Merge staging-next into staging

nixos/modules/services/networking/fedimintd.nix

···
           openFirewall = mkOption {
             type = types.bool;
             default = true;
-            description = "Opens port in firewall for fedimintd's p2p port";
+            description = "Opens port in firewall for fedimintd's p2p port (both TCP and UDP)";
           };
           port = mkOption {
             type = types.port;
             default = 8173;
-            description = "Port to bind on for p2p connections from peers";
+            description = "Port to bind on for p2p connections from peers (both TCP and UDP)";
           };
           bind = mkOption {
             type = types.str;
             default = "0.0.0.0";
-            description = "Address to bind on for p2p connections from peers";
+            description = "Address to bind on for p2p connections from peers (both TCP and UDP)";
           };
           url = mkOption {
-            type = types.str;
+            type = types.nullOr types.str;
             example = "fedimint://p2p.myfedimint.com:8173";
             description = ''
-              Public address for p2p connections from peers
+              Public address for p2p connections from peers (if TCP is used)
             '';
           };
         };
-        api = {
+        api_ws = {
           openFirewall = mkOption {
             type = types.bool;
             default = false;
-            description = "Opens port in firewall for fedimintd's api port";
+            description = "Opens TCP port in firewall for fedimintd's Websocket API";
           };
           port = mkOption {
             type = types.port;
             default = 8174;
-            description = "Port to bind on for API connections relied by the reverse proxy/tls terminator.";
+            description = "TCP Port to bind on for API connections relayed by the reverse proxy/tls terminator.";
           };
           bind = mkOption {
             type = types.str;
···
             description = "Address to bind on for API connections relied by the reverse proxy/tls terminator.";
           };
           url = mkOption {
-            type = types.str;
+            type = types.nullOr types.str;
             description = ''
               Public URL of the API address of the reverse proxy/tls terminator. Usually starting with `wss://`.
             '';
           };
         };
+        api_iroh = {
+          openFirewall = mkOption {
+            type = types.bool;
+            default = true;
+            description = "Opens UDP port in firewall for fedimintd's API Iroh endpoint";
+          };
+          port = mkOption {
+            type = types.port;
+            default = 8174;
+            description = "UDP Port to bind Iroh endpoint for API connections";
+          };
+          bind = mkOption {
+            type = types.str;
+            default = "0.0.0.0";
+            description = "Address to bind on for Iroh endpoint for API connections";
+          };
+        };
+        ui = {
+          openFirewall = mkOption {
+            type = types.bool;
+            default = false;
+            description = "Opens TCP port in firewall for built-in UI";
+          };
+          port = mkOption {
+            type = types.port;
+            default = 8175;
+            description = "TCP Port to bind on for UI connections";
+          };
+          bind = mkOption {
+            type = types.str;
+            default = "127.0.0.1";
+            description = "Address to bind on for UI connections";
+          };
+        };
         bitcoin = {
           network = mkOption {
             type = types.str;
···
             example = "api.myfedimint.com";
             description = "Public domain of the API address of the reverse proxy/tls terminator.";
           };
-          path = mkOption {
+          path_ui = mkOption {
+            type = types.str;
+            example = "/";
+            default = "/";
+            description = "Path to host the built-in UI on and forward to the daemon's api port";
+          };
+          path_ws = mkOption {
             type = types.str;
             example = "/";
             default = "/ws/";
···
       networking.firewall.allowedTCPPorts = concatLists (
         mapAttrsToList (
           fedimintdName: cfg:
-          (lib.optional cfg.api.openFirewall cfg.api.port ++ lib.optional cfg.p2p.openFirewall cfg.p2p.port)
+          (
+            lib.optional cfg.api_ws.openFirewall cfg.api_ws.port
+            ++ lib.optional cfg.p2p.openFirewall cfg.p2p.port
+            ++ lib.optional cfg.ui.openFirewall cfg.ui.port
+          )
+        ) eachFedimintd
+      );
+
+      networking.firewall.allowedUDPPorts = concatLists (
+        mapAttrsToList (
+          fedimintdName: cfg:
+          (
+            lib.optional cfg.api_iroh.openFirewall cfg.api_iroh.port
+            ++ lib.optional cfg.p2p.openFirewall cfg.p2p.port
+          )
         ) eachFedimintd
       );
 
···
         fedimintdName: cfg:
         (nameValuePair "fedimintd-${fedimintdName}" (
           let
-            startScript = pkgs.writeShellScript "fedimintd-start" (
+            startScript = pkgs.writeShellScriptBin "fedimintd" (
               (
                 if cfg.bitcoin.rpc.secretFile != null then
                   ''
-                    secret=$(${pkgs.coreutils}/bin/head -n 1 "${cfg.bitcoin.rpc.secretFile}")
-                    prefix="''${FM_BITCOIN_RPC_URL%*@*}"  # Everything before the last '@'
-                    suffix="''${FM_BITCOIN_RPC_URL##*@}"  # Everything after the last '@'
-                    FM_BITCOIN_RPC_URL="''${prefix}:''${secret}@''${suffix}"
+                    >&2 echo "Setting FM_FORCE_BITCOIN_RPC_URL using password from ${cfg.bitcoin.rpc.secretFile}"
+                    secret=$(${pkgs.coreutils}/bin/head -n 1 "${cfg.bitcoin.rpc.secretFile}" || exit 1)
+                    export FM_FORCE_BITCOIN_RPC_URL=$(echo "$FM_BITCOIN_RPC_URL" | sed "s|^\(\w\+://[^@]\+\)\(@.*\)|\1:''${secret}\2|")
                   ''
                 else
                   ""
···
             environment = lib.mkMerge [
               {
                 FM_BIND_P2P = "${cfg.p2p.bind}:${toString cfg.p2p.port}";
-                FM_BIND_API = "${cfg.api.bind}:${toString cfg.api.port}";
-                FM_P2P_URL = cfg.p2p.url;
-                FM_API_URL = cfg.api.url;
+                FM_BIND_API_WS = "${cfg.api_ws.bind}:${toString cfg.api_ws.port}";
+                FM_BIND_API_IROH = "${cfg.api_iroh.bind}:${toString cfg.api_iroh.port}";
+                FM_BIND_UI = "${cfg.ui.bind}:${toString cfg.ui.port}";
                 FM_DATA_DIR = cfg.dataDir;
                 FM_BITCOIN_NETWORK = cfg.bitcoin.network;
                 FM_BITCOIN_RPC_URL = cfg.bitcoin.rpc.url;
                 FM_BITCOIN_RPC_KIND = cfg.bitcoin.rpc.kind;
               }
+
+              (lib.optionalAttrs (cfg.p2p.url != null) {
+                FM_P2P_URL = cfg.p2p.url;
+              })
+
+              (lib.optionalAttrs (cfg.api_ws.url != null) {
+                FM_API_URL = cfg.api_ws.url;
+              })
+
               cfg.environment
             ];
             serviceConfig = {
···
 
               StateDirectory = "fedimintd-${fedimintdName}";
               StateDirectoryMode = "0700";
-              ExecStart = startScript;
+              ExecStart = "${startScript}/bin/fedimintd";
 
               Restart = "always";
               RestartSec = 10;
···
               RestrictAddressFamilies = [
                 "AF_INET"
                 "AF_INET6"
+                "AF_NETLINK"
               ];
               RestrictNamespaces = true;
               RestrictRealtime = true;
+              SocketBindAllow = "udp:${builtins.toString cfg.api_iroh.port}";
               SystemCallArchitectures = "native";
               SystemCallFilter = [
                 "@system-service"
···
               # overridden by default value from vhost-options.nix
               enableACME = mkOverride 99 true;
               forceSSL = mkOverride 99 true;
-              locations.${cfg.nginx.path} = {
-                proxyPass = "http://127.0.0.1:${toString cfg.api.port}/";
+              locations.${cfg.nginx.path_ws} = {
+                proxyPass = "http://127.0.0.1:${builtins.toString cfg.api_ws.port}/";
                 proxyWebsockets = true;
+                extraConfig = ''
+                  proxy_pass_header Authorization;
+                '';
+              };
+              locations.${cfg.nginx.path_ui} = {
+                proxyPass = "http://127.0.0.1:${builtins.toString cfg.ui.port}/";
                 extraConfig = ''
                   proxy_pass_header Authorization;
                 '';

nixos/modules/services/web-apps/nextcloud.nix

···
               imap0 (i: v: ''
                 ${lib.getExe occ} config:system:set trusted_domains \
                   ${toString i} --value="${toString v}"
-              '') ([ cfg.hostName ] ++ cfg.settings.trusted_domains)
+              '') (lib.unique ([ cfg.hostName ] ++ cfg.settings.trusted_domains))
             );
 
           in

nixos/tests/fedimintd.nix

···
         p2p = {
           url = "fedimint://example.com";
         };
-        api = {
+        api_ws = {
           url = "wss://example.com";
         };
-        environment = {
-          "FM_REL_NOTES_ACK" = "0_4_xyz";
-        };
+        environment = { };
       };
     };
 
···
       start_all()
 
       machine.wait_for_unit("fedimintd-mainnet.service")
-      machine.wait_for_open_port(${toString nodes.machine.services.fedimintd.mainnet.api.port})
+      machine.wait_for_open_port(${toString nodes.machine.services.fedimintd.mainnet.api_ws.port})
     '';
 }

pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix

···
   pkgs,
 }:
 let
-  version = "0.0.24-unstable-2025-06-12";
+  version = "0.0.25-unstable-2025-06-20";
   src = fetchFromGitHub {
     owner = "yetone";
     repo = "avante.nvim";
-    rev = "8a64d454ef8cfaef2c6280efc9a09ba94fec2c42";
-    hash = "sha256-45Hnopy5yAFpPFNnsTEmfeFTub5tQvhf4dRYoKC+F0g=";
+    rev = "060c0de2aa2ef7c9e6e100f3bd8ef92c085d0555";
+    hash = "sha256-g5GVTRy1RiNNYrVIQbHxOu1ihxlQk/kww3DEKJ6hF9Q=";
   };
   avante-nvim-lib = rustPlatform.buildRustPackage {
     pname = "avante-nvim-lib";

pkgs/applications/editors/vscode/extensions/default.nix

···
           # semver scheme, contrary to preview versions which are listed on
           # the VSCode Marketplace and use a calver scheme. We should avoid
           # using preview versions, because they expire after two weeks.
-          version = "17.1.1";
-          hash = "sha256-hlhq4bR3v0AqI3lxilgNEgjjEEBVL0xfvIWbV/Ronh4=";
+          version = "17.2.0";
+          hash = "sha256-jruhqXJfCACYBFUbPCL22nhqCSrm1QFSMIpsPguQ6J8=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/eamodio.gitlens/changelog";
···
         mktplcRef = {
           name = "Ionide-fsharp";
           publisher = "Ionide";
-          version = "7.26.1";
-          hash = "sha256-xNbW3VoFGeOaII3Z1l51F1IAKKaGP7FhE+rGuCdaHTI=";
+          version = "7.26.2";
+          hash = "sha256-Ox2L39Q3XsnktThVaLP0JxqJlvvkJXaZsdBE2A2ntAc=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/Ionide.Ionide-fsharp/changelog";

pkgs/applications/editors/vscode/update-shell.nix

···
-{
-  pkgs ? import ../../../.. { },
-}:
-
-# Ideally, pkgs points to default.nix file of Nixpkgs official tree
-with pkgs;
-
-mkShell {
-  packages = [
-    bash
-    curl
-    gawk
-    gnugrep
-    gnused
-    jq
-    nix
-    nix-prefetch
-    nix-prefetch-scripts
-  ];
-}

pkgs/applications/editors/vscode/update-vscode.sh

···
 #! /usr/bin/env nix-shell
-#! nix-shell update-shell.nix -i bash
-
-# Update script for the vscode versions and hashes.
-# Usually doesn't need to be called by hand,
-# but is called by a bot: https://github.com/samuela/nixpkgs-upkeep/actions
-# Call it by hand if the bot fails to automatically update the versions.
+#!nix-shell -i bash -p bash curl gawk gnugrep gnused jq nix nix-prefetch nix-prefetch-scripts common-updater-scripts
 
 set -eou pipefail
 
-ROOT="$(dirname "$(readlink -f "$0")")"
-if [ ! -f "$ROOT/vscode.nix" ]; then
-  echo "ERROR: cannot find vscode.nix in $ROOT"
-  exit 1
-fi
+latestVersion=$(curl --fail --silent https://api.github.com/repos/Microsoft/vscode/releases/latest | jq --raw-output .tag_name)
+currentVersion=$(nix eval --raw -f . vscode.version)
 
-# VSCode
+echo "latest  version: $latestVersion"
+echo "current version: $currentVersion"
 
-VSCODE_VER=$(curl --fail --silent https://api.github.com/repos/Microsoft/vscode/releases/latest | jq --raw-output .tag_name)
-sed -i "s/version = \".*\"/version = \"${VSCODE_VER}\"/" "$ROOT/vscode.nix"
+if [[ "$latestVersion" == "$currentVersion" ]]; then
+  echo "package is up-to-date"
+  exit 0
+fi
 
-TEMP_FOLDER=$(mktemp -d)
+update-source-version vscode $latestVersion
 
-VSCODE_X64_LINUX_URL="https://update.code.visualstudio.com/${VSCODE_VER}/linux-x64/stable"
+systems=$(nix eval --json -f . vscode.meta.platforms | jq --raw-output '.[]')
+for system in $systems; do
+  hash=$(nix hash convert --to sri --hash-algo sha256 $(nix-prefetch-url $(nix eval --raw -f . vscode.src.url --system "$system")))
+  update-source-version vscode $latestVersion $hash --system=$system --ignore-same-version --ignore-same-hash
+done
 
-# Split output by newlines into Bash array
-readarray -t VSCODE_X64_LINUX <<< $(nix-prefetch-url --print-path ${VSCODE_X64_LINUX_URL})
-
-sed -i "s/x86_64-linux = \".\{52\}\"/x86_64-linux = \"${VSCODE_X64_LINUX[0]}\"/" "$ROOT/vscode.nix"
-
-tar xf ${VSCODE_X64_LINUX[1]} -C $TEMP_FOLDER
-VSCODE_COMMIT=$(jq --raw-output .commit $TEMP_FOLDER/VSCode-linux-x64/resources/app/product.json)
-sed -i "s/rev = \".\{40\}\"/rev = \"${VSCODE_COMMIT}\"/" "$ROOT/vscode.nix"
-
-SERVER_X64_LINUX_URL="https://update.code.visualstudio.com/commit:${VSCODE_COMMIT}/server-linux-x64/stable"
-SERVER_X64_LINUX_SHA256=$(nix-prefetch-url ${SERVER_X64_LINUX_URL})
-sed -i "s/sha256 = \".\{51,52\}\"/sha256 = \"${SERVER_X64_LINUX_SHA256}\"/" "$ROOT/vscode.nix"
-
-VSCODE_X64_DARWIN_URL="https://update.code.visualstudio.com/${VSCODE_VER}/darwin/stable"
-VSCODE_X64_DARWIN_SHA256=$(nix-prefetch-url ${VSCODE_X64_DARWIN_URL})
-sed -i "s/x86_64-darwin = \".\{52\}\"/x86_64-darwin = \"${VSCODE_X64_DARWIN_SHA256}\"/" "$ROOT/vscode.nix"
-
-VSCODE_AARCH64_LINUX_URL="https://update.code.visualstudio.com/${VSCODE_VER}/linux-arm64/stable"
-VSCODE_AARCH64_LINUX_SHA256=$(nix-prefetch-url ${VSCODE_AARCH64_LINUX_URL})
-sed -i "s/aarch64-linux = \".\{52\}\"/aarch64-linux = \"${VSCODE_AARCH64_LINUX_SHA256}\"/" "$ROOT/vscode.nix"
-
-VSCODE_AARCH64_DARWIN_URL="https://update.code.visualstudio.com/${VSCODE_VER}/darwin-arm64/stable"
-VSCODE_AARCH64_DARWIN_SHA256=$(nix-prefetch-url ${VSCODE_AARCH64_DARWIN_URL})
-sed -i "s/aarch64-darwin = \".\{52\}\"/aarch64-darwin = \"${VSCODE_AARCH64_DARWIN_SHA256}\"/" "$ROOT/vscode.nix"
-
-VSCODE_ARMV7L_LINUX_URL="https://update.code.visualstudio.com/${VSCODE_VER}/linux-armhf/stable"
-VSCODE_ARMV7L_LINUX_SHA256=$(nix-prefetch-url ${VSCODE_ARMV7L_LINUX_URL})
-sed -i "s/armv7l-linux = \".\{52\}\"/armv7l-linux = \"${VSCODE_ARMV7L_LINUX_SHA256}\"/" "$ROOT/vscode.nix"
+rev=$(curl --fail --silent https://api.github.com/repos/Microsoft/vscode/git/ref/tags/$latestVersion | jq --raw-output .object.sha)
+update-source-version vscode $rev --version-key=rev --source-key=vscodeServer.src --ignore-same-version --ignore-same-hash

pkgs/applications/editors/vscode/vscode.nix

···
 {
+  lib,
   stdenv,
   stdenvNoCC,
-  lib,
   callPackage,
   fetchurl,
   nixosTests,
···
 
   archive_fmt = if stdenv.hostPlatform.isDarwin then "zip" else "tar.gz";
 
-  sha256 =
+  hash =
     {
-      x86_64-linux = "1zc64d1n84kzwmwh8m3j897di5955qlm7glnpjvl8g7q70b4rdax";
-      x86_64-darwin = "04ycsad1khxjmiph9fk9449w942m8gmq65amwkf8jxqzn0rybh76";
-      aarch64-linux = "0lhqmp59vccs35fksgvdgvw82b0mr9b2wlyafxlwb8pk2q0l0xga";
-      aarch64-darwin = "1axzsk6xqlzs3j9irjxp5f4fbdxyi4fffhdk89h45q3zkw8m9m4i";
-      armv7l-linux = "1rv3a8xj7iv1d8mfikpj58n398ww5cndbyvgy5328nj7dh6azrsw";
+      x86_64-linux = "sha256-Rr7JNWloV4VkgGk9zDEnD/WRHSYv5su8UrOSIl3247c=";
+      x86_64-darwin = "sha256-hHAJVmFKwD0Z8YyqvNlM4SpWnSIniVvdMwR3fhk/mKE=";
+      aarch64-linux = "sha256-/pYykG/1IJU7aJ9wtO5oo3dUdCGtfxklre0SGMpgnq8=";
+      aarch64-darwin = "sha256-pWMCQlgxoJ4EGfycuz3H76r9Sc3x006el1ITOM6E4wE=";
+      armv7l-linux = "sha256-M0fK1n/HMuNQvN85I4g5GV8QAg3n6vQtR6V/B1PFAwQ=";
     }
     .${system} or throwSystem;
 in
 callPackage ./generic.nix rec {
   # Please backport all compatible updates to the stable release.
   # This is important for the extension ecosystem.
-  version = "1.101.0";
+  version = "1.101.1";
   pname = "vscode" + lib.optionalString isInsiders "-insiders";
 
   # This is used for VS Code - Remote SSH test
-  rev = "dfaf44141ea9deb3b4096f7cd6d24e00c147a4b1";
+  rev = "18e3a1ec544e6907be1e944a94c496e302073435";
 
   executableName = "code" + lib.optionalString isInsiders "-insiders";
   longName = "Visual Studio Code" + lib.optionalString isInsiders " - Insiders";
···
   src = fetchurl {
     name = "VSCode_${version}_${plat}.${archive_fmt}";
     url = "https://update.code.visualstudio.com/${version}/${plat}/stable";
-    inherit sha256;
+    inherit hash;
   };
 
   # We don't test vscode on CI, instead we test vscodium
···
     src = fetchurl {
       name = "vscode-server-${rev}.tar.gz";
       url = "https://update.code.visualstudio.com/commit:${rev}/server-linux-x64/stable";
-      sha256 = "0rjd4f54k58k97gxvnivwj52aha5s8prws1izvmg43vphhfvk014";
+      hash = "sha256-Myq0OUrwv6bq53Q5FDCVtt+wfGlEX2bjz9CMeVLfd+4=";
     };
     stdenv = stdenvNoCC;
   };
···
 
   hasVsceSign = true;
 
-  meta = with lib; {
+  meta = {
     description = ''
       Open source source code editor developed by Microsoft for Windows,
       Linux and macOS
···
     '';
     homepage = "https://code.visualstudio.com/";
     downloadPage = "https://code.visualstudio.com/Updates";
-    license = licenses.unfree;
-    maintainers = with maintainers; [
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [
       eadwu
       synthetica
       bobby285271

pkgs/applications/editors/vscode/vscodium.nix

···
 
   hash =
     {
-      x86_64-linux = "sha256-c/0+67nosODGvNFav9JAsZlOOL4AqlcRnM1KvcfTXok=";
-      x86_64-darwin = "sha256-1mqzNWbZE0a7EqbYbPK5iJK4tRuKS0nTDcoDDOikj7g=";
-      aarch64-linux = "sha256-/ygtxPvX4fKG1s4KD+JCdc+PTdEg57J9RYW0GmcOf/4=";
-      aarch64-darwin = "sha256-TRwLkZ0uUeD9FA6IPsZ/pK672IgqmhHHycVME9d5X80=";
-      armv7l-linux = "sha256-81Fm+9iBci7UJupzeG7FWMCIseVGWSSsgyMtOce1fE4=";
+      x86_64-linux = "sha256-8ICeLN4KZo3kg0QSGgDqwnulMf4wligZZTeXQ+dC61U=";
+      x86_64-darwin = "sha256-4UDb678hbstvnkySzwI8uhgoR4pmL7KXv9gYLdhigkg=";
+      aarch64-linux = "sha256-dMsyOV4HFF4xZuUzOBOhVru1XfNu14Ga/2iX2ux07qY=";
+      aarch64-darwin = "sha256-lcX3562Aj994+vWQNcDTOVkSJ/zhH0GRjlNlNxoZUXg=";
+      armv7l-linux = "sha256-iSqVoTppc5WDBLRCFhy1hNtovCxeN2bpcvBW4Gqu2+U=";
     }
     .${system} or throwSystem;
 
···
 
   # Please backport all compatible updates to the stable release.
   # This is important for the extension ecosystem.
-  version = "1.101.03933";
+  version = "1.101.14098";
   pname = "vscodium";
 
   executableName = "codium";

pkgs/applications/networking/browsers/chromium/info.json

···
     }
   },
   "ungoogled-chromium": {
-    "version": "137.0.7151.103",
+    "version": "137.0.7151.119",
     "deps": {
       "depot_tools": {
         "rev": "1fcc527019d786502b02f71b8b764ee674a40953",
···
         "hash": "sha256-+nKP2hBUKIqdNfDz1vGggXSdCuttOt0GwyGUQ3Z1ZHI="
       },
       "ungoogled-patches": {
-        "rev": "137.0.7151.103-1",
-        "hash": "sha256-KMzO25yruwrT7rpqbQ56FMGxkVZOwDSsvFqCZbUUM5Y="
+        "rev": "137.0.7151.119-1",
+        "hash": "sha256-SMEe/Wc4cjaZfw4pQIWeblEvB9CmOJWVNkDvCKAow3Q="
       },
       "npmHash": "sha256-I6MsfAhrLRmgiRJ13LSejfy2N63C3Oug5tOOXA622j4="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "3dcc738117a3439068c9773ccd31f9858923fc4a",
-        "hash": "sha256-MIEjHLpfKIBiTFh+bO+NUf6iDpizTP9yfXQqbHfiDwo=",
+        "rev": "e0ac9d12dff5f2d33c935958b06bf1ded7f1c08c",
+        "hash": "sha256-+3C2n/7bbIOpXGvBrFnSMNlgLVRMoPtOF14CDROVClI=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
···
       },
       "src/third_party/devtools-frontend/src": {
         "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "e423961606946be24c8c1ec0d1ec91511efbabc5",
-        "hash": "sha256-MhooXuF6aw+ixPzvVCBl+6T+79cTReCYx86qqXAZ6bg="
+        "rev": "afc8e923a37090445d6d97ca23fea49d9eb7b9cf",
+        "hash": "sha256-io0J6tt0RXumjjSklZyJpALV5IikPbROd40xcrX4iBs="
       },
       "src/third_party/dom_distiller_js/dist": {
         "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
···
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "41f53aba7095888c959932bd8f2ee8b4e16af223",
-        "hash": "sha256-ICrdvHA6fe2CUphRgPdlofazr0L+NFypWDNOI5e5QIM="
+        "rev": "075234cf3d7622d9d588a6f748fc4501aa23080c",
+        "hash": "sha256-wrLxRuJ3rq1yC0PIUGPsuDB/YNee1x3J/i6ZSLk70HM="
       }
     }
   }

pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix

···
 buildMozillaMach rec {
   pname = "firefox-beta";
   binaryName = pname;
-  version = "140.0b7";
+  version = "140.0b9";
   applicationName = "Firefox Beta";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "51a9dad564bc20aaacec5bc8cfe05f7213d6fbc826783790bcb1067cbea7349a88f479df70f73501357625c6a239d33a10a840e7287d077771dc08b0fd9b076b";
+    sha512 = "eb63be9dd42f5f777706c15a87e536769deb22658da6c35070962d98d03ec678409a1d09bf257c0421039cccdf7db892eb4c7aee610341a262ffae28b04b52b3";
   };
 
   meta = {

pkgs/applications/networking/cluster/helm/default.nix

···
 
 buildGoModule (finalAttrs: {
   pname = "kubernetes-helm";
-  version = "3.18.2";
+  version = "3.18.3";
 
   src = fetchFromGitHub {
     owner = "helm";
     repo = "helm";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-yt5OsJscTjAvr/EAgf4BuE18O+OVmAFNzWMvDCGQ4sw=";
+    sha256 = "sha256-V5gWzgsinT0hGFDocPlljH1ls8Z0j5cz37oPrB6LI9Y=";
   };
-  vendorHash = "sha256-gadl9Jkj95eZpzkFWqk33O1jrLr8IxtB5kml7fNlsIo=";
+  vendorHash = "sha256-r9DLYgEjxapUOAz+FCgYXqdE6APhGKO/YnshbLRmdrU=";
 
   subPackages = [ "cmd/helm" ];
   ldflags = [

pkgs/applications/networking/cluster/terraform-providers/providers.json

···
     "vendorHash": "sha256-Z8ARwVWhep9qrUpl/B7Gj9Aey07Wtwn1XiLnCirV11M="
   },
   "openstack": {
-    "hash": "sha256-7oQ4O76yEF8QKFUHTrwchbShtiG0LAp67MqfIcDLU7o=",
+    "hash": "sha256-pGNHWhg/1LM1IJYEVLppCJWVzow+j3WPW+H8yWQXMyM=",
     "homepage": "https://registry.terraform.io/providers/terraform-provider-openstack/openstack",
     "owner": "terraform-provider-openstack",
     "repo": "terraform-provider-openstack",
-    "rev": "v3.1.0",
+    "rev": "v3.2.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-HQVKblAm8H0Q5pbJdIVSMc5FLi3O9TV475yass6BraY="
+    "vendorHash": "sha256-mTWLix4A0GRe7ayHTwU3Jt+DfDKMIKJlt1I6JuL3wXU="
   },
   "opentelekomcloud": {
     "hash": "sha256-PPrZAxJxLiR3LLEAtWucdWXI5qvsmOVfwCDCtjWuu/A=",

pkgs/by-name/an/ankama-launcher/package.nix

···
 {
+  lib,
   appimageTools,
   fetchurl,
-  lib,
 }:
 let
   pname = "ankama-launcher";
-  version = "3.12.39";
+  version = "3.13.5";
 
   # The original URL for the launcher is:
   # https://launcher.cdn.ankama.com/installers/production/Ankama%20Launcher-Setup-x86_64.AppImage
   # As it does not encode the version, we use the wayback machine (web.archive.org) to get a fixed URL.
   # To update the client, head to web.archive.org and create a new snapshot of the download page.
   src = fetchurl {
-    url = "https://web.archive.org/web/20250413180128/https://launcher.cdn.ankama.com/installers/production/Ankama%20Launcher-Setup-x86_64.AppImage";
-    hash = "sha256-25x+x5Y0pIxvJyjbctt9weCEiH0UlqGbGM7/RKkyHXA=";
+    url = "https://web.archive.org/web/20250617174847/https://launcher.cdn.ankama.com/installers/production/Ankama%20Launcher-Setup-x86_64.AppImage";
+    hash = "sha256-c3lG4Svd5gxsaUVJ3fiBO2ZL+U4pJxJX5Fg5ITZ/QwI=";
   };
 
   appimageContents = appimageTools.extract { inherit pname version src; };

pkgs/by-name/ap/appmenu-glib-translator/package.nix

···
+{
+  lib,
+  fetchFromGitLab,
+  glib,
+  gtk3,
+  meson,
+  ninja,
+  pkg-config,
+  gobject-introspection,
+  vala,
+  stdenv,
+  wrapGAppsHook3,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "appmenu-glib-translator";
+  version = "25.04";
+
+  src = fetchFromGitLab {
+    owner = "vala-panel-project";
+    repo = "vala-panel-appmenu";
+    tag = finalAttrs.version;
+    fetchSubmodules = true;
+    hash = "sha256-v5J3nwViNiSKRPdJr+lhNUdKaPG82fShPDlnmix5tlY=";
+  };
+
+  sourceRoot = "source/subprojects/appmenu-glib-translator";
+
+  nativeBuildInputs = [
+    meson
+    ninja
+
+    pkg-config
+    wrapGAppsHook3
+    vala
+  ];
+
+  buildInputs = [
+    glib
+    gobject-introspection
+    gtk3
+  ];
+
+  meta = {
+    description = "GTK module that strips menus from all GTK programs, converts to MenuModel and sends to AppMenu";
+    homepage = "https://gitlab.com/vala-panel-project/vala-panel-appmenu/-/tree/${finalAttrs.version}/subprojects/appmenu-gtk-module";
+    license = lib.licenses.lgpl3Plus;
+    maintainers = with lib.maintainers; [ perchun ];
+    platforms = lib.platforms.linux;
+  };
+})

pkgs/by-name/bi/biliup-rs/package.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "biliup-rs";
-  version = "0.2.2";
+  version = "0.2.3";
 
   src = fetchFromGitHub {
     owner = "biliup";
     repo = "biliup-rs";
     tag = "v${version}";
-    hash = "sha256-Wpi5ONOzWL/NUUuIR4jaDcJFq7ZIYi7gkIxFIU3SLVY=";
+    hash = "sha256-Gr2veeFDNHisqin4MQl/RcZN51BUHwTn7zUplP+VODo=";
   };
 
   nativeBuildInputs = [
···
   ];
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-4SH7ux15Sm7NJDY79x9O7oahvbjS4kZzzY/9UsLDq0U=";
+  cargoHash = "sha256-7LiwKBsDAIc3zZvKFzgnIjup8lA70g7r7TtBCJ5VgL8=";
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/bt/btcpayserver/deps.json

···
   },
   {
     "pname": "BTCPayServer.Lightning.All",
-    "version": "1.6.10",
-    "hash": "sha256-v2D43E9aEFKN/oMP4W98BST+WBMRDLDBD6AKJZey7PA="
+    "version": "1.6.11",
+    "hash": "sha256-HId8axtrx8i205y1uytHp/04/DyKsXzJwSEMzpr7Mzk="
   },
   {
     "pname": "BTCPayServer.Lightning.Charge",
···
   },
   {
     "pname": "BTCPayServer.Lightning.Phoenixd",
-    "version": "1.5.7",
-    "hash": "sha256-kDl8tDEzrwNwyFRp77NSFw0WkHwudeS5pefJNSvq/IM="
+    "version": "1.5.8",
+    "hash": "sha256-pISNuSZW/B0MZ5VkW8nHAENTOUoFI+YfvrubD/vh74w="
   },
   {
     "pname": "BTCPayServer.NETCore.Plugins",

pkgs/by-name/bt/btcpayserver/package.nix

···
 
 buildDotnetModule rec {
   pname = "btcpayserver";
-  version = "2.1.4";
+  version = "2.1.5";
 
   src = fetchFromGitHub {
     owner = "btcpayserver";
     repo = "btcpayserver";
     tag = "v${version}";
-    hash = "sha256-GY6s/em5jlok1IFe474bD1L34Zlr6gYtG+Wn6eZxMIc=";
+    hash = "sha256-qm/MdgM5sPQu7fI1S8qf/dvkMZbmP4rLA1RdSQHSawE=";
   };
 
   projectFile = "BTCPayServer/BTCPayServer.csproj";

pkgs/by-name/ca/cargo-expand/package.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-expand";
-  version = "1.0.108";
+  version = "1.0.109";
 
   src = fetchFromGitHub {
     owner = "dtolnay";
     repo = "cargo-expand";
     rev = version;
-    hash = "sha256-MJ7v761w8+QePCH5aSi7rTUyMFLwgcmZtHXrfHFRLxU=";
+    hash = "sha256-LMY9kSyFc9B1yxuJ+maE/ETIyaClRLlGlKixnQ7oirw=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-ax16yGwMGHfaXf/feh+1UcgwCEdgINQtz63J1IqH0pc=";
+  cargoHash = "sha256-MK3YODig3KK8qJ3EjLYGE1qR9vukHux9gsEA1C2v8EQ=";
 
   meta = {
     description = "Cargo subcommand to show result of macro expansion";

pkgs/by-name/ch/checkov/package.nix

···
 
 python3.pkgs.buildPythonApplication rec {
   pname = "checkov";
-  version = "3.2.442";
+  version = "3.2.443";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = "checkov";
     tag = version;
-    hash = "sha256-/0Y9zlFS/hBKd9Mxb95u51+/OPjbxgC+OPoP+nIRIl0=";
+    hash = "sha256-qROzLxbeH3DeB5RzUPXJU4zyI4p7j96/vp/+iab2M6A=";
   };
 
   pythonRelaxDeps = [

pkgs/by-name/cl/clickhouse-backup/package.nix

···
 
 buildGoModule rec {
   pname = "clickhouse-backup";
-  version = "2.6.22";
+  version = "2.6.23";
 
   src = fetchFromGitHub {
     owner = "Altinity";
     repo = "clickhouse-backup";
     rev = "v${version}";
-    hash = "sha256-EAaXRFNaK4BzLfvfdVdMiVPdv9giAxbA1UMGqDggjss=";
+    hash = "sha256-r2Oc7WQcWw60g+Pcv4UrSEpxhUET46uNeqF67iK9cvU=";
   };
 
   vendorHash = "sha256-tgDNKujpmDk6wcP9jEwfSbRWzJqiPs7aAWkkaD195Ss=";

pkgs/by-name/cr/crawley/package.nix

···
 
 buildGoModule rec {
   pname = "crawley";
-  version = "1.7.11";
+  version = "1.7.12";
 
   src = fetchFromGitHub {
     owner = "s0rg";
     repo = "crawley";
     rev = "v${version}";
-    hash = "sha256-P+BsfVYqUDZ+wqIwziWLI3V0nUnypenHFfmw6EkPigo=";
+    hash = "sha256-MMjyDWDA4gVbMvqZSpTcM9PZtcmHNm4oglkjvjTKzsw=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
 
-  vendorHash = "sha256-lcCcfn83WGBegQzUKEF8kpu7DdcLyVbS+PGX0mYrr40=";
+  vendorHash = "sha256-JlAk3ctEVOHnwTBLBqIYFENPEDX+t+Je9DykgK8mBrw=";
 
   ldflags = [
     "-w"

pkgs/by-name/cr/credhub-cli/package.nix

···
 
 buildGoModule rec {
   pname = "credhub-cli";
-  version = "2.9.46";
+  version = "2.9.47";
 
   src = fetchFromGitHub {
     owner = "cloudfoundry-incubator";
     repo = "credhub-cli";
     rev = version;
-    sha256 = "sha256-g5Wa+noAcip4My8epfzLZos1wo/J85v5x0G2rwgJLtE=";
+    sha256 = "sha256-3/CYwgdGOFkiGNsWrIGbHGK/iSJxz6KRneTdaJT6i24=";
   };
 
   # these tests require network access that we're not going to give them

pkgs/by-name/cy/cyme/package.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "cyme";
-  version = "2.2.2";
+  version = "2.2.3";
 
   src = fetchFromGitHub {
     owner = "tuna-f1sh";
     repo = "cyme";
     rev = "v${version}";
-    hash = "sha256-oOr7LYQfA/ZtC1Up4/dAHFdtWAM+8J+OPiHIOtVLQxY=";
+    hash = "sha256-Zbb9CEsDtig9Nc6FUFZSdsfU7l6XHQvQK8asZ7O/Weo=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-PaX2Eod/5eCZFzMzkLovhE/TpQqNyhqCHaF1LiRxndg=";
+  cargoHash = "sha256-HdlhsOctPxOanbPAIJnlUoY4QeIluVsJlPglFXHBpFY=";
 
   nativeBuildInputs =
     [

pkgs/by-name/de/delsum/package.nix

···
+{
+  fetchFromGitHub,
+  gf2x,
+  lib,
+  rustPlatform,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "delsum";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "8051Enthusiast";
+    repo = "delsum";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-trCH2LIC3hjm3MMEoVGO2AY33eYTfn4N2mm2rOfUwt4=";
+  };
+
+  cargoHash = "sha256-Flz7h2/i4WIGr8CgVjpbCGHUkkGKSiHw5wlOIo7uuXo=";
+
+  buildInputs = [
+    gf2x
+  ];
+
+  meta = {
+    homepage = "https://github.com/8051Enthusiast/delsum";
+    description = "Reverse engineer's checksum toolbox";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ timschumi ];
+    mainProgram = "delsum";
+  };
+})

pkgs/by-name/do/docker-language-server/package.nix

···
 
 buildGoModule rec {
   pname = "docker-language-server";
-  version = "0.10.2";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "docker";
     repo = "docker-language-server";
     tag = "v${version}";
-    hash = "sha256-IFHwlunenIeTJUMIgMSi/xFbIMjrC3sABxow5Toxi50=";
+    hash = "sha256-cMHWdSMPo38Nuvx/K187PJ4tp6F1Fqs73+sIOrAk8Jo=";
   };
 
   vendorHash = "sha256-yb/GdwgEwv6ybb1CkBivCC6WKc/DX9FXxz+7WLr3scw=";

pkgs/by-name/fa/fastp/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "fastp";
-  version = "0.26.0";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "OpenGene";
     repo = "fastp";
     rev = "v${version}";
-    sha256 = "sha256-DrvY2FqTlQU3mJkBp/gM+GHlBlumfYRZItpphaF1xfs=";
+    sha256 = "sha256-oUThNtxM5zQgC4k3igrzYbFsza8d6E0U/o7w0FC8J3o=";
   };
 
   buildInputs = [

pkgs/by-name/fe/fedimint/package.nix

···
   pkg-config,
   protobuf,
   rustPlatform,
+  version ? "0.7.1",
+  hash ? "sha256-7meBYUN7sG1OAtMEm6I66+ptf4EfsbA+dm5/4P3IRV4=",
+  cargoHash ? "sha256-4cFuasH2hvrnzTBTFifHEMtXZKsBv7OVpuwPlV19GGw=",
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "fedimint";
-  version = "0.5.1";
+  inherit version;
 
   src = fetchFromGitHub {
     owner = "fedimint";
     repo = "fedimint";
     rev = "v${version}";
-    hash = "sha256-dhZYOfXepOnt1lQEgrM/y++5V58weiiTMAyMKl2t37Q=";
+    inherit hash;
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-WElH4AdLlF/BuxRrURUv6xNGUVBZ6hhSFg1p+T3jG54=";
+  inherit cargoHash;
 
   nativeBuildInputs = [
     protobuf
···
     mkdir -p $fedimint/bin $fedimintCli/bin $gateway/bin $gatewayCli/bin $devimint/bin
 
     # delete fuzzing targets and other binaries no one cares about
-    binsToKeep=(fedimint-cli fedimint-dbtool recoverytool fedimintd gatewayd gateway-cli gateway-cln-extension devimint)
+    binsToKeep=(fedimint-cli fedimint-dbtool recoverytool fedimintd gatewayd gateway-cli devimint)
     keepPattern=$(printf "|%s" "''${binsToKeep[@]}")
     keepPattern=''${keepPattern:1}
     find "$out/bin" -maxdepth 1 -type f | grep -Ev "(''${keepPattern})" | xargs rm -f
···
     cp -a $releaseDir/gateway-cli $gatewayCli/bin/
 
     cp -a $releaseDir/gatewayd $gateway/bin/
-    cp -a $releaseDir/gateway-cln-extension $gateway/bin/
 
     cp -a $releaseDir/devimint $devimint/bin/
   '';

pkgs/by-name/gi/github-backup/package.nix

···
 
 python3Packages.buildPythonApplication rec {
   pname = "github-backup";
-  version = "0.50.1";
+  version = "0.50.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "josegonzalez";
     repo = "python-github-backup";
     tag = version;
-    hash = "sha256-9fPZ+QWHkIQVEgPKCZMJZk4p5nkXan61Ym+tbF0ZOMM=";
+    hash = "sha256-MUPQa1L3HmAMn1pZSzQk8VKpcz2nDGuWZB8pVi7CyYs=";
   };
 
   build-system = with python3Packages; [

pkgs/by-name/go/gomi/package.nix

···
 
 buildGoModule rec {
   pname = "gomi";
-  version = "1.6.0";
+  version = "1.6.1";
 
   src = fetchFromGitHub {
     owner = "b4b4r07";
     repo = "gomi";
     tag = "v${version}";
-    hash = "sha256-0C+us4GO8Jd51ATaaf0aRU3NnhmDvu0I3qDDXBoaiXU=";
+    hash = "sha256-Sxf/x29uADkdILrWwdKZhTc1Y7zCJbpMNK6vV/SGF1Q=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
···
     '';
   };
 
-  vendorHash = "sha256-8aw81DKBmgNsQzgtHCsUkok5e5+LeAC8BUijwKVT/0s=";
+  vendorHash = "sha256-Lt2SA3IHD8wDxv5bScU37hqStnfxVYQQZS6ajr7PhJM=";
 
   subPackages = [ "." ];
 
   # Add version information fetched from the repository to ldflags.
-  # https://github.com/babarot/gomi/blob/v1.6.0/.goreleaser.yaml#L20-L22
+  # https://github.com/babarot/gomi/blob/v1.6.1/.goreleaser.yaml#L20-L22
   ldflags = [
     "-X main.version=v${version}"
   ];

pkgs/by-name/gt/gtklock-powerbar-module/package.nix

···
   pkg-config,
   gtk3,
   gtklock,
+  systemd,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
···
   ];
 
   buildInputs = [ gtk3 ];
+
+  postPatch =
+    let
+      systemctl = lib.getExe' systemd "systemctl";
+    in
+    ''
+      substituteInPlace source.c \
+        --replace-fail '"systemctl reboot"' '"${systemctl} reboot"' \
+        --replace-fail '"systemctl -i poweroff"' '"${systemctl} -i poweroff"' \
+        --replace-fail '"systemctl suspend"' '"${systemctl} suspend"'
+    '';
 
   passthru.tests.testModule = gtklock.testModule finalAttrs.finalPackage;
 

pkgs/by-name/hu/hut/package.nix

···
 
 buildGoModule rec {
   pname = "hut";
-  version = "0.6.0";
+  version = "0.7.0";
 
   src = fetchFromSourcehut {
     owner = "~xenrox";
     repo = "hut";
     rev = "v${version}";
-    sha256 = "sha256-wfnuGnO1aiK0D8P5nMCqD38DJ3RpcsK//02KaE5SkZE=";
+    sha256 = "sha256-pc6E3ORDmaMhoNe8GQeYZrxhe5ySQqsMPe/iUbclnGk=";
   };
 
-  vendorHash = "sha256-6dIqcjtacxlmadnPzRlOJYoyOaO4zdjzrjO64KS2Bq0=";
+  vendorHash = "sha256-/51cv/EvcBCyCOf91vJ5M75p0bkAQqVoRUp+C+i70Os=";
 
   nativeBuildInputs = [
     scdoc

pkgs/by-name/hy/hydra/package.nix

···
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "hydra";
-  version = "0-unstable-2025-05-27";
+  version = "0-unstable-2025-06-15";
 
   src = fetchFromGitHub {
     owner = "NixOS";
     repo = "hydra";
-    rev = "2e3c168ec49fb78554247bf1aa7d11fbf716e107";
-    hash = "sha256-S3gG8xXItXdefeSIaR4tTzjHv+pceu/i5s+wGQNHAWQ=";
+    rev = "ed500ca4345f7edaa6c3d84027a7599d38b15a29";
+    hash = "sha256-Mxz4n40VKxA2ILtIHX6fObgcy2WlgsM+ERfpjuVJ0BU=";
   };
 
   outputs = [

pkgs/by-name/li/lifeograph/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lifeograph";
-  version = "3.0.2";
+  version = "3.0.3";
 
   src = fetchgit {
     url = "https://git.launchpad.net/lifeograph";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-eb31/ncGH5+Wz1vPCHeEFP1AiKe29rAOg5SL2cjabCc=";
+    hash = "sha256-VaDxmbTVx6wiFMDRYuBM5Y4oPODWPTm8QP6zpT+yBOY=";
   };
 
   nativeBuildInputs = [
···
     libchamplain
     libshumate
   ];
-
-  postInstall = ''
-    substituteInPlace $out/share/applications/net.sourceforge.Lifeograph.desktop \
-      --replace-fail "Exec=" "Exec=$out/bin/"
-  '';
 
   meta = {
     homepage = "https://lifeograph.sourceforge.net/doku.php?id=start";

pkgs/by-name/lu/lutgen/package.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "lutgen";
-  version = "0.12.0";
+  version = "0.12.1";
 
   src = fetchFromGitHub {
     owner = "ozwaldorf";
     repo = "lutgen-rs";
     rev = "v${version}";
-    hash = "sha256-VE4R0rdQbZ7cyCPRtWWARUAnlR/KWGFUoJSJ4lySwzY=";
+    hash = "sha256-JFVDiq53AZhiTqEXplCuKoATxeHp/HDJ8p0a6WzVq6I=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-H913/EjCh14AcCIj/Em6neP5F6i88rSVbPMmnS3po/I=";
+  cargoHash = "sha256-tOFO2eRWd03zzGX3Ia1IBQ27kmSMX7JgbXmaejRTfp4=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/ma/mark/package.nix

···
 # https://github.com/kovetskiy/mark/pull/581#issuecomment-2797872996
 buildGoModule rec {
   pname = "mark";
-  version = "14.0.4";
+  version = "14.1.0";
 
   src = fetchFromGitHub {
     owner = "kovetskiy";
     repo = "mark";
     rev = "${version}";
-    sha256 = "sha256-o5y1rybj32IrlSPMIw1Jv+Os/fdrQSjeUgvGvFvYS3A=";
+    sha256 = "sha256-TQU49rPpHCDQEOIfC3R89kdtVMVJrisOXF5DhbRgJQ0=";
   };
 
-  vendorHash = "sha256-ClSFazL9+prDgqHGK5ihSIqCWp8IDtyQ5dpKECfUp6A=";
+  vendorHash = "sha256-y5WCpL0bJE48iVUO2hPy7AvAx9KEVQJUK6vVwFfob/M=";
 
   ldflags = [
     "-s"

pkgs/by-name/me/melonDS/package.nix

···
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "melonDS";
-  version = "1.0rc-unstable-2025-05-27";
+  version = "1.0rc-unstable-2025-06-18";
 
   src = fetchFromGitHub {
     owner = "melonDS-emu";
     repo = "melonDS";
-    rev = "7117178c2dd56df32b6534ba6a54ad1f8547e693";
-    hash = "sha256-6bwagPFIv87WtmQ3cl8cDZ/1A8Ab6itLHAr33CJy/Eo=";
+    rev = "71edf793fcd2726c4212f7915194c60107dc2809";
+    hash = "sha256-B/qWdt+fWSov54zA+7S25bEVxqQuspo5oT3MyMk4Ato=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/mo/moon/package.nix

···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "moon";
-  version = "1.37.1";
+  version = "1.37.3";
 
   src = fetchFromGitHub {
     owner = "moonrepo";
     repo = "moon";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qPrrVk+rVEtLPJxhvgYCQ2CczwfGp/Pv1Ck+/FlimwI=";
+    hash = "sha256-XBuB26ghUUXkQrUDZCt7L4c8aW5odI7BqDdM6Si8Nck=";
   };
 
-  cargoHash = "sha256-PEmCrE7GcH09buX5p+UoDgqdBCoY5mqmLxm+hNaz3Yo=";
+  cargoHash = "sha256-7XcpJngFzWvVdmYWLf3jYLVG/rgXaetP1w4vAt6INDQ=";
 
   env = {
     RUSTFLAGS = "-C strip=symbols";

pkgs/by-name/mo/moonraker/package.nix

···
 in
 stdenvNoCC.mkDerivation rec {
   pname = "moonraker";
-  version = "0.9.3-unstable-2025-05-22";
+  version = "0.9.3-unstable-2025-06-12";
 
   src = fetchFromGitHub {
     owner = "Arksine";
     repo = "moonraker";
-    rev = "0310d0be9fd207c510554ff64ca418cf4bcdaf9f";
-    sha256 = "sha256-tTCMNn1UmEeeBEGm8Sw0TrlNcVYHLjw57HH0LIA2y8k=";
+    rev = "ccbfd6498941cb4d8b49d192c8dd34feacfbe84a";
+    sha256 = "sha256-SCexS9dRbdwNSy5bTrGaEfP9EmkO3c/IL2+OIG7/K24=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/by-name/ni/niri/package.nix

···
         "-Wl,--pop-state"
       ]
     );
+
+    # Upstream recommends setting the commit hash manually when in a
+    # build environment where the Git repository is unavailable.
+    # See https://github.com/YaLTeR/niri/wiki/Packaging-niri#version-string
+    NIRI_BUILD_COMMIT = "Nixpkgs";
   };
 
   nativeInstallCheckInputs = [ versionCheckHook ];

pkgs/by-name/no/nomad-driver-podman/package.nix

···
 
 buildGoModule rec {
   pname = "nomad-driver-podman";
-  version = "0.6.2";
+  version = "0.6.3";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = "nomad-driver-podman";
     rev = "v${version}";
-    sha256 = "sha256-QvIc0RNQX9do6pTyGbJTTR7jANp50DVlHsl/8teiCnY=";
+    sha256 = "sha256-foGbOIR1pdimMKVVrnvffNfqcWDwomenxtE696I1KwE=";
   };
 
-  vendorHash = "sha256-9uXpcF/b2iR3xwVQ6XwJ9USuVqzYND4nuGMjMmEIbVs=";
+  vendorHash = "sha256-nQTxadv2EBf4U0dXQXXAetqk9SzB8s+WyU9nRD+I438=";
 
   subPackages = [ "." ];
 

pkgs/by-name/no/nova/package.nix

···
 
 buildGoModule rec {
   pname = "nova";
-  version = "3.11.2";
+  version = "3.11.4";
 
   src = fetchFromGitHub {
     owner = "FairwindsOps";
     repo = "nova";
     rev = "v${version}";
-    hash = "sha256-7GAA5Kc5ximdf71Bd8Q5o2pXixLOobXykKxfI31j/4A=";
+    hash = "sha256-0jDmuZqq3NNTekmu6saUjCuc0G0tj10hV0tRjwkYQg4=";
   };
 
-  vendorHash = "sha256-tWUE3OUpacxRpShbJQtFbHhjEDt4ULL1wc4vfX4DJ2c=";
+  vendorHash = "sha256-qXYhj3vVS6MoU4JPEDIxDZNDM2j/4Nxp6ZSlqUYVjMA=";
 
   ldflags = [
     "-X main.version=${version}"

pkgs/by-name/nu/nufmt/package.nix

···
 {
   lib,
   fetchFromGitHub,
+  nix-update-script,
   rustPlatform,
-  nix-update-script,
+  stdenv,
 }:
-
 rustPlatform.buildRustPackage {
   pname = "nufmt";
-  version = "0-unstable-2025-04-28";
+  version = "0-unstable-2025-05-23";
 
   src = fetchFromGitHub {
     owner = "nushell";
     repo = "nufmt";
-    rev = "feafe695659c4d5153018a78fad949d088d8a480";
-    hash = "sha256-4FnZIlZWuvSAXMQbdyONNrgIuMxH5Vq3MFbb8J2CnHM=";
+    rev = "62fd38af2f6536bb19ecc78a4dd0f0e1245c0939";
+    hash = "sha256-JG8XCXEdjVERQ9f6ZsYCLXVGN85qPWCQhS2svJYW390=";
   };
 
   nativeBuildInputs = [
···
   ];
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-zS4g/uMh1eOoPo/RZfanL6afCEU5cnyzHrIqkvuQVrg=";
+  cargoHash = "sha256-KDXC2/1GcJL6qH+L/FzzQCA7kJigtKOfxVDLv5qXYao=";
+
+  # NOTE: Patch follows similar intention upstream https://github.com/nushell/nufmt/commit/62fd38af2f6536bb19ecc78a4dd0f0e1245c0939
+  postPatch = ''
+    substituteInPlace tests/main.rs --replace-fail \
+      'const TEST_BINARY: &str = "target/debug/nufmt";' \
+      'const TEST_BINARY: &str = "target/${stdenv.hostPlatform.rust.rustcTarget}/release/nufmt";'
+  '';
 
   passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
 

pkgs/by-name/nv/nvidia-modprobe/package.nix

···
 }:
 stdenv.mkDerivation rec {
   pname = "nvidia-modprobe";
-  version = "575.57.08";
+  version = "575.64";
 
   src = fetchFromGitHub {
     owner = "NVIDIA";
     repo = "nvidia-modprobe";
     rev = version;
-    hash = "sha256-KpHhPFl+cNTQpld9LtI9yLidN9gj1zNz+jKfzF+n+sI=";
+    hash = "sha256-V0kD0Kk9PaIzQ9tGd9Tb16wwcvyCg4+1Sm+PwCC98Zs=";
   };
 
   nativeBuildInputs = [ gnum4 ];

pkgs/by-name/or/orbiton/package.nix

···
 
 buildGoModule rec {
   pname = "orbiton";
-  version = "2.69.0";
+  version = "2.70.0";
 
   src = fetchFromGitHub {
     owner = "xyproto";
     repo = "orbiton";
     tag = "v${version}";
-    hash = "sha256-0ba+IkiBQUsesq54S4Ngd9vTO5E7kqOQS61HidxE0jM=";
+    hash = "sha256-3EAYPCNVQiED8qHyLbwyYU7gXJn2TFgiJ2/JyxyD7+M=";
   };
 
   vendorHash = null;

pkgs/by-name/py/pyenv/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "pyenv";
-  version = "2.6.1";
+  version = "2.6.3";
 
   src = fetchFromGitHub {
     owner = "pyenv";
     repo = "pyenv";
     tag = "v${version}";
-    hash = "sha256-Lv8bMFCj+aS3u/1el97O2Z8NnnSjrk1wpguEJIW2oDk=";
+    hash = "sha256-X4Gwjbgl7y/p/CEz1Z2wydP7ZBHD1i8lzmuYISVL/bo=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ri/rio/package.nix

···
 in
 rustPlatform.buildRustPackage rec {
   pname = "rio";
-  version = "0.2.18";
+  version = "0.2.19";
 
   src = fetchFromGitHub {
     owner = "raphamorim";
     repo = "rio";
     rev = "v${version}";
-    hash = "sha256-VEiurf5y3BAQ2UCl0AKBL4fz36F8RH+GOpJwCZxSnMg=";
+    hash = "sha256-qEJrsA6MmLs26cnLo83QkKMUm6XMDk/h0UirUZ3/xGg=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-d7t6XbJs5D8QXyDfXfOqeP6ZhYobcyRADD2SAZX+YQA=";
+  cargoHash = "sha256-+bGP8JDzOtpqggg3kvtPZuT0KFG2VdB15+bRsahQ6SA=";
 
   nativeBuildInputs =
     [

pkgs/by-name/ro/roxterm/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "roxterm";
-  version = "3.16.3";
+  version = "3.16.6";
 
   src = fetchFromGitHub {
     owner = "realh";
     repo = "roxterm";
     rev = finalAttrs.version;
-    hash = "sha256-aS15oFLJVsUDzBtisnHS9S92cZs4w8mqhwrpJJm+6lQ=";
+    hash = "sha256-T6xFExsgYGUVLgDS7sx5juoraMjzIYyfsXHvQUAm1fc=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/si/signal-desktop/package.nix

···
     '';
   });
 
-  version = "7.56.1";
+  version = "7.58.0";
 
   src = fetchFromGitHub {
     owner = "signalapp";
     repo = "Signal-Desktop";
     tag = "v${version}";
-    hash = "sha256-zPoZ76ujS8H4ls7RW4bojRIKOrPRJPjdHJVAl1cH9vY=";
+    hash = "sha256-0WO4cjbZLVaf/ju7PdfZJKOa7qGXsjWZHGY8lxOvr3w=";
   };
 
   sticker-creator = stdenv.mkDerivation (finalAttrs: {
···
       ;
     hash =
       if withAppleEmojis then
-        "sha256-RP3d1t4bbvehdCDSL3bHrlJEnn65TDViI5jVjSiuJw8="
+        "sha256-h2yaGRqAtVh/8Jv+YZAcXw3/b8+fi+cKFSqcRhMH2sM="
       else
-        "sha256-KJvc+kVcwRKsUVW3lK7fPXUSqDQlJFPbYAzQjhFtfoU=";
+        "sha256-1dkJBIQVJxpsd8IQIlRncDYHp+2j0fowlbEEWpQSPtI=";
   };
 
   env = {
     ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
     SIGNAL_ENV = "production";
-    SOURCE_DATE_EPOCH = 1749072888;
+    SOURCE_DATE_EPOCH = 1750276003;
   };
 
   preBuild = ''

pkgs/by-name/si/signal-desktop/ringrtc.nix

···
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ringrtc";
-  version = "2.52.0";
+  version = "2.53.0";
 
   src = fetchFromGitHub {
     owner = "signalapp";
     repo = "ringrtc";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Ao1mFJYPnV3lfg4SERwq4dGnBhOVI9pwsqPAsUtV/iY=";
+    hash = "sha256-JxEeE5r/qQGfTBP0szpChRdPuUl4PMK1km84N/8Dozg=";
   };
   useFetchCargoVendor = true;
-  cargoHash = "sha256-mO9t4ZDDM5Y9cMkmdrYrdGYukN1xfGogPSNq+S1t4Us=";
+  cargoHash = "sha256-qOBjSj1MErB0SajScicVPEn2pqAY+kWq7TS4Wiu4oxI=";
 
   cargoBuildFlags = [
     "-p"

pkgs/by-name/si/signal-desktop/webrtc-sources.json

···
 {
     "src": {
         "args": {
-            "hash": "sha256-AFMJmIo7O4fYrVWABciQphTxHQSj4CdfhluIIPpPWAw=",
+            "hash": "sha256-laPkmf87ujO0dmQ6LqGSnvajeE2D0i5hL95RxN+SdNA=",
             "owner": "signalapp",
             "repo": "webrtc",
-            "tag": "6998c"
+            "tag": "7103d"
         },
         "fetcher": "fetchFromGitHub"
     },
     "src/base": {
         "args": {
-            "hash": "sha256-hglQbmk4pfkzhHPXPGPrjN60VfpEbCn3mbOkM1kcjhE=",
-            "rev": "e0914b7606a151a3a12e994c400519f2e291c53f",
+            "hash": "sha256-Jm+OJlnJJUrTtsAMWEB+DM7eLZyIMJa5jQysVsyHwfk=",
+            "rev": "1d80e43078965dbe6ded5521fbffb128f59124a6",
             "url": "https://chromium.googlesource.com/chromium/src/base"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/build": {
         "args": {
-            "hash": "sha256-f7sLdyVzuWsVMsH21tLBDPadEJPyzSWhk8f97P7Meko=",
-            "rev": "64e296c42a93fbd27acc9a94713e4289273409b2",
+            "hash": "sha256-4iM0mh+1AL1maBjle+GOmfr4AMadQpcNDQg0X5tVD5U=",
+            "rev": "52d62707eaec02b88722a99e335315d166ceda77",
             "url": "https://chromium.googlesource.com/chromium/src/build"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/buildtools": {
         "args": {
-            "hash": "sha256-w6CVjFp5hkRHscXF7qUJ/Ei9Nl7lqBcGnwHXmjrehHw=",
-            "rev": "a660247d3c14a172b74b8e832ba1066b30183c97",
+            "hash": "sha256-Nbaoin+aMtJJaC4mDTYFB7q3RbmzSuEUDDZN3tAXoSI=",
+            "rev": "6f359296daa889aa726f3d05046b9f37be241169",
             "url": "https://chromium.googlesource.com/chromium/src/buildtools"
         },
         "fetcher": "fetchFromGitiles"
···
     },
     "src/testing": {
         "args": {
-            "hash": "sha256-VQJ0hqEI2QIFPKZwLCAtUtKuPkJndvndtK4lGRiX20M=",
-            "rev": "63412fdcdfe281e6b9531a5e1086a59c0b9e6909",
+            "hash": "sha256-CZOMatu2JSB3fztVz8DvW87KtglBqq0hUYm3IM3pZwY=",
+            "rev": "f46b86c7f1fc7a7f52e61c11dbd0573a48cf7a6a",
             "url": "https://chromium.googlesource.com/chromium/src/testing"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party": {
         "args": {
-            "hash": "sha256-88mIRDQvFeCcwiLPt4cyFE/xfmEJ95xB93uUcRPe670=",
-            "rev": "d212a71416ad7c6ceca04d6d27dfdd84fd00c04c",
+            "hash": "sha256-BbFD3QSoHMHsy4d+Quz01Nta7nArhe8or9zsARmlc/U=",
+            "rev": "10064104c1f11074312018c3a9c4b66f25584bdd",
             "url": "https://chromium.googlesource.com/chromium/src/third_party"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/boringssl/src": {
         "args": {
-            "hash": "sha256-Mrv/aV7RjDLPVi0QN7p1qJ3M8zHWogcq+u2F+S1LoNE=",
-            "rev": "d4b6eb542d4fd109baacd550935efd00c521e674",
+            "hash": "sha256-fUPl9E2b7RfanH0pZNArIkJ4lnnmCtyk7sCaTArCB70=",
+            "rev": "a9993612faac4866bc33ca8ff37bfd0659af1c48",
             "url": "https://boringssl.googlesource.com/boringssl.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/breakpad/breakpad": {
         "args": {
-            "hash": "sha256-jOTRgF2WxsX5P0LgUI9zdCc0+NcqSnO310aq15msThY=",
-            "rev": "0dfd77492fdb0dcd06027c5842095e2e908adc90",
+            "hash": "sha256-9MePkv10fwyJ0VDWRtvRcbLMAcJzZlziGTPzXJYjVJE=",
+            "rev": "657a441e5c1a818d4c10b7bafd431454e6614901",
             "url": "https://chromium.googlesource.com/breakpad/breakpad.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/catapult": {
         "args": {
-            "hash": "sha256-XtQclu96NHJxt8kJCyp8iaJUkTI2bS+q6NRwvIgmhX8=",
-            "rev": "b15611f18b506cf9dbc03e9bf87dbc8df549ccce",
+            "hash": "sha256-xwR9gGE8uU8qFr7GgS3/1JiuTmj1tvcM5CoCfPMdW2M=",
+            "rev": "5bda0fdab9d93ec9963e2cd858c7b49ad7fec7d4",
             "url": "https://chromium.googlesource.com/catapult.git"
         },
         "fetcher": "fetchFromGitiles"
···
     },
     "src/third_party/dav1d/libdav1d": {
         "args": {
-            "hash": "sha256-Ft71Ubirlpi7IJcNDFIfyZqmR2Xxv68PiEOfg7JhLuU=",
-            "rev": "edb16889d16f5e13161b6e8f7a839cd82d7d655d",
+            "hash": "sha256-+DY4p41VuAlx7NvOfXjWzgEhvtpebjkjbFwSYOzSjv4=",
+            "rev": "8d956180934f16244bdb58b39175824775125e55",
             "url": "https://chromium.googlesource.com/external/github.com/videolan/dav1d.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/depot_tools": {
         "args": {
-            "hash": "sha256-Qea35ZMbVtvdFPmge0ShrEW0p17Z1UJUGdBTaxaZ5gQ=",
-            "rev": "80d1969422e75e8e9eecafa46074074b289e2568",
+            "hash": "sha256-O9vVbrCqHD4w39Q8ZAxl1RwzJxbH/thjqacMtCnOPdg=",
+            "rev": "f40ddcd8d51626fb7be3ab3c418b3f3be801623f",
             "url": "https://chromium.googlesource.com/chromium/tools/depot_tools.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/ffmpeg": {
         "args": {
-            "hash": "sha256-OXumpRb9XB38dOCJmL3jDcabiJ08wAvydVlJwMgpCoQ=",
-            "rev": "d10a0f8bf5ddcce572df95105152bc74041cae0c",
+            "hash": "sha256-bGa0BCvzNxEKu9VZEwJ1NLt+b2KKWUxshpKSN2FHNEM=",
+            "rev": "fbce2a76c00cd2e5aeffe3c2e71d44c284ec52d6",
             "url": "https://chromium.googlesource.com/chromium/third_party/ffmpeg.git"
         },
         "fetcher": "fetchFromGitiles"
···
     },
     "src/third_party/freetype/src": {
         "args": {
-            "hash": "sha256-wKzsJ5SXicsLXs0M2+usPz72gy8IsmQGTD3RGKYnhgo=",
-            "rev": "a059b237bb01eb3e4f9f8b1618dda8c117498bab",
+            "hash": "sha256-LhSIX7X0+dmLADYGNclg73kIrXmjTMM++tJ92MKzanA=",
+            "rev": "82090e67c24259c343c83fd9cefe6ff0be7a7eca",
             "url": "https://chromium.googlesource.com/chromium/src/third_party/freetype2.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/fuzztest/src": {
         "args": {
-            "hash": "sha256-KjO8h5KS7/3vP8zRY2I09nIA/eJHKnmBuY8i8KU81KQ=",
-            "rev": "00edfa0dd94d7e00a89684e950015c30d3b7ae07",
+            "hash": "sha256-1pzRK+iorGhnLWWpuWdRjBCh0whKoDgEUhTTs2NlPZU=",
+            "rev": "3c7bc855a4938c5d0d1d07303aa0697c88d33e6c",
             "url": "https://chromium.googlesource.com/external/github.com/google/fuzztest.git"
         },
         "fetcher": "fetchFromGitiles"
···
     },
     "src/third_party/googletest/src": {
         "args": {
-            "hash": "sha256-9hPtc5kLEaetJXqtcneXFOcC2z5AdkvWGYgKMSB+vbs=",
-            "rev": "2b6b042a77446ff322cd7522ca068d9f2a21c1d1",
+            "hash": "sha256-8keF4E6ag/rikv5ROaWUB7oganjViupEAdxW1NJVgmE=",
+            "rev": "52204f78f94d7512df1f0f3bea1d47437a2c3a58",
             "url": "https://chromium.googlesource.com/external/github.com/google/googletest.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/grpc/src": {
         "args": {
-            "hash": "sha256-RKGZWtH2JmP2mXN+4ln/nCJvOyzynrYcfrxSY8k1vVg=",
-            "rev": "a363b6c001139b9c8ffb7cd63f60a72f15349c3b",
+            "hash": "sha256-0ljptpIh4wirWZ+utJyiy4g4dhPRB8pIvjcvoqeycu0=",
+            "rev": "d8ce421830bd993885038934abdc74e1e56e3213",
             "url": "https://chromium.googlesource.com/external/github.com/grpc/grpc.git"
         },
         "fetcher": "fetchFromGitiles"
···
     },
     "src/third_party/harfbuzz-ng/src": {
         "args": {
-            "hash": "sha256-TStJvz3Txn4cvU1tCPPZn6RLslvM+VNUqt8l8g67JN4=",
-            "rev": "1c249be96e27eafd15eb86d832b67fbc3751634b",
+            "hash": "sha256-/WNGrvyvJ+FGqoIoHapaux1iu63zjID0yR30HYPpxaw=",
+            "rev": "8efd2d85c78fbba6ca09a3e454f77525f3b296ce",
             "url": "https://chromium.googlesource.com/external/github.com/harfbuzz/harfbuzz.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/icu": {
         "args": {
-            "hash": "sha256-O9qrAt8lwNBg5LCVz+SfTe48uJx8onVYwn0LRXIhUvY=",
-            "rev": "bbccc2f6efc1b825de5f2c903c48be685cd0cf22",
+            "hash": "sha256-Omv4sp9z44eINXtaE0+1TzIU1q2hWviANA79fmkF78U=",
+            "rev": "c9fb4b3a6fb54aa8c20a03bbcaa0a4a985ffd34b",
             "url": "https://chromium.googlesource.com/chromium/deps/icu.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/instrumented_libs": {
         "args": {
-            "hash": "sha256-7w5wMcmPcKLS91buxyRdcgaQjbKGFdmrKClvYVO3iko=",
-            "rev": "3cc43119a29158bcde39d288a8def4b8ec49baf8",
+            "hash": "sha256-8kokdsnn5jD9KgM/6g0NuITBbKkGXWEM4BMr1nCrfdU=",
+            "rev": "69015643b3f68dbd438c010439c59adc52cac808",
             "url": "https://chromium.googlesource.com/chromium/third_party/instrumented_libraries.git"
         },
         "fetcher": "fetchFromGitiles"
···
     },
     "src/third_party/libaom/source/libaom": {
         "args": {
-            "hash": "sha256-oceORERaQDEQkssZwiWGOtAsbuI0YeOciwb9FgtFuHw=",
-            "rev": "d737ca3ebe92feec465876a8fc98950cecd08fd8",
+            "hash": "sha256-nfnt5JXyKR9JR3BflpGEkwzDo0lYa/oeCDm2bKH/j1g=",
+            "rev": "9680f2b1781fb33b9eeb52409b75c679c8a954be",
             "url": "https://aomedia.googlesource.com/aom.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/libc++/src": {
         "args": {
-            "hash": "sha256-QxEbtsEKCs2Xgulq7nVWtAeOGkIYFOy/L1ROfXa5u8U=",
-            "rev": "2e25154d49c29fa9aa42c30ad4a027bd30123434",
+            "hash": "sha256-Ypi5fmWdoNA1IZDoKITlkNRITmho8HzVlgjlmtx0Y84=",
+            "rev": "449310fe2e37834a7e62972d2a690cade2ef596b",
             "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/libc++abi/src": {
         "args": {
-            "hash": "sha256-RIPejJnlQE5S8ss3WijR4uLVC+yRL9Ba0vslQeJFNiE=",
-            "rev": "8205ccf0f23545ebcd8846363ea1d29e77917a22",
+            "hash": "sha256-wMMfj3E2AQJxovoSEIuT2uTyrcGBurS1HrHZOmP36+g=",
+            "rev": "94c5d7a8edc09f0680aee57548c0b5d400c2840d",
             "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/libjpeg_turbo": {
         "args": {
-            "hash": "sha256-qgHXAjCDFxQ+QqJ8pSmI1NUvHvKKTi4MkIe1I/+hUAI=",
-            "rev": "927aabfcd26897abb9776ecf2a6c38ea5bb52ab6",
+            "hash": "sha256-Ig+tmprZDvlf/M72/DTar2pbxat9ZElgSqdXdoM0lPs=",
+            "rev": "e14cbfaa85529d47f9f55b0f104a579c1061f9ad",
             "url": "https://chromium.googlesource.com/chromium/deps/libjpeg_turbo.git"
         },
         "fetcher": "fetchFromGitiles"
···
     },
     "src/third_party/libunwind/src": {
         "args": {
-            "hash": "sha256-JazjgI+ch9RgnsDgu6p4cT4UmCBor4x4sRi1ClLISAY=",
-            "rev": "e55d8cf51c6db1fdd4bb56c158945ec59772c8ee",
+            "hash": "sha256-LdRaxPo2i7uMeFxpR7R4o3V+1ycBcygT/D+gklsD0tA=",
+            "rev": "e2e6f2a67e9420e770b014ce9bba476fa2ab9874",
             "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/libvpx/source/libvpx": {
         "args": {
-            "hash": "sha256-8/Ttkc1ZLQ9WvQf+0/BW9zlmWvlyGDujELyLDqNmQxI=",
-            "rev": "7a65480684b1b28bb9defae164bf0dc78b32653e",
+            "hash": "sha256-+4I6B1aTa+txhey6LMeflU0pe39V6TJ+lNIJPh6yFGM=",
+            "rev": "027bbee30a0103b99d86327b48d29567fed11688",
             "url": "https://chromium.googlesource.com/webm/libvpx.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/libyuv": {
         "args": {
-            "hash": "sha256-hHwJLMI/leUm8RjkBsSQn/GaNU8Aan1yllGnXvdfG78=",
-            "rev": "10592b60c0b2c33210b7752454253dc2625b4305",
+            "hash": "sha256-8sH11psWPXLMy3Q0tAizCZ/woUWvTCCUf44jcr2C4Xs=",
+            "rev": "ccdf870348764e4b77fa3b56accb2a896a901bad",
             "url": "https://chromium.googlesource.com/libyuv/libyuv.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/llvm-libc/src": {
         "args": {
-            "hash": "sha256-OtNt+IRn2AFRTKvrA+c9AD+mbfBD37K2S9PXk3UI99A=",
-            "rev": "12809bfa855813dcef51871e2ee3155e53ed35ea",
+            "hash": "sha256-sV1wqk8BC7cl7HPgAd+kmxOWpBuWT6kTX91IXIoSYts=",
+            "rev": "188329a7f2118a957efbb3e6219c255e7dba997c",
             "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libc.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/lss": {
         "args": {
-            "hash": "sha256-hE8uZf9Fst66qJkoVYChiB8G41ie+k9M4X0W+5JUSdw=",
-            "rev": "ce877209e11aa69dcfffbd53ef90ea1d07136521",
+            "hash": "sha256-rhp4EcZYdgSfu9cqn+zxxGx6v2IW8uX8V+iA0UfZhFY=",
+            "rev": "ed31caa60f20a4f6569883b2d752ef7522de51e0",
             "url": "https://chromium.googlesource.com/linux-syscall-support.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/nasm": {
         "args": {
-            "hash": "sha256-SiRXHsUlWXtH6dbDjDjqNAm105ibEB3jOfNtQAM4CaY=",
-            "rev": "f477acb1049f5e043904b87b825c5915084a9a29",
+            "hash": "sha256-yg4qwhS68B/sWfcJeXUqPC69ppE8FaIyRc+IkUQXSnU=",
+            "rev": "767a169c8811b090df222a458b25dfa137fc637e",
             "url": "https://chromium.googlesource.com/chromium/deps/nasm.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/openh264/src": {
         "args": {
-            "hash": "sha256-S7dS2IZwt4p4ZrF6K7E5HnwKuI3owU2I7vwtu95uTkE=",
-            "rev": "478e5ab3eca30e600006d5a0a08b176fd34d3bd1",
+            "hash": "sha256-tf0lnxATCkoq+xRti6gK6J47HwioAYWnpEsLGSA5Xdg=",
+            "rev": "652bdb7719f30b52b08e506645a7322ff1b2cc6f",
             "url": "https://chromium.googlesource.com/external/github.com/cisco/openh264"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/perfetto": {
         "args": {
-            "hash": "sha256-ogrB+n5F4UnmL3nHJRyMFOLYVUvjirT9BClg20mTZkc=",
-            "rev": "a0c2bc7919f7467cf4a8287c8389c3f96a3fcbac",
+            "hash": "sha256-peD4Vnar1Uf8S/JYPpHH8dJZCDIpzpE4EYDfTqVyG8U=",
+            "rev": "40b529923598b739b2892a536a7692eedbed5685",
             "url": "https://android.googlesource.com/platform/external/perfetto.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/protobuf-javascript/src": {
         "args": {
-            "hash": "sha256-TmP6xftUVTD7yML7UEM/DB8bcsL5RFlKPyCpcboD86U=",
-            "rev": "e34549db516f8712f678fcd4bc411613b5cc5295",
+            "hash": "sha256-zq86SrDASl6aYPFPijRZp03hJqXUFz2Al/KkiNq7i0M=",
+            "rev": "eb785a9363664a402b6336dfe96aad27fb33ffa8",
             "url": "https://chromium.googlesource.com/external/github.com/protocolbuffers/protobuf-javascript"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/re2/src": {
         "args": {
-            "hash": "sha256-IeANwJlJl45yf8iu/AZNDoiyIvTCZIeK1b74sdCfAIc=",
-            "rev": "6dcd83d60f7944926bfd308cc13979fc53dd69ca",
+            "hash": "sha256-f/k2rloV2Nwb0KuJGUX4SijFxAx69EXcsXOG4vo+Kis=",
+            "rev": "c84a140c93352cdabbfb547c531be34515b12228",
             "url": "https://chromium.googlesource.com/external/github.com/google/re2.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/tools": {
         "args": {
-            "hash": "sha256-C3bzAAJp8OpKAHhM54P/sTBVFf3K6ffxvrpfKKxLRII=",
-            "rev": "6820cc03cc8a4b1fb99747f30e8249d138a70981",
+            "hash": "sha256-Vmhd5kfPaOyPJaDSg67V64FSgi4maEVjXE4PMnxnIFw=",
+            "rev": "3460fbcdee33353d37800dad5caa6bba327ad8c8",
             "url": "https://chromium.googlesource.com/chromium/src/tools"
         },
         "fetcher": "fetchFromGitiles"

pkgs/by-name/si/signal-desktop/webrtc.nix

···
   pulseaudio,
   writeShellScriptBin,
   gclient2nix,
+  rustc,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
···
       exec python3 "$@"
     '')
     python3
+    rustc
     pkg-config
     gclient2nix.gclientUnpackHook
   ];
···
     "symbol_level=1"
     "rtc_include_tests=false"
     "rtc_enable_protobuf=false"
+
+    ''rust_sysroot_absolute="${rustc}"''
   ];
   ninjaFlags = [ "webrtc" ];
 

pkgs/by-name/si/signalbackup-tools/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "signalbackup-tools";
-  version = "20250606";
+  version = "20250617";
 
   src = fetchFromGitHub {
     owner = "bepaald";
     repo = "signalbackup-tools";
     rev = version;
-    hash = "sha256-UGSto0RbC+ZTXgcT+F5UEmRYg79jGyYJaWA4m5ulB+Y=";
+    hash = "sha256-sX/JM8d0kex09OT8n4IF26+bSPwvTjarqoiRTknA2Og=";
   };
 
   nativeBuildInputs =

pkgs/by-name/sl/slipshow/package.nix

···
+{
+  lib,
+  ocamlPackages,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+ocamlPackages.buildDunePackage rec {
+  pname = "slipshow";
+  version = "0.2.0";
+
+  src = fetchFromGitHub {
+    owner = "panglesd";
+    repo = "slipshow";
+    tag = "v${version}";
+    hash = "sha256-1gjQDkjDxanshvn1fNxwpJFt12uRWnkmRbs0tWdTgtM=";
+  };
+
+  postPatch = ''
+    substituteInPlace ./src/cli/main.ml \
+      --replace-fail '%%VERSION%%' '${version}'
+  '';
+
+  nativeBuildInputs = with ocamlPackages; [
+    js_of_ocaml
+  ];
+
+  buildInputs = with ocamlPackages; [
+    base64
+    bos
+    cmdliner
+    dream
+    fmt
+    fpath
+    irmin-watcher
+    js_of_ocaml-lwt
+    logs
+    lwt
+    magic-mime
+    ppx_blob
+    ppx_sexp_value
+    sexplib
+  ];
+
+  doCheck = true;
+
+  nativeCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Engine for displaying slips, the next-gen version of slides";
+    homepage = "https://slipshow.readthedocs.io/en/latest/index.html";
+    downloadPage = "https://github.com/panglesd/slipshow";
+    maintainers = [ lib.maintainers.ethancedwards8 ];
+    teams = [ lib.teams.ngi ];
+    mainProgram = "slipshow";
+  };
+}

pkgs/by-name/so/soteria/package.nix

···
   polkit,
 }:
 let
-  version = "0.1.2";
+  version = "0.1.4";
 in
 rustPlatform.buildRustPackage {
   pname = "soteria";
···
     owner = "imvaskel";
     repo = "soteria";
     tag = "v${version}";
-    hash = "sha256-i7g2my0hP54Tj86UVEEFQIb5ih26djKgLg++I1n9Sfs=";
+    hash = "sha256-Dpu0GBpa3W2itIjCiqA4Yh4he0ZfLDSr26DYSfhMphI=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Z9ycfFhnff0z2ZG+tqf+qGUL7gDJQ+kC+e+WZ21qN1Y=";
+  cargoHash = "sha256-RXPzmco+pLkLxY+jicafuqdul9LpkDv6YK8+bHCS+5s=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/st/stats/package.nix

···
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "stats";
-  version = "2.11.41";
+  version = "2.11.45";
 
   src = fetchurl {
     url = "https://github.com/exelban/stats/releases/download/v${finalAttrs.version}/Stats.dmg";
-    hash = "sha256-iW22uCyfx9sCX3GyVmYzyJIHylxIpgJLns2oHVFBwc4=";
+    hash = "sha256-OdZ8LCU0kCCKk4SeyDryDpyCUsjf8aUZAv2o/cR4GX8=";
   };
 
   sourceRoot = ".";

pkgs/by-name/sw/swiftformat/package.nix

···
 
 swift.stdenv.mkDerivation rec {
   pname = "swiftformat";
-  version = "0.56.3";
+  version = "0.56.4";
 
   src = fetchFromGitHub {
     owner = "nicklockwood";
     repo = "SwiftFormat";
     rev = version;
-    sha256 = "sha256-ZPz/AAAs8L0Zn4jWbbCz2y0dVE8Ap1U16rVpxwQYUPI=";
+    sha256 = "sha256-WnBQTpbz9tcnbvmtWpZ9esirWdQKJOpVmH8zk97OuFE=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/te/terragrunt/package.nix

···
 
 buildGoModule (finalAttrs: {
   pname = "terragrunt";
-  version = "0.81.7";
+  version = "0.81.8";
 
   src = fetchFromGitHub {
     owner = "gruntwork-io";
     repo = "terragrunt";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/rpZK3uVd+EAP+lD2PohLRIFJY9GI9d32MNjJUo8hos=";
+    hash = "sha256-+f6rHS1ljj59wmR3NJwviJEBqeS6VzoMPfal4MuoyUE=";
   };
 
   nativeBuildInputs = [
···
     make generate-mocks
   '';
 
-  vendorHash = "sha256-P9EHKvtZwFr6go8IdA8B2SYCfDhaGCADZLVZ46SFQEI=";
+  vendorHash = "sha256-A8P0wJ/EUTnAeCIFfAECTBQmSaOcED6SDbeRnnTlcJ8=";
 
   doCheck = false;
 

pkgs/by-name/tt/ttyplot/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "ttyplot";
-  version = "1.7.1";
+  version = "1.7.2";
 
   src = fetchFromGitHub {
     owner = "tenox7";
     repo = "ttyplot";
     rev = version;
-    hash = "sha256-XPWfSL1395TBkUmAO5kB9TdAZHL011o6t/2s01W/kk8=";
+    hash = "sha256-zTbcl8hM/XYdkV8V/BCQ94fuFXWOMGdQZeowKRhvYNo=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/xk/xk6/package.nix

···
 
 buildGoModule rec {
   pname = "xk6";
-  version = "0.20.1";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "xk6";
     tag = "v${version}";
-    hash = "sha256-RVuHGvoXQ9tAUEYTGK03Qjkgl3WCbFqbqt2rkPP6MYs=";
+    hash = "sha256-lSEMToo4Bjh9j2Z/wG64TIeHdJ/+HpYlEXyqIK9MJ/Y=";
   };
 
   vendorHash = null;

pkgs/by-name/ya/yamlfmt/package.nix

···
 
 buildGoModule (finalAttrs: {
   pname = "yamlfmt";
-  version = "0.17.0";
+  version = "0.17.1";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "yamlfmt";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-G0tejPNlvtar8eR7wS8oK6//ATd9YkDlC7oa3OkzQ3c=";
+    hash = "sha256-ORVT70KXW/eatcQkDdpqb7LK6NbUr389zFDyYHy6Cxs=";
   };
 
   vendorHash = "sha256-Cy1eBvKkQ90twxjRL2bHTk1qNFLQ22uFrOgHKmnoUIQ=";

pkgs/by-name/zg/zgrviewer/package.nix

···
   unzip,
   runtimeShell,
 }:
-stdenv.mkDerivation rec {
-  version = "0.9.0";
+
+stdenv.mkDerivation (finalAttrs: {
   pname = "zgrviewer";
+  version = "0.10.0";
+
   src = fetchurl {
-    url = "mirror://sourceforge/zvtm/${pname}/${version}/${pname}-${version}.zip";
-    sha256 = "1yg2rck81sqqrgfi5kn6c1bz42dr7d0zqpcsdjhicssi1y159f23";
+    url = "mirror://sourceforge/zvtm/zgrviewer/${finalAttrs.version}/zgrviewer-${finalAttrs.version}.zip";
+    hash = "sha256-0CrioPNtpUa8uCZOXpe2q/QOo90kYO7mC2s9x3ymP7I=";
   };
+
   nativeBuildInputs = [ unzip ];
+
   buildInputs = [ jre ];
-  buildPhase = "";
-  installPhase = ''
-    mkdir -p "$out"/{bin,share/java/zvtm/plugins,share/doc/zvtm}
 
-    cp overview.html *.license.* "$out/share/doc/zvtm"
+  installPhase = ''
+    runHook preInstall
 
+    mkdir -p "$out"/{bin,share/java/zvtm/plugins,share/doc/zvtm}
+    cp *.license.* "$out/share/doc/zvtm"
     cp -r target/* "$out/share/java/zvtm/"
-
     echo '#!${runtimeShell}' > "$out/bin/zgrviewer"
-    echo "${jre}/bin/java -jar '$out/share/java/zvtm/zgrviewer-${version}.jar' \"\$@\"" >> "$out/bin/zgrviewer"
+    echo "${lib.getExe jre} -jar '$out/share/java/zvtm/zgrviewer-${finalAttrs.version}.jar' \"\$@\"" >> "$out/bin/zgrviewer"
     chmod a+x "$out/bin/zgrviewer"
+
+    runHook postInstall
   '';
+
   meta = {
     # Quicker to unpack locally than load Hydra
     hydraPlatforms = [ ];
···
     platforms = with lib.platforms; unix;
     mainProgram = "zgrviewer";
   };
-}
+})

pkgs/by-name/zs/zsh-powerlevel10k/package.nix

···
   bash,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "powerlevel10k";
-  version = "1.20.14";
+  version = "1.20.15";
 
   src = fetchFromGitHub {
     owner = "romkatv";
     repo = "powerlevel10k";
     # upstream doesn't seem to use tags anymore
-    rev = "5e26473457d819fe148f7fff32db1082dae72012";
-    hash = "sha256-/+FEkgBR6EOTaCAc15vYGWNih2QZkN27ae6LMXlXZU4=";
+    rev = "36f3045d69d1ba402db09d09eb12b42eebe0fa3b";
+    hash = "sha256-BRJyGn+gTGUWifpJ1ziBKVHACcWw+R5N/HdUi8HzSvY=";
   };
 
   strictDeps = true;
+
   buildInputs = [ bash ];
 
   patches = [
···
   ];
 
   installPhase = ''
+    runHook preInstall
+
     install -D powerlevel10k.zsh-theme --target-directory=$out/share/zsh-powerlevel10k
     install -D powerlevel9k.zsh-theme --target-directory=$out/share/zsh-powerlevel10k
     install -D config/* --target-directory=$out/share/zsh-powerlevel10k/config
     install -D internal/* --target-directory=$out/share/zsh-powerlevel10k/internal
     cp -R gitstatus $out/share/zsh-powerlevel10k/gitstatus
+
+    runHook postInstall
   '';
 
   meta = {
-    changelog = "https://github.com/romkatv/powerlevel10k/releases/tag/v${version}";
+    changelog = "https://github.com/romkatv/powerlevel10k/releases/tag/v${finalAttrs.version}";
     description = "Fast reimplementation of Powerlevel9k ZSH theme";
     longDescription = ''
       To make use of this derivation, use
···
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ ];
   };
-}
+})

pkgs/development/compilers/rust/binary.nix

···
       homepage = "https://www.rust-lang.org/";
       sourceProvenance = with sourceTypes; [ binaryNativeCode ];
       description = "Safe, concurrent, practical language";
+      mainProgram = "rustc";
       maintainers = with maintainers; [ qknight ];
       license = [
         licenses.mit

pkgs/development/libraries/astal/modules/tray.nix

···
 {
   buildAstalModule,
   json-glib,
+  appmenu-glib-translator,
 }:
 buildAstalModule {
   name = "tray";
-  buildInputs = [ json-glib ];
+  buildInputs = [
+    json-glib
+    appmenu-glib-translator
+  ];
   meta.description = "Astal module for StatusNotifierItem";
-  meta.broken = true; # https://github.com/NixOS/nixpkgs/issues/337630
 }

pkgs/development/ocaml-modules/scfg/default.nix

···
+{
+  lib,
+  buildDunePackage,
+  fetchzip,
+  bos,
+  cmdliner,
+  fmt,
+  fpath,
+  menhir,
+  menhirLib,
+  prelude,
+  sedlex,
+  writableTmpDirAsHomeHook,
+}:
+
+buildDunePackage rec {
+  pname = "scfg";
+  version = "0.5";
+
+  # upstream git repo is misconfigured and cannot be cloned
+  src = fetchzip {
+    url = "https://git.zapashcanon.fr/zapashcanon/scfg/archive/${version}.tar.gz";
+    hash = "sha256-XyNVmI0W0B1JqR+uuojpHe9L5KKLhyoH8vN8+9i7Xcg=";
+  };
+
+  nativeBuildInputs = [
+    menhir
+  ];
+
+  buildInputs = [
+    cmdliner
+  ];
+
+  propagatedBuildInputs = [
+    bos
+    fmt
+    fpath
+    menhirLib
+    prelude
+    sedlex
+  ];
+
+  checkInputs = [
+    writableTmpDirAsHomeHook
+  ];
+
+  doCheck = true;
+
+  meta = {
+    description = "Library to work with the scfg configuration file";
+    homepage = "https://ocaml.org/p/scfg/";
+    downloadPage = "https://git.zapashcanon.fr/zapashcanon/scfg";
+    changelog = "https://git.zapashcanon.fr/zapashcanon/scfg/src/tag/${version}/CHANGES.md";
+    license = lib.licenses.isc;
+    maintainers = [ lib.maintainers.ethancedwards8 ];
+  };
+}

pkgs/development/python-modules/babelfont/default.nix

···
 
 buildPythonPackage rec {
   pname = "babelfont";
-  version = "3.1.2";
+  version = "3.1.3";
   pyproject = true;
 
   # PyPI source tarballs omit tests, fetch from Github instead
···
     owner = "simoncozens";
     repo = "babelfont";
     tag = "v${version}";
-    hash = "sha256-XNoyM3kjKRc0NWA94ufzC2DBzAsufJNJbzFDUbLu8Lc=";
+    hash = "sha256-wCJNJZqjMm0M00F9/kd/g97+DRdRPTn03Nk3rnh7me4=";
   };
 
   build-system = [

pkgs/development/python-modules/bdffont/default.nix

···
 
 buildPythonPackage rec {
   pname = "bdffont";
-  version = "0.0.31";
+  version = "0.0.32";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
···
   src = fetchPypi {
     pname = "bdffont";
     inherit version;
-    hash = "sha256-jE6k1gym4UCHpQJTPEip+c5e+9QxNpT41v3fK9WVoLc=";
+    hash = "sha256-5O1AlidPMhp0ztzBi/eHJToFSKMcx+EuQHltt/w4goQ=";
   };
 
   build-system = [ hatchling ];

pkgs/development/python-modules/clarifai-grpc/default.nix

···
 
 buildPythonPackage rec {
   pname = "clarifai-grpc";
-  version = "11.5.3";
+  version = "11.5.5";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
···
     owner = "Clarifai";
     repo = "clarifai-python-grpc";
     tag = version;
-    hash = "sha256-XShgm9/i1YuQRdC2ToImjmeBYfFJL+sJOyPuZGSbC8E=";
+    hash = "sha256-ijfuZh35HpmR3p7n2S+cCpcO4ld52StQOpxgPJtRqM4=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/llm-openai-plugin/default.nix

···
 }:
 buildPythonPackage rec {
   pname = "llm-openai-plugin";
-  version = "0.4";
+  version = "0.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "simonw";
     repo = "llm-openai-plugin";
     tag = version;
-    hash = "sha256-UoUxCwR+qOUufHuS0gw6A5Q7sB77VO4HYuMjFGN7mhA=";
+    hash = "sha256-xlJS+xAKOo40hZH751yrvIuXZw1HQsB7K2anFoMxthU=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/meshtastic/default.nix

···
 
   pythonRelaxDeps = [
     "bleak"
+    "packaging"
     "protobuf"
   ];
 

pkgs/development/python-modules/molecule/default.nix

···
 
 buildPythonPackage rec {
   pname = "molecule";
-  version = "25.5.0";
+  version = "25.6.0";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-WF2M4K1JO+OulN4Jb4tKiWq5AQp+o2qGn99eKb1mj0s=";
+    hash = "sha256-DbII3li+zssMqHvyzEjhAXI04eOtlHwXlIdzf4hOfHw=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/niaarm/default.nix

···
 buildPythonPackage rec {
   pname = "niaarm";
   # nixpkgs-update: no auto update
-  version = "0.4.1";
+  version = "0.4.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "firefly-cpp";
     repo = "NiaARM";
     tag = version;
-    hash = "sha256-/lEW6SUV+CRovYmLVWiolYDHYmMJSJHnYNo9+lBc9nY=";
+    hash = "sha256-WvVXL1a1DvgLF3upbGUi1+nH5aDBUNx5Bitlkb8lQkc=";
   };
 
   pythonRelaxDeps = [
     "numpy"
+    "plotly"
     "scikit-learn"
   ];
 
···
     description = "Minimalistic framework for Numerical Association Rule Mining";
     mainProgram = "niaarm";
     homepage = "https://github.com/firefly-cpp/NiaARM";
-    changelog = "https://github.com/firefly-cpp/NiaARM/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/firefly-cpp/NiaARM/releases/tag/${src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ firefly-cpp ];
   };

pkgs/development/python-modules/onnxslim/default.nix

···
 
 buildPythonPackage rec {
   pname = "onnxslim";
-  version = "0.1.56";
+  version = "0.1.57";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-/c2id6XH0QQUdiISRlC8YDZNAm7E+8sEdfYfgv8J0Mw=";
+    hash = "sha256-VI1OaNMHuL2AhYxZ/n5zrwlqnfcCbjY39QXHX8gcdw8=";
   };
 
   build-system = [

pkgs/development/python-modules/python-gvm/default.nix

···
 
 buildPythonPackage rec {
   pname = "python-gvm";
-  version = "26.2.0";
+  version = "26.2.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
···
     owner = "greenbone";
     repo = "python-gvm";
     tag = "v${version}";
-    hash = "sha256-xWNOUgTanOVYjvoZZkQBrKYr0z+dn0/ur5jdO549FXw=";
+    hash = "sha256-rYUqWuAnbT5XAvUJx0D7y9I0w8z8/jhvwAFtxCL/iGw=";
   };
 
   build-system = [ poetry-core ];

pkgs/development/python-modules/python-matter-server/default.nix

···
 
 buildPythonPackage rec {
   pname = "python-matter-server";
-  version = "7.0.1";
+  version = "8.0.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.10";
+  disabled = pythonOlder "3.12";
 
   src = fetchFromGitHub {
     owner = "home-assistant-libs";
     repo = "python-matter-server";
-    rev = "refs/tags/${version}";
-    hash = "sha256-kwN7mLSKrxsAydp7PnN7kTvvi5zQSpXVwMh2slL6aIA=";
+    tag = version;
+    hash = "sha256-9dMcofwvGYBnI+9y7D+TDwz+uLgBVhcS4iVU7AUqclI=";
   };
 
   patches = [
···
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace 'version = "0.0.0"' 'version = "${version}"'
+      --replace-fail 'version = "0.0.0"' 'version = "${version}"'
   '';
 
   build-system = [
···
     "tests/server/ota/test_dcl.py"
   ];
 
-  meta = with lib; {
-    changelog = "https://github.com/home-assistant-libs/python-matter-server/releases/tag/${version}";
+  meta = {
+    changelog = "https://github.com/home-assistant-libs/python-matter-server/releases/tag/${src.tag}";
     description = "Python server to interact with Matter";
     mainProgram = "matter-server";
     homepage = "https://github.com/home-assistant-libs/python-matter-server";
-    license = licenses.asl20;
-    teams = [ teams.home-assistant ];
+    license = lib.licenses.asl20;
+    teams = [ lib.teams.home-assistant ];
   };
 }

pkgs/development/python-modules/snowflake-sqlalchemy/default.nix

···
 
 buildPythonPackage rec {
   pname = "snowflake-sqlalchemy";
-  version = "1.7.3";
+  version = "1.7.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "snowflakedb";
     repo = "snowflake-sqlalchemy";
     tag = "v${version}";
-    hash = "sha256-E3UnlsGaQPlxHSgBVGrG8pGCA8fE7yN5x9eidbMQ10w=";
+    hash = "sha256-Twv8ugLrQT9y4wHNo0B8vkWOFNSci/t4eY9XvFlq/TE=";
   };
 
   build-system = [ hatchling ];
···
 
   meta = with lib; {
     description = "Snowflake SQLAlchemy Dialect";
-    changelog = "https://github.com/snowflakedb/snowflake-sqlalchemy/blob/v${version}/DESCRIPTION.md";
+    changelog = "https://github.com/snowflakedb/snowflake-sqlalchemy/blob/${src.tag}/DESCRIPTION.md";
     homepage = "https://github.com/snowflakedb/snowflake-sqlalchemy";
     license = licenses.asl20;
     maintainers = [ ];

pkgs/development/python-modules/textual-image/default.nix

···
 
 buildPythonPackage rec {
   pname = "textual-image";
-  version = "0.8.2";
+  version = "0.8.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lnqs";
     repo = "textual-image";
     tag = "v${version}";
-    hash = "sha256-ik/zvnxXN5u2jXHfsGsCLnymZZ+IQiixagOJdEMRDlw=";
+    hash = "sha256-XbQs3E2Zl6Jdq0QVSdF6LexnmEmlZEm9BmWZK+dyBjo=";
   };
 
   buildInputs = [ setuptools ];

pkgs/development/python-modules/types-requests/default.nix

···
 
 buildPythonPackage rec {
   pname = "types-requests";
-  version = "2.32.0.20250328";
+  version = "2.32.4.20250611";
   pyproject = true;
 
   src = fetchPypi {
     pname = "types_requests";
     inherit version;
-    hash = "sha256-yeZyKOoQO9gRyWmE+sNu0q6NqHo2pjOWSiHxmdYLrzI=";
+    hash = "sha256-dByHd+1kJYML9R5U1qviRfebTcuQGfFiK3c0Y5Rr+CY=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/ufomerge/default.nix

···
 
 buildPythonPackage rec {
   pname = "ufomerge";
-  version = "1.9.3";
+  version = "1.9.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "googlefonts";
     repo = "ufomerge";
     tag = "v${version}";
-    hash = "sha256-AWEuHFm9upYrONaHXubPzK5qLsvYJ1M9/vcC5OgqRJM=";
+    hash = "sha256-kXwbdBqcPySboSBpGVevhQqrlE+/t+IFKTX03sh0nfw=";
   };
 
   build-system = [

pkgs/servers/home-assistant/custom-components/oref_alert/package.nix

···
     hash = "sha256-OO3My8U8SCmhaJQI7y0kxVKj/stvfp3pdqhFdTCcIWs=";
   };
 
+  postPatch = ''
+    substituteInPlace custom_components/oref_alert/manifest.json \
+      --replace-fail shapely==2.0.7 shapely
+  '';
+
   dependencies = [
     aiofiles
     shapely

pkgs/servers/monitoring/prometheus/pve-exporter.nix

···
 
 python3.pkgs.buildPythonApplication rec {
   pname = "prometheus_pve_exporter";
-  version = "3.5.4";
+  version = "3.5.5";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-eaBjvcnhqgb/FeD/J919T4WjM4Ft9yYYrLtBFFH/CBo=";
+    hash = "sha256-QFo/gnRF6+mk/xs6vJCxbR64LI3JwrLVwXib6tcEN8g=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [

pkgs/tools/security/gotrue/supabase.nix

···
 
 buildGoModule rec {
   pname = "auth";
-  version = "2.175.0";
+  version = "2.176.1";
 
   src = fetchFromGitHub {
     owner = "supabase";
     repo = "auth";
     rev = "v${version}";
-    hash = "sha256-2tHWisTlNFL1mJEeDD3kG/TWY+w0tjV1dBrl4i8u2C4=";
+    hash = "sha256-YXr5eGyX3cPk0GaV9XsvlIrroCOPIlWEyA1wvwdtT+k=";
   };
 
   vendorHash = "sha256-AU14lvEQQx9JCb1awSo+h63QY0k2v7QibYP8kidfJ8A=";

pkgs/top-level/ocaml-packages.nix

···
 
         sawja = callPackage ../development/ocaml-modules/sawja { };
 
+        scfg = callPackage ../development/ocaml-modules/scfg { };
+
         secp256k1 = callPackage ../development/ocaml-modules/secp256k1 {
           inherit (pkgs) secp256k1;
         };