Merge master into staging-next

.github/PULL_REQUEST_TEMPLATE.md

···
 
 <!-- Please check what applies. Note that these are not hard requirements but merely serve as information for reviewers. -->
 
-- Built on platform(s)
+- Built on platform:
   - [ ] x86_64-linux
   - [ ] aarch64-linux
   - [ ] x86_64-darwin
   - [ ] aarch64-darwin
-- For non-Linux: Is sandboxing enabled in `nix.conf`? (See [Nix manual](https://nixos.org/manual/nix/stable/command-ref/conf-file.html))
-  - [ ] `sandbox = relaxed`
-  - [ ] `sandbox = true`
-- [ ] Tested, as applicable:
-  - [NixOS test(s)](https://nixos.org/manual/nixos/unstable/index.html#sec-nixos-tests) (look inside [nixos/tests](https://github.com/NixOS/nixpkgs/blob/master/nixos/tests))
-  - and/or [package tests](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md#package-tests)
-  - or, for functions and "core" functionality, tests in [lib/tests](https://github.com/NixOS/nixpkgs/blob/master/lib/tests) or [pkgs/test](https://github.com/NixOS/nixpkgs/blob/master/pkgs/test)
-  - made sure NixOS tests are [linked](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md#linking-nixos-module-tests-to-a-package) to the relevant packages
-- [ ] Tested compilation of all packages that depend on this change using `nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD"`. Note: all changes have to be committed, also see [nixpkgs-review usage](https://github.com/Mic92/nixpkgs-review#usage)
-- [ ] Tested basic functionality of all binary files (usually in `./result/bin/`)
-- [Nixpkgs 25.11 Release Notes](https://github.com/NixOS/nixpkgs/blob/master/doc/release-notes/rl-2511.section.md) (or backporting [25.05](https://github.com/NixOS/nixpkgs/blob/master/doc/manual/release-notes/rl-2505.section.md) Nixpkgs Release notes)
-  - [ ] (Package updates) Added a release notes entry if the change is major or breaking
-- [NixOS 25.11 Release Notes](https://github.com/NixOS/nixpkgs/blob/master/nixos/doc/manual/release-notes/rl-2511.section.md) (or backporting [25.05](https://github.com/NixOS/nixpkgs/blob/master/nixos/doc/manual/release-notes/rl-2505.section.md) NixOS Release notes)
-  - [ ] (Module updates) Added a release notes entry if the change is significant
-  - [ ] (Module addition) Added a release notes entry if adding a new NixOS module
-- [ ] Fits [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md), [pkgs/README.md](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md), [maintainers/README.md](https://github.com/NixOS/nixpkgs/blob/master/maintainers/README.md) and other contributing documentation in corresponding paths.
+- Tested, as applicable:
+  - [ ] [NixOS tests] in [nixos/tests].
+  - [ ] [Package tests] at `passthru.tests`.
+  - [ ] Tests in [lib/tests] or [pkgs/test] for functions and "core" functionality.
+- [ ] Ran `nixpkgs-review` on this PR. See [nixpkgs-review usage].
+- [ ] Tested basic functionality of all binary files, usually in `./result/bin/`.
+- Nixpkgs Release Notes
+  - [ ] Package update: when the change is major or breaking.
+- NixOS Release Notes
+  - [ ] Module addition: when adding a new NixOS module.
+  - [ ] Module update: when the change is significant.
+- [ ] Fits [CONTRIBUTING.md], [pkgs/README.md], [maintainers/README.md] and others READMEs.
 
-<!--
-To help with the large amounts of pull requests, we would appreciate your
-reviews of other pull requests, especially simple package updates. Just leave a
-comment describing what you have tested in the relevant package/service.
-Reviewing helps to reduce the average time-to-merge for everyone.
-Thanks a lot if you do!
+[NixOS tests]: https://nixos.org/manual/nixos/unstable/index.html#sec-nixos-tests
+[Package tests]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md#package-tests
+[nixpkgs-review usage]: https://github.com/Mic92/nixpkgs-review#usage
 
-List of open PRs: https://github.com/NixOS/nixpkgs/pulls
-Reviewing guidelines: https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md#reviewing-contributions
--->
+[CONTRIBUTING.md]: https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md
+[lib/tests]: https://github.com/NixOS/nixpkgs/blob/master/lib/tests
+[maintainers/README.md]: https://github.com/NixOS/nixpkgs/blob/master/maintainers/README.md
+[nixos/tests]: https://github.com/NixOS/nixpkgs/blob/master/nixos/tests
+[pkgs/README.md]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md
+[pkgs/test]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/test
 
 ---
 

nixos/doc/manual/release-notes/rl-2511.section.md

···
 
 - [tlsrpt-reporter], an application suite to generate and deliver TLSRPT reports. Available as [services.tlsrpt](#opt-services.tlsrpt.enable).
 
+- [Chhoto URL](https://github.com/SinTan1729/chhoto-url), a simple, blazingly fast, selfhosted URL shortener with no unnecessary features, written in Rust. Available as [services.chhoto-url](#opt-services.chhoto-url.enable).
+
 - [Broadcast Box](https://github.com/Glimesh/broadcast-box), a WebRTC broadcast server. Available as [services.broadcast-box](options.html#opt-services.broadcast-box.enable).
 
 - Docker now defaults to 28.x, because version 27.x stopped receiving security updates and bug fixes after [May 2, 2025](https://github.com/moby/moby/pull/49910).
···
 - [Draupnir](https://github.com/the-draupnir-project/draupnir), a Matrix moderation bot. Available as [services.draupnir](#opt-services.draupnir.enable).
 
 - [postfix-tlspol](https://github.com/Zuplu/postfix-tlspol), MTA-STS and DANE resolver and TLS policy server for Postfix. Available as [services.postfix-tlspol](#opt-services.postfix-tlspol.enable).
+
+- [Newt](https://github.com/fosrl/newt), a fully user space WireGuard tunnel client and TCP/UDP proxy, designed to securely expose private resources controlled by Pangolin. Available as [services.newt](options.html#opt-services.newt.enable).
 
 - [Szurubooru](https://github.com/rr-/szurubooru), an image board engine inspired by services such as Danbooru, dedicated for small and medium communities. Available as [services.szurubooru](#opt-services.szurubooru.enable).
 

nixos/modules/module-list.nix

···
   ./services/networking/netclient.nix
   ./services/networking/networkd-dispatcher.nix
   ./services/networking/networkmanager.nix
+  ./services/networking/newt.nix
   ./services/networking/nextdns.nix
   ./services/networking/nftables.nix
   ./services/networking/nghttpx/default.nix
···
   ./services/web-apps/castopod.nix
   ./services/web-apps/changedetection-io.nix
   ./services/web-apps/chatgpt-retrieval-plugin.nix
+  ./services/web-apps/chhoto-url.nix
   ./services/web-apps/cloudlog.nix
   ./services/web-apps/code-server.nix
   ./services/web-apps/coder.nix

nixos/modules/services/matrix/synapse.nix

···
     "systemd"
     "postgres"
     "url-preview"
-    "user-search"
   ];
 
   wantedExtras =
···
     ++ lib.optional (cfg.settings ? saml2_config) "saml2"
     ++ lib.optional (cfg.settings ? redis) "redis"
     ++ lib.optional (cfg.settings ? sentry) "sentry"
-    ++ lib.optional (cfg.settings ? user_directory) "user-search"
     ++ lib.optional (cfg.settings.url_preview_enabled) "url-preview"
     ++ lib.optional (cfg.settings.database.name == "psycopg2") "postgres";
 
···
               "sentry"       # Error tracking and performance metrics
               "systemd"      # Provide the JournalHandler used in the default log_config
               "url-preview"  # Support for oEmbed URL previews
-              "user-search"  # Support internationalized domain names in user-search
             ]
           '';
           description = ''

nixos/modules/services/networking/newt.nix

···
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.newt;
+in
+{
+  options = {
+    services.newt = {
+      enable = lib.mkEnableOption "Newt, user space tunnel client for Pangolin";
+      # needs to be changed when newt-go changes to fosrl-newt
+      package = lib.mkPackageOption pkgs "newt-go" { };
+
+      id = lib.mkOption {
+        type = with lib.types; nullOr str;
+        default = null;
+        description = ''
+          The Newt Id that will be used to communicate to Pangolin. This is generated on site creation in the dashboard.
+        '';
+      };
+      endpoint = lib.mkOption {
+        type = with lib.types; nullOr str;
+        default = null;
+        description = ''
+          The endpoint where both Gerbil and Pangolin reside in order to connect to the websocket. The url of your Pangolin dashboard.
+        '';
+      };
+      logLevel = lib.mkOption {
+        type = lib.types.enum [
+          "DEBUG"
+          "INFO"
+          "WARN"
+          "ERROR"
+          "FATAL"
+        ];
+        default = "INFO";
+        description = "The log level to use.";
+      };
+      # provide path to file to keep secrets out of the nix store
+      environmentFile = lib.mkOption {
+        type = with lib.types; nullOr path;
+        default = null;
+        description = ''
+          Path to a file containing sensitive environment variables for Newt. See https://docs.fossorial.io/Newt/overview#cli-args
+          These will overwrite anything defined in the config.
+          The file should contain environment-variable assignments like:
+          NEWT_ID=2ix2t8xk22ubpfy
+          NEWT_SECRET=nnisrfsdfc7prqsp9ewo1dvtvci50j5uiqotez00dgap0ii2
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+
+    assertions = [
+      {
+        assertion = cfg.environmentFile != null;
+        message = "services.newt.environmentFile must be provided when Newt is enabled.";
+      }
+    ];
+
+    systemd.services.newt = {
+      description = "Newt, user space tunnel client for Pangolin";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      environment = {
+        HOME = "/var/lib/private/newt";
+      };
+      # the flag values will all be overwritten if also defined in the env file
+      script = "
+        exec ${lib.getExe pkgs.newt-go} \\\n
+        ${lib.optionalString (
+                !isNull cfg.id
+              ) "--id ${cfg.id} \\\n"}
+        ${lib.optionalString (
+                !isNull cfg.endpoint
+              ) "--endpoint ${cfg.endpoint} \\\n"}
+        --log-level ${cfg.logLevel}
+      ";
+      serviceConfig = {
+        DynamicUser = true;
+        StateDirectory = "newt";
+        StateDirectoryMode = "0700";
+        Restart = "always";
+        RestartSec = "10s";
+        EnvironmentFile = cfg.environmentFile;
+        # hardening
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        PrivateTmp = "disconnected";
+        PrivateDevices = true;
+        PrivateUsers = true;
+        PrivateMounts = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectKernelLogs = true;
+        ProtectControlGroups = true;
+        LockPersonality = true;
+        RestrictRealtime = true;
+        ProtectClock = true;
+        ProtectProc = "noaccess";
+        ProtectHostname = true;
+        RemoveIPC = true;
+        NoNewPrivileges = true;
+        RestrictSUIDSGID = true;
+        MemoryDenyWriteExecute = true;
+        SystemCallArchitectures = "native";
+        UMask = "0077";
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_NETLINK"
+          "AF_UNIX"
+        ];
+        CapabilityBoundingSet = [
+          "~CAP_BLOCK_SUSPEND"
+          "~CAP_BPF"
+          "~CAP_CHOWN"
+          "~CAP_MKNOD"
+          "~CAP_NET_RAW"
+          "~CAP_PERFMON"
+          "~CAP_SYS_BOOT"
+          "~CAP_SYS_CHROOT"
+          "~CAP_SYS_MODULE"
+          "~CAP_SYS_NICE"
+          "~CAP_SYS_PACCT"
+          "~CAP_SYS_PTRACE"
+          "~CAP_SYS_TIME"
+          "~CAP_SYS_TTY_CONFIG"
+          "~CAP_SYSLOG"
+          "~CAP_WAKE_ALARM"
+        ];
+        SystemCallFilter = [
+          "~@aio:EPERM"
+          "~@chown:EPERM"
+          "~@clock:EPERM"
+          "~@cpu-emulation:EPERM"
+          "~@debug:EPERM"
+          "~@keyring:EPERM"
+          "~@memlock:EPERM"
+          "~@module:EPERM"
+          "~@mount:EPERM"
+          "~@obsolete:EPERM"
+          "~@pkey:EPERM"
+          "~@privileged:EPERM"
+          "~@raw-io:EPERM"
+          "~@reboot:EPERM"
+          "~@resources:EPERM"
+          "~@sandbox:EPERM"
+          "~@setuid:EPERM"
+          "~@swap:EPERM"
+          "~@sync:EPERM"
+          "~@timer:EPERM"
+        ];
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ jackr ];
+}

nixos/modules/services/web-apps/chhoto-url.nix

···
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.chhoto-url;
+
+  environment = lib.mapAttrs (
+    _: value:
+    if value == true then
+      "True"
+    else if value == false then
+      "False"
+    else
+      toString value
+  ) cfg.settings;
+in
+
+{
+  meta.maintainers = with lib.maintainers; [ defelo ];
+
+  options.services.chhoto-url = {
+    enable = lib.mkEnableOption "Chhoto URL";
+
+    package = lib.mkPackageOption pkgs "chhoto-url" { };
+
+    settings = lib.mkOption {
+      description = ''
+        Configuration of Chhoto URL.
+        See <https://github.com/SinTan1729/chhoto-url/blob/main/compose.yaml> for a list of options.
+      '';
+      example = {
+        port = 4567;
+      };
+
+      type = lib.types.submodule {
+        freeformType =
+          with lib.types;
+          attrsOf (oneOf [
+            str
+            int
+            bool
+          ]);
+
+        options = {
+          db_url = lib.mkOption {
+            type = lib.types.path;
+            description = "The path of the sqlite database.";
+            default = "/var/lib/chhoto-url/urls.sqlite";
+          };
+
+          port = lib.mkOption {
+            type = lib.types.port;
+            description = "The port to listen on.";
+            example = 4567;
+          };
+
+          cache_control_header = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            description = "The Cache-Control header to send.";
+            default = null;
+            example = "no-cache, private";
+          };
+
+          disable_frontend = lib.mkOption {
+            type = lib.types.bool;
+            description = "Whether to disable the frontend.";
+            default = false;
+          };
+
+          public_mode = lib.mkOption {
+            type = lib.types.bool;
+            description = "Whether to enable public mode.";
+            default = false;
+            apply = x: if x then "Enable" else "Disable";
+          };
+
+          public_mode_expiry_delay = lib.mkOption {
+            type = lib.types.nullOr lib.types.ints.unsigned;
+            description = "The maximum expiry delay in seconds to force in public mode.";
+            default = null;
+            example = 3600;
+          };
+
+          redirect_method = lib.mkOption {
+            type = lib.types.enum [
+              "TEMPORARY"
+              "PERMANENT"
+            ];
+            description = "The redirect method to use.";
+            default = "PERMANENT";
+          };
+
+          hash_algorithm = lib.mkOption {
+            type = lib.types.nullOr (lib.types.enum [ "Argon2" ]);
+            description = ''
+              The hash algorithm to use for passwords and API keys.
+              Set to `null` if you want to provide these secrets as plaintext.
+            '';
+            default = null;
+          };
+
+          site_url = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            description = "The URL under which Chhoto URL is externally reachable.";
+            default = null;
+          };
+
+          slug_style = lib.mkOption {
+            type = lib.types.enum [
+              "Pair"
+              "UID"
+            ];
+            description = "The slug style to use for auto-generated URLs.";
+            default = "Pair";
+          };
+
+          slug_length = lib.mkOption {
+            type = lib.types.addCheck lib.types.int (x: x >= 4);
+            description = "The length of auto-generated slugs.";
+            default = 8;
+          };
+
+          try_longer_slugs = lib.mkOption {
+            type = lib.types.bool;
+            description = "Whether to try a longer UID upon collision.";
+            default = false;
+          };
+
+          allow_capital_letters = lib.mkOption {
+            type = lib.types.bool;
+            description = "Whether to allow capital letters in slugs.";
+            default = false;
+          };
+
+          custom_landing_directory = lib.mkOption {
+            type = lib.types.nullOr lib.types.path;
+            description = "The path of a directory which contains a custom landing page.";
+            default = null;
+          };
+        };
+      };
+    };
+
+    environmentFiles = lib.mkOption {
+      type = lib.types.listOf lib.types.path;
+      default = [ ];
+      example = [ "/run/secrets/chhoto-url.env" ];
+      description = ''
+        Files to load environment variables from in addition to [](#opt-services.chhoto-url.settings).
+        This is useful to avoid putting secrets into the nix store.
+        See <https://github.com/SinTan1729/chhoto-url/blob/main/compose.yaml> for a list of options.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.chhoto-url = {
+      wantedBy = [ "multi-user.target" ];
+
+      inherit environment;
+
+      serviceConfig = {
+        User = "chhoto-url";
+        Group = "chhoto-url";
+        DynamicUser = true;
+        StateDirectory = "chhoto-url";
+        EnvironmentFile = cfg.environmentFiles;
+
+        ExecStart = lib.getExe cfg.package;
+
+        # hardening
+        AmbientCapabilities = "";
+        CapabilityBoundingSet = [ "" ];
+        DevicePolicy = "closed";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [ "AF_INET AF_INET6" ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SocketBindAllow = "tcp:${toString cfg.settings.port}";
+        SocketBindDeny = "any";
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
+        UMask = "0077";
+      };
+    };
+  };
+}

nixos/tests/all-tests.nix

···
   cfssl = runTestOn [ "aarch64-linux" "x86_64-linux" ] ./cfssl.nix;
   cgit = runTest ./cgit.nix;
   charliecloud = runTest ./charliecloud.nix;
+  chhoto-url = runTest ./chhoto-url.nix;
   chromadb = runTest ./chromadb.nix;
   chromium = (handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./chromium.nix { }).stable or { };
   chrony = runTestOn [ "aarch64-linux" "x86_64-linux" ] ./chrony.nix;

nixos/tests/chhoto-url.nix

···
+{ config, lib, ... }:
+
+{
+  name = "chhoto-url";
+  meta.maintainers = with lib.maintainers; [ defelo ];
+
+  nodes.machine = {
+    services.chhoto-url = {
+      enable = true;
+      settings.port = 8000;
+      environmentFiles = [
+        (builtins.toFile "chhoto-url.env" ''
+          api_key=api_key
+          password=password
+        '')
+      ];
+    };
+  };
+
+  interactive.nodes.machine = {
+    services.glitchtip.listenAddress = "0.0.0.0";
+    networking.firewall.allowedTCPPorts = [ 8000 ];
+    virtualisation.forwardPorts = [
+      {
+        from = "host";
+        host.port = 8000;
+        guest.port = 8000;
+      }
+    ];
+  };
+
+  testScript = ''
+    import json
+    import re
+
+    machine.wait_for_unit("chhoto-url.service")
+    machine.wait_for_open_port(8000)
+
+    resp = json.loads(machine.succeed("curl localhost:8000/api/getconfig"))
+    assert resp["success"] is False
+    assert resp["reason"] == "No valid authentication was found"
+
+    resp = json.loads(machine.succeed("curl -H 'X-API-Key: api_key' localhost:8000/api/getconfig"))
+    expected_version = "${config.nodes.machine.services.chhoto-url.package.version}"
+    assert resp["version"] == expected_version
+
+    resp = json.loads(machine.succeed("curl -H 'X-API-Key: api_key' localhost:8000/api/new -d '{\"longlink\": \"https://nixos.org/\"}'"))
+    assert resp["success"] is True
+    assert (match := re.match(r"^http://localhost:8000/(.+)$", resp["shorturl"]))
+    slug = match[1]
+
+    resp = machine.succeed(f"curl -i {resp["shorturl"]}")
+    assert (match := re.search(r"(?m)^location: (.+?)\r?$", resp))
+    assert match[1] == "https://nixos.org/"
+
+    resp = json.loads(machine.succeed(f"curl -H 'X-API-Key: api_key' localhost:8000/api/expand -d '{slug}'"))
+    assert resp["success"] is True
+    assert resp["hits"] == 1
+  '';
+}

pkgs/applications/misc/prusa-slicer/super-slicer-allow-wayland.patch

···
+From e60fc934dd48613d2fa2128e962fdc4955c91cad Mon Sep 17 00:00:00 2001
+From: Nathan Regner <[e-mail]>
+Date: Wed, 21 May 2025 08:12:55 -0600
+Subject: [PATCH] Remove forced GDK_BACKEND to x11
+
+Fixes black platter preview with NVIDIA hardware on Wayland
+
+Original patch: https://gitlab.archlinux.org/schiele/prusa-slicer/-/blob/d839bb84345c0f3ab3eb151a5777f0ca85b5f318/allow_wayland.patch
+Discussion: https://gitlab.archlinux.org/archlinux/packaging/packages/prusa-slicer/-/issues/3
+---
+ src/PrusaSlicer.cpp | 13 +++----------
+ 1 file changed, 3 insertions(+), 10 deletions(-)
+
+diff --git a/src/PrusaSlicer.cpp b/src/PrusaSlicer.cpp
+index 2111308..ccb1a34 100644
+--- a/src/PrusaSlicer.cpp
++++ b/src/PrusaSlicer.cpp
+@@ -80,13 +80,6 @@ int CLI::run(int argc, char **argv)
+     //init random generator
+     std::srand((unsigned int)std::time(nullptr));
+ 
+-#ifdef __WXGTK__
+-    // On Linux, wxGTK has no support for Wayland, and the app crashes on
+-    // startup if gtk3 is used. This env var has to be set explicitly to
+-    // instruct the window manager to fall back to X server mode.
+-    ::setenv("GDK_BACKEND", "x11", /* replace */ true);
+-#endif
+-
+ 	// Switch boost::filesystem to utf8.
+     try {
+         boost::nowide::nowide_filesystem();
+@@ -710,9 +703,9 @@ int CLI::run(int argc, char **argv)
+     #if !defined(_WIN32) && !defined(__APPLE__)
+         // likely some linux / unix system
+         const char *display = boost::nowide::getenv("DISPLAY");
+-        // const char *wayland_display = boost::nowide::getenv("WAYLAND_DISPLAY");
+-        //if (! ((display && *display) || (wayland_display && *wayland_display))) {
+-        if (! (display && *display)) {
++        const char *wayland_display = boost::nowide::getenv("WAYLAND_DISPLAY");
++        if (! ((display && *display) || (wayland_display && *wayland_display))) {
++        // if (! (display && *display)) {
+             // DISPLAY not set.
+             boost::nowide::cerr << "DISPLAY not set, GUI mode not available." << std::endl << std::endl;
+             this->print_help(false);
+-- 
+2.49.0
+

pkgs/applications/misc/prusa-slicer/super-slicer.nix

···
     ./super-slicer-use-boost186.patch
   ];
 
+  wxGTK31-prusa = wxGTK31.overrideAttrs (old: {
+    pname = "wxwidgets-prusa3d-patched";
+    version = "3.1.4";
+    src = fetchFromGitHub {
+      owner = "prusa3d";
+      repo = "wxWidgets";
+      rev = "489f6118256853cf5b299d595868641938566cdb";
+      hash = "sha256-xGL5I2+bPjmZGSTYe1L7VAmvLHbwd934o/cxg9baEvQ=";
+      fetchSubmodules = true;
+    };
+  });
+
   versions = {
     stable = {
       version = "2.5.59.13";
       hash = "sha256-FkoGcgVoBeHSZC3W5y30TBPmPrWnZSlO66TgwskgqAU=";
       inherit patches;
+      overrides = {
+        wxGTK-override = wxGTK31-prusa;
+      };
     };
     latest = {
       version = "2.5.59.13";
       hash = "sha256-FkoGcgVoBeHSZC3W5y30TBPmPrWnZSlO66TgwskgqAU=";
       inherit patches;
+      overrides = {
+        wxGTK-override = wxGTK31-prusa;
+      };
     };
     beta = {
-      version = "2.5.60.0";
-      hash = "sha256-dDRK07SatLLhuoc2fJKbHUwAofRRvBUoXWO61W2blFM=";
-      inherit patches;
+      version = "2.7.61.6";
+      hash = "sha256-j9er2/z4jl04HI6aOMJ6YCXwhZ6qEhgMJjW117cLnz0=";
+      # this can be removed once prusa-slicer natively supports WayLand
+      # https://github.com/prusa3d/PrusaSlicer/issues/8284
+      # https://github.com/prusa3d/PrusaSlicer/pull/13307
+      # https://gitlab.archlinux.org/schiele/prusa-slicer/-/blob/d839bb84345c0f3ab3eb151a5777f0ca85b5f318/allow_wayland.patch
+      # https://gitlab.archlinux.org/archlinux/packaging/packages/prusa-slicer/-/issues/3
+      patches = [ ./super-slicer-allow-wayland.patch ];
     };
   };
 
···
     {
       version,
       hash,
-      patches,
+      patches ? [ ],
+      ...
     }:
     super: {
       inherit version pname patches;
···
       passthru = allVersions;
 
     };
-  wxGTK31-prusa = wxGTK31.overrideAttrs (old: {
-    pname = "wxwidgets-prusa3d-patched";
-    version = "3.1.4";
-    src = fetchFromGitHub {
-      owner = "prusa3d";
-      repo = "wxWidgets";
-      rev = "489f6118256853cf5b299d595868641938566cdb";
-      hash = "sha256-xGL5I2+bPjmZGSTYe1L7VAmvLHbwd934o/cxg9baEvQ=";
-      fetchSubmodules = true;
-    };
-  });
   prusa-slicer-deps-override = prusa-slicer.override {
-    wxGTK-override = wxGTK31-prusa;
     opencascade-override = opencascade-occt_7_6;
   };
   allVersions = builtins.mapAttrs (
-    _name: version: (prusa-slicer-deps-override.overrideAttrs (override version))
+    _name: version:
+    (prusa-slicer-deps-override.override (version.overrides or { })).overrideAttrs (override version)
   ) versions;
 in
 allVersions.stable

pkgs/applications/misc/zathura/core/default.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zathura";
-  version = "0.5.11";
+  version = "0.5.12";
 
   src = fetchurl {
     url = "https://pwmt.org/projects/zathura/download/zathura-${finalAttrs.version}.tar.xz";
-    hash = "sha256-VEWKmZivD7j67y6TSoESe75LeQyG3NLIuPMjZfPRtTw=";
+    hash = "sha256-6Ehw+/lrdmuCJKPzps58z6Nu+jtpGcyKL792XqTf5HY=";
   };
 
   outputs = [

pkgs/by-name/ai/aichat/package.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "aichat";
-  version = "0.29.0";
+  version = "0.30.0";
 
   src = fetchFromGitHub {
     owner = "sigoden";
     repo = "aichat";
     tag = "v${version}";
-    hash = "sha256-5fXZfRrHBAtjUa1VzzsdoFvXQSPQ8YUNJ7yhZlp58tM=";
+    hash = "sha256-xgTGii1xGtCc1OLoC53HAtQ+KVZNO1plB2GVtVBBlqs=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-YK2mps9DUs4HNFmYHtZHTJREuImlQ24y64ykGr8ovTs=";
+  cargoHash = "sha256-u2JBPm03qvuLEUOEt4YL9O750V2QPgZbxvsvlTQe2nk=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/an/anydesk/package.nix

···
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "anydesk";
-  version = "7.0.0";
+  version = "7.0.2";
 
   src = fetchurl {
     urls = [
       "https://download.anydesk.com/linux/anydesk-${finalAttrs.version}-amd64.tar.gz"
       "https://download.anydesk.com/linux/generic-linux/anydesk-${finalAttrs.version}-amd64.tar.gz"
     ];
-    hash = "sha256-AEj4/S4k6mnCb/CagEDhpCtExB8pIqv7V2b/br4nC/8=";
+    hash = "sha256-qE49rV/QPYkbyAppDML/n6brzmiA93w47bDOwiKDuUo=";
   };
 
   buildInputs =

pkgs/by-name/ca/cargo-public-api/package.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-public-api";
-  version = "0.48.0";
+  version = "0.49.0";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-QNv1aVdGZUSgiq4nJ5epuioZOJCKsss7GKYlsf98CJc=";
+    hash = "sha256-OUWTRnV1cH+a0LtYau5v4kt+1Br8Yn8RPMIPlGNcvHc=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-XzMNQbDP1dCs1vCEGgOBLR0xw8RSXupMdX5V0SPtvy4=";
+  cargoHash = "sha256-UPtD5udR/avho3Sw3dyRjNGS5UmdwWWJJHkdSY92g8s=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/ca/cargo-valgrind/package.nix

···
 }:
 rustPlatform.buildRustPackage rec {
   pname = "cargo-valgrind";
-  version = "2.3.1";
+  version = "2.3.2";
 
   src = fetchFromGitHub {
     owner = "jfrimmel";
     repo = "cargo-valgrind";
     tag = version;
-    sha256 = "sha256-gr/s2dYCFmhwfXT3tqWPFpXQK2QaAhL7Aqnn1A3KjJI=";
+    sha256 = "sha256-oLnvDie6PUW5MVEMIcqfmwNkkfz25l+NABSKih4eSpI=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-iNsGrbncZwCHXn/xuiI4Mw4F3FFWswEhwpIMI0xcFgU=";
+  cargoHash = "sha256-L927ViGgb5LchJRMd6cBks6K41xOYLNI1Q2kTKdYBgg=";
 
   passthru = {
     updateScript = nix-update-script { };

pkgs/by-name/ch/chhoto-url/package.nix

···
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nixosTests,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "chhoto-url";
+  version = "6.2.8";
+
+  src = fetchFromGitHub {
+    owner = "SinTan1729";
+    repo = "chhoto-url";
+    tag = finalAttrs.version;
+    hash = "sha256-aWiLfhNbtjsM7fEqoNIKsU12/3b8ORTpZ/4jyqSLmdM=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/actix";
+
+  postPatch = ''
+    substituteInPlace src/{main.rs,services.rs} \
+      --replace-fail "./resources/" "${placeholder "out"}/share/chhoto-url/resources/"
+  '';
+
+  cargoHash = "sha256-rKNGUl1TI21SOBwTuv/TGl46S8FVjCWunJwP5PLdx6g=";
+
+  postInstall = ''
+    mkdir -p $out/share/chhoto-url
+    cp -r ${finalAttrs.src}/resources $out/share/chhoto-url/resources
+  '';
+
+  passthru = {
+    tests = { inherit (nixosTests) chhoto-url; };
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Simple, blazingly fast, selfhosted URL shortener with no unnecessary features";
+    homepage = "https://github.com/SinTan1729/chhoto-url";
+    changelog = "https://github.com/SinTan1729/chhoto-url/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ defelo ];
+    mainProgram = "chhoto-url";
+  };
+})

pkgs/by-name/dp/dprint/plugins/dprint-plugin-biome.nix

···
 { mkDprintPlugin }:
 mkDprintPlugin {
   description = "Biome (JS/TS) wrapper plugin.";
-  hash = "sha256-QQ4FrQL64JJ/JJNWt6i5+2yqM15TXICcKGTqUDEWVVA=";
+  hash = "sha256-CqsBSzhUD5OUqyXNIl2T8yb/QngR3ept1kTMUKu7vuc=";
   initConfig = {
     configExcludes = [ "**/node_modules" ];
     configKey = "biome";
···
   };
   pname = "dprint-plugin-biome";
   updateUrl = "https://plugins.dprint.dev/dprint/biome/latest.json";
-  url = "https://plugins.dprint.dev/biome-0.9.0.wasm";
-  version = "0.9.0";
+  url = "https://plugins.dprint.dev/biome-0.9.1.wasm";
+  version = "0.9.1";
 }

pkgs/by-name/fn/fnott/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fnott";
-  version = "1.7.1";
+  version = "1.8.0";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "dnkl";
     repo = "fnott";
     rev = finalAttrs.version;
-    hash = "sha256-C0GvpjOrcelk/KNNDQ7/02Ai7xy8FVzmLcuC2je5wYA=";
+    hash = "sha256-II8fij64ufwXg71VoSayVpSFim9+2w3j4gdTRDBrYQE=";
   };
 
   PKG_CONFIG_DBUS_1_SESSION_BUS_SERVICES_DIR = "${placeholder "out"}/share/dbus-1/services";

pkgs/by-name/go/go-blueprint/package.nix

···
 
 buildGoModule rec {
   pname = "go-blueprint";
-  version = "0.10.10";
+  version = "0.10.11";
 
   src = fetchFromGitHub {
     owner = "Melkeydev";
     repo = "go-blueprint";
     rev = "v${version}";
-    hash = "sha256-yUuI7FrrSTTlaFfb/hh0YSzaOzE2dBlXoSCaNuKFdrM=";
+    hash = "sha256-ahvSCu4bqzPmscHSQmaxhbUtlEL7T0T/13RY2sIGWjA=";
   };
 
   ldflags = [

pkgs/by-name/hy/hyprgraphics/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hyprgraphics";
-  version = "0.1.4";
+  version = "0.1.5";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "hyprgraphics";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8u6b5oAdX0rCuoR8wFenajBRmI+mzbpNig6hSCuWUzE=";
+    hash = "sha256-gbh1HL98Fdqu0jJIWN4OJQN7Kkth7+rbkFpSZLm/62A=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ln/lnd/package.nix

···
 
 buildGoModule rec {
   pname = "lnd";
-  version = "0.19.1-beta";
+  version = "0.19.2-beta";
 
   src = fetchFromGitHub {
     owner = "lightningnetwork";
     repo = "lnd";
     rev = "v${version}";
-    hash = "sha256-ifxEUEQUhy1msMsP+rIx0s1GkI+569kMR9LwymeSPkY=";
+    hash = "sha256-LUBUODPKXqU/wzQhjmC0NfvM284sD5dc7iQFSsdzyyI=";
   };
 
-  vendorHash = "sha256-FYyjCNiHKoG7/uvxhHKnEz3J4GuKwEJcjrFXYqCxTtc=";
+  vendorHash = "sha256-3eOKZ/NgSPrtYfDYUTDnVVb7EyMz8s+mtFo2UMyieHY=";
 
   subPackages = [
     "cmd/lncli"

pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix

···
 in
 python3.pkgs.buildPythonApplication rec {
   pname = "matrix-synapse";
-  version = "1.133.0";
+  version = "1.134.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "element-hq";
     repo = "synapse";
     rev = "v${version}";
-    hash = "sha256-SCpLM/4sxE9xA781tgjrNNXpScCQOtgKnZKq64eCay8=";
+    hash = "sha256-q7+yVKFzyu8ccuroZsTSMRRKMwmr3TDojtXNx4bChTE";
   };
 
   patches = [
···
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-qgQU041VlAFFgEg2RhbK6g+aike+HN0FYuvHYtufzW8=";
+    hash = "sha256-BfLj+cqS6zpX2qLb+Rur4cy7CyPH2KzdXaTXpNK20DM=";
   };
 
   postPatch = ''
···
     ];
     cache-memory = [
       pympler
-    ];
-    user-search = [
-      pyicu
     ];
   };
 

pkgs/by-name/ma/matrix-synapse/package.nix

···
     [
       "postgres"
       "url-preview"
-      "user-search"
     ]
     ++ lib.optional (lib.meta.availableOn stdenv.hostPlatform matrix-synapse-unwrapped.python.pkgs.systemd) "systemd",
   plugins ? [ ],

pkgs/by-name/my/myks/package.nix

···
 
 buildGoModule rec {
   pname = "myks";
-  version = "4.11.0";
+  version = "4.11.2";
 
   src = fetchFromGitHub {
     owner = "mykso";
     repo = "myks";
     tag = "v${version}";
-    hash = "sha256-NXb+7JEk5w1hq7ML6LQD1QXbnOqp+BJ9K+uqrwUsrDs=";
+    hash = "sha256-T+ur6JSSC71mStc8/HxkGN4tMS4pEvoHBpsYkukYvRQ=";
   };
 
-  vendorHash = "sha256-iAihVBR63OcORNAW7szKPOMyc+X1X76u++j5HLHU35I=";
+  vendorHash = "sha256-9dT3Y+d6JNSzVLxB8I0rsVLSPDH4ijeeehX9RWWo7hI=";
 
   subPackages = ".";
 

pkgs/by-name/na/naja/package.nix

···
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "naja";
-  version = "0.1.16";
+  version = "0.1.24";
 
   src = fetchFromGitHub {
     owner = "najaeda";
     repo = "naja";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-MwMpxmmr8fJN49RkRguiEEwPVUIm+OcNFjEixpjn9UY=";
+    hash = "sha256-vfP/xusfY11bk0GsIZcW38rXPMgutTDgTNjO40Uz1bU=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/ne/netexec/package.nix

···
     self = python;
     packageOverrides = self: super: {
       impacket = super.impacket.overridePythonAttrs {
-        version = "0.12.0.dev1-unstable-2023-11-30";
+        version = "0.12.0-unstable-2025-03-14";
         src = fetchFromGitHub {
-          owner = "Pennyw0rth";
+          owner = "fortra";
           repo = "impacket";
-          rev = "d370e6359a410063b2c9c68f6572c3b5fb178a38";
-          hash = "sha256-Jozn4lKAnLQ2I53+bx0mFY++OH5P4KyqVmrS5XJUY3E=";
+          rev = "8b4566b12fc79acb520d045dbae8f13446a9d4d7";
+          hash = "sha256-jyn5qSSAipGYhHm2EROwDHa227mnmW+d+0H0/++i1OY=";
         };
         # Fix version to be compliant with Python packaging rules
         postPatch = ''

pkgs/by-name/op/open-webui/package.nix

···
 }:
 let
   pname = "open-webui";
-  version = "0.6.15";
+  version = "0.6.16";
 
   src = fetchFromGitHub {
     owner = "open-webui";
     repo = "open-webui";
     tag = "v${version}";
-    hash = "sha256-MD7d+5JuTzChqKLxXyZFLyPktXFta1EOe4Oj4uEGaho=";
+    hash = "sha256-git5bNvW+CfeH4N9/AF5iWly0KoJf6OZKDKlGfhDtP4=";
   };
 
   frontend = buildNpmPackage rec {
···
       url = "https://github.com/pyodide/pyodide/releases/download/${pyodideVersion}/pyodide-${pyodideVersion}.tar.bz2";
     };
 
-    npmDepsHash = "sha256-rUFCFYbthr0IJ5oIMgb3tr5kTqmZN40EPn05xR3LL+A=";
+    npmDepsHash = "sha256-J739sG2rKmgQQ2bPHtwzdmYcwCig3AMzpHxt+PhmAME=";
 
     # Disabling `pyodide:fetch` as it downloads packages during `buildPhase`
     # Until this is solved, running python packages from the browser will not work.
···
       boto3
       chromadb
       colbert-ai
+      cryptography
+      ddgs
       docx2txt
-      duckduckgo-search
       einops
       elasticsearch
       extract-msg
···
       google-genai
       google-generativeai
       googleapis-common-protos
+      httpx
       iso-639
       langchain
       langchain-community
···
       playwright
       psutil
       psycopg2-binary
+      pycrdt
       pydub
       pyjwt
       pymdown-extensions

pkgs/by-name/os/osquery/info.json

···
     },
     "osquery": {
         "fetchSubmodules": true,
-        "hash": "sha256-zv6R6MR9uaizwkDWw0sT3XSzT1qmPDAkL9crbzBTKTk=",
+        "hash": "sha256-oNH+mDTtg4m6wnE5XBWRQHWhBasy9ssSrxA/TPCd2pI=",
         "owner": "osquery",
         "repo": "osquery",
-        "rev": "5.17.0"
+        "rev": "5.18.1"
     }
 }

pkgs/by-name/po/pomerium-cli/package.nix

···
 in
 buildGoModule rec {
   pname = "pomerium-cli";
-  version = "0.30.0";
+  version = "0.30.1";
 
   src = fetchFromGitHub {
     owner = "pomerium";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-BQuI4t9WjOeeqqPYLLsVyvyAbotzQZKAgSLgYDEF0Rg=";
+    sha256 = "sha256-zrmd/c1XVoD9oLbDBvbtPHQpbPLOvDRSV4CamViBd1w=";
   };
 
-  vendorHash = "sha256-E3wKzIgrw1UDzHyZIHsALlTrQojHtSjtyckV34RPUtg=";
+  vendorHash = "sha256-G+XnzbkJw4ttif+OcTrHlhz9a3P/CVKnJ3IF3iPcaHM=";
 
   subPackages = [
     "cmd/pomerium-cli"

pkgs/by-name/so/soteria/package.nix

···
   polkit,
 }:
 let
-  version = "0.1.4";
+  version = "0.2.0";
 in
 rustPlatform.buildRustPackage {
   pname = "soteria";
···
     owner = "imvaskel";
     repo = "soteria";
     tag = "v${version}";
-    hash = "sha256-Dpu0GBpa3W2itIjCiqA4Yh4he0ZfLDSr26DYSfhMphI=";
+    hash = "sha256-bZhxz6aycx7J3itInSsl2glbIs6OpIEkfSp3nYfPojk=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-RXPzmco+pLkLxY+jicafuqdul9LpkDv6YK8+bHCS+5s=";
+  cargoHash = "sha256-rxZRDx+5srBbMTVLMNH8liOqjyg90FvTaTT7g+3fq7E=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/wh/whois/package.nix

···
 }:
 
 stdenv.mkDerivation rec {
-  version = "5.6.2";
+  version = "5.6.3";
   pname = "whois";
 
   src = fetchFromGitHub {
     owner = "rfc1036";
     repo = "whois";
     rev = "v${version}";
-    hash = "sha256-SUpbPxEAFXNlncUgmbMt7ZjaX45hzffca8keBRpcXcM=";
+    hash = "sha256-YJAd6s1kq2IJcR7qf7ljntLb5HgsaTH0wsoPKIMxHdg=";
   };
 
   patches = [

pkgs/by-name/xm/xmake/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xmake";
-  version = "3.0.0";
+  version = "3.0.1";
 
   src = fetchFromGitHub {
     owner = "xmake-io";
     repo = "xmake";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-JY94DaSZ12pRrcCPxoPaECRA8rMK6/fNNyr/F8Htu8A=";
+    hash = "sha256-PlSNeC5h2C+cQMHqN1dD6prfZIenZXEHa1nWD2SgMIU=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/ze/zenn-cli/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zenn-cli";
-  version = "0.1.159";
+  version = "0.2.1";
 
   src = fetchFromGitHub {
     owner = "zenn-dev";
     repo = "zenn-editor";
     tag = finalAttrs.version;
-    hash = "sha256-q28XSsGf+Uz+FTRwyu1xg/8bnYxuL6Jt+t3mk0CcWGY=";
+    hash = "sha256-LFbC3GXYLCgBOYBdNJRdESGb37DuGBCEL8ak1Qf9DVA=";
     # turborepo requires .git directory
     leaveDotGit = true;
   };

pkgs/development/python-modules/craft-parts/default.nix

···
 
 buildPythonPackage rec {
   pname = "craft-parts";
-  version = "2.16.0";
+  version = "2.18.0";
 
   pyproject = true;
 
···
     owner = "canonical";
     repo = "craft-parts";
     tag = version;
-    hash = "sha256-JuFx5Ap2ioYsc20E5Ho4z+/DFs7d+OBF3XLlOOZ10Zk=";
+    hash = "sha256-mjmWB6kgQNY++aAb9Ql/1cISGqX1mivz62y0Sa65FwM=";
   };
 
   patches = [ ./bash-path.patch ];

pkgs/development/web/nodejs/v24.nix

···
 in
 buildNodejs {
   inherit enableNpm;
-  version = "24.4.0";
-  sha256 = "42fa8079da25a926013cd89b9d3467d09110e4fbb0c439342ebe4dd6ecc26bbb";
+  version = "24.4.1";
+  sha256 = "adb79ca0987486ed66136213da19ff17ef6724dcb340c320e010c9442101652f";
   patches =
     (
       if (stdenv.hostPlatform.emulatorAvailable buildPackages) then