Merge master into staging-next

maintainers/maintainer-list.nix

···
     github = "mrcjkb";
     githubId = 12857160;
   };
+  mrdev023 = {
+    name = "Florian RICHER";
+    email = "[e-mail]";
+    matrix = "@mrdev023:matrix.org";
+    github = "mrdev023";
+    githubId = 11292703;
+    keys = [ { fingerprint = "B19E 3F4A 2D80 6AB4 793F  DF2F C73D 37CB ED7B FC77"; } ];
+  };
   mredaelli = {
     email = "[e-mail]";
     github = "mredaelli";

nixos/modules/services/continuous-integration/woodpecker/agents.nix

···
             DOCKER_HOST = "unix:///run/podman/podman.sock";
           }
         '';
-        description = "woodpecker-agent config environment variables, for other options read the [documentation](https://woodpecker-ci.org/docs/administration/agent-config)";
+        description = "woodpecker-agent config environment variables, for other options read the [documentation](https://woodpecker-ci.org/docs/administration/configuration/agent)";
       };
 
       extraGroups = lib.mkOption {

nixos/modules/services/continuous-integration/woodpecker/server.nix

···
             WOODPECKER_GITEA_URL = "https://git.example.com";
           }
         '';
-        description = "woodpecker-server config environment variables, for other options read the [documentation](https://woodpecker-ci.org/docs/administration/server-config)";
+        description = "woodpecker-server config environment variables, for other options read the [documentation](https://woodpecker-ci.org/docs/administration/configuration/server)";
       };
       environmentFile = lib.mkOption {
         type = with lib.types; coercedTo path (f: [ f ]) (listOf path);

nixos/modules/services/web-apps/drupal.nix

···
           '';
         };
 
+        privateFilesDir = mkOption {
+          type = types.path;
+          default = "/var/lib/drupal/${name}/private";
+          defaultText = "/var/lib/drupal/<name>/private";
+          description = "The location of the Drupal private files directory.";
+        };
+
         stateDir = mkOption {
           type = types.path;
           default = "/var/lib/drupal/${name}";
···
           "Z '${cfg.modulesDir}' 0750 ${user} ${webserver.group} - -"
           "d '${cfg.themesDir}' 0750 ${user} ${webserver.group} - -"
           "Z '${cfg.themesDir}' 0750 ${user} ${webserver.group} - -"
+          "d '${cfg.privateFilesDir}' 0750 ${user} ${webserver.group} - -"
         ]) eachSite
       );
 
···
                   chown -R ${user}:${webserver.group} ${cfg.filesDir}
                 fi
 
-                settings="${cfg.stateDir}/sites/default/settings.php"
+                settings_file="${cfg.stateDir}/sites/default/settings.php"
                 defaultSettings="${cfg.package}/share/php/drupal/sites/default/default.settings.php"
 
                 if [ ! -f "$settings" ]; then
                   echo "Preparing settings.php for ${hostName}..."
-                  cp "$defaultSettings" "$settings"
-                  chmod 644 "$settings"
+                  cp "$defaultSettings" "$settings_file"
+                  chmod 644 "$settings_file"
+
+                  # Append settings to settings file
+                  printf "\n\n// NixOS Automatically Generated Settings\n" >> $settings_file
+                  printf "\$settings['file_private_path'] = '${cfg.privateFilesDir}';" >> $settings_file
                 fi
 
                 # Set or reset file permissions so that the web user and webserver owns them.

nixos/tests/all-tests.nix

···
   whoogle-search = runTest ./whoogle-search.nix;
   wiki-js = runTest ./wiki-js.nix;
   wine = handleTest ./wine.nix { };
-  wireguard = handleTest ./wireguard { };
+  wireguard = import ./wireguard {
+    inherit pkgs runTest;
+    inherit (pkgs) lib;
+  };
   wg-access-server = runTest ./wg-access-server.nix;
   without-nix = runTest ./without-nix.nix;
   wmderland = runTest ./wmderland.nix;

nixos/tests/wireguard/amneziawg-quick.nix

···
-import ../make-test-python.nix (
-  {
-    pkgs,
-    lib,
-    kernelPackages ? null,
-    nftables ? false,
-    ...
-  }:
-  let
-    wg-snakeoil-keys = import ./snakeoil-keys.nix;
-    peer = import ./make-peer.nix { inherit lib; };
-    commonConfig = {
-      boot.kernelPackages = lib.mkIf (kernelPackages != null) kernelPackages;
+{
+  lib,
+  kernelPackages ? null,
+  nftables ? false,
+  ...
+}:
+let
+  wg-snakeoil-keys = import ./snakeoil-keys.nix;
+  peer = import ./make-peer.nix;
+  commonConfig =
+    { pkgs, ... }:
+    {
+      boot.kernelPackages = lib.mkIf (kernelPackages != null) (kernelPackages pkgs);
       networking.nftables.enable = nftables;
       # Make sure iptables doesn't work with nftables enabled
       boot.blacklistedKernelModules = lib.mkIf nftables [ "nft_compat" ];
     };
-    extraOptions = {
-      Jc = 5;
-      Jmin = 10;
-      Jmax = 42;
-      S1 = 60;
-      S2 = 90;
-    };
-  in
-  {
-    name = "amneziawg-quick";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [
-        averyanalex
-        azahi
-      ];
-    };
+  extraOptions = {
+    Jc = 5;
+    Jmin = 10;
+    Jmax = 42;
+    S1 = 60;
+    S2 = 90;
+  };
+in
+{
+  name = "amneziawg-quick";
+  meta.maintainers = with lib.maintainers; [
+    averyanalex
+    azahi
+  ];
 
-    nodes = {
-      peer0 = peer {
-        ip4 = "192.168.0.1";
-        ip6 = "fd00::1";
-        extraConfig = lib.mkMerge [
-          commonConfig
-          {
-            networking.firewall.allowedUDPPorts = [ 23542 ];
-            networking.wg-quick.interfaces.wg0 = {
-              type = "amneziawg";
+  nodes = {
+    peer0 = peer {
+      ip4 = "192.168.0.1";
+      ip6 = "fd00::1";
+      extraConfig = {
+        imports = [ commonConfig ];
 
-              address = [
-                "10.23.42.1/32"
-                "fc00::1/128"
-              ];
-              listenPort = 23542;
+        networking.firewall.allowedUDPPorts = [ 23542 ];
+        networking.wg-quick.interfaces.wg0 = {
+          type = "amneziawg";
+
+          address = [
+            "10.23.42.1/32"
+            "fc00::1/128"
+          ];
+          listenPort = 23542;
 
-              inherit (wg-snakeoil-keys.peer0) privateKey;
+          inherit (wg-snakeoil-keys.peer0) privateKey;
 
-              peers = lib.singleton {
-                allowedIPs = [
-                  "10.23.42.2/32"
-                  "fc00::2/128"
-                ];
+          peers = lib.singleton {
+            allowedIPs = [
+              "10.23.42.2/32"
+              "fc00::2/128"
+            ];
 
-                inherit (wg-snakeoil-keys.peer1) publicKey;
-              };
+            inherit (wg-snakeoil-keys.peer1) publicKey;
+          };
 
-              dns = [
-                "10.23.42.2"
-                "fc00::2"
-                "wg0"
-              ];
+          dns = [
+            "10.23.42.2"
+            "fc00::2"
+            "wg0"
+          ];
 
-              inherit extraOptions;
-            };
-          }
-        ];
+          inherit extraOptions;
+        };
       };
+    };
 
-      peer1 = peer {
-        ip4 = "192.168.0.2";
-        ip6 = "fd00::2";
-        extraConfig = lib.mkMerge [
-          commonConfig
-          {
-            networking.useNetworkd = true;
-            networking.wg-quick.interfaces.wg0 = {
-              type = "amneziawg";
+    peer1 = peer {
+      ip4 = "192.168.0.2";
+      ip6 = "fd00::2";
+      extraConfig = {
+        imports = [ commonConfig ];
+
+        networking.useNetworkd = true;
+        networking.wg-quick.interfaces.wg0 = {
+          type = "amneziawg";
 
-              address = [
-                "10.23.42.2/32"
-                "fc00::2/128"
-              ];
-              inherit (wg-snakeoil-keys.peer1) privateKey;
+          address = [
+            "10.23.42.2/32"
+            "fc00::2/128"
+          ];
+          inherit (wg-snakeoil-keys.peer1) privateKey;
 
-              peers = lib.singleton {
-                allowedIPs = [
-                  "0.0.0.0/0"
-                  "::/0"
-                ];
-                endpoint = "192.168.0.1:23542";
-                persistentKeepalive = 25;
+          peers = lib.singleton {
+            allowedIPs = [
+              "0.0.0.0/0"
+              "::/0"
+            ];
+            endpoint = "192.168.0.1:23542";
+            persistentKeepalive = 25;
 
-                inherit (wg-snakeoil-keys.peer0) publicKey;
-              };
+            inherit (wg-snakeoil-keys.peer0) publicKey;
+          };
 
-              dns = [
-                "10.23.42.1"
-                "fc00::1"
-                "wg0"
-              ];
+          dns = [
+            "10.23.42.1"
+            "fc00::1"
+            "wg0"
+          ];
 
-              inherit extraOptions;
-            };
-          }
-        ];
+          inherit extraOptions;
+        };
       };
     };
+  };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      peer0.wait_for_unit("wg-quick-wg0.service")
-      peer1.wait_for_unit("wg-quick-wg0.service")
+    peer0.wait_for_unit("wg-quick-wg0.service")
+    peer1.wait_for_unit("wg-quick-wg0.service")
 
-      peer1.succeed("ping -c5 fc00::1")
-      peer1.succeed("ping -c5 10.23.42.1")
-    '';
-  }
-)
+    peer1.succeed("ping -c5 fc00::1")
+    peer1.succeed("ping -c5 10.23.42.1")
+  '';
+}

nixos/tests/wireguard/amneziawg.nix

···
-import ../make-test-python.nix (
-  {
-    pkgs,
-    lib,
-    kernelPackages ? null,
-    ...
-  }:
-  let
-    wg-snakeoil-keys = import ./snakeoil-keys.nix;
-    peer = (import ./make-peer.nix) { inherit lib; };
-    extraOptions = {
-      Jc = 5;
-      Jmin = 10;
-      Jmax = 42;
-      S1 = 60;
-      S2 = 90;
-    };
-  in
-  {
-    name = "amneziawg";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [
-        averyanalex
-        azahi
-      ];
-    };
+{
+  lib,
+  kernelPackages ? null,
+  ...
+}:
+let
+  wg-snakeoil-keys = import ./snakeoil-keys.nix;
+  peer = import ./make-peer.nix;
+  extraOptions = {
+    Jc = 5;
+    Jmin = 10;
+    Jmax = 42;
+    S1 = 60;
+    S2 = 90;
+  };
+in
+{
+  name = "amneziawg";
+  meta.maintainers = with lib.maintainers; [
+    averyanalex
+    azahi
+  ];
 
-    nodes = {
-      peer0 = peer {
-        ip4 = "192.168.0.1";
-        ip6 = "fd00::1";
-        extraConfig = {
-          boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; };
+  nodes = {
+    peer0 = peer {
+      ip4 = "192.168.0.1";
+      ip6 = "fd00::1";
+      extraConfig =
+        { lib, pkgs, ... }:
+        {
+          boot.kernelPackages = lib.mkIf (kernelPackages != null) (kernelPackages pkgs);
           networking.firewall.allowedUDPPorts = [ 23542 ];
           networking.wireguard.interfaces.wg0 = {
             type = "amneziawg";
···
             inherit extraOptions;
           };
         };
-      };
+    };
 
-      peer1 = peer {
-        ip4 = "192.168.0.2";
-        ip6 = "fd00::2";
-        extraConfig = {
-          boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; };
+    peer1 = peer {
+      ip4 = "192.168.0.2";
+      ip6 = "fd00::2";
+      extraConfig =
+        { lib, pkgs, ... }:
+        {
+          boot.kernelPackages = lib.mkIf (kernelPackages != null) (kernelPackages pkgs);
           networking.wireguard.interfaces.wg0 = {
             type = "amneziawg";
             ips = [
···
 
             postSetup =
               let
-                inherit (pkgs) iproute2;
+                ip = lib.getExe' pkgs.iproute2 "ip";
               in
               ''
-                ${iproute2}/bin/ip route replace 10.23.42.1/32 dev wg0
-                ${iproute2}/bin/ip route replace fc00::1/128 dev wg0
+                ${ip} route replace 10.23.42.1/32 dev wg0
+                ${ip} route replace fc00::1/128 dev wg0
               '';
 
             inherit extraOptions;
           };
         };
-      };
     };
+  };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      peer0.wait_for_unit("wireguard-wg0.service")
-      peer1.wait_for_unit("wireguard-wg0.service")
+    peer0.wait_for_unit("wireguard-wg0.service")
+    peer1.wait_for_unit("wireguard-wg0.service")
 
-      peer1.succeed("ping -c5 fc00::1")
-      peer1.succeed("ping -c5 10.23.42.1")
-    '';
-  }
-)
+    peer1.succeed("ping -c5 fc00::1")
+    peer1.succeed("ping -c5 10.23.42.1")
+  '';
+}

nixos/tests/wireguard/basic.nix

···
-import ../make-test-python.nix (
-  {
-    pkgs,
-    lib,
-    kernelPackages ? null,
-    ...
-  }:
-  let
-    wg-snakeoil-keys = import ./snakeoil-keys.nix;
-    peer = (import ./make-peer.nix) { inherit lib; };
-  in
-  {
-    name = "wireguard";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ ma27 ];
-    };
+{
+  lib,
+  kernelPackages ? null,
+  ...
+}:
+let
+  wg-snakeoil-keys = import ./snakeoil-keys.nix;
+  peer = import ./make-peer.nix;
+in
+{
+  name = "wireguard";
+  meta.maintainers = with lib.maintainers; [ ma27 ];
 
-    nodes = {
-      peer0 = peer {
-        ip4 = "192.168.0.1";
-        ip6 = "fd00::1";
-        extraConfig = {
-          boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; };
+  nodes = {
+    peer0 = peer {
+      ip4 = "192.168.0.1";
+      ip6 = "fd00::1";
+      extraConfig =
+        { lib, pkgs, ... }:
+        {
+          boot.kernelPackages = lib.mkIf (kernelPackages != null) (kernelPackages pkgs);
           networking.firewall.allowedUDPPorts = [ 23542 ];
           networking.wireguard.interfaces.wg0 = {
             ips = [
···
             };
           };
         };
-      };
+    };
 
-      peer1 = peer {
-        ip4 = "192.168.0.2";
-        ip6 = "fd00::2";
-        extraConfig = {
-          boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; };
+    peer1 = peer {
+      ip4 = "192.168.0.2";
+      ip6 = "fd00::2";
+      extraConfig =
+        { lib, pkgs, ... }:
+        {
+          boot.kernelPackages = lib.mkIf (kernelPackages != null) (kernelPackages pkgs);
           networking.wireguard.interfaces.wg0 = {
             ips = [
               "10.23.42.2/32"
···
 
             postSetup =
               let
-                inherit (pkgs) iproute2;
+                ip = lib.getExe' pkgs.iproute2 "ip";
               in
               ''
-                ${iproute2}/bin/ip route replace 10.23.42.1/32 dev wg0
-                ${iproute2}/bin/ip route replace fc00::1/128 dev wg0
+                ${ip} route replace 10.23.42.1/32 dev wg0
+                ${ip} route replace fc00::1/128 dev wg0
               '';
           };
         };
-      };
     };
+  };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      peer0.wait_for_unit("wireguard-wg0.service")
-      peer1.wait_for_unit("wireguard-wg0.service")
+    peer0.wait_for_unit("wireguard-wg0.service")
+    peer1.wait_for_unit("wireguard-wg0.service")
 
-      peer1.succeed("ping -c5 fc00::1")
-      peer1.succeed("ping -c5 10.23.42.1")
-    '';
-  }
-)
+    peer1.succeed("ping -c5 fc00::1")
+    peer1.succeed("ping -c5 10.23.42.1")
+  '';
+}

nixos/tests/wireguard/default.nix

···
 {
-  system ? builtins.currentSystem,
-  config ? { },
-  pkgs ? import ../../.. { inherit system config; },
+  runTest,
+  lib,
+  pkgs,
   # Test current default (LTS) and latest kernel
   kernelVersionsToTest ? [
-    (pkgs.lib.versions.majorMinor pkgs.linuxPackages.kernel.version)
+    (lib.versions.majorMinor pkgs.linuxPackages.kernel.version)
     "latest"
   ],
 }:
 
-with pkgs.lib;
-
 let
   tests =
     let
-      callTest = p: args: import p ({ inherit system pkgs; } // args);
+      callTest =
+        p: args:
+        runTest {
+          imports = [ p ];
+          _module = { inherit args; };
+        };
     in
     {
       basic = callTest ./basic.nix;
       amneziawg = callTest ./amneziawg.nix;
       namespaces = callTest ./namespaces.nix;
       networkd = callTest ./networkd.nix;
-      wg-quick = callTest ./wg-quick.nix;
+      wg-quick = args: callTest ./wg-quick.nix ({ nftables = false; } // args);
       wg-quick-nftables = args: callTest ./wg-quick.nix ({ nftables = true; } // args);
-      amneziawg-quick = callTest ./amneziawg-quick.nix;
+      amneziawg-quick = args: callTest ./amneziawg-quick.nix ({ nftables = false; } // args);
       generated = callTest ./generated.nix;
-      dynamic-refresh = callTest ./dynamic-refresh.nix;
+      dynamic-refresh = args: callTest ./dynamic-refresh.nix ({ useNetworkd = false; } // args);
       dynamic-refresh-networkd = args: callTest ./dynamic-refresh.nix ({ useNetworkd = true; } // args);
     };
 in
 
-listToAttrs (
-  flip concatMap kernelVersionsToTest (
+lib.listToAttrs (
+  lib.flip lib.concatMap kernelVersionsToTest (
     version:
     let
-      v' = replaceStrings [ "." ] [ "_" ] version;
+      v' = lib.replaceString "." "_" version;
     in
-    flip mapAttrsToList tests (
+    lib.flip lib.mapAttrsToList tests (
       name: test:
-      nameValuePair "wireguard-${name}-linux-${v'}" (test {
+      lib.nameValuePair "wireguard-${name}-linux-${v'}" (test {
         kernelPackages =
-          if v' == "latest" then pkgs.linuxPackages_latest else pkgs.linuxKernel.packages."linux_${v'}";
+          pkgs: if v' == "latest" then pkgs.linuxPackages_latest else pkgs.linuxKernel.packages."linux_${v'}";
       })
     )
   )

nixos/tests/wireguard/dynamic-refresh.nix

···
-import ../make-test-python.nix (
-  {
-    pkgs,
-    lib,
-    kernelPackages ? null,
-    useNetworkd ? false,
-    ...
-  }:
-  let
-    wg-snakeoil-keys = import ./snakeoil-keys.nix;
-  in
-  {
-    name = "wireguard-dynamic-refresh";
-    meta = with lib.maintainers; {
-      maintainers = [ majiir ];
-    };
+{
+  lib,
+  kernelPackages ? null,
+  useNetworkd ? false,
+  ...
+}:
+let
+  wg-snakeoil-keys = import ./snakeoil-keys.nix;
+in
+{
+  name = "wireguard-dynamic-refresh";
+  meta.maintainers = with lib.maintainers; [ majiir ];
 
-    nodes = {
-      server = {
+  nodes = {
+    server =
+      { lib, pkgs, ... }:
+      {
         virtualisation.vlans = [
           1
           2
         ];
-        boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; };
+        boot.kernelPackages = lib.mkIf (kernelPackages != null) (kernelPackages pkgs);
         networking.firewall.allowedUDPPorts = [ 23542 ];
         networking.useDHCP = false;
         networking.wireguard.useNetworkd = useNetworkd;
···
         };
       };
 
-      client =
-        { nodes, ... }:
-        {
-          virtualisation.vlans = [
-            1
-            2
-          ];
-          boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; };
-          networking.useDHCP = false;
-          networking.wireguard.useNetworkd = useNetworkd;
-          networking.wireguard.interfaces.wg0 = {
-            ips = [ "10.23.42.2/32" ];
+    client =
+      {
+        nodes,
+        lib,
+        pkgs,
+        ...
+      }:
+      {
+        virtualisation.vlans = [
+          1
+          2
+        ];
+        boot.kernelPackages = lib.mkIf (kernelPackages != null) (kernelPackages pkgs);
+        networking.useDHCP = false;
+        networking.wireguard.useNetworkd = useNetworkd;
+        networking.wireguard.interfaces.wg0 = {
+          ips = [ "10.23.42.2/32" ];
 
-            # !!! Don't do this with real keys. The /nix store is world-readable!
-            privateKeyFile = toString (pkgs.writeText "privateKey" wg-snakeoil-keys.peer1.privateKey);
+          # !!! Don't do this with real keys. The /nix store is world-readable!
+          privateKeyFile = toString (pkgs.writeText "privateKey" wg-snakeoil-keys.peer1.privateKey);
 
-            dynamicEndpointRefreshSeconds = 2;
+          dynamicEndpointRefreshSeconds = 2;
 
-            peers = lib.singleton {
-              allowedIPs = [
-                "0.0.0.0/0"
-                "::/0"
-              ];
-              endpoint = "server:23542";
+          peers = lib.singleton {
+            allowedIPs = [
+              "0.0.0.0/0"
+              "::/0"
+            ];
+            endpoint = "server:23542";
 
-              inherit (wg-snakeoil-keys.peer0) publicKey;
-            };
+            inherit (wg-snakeoil-keys.peer0) publicKey;
           };
+        };
 
-          specialisation.update-hosts.configuration = {
-            networking.extraHosts =
-              let
-                testCfg = nodes.server.virtualisation.test;
-              in
-              lib.mkForce "192.168.2.${toString testCfg.nodeNumber} ${testCfg.nodeName}";
-          };
+        specialisation.update-hosts.configuration = {
+          networking.extraHosts =
+            let
+              testCfg = nodes.server.virtualisation.test;
+            in
+            lib.mkForce "192.168.2.${toString testCfg.nodeNumber} ${testCfg.nodeName}";
         };
-    };
+      };
+  };
 
-    testScript =
-      { nodes, ... }:
-      ''
-        start_all()
+  testScript =
+    { nodes, ... }:
+    ''
+      start_all()
 
-        server.systemctl("start network-online.target")
-        server.wait_for_unit("network-online.target")
+      server.systemctl("start network-online.target")
+      server.wait_for_unit("network-online.target")
 
-        client.systemctl("start network-online.target")
-        client.wait_for_unit("network-online.target")
+      client.systemctl("start network-online.target")
+      client.wait_for_unit("network-online.target")
 
-        client.succeed("ping -n -w 1 -c 1 10.23.42.1")
+      client.succeed("ping -n -w 1 -c 1 10.23.42.1")
 
-        client.succeed("ip link set down eth1")
+      client.succeed("ip link set down eth1")
 
-        client.fail("ping -n -w 1 -c 1 10.23.42.1")
+      client.fail("ping -n -w 1 -c 1 10.23.42.1")
 
-        with client.nested("update hosts file"):
-          client.succeed("${nodes.client.system.build.toplevel}/specialisation/update-hosts/bin/switch-to-configuration test")
+      with client.nested("update hosts file"):
+        client.succeed("${nodes.client.system.build.toplevel}/specialisation/update-hosts/bin/switch-to-configuration test")
 
-        client.succeed("sleep 5 && ping -n -w 1 -c 1 10.23.42.1")
-      '';
-  }
-)
+      client.succeed("sleep 5 && ping -n -w 1 -c 1 10.23.42.1")
+    '';
+}

nixos/tests/wireguard/generated.nix

···
-import ../make-test-python.nix (
-  {
-    pkgs,
-    lib,
-    kernelPackages ? null,
-    ...
-  }:
-  {
-    name = "wireguard-generated";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [
-        ma27
-        grahamc
-      ];
-    };
+{
+  lib,
+  kernelPackages ? null,
+  ...
+}:
+{
+  name = "wireguard-generated";
+  meta.maintainers = with lib.maintainers; [
+    ma27
+    grahamc
+  ];
 
-    nodes = {
-      peer1 = {
-        boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; };
+  nodes = {
+    peer1 =
+      { lib, pkgs, ... }:
+      {
+        boot.kernelPackages = lib.mkIf (kernelPackages != null) (kernelPackages pkgs);
         networking.firewall.allowedUDPPorts = [ 12345 ];
         networking.wireguard.interfaces.wg0 = {
           ips = [ "10.10.10.1/24" ];
···
         };
       };
 
-      peer2 = {
-        boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; };
+    peer2 =
+      { lib, pkgs, ... }:
+      {
+        boot.kernelPackages = lib.mkIf (kernelPackages != null) (kernelPackages pkgs);
         networking.firewall.allowedUDPPorts = [ 12345 ];
         networking.wireguard.interfaces.wg0 = {
           ips = [ "10.10.10.2/24" ];
···
           generatePrivateKeyFile = true;
         };
       };
-    };
+  };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      peer1.wait_for_unit("wireguard-wg0.service")
-      peer2.wait_for_unit("wireguard-wg0.service")
+    peer1.wait_for_unit("wireguard-wg0.service")
+    peer2.wait_for_unit("wireguard-wg0.service")
 
-      retcode, peer1pubkey = peer1.execute("wg pubkey < /etc/wireguard/private")
-      if retcode != 0:
-          raise Exception("Could not read public key from peer1")
+    retcode, peer1pubkey = peer1.execute("wg pubkey < /etc/wireguard/private")
+    if retcode != 0:
+        raise Exception("Could not read public key from peer1")
 
-      retcode, peer2pubkey = peer2.execute("wg pubkey < /etc/wireguard/private")
-      if retcode != 0:
-          raise Exception("Could not read public key from peer2")
+    retcode, peer2pubkey = peer2.execute("wg pubkey < /etc/wireguard/private")
+    if retcode != 0:
+        raise Exception("Could not read public key from peer2")
 
-      peer1.succeed(
-          "wg set wg0 peer {} allowed-ips 10.10.10.2/32 endpoint 192.168.1.2:12345 persistent-keepalive 1".format(
-              peer2pubkey.strip()
-          )
-      )
-      peer1.succeed("ip route replace 10.10.10.2/32 dev wg0 table main")
+    peer1.succeed(
+        "wg set wg0 peer {} allowed-ips 10.10.10.2/32 endpoint 192.168.1.2:12345 persistent-keepalive 1".format(
+            peer2pubkey.strip()
+        )
+    )
+    peer1.succeed("ip route replace 10.10.10.2/32 dev wg0 table main")
 
-      peer2.succeed(
-          "wg set wg0 peer {} allowed-ips 10.10.10.1/32 endpoint 192.168.1.1:12345 persistent-keepalive 1".format(
-              peer1pubkey.strip()
-          )
-      )
-      peer2.succeed("ip route replace 10.10.10.1/32 dev wg0 table main")
+    peer2.succeed(
+        "wg set wg0 peer {} allowed-ips 10.10.10.1/32 endpoint 192.168.1.1:12345 persistent-keepalive 1".format(
+            peer1pubkey.strip()
+        )
+    )
+    peer2.succeed("ip route replace 10.10.10.1/32 dev wg0 table main")
 
-      peer1.succeed("ping -c1 10.10.10.2")
-      peer2.succeed("ping -c1 10.10.10.1")
-    '';
-  }
-)
+    peer1.succeed("ping -c1 10.10.10.2")
+    peer2.succeed("ping -c1 10.10.10.1")
+  '';
+}

nixos/tests/wireguard/make-peer.nix

···
-{ lib, ... }:
 {
   ip4,
   ip6,
   extraConfig,
 }:
-lib.mkMerge [
-  {
-    boot.kernel.sysctl = {
-      "net.ipv6.conf.all.forwarding" = "1";
-      "net.ipv6.conf.default.forwarding" = "1";
-      "net.ipv4.ip_forward" = "1";
-    };
+{
+  imports = [
+    {
+      boot.kernel.sysctl = {
+        "net.ipv6.conf.all.forwarding" = "1";
+        "net.ipv6.conf.default.forwarding" = "1";
+        "net.ipv4.ip_forward" = "1";
+      };
 
-    networking.useDHCP = false;
-    networking.interfaces.eth1 = {
-      ipv4.addresses = [
-        {
-          address = ip4;
-          prefixLength = 24;
-        }
-      ];
-      ipv6.addresses = [
-        {
-          address = ip6;
-          prefixLength = 64;
-        }
-      ];
-    };
-  }
-  extraConfig
-]
+      networking.useDHCP = false;
+      networking.interfaces.eth1 = {
+        ipv4.addresses = [
+          {
+            address = ip4;
+            prefixLength = 24;
+          }
+        ];
+        ipv6.addresses = [
+          {
+            address = ip6;
+            prefixLength = 64;
+          }
+        ];
+      };
+    }
+    extraConfig
+  ];
+}

nixos/tests/wireguard/namespaces.nix

···
+{
+  lib,
+  kernelPackages ? null,
+  ...
+}:
 let
   listenPort = 12345;
   socketNamespace = "foo";
···
       generatePrivateKeyFile = true;
     };
   };
-
 in
-
-import ../make-test-python.nix (
-  {
-    pkgs,
-    lib,
-    kernelPackages ? null,
-    ...
-  }:
-  {
-    name = "wireguard-with-namespaces";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ asymmetric ];
-    };
+{
+  name = "wireguard-with-namespaces";
+  meta.maintainers = with lib.maintainers; [ asymmetric ];
 
-    nodes = {
-      # interface should be created in the socketNamespace
-      # and not moved from there
-      peer0 = pkgs.lib.attrsets.recursiveUpdate node {
-        boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; };
+  nodes = {
+    # interface should be created in the socketNamespace
+    # and not moved from there
+    peer0 =
+      { lib, pkgs, ... }:
+      lib.attrsets.recursiveUpdate node {
+        boot.kernelPackages = lib.mkIf (kernelPackages != null) (kernelPackages pkgs);
         networking.wireguard.interfaces.wg0 = {
           preSetup = ''
             ip netns add ${socketNamespace}
···
           inherit socketNamespace;
         };
       };
-      # interface should be created in the init namespace
-      # and moved to the interfaceNamespace
-      peer1 = pkgs.lib.attrsets.recursiveUpdate node {
-        boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; };
+    # interface should be created in the init namespace
+    # and moved to the interfaceNamespace
+    peer1 =
+      { lib, pkgs, ... }:
+      lib.attrsets.recursiveUpdate node {
+        boot.kernelPackages = lib.mkIf (kernelPackages != null) (kernelPackages pkgs);
         networking.wireguard.interfaces.wg0 = {
           preSetup = ''
             ip netns add ${interfaceNamespace}
···
           inherit interfaceNamespace;
         };
       };
-      # interface should be created in the socketNamespace
-      # and moved to the interfaceNamespace
-      peer2 = pkgs.lib.attrsets.recursiveUpdate node {
-        boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; };
+    # interface should be created in the socketNamespace
+    # and moved to the interfaceNamespace
+    peer2 =
+      { lib, pkgs, ... }:
+      lib.attrsets.recursiveUpdate node {
+        boot.kernelPackages = lib.mkIf (kernelPackages != null) (kernelPackages pkgs);
         networking.wireguard.interfaces.wg0 = {
           preSetup = ''
             ip netns add ${socketNamespace}
···
           inherit socketNamespace interfaceNamespace;
         };
       };
-      # interface should be created in the socketNamespace
-      # and moved to the init namespace
-      peer3 = pkgs.lib.attrsets.recursiveUpdate node {
-        boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; };
+    # interface should be created in the socketNamespace
+    # and moved to the init namespace
+    peer3 =
+      { lib, pkgs, ... }:
+      lib.attrsets.recursiveUpdate node {
+        boot.kernelPackages = lib.mkIf (kernelPackages != null) (kernelPackages pkgs);
         networking.wireguard.interfaces.wg0 = {
           preSetup = ''
             ip netns add ${socketNamespace}
···
           interfaceNamespace = "init";
         };
       };
-    };
+  };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      for machine in peer0, peer1, peer2, peer3:
-          machine.wait_for_unit("wireguard-wg0.service")
+    for machine in peer0, peer1, peer2, peer3:
+        machine.wait_for_unit("wireguard-wg0.service")
 
-      peer0.succeed("ip -n ${socketNamespace} link show wg0")
-      peer1.succeed("ip -n ${interfaceNamespace} link show wg0")
-      peer2.succeed("ip -n ${interfaceNamespace} link show wg0")
-      peer3.succeed("ip link show wg0")
-    '';
-  }
-)
+    peer0.succeed("ip -n ${socketNamespace} link show wg0")
+    peer1.succeed("ip -n ${interfaceNamespace} link show wg0")
+    peer2.succeed("ip -n ${interfaceNamespace} link show wg0")
+    peer3.succeed("ip link show wg0")
+  '';
+}

nixos/tests/wireguard/networkd.nix

···
-import ../make-test-python.nix (
-  {
-    pkgs,
-    lib,
-    kernelPackages ? null,
-    ...
-  }:
-  let
-    wg-snakeoil-keys = import ./snakeoil-keys.nix;
-    peer = (import ./make-peer.nix) { inherit lib; };
-  in
-  {
-    name = "wireguard-networkd";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ majiir ];
-    };
+{
+  lib,
+  kernelPackages ? null,
+  ...
+}:
+let
+  wg-snakeoil-keys = import ./snakeoil-keys.nix;
+  peer = import ./make-peer.nix;
+in
+{
+  name = "wireguard-networkd";
+  meta.maintainers = with lib.maintainers; [ majiir ];
 
-    nodes = {
-      peer0 = peer {
-        ip4 = "192.168.0.1";
-        ip6 = "fd00::1";
-        extraConfig = {
-          boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; };
+  nodes = {
+    peer0 = peer {
+      ip4 = "192.168.0.1";
+      ip6 = "fd00::1";
+      extraConfig =
+        { lib, pkgs, ... }:
+        {
+          boot.kernelPackages = lib.mkIf (kernelPackages != null) (kernelPackages pkgs);
           networking.firewall.allowedUDPPorts = [ 23542 ];
           networking.wireguard.useNetworkd = true;
           networking.wireguard.interfaces.wg0 = {
···
             };
           };
         };
-      };
+    };
 
-      peer1 = peer {
-        ip4 = "192.168.0.2";
-        ip6 = "fd00::2";
-        extraConfig = {
-          boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; };
+    peer1 = peer {
+      ip4 = "192.168.0.2";
+      ip6 = "fd00::2";
+      extraConfig =
+        { lib, pkgs, ... }:
+        {
+          boot.kernelPackages = lib.mkIf (kernelPackages != null) (kernelPackages pkgs);
           networking.wireguard.useNetworkd = true;
           networking.wireguard.interfaces.wg0 = {
             ips = [
···
             };
           };
         };
-      };
     };
+  };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      peer0.systemctl("start network-online.target")
-      peer0.wait_for_unit("network-online.target")
+    peer0.systemctl("start network-online.target")
+    peer0.wait_for_unit("network-online.target")
 
-      peer1.systemctl("start network-online.target")
-      peer1.wait_for_unit("network-online.target")
+    peer1.systemctl("start network-online.target")
+    peer1.wait_for_unit("network-online.target")
 
-      peer1.succeed("ping -c5 fc00::1")
-      peer1.succeed("ping -c5 10.23.42.1")
+    peer1.succeed("ping -c5 fc00::1")
+    peer1.succeed("ping -c5 10.23.42.1")
 
-      with subtest("Has PSK set"):
-        peer0.succeed("wg | grep 'preshared key'")
-        peer1.succeed("wg | grep 'preshared key'")
-    '';
-  }
-)
+    with subtest("Has PSK set"):
+      peer0.succeed("wg | grep 'preshared key'")
+      peer1.succeed("wg | grep 'preshared key'")
+  '';
+}

nixos/tests/wireguard/wg-quick.nix

···
-import ../make-test-python.nix (
-  {
-    pkgs,
-    lib,
-    kernelPackages ? null,
-    nftables ? false,
-    ...
-  }:
-  let
-    wg-snakeoil-keys = import ./snakeoil-keys.nix;
-    peer = import ./make-peer.nix { inherit lib; };
-    commonConfig = {
-      boot.kernelPackages = lib.mkIf (kernelPackages != null) kernelPackages;
+{
+  lib,
+  kernelPackages ? null,
+  nftables ? false,
+  ...
+}:
+let
+  wg-snakeoil-keys = import ./snakeoil-keys.nix;
+  peer = import ./make-peer.nix;
+  commonConfig =
+    { pkgs, ... }:
+    {
+      boot.kernelPackages = lib.mkIf (kernelPackages != null) (kernelPackages pkgs);
       networking.nftables.enable = nftables;
       # Make sure iptables doesn't work with nftables enabled
       boot.blacklistedKernelModules = lib.mkIf nftables [ "nft_compat" ];
     };
-  in
-  {
-    name = "wg-quick";
+in
+{
+  name = "wg-quick";
 
-    nodes = {
-      peer0 = peer {
-        ip4 = "192.168.0.1";
-        ip6 = "fd00::1";
-        extraConfig = lib.mkMerge [
-          commonConfig
-          {
-            networking.firewall.allowedUDPPorts = [ 23542 ];
-            networking.wg-quick.interfaces.wg0 = {
-              address = [
-                "10.23.42.1/32"
-                "fc00::1/128"
-              ];
-              listenPort = 23542;
+  nodes = {
+    peer0 = peer {
+      ip4 = "192.168.0.1";
+      ip6 = "fd00::1";
+      extraConfig = {
+        imports = [ commonConfig ];
 
-              inherit (wg-snakeoil-keys.peer0) privateKey;
+        networking.firewall.allowedUDPPorts = [ 23542 ];
+        networking.wg-quick.interfaces.wg0 = {
+          address = [
+            "10.23.42.1/32"
+            "fc00::1/128"
+          ];
+          listenPort = 23542;
 
-              peers = lib.singleton {
-                allowedIPs = [
-                  "10.23.42.2/32"
-                  "fc00::2/128"
-                ];
+          inherit (wg-snakeoil-keys.peer0) privateKey;
+
+          peers = lib.singleton {
+            allowedIPs = [
+              "10.23.42.2/32"
+              "fc00::2/128"
+            ];
 
-                inherit (wg-snakeoil-keys.peer1) publicKey;
-              };
+            inherit (wg-snakeoil-keys.peer1) publicKey;
+          };
 
-              dns = [
-                "10.23.42.2"
-                "fc00::2"
-                "wg0"
-              ];
-            };
-          }
-        ];
+          dns = [
+            "10.23.42.2"
+            "fc00::2"
+            "wg0"
+          ];
+        };
       };
+    };
 
-      peer1 = peer {
-        ip4 = "192.168.0.2";
-        ip6 = "fd00::2";
-        extraConfig = lib.mkMerge [
-          commonConfig
-          {
-            networking.useNetworkd = true;
-            networking.wg-quick.interfaces.wg0 = {
-              address = [
-                "10.23.42.2/32"
-                "fc00::2/128"
-              ];
-              inherit (wg-snakeoil-keys.peer1) privateKey;
+    peer1 = peer {
+      ip4 = "192.168.0.2";
+      ip6 = "fd00::2";
+      extraConfig = {
+        imports = [ commonConfig ];
 
-              peers = lib.singleton {
-                allowedIPs = [
-                  "0.0.0.0/0"
-                  "::/0"
-                ];
-                endpoint = "192.168.0.1:23542";
-                persistentKeepalive = 25;
+        networking.useNetworkd = true;
+        networking.wg-quick.interfaces.wg0 = {
+          address = [
+            "10.23.42.2/32"
+            "fc00::2/128"
+          ];
+          inherit (wg-snakeoil-keys.peer1) privateKey;
+
+          peers = lib.singleton {
+            allowedIPs = [
+              "0.0.0.0/0"
+              "::/0"
+            ];
+            endpoint = "192.168.0.1:23542";
+            persistentKeepalive = 25;
 
-                inherit (wg-snakeoil-keys.peer0) publicKey;
-              };
+            inherit (wg-snakeoil-keys.peer0) publicKey;
+          };
 
-              dns = [
-                "10.23.42.1"
-                "fc00::1"
-                "wg0"
-              ];
-            };
-          }
-        ];
+          dns = [
+            "10.23.42.1"
+            "fc00::1"
+            "wg0"
+          ];
+        };
       };
     };
+  };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      peer0.wait_for_unit("wg-quick-wg0.service")
-      peer1.wait_for_unit("wg-quick-wg0.service")
+    peer0.wait_for_unit("wg-quick-wg0.service")
+    peer1.wait_for_unit("wg-quick-wg0.service")
 
-      peer1.succeed("ping -c5 fc00::1")
-      peer1.succeed("ping -c5 10.23.42.1")
-    '';
-  }
-)
+    peer1.succeed("ping -c5 fc00::1")
+    peer1.succeed("ping -c5 10.23.42.1")
+  '';
+}

pkgs/applications/networking/cluster/krane/default.nix pkgs/by-name/kr/krane/package.nix

···
 
   passthru.updateScript = bundlerUpdateScript "krane";
 
-  meta = with lib; {
+  meta = {
     description = "Command-line tool that helps you ship changes to a Kubernetes namespace and understand the result";
     homepage = "https://github.com/Shopify/krane";
     changelog = "https://github.com/Shopify/krane/blob/main/CHANGELOG.md";
-    license = licenses.mit;
-    maintainers = with maintainers; [ kira-bruneau ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ kira-bruneau ];
   };
 }

pkgs/by-name/_0/_0verkill/package.nix

···
   lib,
   gccStdenv,
   fetchFromGitHub,
-  autoreconfHook269,
+  autoreconfHook,
   xorgproto,
   libX11,
   libXpm,
···
     sha256 = "WO7PN192HhcDl6iHIbVbH7MVMi1Tl2KyQbDa9DWRO6M=";
   };
 
-  nativeBuildInputs = [ autoreconfHook269 ];
+  nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [
     libX11
     xorgproto
···
   ];
 
   configureFlags = [ "--with-x" ];
-
-  preAutoreconf = ''
-    autoupdate
-  '';
 
   # The code needs an update for gcc-10:
   #   https://github.com/hackndev/0verkill/issues/7

pkgs/by-name/ba/bark-server/package.nix

···
 
 buildGoModule (finalAttrs: {
   pname = "bark-server";
-  version = "2.2.1";
+  version = "2.2.5";
 
   src = fetchFromGitHub {
     owner = "Finb";
     repo = "bark-server";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wwb3k68tjdmN+dy5CKJoUIScLXzNucq6wXy1HgXNa/0=";
+    hash = "sha256-Fe0PXwwVCrvoMTYMoTUkQaT6kVDdGPadFLkTDRhlh5U=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
···
     '';
   };
 
-  vendorHash = "sha256-FTzSlliphTukCNf+cGGKWK798SARdEkE2HpfWS8ZlNc=";
+  vendorHash = "sha256-lpRxwCF+3+32FSn5XQ551l2ONtyuA9ewDQgwHgYUnT0=";
 
   ldflags = [
     "-s"

pkgs/by-name/ba/basedpyright/package.nix

···
 
 buildNpmPackage rec {
   pname = "basedpyright";
-  version = "1.30.1";
+  version = "1.31.0";
 
   src = fetchFromGitHub {
     owner = "detachhead";
     repo = "basedpyright";
     tag = "v${version}";
-    hash = "sha256-YPjeiRg7vIpb9k32og6byWMk+EfhDS9MwfJveAndbQQ=";
+    hash = "sha256-vgOo44ZvuySxQP9qJC7kXUVkOT1RhJ+/giqNBTCzpAg=";
   };
 
   npmDepsHash = "sha256-aJte4ApeXJQ9EYn87Uo+Xx7s+wi80I1JsZHeqklHGs4=";

pkgs/by-name/ch/chawan/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "chawan";
-  version = "0.2.0";
+  version = "0.2.1";
 
   src = fetchFromSourcehut {
     owner = "~bptato";
     repo = "chawan";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-DiA7SEXPJTScdoFeGzH45wZP6gZRU8t/fvJLOufuNmU=";
+    hash = "sha256-n0hyAT6XuNJTpjLlYiiDER1xrz8nwT+Q2kSkg28Y8zE=";
   };
 
   patches = [ ./mancha-augment-path.diff ];
···
   meta = {
     description = "Lightweight and featureful terminal web browser";
     homepage = "https://sr.ht/~bptato/chawan/";
+    changelog = "https://git.sr.ht/~bptato/chawan/refs/v${finalAttrs.version}";
     license = lib.licenses.publicDomain;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ ];

pkgs/by-name/cl/cloud-hypervisor/package.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "cloud-hypervisor";
-  version = "46.0";
+  version = "47.0";
 
   src = fetchFromGitHub {
     owner = "cloud-hypervisor";
     repo = "cloud-hypervisor";
     rev = "v${version}";
-    hash = "sha256-3jFZgcTyjbAB4Ka8ZHeqorlVTkAvXJ2No32038xK0Pc=";
+    hash = "sha256-NzvK6gKu7pWwTqLaeDKyYedIjzRa85k9PGUGfeA2Y4c=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Zllj6HGRgI1tT8EODGOpSgmw3F89ie9Y1hChTrvwskg=";
+  cargoHash = "sha256-s3lBlYbE9xoLov8JWeX89A7J00tCISoCDHHBoEcILus=";
 
   separateDebugInfo = true;
 

pkgs/by-name/ea/easyeffects/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "easyeffects";
-  version = "7.2.4";
+  version = "7.2.5";
 
   src = fetchFromGitHub {
     owner = "wwmm";
     repo = "easyeffects";
     tag = "v${version}";
-    hash = "sha256-C+zorQ7AFx72eOHUtjCHB2/1i1gnAoSMfEB+dWJIXHM=";
+    hash = "sha256-w3Mb13LOSF8vgcdJrqbesLqyyilI5AoA19jFquE5lEw=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/el/element-desktop/element-desktop-pin.nix

···
 {
-  "version" = "1.11.105";
+  "version" = "1.11.106";
   "hashes" = {
-    "desktopSrcHash" = "sha256-9btwbHHl1tiUBTMBltNdy8K/PHJOf3HKPWEPyAYz6+s=";
-    "desktopYarnHash" = "sha256-VumuYbbJlJCtmENeR/qHGl9jhF1xgIUib5CW7kGdToo=";
+    "desktopSrcHash" = "sha256-uQUd84MtwMTGhhw83pQk9jI79pNKBVTWJLz8dyT/SE4=";
+    "desktopYarnHash" = "sha256-WZYRPU3ZswAtUAZDJnlELLU1JImO3uFaYHQl+kJOeqk=";
   };
 }

pkgs/by-name/el/element-web-unwrapped/element-web-pin.nix

···
 {
-  "version" = "1.11.105";
+  "version" = "1.11.106";
   "hashes" = {
-    "webSrcHash" = "sha256-IGpSpv1dfOnT6AQGzRYWE/eGW262i7mYGC4DmUnMwlk=";
-    "webYarnHash" = "sha256-cigiAKAJaOSCVaPThGhGi0HZYMZY8i3nnBT5PS7QVNg=";
+    "webSrcHash" = "sha256-1l7A+cpXAsTmNbRZgFevPh7Tr/uMHDJkOCNHoc5lGX8=";
+    "webYarnHash" = "sha256-N+aVIKLqTc9lwATYtoIHl7KGiREtWJdMa8bxEv60LQo=";
   };
 }

pkgs/by-name/et/etesync-dav/package.nix

···
 }:
 python3Packages.buildPythonApplication rec {
   pname = "etesync-dav";
-  version = "0.34.0";
-  format = "pyproject";
+  version = "0.35.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "etesync";
     repo = "etesync-dav";
     tag = "v${version}";
-    hash = "sha256-+rNqyksOmDUh0OuvgEDWv6tuZQkn1gizz35Ptr6izos=";
+    hash = "sha256-CD02nuA9GD/oe7mjExUHIftkPxM1pZQKyDalXSoOhXY=";
   };
 
   build-system = with python3Packages; [ setuptools ];

pkgs/by-name/ga/gash/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gash";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchurl {
-    url = "mirror://savannah/gash/gash-${finalAttrs.version}.tar.gz";
-    hash = "sha256-VGrsaRBo1nfFjd/BVpXbn4CGFuGfpzMi1Ppno8iXwqk=";
+    url = "mirror://gnu/guix/mirror/gash-${finalAttrs.version}.tar.gz";
+    hash = "sha256-RwPWo+Kg3ztZCC1Ku7vJXlr2Fp/OZGCTjC7O6eaPPBk=";
   };
 
   strictDeps = true;

pkgs/by-name/lo/loco/package.nix

···
 }:
 rustPlatform.buildRustPackage rec {
   pname = "loco";
-  version = "0.15.0";
+  version = "0.16.1";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-sTPFDdiYmw+ODAcuBh4XXpSXVZbbYxfjr+WiTGit18E=";
+    hash = "sha256-5mg2caScI1sxKtadw8IP/yxDOdPN+RRqHXdsWr2R0FY=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-EsNFdk7bLRzyfncDRxqS0CQGdtPFdRRSlpTTxbQ8csI=";
+  cargoHash = "sha256-SFNaTo6fV7xhmkqK8SuFOjXeDDYN4+KTbF9DfpEX+dI=";
 
   #Skip trycmd integration tests
   checkFlags = [ "--skip=cli_tests" ];

pkgs/by-name/lz/lzbench/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "lzbench";
-  version = "2.0.1";
+  version = "2.1";
 
   src = fetchFromGitHub {
     owner = "inikep";
     repo = "lzbench";
     rev = "v${version}";
-    sha256 = "sha256-946AcnD9z60Oihm2pseS8D5j6pGdYeCxmhTLNcW9Mmc=";
+    sha256 = "sha256-JyK5Hah3X4zwmli44HEO62BYfNg7BBd0+DLlljeHmRc=";
   };
 
   enableParallelBuilding = true;
···
   meta = with lib; {
     inherit (src.meta) homepage;
     description = "In-memory benchmark of open-source LZ77/LZSS/LZMA compressors";
-    license = licenses.free;
+    license = with licenses; [
+      gpl2Only
+      gpl3Only
+    ];
     platforms = platforms.all;
+    maintainers = with lib.maintainers; [ videl ];
     mainProgram = "lzbench";
   };
 }

pkgs/by-name/mi/mirrord/manifest.json

···
 {
-  "version": "3.149.0",
+  "version": "3.152.1",
   "assets": {
     "x86_64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.149.0/mirrord_linux_x86_64",
-      "hash": "sha256-sRg0p9A8azjSSQLTltgfi62GaA0VI2bLKuL2P2hB2E8="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.152.1/mirrord_linux_x86_64",
+      "hash": "sha256-iHGwnqJQ2uEyi3Mvtkce3YU38nuHjPL0x5cSbDZ4RXk="
     },
     "aarch64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.149.0/mirrord_linux_aarch64",
-      "hash": "sha256-gbDNJh1rycJ/WzBA/wy6eLscjNQ7ktCV+CrlorCF95A="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.152.1/mirrord_linux_aarch64",
+      "hash": "sha256-6Ef5MRVUF7bNMNCFbSpUvZK6JoTdgWi/QhiqVuQIW5E="
     },
     "aarch64-darwin": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.149.0/mirrord_mac_universal",
-      "hash": "sha256-vUPuTc69yn71tLzSH6DdzWKc/yoHergglF7iL+R7PLE="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.152.1/mirrord_mac_universal",
+      "hash": "sha256-GzUpt+3GkWdMTXK1O5Daki1ASoHtf6DbufyTy5HRcm4="
     },
     "x86_64-darwin": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.149.0/mirrord_mac_universal",
-      "hash": "sha256-vUPuTc69yn71tLzSH6DdzWKc/yoHergglF7iL+R7PLE="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.152.1/mirrord_mac_universal",
+      "hash": "sha256-GzUpt+3GkWdMTXK1O5Daki1ASoHtf6DbufyTy5HRcm4="
     }
   }
 }

pkgs/by-name/mk/mkbrr/package.nix

···
 
 buildGoModule (finalAttrs: {
   pname = "mkbrr";
-  version = "1.13.0";
+  version = "1.13.1";
 
   src = fetchFromGitHub {
     owner = "autobrr";
     repo = "mkbrr";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-E5UiV7JoMzmnj8/LzVDqOuPNSockgmExmc0B9+KjGII=";
+    hash = "sha256-fX58/PRTVhUATWX5HOTtf6d6lmSRuE3xSrg/Qtzv/rs=";
   };
 
   vendorHash = "sha256-G8WM5x99UZfAZUkE5W37Ogx/OKk8JypPzGBrIuBOFNo=";

pkgs/by-name/nu/nudoku/package.nix

···
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch2,
   autoreconfHook,
   pkg-config,
   gettext,
···
     rev = version;
     hash = "sha256-aOtP23kNd15DdV6on7o80QnEf0CiUBubHfFE8M1mhg0=";
   };
+
+  patches = [
+    (fetchpatch2 {
+      url = "https://github.com/jubalh/nudoku/commit/c5fd9156d2d1f2c95a5d87b07adeaee90a7f911d.patch?full_index=1";
+      hash = "sha256-nvLKAUCDY3fQWjybVX8DaMBdk5CaegRRb/ENTI9kJ9k=";
+    })
+  ];
 
   nativeBuildInputs = [
     autoreconfHook

pkgs/by-name/s7/s7/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "s7";
-  version = "11.5-unstable-2025-07-14";
+  version = "11.5-unstable-2025-07-22";
 
   src = fetchFromGitLab {
     domain = "cm-gitlab.stanford.edu";
     owner = "bil";
     repo = "s7";
-    rev = "df56e55d023d0ed9c5be5a4fb6cd7a7f4cbc22fe";
-    hash = "sha256-iFOT7tTCTxOmLKj11NFTJ87ybE7XvLpRVQZgBTEjMbQ=";
+    rev = "03939f855e15f84f9113a92271cdfa0a09b28a67";
+    hash = "sha256-n6Uattns9TxXRi1lz/adexa13nlYXSp0usTT9uZ47JY=";
   };
 
   buildInputs = [

pkgs/by-name/st/starlark/package.nix

···
 }:
 buildGoModule {
   pname = "starlark";
-  version = "0-unstable-2025-07-01";
+  version = "0-unstable-2025-07-17";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "starlark-go";
-    rev = "d457b4515e0ec7aa889d395a3d5b60732e814e73";
-    hash = "sha256-UUZPYYjAB6Hz+jUEmnyHM+MBDbHLt8XBSm1LKFzvxrM=";
+    rev = "336a4b3a6d1d23d37a9ac38a44af558c94c2f37a";
+    hash = "sha256-FXZCwGS/OaVwYa6q14OSLYvntYItfwRvn0M/P8rbnNg=";
   };
 
   vendorHash = "sha256-8drlCBy+KROyqXzm/c+HBe/bMVOyvwRoLHxOApJhMfo=";

pkgs/by-name/ta/talosctl/package.nix

···
 
 buildGoModule rec {
   pname = "talosctl";
-  version = "1.10.4";
+  version = "1.10.5";
 
   src = fetchFromGitHub {
     owner = "siderolabs";
     repo = "talos";
     tag = "v${version}";
-    hash = "sha256-TWaORaR+3PTc+KqWuZiR5HpsuY7ox5BjQ72F8uYRzWQ=";
+    hash = "sha256-s+vRJ0qFhsgLiRpQfUnf/p6bcjQq40ISTB042iE7eBQ=";
   };
 
-  vendorHash = "sha256-SDSWWhj3MTuNASZOujKz2M3glO1dhg0cS2pdfeZXyPk=";
+  vendorHash = "sha256-lYfyW3BEqlzf2wesZwNqQPdjSKRRldEbOeyRri4GwvQ=";
 
   ldflags = [
     "-s"

pkgs/by-name/to/tokyonight-gtk-theme/package.nix

···
   stdenvNoCC.mkDerivation
   {
     inherit pname;
-    version = "0-unstable-2025-04-24";
+    version = "0-unstable-2025-07-21";
 
     src = fetchFromGitHub {
       owner = "Fausto-Korpsvart";
       repo = "Tokyonight-GTK-Theme";
-      rev = "006154c78dde52b5851347a7e91f924af62f1b8f";
-      hash = "sha256-h5k9p++zjzxGFkTK/6o/ISl/Litgf6fzy8Jf6Ikt5V8=";
+      rev = "803334a2d85ff60597e1ddd6a593462acc570298";
+      hash = "sha256-aJWyMz1FZnGOH5YXiGa9NBlNY5JRw7J7SWqt5XGKznU=";
     };
 
     propagatedUserEnvPkgs = [ gtk-engine-murrine ];

pkgs/by-name/uv/uv/package.nix

···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "uv";
-  version = "0.8.0";
+  version = "0.8.2";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "uv";
     tag = finalAttrs.version;
-    hash = "sha256-iVwiXen/VNxXQxlF7cg9qGz61cEoszNgWB3XHdl750I=";
+    hash = "sha256-qMXXkf2hLyzd+4H85kGHiQIdAbvhMA2z+1z05ZF0hts=";
   };
 
-  cargoHash = "sha256-Bw8/AAGcdE3qL0TENj4hMrOG89MLUQauMfpTmlgXdk8=";
+  cargoHash = "sha256-G5mLFKy/khHlP32/VFudtJJC1CWpBNyx4yPx1Gc8pcY=";
 
   buildInputs = [
     rust-jemalloc-sys

pkgs/by-name/yq/yq-go/package.nix

···
 
 buildGoModule (finalAttrs: {
   pname = "yq-go";
-  version = "4.46.1";
+  version = "4.47.1";
 
   src = fetchFromGitHub {
     owner = "mikefarah";
     repo = "yq";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lMmcqAe1A/ET/2Dju6Gj0+I/g4z23EmtuRio0NYTHws=";
+    hash = "sha256-r9vHXDviQADv7yIwwzCHKjvHSNzZnJATwiWAaFW4vXs=";
   };
 
-  vendorHash = "sha256-wfn8u8I4dyAD4PbeiQGSai1gQ2ZDFBi2mysZVKa0mkA=";
+  vendorHash = "sha256-mG9rKla2ZSEbOvSlV6jl7MBoo0dDI//CMcR2hLET4K4=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/development/ocaml-modules/camlgpc/default.nix

···
+{
+  buildDunePackage,
+  fetchFromGitHub,
+  fetchpatch,
+  lib,
+}:
+
+let
+  pname = "camlgpc";
+  version = "1.2";
+in
+buildDunePackage {
+  inherit pname version;
+  src = fetchFromGitHub {
+    owner = "johnwhitington";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-+Dx8BuRlxb8xh41jHskrNcKGV/HgedauLt1vo1tADHw=";
+  };
+  patches = [
+    (fetchpatch {
+      name = "camlgpc-pr-5-switch-to-dune";
+      url = "https://github.com/johnwhitington/camlgpc/pull/5.diff";
+      hash = "sha256-znm+mX60RwYNCYXwm9HYCO8BRbzUM0Bm6dI1f1FzncA=";
+    })
+  ];
+  propagatedBuildInputs = [ ];
+  doCheck = true;
+  checkInputs = [ ];
+  meta = {
+    description = "OCaml interface to Alan Murta's General Polygon Clipper";
+    homepage = "https://github.com/johnwhitington/camlgpc";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.vog ];
+  };
+}

pkgs/development/ocaml-modules/ocaml-lsp/jsonrpc.nix

···
   ocaml,
   version ?
     if lib.versionAtLeast ocaml.version "5.3" then
-      "1.22.0"
+      "1.23.0"
     else if lib.versionAtLeast ocaml.version "5.2" then
       "1.21.0"
     else if lib.versionAtLeast ocaml.version "4.14" then
···
 let
   params =
     {
+      "1.23.0" = {
+        name = "lsp";
+        minimalOCamlVersion = "5.3";
+        sha256 = "sha256-fyvQI7VKgOrOFihtKIkcE2B2iUYFLJOZGKipzZU0Dn0=";
+      };
       "1.22.0" = {
         name = "lsp";
         minimalOCamlVersion = "5.2";

pkgs/development/ocaml-modules/ocaml-lsp/lsp.nix

···
   ocaml,
   version ?
     if lib.versionAtLeast ocaml.version "5.3" then
-      "1.22.0"
+      "1.23.0"
     else if lib.versionAtLeast ocaml.version "5.2" then
       "1.21.0"
     else if lib.versionAtLeast ocaml.version "4.14" then

pkgs/development/python-modules/cvxpy/default.nix

···
 
 buildPythonPackage rec {
   pname = "cvxpy";
-  version = "1.6.6";
+  version = "1.7.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cvxpy";
     repo = "cvxpy";
     tag = "v${version}";
-    hash = "sha256-dn29rAm0f0cgUFtnHSykBE2p/U/EPorozjuuLWuH/Tw=";
+    hash = "sha256-gJL9j2hA+PvNhN1twv31dxb5Gz+q8uoIzwhXB12aIr4=";
   };
 
-  # we need to patch out numpy version caps from upstream
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace-fail "numpy >= 2.0.0" "numpy"
-  '';
+  postPatch =
+    # too tight tolerance in tests (AssertionError)
+    ''
+      substituteInPlace cvxpy/tests/test_constant_atoms.py \
+        --replace-fail \
+          "CLARABEL: 1e-7," \
+          "CLARABEL: 1e-6,"
+    '';
 
   build-system = [
     numpy

pkgs/development/python-modules/frida-python/default.nix

···
   buildPythonPackage,
 }:
 let
-  version = "16.7.11";
+  version = "17.2.11";
   format = "wheel";
   inherit (stdenvNoCC.hostPlatform) system;
 
···
   pypiMeta =
     {
       x86_64-linux = {
-        hash = "sha256-aAPVZPz1mn73JuQPGJ/PAOUAtaufeHehSKHzaBmVFF8=";
+        hash = "sha256-PSCT5Y3JaOo9uJgCzXQVmcDvNxUEEN5dvjRxiEMcJEQ=";
         platform = "manylinux1_x86_64";
       };
       aarch64-linux = {
-        hash = "sha256-mQgfMJ6esH41MXnGZQUwF4j8gDgzfyBDUQo5Kw8TGa4=";
+        hash = "sha256-UH+f6Pj1BS2hcwz3WoSsBGRXOIM/y8D0ymk8s7BU2nw=";
         platform = "manylinux2014_aarch64";
       };
       x86_64-darwin = {
-        hash = "sha256-TuWvQ4oDkK5Fn/bp0G3eAhvDLlv0tzIQ8dKtysX36w0=";
+        hash = "sha256-zZms5eIguKTl5SYWtDNQwROPM2+5t8JVp/itIl9FkXs=";
         platform = "macosx_10_13_x86_64";
       };
       aarch64-darwin = {
-        hash = "sha256-QWfWbGnKeuKiGoD0srnnMsbWPYFcYsbO/Oy68uJIRjI=";
+        hash = "sha256-vzyHYlstwm1GT1jKc0g5Yr6JVte9WGn+hALYpkefKBY=";
         platform = "macosx_11_0_arm64";
       };
     }

pkgs/development/python-modules/langchain-experimental/001-avoid-check-fullpath.patch

···
+diff --git a/tests/unit_tests/test_bash.py b/tests/unit_tests/test_bash.py
+index ba7b0d0..cade19e 100644
+--- a/tests/unit_tests/test_bash.py
++++ b/tests/unit_tests/test_bash.py
+@@ -58,7 +58,7 @@ def test_incorrect_command_return_err_output() -> None:
+     session = BashProcess(return_err_output=True)
+     output = session.run(["invalid_command"])
+     assert re.match(
+-        r"^/bin/sh:.*invalid_command.*(?:not found|Permission denied).*$", output
++        r".*/bin/sh:.*invalid_command.*(?:not found|Permission denied).*$", output
+     )
+ 
+ 

pkgs/development/python-modules/langchain-experimental/default.nix

···
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  poetry-core,
+
+  # dependencies
+  langchain-core,
+  langchain-community,
+
+  # testing
+  langchain-tests,
+  pytestCheckHook,
+
+  # passthru
+  gitUpdater,
+}:
+
+buildPythonPackage rec {
+  pname = "langchain-experimental";
+  version = "0.3.4";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "langchain-ai";
+    repo = "langchain-experimental";
+    tag = "libs/experimental/v${version}";
+    hash = "sha256-KgGfJfxHOfpwVVo/OcbOjiO5pbxoDE1MiyKqUwsqfIg=";
+  };
+
+  sourceRoot = "${src.name}/libs/experimental";
+
+  patches = [
+    # Remove it when https://github.com/langchain-ai/langchain-experimental/pull/58 is merged and released
+    ./001-avoid-check-fullpath.patch
+  ];
+
+  build-system = [
+    poetry-core
+  ];
+
+  pythonRelaxDeps = [
+    # Each component release requests the exact latest core.
+    # That prevents us from updating individual components.
+    "langchain-core"
+    "langchain-community"
+  ];
+
+  dependencies = [
+    langchain-core
+    langchain-community
+  ];
+
+  nativeCheckInputs = [
+    langchain-tests
+    pytestCheckHook
+  ];
+
+  pytestFlagsArray = [ "tests/unit_tests" ];
+
+  pythonImportsCheck = [ "langchain_experimental" ];
+
+  passthru.updateScript = gitUpdater {
+    rev-prefix = "libs/experimental/v";
+  };
+
+  meta = {
+    changelog = "https://github.com/langchain-ai/langchain-experimental/releases/tag/${src.tag}";
+    description = "Package add experimental features on LangChain";
+    homepage = "https://github.com/langchain-ai/langchain-experimental/tree/main/libs/experimental";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ mrdev023 ];
+  };
+}

pkgs/development/python-modules/pymc/default.nix

···
 
 buildPythonPackage rec {
   pname = "pymc";
-  version = "5.24.1";
+  version = "5.25.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pymc-devs";
     repo = "pymc";
     tag = "v${version}";
-    hash = "sha256-lBsVr3A7y9CP+41Tk5TraWhu59HJb2+r0I7WlXiP/sY=";
+    hash = "sha256-/BSnDi34hhn7lFuLO/arMn018BU09PaQqmaLbYG3en4=";
   };
 
   build-system = [

pkgs/development/tools/misc/autoconf/2.13.nix

···
-{
-  lib,
-  stdenv,
-  fetchurl,
-  m4,
-  perl,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "autoconf";
-  version = "2.13";
-
-  src = fetchurl {
-    url = "mirror://gnu/autoconf/autoconf-${version}.tar.gz";
-    sha256 = "07krzl4czczdsgzrrw9fiqx35xcf32naf751khg821g5pqv12qgh";
-  };
-
-  nativeBuildInputs = [
-    m4
-    perl
-  ];
-  strictDeps = true;
-
-  doCheck = true;
-
-  # Don't fixup "#! /bin/sh" in Autoconf, otherwise it will use the
-  # "fixed" path in generated files!
-  dontPatchShebangs = true;
-
-  postInstall = ''ln -s autoconf "$out"/bin/autoconf-2.13'';
-
-  meta = {
-    homepage = "https://www.gnu.org/software/autoconf/";
-    description = "Part of the GNU Build System";
-    branch = "2.13";
-
-    longDescription = ''
-      GNU Autoconf is an extensible package of M4 macros that produce
-      shell scripts to automatically configure software source code
-      packages.  These scripts can adapt the packages to many kinds of
-      UNIX-like systems without manual user intervention.  Autoconf
-      creates a configuration script for a package from a template
-      file that lists the operating system features that the package
-      can use, in the form of M4 macro calls.
-    '';
-
-    license = lib.licenses.gpl2Plus;
-    platforms = lib.platforms.unix;
-  };
-}

pkgs/development/tools/misc/autoconf/2.64.nix

···
-{
-  lib,
-  stdenv,
-  fetchurl,
-  m4,
-  perl,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "autoconf";
-  version = "2.64";
-
-  src = fetchurl {
-    url = "mirror://gnu/autoconf/autoconf-${version}.tar.xz";
-    sha256 = "0j3jdjpf5ly39dlp0bg70h72nzqr059k0x8iqxvaxf106chpgn9j";
-  };
-
-  strictDeps = true;
-  nativeBuildInputs = [
-    m4
-    perl
-  ];
-  buildInputs = [ m4 ];
-
-  # Work around a known issue in Cygwin.  See
-  # http://thread.gmane.org/gmane.comp.sysutils.autoconf.bugs/6822 for
-  # details.
-  # There are many test failures on `i386-pc-solaris2.11'.
-  #doCheck = ((!stdenv.hostPlatform.isCygwin) && (!stdenv.hostPlatform.isSunOS));
-  doCheck = false;
-
-  # Don't fixup "#! /bin/sh" in Autoconf, otherwise it will use the
-  # "fixed" path in generated files!
-  dontPatchShebangs = true;
-
-  enableParallelBuilding = true;
-
-  # Make the Autotest test suite run in parallel.
-  preCheck = ''
-    export TESTSUITEFLAGS="-j$NIX_BUILD_CORES"
-  '';
-
-  doInstallCheck = false; # fails
-
-  meta = {
-    homepage = "https://www.gnu.org/software/autoconf/";
-    description = "Part of the GNU Build System";
-
-    longDescription = ''
-      GNU Autoconf is an extensible package of M4 macros that produce
-      shell scripts to automatically configure software source code
-      packages.  These scripts can adapt the packages to many kinds of
-      UNIX-like systems without manual user intervention.  Autoconf
-      creates a configuration script for a package from a template
-      file that lists the operating system features that the package
-      can use, in the form of M4 macro calls.
-    '';
-
-    license = lib.licenses.gpl2Plus;
-
-    platforms = lib.platforms.all;
-  };
-}

pkgs/development/tools/misc/automake/automake-1.11.x.nix

···
-{
-  lib,
-  stdenv,
-  fetchurl,
-  perl,
-  autoconf,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "automake";
-  version = "1.11.6";
-
-  # TODO: Remove the `aclocal' wrapper when $ACLOCAL_PATH support is
-  # available upstream; see
-  # <https://debbugs.gnu.org/cgi/bugreport.cgi?bug=9026>.
-  builder = ./builder.sh;
-
-  setupHook = ./setup-hook.sh;
-
-  src = fetchurl {
-    url = "mirror://gnu/automake/automake-${version}.tar.xz";
-    sha256 = "1ffbc6cc41f0ea6c864fbe9485b981679dc5e350f6c4bc6c3512f5a4226936b5";
-  };
-
-  patches = [
-    ./fix-test-autoconf-2.69.patch
-    ./fix-perl-5.26.patch
-  ];
-
-  strictDeps = true;
-  nativeBuildInputs = [
-    perl
-    autoconf
-  ];
-  buildInputs = [ autoconf ];
-
-  doCheck = false; # takes _a lot_ of time, fails 11 of 782 tests
-
-  # Don't fixup "#! /bin/sh" in Libtool, otherwise it will use the
-  # "fixed" path in generated files!
-  dontPatchShebangs = true;
-
-  # Run the test suite in parallel.
-  enableParallelBuilding = true;
-
-  meta = {
-    branch = "1.11";
-    homepage = "https://www.gnu.org/software/automake/";
-    description = "GNU standard-compliant makefile generator";
-
-    longDescription = ''
-      GNU Automake is a tool for automatically generating
-      `Makefile.in' files compliant with the GNU Coding
-      Standards.  Automake requires the use of Autoconf.
-    '';
-
-    license = lib.licenses.gpl2Plus;
-
-    platforms = lib.platforms.all;
-  };
-}

pkgs/development/tools/misc/automake/builder.sh

···
-# Wrap the given `aclocal' program, appending extra `-I' flags
-# corresponding to the directories listed in $ACLOCAL_PATH.  (Note
-# that `wrapProgram' can't be used for that purpose since it can only
-# prepend flags, not append them.)
-wrapAclocal() {
-    local program="$1"
-    local wrapped="$(dirname $program)/.$(basename $program)-wrapped"
-
-    mv "$program" "$wrapped"
-    cat > "$program"<<EOF
-#! $SHELL -e
-
-unset extraFlagsArray
-declare -a extraFlagsArray
-
-oldIFS=\$IFS
-IFS=:
-for dir in \$ACLOCAL_PATH; do
-    if test -n "\$dir" -a -d "\$dir"; then
-        extraFlagsArray=("\${extraFlagsArray[@]}" "-I" "\$dir")
-    fi
-done
-IFS=\$oldIFS
-
-exec "$wrapped" "\$@" "\${extraFlagsArray[@]}"
-EOF
-    chmod +x "$program"
-}
-
-postInstall() {
-    # Create a wrapper around `aclocal' that converts every element in
-    # `ACLOCAL_PATH' into a `-I dir' option.  This way `aclocal'
-    # becomes modular; M4 macros do not need to be stored in a single
-    # global directory, while callers of `aclocal' do not need to pass
-    # `-I' options explicitly.
-
-    for prog in $out/bin/aclocal*; do
-        wrapAclocal "$prog"
-    done
-
-    ln -s aclocal-1.11 $out/share/aclocal
-    ln -s automake-1.11 $out/share/automake
-}
-
-genericBuild

pkgs/development/tools/misc/automake/fix-perl-5.26.patch

···
---- automake-1.11.2/automake.in
-+++ automake-1.11.2/automake.in
-@@ -4156,7 +4156,7 @@ sub substitute_ac_subst_variables_worker($)
- sub substitute_ac_subst_variables ($)
- {
-   my ($text) = @_;
--  $text =~ s/\${([^ \t=:+{}]+)}/&substitute_ac_subst_variables_worker ($1)/ge;
-+  $text =~ s/\$\{([^ \t=:+{}]+)}/&substitute_ac_subst_variables_worker ($1)/ge;
-   return $text;
- }

pkgs/development/tools/misc/automake/fix-test-autoconf-2.69.patch

···
-With Autoconf 2.69 (instead of 2.68), config.{guess,sub} are needed.
-
---- automake-1.11.2/tests/compile_f90_c_cxx.test	2011-12-20 21:56:29.000000000 +0100
-+++ automake-1.11.2/tests/compile_f90_c_cxx.test	2012-07-07 13:35:58.000000000 +0200
-@@ -41,7 +41,7 @@ END
- : > baz.cc
- 
- $ACLOCAL
--$AUTOMAKE
-+$AUTOMAKE --add-missing
- 
- # Look for the macros at the beginning of rules.  Be careful, as there
- # are literal tabs at the beginning of the search strings.

pkgs/development/tools/ocaml/merlin/4.x.nix

···
       "4.12.1" = "4.7-412";
       "4.13.0" = "4.7-413";
       "4.13.1" = "4.7-413";
-      "4.14.0" = "4.18-414";
-      "4.14.1" = "4.18-414";
-      "4.14.2" = "4.18-414";
+      "4.14.0" = "4.19-414";
+      "4.14.1" = "4.19-414";
+      "4.14.2" = "4.19-414";
       "5.0.0" = "4.14-500";
       "5.1.0" = "4.17.1-501";
       "5.1.1" = "4.17.1-501";
       "5.2.0" = "5.3-502";
       "5.2.1" = "5.3-502";
-      "5.3.0" = "5.4.1-503";
+      "5.3.0" = "5.5-503";
     }
     ."${ocaml.version}",
 }:
···
     "4.16-414" = "sha256-xekZdfPfVoSeGzBvNWwxcJorE519V2NLjSHkcyZvzy0="; # Used by ocaml-lsp
     "4.16-501" = "sha256-2lvzCbBAZFwpKuRXLMagpwDb0rz8mWrBPI5cODbCHiY="; # Used by ocaml-lsp
     "4.18-414" = "sha256-9tb3omYUHjWMGoaWEsgTXIWRhdVH6julya17tn/jDME=";
+    "4.19-414" = "sha256-YKYw9ZIDqc5wR6XwTQ8jmUWWDaxvOBApIuMottJlc4Q=";
     "4.17.1-501" = "sha256-N2cHqocfCeljlFbT++S4miHJrXXHdOlMu75n+EKwpQA=";
     "5.3-502" = "sha256-LOpG8SOX+m4x7wwNT14Rwc/ZFu5JQgaUAFyV67OqJLw=";
     "5.4.1-503" = "sha256-SbO0x3jBISX8dAXnN5CwsxLV15dJ3XPUg4tlYqJTMCI=";
+    "5.5-503" = "sha256-Z9o7NPL+oHZ4JnMJ9h2kosbwgpjeDcWWVbjTD9gmmvE=";
   };
 
 in

pkgs/tools/package-management/nix-eval-jobs/default.nix

···
 
   src = fetchFromGitHub {
     owner = "nix-community";
-    repo = pname;
-    rev = "v${version}";
+    repo = "nix-eval-jobs";
+    tag = "v${version}";
     hash = "sha256-AJ22q6yWc1hPkqssXMxQqD6QUeJ6hbx52xWHhKsmuP0=";
   };
 
···
     meson
     ninja
     pkg-config
+  ];
+
+  outputs = [
+    "out"
+    "dev"
   ];
 
   # Since this package is intimately tied to a specific Nix release, we

pkgs/top-level/aliases.nix

···
   ats = throw "'ats' has been removed as it is unmaintained for 10 years and broken"; # Added 2025-05-17
   audaciousQt5 = throw "'audaciousQt5' has been removed, since audacious is built with Qt 6 now"; # Added 2024-07-06
   auditBlasHook = throw "'auditBlasHook' has been removed since it never worked"; # Added 2024-04-02
+  autoconf213 = throw "'autoconf213' has been removed in favor of 'autoconf'"; # Added 2025-07-21
+  autoconf264 = throw "'autoconf264' has been removed in favor of 'autoconf'"; # Added 2025-07-21
+  automake111x = throw "'automake111x' has been removed in favor of 'automake'"; # Added 2025-07-21
   autoReconfHook = throw "You meant 'autoreconfHook', with a lowercase 'r'."; # preserve
+  autoreconfHook264 = throw "'autoreconfHook264' has been removed in favor of 'autoreconfHook'"; # Added 2025-07-21
   aumix = throw "'aumix' has been removed due to lack of maintenance upstream. Consider using 'pamixer' for CLI or 'pavucontrol' for GUI"; # Added 2024-09-14
   authy = throw "'authy' has been removed since it reached end of life"; # Added 2024-04-19
   autoadb = throw "'autoadb' has been removed due to lack of maintenance upstream"; # Added 2025-01-25

pkgs/top-level/all-packages.nix

···
     } ../build-support/setup-hooks/autoreconf.sh
   ) { };
 
-  autoreconfHook264 = autoreconfHook.override {
-    autoconf = autoconf264;
-    automake = automake111x;
-  };
-
   autoreconfHook269 = autoreconfHook.override {
     autoconf = autoconf269;
   };
···
   electron-chromedriver = electron-chromedriver_37;
 
   autoconf = callPackage ../development/tools/misc/autoconf { };
-  autoconf213 = callPackage ../development/tools/misc/autoconf/2.13.nix { };
-  autoconf264 = callPackage ../development/tools/misc/autoconf/2.64.nix { };
   autoconf269 = callPackage ../development/tools/misc/autoconf/2.69.nix { };
   autoconf271 = callPackage ../development/tools/misc/autoconf/2.71.nix { };
 
   automake = automake116x;
-
-  automake111x = callPackage ../development/tools/misc/automake/automake-1.11.x.nix { };
 
   automake116x = callPackage ../development/tools/misc/automake/automake-1.16.x.nix { };
 
···
   kotatogram-desktop =
     callPackage ../applications/networking/instant-messengers/telegram/kotatogram-desktop
       { };
-
-  krane = callPackage ../applications/networking/cluster/krane { };
 
   ktimetracker = libsForQt5.callPackage ../applications/office/ktimetracker { };
 

pkgs/top-level/ocaml-packages.nix

···
 
         callipyge = callPackage ../development/ocaml-modules/callipyge { };
 
+        camlgpc = callPackage ../development/ocaml-modules/camlgpc { };
+
         camlidl = callPackage ../development/tools/ocaml/camlidl { };
 
         camlimages = callPackage ../development/ocaml-modules/camlimages { };

pkgs/top-level/python-packages.nix

···
 
   langchain-deepseek = callPackage ../development/python-modules/langchain-deepseek { };
 
+  langchain-experimental = callPackage ../development/python-modules/langchain-experimental { };
+
   langchain-fireworks = callPackage ../development/python-modules/langchain-fireworks { };
 
   langchain-google-genai = callPackage ../development/python-modules/langchain-google-genai { };

pkgs/top-level/stage.nix

···
     # All packages built for i686 Linux.
     # Used by wine, firefox with debugging version of Flash, ...
     pkgsi686Linux =
-      if stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isx86 then
+      let
+        isSupported = stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isx86;
+      in
+      if !config.allowAliases || isSupported then
         nixpkgsFun {
           overlays = [
-            (self': super': {
-              pkgsi686Linux = super';
-            })
+            (
+              self': super':
+              {
+                pkgsi686Linux = super';
+              }
+              // lib.optionalAttrs (!isSupported) {
+                # Overrides pkgsi686Linux.stdenv.mkDerivation to produce only broken derivations,
+                # when used on a non x86_64-linux platform in CI.
+                # TODO: Remove this, once pkgsi686Linux can become a variant.
+                stdenv = super'.stdenv // {
+                  mkDerivation =
+                    args:
+                    (super'.stdenv.mkDerivation args).overrideAttrs (prevAttrs: {
+                      meta = prevAttrs.meta or { } // {
+                        broken = true;
+                      };
+                    });
+                };
+              }
+            )
           ] ++ overlays;
           ${if stdenv.hostPlatform == stdenv.buildPlatform then "localSystem" else "crossSystem"} = {
             config = lib.systems.parse.tripleFromSystem (