Merge master into staging-next

maintainers/maintainer-list.nix

···
     githubId = 1699466;
     name = "Michael Peyton Jones";
   };
-  michaelshmitty = {
-    name = "Michael Smith";
-    email = "[e-mail]";
-    github = "michaelshmitty";
-    githubId = 114845;
-  };
   michaelvanstraten = {
     name = "Michael van Straten";
     email = "[e-mail]";

nixos/doc/manual/release-notes/rl-2511.section.md

···
 
 - `services.nextcloud.configureRedis` now defaults to `true` in accordance with upstream recommendations to have caching for file locking. See the [upstream doc](https://docs.nextcloud.com/server/31/admin_manual/configuration_files/files_locking_transactional.html) for further details.
 
+- mate-wayland-session 1.28.4 is now using the default wayfire decorator instead of firedecor, thus `services.xserver.desktopManager.mate.enableWaylandSession` is no longer shipping firedecor. If you are experiencing broken window decorations after upgrade, backup and remove `~/.config/mate/wayfire.ini` and re-login.
+
 - `services.gitea` supports sending notifications with sendmail again. To do this, activate the parameter `services.gitea.mailerUseSendmail` and configure SMTP server.
 
 - Revamp of the ACME certificate acquisication and renewal process to help scale systems with lots (100+) of certificates.

nixos/modules/services/cluster/k3s/default.nix

···
             finalImageTag = "21.1.2-debian-11-r0";
           })
 
-          config.services.k3s.package.airgapImages
+          config.services.k3s.package.airgap-images
         ]
       '';
       description = ''

nixos/modules/services/web-apps/anuko-time-tracker.nix

···
     };
   };
 
-  meta.maintainers = with lib.maintainers; [ michaelshmitty ];
+  meta.maintainers = with lib.maintainers; [ ];
 }

nixos/modules/services/x11/desktop-managers/mate.nix

···
     })
     (mkIf cfg.enableWaylandSession {
       programs.wayfire.enable = true;
-      programs.wayfire.plugins = [ pkgs.wayfirePlugins.firedecor ];
 
       environment.sessionVariables.NIX_GSETTINGS_OVERRIDES_DIR = "${pkgs.mate.mate-gsettings-overrides}/share/gsettings-schemas/nixos-gsettings-overrides/glib-2.0/schemas";
 

nixos/tests/anuko-time-tracker.nix

···
 {
   name = "anuko-time-tracker";
   meta = {
-    maintainers = with pkgs.lib.maintainers; [ michaelshmitty ];
+    maintainers = with pkgs.lib.maintainers; [ ];
   };
   nodes = {
     machine = {

nixos/tests/k3s/auto-deploy-charts.nix

···
           ];
           images = [
             # Provides the k3s Helm controller
-            k3s.airgapImages
+            k3s.airgap-images
             testImage
           ];
           autoDeployCharts = {

nixos/tests/mate-wayland.nix

···
           machine.succeed(f"{cmd} | grep 'SSH_AUTH_SOCK' | grep 'gcr'")
 
       with subtest("Check if Wayfire config is properly configured"):
-          for i in ["button_style = mate", "firedecor", "mate-wayland-components.sh"]:
+          for i in ["autostart_wf_shell = false", "mate-wayland-components.sh"]:
               machine.wait_until_succeeds(f"cat /home/${user.name}/.config/mate/wayfire.ini | grep '{i}'")
 
       with subtest("Check if Wayfire has ever coredumped"):

pkgs/applications/editors/vscode/extensions/biomejs.biome/default.nix

···
+{
+  lib,
+  vscode-utils,
+  jq,
+  biome,
+  moreutils,
+  vscode-extension-update-script,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "biome";
+    publisher = "biomejs";
+    version = "2025.7.41733";
+    hash = "sha256-wWyLIjNOBjIe72ed+wwfQWGH7Vzuea/0Xux0XJkhAkY=";
+  };
+
+  postInstall = ''
+    cd "$out/$installPrefix"
+    ${lib.getExe jq} '.contributes.configuration.properties."biome.lsp.bin".oneOf[0].default = "${lib.getExe biome}"' package.json | ${lib.getExe' moreutils "sponge"} package.json
+  '';
+
+  passthru.updateScript = vscode-extension-update-script {
+    extraArgs = [ "--pre-release" ];
+  };
+
+  meta = {
+    changelog = "https://github.com/biomejs/biome-vscode/blob/main/CHANGELOG.md";
+    description = "Biome LSP extension for Visual Studio Code";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=biomejs.biome";
+    homepage = "https://github.com/biomejs/biome-vscode";
+    license = with lib.licenses; [
+      mit
+      # or
+      asl20
+    ];
+    maintainers = [ ];
+  };
+}

pkgs/applications/editors/vscode/extensions/default.nix

···
         };
       };
 
-      biomejs.biome = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "biome";
-          publisher = "biomejs";
-          version = "2025.2.72227";
-          hash = "sha256-Lj5+Vy8IbU70y6ee42cjxyz/mwpIAhWSF4KtL9OYo2Q=";
-        };
-        meta = {
-          changelog = "https://github.com/biomejs/biome-vscode/blob/main/CHANGELOG.md";
-          description = "Biome LSP extension for Visual Studio Code";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=biomejs.biome";
-          homepage = "https://github.com/biomejs/biome-vscode";
-          license = with lib.licenses; [
-            mit
-            # or
-            asl20
-          ];
-          maintainers = [ ];
-        };
-      };
+      biomejs.biome = callPackage ./biomejs.biome { };
 
       bmalehorn.vscode-fish = buildVscodeMarketplaceExtension {
         mktplcRef = {
···
         };
       };
 
-      richie5um2.snake-trail = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "snake-trail";
-          publisher = "richie5um2";
-          version = "0.6.0";
-          sha256 = "0wkpq9f48hplrgabb0v1ij6fc4sb8h4a93dagw4biprhnnm3qx49";
-        };
-        meta = {
-          license = lib.licenses.mit;
-        };
-      };
-
       rioj7.commandonallfiles = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "commandOnAllFiles";
···
     ms-vscode.go = throw "ms-vscode.go is deprecated in favor of golang.go"; # Added 2024-05-29
     ms-vscode.PowerShell = throw "ms-vscode.PowerShell is deprecated in favor of super.ms-vscode.powershell"; # Added 2024-05-29
     ms-vscode.theme-tomorrowkit = throw "ms-vscode.theme-tomorrowkit is deprecated"; # Added 2025-08-30
+    richie5um2.snake-trail = throw "richie5um2.snake-trail is deprecated"; # Added 2025-09-04
     rioj7.commandOnAllFiles = throw "rioj7.commandOnAllFiles is deprecated in favor of rioj7.commandonallfiles"; # Added 2024-05-29
     WakaTime.vscode-wakatime = throw "WakaTime.vscode-wakatime is deprecated in favor of wakatime.vscode-wakatime"; # Added 2024-05-29
   };

pkgs/applications/misc/whalebird/default.nix

···
   makeDesktopItem,
   copyDesktopItems,
   makeWrapper,
-  electron,
-  cacert,
-  gitMinimal,
-  yarn,
+  electron_37,
+  yarn-berry,
+  writableTmpDirAsHomeHook,
 }:
-stdenv.mkDerivation rec {
+
+let
+  electron = electron_37;
+in
+stdenv.mkDerivation (finalAttrs: {
   pname = "whalebird";
-  version = "6.2.2-unstable-2025-06-12";
+  version = "6.2.4";
 
   src = fetchFromGitHub {
     owner = "h3poteto";
     repo = "whalebird-desktop";
-    rev = "506a1ff00188f04bffeaede0110719512c621b02";
-    hash = "sha256-jkdGwdNcF4Rbivi0TziW/ZOficbXIrxqaB+kQrNcdsc=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-0wXfyRmCDkirYgSXUuvrIkQ2yRnVRWMoyyqifIF5VU4=";
   };
-  # we cannot use fetchYarnDeps because that doesn't support yarn 2/berry lockfiles
-  offlineCache = stdenv.mkDerivation {
-    name = "whalebird-${version}-offline-cache";
-    inherit src;
 
-    nativeBuildInputs = [
-      cacert # needed for git
-      gitMinimal # needed to download git dependencies
-      yarn
-    ];
+  missingHashes = ./missing-hashes.json;
 
-    buildPhase = ''
-      export HOME=$(mktemp -d)
-      yarn config set enableTelemetry 0
-      yarn config set cacheFolder $out
-      yarn config set --json supportedArchitectures.os '[ "linux" ]'
-      yarn config set --json supportedArchitectures.cpu '[ "arm64", "x64" ]'
-      yarn
-    '';
+  offlineCache = yarn-berry.fetchYarnBerryDeps {
+    inherit (finalAttrs) src missingHashes;
+    hash = "sha256-vwSVd+ttQFeXEsRsh9jmHKouyqkHeosy0Z/LMb4pzeI=";
+  };
 
-    outputHashMode = "recursive";
-    outputHash = "sha256-Lru6utVP1uHpHvL8Jg/JzEnIErsxVo7njJhsqkThktk=";
-  };
+  postPatch = ''
+    sed -i "/module.exports = {/a \  typescript: {\n    ignoreBuildErrors: true,\n  }," renderer/next.config.js
+  '';
 
   nativeBuildInputs = [
     makeWrapper
     copyDesktopItems
-    yarn
+    yarn-berry
+    yarn-berry.yarnBerryConfigHook
+    writableTmpDirAsHomeHook
   ];
 
   desktopItems = [
     (makeDesktopItem {
       desktopName = "Whalebird";
-      comment = meta.description;
+      comment = finalAttrs.meta.description;
       categories = [ "Network" ];
       exec = "whalebird";
       icon = "whalebird";
···
     })
   ];
 
-  ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
 
   buildPhase = ''
     runHook preBuild
 
-    export HOME=$(mktemp -d)
-    yarn config set enableTelemetry 0
-    yarn config set cacheFolder ${offlineCache}
-
-    yarn --immutable-cache
-    yarn run nextron build --no-pack
-    yarn run electron-builder --dir \
+    yarn exec nextron build --no-pack
+    yarn exec electron-builder --dir \
+      --linux \
+      -p never \
       --config electron-builder.yml \
       -c.electronDist="${electron.dist}" \
       -c.electronVersion=${electron.version}
···
 
     mkdir -p $out/opt
     cp -r ./dist/*-unpacked $out/opt/Whalebird
-
-    # Install icons
-    # Taken from https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=whalebird#n41
+  ''
+  # Install icons
+  # Taken from https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=whalebird#n41
+  + ''
     for i in 16 32 128 256 512; do
       install -Dm644 "resources/icons/icon.iconset/icon_$i"x"$i.png" \
         "$out/share/icons/hicolor/$i"x"$i/apps/whalebird.png"
···
 
     makeWrapper "${electron}/bin/electron" "$out/bin/whalebird" \
       --add-flags "$out/opt/Whalebird/resources/app.asar" \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}"
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true --wayland-text-input-version=3}}"
 
     runHook postInstall
   '';
···
     description = "Single-column Fediverse client for desktop";
     mainProgram = "whalebird";
     homepage = "https://whalebird.social";
-    changelog = "https://github.com/h3poteto/whalebird-desktop/releases/tag/v${version}";
+    changelog = "https://github.com/h3poteto/whalebird-desktop/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ weathercold ];
     platforms = [
···
       "aarch64-linux"
     ];
   };
-}
+})

pkgs/applications/misc/whalebird/missing-hashes.json

···
+{
+    "@next/swc-darwin-arm64@npm:14.2.29": "34800ea408d4025e6dd87e9b9b14ffff8c881cd3566f23f71dccaf9be3c7637a040fe5d5192970f04bc66630415c208856d129800ac017dc03978bb6c4211892",
+    "@next/swc-darwin-x64@npm:14.2.29": "608a86eaff1a683464eda5bab2877a9a51cd0b3b5b28cc9ff0978a940c887451feb1e4da46d509c1a75e125e367214015e895180b2cd3600b90a6db2a66849e6",
+    "@next/swc-linux-arm64-gnu@npm:14.2.29": "2b6dcbfeb9952cd8217503becf73b6899611f8301bbd3ebb5da14f209022fe8dfbeda8724e698c76bd14bcd8db3e58a7abd65d943806b0339502e66d8869ed1c",
+    "@next/swc-linux-arm64-musl@npm:14.2.29": "8fa07a16776a7a9ba70fb08540494b02874dff066af67010fc8681e8eedf0c9c3d2199719a1629dae55d487bb9143843772a39e32472b435512546013dd25bc1",
+    "@next/swc-linux-x64-gnu@npm:14.2.29": "0172a1d5b75d84109a500abb4ea1d2827ec9e71ba3b3101b5899380cf1ec6aa7919922027cb0e288cd31de5f5bb04da4b9ce2897a9e1273be6105d0283bbf750",
+    "@next/swc-linux-x64-musl@npm:14.2.29": "fea65e83d1d2b06f5f00c41f26919cd8db94372f7faf57f515ba882936adde2f6b42e5da0db88681a91326ab90454561afdcb41185be5d6bb9e0309d55aa3d8a",
+    "@next/swc-win32-arm64-msvc@npm:14.2.29": "143a5751877a4475ff06e24d8c5c98db1515ddc8cb04dd62ad4d657ca856766ed39793243169961b0b68db5454c2220b23e17e9dd12c9dee66a637943624249e",
+    "@next/swc-win32-ia32-msvc@npm:14.2.29": "a77da58ed7352144ad9d1929d2356898d6aebfdafa5796b8381900ebd25e7faa1dfdf4e8ce4b1aa056aa459941ee61a0c59eb1b871d1f39d24405e9d46592070",
+    "@next/swc-win32-x64-msvc@npm:14.2.29": "35a492be5e597bfed81eca677321ba37676b271dcd5c47d2e1411c3310bed485fdeeaee303da41dc194d18394d4053667fe7e3ba02e7e327dae9f99a1b19b743",
+    "@parcel/watcher-android-arm64@npm:2.5.0": "aaa9d1cae932f081e331f506200c9d4dd8ceaebfbbfbc5868f7c76cf4b7259403e9c8128ee26a68d24cc4ca6f5f683830f4895f8aa8eb014e9582a5af0c608e1",
+    "@parcel/watcher-darwin-arm64@npm:2.5.0": "3b43e993a3f5a68c48a2a80302443ab079ca380d94d11c09ec731bc0aa74776bf9e1360e8371850ebae136f317f62a7d546c7e53de315ea3fd5d3ffa3bf5d690",
+    "@parcel/watcher-darwin-x64@npm:2.5.0": "ff642c65a251be601b9ed72618956a4cb6cac8ffed5db1eaceab2607ee74d0161b9f15c333b3b8d440526ea5795f3ef762cf4e3bf26f21a3f82fe8e4bec7dd9f",
+    "@parcel/watcher-freebsd-x64@npm:2.5.0": "33ce8bce2afe0a4dacba9aadf322346292a5a80f79ffb49f2ba1f9ed13a8124e10f8fac5eff6e556f956077404c68834d40fbbb52e351f90c9c459d51be67bec",
+    "@parcel/watcher-linux-arm-glibc@npm:2.5.0": "fff5f8f1628bdfcd8fd5ec6567ef544b9377b34a7bf42bf7c65cd6f66835e77d7c09a395576ca1e7e1c59a9de5499d88b7e61f3cf28cd4f18bd3507ddf3ba083",
+    "@parcel/watcher-linux-arm-musl@npm:2.5.0": "d40314d3e4e3381df0e33e4aeafa398ad7d1e0ed553b1aa3fbfeda6868041070ca3998caaa8f82e8549db8c6276e7532c0e18c21bc616c5c166ef38c0a1d0ab9",
+    "@parcel/watcher-linux-arm64-glibc@npm:2.5.0": "2ac244de308be96dda7e080aa57cfd35ca90c4ecd27992c291e8428c5d343e77f2e30872306d1493171687143bbe9a61a3ba4cbb500002a4931fc4ccc52363fa",
+    "@parcel/watcher-linux-arm64-musl@npm:2.5.0": "7b233f9e19358f41ecbf1ca5d5ef003435b88689c4cbd56cf9e31d1cfb34647fde38e333fb07b997fb3908878a898043bbc725c9483fe2d1a93c17a0d4527f93",
+    "@parcel/watcher-linux-x64-glibc@npm:2.5.0": "9797ab32ac241966b5396e95b9489d912c905b863ca42a964373d73db59e594d020810a1784b76b8b456018bb5774d43a778f0c33083ba0ada4c5a11cf7855e6",
+    "@parcel/watcher-linux-x64-musl@npm:2.5.0": "42a75104cae0fb6f208d644ee16a0f21e8cb3b288ff041899eda116f475f07a657427439b1c9e2d1318806c42cb0c0e342df6b87f9e0e00d2bbbf4df041122bf",
+    "@parcel/watcher-win32-arm64@npm:2.5.0": "bc7e902a2e26824d9bfce9bd16de997d3ae900b03433b70f24eaff264a9279910e1a430eb77b07a72597494ecfa89bd87fe4b7c10e3169c51ccc7b9ebc813e3e",
+    "@parcel/watcher-win32-ia32@npm:2.5.0": "915963497eb35a1a3e71a1b8d1aac851d231743955b53c8a7eaf2cb77dec99a21a285397349dd6a488e6305c01311b57ee1bae897ee7016c0d40fceaf2b2af16",
+    "@parcel/watcher-win32-x64@npm:2.5.0": "fd764a09afa89a5e0e50eb610920cf4982b1cb3ec04ca68348c0503b66af6eefd4942f1130276b928d94be6699d72607a46fab9586a800a4394eee05ee1b7b4c",
+    "dmg-license@npm:1.0.11": "36c0a7b030801b91216affa9b2bb00caa345b2327f298accb2263a80a0320ca305f90b99da68007d187c830c543410d58a0a2bbc229e8d169b0e1d1652ff42aa",
+    "iconv-corefoundation@npm:1.1.7": "0189733ef51a9f481379202cb1919f2677efc44aa014ba662a6fd99e47993e350eab0ff724ed18cda8011c9b78c4702b2d374f732955f1def3fd2a14a29d25c0"
+}

pkgs/applications/networking/instant-messengers/discord/default.nix

···
       {
         stable = "0.0.107";
         ptb = "0.0.158";
-        canary = "0.0.745";
+        canary = "0.0.748";
         development = "0.0.84";
       }
     else
···
       };
       canary = fetchurl {
         url = "https://canary.dl2.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-6vo7vevxzVyZpLWBbTPS94wQU3pQtrMsxc91S02M42M=";
+        hash = "sha256-kjq8liiC/Op+Ik+r9RSl/tPLDlWiUyIb3cOjAxWpkO0=";
       };
       development = fetchurl {
         url = "https://development.dl2.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";

pkgs/applications/networking/syncthing/default.nix

···
     }:
     buildGoModule rec {
       pname = stname;
-      version = "2.0.3";
+      version = "2.0.6";
 
       src = fetchFromGitHub {
         owner = "syncthing";
         repo = "syncthing";
         tag = "v${version}";
-        hash = "sha256-s5kW7FJfLSTezG/PvRGEoBBlMhYUoszpduKFKlnCcaU=";
+        hash = "sha256-BHrZJSNuq4PZI6fgbTCfo2hXUmXW/C0TvWzZRkoiaFU=";
       };
 
-      vendorHash = "sha256-Ws++TwmOcWe1ArRuQzIgEIUCHGC30LU4Y4zYUrBkpmA=";
+      vendorHash = "sha256-iYTAnEy0MqJaTz/cdpteealyviwVrpwDzVigo8nnXqs=";
 
       nativeBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
         # Recent versions of macOS seem to require binaries to be signed when

pkgs/applications/window-managers/wayfire/firedecor.nix

···
-{
-  stdenv,
-  lib,
-  fetchFromGitHub,
-  meson,
-  ninja,
-  pkg-config,
-  boost,
-  glib,
-  libGL,
-  libinput,
-  librsvg,
-  libxkbcommon,
-  udev,
-  wayfire,
-  xcbutilwm,
-  mate,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "firedecor";
-  version = "2023-10-23";
-
-  src = fetchFromGitHub {
-    owner = "mntmn";
-    repo = "Firedecor";
-    rev = finalAttrs.version;
-    hash = "sha256-7or8HkmIZnLpXEZzUhJ3u8SIPfIQFgn32Ju/5OzK06Y=";
-  };
-
-  nativeBuildInputs = [
-    meson
-    ninja
-    pkg-config
-  ];
-
-  buildInputs = [
-    boost
-    glib
-    libGL
-    libinput
-    librsvg
-    libxkbcommon
-    udev
-    wayfire
-    xcbutilwm
-  ];
-
-  postPatch = ''
-    substituteInPlace src/firedecor-theme.cpp \
-      --replace-fail "/usr/share" "/run/current-system/sw/share"
-  '';
-
-  env = {
-    PKG_CONFIG_WAYFIRE_PLUGINDIR = "${placeholder "out"}/lib/wayfire";
-    PKG_CONFIG_WAYFIRE_METADATADIR = "${placeholder "out"}/share/wayfire/metadata";
-  };
-
-  meta = with lib; {
-    homepage = "https://github.com/mntmn/Firedecor";
-    description = "Advanced window decoration plugin for the Wayfire window manager";
-    license = licenses.mit;
-    inherit (mate.mate-wayland-session.meta) teams;
-    inherit (wayfire.meta) platforms;
-  };
-})

pkgs/applications/window-managers/wayfire/plugins.nix

···
-{ lib, pkgs }:
+{
+  config,
+  lib,
+  pkgs,
+}:
 
 lib.makeScope pkgs.newScope (
   self:
···
     inherit (self) callPackage;
   in
   {
-    firedecor = callPackage ./firedecor.nix { };
     focus-request = callPackage ./focus-request.nix { };
     wayfire-plugins-extra = callPackage ./wayfire-plugins-extra.nix { };
     wayfire-shadows = callPackage ./wayfire-shadows.nix { };
···
     wwp-switcher = callPackage ./wwp-switcher.nix { };
   }
 )
+// lib.optionalAttrs config.allowAliases {
+  firedecor = throw "wayfirePlugins.firedecor has been removed as it is unmaintained and no longer used by mate-wayland-session."; # Added 2025-09-03
+}

pkgs/by-name/am/amiberry/package.nix

···
     description = "Optimized Amiga emulator for Linux/macOS";
     license = licenses.gpl3;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ michaelshmitty ];
+    maintainers = with maintainers; [ ];
     mainProgram = "amiberry";
   };
 })

pkgs/by-name/an/anuko-time-tracker/package.nix

···
     license = lib.licenses.sspl;
     homepage = "https://github.com/anuko/timetracker/";
     platforms = php.meta.platforms;
-    maintainers = with lib.maintainers; [ michaelshmitty ];
+    maintainers = with lib.maintainers; [ ];
   };
 }

pkgs/by-name/ap/appium-inspector/package.nix

···
 
 let
   electron = electron_36;
-  version = "2025.7.3";
+  version = "2025.8.2";
 in
 
 buildNpmPackage {
···
     owner = "appium";
     repo = "appium-inspector";
     tag = "v${version}";
-    hash = "sha256-KOZD/KfEG9muNEIxqgedZe9ftvFbBsPjvtwt1yb1gWc=";
+    hash = "sha256-v3UN58dJ+rSdFx+99xRMI88gnJ/hgL48Lr7AMjNgXMY=";
   };
 
-  npmDepsHash = "sha256-XJg0y4d1GgCvlq1YEQpPOIkwkpv6GbeAE32cxwj7gZ0=";
+  npmDepsHash = "sha256-rlmAZyznoLSudAf7k1mgf13CO+9mlDB3HhubPga+30Q=";
   npmFlags = [ "--ignore-scripts" ];
 
   nativeBuildInputs = [

pkgs/by-name/ch/chess-tui/package.nix

···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "chess-tui";
-  version = "1.6.1";
+  version = "1.6.2";
 
   src = fetchFromGitHub {
     owner = "thomas-mauran";
     repo = "chess-tui";
     tag = finalAttrs.version;
-    hash = "sha256-L7SaWNSS5tn8OyKTPixTtlMB+OmVd9I0VXtasQMI5GI=";
+    hash = "sha256-OGzYxFGHSH1X8Q8dcB35on/2D+sc0e+chtgObOWUGGM=";
   };
 
-  cargoHash = "sha256-u3Di/vTKbyehmNbTlMZPNRejgK9jYROQv8qdz2XT4Bs=";
+  cargoHash = "sha256-JfX2JWQVrVvq/P/rFumO9QAeJSTxXIKXJxjXmvl1y+g=";
 
   checkFlags = [
     # assertion failed: result.is_ok()

pkgs/by-name/co/cotp/package.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "cotp";
-  version = "1.9.6";
+  version = "1.9.7";
 
   src = fetchFromGitHub {
     owner = "replydev";
     repo = "cotp";
     rev = "v${version}";
-    hash = "sha256-bbmxnzCUvhZ7rjaqbFCB+Qqx3EfY/W8OKhMNlt6KQ64=";
+    hash = "sha256-N3UPeEc3xPIRHt1lOwd8c7e61jZk3PPo3sC/7BQBosY=";
   };
 
-  cargoHash = "sha256-pWgHwqU/xbD5aA2ZCuI7PaImmdojHATgZ+SVSwjnqbk=";
+  cargoHash = "sha256-3IJV7X3G12+ca723sDhOn4SN9CeqKPzGs59IQBYS5QY=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ libxcb ];
 

pkgs/by-name/cs/csvlens/package.nix

···
   lib,
   rustPlatform,
   fetchFromGitHub,
-  fetchpatch2,
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "csvlens";
-  version = "0.12.0";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "YS-L";
     repo = "csvlens";
     tag = "v${version}";
-    hash = "sha256-kyUfpZaOpLP8nGrXH8t9cOutXFkZsmZnPmIu3t6uaWU=";
+    hash = "sha256-8NEZH+a1HBQ7lVcJlIEaeDjFU8c+4Zm6JOe0IiK0nIU=";
   };
 
-  patches = [
-    (fetchpatch2 {
-      # https://github.com/YS-L/csvlens/pull/129
-      name = "fix-flaky-test.patch";
-      url = "https://github.com/YS-L/csvlens/commit/8544e9d4179eef10e8d1a625a41c0e1ef3eb188b.patch";
-      hash = "sha256-j02H+R14Hfm7ZEHFPRGqTY/GEzj5ETXp72kk7os9Zso=";
-    })
-  ];
-
-  cargoHash = "sha256-lr1pqFodqgsKHRFGonXj0nG4elomiSMETulBdCLMR3w=";
+  cargoHash = "sha256-ro+vlkuX2eZ6Sh8uW/0ZZJnl8YqW7Yij+6xneQMDpEQ=";
 
   meta = with lib; {
     description = "Command line csv viewer";

pkgs/by-name/db/dbcsr/package.nix

···
       --replace 'COMMAND ''${Python_EXECUTABLE} ''${FYPP_EXECUTABLE}' 'COMMAND ''${FYPP_EXECUTABLE}'
   '';
 
+  outputs = [
+    "out"
+    "dev"
+  ];
+
   nativeBuildInputs = [
     gfortran
     python3

pkgs/by-name/e-/e-imzo/package.nix

···
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "e-imzo";
-  version = "4.71";
+  version = "4.73";
 
   src = fetchurl {
-    url = "https://dls.yt.uz/E-IMZO-v${finalAttrs.version}.tar.gz";
-    hash = "sha256-sV/xcUaBSqJw0QHkXcbkn5nsm2iL3zTt0Uoa2O/H64A=";
+    url = "https://cdn.xinux.uz/e-imzo/E-IMZO-v${finalAttrs.version}.tar.gz";
+    hash = "sha256-pkBpU0pyI1kmISNShhB17psLHmTZn3JdHbnRZCgLuGc==";
   };
 
   installPhase = ''

pkgs/by-name/ee/ee/package.nix

···
+{
+  lib,
+  stdenv,
+  nix-update-script,
+  fetchgit,
+  ncurses,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "ee";
+  version = "1.5.2";
+
+  src = fetchgit {
+    url = "https://git.freebsd.org/src.git";
+    tag = "release/14.3.0";
+    outputHash = "sha256-nMhHXeoam9VtUuhhi0eoGZfcW9zZhpYQKVYbkAbfgc0=";
+    rootDir = "contrib/ee";
+  };
+
+  passthru.updateScript = nix-update-script { };
+
+  buildInputs = [ ncurses ];
+
+  postPatch = ''
+    substituteInPlace create.make --replace-fail "/usr/include/curses.h" "${ncurses.dev}/include/ncurses.h"
+    substituteInPlace create.make --replace-fail "-lcurses" "-lncurses"
+  '';
+
+  NIX_CFLAGS_COMPILE = "-DHAS_UNISTD=1 -DHAS_STDLIB=1 -DHAS_SYS_WAIT=1";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp ee $out/bin/ee
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "classic curses text editor";
+    homepage = "https://man.freebsd.org/cgi/man.cgi?ee";
+    longDescription = ''
+      An easy to use text editor. Intended to be usable with little or no
+      instruction. Provides a terminal (curses based) interface. Features
+      pop-up menus. Born in HP-UX, included in FreeBSD.
+    '';
+    license = lib.licenses.bsd2;
+    platforms = lib.platforms.unix;
+    mainProgram = "ee";
+  };
+})

pkgs/by-name/en/envoy-bin/package.nix

···
   versionCheckHook,
 }:
 let
-  version = "1.35.1";
+  version = "1.35.2";
   inherit (stdenv.hostPlatform) system;
   throwSystem = throw "envoy-bin is not available for ${system}.";
 
···
 
   hash =
     {
-      aarch64-linux = "sha256-tIBXnm6bGdA6tlYFL+aDf1bOjlUVof0MDNDpFi0tcbE=";
-      x86_64-linux = "sha256-emAbbVhEw0MA21rPxQD/z/p3yVuDi5JZg1yjuRkkmlo=";
+      aarch64-linux = "sha256-XfV0d4l8yTsEF9hDXAFnd0wgtu+Hm6VaEfPfXHF9wdE=";
+      x86_64-linux = "sha256-6Uo9Gya7lpkb5GAiB8yxIX81Yw1BWurBUF1ooDuJc9w=";
     }
     .${system} or throwSystem;
 in
···
     description = "Cloud-native edge and service proxy";
     license = lib.licenses.asl20;
     sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
-    maintainers = with lib.maintainers; [
-      adamcstephens
-    ];
+    maintainers = with lib.maintainers; [ katexochen ];
     mainProgram = "envoy";
     platforms = [
       "x86_64-linux"

pkgs/by-name/en/envoy-bin/update.sh

···
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl gnused gawk nix-prefetch common-updater-scripts jq
+#!nix-shell -i bash -p common-updater-scripts coreutils gnused ripgrep
 
 set -euo pipefail
 
 ROOT="$(dirname "$(readlink -f "$0")")"
 NIX_DRV="$ROOT/package.nix"
 if [ ! -f "$NIX_DRV" ]; then
-    echo "ERROR: cannot find package.nix in $ROOT"
-    exit 1
+  echo "ERROR: cannot find package.nix in $ROOT"
+  exit 1
 fi
 
 fetch_arch() {
-    VER="$1"
-    ARCH="$2"
-    URL="https://github.com/envoyproxy/envoy/releases/download/v${VER}/envoy-${VER}-linux-${ARCH}"
-    nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 "$(nix-prefetch-url --type sha256 "$URL")"
+  VER="$1"
+  ARCH="$2"
+  URL="https://github.com/envoyproxy/envoy/releases/download/v${VER}/envoy-${VER}-linux-${ARCH}"
+  nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 "$(nix-prefetch-url --type sha256 "$URL")"
 }
 
 replace_hash() {
-    sed -i "s#$1 = \"sha256-.\{44\}\"#$1 = \"$2\"#" "$NIX_DRV"
+  sed -i "s#$1 = \"sha256-.\{44\}\"#$1 = \"$2\"#" "$NIX_DRV"
 }
 
 VER=$(list-git-tags --url=https://github.com/envoyproxy/envoy | rg 'v[0-9\.]*$' | sed -e 's/^v//' | sort -V | tail -n 1)

pkgs/by-name/fu/fuzzel/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fuzzel";
-  version = "1.13.0";
+  version = "1.13.1";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "dnkl";
     repo = "fuzzel";
     rev = finalAttrs.version;
-    hash = "sha256-sZycvHoKn9i+360XxDOEhieLEeicSiAqWVUJFb/VK4Y=";
+    hash = "sha256-JW6MvLXax7taJfBjJjRkEKCczzO4AYsQ47akJK2pkh0=";
   };
 
   depsBuildBuild = [

pkgs/by-name/hy/hyfetch/package.nix

···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "hyfetch";
-  version = "2.0.1";
+  version = "2.0.2";
 
   src = fetchFromGitHub {
     owner = "hykilpikonna";
     repo = "hyfetch";
     tag = finalAttrs.version;
-    hash = "sha256-OaMwUTBBpFrco2Wcodb7+3ywdD5bXDebBFEoJYsgAbE=";
+    hash = "sha256-Y9v2vrpTPlsgFRoo33NDVoyQSgUD/stKQLJXzUxFesA=";
   };
 
-  cargoHash = "sha256-xm8q4EG7qfaz/Ru/FVRiWIQW2Tjh9Ar0MquVQVLDSRA=";
+  cargoHash = "sha256-auOeH/1KtxS7a1APOtCMwNTdEQ976BL/jEKj2ADaakQ=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/ka/kanidm/1_6.nix pkgs/servers/kanidm/1_6.nix

···
   version = "1.6.4";
   hash = "sha256-ui3w1HDHXHARsjQ3WtJfZbM7Xgg3ODnUneXJMQwaOMw=";
   cargoHash = "sha256-KJGELBzScwsLd6g3GR9Vk0nfDU2EjZBfXwlXJ+bZb1k=";
-  eolDate = "2025-09-01";
+  unsupported = true;
 }

pkgs/by-name/ka/kanidm/README.md pkgs/servers/kanidm/README.md

···
 
 ### Update default
 
-1. `sed -i 's/1_4/1_5/' pkgs/by-name/ka/kanidm/package.nix`
-1. Update `all-packages.nix` and set `kanidmWithSecretProvisioning = kanidmWithSecretProvisioning_1_5;`
+1. Update kanidm aliases in `aliases.nix`. Should remove completely after 25.11 branch off.
 1. Create commit `kanidm: update default to 1.5.0`
 
 ### Backport to stable

pkgs/by-name/ka/kanidm/package.nix

···
-import ./1_6.nix

pkgs/by-name/lo/log4brains/0001-replace-version-check-using-package.json.patch

···
+From 6a8571098024d1eb69efaae1f1622b3a91417b5f Mon Sep 17 00:00:00 2001
+From: tropf <[e-mail]>
+Date: Tue, 26 Aug 2025 15:08:07 +0200
+Subject: [PATCH 1/2] replace version check using package.json
+
+In the distributed (nix) version, package.json is not available under
+the expected path. As nix can inject the version during build time, this
+patch removes the reference to package.json, and injects a marker for
+the version to be replaced during the patchPhase.
+---
+ packages/web/nextjs/next.config.js | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/packages/web/nextjs/next.config.js b/packages/web/nextjs/next.config.js
+index 9b2b364..db9d680 100644
+--- a/packages/web/nextjs/next.config.js
++++ b/packages/web/nextjs/next.config.js
+@@ -5,10 +5,6 @@ const withBundleAnalyzer = require("@next/bundle-analyzer")({
+   enabled: process.env.ANALYZE === "true"
+ });
+ 
+-const packageJson = require(`${
+-  fs.existsSync(path.join(__dirname, "package.json")) ? "./" : "../"
+-}package.json`);
+-
+ module.exports = withBundleAnalyzer({
+   reactStrictMode: true,
+   target: "serverless",
+@@ -16,7 +12,7 @@ module.exports = withBundleAnalyzer({
+   trailingSlash: true,
+   serverRuntimeConfig: {
+     PROJECT_ROOT: __dirname, // https://github.com/vercel/next.js/issues/8251
+-    VERSION: packageJson.version
++    VERSION: "@NIX_LOG4BRAINS_VERSION@",
+   },
+   webpack(config, { webpack, buildId }) {
+     // For cache invalidation purpose (thanks https://github.com/vercel/next.js/discussions/14743)
+-- 
+2.50.1
+

pkgs/by-name/lo/log4brains/0002-move-nextjs-build-into-temporary-directory.patch

···
+From 8c7af30fe7377235037c1a385f484f201ecfe063 Mon Sep 17 00:00:00 2001
+From: tropf <[e-mail]>
+Date: Tue, 26 Aug 2025 15:15:19 +0200
+Subject: [PATCH 2/2] move nextjs build into temporary directory
+
+For the build command, upstream invokes a nextjs-base build inside
+node_modules. As this is read-only in nix, the corresponding directory
+is copied into a newly-created directory in the temporary directory
+(e.g. /tmp), from where the build can successfully run.
+---
+ packages/web/cli/commands/build.ts | 38 +++++++++++++++++++++++++++++-
+ 1 file changed, 37 insertions(+), 1 deletion(-)
+
+diff --git a/packages/web/cli/commands/build.ts b/packages/web/cli/commands/build.ts
+index b611cd9..213e82f 100644
+--- a/packages/web/cli/commands/build.ts
++++ b/packages/web/cli/commands/build.ts
+@@ -16,6 +16,36 @@ type Deps = {
+   appConsole: AppConsole;
+ };
+ 
++const fs = require('fs');
++const os = require('os');
++
++// Helper: Recursively copy directory
++function copyDirSync(src: any, dest: any) {
++  if (!fs.existsSync(dest)) fs.mkdirSync(dest, { recursive: true });
++  for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
++    const srcPath = path.join(src, entry.name);
++    const destPath = path.join(dest, entry.name);
++    if (entry.isDirectory()) {
++      copyDirSync(srcPath, destPath);
++    } else {
++      fs.copyFileSync(srcPath, destPath);
++    }
++  }
++}
++
++// Helper: Recursively set writeable flag
++function setWriteableSync(target: any) {
++  const stat = fs.statSync(target);
++  if (stat.isDirectory()) {
++    fs.chmodSync(target, 0o755);
++    for (const entry of fs.readdirSync(target)) {
++      setWriteableSync(path.join(target, entry));
++    }
++  } else {
++    fs.chmodSync(target, 0o644);
++  }
++}
++
+ export async function buildCommand(
+   { appConsole }: Deps,
+   outPath: string,
+@@ -24,7 +54,13 @@ export async function buildCommand(
+   process.env.NEXT_TELEMETRY_DISABLED = "1";
+   appConsole.println("Building Log4brains...");
+ 
+-  const nextDir = getNextJsDir();
++  const oldNextDir = getNextJsDir();
++
++  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'log4brains-nextjs-'));
++  copyDirSync(oldNextDir, tmpDir);
++  setWriteableSync(tmpDir);
++  const nextDir = tmpDir;
++
+   // eslint-disable-next-line global-require,import/no-dynamic-require,@typescript-eslint/no-var-requires
+   const nextConfig = require(path.join(nextDir, "next.config.js")) as Record<
+     string,
+-- 
+2.50.1
+

pkgs/by-name/lo/log4brains/package.nix

···
+{
+  lib,
+  stdenv,
+  callPackage,
+  fetchFromGitHub,
+  fetchYarnDeps,
+  yarnConfigHook,
+  yarnBuildHook,
+  yarnInstallHook,
+  nodejs,
+  yarn,
+  moreutils,
+  jq,
+  makeBinaryWrapper,
+  fetchpatch2,
+  replaceVars,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "log4brains";
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    owner = "thomvaill";
+    repo = "log4brains";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-2EAETbICK3XSjAEoLV0KP2xeOYlw8qgctit+shMp5Qs=";
+  };
+
+  yarnOfflineCache = fetchYarnDeps {
+    yarnLock = finalAttrs.src + "/yarn.lock";
+    hash = "sha256-HHiWlOYwR+PhfpQlUfuTXUiQ+6w1HATGlmflQvqdNlg=";
+  };
+
+  # generated from https://codeberg.org/tropf/log4brains
+  patches = [
+    # This replaces a version check by accessing package.json, which
+    # in the nix packaging is not at the expected path
+    (replaceVars ./0001-replace-version-check-using-package.json.patch {
+      NIX_LOG4BRAINS_VERSION = finalAttrs.version;
+    })
+
+    ./0002-move-nextjs-build-into-temporary-directory.patch
+  ];
+
+  postPatch = ''
+    # Top-level is just a workspace (actual packages reside in packages/
+    # subdir), but w/o `version` the yarn hooks refuse to run.
+    jq '.version = "${finalAttrs.version}"' < package.json | sponge package.json
+  '';
+
+  # = Notes =
+  #
+  # Not copying the full node_modules yields:
+  # Error: Cannot find module 'chalk'
+  #
+  # The log4brains version in src/ and the default install differ,
+  # hence remove the copied version and let installPhase handle it.
+  #
+  # An alternative approach is to bundle log4brains binary using (tested only in devshell):
+  # npx pkg --target 'node*-linux-x64' .
+  preInstall = ''
+    mkdir -p $out/lib
+    cp -aLrt $out/lib node_modules
+
+    # will get installed by the installPhase, so avoid conflicts
+    rm -r $out/lib/node_modules/log4brains
+
+    # the desired final package is inside of a subdir; switch there
+    pushd packages/global-cli
+  '';
+
+  # w/o yarn it just generated cryptic errors ENOENT
+  #
+  # There are some builds at runtime (marked as "hack" in the src),
+  # hence we need node_modules set
+  postInstall = ''
+    popd
+
+    wrapProgram $out/bin/log4brains \
+      --suffix PATH : ${
+        lib.makeBinPath [
+          nodejs
+          yarn
+        ]
+      } \
+      --set NODE_PATH $out/lib/node_modules
+  '';
+
+  nativeBuildInputs = [
+    yarnConfigHook
+    yarnBuildHook
+    yarnInstallHook
+    # Needed for executing package.json scripts
+    nodejs
+
+    makeBinaryWrapper
+
+    moreutils # sponge
+    jq
+  ];
+
+  passthru.tests.basic-scenario = callPackage ./test-basic-scenario.nix {
+    log4brains = finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "Architecture Decision Records (ADR) management and publication tool";
+    longDescription = ''
+      Log4brains is a docs-as-code knowledge base for your development and infrastructure projects.
+      It enables you to log Architecture Decision Records (ADR) right from your IDE and to publish them automatically as a static website.
+    '';
+    homepage = "https://github.com/thomvaill/log4brains";
+    license = lib.licenses.asl20;
+    mainProgram = "log4brains";
+    maintainers = with lib.maintainers; [ tropf ];
+    platforms = lib.platforms.all;
+  };
+})

pkgs/by-name/lo/log4brains/test-basic-scenario.nix

···
+{
+  testers,
+  log4brains,
+}:
+testers.runCommand {
+  name = "log4brains-test-basic-scenario";
+  # the build runs for *quite* a while
+  meta.timeout = 90;
+  nativeBuildInputs = [ log4brains ];
+
+  script = ''
+    log4brains | grep 'Log4brains CLI'
+
+    mkdir project && cd project
+
+    log4brains init --defaults
+    test -f docs/adr/index.md
+
+    log4brains adr new --quiet 'Test ADR'
+    grep -r 'Test ADR' docs/adr/ >/dev/null
+
+    # Note: Preview is difficult to check (and hence not checked):
+    # (1) It requires some timeout for the page to become ready.
+    # (2) The signal & process handling is screwed; on kill the
+    #     process serving in the background stays alive.
+
+    log4brains build --out www
+    test -f www/index.html
+    grep -r 'Test ADR' www >/dev/null
+
+    touch $out
+  '';
+}

pkgs/by-name/me/meilisearch/package.nix

···
   fetchFromGitHub,
   nixosTests,
   nix-update-script,
-  version ? "1.18.0",
+  version ? "1.19.1",
 }:
 
 let
···
   # the meilisearch module accordingly and to remove the meilisearch_1_11
   # attribute from all-packages.nix at that point too.
   hashes = {
-    "1.18.0" = "sha256-43+/pu3iuoaZ8c2x1PWyVsQqQrFd+EFpvEicABpoeqg=";
+    "1.19.1" = "sha256-gB8hqA8kWXQxziP/HuTB43wFppjEVLCPo3AoGMnaJqs=";
     "1.11.3" = "sha256-CVofke9tOGeDEhRHEt6EYwT52eeAYNqlEd9zPpmXQ2U=";
   };
   cargoHashes = {
-    "1.18.0" = "sha256-mM5moa1GRPrg6NhmsOHtxAZEvoyaEvoCmm0FMTNmYE4=";
+    "1.19.1" = "sha256-74gOVO5lixR4R3PVOIhTsLPzXIORSvvePFbNgDeWn2E=";
     "1.11.3" = "sha256-cEJTokDJQuc9Le5+3ObMDNJmEhWEb+Qh0TV9xZkD9D8=";
   };
 in

pkgs/by-name/me/meshoptimizer/package.nix

···
 in
 stdenv.mkDerivation rec {
   pname = "meshoptimizer";
-  version = "0.24";
+  version = "0.25";
   src = fetchFromGitHub {
     owner = "zeux";
     repo = "meshoptimizer";
     rev = "v${version}";
-    hash = "sha256-mNZOlo0GD6Bf+aYmHL4E6yBkLJ2VRArEQ1FM1BD2+ow=";
+    hash = "sha256-ac1qX7neAN5Okpe3EytZKOglesyAAnyQkNWXa7TnMcg=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/mo/moralerspace-hw/package.nix

···
 
   src = fetchzip {
     url = "https://github.com/yuru7/moralerspace/releases/download/v${finalAttrs.version}/MoralerspaceHW_v${finalAttrs.version}.zip";
-    hash = "sha256-V02Lp7bWKjUGhFJ5fOTVrk74ei0T5UtITQeHZ4OHytw=";
+    hash = "sha256-gd195o0acZL8AhGvcLLQYxd1VWvUYjpVRMOT5D7zDME=";
   };
 
   installPhase = ''

pkgs/by-name/mo/moralerspace-hwjpdoc/package.nix

···
 
   src = fetchzip {
     url = "https://github.com/yuru7/moralerspace/releases/download/v${finalAttrs.version}/MoralerspaceHWJPDOC_v${finalAttrs.version}.zip";
-    hash = "sha256-rYDx3MMjxnmp/o6nRc5/bIEkwvMP9gmwm6R//3KwoLk=";
+    hash = "sha256-t8dp+SwndHxBA5YE2TYTWP6x3MgczbMXQ6oNvMD0ycU=";
   };
 
   installPhase = ''

pkgs/by-name/mo/moralerspace-hwnf/package.nix

···
-{
-  lib,
-  stdenvNoCC,
-  fetchzip,
-  moralerspace,
-}:
-
-stdenvNoCC.mkDerivation (finalAttrs: {
-  pname = "moralerspace-hwnf";
-  inherit (moralerspace) version meta;
-
-  src = fetchzip {
-    url = "https://github.com/yuru7/moralerspace/releases/download/v${finalAttrs.version}/MoralerspaceHWNF_v${finalAttrs.version}.zip";
-    hash = "sha256-XRdDcfgwbP5g26xh9rlHRp9i//k5PdRhMExMy3ibN/4=";
-  };
-
-  installPhase = ''
-    runHook preInstall
-
-    install -Dm644 *.ttf -t $out/share/fonts/moralerspace-hwnf
-
-    runHook postInstall
-  '';
-
-  passthru = {
-    inherit (moralerspace) updateScript;
-  };
-})

pkgs/by-name/mo/moralerspace-jpdoc/package.nix

···
 
   src = fetchzip {
     url = "https://github.com/yuru7/moralerspace/releases/download/v${finalAttrs.version}/MoralerspaceJPDOC_v${finalAttrs.version}.zip";
-    hash = "sha256-oeTRnDSp9sbicMmaybX7xue1u7dSpAqUv8XTOUrzEjE=";
+    hash = "sha256-FDiWiqIAFoiA1SFCv7ff5kCfPcKTbSxxGBWHOljQYVg=";
   };
 
   installPhase = ''

pkgs/by-name/mo/moralerspace-nf/package.nix

···
-{
-  lib,
-  stdenvNoCC,
-  fetchzip,
-  moralerspace,
-}:
-
-stdenvNoCC.mkDerivation (finalAttrs: {
-  pname = "moralerspace-nf";
-  inherit (moralerspace) version meta;
-
-  src = fetchzip {
-    url = "https://github.com/yuru7/moralerspace/releases/download/v${finalAttrs.version}/MoralerspaceNF_v${finalAttrs.version}.zip";
-    hash = "sha256-zpJ6I/4WMiVfDbowcvw1JAup0RdvylJCzQbwa5qWM44=";
-  };
-
-  installPhase = ''
-    runHook preInstall
-
-    install -Dm644 *.ttf -t $out/share/fonts/moralerspace-nf
-
-    runHook postInstall
-  '';
-
-  passthru = {
-    inherit (moralerspace) updateScript;
-  };
-})

pkgs/by-name/mo/moralerspace/package.nix

···
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "moralerspace";
-  version = "1.1.0";
+  version = "2.0.0";
 
   src = fetchzip {
     url = "https://github.com/yuru7/moralerspace/releases/download/v${finalAttrs.version}/Moralerspace_v${finalAttrs.version}.zip";
-    hash = "sha256-sItgkidfmOPKtMx8+eaVFn8hK9cRxYShIsNXTh5dJfk=";
+    hash = "sha256-RWpJt59Yvt/nhu6xeyR3eJKRaw+477ZXAPztt7Clt7Q=";
   };
 
   installPhase = ''
···
       extraArgs = [ "--version=skip" ];
     })
     (nix-update-script {
-      attrPath = "moralerspace-hwnf";
-      extraArgs = [ "--version=skip" ];
-    })
-    (nix-update-script {
       attrPath = "moralerspace-jpdoc";
-      extraArgs = [ "--version=skip" ];
-    })
-    (nix-update-script {
-      attrPath = "moralerspace-nf";
       extraArgs = [ "--version=skip" ];
     })
   ];

pkgs/by-name/no/notonoto-35/package.nix

···
     hash = "sha256-1dbx4yC8gL41OEAE/LNDyoDb4xhAwV5h8oRmdlPULUo=";
   };
 
+  # ttfautohint: unrecognized option '--epoch'
+  postPatch = ''
+    substituteInPlace fonttools_script.py \
+      --replace-fail 'print("exec hinting", options_)' 'options_.pop("epoch", None)'
+  '';
+
   nativeBuildInputs = [
     fontforge
     python3'

pkgs/by-name/no/notonoto-console/package.nix

···
     hash = "sha256-1dbx4yC8gL41OEAE/LNDyoDb4xhAwV5h8oRmdlPULUo=";
   };
 
+  # ttfautohint: unrecognized option '--epoch'
+  postPatch = ''
+    substituteInPlace fonttools_script.py \
+      --replace-fail 'print("exec hinting", options_)' 'options_.pop("epoch", None)'
+  '';
+
   nativeBuildInputs = [
     fontforge
     python3'

pkgs/by-name/no/notonoto-hs-35/package.nix

···
     hash = "sha256-1dbx4yC8gL41OEAE/LNDyoDb4xhAwV5h8oRmdlPULUo=";
   };
 
+  # ttfautohint: unrecognized option '--epoch'
+  postPatch = ''
+    substituteInPlace fonttools_script.py \
+      --replace-fail 'print("exec hinting", options_)' 'options_.pop("epoch", None)'
+  '';
+
   nativeBuildInputs = [
     fontforge
     python3'

pkgs/by-name/no/notonoto-hs-console/package.nix

···
     hash = "sha256-1dbx4yC8gL41OEAE/LNDyoDb4xhAwV5h8oRmdlPULUo=";
   };
 
+  # ttfautohint: unrecognized option '--epoch'
+  postPatch = ''
+    substituteInPlace fonttools_script.py \
+      --replace-fail 'print("exec hinting", options_)' 'options_.pop("epoch", None)'
+  '';
+
   nativeBuildInputs = [
     fontforge
     python3'

pkgs/by-name/no/notonoto-hs/package.nix

···
     hash = "sha256-1dbx4yC8gL41OEAE/LNDyoDb4xhAwV5h8oRmdlPULUo=";
   };
 
+  # ttfautohint: unrecognized option '--epoch'
+  postPatch = ''
+    substituteInPlace fonttools_script.py \
+      --replace-fail 'print("exec hinting", options_)' 'options_.pop("epoch", None)'
+  '';
+
   nativeBuildInputs = [
     fontforge
     python3'

pkgs/by-name/no/notonoto/package.nix

···
     hash = "sha256-1dbx4yC8gL41OEAE/LNDyoDb4xhAwV5h8oRmdlPULUo=";
   };
 
+  # ttfautohint: unrecognized option '--epoch'
+  postPatch = ''
+    substituteInPlace fonttools_script.py \
+      --replace-fail 'print("exec hinting", options_)' 'options_.pop("epoch", None)'
+  '';
+
   nativeBuildInputs = [
     fontforge
     python3'

pkgs/by-name/nz/nzbhydra2/package.nix

···
 }:
 stdenv.mkDerivation rec {
   pname = "nzbhydra2";
-  version = "7.16.0";
+  version = "7.16.1";
 
   src = fetchzip {
     url = "https://github.com/theotherp/nzbhydra2/releases/download/v${version}/nzbhydra2-${version}-generic.zip";
-    hash = "sha256-BgMTR4vj+JTzxJDPJhpvkYjTav68O7d1POXDMbQMOvQ=";
+    hash = "sha256-B7rqsSRLQrsMA049/SSnH7f5MCtU72rgQnO1UB/EG1Y=";
     stripRoot = false;
   };
 

pkgs/by-name/pa/paperless-ngx/package.nix

···
     export HOME=$(mktemp -d)
     export XDG_DATA_DIRS="${liberation_ttf}/share:$XDG_DATA_DIRS"
     export PAPERLESS_NLTK_DIR=${passthru.nltkDataDir}
+    # Limit threads per worker based on NIX_BUILD_CORES, capped at 256
+    # ocrmypdf has an internal limit of 256 jobs and will fail with more:
+    # https://github.com/ocrmypdf/OCRmyPDF/blob/66308c281306302fac3470f587814c3b212d0c40/src/ocrmypdf/cli.py#L234
+    export PAPERLESS_THREADS_PER_WORKER=$(( NIX_BUILD_CORES > 256 ? 256 : NIX_BUILD_CORES ))
   '';
 
   disabledTests = [

pkgs/by-name/ra/radicle-node/package.nix

···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "radicle-node";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchFromRadicle {
     seed = "seed.radicle.xyz";
     repo = "z3gqcJUoA1n9HaHKufZs5FCSGazv5";
     tag = "releases/${finalAttrs.version}";
-    hash = "sha256-0gK+fM/YGGpxlcR1HQixbLK0/sv+HH29h6ajEP2w2pI=";
+    hash = "sha256-e5Zelu3g8m9u5NtyABkIV4wOed9cq58xSaxginoDb2Q=";
     leaveDotGit = true;
     postFetch = ''
       git -C $out rev-parse HEAD > $out/.git_head
···
     '';
   };
 
-  cargoHash = "sha256-qLRFZXbVbsgMyXiljsb8lOBCDZKa17LcxWuPaUYSG70=";
+  cargoHash = "sha256-64SDz0wHKcp/tPGDDOlCRFr3Z1q6cWOafhP0howSFhA=";
 
   env.RADICLE_VERSION = finalAttrs.version;
 

pkgs/by-name/ri/rime-wanxiang/package.nix

···
   lib,
   fetchFromGitHub,
   stdenvNoCC,
-  librime,
-  rime-data,
   nix-update-script,
 }:
 
···
     hash = "sha256-tCQ2mPOw7meA7ex7e4BgVco86MNNtxsSC9L6oaVebo4=";
   };
 
-  nativeBuildInputs = [
-    librime
-  ];
-
-  buildInputs = [
-    rime-data
-  ];
-
-  dontConfigure = true;
-
-  buildPhase = ''
-    runHook preBuild
-
-    for s in *.schema.yaml; do
-        rime_deployer --compile "$s" . ${rime-data}/share/rime-data ./build
-    done
-
-    rm build/*.txt
-
-    runHook postBuild
-  '';
-
   installPhase = ''
     runHook preInstall
 
-    dst=$out/share/rime-data
-    mkdir -p $dst
+    rm -rf README.md .git* custom LICENSE
 
-    rm -r .github custom LICENSE squirrel.yaml weasel.yaml *.md *.trime.yaml
     mv default.yaml wanxiang_suggested_default.yaml
 
-    cp -pr -t $dst *
+    mkdir -p $out/share
+    cp -r . $out/share/rime-data
 
     runHook postInstall
   '';

pkgs/by-name/rt/rtorrent/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rakshasa-rtorrent";
-  version = "0.15.5";
+  version = "0.15.6";
 
   src = fetchFromGitHub {
     owner = "rakshasa";
     repo = "rtorrent";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ZUZR/ydGhxLbjMEDAlbU5IbAxU1dCd0vvATdsn0NMQc=";
+    hash = "sha256-B/5m1JXdUpczUMNN4cy5p6YurjmRFxMQHG3cQFSmZSs=";
   };
 
   outputs = [

pkgs/by-name/sn/sniproxy/package.nix

···
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchurl,
   autoreconfHook,
   gettext,
   libev,
-  pcre,
+  pcre2,
   pkg-config,
   udns,
 }:
···
 
   patches = [
     ./gettext-0.25.patch
+    (fetchurl {
+      name = "compat-pcre2.patch";
+      # Using Arch Linux patch because the following upstream patches do not apply cleanly:
+      # https://github.com/dlundquist/sniproxy/commit/62e621f050f79eb78598b1296a089ef88a19ea91
+      # https://github.com/dlundquist/sniproxy/commit/7fdd86c054a21f7ac62343010de20f28645b14d2
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/sniproxy/-/raw/3272f9f0d406c51122f90708bfcc7b4ba0eb38c9/sniproxy-0.6.1-pcre2.patch?inline=false";
+      hash = "sha256-v6qdBAWXit0Zg43OsgzCTb4cSPm7gsEXVd7W8LvBgMk=";
+    })
   ];
 
   nativeBuildInputs = [
···
   buildInputs = [
     gettext
     libev
-    pcre
+    pcre2
     udns
   ];
 

pkgs/by-name/st/stats/package.nix

···
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "stats";
-  version = "2.11.49";
+  version = "2.11.51";
 
   src = fetchurl {
     url = "https://github.com/exelban/stats/releases/download/v${finalAttrs.version}/Stats.dmg";
-    hash = "sha256-v+ZwEFYb5v7dUZlXar8io4/Lr34326ZM1p5j7OzSmig=";
+    hash = "sha256-oFRS60LPIscqBPMUfK1WvWi7eDv3VpAUaaAKyrpzN2s=";
   };
 
   sourceRoot = ".";

pkgs/by-name/te/tenv/package.nix

···
 
 buildGoModule rec {
   pname = "tenv";
-  version = "4.7.7";
+  version = "4.7.21";
 
   src = fetchFromGitHub {
     owner = "tofuutils";
     repo = "tenv";
     tag = "v${version}";
-    hash = "sha256-7cFPlrfbKmYLi02LnERFddYzZqH4/HYt407h8eX6tew=";
+    hash = "sha256-u7Whu2Y9MAGmEOnQECb0B/VMW6ZCflAANQxan+CrnAw=";
   };
 
-  vendorHash = "sha256-kp2/R3zo+Q+ofFBeHwKoSztj7dmLIdaS6NILEFhdG2o=";
+  vendorHash = "sha256-Jt0GDrYay6ZbMsayO5BFO2psK6BHwL/4AyEi8SqxZ4E=";
 
   excludedPackages = [ "tools" ];
 

pkgs/by-name/ur/urbit/package.nix

···
 in
 stdenv.mkDerivation rec {
   pname = "urbit";
-  version = "3.4";
+  version = "3.5";
 
   src = fetchzip {
     url = "https://github.com/urbit/vere/releases/download/vere-v${version}/${platform}.tgz";
     sha256 =
       {
-        x86_64-linux = "sha256-BflhL1T33VqWW9ni9TZuNAauPh0d8hRhkdUgZPGXW+Q=";
-        aarch64-linux = "sha256-NJS7s3bXu072m3bbfpKj8CyB2qLa9v/rkUCDBoY+2vs=";
-        x86_64-darwin = "sha256-qivzosca6zq2Rmv4hqwQi5Mmm/HWJS8tEosArlzcU3M=";
-        aarch64-darwin = "sha256-RBM44+Govt5MidSBWODi/62RdOxd8KVFNQJGbvA4yNw=";
+        x86_64-linux = "sha256-eB80GuyNuVZbBsyNnek8UCtquZbNt5G4Co7IKqq7aeI=";
+        aarch64-linux = "sha256-imbzAsjjznLuxee9mWXpsG/dKEJxdEOTw+JFc4DbQ2Q=";
+        x86_64-darwin = "sha256-0c1ewdrVsfSUivrcLwVuxZdcyrOAKXF7P9W+B7o5aNU=";
+        aarch64-darwin = "sha256-j8PJ04zRz2sZdpetLyzwRasj0CkiRGY+GvzWXG90IaE=";
       }
       .${stdenv.hostPlatform.system} or (throw "unsupported system ${stdenv.hostPlatform.system}");
   };

pkgs/by-name/ve/venera/package.nix

···
     owner = "venera-app";
     repo = "venera";
     tag = "v${version}";
-    hash = "sha256-5TO68+h49l0KCT99rZ+iXzgZiT7H0H0XeRWjSbrc9yM=";
+    hash = "sha256-LhPtoMD7IjxbTFTSzP+vtflDUixUoN9eqE1AQyWhJzg=";
   };
 in
 flutter335.buildFlutterApplication {

pkgs/by-name/vo/volanta/package.nix

···
   fetchurl,
   lib,
   makeWrapper,
+  writeShellScript,
+  common-updater-scripts,
+  nix-update,
 }:
 let
   pname = "volanta";
-  version = "1.12.0";
+  version = "1.12.4";
+  build = "e745115c";
   src = fetchurl {
-    url = "https://cdn.volanta.app/software/volanta-app/${version}-0e24f0ee/volanta-${version}.AppImage";
-    hash = "sha256-PwBnKR0oFMJtyPxpgDGlSDmcxY9wxhp2Un6mkRJIlfI=";
+    url = "https://cdn.volanta.app/software/volanta-app/${version}-${build}/volanta-${version}.AppImage";
+    hash = "sha256-BfPfIeCJZLk2Lkr+8QWcDhpDNdPQbFt9cnH31uGSeBU=";
   };
   appImageContents = appimageTools.extract { inherit pname version src; };
 in
···
     substituteInPlace $out/share/applications/volanta.desktop \
       --replace-fail 'Exec=AppRun' 'Exec=env APPIMAGE=true volanta'
     wrapProgram $out/bin/volanta \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --wayland-text-input-version=3}}"
   '';
+
+  passthru = {
+    inherit src build;
+    updateScript = writeShellScript "update-volanta" ''
+      LATEST_YML=$(curl --fail --silent https://api.volanta.app/api/v1/ClientUpdate/latest-linux.yml)
+      VERSION=$(echo "$LATEST_YML" | grep -E '^version:' | awk '{print $2}')
+      BUILD=$(echo "$LATEST_YML" | grep -E 'url: .*/volanta-app/' | sed -E 's/.*volanta-app\/[0-9.]+-([0-9a-f]+)\/.*/\1/' | head -n1)
+      ${lib.getExe' common-updater-scripts "update-source-version"} volanta $BUILD --version-key=build || true
+      ${lib.getExe nix-update} volanta --version $VERSION
+    '';
+  };
+
   meta = {
     description = "Easy-to-use smart flight tracker that integrates all your flight data across all major flightsims";
     homepage = "https://volanta.app/";

pkgs/by-name/vs/vscode-runner/package.nix

···
   fetchFromGitHub,
   buildDartApplication,
   kdePackages,
+  sqlite,
 }:
 
 let
···
   dartEntryPoints = {
     "bin/vscode_runner" = "bin/vscode_runner.dart";
   };
+
+  buildInputs = [ sqlite ];
 
   postInstall = ''
     substituteInPlace ./package/codes.merritt.vscode_runner.service \

pkgs/by-name/wa/wasm-tools/package.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "wasm-tools";
-  version = "1.238.0";
+  version = "1.238.1";
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = "wasm-tools";
     tag = "v${version}";
-    hash = "sha256-7wzIKOn/B0GqHaODMfjjCJ/ffBi9j7OYxasuWg7wct0=";
+    hash = "sha256-iQeb3MnOIKpYvEGIrEYiBoLuM4LLwKCDw7ub/dPQTxg=";
     fetchSubmodules = true;
   };
 
   # Disable cargo-auditable until https://github.com/rust-secure-code/cargo-auditable/issues/124 is solved.
   auditable = false;
 
-  cargoHash = "sha256-I3r20fTakd+PK4JWMj2i1OziFrxDWpneQqnlKav6chI=";
+  cargoHash = "sha256-GzdxpO+QvN2QDEBZkdvDbvG+y+mEYHWzdDhH+LH3TFM=";
   cargoBuildFlags = [
     "--package"
     "wasm-tools"

pkgs/by-name/we/weaviate/package.nix

···
 
 buildGoModule rec {
   pname = "weaviate";
-  version = "1.32.1";
+  version = "1.32.5";
 
   src = fetchFromGitHub {
     owner = "weaviate";
     repo = "weaviate";
     rev = "v${version}";
-    hash = "sha256-upia7a7IzLee0xZWQ8w/LW8zIfva40Jc57hZE50kIa4=";
+    hash = "sha256-LPGuYnLVIShIJeFNoNqlf9OgwtDuH/efPtWj9mAR0uQ=";
   };
 
-  vendorHash = "sha256-PnwlwWhTL1Fwz5nx6gune3DICVmApHl6rtddxRc2I1Q=";
+  vendorHash = "sha256-CuTX2yscnZrOV+be+cx5Vr8jXfduEF4My2CEFA6IIjQ=";
 
   subPackages = [ "cmd/weaviate-server" ];
 

pkgs/desktops/mate/caja/default.nix

···
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
   pkg-config,
   gettext,
   gtk-layer-shell,
···
     url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "HjAUzhRVgX7C73TQnv37aDXYo3LtmhbvtZGe97ghlXo=";
   };
+
+  patches = [
+    # wayland: ensure windows can be moved if compositor is using CSD
+    # https://github.com/mate-desktop/caja/pull/1787
+    (fetchpatch {
+      url = "https://github.com/mate-desktop/caja/commit/b0fb727c62ef9f45865d5d7974df7b79bcf0d133.patch";
+      hash = "sha256-2QAXveJnrPPyFSBST6wQcXz9PRsJVdt4iSYy0gubDAs=";
+    })
+  ];
 
   nativeBuildInputs = [
     pkg-config

pkgs/desktops/mate/mate-wayland-session/default.nix

···
   glib,
   mate-polkit,
   mate-notification-daemon,
+  mate-settings-daemon,
   wayfire,
-  wayfirePlugins,
   gitUpdater,
 }:
 
 stdenvNoCC.mkDerivation rec {
   pname = "mate-wayland-session";
-  version = "1.28.3";
+  version = "1.28.4";
 
   src = fetchFromGitHub {
     owner = "mate-desktop";
     repo = "mate-wayland-session";
     rev = "v${version}";
-    hash = "sha256-sUAq2BylsvjYn8Lt+nm4yIfVhzIEefxKZYnhJnuxjs0=";
+    hash = "sha256-jcYkiJOo1k0bMP/LkBW+QIrSyoj6qi8zZMTxqmuNQd0=";
   };
 
   nativeBuildInputs = [
···
     substituteInPlace session/mate-wayland-components.sh \
       --replace-fail "polkit-mate-authentication-agent-1" "${mate-polkit}/libexec/polkit-mate-authentication-agent-1" \
       --replace-fail "mate-notification-daemon" "${mate-notification-daemon}/libexec/mate-notification-daemon" \
+      --replace-fail "mate-settings-daemon" "${mate-settings-daemon}/libexec/mate-settings-daemon" \
       --replace-fail "cat /usr/bin/blueman-applet" "command -v blueman-applet" \
       --replace-fail "cat /usr/bin/gnome-keyring-daemon" "command -v gnome-keyring-daemon"
 
-    # Ensure wayfire.ini is writable, as this script tries to modify it later.
     substituteInPlace session/mate-wayland.sh \
-      --replace-fail "cp /usr/share/doc/wayfire/examples/wayfire.ini" "cp --no-preserve=mode,ownership ${wayfire.src}/wayfire.ini" \
-      --replace-fail "/usr/share/doc/wayfire/examples/wayfire.ini" "${wayfire.src}/wayfire.ini" \
-      --replace-fail "/usr/lib/x86_64-linux-gnu/wayfire/libfiredecor.so" "${wayfirePlugins.firedecor}/lib/wayfire/libfiredecor.so" \
-      --replace-fail "/usr/share/doc/firedecor/firedecor.config" "$out/share/doc/firedecor/firedecor.config"
+      --replace-fail "/usr/share/doc/wayfire/examples/wayfire.ini" "${wayfire.src}/wayfire.ini"
   '';
 
   passthru = {

pkgs/development/beam-modules/livebook/default.nix

···
 
 beamPackages.mixRelease rec {
   pname = "livebook";
-  version = "0.16.4";
+  version = "0.17.0";
 
   inherit (beamPackages) elixir;
 
···
     owner = "livebook-dev";
     repo = "livebook";
     tag = "v${version}";
-    hash = "sha256-Cwzcoslqjaf7z9x2Sgnzrrl4zUcH2f7DEWaFPBIi3ms=";
+    hash = "sha256-bdz6ufli+WC+3Fpd9uFK+OKOmL2Ogvmr5qsI85N1vgg=";
   };
 
   mixFodDeps = beamPackages.fetchMixDeps {
     pname = "mix-deps-${pname}";
     inherit src version;
-    hash = "sha256-OEYkWh0hAl7ZXP2Cq+TgVGF4tnWlpF6W5uRSdyrswlA=";
+    hash = "sha256-YyNrERVomIPaBJVKPTc5ZbWzaJk6b87RAC4QkBDicoQ=";
   };
 
   postInstall = ''

pkgs/development/embedded/platformio/default.nix

···
-{ newScope }:
-
-let
-  callPackage = newScope self;
-
-  self = {
-    platformio-core = callPackage ./core.nix { };
-
-    platformio-chrootenv = callPackage ./chrootenv.nix { };
-  };
-
-in
-self

pkgs/development/libraries/astal/source.nix

···
   originalDrv = fetchFromGitHub {
     owner = "Aylur";
     repo = "astal";
-    rev = "5d4eef66392b0dff99a63a4f39ff886624bd69dd";
-    hash = "sha256-kzU/3A4k+d3PsgMLohzSh4KJybTqvzqibUVqV2yXCGY=";
+    rev = "20bd8318e4136fbd3d4eb2d64dbabc3acbc915dd";
+    hash = "sha256-iiBU6itpEqE0spXeNJ3uJTfioSyKYjt5bNepykpDXTE=";
   };
 in
 originalDrv.overrideAttrs (
   final: prev: {
     name = "${final.pname}-${final.version}"; # fetchFromGitHub already defines name
     pname = "astal-source";
-    version = "0-unstable-2025-08-11";
+    version = "0-unstable-2025-08-29";
 
     meta = prev.meta // {
       description = "Building blocks for creating custom desktop shells (source)";

pkgs/development/python-modules/osc-lib/default.nix

···
 
 buildPythonPackage rec {
   pname = "osc-lib";
-  version = "4.1.0";
+  version = "4.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "openstack";
     repo = "osc-lib";
     tag = version;
-    hash = "sha256-mFZLVlq2mFgx5yQLBPVVT/zDLbOJ/EodAwsm/QxvW0Q=";
+    hash = "sha256-5WoYamGRLz3fjebel1yxg39YGAK9ZfMbTXG6IXPnJYo=";
   };
+
+  postPatch = ''
+    # TODO: somehow bring this to upstreams attention
+    substituteInPlace pyproject.toml \
+      --replace-fail '"osc_lib"' '"osc_lib", "osc_lib.api", "osc_lib.cli", "osc_lib.command", "osc_lib.tests", "osc_lib.tests.api", "osc_lib.tests.cli", "osc_lib.tests.command", "osc_lib.tests.utils", "osc_lib.utils"'
+  '';
 
   env.PBR_VERSION = version;
 

pkgs/development/python-modules/osc-placement/default.nix

···
 
 buildPythonPackage rec {
   pname = "osc-placement";
-  version = "4.6.0";
+  version = "4.7.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
···
     owner = "openstack";
     repo = "osc-placement";
     tag = version;
-    hash = "sha256-8D/8WRUZnVTCXL/I+KmIGKtnfyjM7evux808+XY3ciw=";
+    hash = "sha256-OLvi/eIgEEUoZKxowU7On5m2OkRsCEsU/Me7rPruIdM=";
   };
 
   env.PBR_VERSION = version;
···
   pythonImportsCheck = [ "osc_placement" ];
 
   meta = {
-    homepage = "https://opendev.org/openstack/osc-placement";
+    homepage = "https://github.com/openstack/osc-placement";
     description = "OpenStackClient plugin for the Placement service";
     license = lib.licenses.asl20;
     teams = [ lib.teams.openstack ];

pkgs/development/python-modules/oslo-context/default.nix

···
 
 buildPythonPackage rec {
   pname = "oslo-context";
-  version = "6.0.0";
+  version = "6.1.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit version;
     pname = "oslo_context";
-    hash = "sha256-FR6CKJgtOIXtP+0ojozdsm+JT7QMuBMhKfqeWz4O8L0=";
+    hash = "sha256-wajRfHn1DHECTVTMF8wLAeidv/JYMV3BHX4E5rGgLOM=";
   };
 
   postPatch = ''

pkgs/development/python-modules/oslo-i18n/default.nix

···
 
 buildPythonPackage rec {
   pname = "oslo-i18n";
-  version = "6.5.1";
+  version = "6.6.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "oslo_i18n";
     inherit version;
-    hash = "sha256-6oVqcMWvfHbvtlkJlCMSid6r4jvoR3FZ03kBzvM7EJ0=";
+    hash = "sha256-u1477O+i5ASIsln52xLMWtiU3TCbW1rKVjgv8ZDBj14=";
   };
 
   postPatch = ''

pkgs/development/python-modules/pkg-about/default.nix

···
 
 buildPythonPackage rec {
   pname = "pkg-about";
-  version = "1.4.0";
+  version = "1.5.0";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
···
   src = fetchPypi {
     pname = "pkg_about";
     inherit version;
-    hash = "sha256-D3lcyisijpDDQkYWR1OB5dUo2ErnRjmV/H9mCsDJuxM=";
+    hash = "sha256-+I/a4BFGKPiuRPQwRr7+Sz05YRw4ZgwxgvDU8OWpnJc=";
   };
 
   # tox is listed in build requirements but not actually used to build

pkgs/development/python-modules/pylibjpeg/default.nix

···
 
 buildPythonPackage rec {
   pname = "pylibjpeg";
-  version = "2.0.1";
+  version = "2.1.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
···
     owner = "pydicom";
     repo = "pylibjpeg";
     tag = "v${version}";
-    hash = "sha256-MA1A/hTIx95MYZ2LGOifnHn77wbv0ydAgQSzNZRykVg=";
+    hash = "sha256-jMdNzruzr2VgEntFF5BBoK3yrq0VegtJNXAkCpHjsks=";
   };
 
   build-system = [ flit-core ];

pkgs/development/python-modules/pyphotonfile/default.nix

···
   numpy,
 }:
 let
-  version = "0.2.1+";
+  version = "0.2.1";
 in
 buildPythonPackage {
   pname = "pyphotonfile";
···
     owner = "cab404";
     repo = "pyphotonfile";
     rev = "b7ee92a0071007bb1d6a5984262651beec26543d";
-    sha256 = "iB5ky4fPX8ZnvXlDpggqS/345k2x/mPC4cIgb9M0f/c=";
+    sha256 = "sha256-iB5ky4fPX8ZnvXlDpggqS/345k2x/mPC4cIgb9M0f/c=";
   };
 
   meta = with lib; {

pkgs/development/python-modules/python-keystoneclient/default.nix

···
 
 buildPythonPackage rec {
   pname = "python-keystoneclient";
-  version = "5.6.0";
+  version = "5.7.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
···
   src = fetchPypi {
     pname = "python_keystoneclient";
     inherit version;
-    hash = "sha256-ch3irsdxAHY4nGdO4ntnEul9hsfg/0h7C0QJyPzuEOc=";
+    hash = "sha256-jOe/HIzdym1xQPx2kYtE7d8dZAQKYMuP9wWRNhBNTOs=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/rio-stac/default.nix

···
 
 buildPythonPackage rec {
   pname = "rio-stac";
-  version = "0.11.0";
+  version = "0.11.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "developmentseed";
     repo = "rio-stac";
     tag = version;
-    hash = "sha256-3MAqBhekkjJOQnE1B7GxZiFcjkbhhsON01ciKPvGa4g=";
+    hash = "sha256-1hutGRiSWgw2wX5dOPg31/m/zZFonuKsH0wEkVsbMxU=";
   };
 
   build-system = [ flit ];

pkgs/development/python-modules/scikit-rf/default.nix

···
   ];
 
   # test_calibration.py generates a divide by zero error on darwin
+  # and fails on Linux after updates of dependenceis
   # https://github.com/scikit-rf/scikit-rf/issues/972
-  disabledTestPaths = lib.optional (
-    stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isDarwin
-  ) "skrf/calibration/tests/test_calibration.py";
+  disabledTestPaths = [
+    "skrf/calibration/tests/test_calibration.py"
+  ];
 
   pythonImportsCheck = [ "skrf" ];
 

pkgs/development/python-modules/verilogae/default.nix

···
   rustPlatform,
   cargo,
   rustc,
-  autoPatchelfHook,
   pkg-config,
-  llvmPackages_15,
+  llvmPackages,
   libxml2,
   ncurses,
   zlib,
···
 
 buildPythonPackage rec {
   pname = "verilogae";
-  version = "1.0.0";
+  version = "24.0.0mob-unstable-2025-07-21";
   pyproject = true;
+
+  stdenv = llvmPackages.stdenv;
 
   src = fetchFromGitHub {
-    owner = "pascalkuthe";
-    repo = "OpenVAF";
-    rev = "VerilogAE-v${version}";
-    hash = "sha256-TILKKmgSyhyxp88sdflDXAoH++iP6CMpdoXN1/1fsjU=";
+    owner = "OpenVAF";
+    repo = "OpenVAF-Reloaded";
+    rev = "d878f5519b1767b64c6ebeb4d67e29e7cd46e60b";
+    hash = "sha256-TDE2Ewokhm2KSKe+sunUbV8KD3kaTSd5dB3CLCWGJ9U=";
   };
 
   postPatch = ''
-    substituteInPlace openvaf/llvm/src/initialization.rs \
-      --replace-fail "i8" "libc::c_char"
     substituteInPlace openvaf/osdi/build.rs \
       --replace-fail "-fPIC" ""
   '';
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-/gSqaxqOZUkUmJJ5PGMkAG/5PSeAjwDjT2ce+tL7xmY";
+    hash = "sha256-5SLrVL3h6+tptHv3GV7r8HUTrYQC9VdF68O2/Uct3xA=";
   };
 
   nativeBuildInputs = [
···
     rustPlatform.bindgenHook
     cargo
     rustc
-    autoPatchelfHook
     pkg-config
-    llvmPackages_15.clang
-    llvmPackages_15.llvm
+    llvmPackages.llvm
   ];
 
   buildInputs = [
     libxml2.dev
-    llvmPackages_15.libclang
+    llvmPackages.libclang
     ncurses
     zlib
   ];
···
       jasonodoom
       jleightcap
     ];
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.unix;
     sourceProvenance = [ lib.sourceTypes.binaryBytecode ];
   };
 }

pkgs/servers/sql/postgresql/ext/pg_ivm.nix

···
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "pg_ivm";
-  version = "1.11";
+  version = "1.12";
 
   src = fetchFromGitHub {
     owner = "sraoss";
     repo = "pg_ivm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-fPtDwP+IZ/RQOriRklSvpUnJ8qEwJaxIrcfnAReRQeQ=";
+    hash = "sha256-UeRcxoUkpPw4EcQXKUxHamjczOaE59d00kSrYsijnH8=";
   };
 
   meta = {
···
     maintainers = with lib.maintainers; [ ivan ];
     platforms = postgresql.meta.platforms;
     license = lib.licenses.postgresql;
-    # PostgreSQL 18 support issue upstream: https://github.com/sraoss/pg_ivm/issues/133
-    # Note: already fixed on `main` branch.
-    # Check after next package update.
-    broken = lib.warnIf (finalAttrs.version != "1.11") "Is postgresql18Packages.pg_ivm still broken?" (
-      lib.versionAtLeast postgresql.version "18"
-    );
   };
 })

pkgs/tools/misc/ttfautohint/default.nix

···
   fetchurl,
   pkg-config,
   autoreconfHook,
+  perl,
   freetype,
   harfbuzz,
-  libiconv,
-  qtbase,
+  libsForQt5,
   enableGUI ? true,
 }:
 
-stdenv.mkDerivation rec {
-  version = "1.8.3";
+stdenv.mkDerivation (finalAttrs: {
+  version = "1.8.4";
   pname = "ttfautohint";
 
   src = fetchurl {
-    url = "mirror://savannah/freetype/ttfautohint-${version}.tar.gz";
-    sha256 = "0zpqgihn3yh3v51ynxwr8asqrijvs4gv686clwv7bm8sawr4kfw7";
+    url = "mirror://savannah/freetype/ttfautohint-${finalAttrs.version}.tar.gz";
+    hash = "sha256-iodhF/puv9L/4bNoKpqYyALA9HGJ9X09tLmXdCBoMuE=";
   };
 
+  postPatch =
+    lib.optionalString stdenv.hostPlatform.isLinux ''
+      echo "${finalAttrs.version}" > VERSION
+    ''
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      echo '#define VERSION "${finalAttrs.version}"' > version
+    '';
+
   postAutoreconf = ''
-    substituteInPlace configure --replace "macx-g++" "macx-clang"
+    substituteInPlace configure --replace-fail "macx-g++" "macx-clang"
   '';
 
   nativeBuildInputs = [
     pkg-config
     autoreconfHook
-  ];
+    perl
+  ]
+  ++ lib.optionals enableGUI [ libsForQt5.qt5.wrapQtAppsHook ];
 
   buildInputs = [
     freetype
     harfbuzz
-    libiconv
   ]
-  ++ lib.optional enableGUI qtbase;
+  ++ lib.optionals enableGUI [ libsForQt5.qt5.qtbase ];
 
-  configureFlags = [ ''--with-qt=${if enableGUI then "${qtbase}/lib" else "no"}'' ];
-
-  # workaround https://github.com/NixOS/nixpkgs/issues/155458
-  preBuild = lib.optionalString stdenv.cc.isClang ''
-    rm version
-  '';
+  configureFlags = [
+    ''--with-qt=${if enableGUI then "${libsForQt5.qt5.qtbase}/lib" else "no"}''
+  ]
+  ++ lib.optionals (!enableGUI) [ "--without-doc" ];
 
   enableParallelBuilding = true;
 
-  dontWrapQtApps = true;
-
-  meta = with lib; {
+  meta = {
     description = "Automatic hinter for TrueType fonts";
     mainProgram = "ttfautohint";
     longDescription = ''
···
       information given by FreeType’s auto-hinting module.
     '';
     homepage = "https://www.freetype.org/ttfautohint";
-    license = licenses.gpl2Plus; # or the FreeType License (BSD + advertising clause)
+    license = lib.licenses.gpl2Plus; # or the FreeType License (BSD + advertising clause)
     maintainers = [ ];
-    platforms = platforms.unix;
+    platforms = lib.platforms.unix;
   };
-
-}
+})

pkgs/tools/package-management/lix/default.nix

···
 lib.makeExtensible (self: {
   inherit makeLixScope;
 
-  lix_2_90 = self.makeLixScope {
-    attrName = "lix_2_90";
-
-    lix-args = rec {
-      version = "2.90.0";
-
-      src = fetchFromGitHub {
-        owner = "lix-project";
-        repo = "lix";
-        rev = version;
-        hash = "sha256-f8k+BezKdJfmE+k7zgBJiohtS3VkkriycdXYsKOm3sc=";
-      };
-
-      docCargoDeps = rustPlatform.fetchCargoVendor {
-        name = "lix-doc-${version}";
-        inherit src;
-        sourceRoot = "${src.name or src}/lix-doc";
-        hash = "sha256-VPcrf78gfLlkTRrcbLkPgLOk0o6lsOJBm6HYLvavpNU=";
-      };
-
-      knownVulnerabilities = [
-        "Lix 2.90 is vulnerable to CVE-2025-46415 and CVE-2025-46416 and will not receive updates."
-      ];
-    };
-
-    nix-eval-jobs-args = {
-      version = "2.90.0";
-      src = fetchgit {
-        url = "https://git.lix.systems/lix-project/nix-eval-jobs.git";
-        # https://git.lix.systems/lix-project/nix-eval-jobs/commits/branch/release-2.90
-        rev = "9c23772cf25e0d891bef70b7bcb7df36239672a5";
-        hash = "sha256-oT273pDmYzzI7ACAFUOcsxtT6y34V5KF7VBSqTza7j8=";
-      };
-    };
-  };
-
   lix_2_91 = self.makeLixScope {
     attrName = "lix_2_91";
 
···
           self.${version}.lix;
     in
     lib.dontRecurseIntoAttrs {
-      lix_2_90 = mkAlias "lix_2_90";
       lix_2_91 = mkAlias "lix_2_91";
       # NOTE: Do not add new versions of Lix here.
       stable = mkAlias "stable";

pkgs/top-level/aliases.nix

···
   kube3d = k3d; # Added 2022-0705
   kafkacat = throw "'kafkacat' has been renamed to/replaced by 'kcat'"; # Converted to throw 2024-10-17
   kak-lsp = kakoune-lsp; # Added 2024-04-01
+  kanidm = lib.warnOnInstantiate "'kanidm' will be removed before 26.05. You must use a versioned package, e.g. 'kanidm_1_x'." kanidm_1_7; # Added 2025-09-01
+  kanidmWithSecretProvisioning = lib.warnOnInstantiate "'kanidmWithSecretProvisioning' will be removed before 26.05. You must use a versioned package, e.g. 'kanidmWithSecretProvisioning_1_x'." kanidmWithSecretProvisioning_1_7; # Added 2025-09-01
   kanidm_1_3 = throw "'kanidm_1_3' has been removed as it has reached end of life"; # Added 2025-03-10
   kanidm_1_4 = throw "'kanidm_1_4' has been removed as it has reached end of life"; # Added 2025-06-18
   kanidmWithSecretProvisioning_1_4 = throw "'kanidmWithSecretProvisioning_1_4' has been removed as it has reached end of life"; # Added 2025-06-18
···
   mongodb-4_4 = throw "mongodb-4_4 has been removed, it's end of life since April 2024"; # Added 2024-04-11
   mongodb-5_0 = throw "mongodb-5_0 has been removed, it's end of life since October 2024"; # Added 2024-10-01
   mongodb-6_0 = throw "mongodb-6_0 has been removed, it's end of life since July 2025"; # Added 2025-07-23
+  moralerspace-nf = throw "moralerspace-nf has been removed, use moralerspace instead."; # Added 2025-08-30
+  moralerspace-hwnf = throw "moralerspace-hwnf has been removed, use moralerspace-hw instead."; # Added 2025-08-30
   moz-phab = mozphab; # Added 2022-08-09
   mp3info = throw "'mp3info' has been removed due to lack of maintenance upstream. Consider using 'eartag' or 'tagger' instead"; # Added 2024-09-14
   mp3splt = throw "'mp3splt' has been removed due to lack of maintenance upstream."; # Added 2025-05-17
···
   pio = throw "pio has been removed due to lack of upstream maintenance"; # Added 2025-01-25
   pipewire_0_2 = throw "pipewire_0_2 has been removed as it is outdated and no longer used"; # Added 2024-07-28
   pipewire-media-session = throw "pipewire-media-session is no longer maintained and has been removed. Please use Wireplumber instead.";
+  platformioPackages = {
+    inherit
+      platformio-core
+      platformio-chrootenv
+      ;
+  }; # Added 2025-09-04
   platypus = throw "platypus is unmaintained and has not merged Python3 support"; # Added 2025-03-20
   pleroma-otp = throw "'pleroma-otp' has been renamed to/replaced by 'pleroma'"; # Converted to throw 2024-10-17
   plex-media-player = throw "'plex-media-player' has been discontinued, the new official client is available as 'plex-desktop'"; # Added 2025-05-28

pkgs/top-level/all-packages.nix

···
     inherit (darwin) DarwinTools;
   };
 
-  platformioPackages = dontRecurseIntoAttrs (callPackage ../development/embedded/platformio { });
-  platformio =
-    if stdenv.hostPlatform.isLinux then
-      platformioPackages.platformio-chrootenv
-    else
-      platformioPackages.platformio-core;
-  platformio-core = platformioPackages.platformio-core;
+  platformio = if stdenv.hostPlatform.isLinux then platformio-chrootenv else platformio-core;
 
   playbar2 = libsForQt5.callPackage ../applications/audio/playbar2 { };
 
···
 
   trytond = with python3Packages; toPythonApplication trytond;
 
-  ttfautohint = libsForQt5.callPackage ../tools/misc/ttfautohint { };
+  ttfautohint = callPackage ../tools/misc/ttfautohint { };
   ttfautohint-nox = ttfautohint.override { enableGUI = false; };
 
   twilight = callPackage ../tools/graphics/twilight {
···
 
   #GMP ex-satellite, so better keep it near gmp
   # A GMP fork
-  gns3Packages = dontRecurseIntoAttrs (callPackage ../applications/networking/gns3 { });
+  gns3Packages = recurseIntoAttrs (callPackage ../applications/networking/gns3 { });
   gns3-gui = gns3Packages.guiStable;
   gns3-server = gns3Packages.serverStable;
 
···
 
   jetty = jetty_12;
 
-  kanidm_1_5 = callPackage ../by-name/ka/kanidm/1_5.nix {
+  kanidm_1_5 = callPackage ../servers/kanidm/1_5.nix {
     kanidmWithSecretProvisioning = kanidmWithSecretProvisioning_1_5;
   };
-  kanidm_1_6 = callPackage ../by-name/ka/kanidm/1_6.nix {
+  kanidm_1_6 = callPackage ../servers/kanidm/1_6.nix {
     kanidmWithSecretProvisioning = kanidmWithSecretProvisioning_1_6;
   };
-  kanidm_1_7 = callPackage ../by-name/ka/kanidm/1_7.nix {
+  kanidm_1_7 = callPackage ../servers/kanidm/1_7.nix {
     kanidmWithSecretProvisioning = kanidmWithSecretProvisioning_1_7;
   };
 
-  kanidmWithSecretProvisioning = kanidm.override { enableSecretProvisioning = true; };
   kanidmWithSecretProvisioning_1_5 = kanidm_1_5.override { enableSecretProvisioning = true; };
   kanidmWithSecretProvisioning_1_6 = kanidm_1_6.override { enableSecretProvisioning = true; };
   kanidmWithSecretProvisioning_1_7 = kanidm_1_7.override { enableSecretProvisioning = true; };
···
     xwaylandSupport = false;
   };
 
-  whalebird = callPackage ../applications/misc/whalebird {
-    electron = electron_36;
-  };
+  whalebird = callPackage ../applications/misc/whalebird { };
 
   inherit (windowmaker) dockapps;
 

pkgs/top-level/packages-config.nix

···
     with super;
     lib.mapAttrs (_: set: recurseIntoAttrs set) {
       inherit (super)
-        gns3Packages
-        platformioPackages
         rPackages
         sourceHanPackages
         ;

pkgs/top-level/release.nix

···
       # so users choosing to allow don't have to rebuild them every time.
       permittedInsecurePackages = [
         "olm-3.2.16" # see PR #347899
-        "kanidm_1_5-1.5.0"
-        "kanidmWithSecretProvisioning_1_5-1.5.0"
+        "kanidm_1_6-1.6.4"
+        "kanidmWithSecretProvisioning_1_6-1.6.4"
       ];
     };