpers/file_archiver_test.go
-    sed -i "s/func TestCacheArchiverAddingUntrackedUnicodeFiles/func OFF_TestCacheArchiverAddingUntrackedUnicodeFiles/" commands/helpers/file_archiver_test.go
+      # Requires to run in a git repo
+      sed -i "s/func TestCacheArchiverAddingUntrackedFiles/func OFF_TestCacheArchiverAddingUntrackedFiles/" commands/helpers/file_archiver_test.go
+      sed -i "s/func TestCacheArchiverAddingUntrackedUnicodeFiles/func OFF_TestCacheArchiverAddingUntrackedUnicodeFiles/" commands/helpers/file_archiver_test.go
 
-    # No writable developer environment
-    rm common/build_test.go
-    rm common/build_settings_test.go
-    rm executors/custom/custom_test.go
+      # No writable developer environment
+      rm common/build_test.go
+      rm common/build_settings_test.go
+      rm executors/custom/custom_test.go
 
-    # No docker during build
-    rm executors/docker/terminal_test.go
-    rm executors/docker/docker_test.go
-    rm helpers/docker/auth/auth_test.go
-    rm executors/docker/services_test.go
-  '';
+      # No docker during build
+      rm executors/docker/terminal_test.go
+      rm executors/docker/docker_test.go
+      rm helpers/docker/auth/auth_test.go
+      rm executors/docker/services_test.go
+    ''
+    + lib.optionalString stdenv.buildPlatform.isDarwin ''
+      # No keychain access during build breaks X.509 certificate tests
+      rm helpers/certificate/x509_test.go
+      rm network/client_test.go
+    '';
 
   excludedPackages = [
     # CI helper script for pushing images to Docker and ECR registries
+    #
     # https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/4139
     "./scripts/sync-docker-images"
   ];
 
-  postInstall = ''
-    install packaging/root/usr/share/gitlab-runner/clear-docker-cache $out/bin
-  '';
+  ldflags =
+    let
+      ldflagsPackageVariablePrefix = "gitlab.com/gitlab-org/gitlab-runner/common";
+    in
+    [
+      "-X ${ldflagsPackageVariablePrefix}.NAME=gitlab-runner"
+      "-X ${ldflagsPackageVariablePrefix}.VERSION=${finalAttrs.version}"
+      "-X ${ldflagsPackageVariablePrefix}.REVISION=${finalAttrs.src.tag}"
+    ];
 
   preCheck = ''
     # Make the tests pass outside of GitLab CI
     export CI=0
   '';
 
-  meta = with lib; {
+  # Many tests start servers which bind to ports
+  __darwinAllowLocalNetworking = true;
+
+  postInstall = ''
+    install packaging/root/usr/share/gitlab-runner/clear-docker-cache $out/bin
+  '';
+
+  doInstallCheck = true;
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  versionCheckProgramArg = "--version";
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
     description = "GitLab Runner the continuous integration executor of GitLab";
-    license = licenses.mit;
-    homepage = "https://docs.gitlab.com/runner/";
-    platforms = platforms.unix ++ platforms.darwin;
-    maintainers = with maintainers; [ zimbatm ] ++ teams.gitlab.members;
+    homepage = "https://docs.gitlab.com/runner";
+    license = lib.licenses.mit;
+    mainProgram = "gitlab-runner";
+    maintainers = with lib.maintainers; [ zimbatm ] ++ lib.teams.gitlab.members;
   };
-}
+})

pkgs/by-name/he/heynote/package.nix

···
+{
+  appimageTools,
+  desktop-file-utils,
+  fetchurl,
+  lib,
+  nix-update-script,
+}:
+let
+  pname = "heynote";
+  version = "2.1.3";
+
+  src = fetchurl {
+    url = "https://github.com/heyman/heynote/releases/download/v${version}/Heynote_${version}_x86_64.AppImage";
+    sha256 = "sha256-O8loDE2GzXQofh3iNQeP5OAWh7i0QCSxl4I++ERcjbU=";
+  };
+
+  appimageContents = appimageTools.extractType2 {
+    inherit version pname src;
+  };
+
+in
+appimageTools.wrapType2 {
+  inherit pname version src;
+
+  nativeBuildInputs = [ desktop-file-utils ];
+
+  extraInstallCommands = ''
+    mkdir -p $out/share/pixmaps $out/share/licenses/heynote
+    cp ${appimageContents}/heynote.png $out/share/pixmaps/
+    cp ${appimageContents}/heynote.desktop $out
+    # verify binary is present
+    stat $out/bin/heynote
+    desktop-file-install --dir $out/share/applications \
+    --set-key Exec --set-value heynote \
+    --set-key Comment --set-value "Heynote" \
+    --delete-original $out/heynote.desktop
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    mainProgram = "heynote";
+    description = "Dedicated scratchpad for developers";
+    homepage = "https://heynote.com/";
+    changelog = "https://github.com/heyman/heynote/releases/v${version}";
+    license = with lib.licenses; [
+      mit
+      commons-clause
+    ];
+    maintainers = with lib.maintainers; [ jasoncrevier ];
+    platforms = lib.platforms.x86_64;
+  };
+}

pkgs/by-name/hu/hubble/package.nix

···
   buildGo124Module,
   fetchFromGitHub,
   installShellFiles,
+  versionCheckHook,
 }:
 
 buildGo124Module rec {
   pname = "hubble";
-  version = "1.17.1";
+  version = "1.17.2";
 
   src = fetchFromGitHub {
     owner = "cilium";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-ZrLb2dITQPd9g4azlidpTHFWNwop0AMKEIzwMX1Y7Jw=";
+    repo = "hubble";
+    tag = "v${version}";
+    hash = "sha256-ZkowUftSEGo+UjYM+kk3tQJc8QJgoJATeIKPwu2ikQ4=";
   };
+
+  nativeBuildInputs = [
+    installShellFiles
+    versionCheckHook
+  ];
 
   vendorHash = null;
 
   ldflags = [
     "-s"
     "-w"
-    "-X github.com/cilium/cilium/hubble/pkg.GitBranch=none"
-    "-X github.com/cilium/cilium/hubble/pkg.GitHash=none"
-    "-X github.com/cilium/cilium/hubble/pkg.Version=${version}"
+    "-X=github.com/cilium/cilium/hubble/pkg.GitBranch=none"
+    "-X=github.com/cilium/cilium/hubble/pkg.GitHash=none"
+    "-X=github.com/cilium/cilium/hubble/pkg.Version=${version}"
   ];
 
   # Test fails at Test_getFlowsRequestWithInvalidRawFilters in github.com/cilium/hubble/cmd/observe
···
   # https://github.com/cilium/hubble/pull/656
   # https://github.com/cilium/hubble/pull/655
   doCheck = false;
+
   doInstallCheck = true;
-  installCheckPhase = ''
-    $out/bin/hubble version | grep ${version} > /dev/null
-  '';
 
-  nativeBuildInputs = [ installShellFiles ];
   postInstall = ''
     installShellCompletion --cmd hubble \
       --bash <($out/bin/hubble completion bash) \
···
 
   meta = with lib; {
     description = "Network, Service & Security Observability for Kubernetes using eBPF";
-    mainProgram = "hubble";
+    homepage = "https://github.com/cilium/hubble/";
+    changelog = "https://github.com/cilium/hubble/releases/tag/${src.tag}";
     license = licenses.asl20;
-    homepage = "https://github.com/cilium/hubble/";
     maintainers = with maintainers; [
       humancalico
       bryanasdev000
       FKouhai
     ];
+    mainProgram = "hubble";
   };
 }

pkgs/by-name/mo/mountpoint-s3/package.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "mountpoint-s3";
-  version = "1.14.0";
+  version = "1.16.1";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "mountpoint-s3";
     rev = "v${version}";
-    hash = "sha256-QpJYpHow9/vEPrq82XtbDosGz8lqVB0cOPQmY7Dx78Q=";
+    hash = "sha256-/a9chdeijaGKJ3nDDYYZLdS9JrZiAjC8QFQ6bjdLWT8=";
     fetchSubmodules = true;
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-QeRCCu7d4fdRfiw3qdbyFk+N0nT+IYKVJ/NvieejVQg=";
+  cargoHash = "sha256-qFPvNCRF3eUprj2/88RF+H5O3Kz9QF9SQqPfXb9Yogo=";
 
   # thread 'main' panicked at cargo-auditable/src/collect_audit_data.rs:77:9:
   # cargo metadata failure: error: none of the selected packages contains these features: libfuse3

pkgs/by-name/my/mympd/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mympd";
-  version = "20.1.1";
+  version = "20.1.2";
 
   src = fetchFromGitHub {
     owner = "jcorporation";
     repo = "myMPD";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-A78dT/BervM4rlVlbEYojNsG7wvESvKsm9nYjI9svb4=";
+    sha256 = "sha256-u4Ne32gKkA1bFOIaa3uFEMxjhERXTVpqnnCBXQktDAs=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py

···
                     raise NRError(
                         "please specify one of the following "
                         + "supported image variants via --image-variant:\n"
-                        + "\n".join(f"- {v}" for v in variants.keys())
+                        + "\n".join(f"- {v}" for v in variants)
                     )
 
             match action:
···
                         "Done. The virtual machine can be started by running", vm_path
                     )
                 case Action.BUILD_IMAGE:
-                    disk_path = path_to_config / variants[args.image_variant]
+                    if flake:
+                        image_name = nix.get_build_image_name_flake(
+                            flake,
+                            args.image_variant,
+                            eval_flags=flake_common_flags,
+                        )
+                    else:
+                        image_name = nix.get_build_image_name(
+                            build_attr,
+                            args.image_variant,
+                            instantiate_flags=flake_common_flags,
+                        )
+                    disk_path = path_to_config / image_name
                     print_result("Done. The disk image can be found in", disk_path)
 
         case Action.EDIT:

pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/models.py

···
 
 from .process import Remote, run_wrapper
 
-type ImageVariants = dict[str, str]
+type ImageVariants = list[str]
 
 
 class NRError(Exception):

pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py

···
     return Path(r.stdout.strip())
 
 
+def get_build_image_name(
+    build_attr: BuildAttr,
+    image_variant: str,
+    instantiate_flags: Args | None = None,
+) -> str:
+    path = (
+        f'"{build_attr.path.resolve()}"'
+        if isinstance(build_attr.path, Path)
+        else build_attr.path
+    )
+    r = run_wrapper(
+        [
+            "nix-instantiate",
+            "--eval",
+            "--strict",
+            "--json",
+            "--expr",
+            textwrap.dedent(f"""
+            let
+              value = import {path};
+              set = if builtins.isFunction value then value {{}} else value;
+            in
+              set.{build_attr.to_attr("config.system.build.images", image_variant, "passthru", "filePath")}
+            """),
+            *dict_to_flags(instantiate_flags),
+        ],
+        stdout=PIPE,
+    )
+    j: str = json.loads(r.stdout.strip())
+    return j
+
+
+def get_build_image_name_flake(
+    flake: Flake,
+    image_variant: str,
+    eval_flags: Args | None = None,
+) -> str:
+    r = run_wrapper(
+        [
+            "nix",
+            "eval",
+            "--json",
+            flake.to_attr(
+                "config.system.build.images", image_variant, "passthru", "filePath"
+            ),
+            *dict_to_flags(eval_flags),
+        ],
+        stdout=PIPE,
+    )
+    j: str = json.loads(r.stdout.strip())
+    return j
+
+
 def get_build_image_variants(
     build_attr: BuildAttr,
     instantiate_flags: Args | None = None,
···
               value = import {path};
               set = if builtins.isFunction value then value {{}} else value;
             in
-              builtins.mapAttrs (n: v: v.passthru.filePath) set.{build_attr.to_attr("config.system.build.images")}
+              builtins.attrNames set.{build_attr.to_attr("config.system.build.images")}
             """),
             *dict_to_flags(instantiate_flags),
         ],
···
             "--json",
             flake.to_attr("config.system.build.images"),
             "--apply",
-            "builtins.mapAttrs (n: v: v.passthru.filePath)",
+            "builtins.attrNames",
             *dict_to_flags(eval_flags),
         ],
         stdout=PIPE,

pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py

···
             return CompletedProcess(
                 [],
                 0,
-                """
-                {
-                  "azure": "nixos-image-azure-25.05.20250102.6df2492-x86_64-linux.vhd",
-                  "vmware": "nixos-image-vmware-25.05.20250102.6df2492-x86_64-linux.vmdk"
-                }
-                """,
+                '"nixos-image-azure-25.05.20250102.6df2492-x86_64-linux.vhd"',
             )
         elif args[0] == "nix":
             return CompletedProcess([], 0, str(config_path))
···
         ]
     )
 
-    assert mock_run.call_count == 2
+    assert mock_run.call_count == 3
     mock_run.assert_has_calls(
         [
             call(
···
                     "--json",
                     "/path/to/config#nixosConfigurations.hostname.config.system.build.images",
                     "--apply",
-                    "builtins.mapAttrs (n: v: v.passthru.filePath)",
+                    "builtins.attrNames",
                 ],
                 check=True,
                 stdout=PIPE,
···
                     "build",
                     "--print-out-paths",
                     "/path/to/config#nixosConfigurations.hostname.config.system.build.images.azure",
+                ],
+                check=True,
+                stdout=PIPE,
+                **DEFAULT_RUN_KWARGS,
+            ),
+            call(
+                [
+                    "nix",
+                    "eval",
+                    "--json",
+                    "/path/to/config#nixosConfigurations.hostname.config.system.build.images.azure.passthru.filePath",
                 ],
                 check=True,
                 stdout=PIPE,

pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py

···
               value = import <nixpkgs/nixos>;
               set = if builtins.isFunction value then value {} else value;
             in
-              builtins.mapAttrs (n: v: v.passthru.filePath) set.config.system.build.images
+              builtins.attrNames set.config.system.build.images
             """),
         ],
         stdout=PIPE,
···
               value = import "{tmp_path}";
               set = if builtins.isFunction value then value {{}} else value;
             in
-              builtins.mapAttrs (n: v: v.passthru.filePath) set.preAttr.config.system.build.images
+              builtins.attrNames set.preAttr.config.system.build.images
             """),
             "--inst-flag",
         ],
···
             "--json",
             "flake.nix#myAttr.config.system.build.images",
             "--apply",
-            "builtins.mapAttrs (n: v: v.passthru.filePath)",
+            "builtins.attrNames",
             "--eval-flag",
         ],
         stdout=PIPE,

pkgs/by-name/no/noto-fonts/package.nix

···
 
 stdenvNoCC.mkDerivation rec {
   pname = "noto-fonts${suffix}";
-  version = "2025.03.01";
+  version = "2025.04.01";
 
   src = fetchFromGitHub {
     owner = "notofonts";
     repo = "notofonts.github.io";
     rev = "noto-monthly-release-${version}";
-    hash = "sha256-49p4LFGywuA6zNZEw0VmtykmDUBtRkzOKYAb4sG4fK4=";
+    hash = "sha256-xR3P6RWb1pHdOuCbb+kQXqv3Ip3+2yXAVqeZ+f2M3VU=";
   };
 
   outputs = [

pkgs/by-name/op/openvi/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "openvi";
-  version = "7.6.30";
+  version = "7.6.31";
 
   src = fetchFromGitHub {
     owner = "johnsonjh";
     repo = "OpenVi";
     rev = version;
-    hash = "sha256-P4w/PM9UmHmTzS9+WDK3x3MyZ7OoY2yO/Rx0vRMJuLI=";
+    hash = "sha256-RqmulYHQFZmTHQAYgZmB8tAG6mSquNODmssfKB8YqDU=";
   };
 
   buildInputs = [

pkgs/by-name/pa/pay-respects/package.nix

···
 }:
 rustPlatform.buildRustPackage rec {
   pname = "pay-respects";
-  version = "0.6.14";
+  version = "0.7.0";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "iff";
     repo = "pay-respects";
     rev = "v${version}";
-    hash = "sha256-D6wkLrIzFpCTzOtVD8GcfBAZS48pNAIkTUTw3DRf7ds=";
+    hash = "sha256-xuZkZXVEXSmRGp1huVpqvjrP5kllq3fGg1Mg7wuyE3E=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-QdeU+0o68j5Y0IKouyJ8ypZghuS8NKxCUpmZxi+sxuk=";
+  cargoHash = "sha256-aocFplTvjc3zV6NL6UKzdfdx5ry+jhvi4azceC0KSKA=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/pe/petidomo/package.nix

···
   flex,
   bison,
   sendmailPath ? "/run/wrappers/bin/sendmail",
+  versionCheckHook,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "petidomo";
   version = "4.3";
 
   src = fetchurl {
-    url = "mirror://sourceforge/petidomo/${pname}-${version}.tar.gz";
-    sha256 = "0x4dbxc4fcfg1rw5ywpcypvylnzn3y4rh0m6fz4h4cdnzb8p1lvm";
+    url = "mirror://sourceforge/petidomo/petidomo-${finalAttrs.version}.tar.gz";
+    hash = "sha256-ddNw0fq2MQLJd6YCmIkf9lvq9/Xscl94Ds8xR1hfjXQ=";
   };
 
   buildInputs = [
···
 
   configureFlags = [ "--with-mta=${sendmailPath}" ];
 
+  # test.c:43:11: error: implicit declaration of function 'gets'; did you mean 'fgets'?
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
+
   enableParallelBuilding = true;
 
   doCheck = true;
+
+  doInstallCheck = true;
+  nativeInstallCheck = [ versionCheckHook ];
 
   meta = {
     homepage = "https://petidomo.sourceforge.net/";
···
     platforms = lib.platforms.unix;
     maintainers = [ lib.maintainers.peti ];
   };
-}
+})

pkgs/by-name/po/polarity/package.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "polarity";
-  version = "latest-unstable-2025-03-26";
+  version = "latest-unstable-2025-04-06";
 
   src = fetchFromGitHub {
     owner = "polarity-lang";
     repo = "polarity";
-    rev = "73c91061930cf10002aae4f2dd7ac301af20dfdc";
-    hash = "sha256-EN4xOBIrIrNBd/YQPc1xRagAvCdvEH83shb2axj9xX0=";
+    rev = "3d661ea0485a83b0c1065595839cb2d9d594e4e8";
+    hash = "sha256-4NeDOGzCq211SVVtfISq/Z901Et1zYhMQ/t7eNEBW9Y=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-wpO7JYLjuEbKc/a4WO4KeUxdDCI1BswvgvSH+sFh1V0=";
+  cargoHash = "sha256-S0d64jFKiyGVIFH8HhT4mzBEVUPDIMevvClTeqy0/28=";
 
   passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
 

pkgs/by-name/pq/pq-cli/package.nix

···
 
 python3Packages.buildPythonApplication rec {
   pname = "pq-cli";
-  version = "1.0.2-unstable-2024-07-15";
+  version = "1.0.2-unstable-2025-04-04";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "rr-";
     repo = "pq-cli";
-    rev = "4122e936c87436552f35ff7972d6e543ba6c837b";
-    hash = "sha256-PvHkTjPjOubhl9gfPTF7yNaFgg2GLk8y+PtF09fpaII=";
+    rev = "e6d18352c5874364a7bbb65ad41a198838d907ed";
+    hash = "sha256-gT9vxz4oAtoatG8dUDJbr60yyKhglFrxNe1SQMKilb8=";
   };
 
   build-system = with python3Packages; [

pkgs/by-name/pr/protols/package.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "protols";
-  version = "0.11.1";
+  version = "0.11.5";
 
   src = fetchFromGitHub {
     owner = "coder3101";
     repo = "protols";
     tag = version;
-    hash = "sha256-A2fa1rZvxVpJ6X0s0wTDROarGX5Fxp6zKK9cWiag7TQ=";
+    hash = "sha256-SW7Ef4HRuv1z2QwHqj+S9MO9t4Pi+uDRYFPxb82y4Nc=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Pvz15q9yGqcJecOvDWXQQCEDXuSEJbJyZ8Arj8Xbyh4=";
+  cargoHash = "sha256-bl9N6Kv01QSZAr7BXLNJ2owcwtxP+vhTXUWLAud2npA=";
 
   meta = {
     description = "Protocol Buffers language server written in Rust";

pkgs/by-name/ra/rabbitmqadmin-ng/package.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "rabbitmqadmin-ng";
-  version = "0.29.0";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "rabbitmq";
     repo = "rabbitmqadmin-ng";
     tag = "v${version}";
-    hash = "sha256-EWL1MFBBIsjfkx43SFSxsxjM0/XVYS8O3fYkXWkkctc=";
+    hash = "sha256-M3YaqBwSj/5d936oOVA6JmqWYEU8kDYP+2ImjlOiAqo=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-PShBU5xC9+X1exoIFP64xHWn6oVsID4ZcYMuUq/1vKI=";
+  cargoHash = "sha256-Ik3G9McsFO+NIEBuB9N1HSXeIpULSPTHx4V2ulpgDio=";
 
   buildInputs = [ openssl ];
   nativeBuildInputs = [ pkg-config ];

pkgs/by-name/ra/radicale/package.nix

···
 
 python3.pkgs.buildPythonApplication rec {
   pname = "radicale";
-  version = "3.5.0";
+  version = "3.5.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Kozea";
     repo = "Radicale";
     tag = "v${version}";
-    hash = "sha256-OWOCwioW0TPVk6vIkfVuAaYJdIWJ6Do4NcYWR/b3sQs=";
+    hash = "sha256-CM4ljD2fXwQIiJW135G9cIEO0YNmhbS0Cwiv0EU+Bsk=";
   };
 
   build-system = with python3.pkgs; [
···
       passlib
       vobject
       pika
-      python-dateutil
+      requests
       pytz # https://github.com/Kozea/Radicale/issues/816
       ldap3
     ]

pkgs/by-name/ru/rundeck/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rundeck";
-  version = "5.9.0-20250205";
+  version = "5.10.0-20250312";
 
   src = fetchurl {
     url = "https://packagecloud.io/pagerduty/rundeck/packages/java/org.rundeck/rundeck-${finalAttrs.version}.war/artifacts/rundeck-${finalAttrs.version}.war/download?distro_version_id=167";
-    hash = "sha256-3FDZJMw/ix54mSrMZ56CxibTjnI+6NxmjmKn59TAWtI=";
+    hash = "sha256-BwO7FM1LP0OrjG7opz4qqDuJQdtBmmFtZTtigV99ssE=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/by-name/sd/SDL_ttf/package.nix

···
     (lib.enableFeature enableSdltest "sdltest")
   ];
 
+  env.NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-liconv";
+
   strictDeps = true;
 
   passthru.updateScript = unstableGitUpdater {

pkgs/by-name/se/selinux-refpolicy/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  gnum4,
+  python3,
+  getopt,
+  checkpolicy,
+  policycoreutils,
+  semodule-utils,
+  policyVersion ? null,
+  moduleVersion ? null,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "selinux-refpolicy";
+  version = "2.20250213";
+
+  src = fetchFromGitHub {
+    owner = "SELinuxProject";
+    repo = "refpolicy";
+    tag = "RELEASE_${lib.versions.major finalAttrs.version}_${lib.versions.minor finalAttrs.version}";
+    hash = "sha256-VsQRqigGwSVJ52uqFj1L2xzQqbWwQ/YaFI5Rsn/HbP8=";
+  };
+
+  nativeBuildInputs = [
+    gnum4
+    python3
+    getopt
+  ];
+
+  configurePhase = ''
+    runHook preConfigure
+    make conf ''${makeFlags[@]}
+    runHook postConfigure
+  '';
+
+  makeFlags =
+    [
+      "CHECKPOLICY=${lib.getExe checkpolicy}"
+      "CHECKMODULE=${lib.getExe' checkpolicy "checkmodule"}"
+      "SEMODULE=${lib.getExe' policycoreutils "semodule"}"
+      "SEMOD_PKG=${lib.getExe' semodule-utils "semodule_package"}"
+      "SEMOD_LNK=${lib.getExe' semodule-utils "semodule_link"}"
+      "SEMOD_EXP=${lib.getExe' semodule-utils "semodule_expand"}"
+      "DESTDIR=${placeholder "out"}"
+      "prefix=${placeholder "out"}"
+      "DISTRO=nixos"
+      "SYSTEMD=y"
+      "UBAC=y"
+    ]
+    ++ lib.optional (policyVersion != null) "OUTPUT_POLICY=${toString policyVersion}"
+    ++ lib.optional (moduleVersion != null) "OUTPUT_MODULE=${toString moduleVersion}";
+
+  installTargets = "all install install-headers install-docs";
+
+  meta = {
+    description = "SELinux Reference Policy v2";
+    homepage = "http://userspace.selinuxproject.org";
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ RossComputerGuy ];
+    license = lib.licenses.gpl2Only;
+  };
+})

pkgs/by-name/si/simplex-chat-desktop/package.nix

···
 
 let
   pname = "simplex-chat-desktop";
-  version = "6.3.0";
+  version = "6.3.1";
 
   src = fetchurl {
     url = "https://github.com/simplex-chat/simplex-chat/releases/download/v${version}/simplex-desktop-x86_64.AppImage";
-    hash = "sha256-p2NPBJyAfWkpM6Ws0Xm4Vyt3DIbfl+soYfYfqjV4cY0=";
+    hash = "sha256-jCBCZ5nzA8WxIQFsGpuuyZ1Jmt+PJmqybFHFOUkw9L0=";
   };
 
   appimageContents = appimageTools.extract {

pkgs/by-name/tr/trafficserver/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "trafficserver";
-  version = "9.2.7";
+  version = "9.2.9";
 
   src = fetchzip {
     url = "mirror://apache/trafficserver/trafficserver-${version}.tar.bz2";
-    hash = "sha256-i3UTqOO3gQezL2HmQllJa+hwy03tJViyOOflW2iXBAM=";
+    hash = "sha256-itz7LodhVdevidBb8wbInp/ghDgDEZ/KTI3Ksjbg47A=";
   };
 
   # NOTE: The upstream README indicates that flex is needed for some features,

pkgs/by-name/um/umpire/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "umpire";
-  version = "2024.07.0";
+  version = "2025.03.0";
 
   src = fetchFromGitHub {
     owner = "LLNL";
     repo = "umpire";
     rev = "v${version}";
-    hash = "sha256-JbYaJe4bqlB272aZxB3Amw8fX/pmZr/4/7kaukAiK8c=";
+    hash = "sha256-IL8jfG0qTDjp80E8bniNYUiH77PTtL4QIwMCEkqdwSE=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/wh/whitesur-gtk-theme/package.nix

···
   stdenv.mkDerivation
   rec {
     pname = "whitesur-gtk-theme";
-    version = "2024-11-18";
+    version = "2025-04-03";
 
     src = fetchFromGitHub {
       owner = "vinceliuice";
       repo = pname;
       rev = version;
-      hash = "sha256-SSGb7EdJN8E4N8b98VO7oFTeOmhKEo/0qhso9410ihg=";
+      hash = "sha256-XSghDBpxAjdQMB9tyV2NIM6j/AzmzsnybGGDYi7u3BQ=";
     };
 
     nativeBuildInputs = [

pkgs/by-name/za/zabbix-agent2-plugin-postgresql/package.nix

···
 
 buildGoModule rec {
   pname = "zabbix-agent2-plugin-postgresql";
-  version = "7.2.4";
+  version = "7.2.5";
 
   src = fetchurl {
     url = "https://cdn.zabbix.com/zabbix-agent2-plugins/sources/postgresql/zabbix-agent2-plugin-postgresql-${version}.tar.gz";
-    hash = "sha256-QslDQ45XQ3FjCSRu1cytHVPwJWpIvrxvqC57lCZGMKs=";
+    hash = "sha256-FJf7rjghYe0paIzjzdkiummzPcBFaH7fcfTJ+pTSZUE=";
   };
 
   vendorHash = null;

pkgs/development/interpreters/erlang/generic-builder.nix

···
   odbcSupport ? false,
   odbcPackages ? [ unixODBC ],
   opensslPackage ? openssl,
-  systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemd,
   wxPackages ? [
     libGL
     libGLU

pkgs/development/libraries/wlroots/default.nix

···
   libcap,
   libgbm,
   xorg,
-  libpng,
-  ffmpeg,
   hwdata,
   seatd,
   vulkan-loader,
···
 
       buildInputs =
         [
-          ffmpeg
           libliftoff
           libdisplay-info
           libGL
           libcap
           libinput
-          libpng
           libxkbcommon
           libgbm
           pixman

pkgs/development/python-modules/falconpy/default.nix

···
 
 buildPythonPackage rec {
   pname = "falconpy";
-  version = "1.4.7";
+  version = "1.4.8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "CrowdStrike";
     repo = "falconpy";
     tag = "v${version}";
-    hash = "sha256-Ka1QVDXbUJQjCwGMsvMrItPiE88tgVcuz/iaXhjctSQ=";
+    hash = "sha256-tl/+mYilGFGxq9gJcu9tmm6wenF14gIP0gB+HAXQh0o=";
   };
 
   build-system = [ hatchling ];

pkgs/development/python-modules/pyroaring/default.nix

···
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  cython,
+  setuptools,
+  hypothesis,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "pyroaring";
+  version = "1.0.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "Ezibenroc";
+    repo = "PyRoaringBitMap";
+    tag = version;
+    hash = "sha256-pnANvqyQ5DpG4NWSgWkAkXvSNLO67nfa97nEz3fYf1Y=";
+  };
+
+  build-system = [
+    cython
+    setuptools
+  ];
+
+  pythonImportsCheck = [ "pyroaring" ];
+
+  nativeCheckInputs = [
+    hypothesis
+    pytestCheckHook
+  ];
+
+  meta = {
+    description = "Python library for handling efficiently sorted integer sets";
+    homepage = "https://github.com/Ezibenroc/PyRoaringBitMap";
+    changelog = "https://github.com/Ezibenroc/PyRoaringBitMap/releases/tag/${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ drupol ];
+  };
+}

pkgs/development/python-modules/safetensors/default.nix

···
   fetchFromGitHub,
   rustPlatform,
 
-  # tests
-  h5py,
+  # optional-dependencies
   numpy,
-  pytestCheckHook,
   torch,
+  tensorflow,
+  flax,
+  jax,
+  mlx,
+  paddlepaddle,
+  h5py,
+  huggingface-hub,
+  setuptools-rust,
+  pytest,
+  pytest-benchmark,
+  hypothesis,
+
+  # tests
+  pytestCheckHook,
 }:
 
 buildPythonPackage rec {
···
     rustPlatform.cargoSetupHook
     rustPlatform.maturinBuildHook
   ];
+
+  optional-dependencies = lib.fix (self: {
+    numpy = [ numpy ];
+    torch = self.numpy ++ [
+      torch
+    ];
+    tensorflow = self.numpy ++ [
+      tensorflow
+    ];
+    pinned-tf = self.numpy ++ [
+      tensorflow
+    ];
+    jax = self.numpy ++ [
+      flax
+      jax
+    ];
+    mlx = [
+      mlx
+    ];
+    paddlepaddle = self.numpy ++ [
+      paddlepaddle
+    ];
+    testing = self.numpy ++ [
+      h5py
+      huggingface-hub
+      setuptools-rust
+      pytest
+      pytest-benchmark
+      hypothesis
+    ];
+    all = self.torch ++ self.numpy ++ self.pinned-tf ++ self.jax ++ self.paddlepaddle ++ self.testing;
+    dev = self.all;
+  });
 
   nativeCheckInputs = [
     h5py

pkgs/os-specific/linux/kernel/kernels-org.json

···
 {
     "testing": {
-        "version": "6.14-rc7",
-        "hash": "sha256:0bw3xip9qg4zr42vx28iai954g5a1wprrrkr81zn7x7vv3ayjvya"
+        "version": "6.15-rc1",
+        "hash": "sha256:0kp35q86jihknj5y6f1zspfkhqx0c0npkk3is8p0gf2r3y302cp9"
     },
     "6.1": {
-        "version": "6.1.132",
-        "hash": "sha256:1l5vrc8an6h0fcnfmqb6pmal686imxbllcvlkqah19fg7wnv3dyx"
+        "version": "6.1.133",
+        "hash": "sha256:0w5yb9y0jxrqh1wyajs33mpkcix4752acwra8jbg498r7yprzdcp"
     },
     "5.15": {
         "version": "5.15.179",
···
         "hash": "sha256:0vpgb3lmhgv5iw9b1z0kqr6vdv44if49marfp5858z3a8yj69bdk"
     },
     "6.6": {
-        "version": "6.6.85",
-        "hash": "sha256:0abmgc5rg7hx18ykwsl6xl72gzaf3wbn5bkvh4kcsa1lrbscrfjy"
+        "version": "6.6.86",
+        "hash": "sha256:0s1yy429g70iry559hsfv3plf787bik3kkd0mpx3a1z44dsavqs9"
     },
     "6.12": {
-        "version": "6.12.21",
-        "hash": "sha256:1iyn8qif6xfz04z698ib2dvmam54pyxzsign8sbdj9505sdf66lx"
+        "version": "6.12.22",
+        "hash": "sha256:0dkk6d9ml44q2kr7wd8px8iy3lwgyb2qmbhq4f6sg1crnh580j5b"
     },
     "6.13": {
-        "version": "6.13.9",
-        "hash": "sha256:1ci78x5dfjm3nlv4m2j02wl7ax82l47xwnr4k6j9n4dn53qa7rsk"
+        "version": "6.13.10",
+        "hash": "sha256:08kpzbysnabyjn76nk8f3zqxlsw45wkhw5vafrgr43vj3v1zrwjp"
     },
     "6.14": {
-        "version": "6.14",
-        "hash": "sha256:0w3nqh02vl8f2wsx3fmsvw1pdsnjs5zfqcmv2w2vnqdiwy1vd552"
+        "version": "6.14.1",
+        "hash": "sha256:01z4cf2aivg0bs1i874kqldwxsspg53wvkyfy2nlzmlzhz8j5wav"
     }
 }

pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh

···
                 "let
                     value = import \"$(realpath $buildFile)\";
                     set = if builtins.isFunction value then value {} else value;
-                in builtins.mapAttrs (n: v: v.passthru.filePath) set.${attr:+$attr.}config.system.build.images" \
+                in builtins.attrNames set.${attr:+$attr.}config.system.build.images" \
                 "${extraBuildFlags[@]}"
             )"
         elif [[ -z $flake ]]; then
             variants="$(
                 runCmd nix-instantiate --eval --strict --json --expr \
-                "with import <nixpkgs/nixos> {}; builtins.mapAttrs (n: v: v.passthru.filePath) config.system.build.images" \
+                "with import <nixpkgs/nixos> {}; builtins.attrNames config.system.build.images" \
                 "${extraBuildFlags[@]}"
             )"
         else
             variants="$(
                 runCmd nix "${flakeFlags[@]}" eval --json \
                 "$flake#$flakeAttr.config.system.build.images" \
-                --apply "builtins.mapAttrs (n: v: v.passthru.filePath)" "${evalArgs[@]}" "${extraBuildFlags[@]}"
+                --apply "builtins.attrNames" "${evalArgs[@]}" "${extraBuildFlags[@]}"
             )"
         fi
-        if ! echo "$variants" | jq -e --arg variant "$imageVariant" "keys | any(. == \$variant)" > /dev/null; then
+        if ! echo "$variants" | jq -e --arg variant "$imageVariant" "any(. == \$variant)" > /dev/null; then
             echo -e "Please specify one of the following supported image variants via --image-variant:\n" >&2
-            echo "$variants" | jq -r '. | keys | join ("\n")'
+            echo "$variants" | jq -r 'join ("\n")'
             exit 1
         fi
-        imageName="$(echo "$variants" | jq -r --arg variant "$imageVariant" ".[\$variant]")"
+
+        if [[ -z $buildingAttribute ]]; then
+            imageName="$(
+                runCmd nix-instantiate --eval --strict --json --expr \
+                "let
+                    value = import \"$(realpath $buildFile)\";
+                    set = if builtins.isFunction value then value {} else value;
+                in set.${attr:+$attr.}config.system.build.images.$imageVariant.v.passthru.filePath" \
+                "${extraBuildFlags[@]}"
+            )"
+        elif [[ -z $flake ]]; then
+            imageName="$(
+                runCmd nix-instantiate --eval --strict --json --expr \
+                "with import <nixpkgs/nixos> {}; config.system.build.images.$imageVariant.passthru.filePath" \
+                "${extraBuildFlags[@]}"
+            )"
+        else
+            imageName="$(
+                runCmd nix "${flakeFlags[@]}" eval --json \
+                "$flake#$flakeAttr.config.system.build.images.$imageVariant.passthru.filePath" \
+                "${evalArgs[@]}" "${extraBuildFlags[@]}"
+            )"
+        fi
 
         if [[ -z $buildingAttribute ]]; then
             pathToConfig="$(nixBuild $buildFile -A "${attr:+$attr.}config.system.build.images.${imageVariant}" "${extraBuildFlags[@]}")"

pkgs/servers/mastodon/source.nix

···
   patches ? [ ],
 }:
 let
-  version = "4.3.6";
+  version = "4.3.7";
 in
 (applyPatches {
   src = fetchFromGitHub {
     owner = "mastodon";
     repo = "mastodon";
     rev = "v${version}";
-    hash = "sha256-cTJmSrQ+xlDfrAyHKeiIvrUOgAh9DQT2NNizN8XT3P0=";
+    hash = "sha256-KmeWBMuyJ/ZdZnFXAlpvgXV+J8IZrcaTXvvui4l6mjY=";
   };
   patches = patches ++ [ ];
 })

pkgs/servers/nextcloud/packages/29.json

···
       "agpl"
     ]
   },
+  "twofactor_admin": {
+    "hash": "sha256-zZvH7xfSooKBG4CKvSuf8D/6KnKEunLa+DRLAkWGoow=",
+    "url": "https://github.com/nextcloud-releases/twofactor_admin/releases/download/v4.8.0/twofactor_admin.tar.gz",
+    "version": "4.8.0",
+    "description": "This two-factor auth (2FA) provider for Nextcloud allows admins to generate a one-time\n\t\tcode for users to log into a 2FA protected account. This is helpful in situations where\n\t\tusers have lost access to their other 2FA methods or mandatory 2FA without any previously\n\t\tenabled 2FA provider.",
+    "homepage": "",
+    "licenses": [
+      "agpl"
+    ]
+  },
   "twofactor_nextcloud_notification": {
     "hash": "sha256-4fXWgDeiup5/Gm9hdZDj/u07rp/Nzwly53aLUT/d0IU=",
     "url": "https://github.com/nextcloud-releases/twofactor_nextcloud_notification/releases/download/v3.9.0/twofactor_nextcloud_notification-v3.9.0.tar.gz",

pkgs/servers/nextcloud/packages/30.json

···
       "agpl"
     ]
   },
+  "twofactor_admin": {
+    "hash": "sha256-zZvH7xfSooKBG4CKvSuf8D/6KnKEunLa+DRLAkWGoow=",
+    "url": "https://github.com/nextcloud-releases/twofactor_admin/releases/download/v4.8.0/twofactor_admin.tar.gz",
+    "version": "4.8.0",
+    "description": "This two-factor auth (2FA) provider for Nextcloud allows admins to generate a one-time\n\t\tcode for users to log into a 2FA protected account. This is helpful in situations where\n\t\tusers have lost access to their other 2FA methods or mandatory 2FA without any previously\n\t\tenabled 2FA provider.",
+    "homepage": "",
+    "licenses": [
+      "agpl"
+    ]
+  },
   "twofactor_webauthn": {
     "hash": "sha256-16Silofm/alQaKZ2buNqyLEjKK2kR2IpTAxEawHpGjI=",
     "url": "https://github.com/nextcloud-releases/twofactor_webauthn/releases/download/v2.1.0/twofactor_webauthn-v2.1.0.tar.gz",

pkgs/servers/nextcloud/packages/31.json

···
       "agpl"
     ]
   },
+  "twofactor_admin": {
+    "hash": "sha256-zZvH7xfSooKBG4CKvSuf8D/6KnKEunLa+DRLAkWGoow=",
+    "url": "https://github.com/nextcloud-releases/twofactor_admin/releases/download/v4.8.0/twofactor_admin.tar.gz",
+    "version": "4.8.0",
+    "description": "This two-factor auth (2FA) provider for Nextcloud allows admins to generate a one-time\n\t\tcode for users to log into a 2FA protected account. This is helpful in situations where\n\t\tusers have lost access to their other 2FA methods or mandatory 2FA without any previously\n\t\tenabled 2FA provider.",
+    "homepage": "",
+    "licenses": [
+      "agpl"
+    ]
+  },
   "twofactor_webauthn": {
     "hash": "sha256-16Silofm/alQaKZ2buNqyLEjKK2kR2IpTAxEawHpGjI=",
     "url": "https://github.com/nextcloud-releases/twofactor_webauthn/releases/download/v2.1.0/twofactor_webauthn-v2.1.0.tar.gz",

pkgs/servers/nextcloud/packages/nextcloud-apps.json

···
 , "sociallogin": "agpl3Only"
 , "spreed": "agpl3Plus"
 , "tasks": "agpl3Plus"
+, "twofactor_admin": "agpl3Plus"
 , "twofactor_nextcloud_notification": "agpl3Only"
 , "twofactor_totp": "agpl3Plus"
 , "twofactor_webauthn": "agpl3Plus"

pkgs/top-level/all-packages.nix

···
   beam = callPackage ./beam-packages.nix { };
   beam_minimal = callPackage ./beam-packages.nix {
     beam = beam_minimal;
+    systemdSupport = false;
     wxSupport = false;
   };
 

pkgs/top-level/python-packages.nix

···
 
   pyro5 = callPackage ../development/python-modules/pyro5 { };
 
+  pyroaring = callPackage ../development/python-modules/pyroaring { };
+
   pyrogram = callPackage ../development/python-modules/pyrogram { };
 
   pyroma = callPackage ../development/python-modules/pyroma { };