Merge staging-next into staging

nixos/modules/installer/cd-dvd/iso-image.nix

···
 {
   config,
   lib,
+  utils,
   pkgs,
   ...
 }:
···
     # specified on the kernel command line, created in the stage 1
     # init script.
     "/iso" = lib.mkImageMediaOverride {
-      device = "/dev/root";
+      device =
+        if config.boot.initrd.systemd.enable then
+          "/dev/disk/by-label/${config.isoImage.volumeID}"
+        else
+          "/dev/root";
       neededForBoot = true;
       noCheck = true;
     };
···
     # image) to make this a live CD.
     "/nix/.ro-store" = lib.mkImageMediaOverride {
       fsType = "squashfs";
-      device = "/iso/nix-store.squashfs";
+      device = "${lib.optionalString config.boot.initrd.systemd.enable "/sysroot"}/iso/nix-store.squashfs";
       options = [
         "loop"
       ]
···
     };
 
     "/nix/store" = lib.mkImageMediaOverride {
-      fsType = "overlay";
-      device = "overlay";
-      options = [
-        "lowerdir=/nix/.ro-store"
-        "upperdir=/nix/.rw-store/store"
-        "workdir=/nix/.rw-store/work"
-      ];
-      depends = [
-        "/nix/.ro-store"
-        "/nix/.rw-store/store"
-        "/nix/.rw-store/work"
-      ];
+      overlay = {
+        lowerdir = [ "/nix/.ro-store" ];
+        upperdir = "/nix/.rw-store/store";
+        workdir = "/nix/.rw-store/work";
+      };
     };
   };
 
···
     # UUID of the USB stick.  It would be nicer to write
     # `root=/dev/disk/by-label/...' here, but UNetbootin doesn't
     # recognise that.
-    boot.kernelParams = [
-      "root=LABEL=${config.isoImage.volumeID}"
+    boot.kernelParams = lib.optionals (!config.boot.initrd.systemd.enable) [
       "boot.shell_on_fail"
+      "root=LABEL=${config.isoImage.volumeID}"
     ];
 
     fileSystems = config.lib.isoFileSystems;
···
       "overlay"
     ];
 
+    boot.initrd.systemd = lib.mkIf config.boot.initrd.systemd.enable {
+      emergencyAccess = true;
+
+      # Most of util-linux is not included by default.
+      initrdBin = [ config.boot.initrd.systemd.package.util-linux ];
+      services.copytoram = {
+        description = "Copy ISO contents to RAM";
+        requiredBy = [ "initrd.target" ];
+        before = [
+          "${utils.escapeSystemdPath "/sysroot/nix/.ro-store"}.mount"
+          "initrd-switch-root.target"
+        ];
+        unitConfig = {
+          RequiresMountsFor = "/sysroot/iso";
+          ConditionKernelCommandLine = "copytoram";
+        };
+        serviceConfig = {
+          Type = "oneshot";
+          RemainAfterExit = true;
+        };
+        path = [
+          pkgs.coreutils
+          config.boot.initrd.systemd.package.util-linux
+        ];
+        script = ''
+          device=$(findmnt -n -o SOURCE --target /sysroot/iso)
+          fsSize=$(blockdev --getsize64 "$device" || stat -Lc '%s' "$device")
+          mkdir -p /tmp-iso
+          mount --bind --make-private /sysroot/iso /tmp-iso
+          umount /sysroot/iso
+          mount -t tmpfs -o size="$fsSize" tmpfs /sysroot/iso
+          cp -r /tmp-iso/* /sysroot/iso/
+          umount /tmp-iso
+          rm -r /tmp-iso
+        '';
+      };
+    };
+
     # Closures to be copied to the Nix store on the CD, namely the init
     # script and the top-level system configuration directory.
     isoImage.storeContents = [
···
           target = "/EFI";
         }
         {
-          source = (pkgs.writeTextDir "grub/loopback.cfg" "source /EFI/BOOT/grub.cfg") + "/grub";
-          target = "/boot/grub";
-        }
-        {
           source = config.isoImage.efiSplashImage;
           target = "/EFI/BOOT/efi-background.png";
+        }
+      ]
+      ++ lib.optionals (config.isoImage.makeEfiBootable && !config.boot.initrd.systemd.enable) [
+        # http://www.supergrubdisk.org/wiki/Loopback.cfg
+        # This feature will be removed, and thus is not supported by systemd initrd
+        {
+          source = (pkgs.writeTextDir "grub/loopback.cfg" "source /EFI/BOOT/grub.cfg") + "/grub";
+          target = "/boot/grub";
         }
       ]
       ++ lib.optionals (config.boot.loader.grub.memtest86.enable && config.isoImage.makeBiosBootable) [

pkgs/by-name/_7/_7zz/package.nix

···
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "7zz";
-  version = "25.00";
+  version = "25.01";
 
   src = fetchzip {
     url = "https://7-zip.org/a/7z${lib.replaceStrings [ "." ] [ "" ] finalAttrs.version}-src.tar.xz";
     hash =
       {
-        free = "sha256-YY2Nw1aeQjXay9IEd4SwuhgqzeK95nH4nlZGwAlud6o=";
-        unfree = "sha256-gwC/5OkIAHp0OHJWhwD7JpJVSx06oCFs1Ndf+iG5qB8=";
+        free = "sha256-A1BBdSGepobpguzokL1zpjce5EOl0zqABYciv9zCOac=";
+        unfree = "sha256-Jkj6T4tMols33uyJSOCcVmxh5iBYYCO/rq9dF4NDMko=";
       }
       .${if enableUnfree then "unfree" else "free"};
     stripRoot = false;

pkgs/by-name/ai/aider-chat/package.nix

···
     d.stopwords
   ]);
 
-  version = "0.85.2";
+  version = "0.86.0";
   aider-chat = python3Packages.buildPythonApplication {
     pname = "aider-chat";
     inherit version;
···
       owner = "Aider-AI";
       repo = "aider";
       tag = "v${version}";
-      hash = "sha256-J2xCx1edbu8mEGzNq2PKMxPCMlMZkArEwz6338Sm1tw=";
+      hash = "sha256-pqwsYObgio50rbuGGOmi7PlEMxdX75B1ONKs+VAJrd8=";
     };
 
     pythonRelaxDeps = true;

pkgs/by-name/bo/boring/package.nix

···
 
 buildGoModule (finalAttrs: {
   pname = "boring";
-  version = "0.11.6";
+  version = "0.11.7";
 
   src = fetchFromGitHub {
     owner = "alebeck";
     repo = "boring";
     tag = finalAttrs.version;
-    hash = "sha256-mIR12OkdZll3MqlKF3OMqrc3C73SPmqypj0as9Y5LRQ=";
+    hash = "sha256-RXLFIOGJEvE6kV14+rnN4zPV8bloikxjksdlSHQFwUU=";
   };
 
   nativeBuildInputs = [
     installShellFiles
   ];
 
-  vendorHash = "sha256-1FVSKjsPDe4faaIioJG89556ibREcJt6xi28mp68Ea0=";
+  vendorHash = "sha256-/MAkVesn8ub2MrguWTueMI9+/lgCRdaXUEioHE/bg8w=";
 
   ldflags = [
     "-s"

pkgs/by-name/fr/frida-tools/package.nix

···
 
 python3Packages.buildPythonApplication rec {
   pname = "frida-tools";
-  version = "14.4.2";
+  version = "14.4.5";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-M+iKHoJpxIUUoEVYntL8PPR7B3TbBDiW/Oc8ZE15wo8=";
+    hash = "sha256-sId91KB2qLasJHsfrS6Nfqctn0kCPS6ieNwtfheai8M=";
   };
 
   build-system = with python3Packages; [

pkgs/by-name/op/opentofu/package.nix

···
 let
   package = buildGoModule rec {
     pname = "opentofu";
-    version = "1.10.4";
+    version = "1.10.5";
 
     src = fetchFromGitHub {
       owner = "opentofu";
       repo = "opentofu";
       tag = "v${version}";
-      hash = "sha256-COAX185U35htUL/ZdUy5Rq2/OUVcdGe3zAg8NnjoqnQ=";
+      hash = "sha256-w7uzTG0zqa+izncQoqCSbIJCCIz+jOVbPg9/HiCm7Ik=";
     };
 
     vendorHash = "sha256-+cwFkqhFuLJCb02tvYjccpkNzy7tz979mjgCeqi2DC4=";

pkgs/by-name/ri/rime-wanxiang/package.nix

···
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "rime-wanxiang";
-  version = "9.1.3";
+  version = "10.0.10";
 
   src = fetchFromGitHub {
     owner = "amzxyz";
     repo = "rime_wanxiang";
     tag = "v" + finalAttrs.version;
-    hash = "sha256-jcYvDktk1zj32i92LQKYu35Br2uPRcoNtoyPKo3hP/Y=";
+    hash = "sha256-lDjvaVkHEHhfL7iI7psaaVlUO4SNe2e49N5Nz+Lex68=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/va/vala-lint/package.nix

···
 
 stdenv.mkDerivation {
   pname = "vala-lint";
-  version = "0-unstable-2024-08-28";
+  version = "0-unstable-2025-08-03";
 
   src = fetchFromGitHub {
     owner = "vala-lang";
     repo = "vala-lint";
-    rev = "4ed1443c35a8a84445fb59292d539358365d8263";
-    sha256 = "sha256-NPadBrL2g5w95slwDpp7kNXBgLJ9na8Yd/J7zm28SSo=";
+    rev = "a1d1a7bc0f740920e592fd788a836c402fd9825c";
+    sha256 = "sha256-63T+wLdnGtVBxKkkkj7gJx0ebApam922Z+cmk2R7Ys0=";
   };
 
   nativeBuildInputs = [
···
     glib
     json-glib
   ];
-
-  postPatch = ''
-    # https://github.com/vala-lang/vala-lint/issues/181
-    substituteInPlace test/meson.build \
-      --replace "test('auto-fix', auto_fix_test, env: test_envars)" ""
-  '';
 
   doCheck = true;
 

pkgs/by-name/xa/xapp/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "xapp";
-  version = "2.8.11";
+  version = "2.8.12";
 
   outputs = [
     "out"
···
     owner = "linuxmint";
     repo = "xapp";
     rev = version;
-    hash = "sha256-dmMjGWjq0s4MkobeqssbG5G3+gHRqA6lmu95uJX3RJY=";
+    hash = "sha256-LGONOsllf9POLLcRG2JN6VNvvMZorcG+aXVNLUz31Tc=";
   };
 
   # Recommended by upstream, which enables the build of xapp-debug.

pkgs/desktops/mate/mate-panel/default.nix

···
 {
   lib,
   stdenv,
-  fetchurl,
+  fetchFromGitHub,
+  autoconf-archive,
+  autoreconfHook,
   pkg-config,
   gettext,
+  gtk-doc,
   itstool,
   glib,
   gtk-layer-shell,
···
   libxml2,
   dconf,
   dconf-editor,
+  mate-common,
   mate-desktop,
   mate-menus,
   hicolor-icon-theme,
   wayland,
   gobject-introspection,
   wrapGAppsHook3,
+  yelp-tools,
   marco,
-  mateUpdateScript,
+  gitUpdater,
 }:
 
 stdenv.mkDerivation rec {
   pname = "mate-panel";
-  version = "1.28.4";
+  version = "1.28.5";
 
-  src = fetchurl {
-    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-AvCesDFMKsGXtvCJlQpXHNujm/0D1sOguP13JSqWiHQ=";
+  src = fetchFromGitHub {
+    owner = "mate-desktop";
+    repo = "mate-panel";
+    tag = "v${version}";
+    fetchSubmodules = true;
+    hash = "sha256-P1zrOH1xTbKXIoP13azAFDv2Q05dubR1AfmuLbgh250=";
   };
 
   nativeBuildInputs = [
+    autoconf-archive
+    autoreconfHook
     gobject-introspection
     gettext
+    gtk-doc
     itstool
     libxml2 # xmllint
+    mate-common # mate-common.m4 macros
     pkg-config
     wrapGAppsHook3
+    yelp-tools
   ];
 
   buildInputs = [
···
 
   enableParallelBuilding = true;
 
-  passthru.updateScript = mateUpdateScript { inherit pname; };
+  passthru.updateScript = gitUpdater {
+    rev-prefix = "v";
+    odd-unstable = true;
+  };
 
   meta = with lib; {
     description = "MATE panel";

pkgs/desktops/pantheon/apps/elementary-code/default.nix

···
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   nix-update-script,
   meson,
   ninja,
···
 
 stdenv.mkDerivation rec {
   pname = "elementary-code";
-  version = "8.0.0";
+  version = "8.1.0";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = "code";
     rev = version;
-    hash = "sha256-muW7K9cFITZaoNi3id+iplmokN5sSE8x1CVQ62+myUU=";
+    hash = "sha256-pL/xyD9jwuPixbVdjPa3vdZWHxI+T2ARI4BvcTV61jc=";
   };
-
-  patches = [
-    # Fix build with GCC 14
-    # https://github.com/elementary/code/pull/1606
-    (fetchpatch {
-      url = "https://github.com/elementary/code/commit/9b8347adcbb94f3186815413d927eecc51be2ccf.patch";
-      hash = "sha256-VhpvWgOGniOEjxBOjvX30DZIRGalxfPlb9j1VaOAJTA=";
-    })
-  ];
 
   strictDeps = true;
 

pkgs/desktops/xfce/applications/orage/default.nix

···
 mkXfceDerivation {
   category = "apps";
   pname = "orage";
-  version = "4.20.1";
+  version = "4.20.2";
 
-  sha256 = "sha256-WdvqsgHfhJ2sk4vQ75m1zmWjefJBJdDKH8E0GA4fCNg=";
+  sha256 = "sha256-iV4eVYmOXfEpq5cnHeCXRvx0Ms0Dis3EIwbcSakGLXs=";
 
   buildInputs = [
     glib