Merge remote-tracking branch 'origin/master' into staging-next

nixos/modules/services/web-apps/zipline.nix

···
           "@system-service"
           "~@privileged"
           "~@resources"
+          "@chown"
         ];
         UMask = "0077";
       };

pkgs/by-name/pr/proxyman/package.nix

···
+{
+  lib,
+  appimageTools,
+  fetchurl,
+  asar,
+}:
+let
+  pname = "proxyman";
+  version = "3.1.0";
+
+  src = fetchurl {
+    url = "https://github.com/ProxymanApp/proxyman-windows-linux/releases/download/${version}/Proxyman-${version}.AppImage";
+    hash = "sha256-R/PrJCIK6dWwdivzeTpAhyD1Ir34hdBaHDtE+TRHOxo=";
+  };
+
+  appimageContents = appimageTools.extract {
+    inherit pname version src;
+    postExtract = ''
+      ${asar}/bin/asar extract $out/resources/app.asar app
+
+      # This will fix the issue with Proxyman not detecting NixOS as a valid Linux environment
+      substituteInPlace app/dist/main/main.js --replace-fail "/etc/ca-certificates/trust-source/anchors/" "/etc/ssl/certs/"
+
+      # This will permanently mark the certificate as installed, as this should be done through Nix config rather than
+      # placing / editing a file in /etc like Proxyman would expect.
+      # Configure the certificate located in "~/.config/Proxyman/certificate/certs/ca.pem" using security.pki.certificates in your nix config
+      substituteInPlace app/dist/main/main.js --replace-fail "return this.isFile(this.getNewCertPath(e))" "return true"
+
+      ${asar}/bin/asar pack app $out/resources/app.asar
+    '';
+  };
+
+in
+appimageTools.wrapAppImage {
+  inherit pname version;
+  src = appimageContents;
+
+  extraInstallCommands = ''
+    install -Dm444 ${appimageContents}/proxyman.desktop -t $out/share/applications
+    install -Dm444 ${appimageContents}/proxyman.png -t $out/share/pixmaps
+    substituteInPlace $out/share/applications/proxyman.desktop \
+      --replace-fail "Exec=AppRun" "Exec=proxyman --"
+  '';
+
+  meta = {
+    description = "Capture, inspect, and manipulate HTTP(s) requests/responses with ease";
+    homepage = "https://proxyman.com";
+    changelog = "https://proxyman.com/changelog-windows";
+    license = lib.licenses.unfree;
+    mainProgram = "proxyman";
+    maintainers = with lib.maintainers; [ nilathedragon ];
+    platforms = [ "x86_64-linux" ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+}

pkgs/by-name/we/werf/package.nix

···
 }:
 buildGoModule (finalAttrs: {
   pname = "werf";
-  version = "2.45.0";
+  version = "2.47.0";
 
   src = fetchFromGitHub {
     owner = "werf";
     repo = "werf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tTWhGaKEYrZAQnIkuRcTMLlYooexhRIc0rJ4wzqJCWM=";
+    hash = "sha256-FrFo/RJuwNQps6Fqr/B+xwgYvL9wbVyEkvh91ujf3gU=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-5OSt0oMFb0MjJDXTFJKtaintOhnCShBOHfjllWbwb6Y=";
+  vendorHash = "sha256-/0snKYzNJMbXGikMq81XIwn7ip53bV7MT31VmeA668g=";
 
   subPackages = [ "cmd/werf" ];
 

pkgs/by-name/wr/wrangler/package.nix

···
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "wrangler";
-  version = "4.26.1";
+  version = "4.30.0";
 
   src = fetchFromGitHub {
     owner = "cloudflare";
     repo = "workers-sdk";
     rev = "wrangler@${finalAttrs.version}";
-    hash = "sha256-7Z2MCG9YKwIkZ2eJucSgFr9R+rR+GFKiSXQX0xR5Xas=";
+    hash = "sha256-wncNdsQnmvZFf5sBw/sxDCF1SYuOIhj4bIeDpFj2FyI=";
   };
 
   pnpmDeps = pnpm_9.fetchDeps {
···
       postPatch
       ;
     fetcherVersion = 2;
-    hash = "sha256-Gsiq0+PIA3rJ0D9JryqaO0ThQcY+hC02AtzxdS+wSPg=";
+    hash = "sha256-w2AwYhn2+U+Kj8d9SXZssiH8tqSi9P3gSpLCR6L3T+A=";
   };
   # pnpm packageManager version in workers-sdk root package.json may not match nixpkgs
   postPatch = ''

pkgs/by-name/zi/zipline/package.nix

···
     PRISMA_INTROSPECTION_ENGINE_BINARY = lib.getExe' prisma-engines "introspection-engine";
     PRISMA_FMT_BINARY = lib.getExe' prisma-engines "prisma-fmt";
   };
+
+  vips' = vips.overrideAttrs (
+    finalAttrs: prevAttrs: {
+      version = "8.17.1";
+      src = fetchFromGitHub {
+        inherit (prevAttrs.src) owner repo;
+        tag = "v${finalAttrs.version}";
+        hash = "sha256-Sc2BWdQIgL/dI0zfbEQVCs3+1QBrLE7BsE3uFHe9C/c=";
+        postFetch = ''
+          rm -r $out/test/test-suite/images/
+        '';
+      };
+      outputs = lib.remove "devdoc" prevAttrs.outputs;
+      mesonFlags = lib.remove (lib.mesonBool "gtk_doc" true) prevAttrs.mesonFlags;
+    }
+  );
 in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zipline";
-  version = "4.2.1";
+  version = "4.2.3";
 
   src = fetchFromGitHub {
     owner = "diced";
     repo = "zipline";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-16D44QQHrXn6y+3IRsWh6iHSr+o4l3zHDW7SOFMsHnc=";
+    hash = "sha256-WyL/ItY/hvmBDRBB063QAIATPT51bPChkFKH7i32sz0=";
     leaveDotGit = true;
     postFetch = ''
       git -C $out rev-parse --short HEAD > $out/.git_head
···
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
     fetcherVersion = 1;
-    hash = "sha256-kIneqtLPZ29PzluKUGO4XbQYHbNddu0kTfoP4C22k7U=";
+    hash = "sha256-LDLcde+p0wjy1BddiNxJwFLS/7O9jGpMNapojZIipeA=";
   };
 
   buildInputs = [
     openssl
-    vips
+    vips'
   ];
 
   nativeBuildInputs = [
···
 
   installPhase = ''
     runHook preInstall
+
+    pnpm prune --prod
+    find node_modules -xtype l -delete
 
     mkdir -p $out/{bin,share/zipline}
 

pkgs/development/python-modules/xlsxwriter/default.nix

···
 
 buildPythonPackage rec {
   pname = "xlsxwriter";
-  version = "3.2.2";
+  version = "3.2.5";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "jmcnamara";
     repo = "XlsxWriter";
     rev = "RELEASE_${version}";
-    hash = "sha256-bacoOZckZVADMa81raUV9z3V1xj2Eid7B+gLb+MCccg=";
+    hash = "sha256-Z384IYFQzGViJXJQe+zovXn5X+MyOqGv0NKKlktcF4o=";
   };
 
   build-system = [ setuptools ];

pkgs/servers/sql/postgresql/18.nix

···
 import ./generic.nix {
   version = "18beta2";
-  rev = "refs/tags/REL_18_BETA2";
-  hash = "sha256-n3NA0XJE2wvbOwrQOMXbzKn+7HLGAQSXgDU9ObhddZQ=";
+  rev = "refs/tags/REL_18_BETA3";
+  hash = "sha256-QpJONriQnRN75cCcsdu9TGt8Km7NQLs5diZx1pVruc4=";
   muslPatches = {
     dont-use-locale-a = {
       url = "https://git.alpinelinux.org/aports/plain/main/postgresql17/dont-use-locale-a-on-musl.patch?id=d69ead2c87230118ae7f72cef7d761e761e1f37e";

pkgs/servers/sql/postgresql/ext/timescaledb_toolkit.nix

···
     maintainers = with lib.maintainers; [ typetetris ];
     platforms = postgresql.meta.platforms;
     license = lib.licenses.tsl;
-    broken = lib.versionOlder postgresql.version "15";
+    broken =
+      lib.versionOlder postgresql.version "15"
+      ||
+        # Check after next package update.
+        lib.warnIf (finalAttrs.version != "1.21.0")
+          "Is postgresql18Packages.timescaledb_toolkit still broken?"
+          (lib.versionAtLeast postgresql.version "18");
   };
 })