Merge master into staging-next

maintainers/maintainer-list.nix

···
     githubId = 9086315;
     name = "Connor Brewster";
   };
-  cburstedde = {
-    email = "[e-mail]";
-    github = "cburstedde";
-    githubId = 109908;
-    name = "Carsten Burstedde";
-    keys = [ { fingerprint = "1127 A432 6524 BF02 737B  544E 0704 CD9E 550A 6BCD"; } ];
-  };
   ccellado = {
     email = "[e-mail]";
     github = "ccellado";

nixos/modules/services/matrix/continuwuity.nix

···
       wants = [ "network-online.target" ];
       after = [ "network-online.target" ];
       environment = lib.mkMerge [
-        { CONDUWUIT_CONFIG = configFile; }
+        { CONTINUWUITY_CONFIG = configFile; }
         cfg.extraEnvironment
       ];
       startLimitBurst = 5;

nixos/modules/services/networking/ntp/chrony.nix

···
           Alternatively, disable this behaviour by `services.chrony.enableRTCTrimming = false;`
         '';
       }
-      {
-        assertion = !(cfg.enable && config.environment.memoryAllocator.provider == "graphene-hardened");
-        message = ''
-          Chrony doesn't work with the graphene-hardened memory allocator set by
-          `environment.memoryAllocator.provider`.
-        '';
-      }
     ];
   };
 }

nixos/tests/chrony.nix

···
-{ lib, ... }:
 {
   name = "chrony";
-
-  meta.maintainers = with lib.maintainers; [ fpletz ];
 
   nodes.machine = {
     services.chrony.enable = true;
 
     specialisation.hardened.configuration = {
-      services.chrony.enableMemoryLocking = true;
+      environment.memoryAllocator.provider = "graphene-hardened";
     };
   };
 

pkgs/applications/networking/p2p/gnunet/default.nix

···
     homepage = "https://gnunet.org/";
     license = lib.licenses.agpl3Plus;
     maintainers = with lib.maintainers; [ pstn ];
+    teams = with lib.teams; [ ngi ];
     platforms = lib.platforms.unix;
     changelog = "https://git.gnunet.org/gnunet.git/tree/ChangeLog?h=v${finalAttrs.version}";
     # meson: "Can not run test applications in this cross environment." (for dane_verify_crt_raw)

pkgs/by-name/bu/buildkit/package.nix

···
 
 buildGoModule rec {
   pname = "buildkit";
-  version = "0.23.0";
+  version = "0.23.2";
 
   src = fetchFromGitHub {
     owner = "moby";
     repo = "buildkit";
     rev = "v${version}";
-    hash = "sha256-yEIzXBwcct7+8Bqk5256ZNyWpSpCZwxVVyg5vua2Oj8=";
+    hash = "sha256-/1wOZWvHHpT8zTnaQi/v3XgMyU8r2QPOBDadbos8GV8=";
   };
 
   vendorHash = null;

pkgs/by-name/bu/bun/package.nix

···
 }:
 
 stdenvNoCC.mkDerivation rec {
-  version = "1.2.17";
+  version = "1.2.18";
   pname = "bun";
 
   src =
···
     sources = {
       "aarch64-darwin" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-aarch64.zip";
-        hash = "sha256-n1X9IT8vdo0C61uYhaqkSx4TB6aAwYYitXCVMCqTGvk=";
+        hash = "sha256-zKnrUnYrvYHriU/IJ1u6CgZU6BqtMY0ZhphUow83aaI=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-aarch64.zip";
-        hash = "sha256-oLmW9IyXe+tOh7CaRx3tfmPuXC+0tyeQx6tLrbwUfWs=";
+        hash = "sha256-G60WcdBboVaWMVynJI7AQ9KbWV/1+xX6hraZwiVdi8U=";
       };
       "x86_64-darwin" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-x64-baseline.zip";
-        hash = "sha256-pUtqF3ilItj4z1fBgJWsp2QrAJz4FhPkiAX9gpVPsME=";
+        hash = "sha256-1/XHbGiaZ/D5pRmDy2EJacwUYhdr2P0BSDwKDBoG9P4=";
       };
       "x86_64-linux" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-x64.zip";
-        hash = "sha256-YFQgcHRlO028IyDVph5mTktvQjee/BjWGBv/zAekMZM=";
+        hash = "sha256-kOAyqYKuKZxi1kXaxsqqjrALaQkryFAb8TpZDejQmcg=";
       };
     };
     updateScript = writeShellScript "update-bun" ''

pkgs/by-name/ch/chatmcp/package.nix

···
 
 flutter332.buildFlutterApplication rec {
   pname = "chatmcp";
-  version = "0.0.69";
+  version = "0.0.70";
 
   src = fetchFromGitHub {
     owner = "daodao97";
     repo = "chatmcp";
     tag = "v${version}";
-    hash = "sha256-TA3ncOatmkX7GcaqxJ8yhdpnou2e9cQNweO+AR98Gto=";
+    hash = "sha256-Nxdnb8qGSOfczwzy1XfilMMLJN/jbFQS9F7O8YFktDk=";
   };
 
   pubspecLock = lib.importJSON ./pubspec.lock.json;

pkgs/by-name/ch/chrony/package.nix

···
         illumos
       ];
     maintainers = with lib.maintainers; [
-      fpletz
       thoughtpolice
       vifino
     ];

pkgs/by-name/cl/clickhouse/package.nix

···
       "-DENABLE_TESTS=OFF"
       "-DENABLE_DELTA_KERNEL_RS=0"
       "-DCOMPILER_CACHE=disabled"
-      "-DENABLE_EMBEDDED_COMPILER=ON"
     ]
     ++ lib.optional (
       stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64
···
       --replace-fail "<errorlog>/var/log/clickhouse-server/clickhouse-server.err.log</errorlog>" "<console>1</console>"
     substituteInPlace $out/etc/clickhouse-server/config.xml \
       --replace-fail "<level>trace</level>" "<level>warning</level>"
+  '';
+
+  # Basic smoke test
+  doCheck = true;
+  checkPhase = ''
+    $NIX_BUILD_TOP/$sourceRoot/build/programs/clickhouse local --query 'SELECT 1' | grep 1
   '';
 
   # Builds in 7+h with 2 cores, and ~20m with a big-parallel builder.

pkgs/by-name/co/codex/package.nix

···
 
   nativeBuildInputs = [
     pkg-config
+  ];
+  buildInputs = [
     openssl
   ];
 

pkgs/by-name/co/copygen/package.nix

···
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+buildGoModule (finalAttrs: {
+  pname = "copygen";
+  version = "0.4.1";
+
+  src = fetchFromGitHub {
+    owner = "switchupcb";
+    repo = "copygen";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-gdoUvTla+fRoYayUeuRha8Dkix9ACxlt0tkac0CRqwA=";
+  };
+
+  vendorHash = "sha256-dOIGGZWtr8F82YJRXibdw3MvohLFBQxD+Y4OkZIJc2s=";
+  subPackages = [ "." ];
+  proxyVendor = true;
+
+  meta = {
+    description = "Command-line and programmatic Go code generator that generates custom type-based code";
+    homepage = "https://github.com/switchupcb/copygen";
+    license = lib.licenses.agpl3Only;
+    mainProgram = "copygen";
+    maintainers = with lib.maintainers; [ connerohnesorge ];
+  };
+})

pkgs/by-name/ex/exercism/package.nix

···
 
 buildGoModule rec {
   pname = "exercism";
-  version = "3.5.5";
+  version = "3.5.6";
 
   src = fetchFromGitHub {
     owner = "exercism";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-Xz+yTCFwMKd8P3PKX8e3L+XFvt0ntZrOgxnsnrFio6g=";
+    hash = "sha256-5RUoGrR86dary5k2bMx/G3HKIDccdr/D0UVgDB/soms=";
   };
 
   vendorHash = "sha256-xY3C3emqtPIKyxIN9aEkrLXhTxWNmo0EJXNZVtbtIvs=";

pkgs/by-name/f3/f3d/package.nix

···
       url = "https://github.com/f3d-app/f3d/commit/3814f3356d888ce59bbe6eda0293c2de73b0c89a.patch";
       hash = "sha256-TeV8byIxX6PBEW06/sS7kHaSS99S88WiyzjHZ/Zh5x4=";
     })
+
+    # https://github.com/f3d-app/f3d/pull/2286
+    (fetchpatch {
+      name = "fix_assimp_6_0_configuration.patch";
+      url = "https://github.com/f3d-app/f3d/commit/9bed68ef2b5425c9600c81a7245f13ed2d4079b8.patch";
+      hash = "sha256-u4VQiTTgFSYxdJ3wvQUfSTt2fcsXBO3p15f/cNRRCHo=";
+    })
   ];
 
   nativeBuildInputs =

pkgs/by-name/fl/flutter_rust_bridge_codegen/package.nix

···
 }:
 rustPlatform.buildRustPackage rec {
   pname = "flutter_rust_bridge_codegen";
-  version = "2.10.0";
+  version = "2.11.0";
 
   src = fetchFromGitHub {
     owner = "fzyzcjy";
     repo = "flutter_rust_bridge";
     rev = "v${version}";
-    hash = "sha256-ReJmS8cfsWCD/wFEpZ+EJBFGMOQZE/zzlOYOk74UCfQ=";
+    hash = "sha256-vtdIbrVm9r8PiTYvhz4Ikj4e22jxqgEraH+YHlRS4O4=";
     fetchSubmodules = true;
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-6HVpETMnhL5gdIls46IdSkTxvJibvfiiPa6l/2GJy7k=";
+  cargoHash = "sha256-TwnibHjMDZ3aj1EDNHd/AO7nNtSnY335P3vU4iyp4SY=";
   cargoBuildFlags = "--package flutter_rust_bridge_codegen";
   cargoTestFlags = "--package flutter_rust_bridge_codegen";
 

pkgs/by-name/ha/halo/package.nix

···
 }:
 stdenv.mkDerivation rec {
   pname = "halo";
-  version = "2.21.1";
+  version = "2.21.2";
   src = fetchurl {
     url = "https://github.com/halo-dev/halo/releases/download/v${version}/halo-${version}.jar";
-    hash = "sha256-1R4xeXANk2LUbIcHEEwNOnBhKsIBkf+naB9b9VSOg9w=";
+    hash = "sha256-XYzk989eaOXU81EWUbwhLl6Fy30dbLhn4/x2wJ4I4ac=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/in/infrastructure-agent/package.nix

···
 }:
 buildGoModule rec {
   pname = "infrastructure-agent";
-  version = "1.65.0";
+  version = "1.65.1";
 
   src = fetchFromGitHub {
     owner = "newrelic";
     repo = "infrastructure-agent";
     rev = version;
-    hash = "sha256-Rc4pQQNlWXJuSVxgnzZYllEPV1/D+XgefukDPTBITnU=";
+    hash = "sha256-OHL0H2OCPd5+HenF63/ndWYkdlufrG31Xlb9Sv9EP6g=";
   };
 
   vendorHash = "sha256-eZtO+RFw+yUjIQ03y0NOiHIFLcwEwWu5A+7wsaraCCQ=";

pkgs/by-name/ka/kaidan/package.nix

···
   zxing-cpp,
   qxmpp,
   gst_all_1,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
···
     domain = "invent.kde.org";
     owner = "network";
     repo = "kaidan";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-8pC4vINeKSYY+LlVgCXUtBq9UjraPdTikBOwLBLeQ3Y=";
   };
 
···
     qtWrapperArgs+=(--prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$GST_PLUGIN_SYSTEM_PATH_1_0")
   '';
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "User-friendly and modern chat app, using XMPP";
     mainProgram = "kaidan";
···
       cc-by-sa-40
     ];
     maintainers = with lib.maintainers; [ astro ];
+    teams = with lib.teams; [ ngi ];
     platforms = with lib.platforms; linux;
   };
 })

pkgs/by-name/ki/kissat/package.nix

···
 in
 stdenv.mkDerivation rec {
   pname = "kissat";
-  version = "4.0.2";
+  version = "4.0.3";
 
   src = fetchFromGitHub {
     owner = "arminbiere";
     repo = "kissat";
     rev = "rel-${version}";
-    sha256 = "sha256-XVaWO1zHMXM83Qih3HnmIsOvM1zpefF6u9lBP420/mQ=";
+    sha256 = "sha256-IlMHtsEYafpbCNZfbeJo1JS5S5qcZQt1aDWjv+xxoqM=";
   };
 
   outputs = [

pkgs/by-name/ku/kubectl-gadget/package.nix

···
 
 buildGoModule rec {
   pname = "kubectl-gadget";
-  version = "0.41.0";
+  version = "0.42.0";
 
   src = fetchFromGitHub {
     owner = "inspektor-gadget";
     repo = "inspektor-gadget";
     rev = "v${version}";
-    hash = "sha256-q88+PTZqhJwkl5jmP9AwH/nRToU/jdOFd/Z+5RcyUYE=";
+    hash = "sha256-oLgcM5/FwZ81YpQCT3oc29nKYK9mdsSHmYS2UtAVSlw=";
   };
 
-  vendorHash = "sha256-+z9DGplQZ77knVxYUUuUHwfE9ZtnZjMKuU6nMm8sAU0=";
+  vendorHash = "sha256-pgaD6iTLhQ2tHmo+e4BtPKdK0PCKngqSQENgNAz6vRo=";
 
   env.CGO_ENABLED = 0;
 

pkgs/by-name/li/libdivecomputer/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "libdivecomputer";
-  version = "0.8.0";
+  version = "0.9.0";
 
   src = fetchurl {
     url = "https://www.libdivecomputer.org/releases/${pname}-${version}.tar.gz";
-    sha256 = "sha256-J17M55I2RO1YH6q53LTxpprSUbzrByHE5fhftjFheg4=";
+    sha256 = "sha256-p7gLkIOiETpDKA7ntR1I1m6lp3n8P+5X33xFHaAlHGU=";
   };
 
   enableParallelBuilding = true;

pkgs/by-name/ma/mautrix-whatsapp/package.nix

···
       vskilet
       ma27
       chvp
+      SchweGELBin
     ];
     mainProgram = "mautrix-whatsapp";
   };

pkgs/by-name/nc/ncspot/package.nix

···
   fetchFromGitHub,
   libpulseaudio,
   libxcb,
-  ncspot,
   ncurses,
   nix-update-script,
   openssl,
···
   portaudio,
   python3,
   rustPlatform,
-  testers,
+  versionCheckHook,
   ueberzug,
   withALSA ? stdenv.hostPlatform.isLinux,
   withClipboard ? true,
···
   withTermion ? false,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ncspot";
   version = "1.2.2";
 
   src = fetchFromGitHub {
     owner = "hrkfdn";
     repo = "ncspot";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-4zeBTi1WBy9tXowsehUo4qou6bhznWPeCXFg+R3akho=";
   };
 
-  useFetchCargoVendor = true;
   cargoHash = "sha256-c16qw2khbMXTA8IbYQnMKqivO63DwyAWKfV2P1aD7dU=";
 
   nativeBuildInputs = [ pkg-config ] ++ lib.optional withClipboard python3;
···
     install -D --mode=444 $src/images/logo.svg $out/share/icons/hicolor/scalable/apps/ncspot.svg
   '';
 
-  passthru = {
-    tests.version = testers.testVersion { package = ncspot; };
-    updateScript = nix-update-script { };
-  };
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
 
   meta = {
     description = "Cross-platform ncurses Spotify client written in Rust, inspired by ncmpc and the likes";
     homepage = "https://github.com/hrkfdn/ncspot";
-    changelog = "https://github.com/hrkfdn/ncspot/releases/tag/v${version}";
+    changelog = "https://github.com/hrkfdn/ncspot/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.bsd2;
     maintainers = with lib.maintainers; [
       liff
···
     ];
     mainProgram = "ncspot";
   };
-}
+})

pkgs/by-name/od/odin/package.nix

···
 
   patches = [
     ./darwin-remove-impure-links.patch
+    # The default behavior is to use the statically linked Raylib libraries,
+    # but GLFW still attempts to load Xlib at runtime, which won't normally be
+    # available on Nix based systems. Instead, use the "system" Raylib version,
+    # which can be provided by a pure Nix expression, for example in a shell.
+    ./system-raylib.patch
   ];
   postPatch = ''
+    rm -r vendor/raylib/{linux,macos,macos-arm64,wasm,windows}
+
     patchShebangs --build build_odin.sh
   '';
 
···
     mainProgram = "odin";
     maintainers = with lib.maintainers; [
       astavie
+      diniamo
     ];
     platforms = lib.platforms.unix;
     broken = stdenv.hostPlatform.isMusl;

pkgs/by-name/od/odin/system-raylib.patch

···
+diff --git a/vendor/raylib/raygui.odin b/vendor/raylib/raygui.odin
+index 559437a60..cd31fbe43 100644
+--- a/vendor/raylib/raygui.odin
++++ b/vendor/raylib/raygui.odin
+@@ -2,34 +2,7 @@ package raylib
+ 
+ import "core:c"
+ 
+-RAYGUI_SHARED :: #config(RAYGUI_SHARED, false)
+-RAYGUI_WASM_LIB :: #config(RAYGUI_WASM_LIB, "wasm/libraygui.a")
+-
+-when ODIN_OS == .Windows {
+-	foreign import lib {
+-		"windows/rayguidll.lib" when RAYGUI_SHARED else "windows/raygui.lib",
+-	}
+-} else when ODIN_OS == .Linux  {
+-	foreign import lib {
+-		"linux/libraygui.so" when RAYGUI_SHARED else "linux/libraygui.a",
+-	}
+-} else when ODIN_OS == .Darwin {
+-	when ODIN_ARCH == .arm64 {
+-		foreign import lib {
+-			"macos-arm64/libraygui.dylib" when RAYGUI_SHARED else "macos-arm64/libraygui.a",
+-		}
+-	} else {
+-		foreign import lib {
+-			"macos/libraygui.dylib" when RAYGUI_SHARED else "macos/libraygui.a",
+-		}
+-	}
+-} else when ODIN_ARCH == .wasm32 || ODIN_ARCH == .wasm64p32 {
+-	foreign import lib {
+-		RAYGUI_WASM_LIB,
+-	}
+-} else {
+-	foreign import lib "system:raygui"
+-}
++foreign import lib "system:raygui"
+ 
+ RAYGUI_VERSION :: "4.0"
+ 
+diff --git a/vendor/raylib/raylib.odin b/vendor/raylib/raylib.odin
+index 02bb6deea..0df93009b 100644
+--- a/vendor/raylib/raylib.odin
++++ b/vendor/raylib/raylib.odin
+@@ -99,42 +99,7 @@ MAX_TEXT_BUFFER_LENGTH :: #config(RAYLIB_MAX_TEXT_BUFFER_LENGTH, 1024)
+ 
+ #assert(size_of(rune) == size_of(c.int))
+ 
+-RAYLIB_SHARED :: #config(RAYLIB_SHARED, false)
+-RAYLIB_WASM_LIB :: #config(RAYLIB_WASM_LIB, "wasm/libraylib.a")
+-
+-when ODIN_OS == .Windows {
+-	@(extra_linker_flags="/NODEFAULTLIB:" + ("msvcrt" when RAYLIB_SHARED else "libcmt"))
+-	foreign import lib {
+-		"windows/raylibdll.lib" when RAYLIB_SHARED else "windows/raylib.lib" ,
+-		"system:Winmm.lib",
+-		"system:Gdi32.lib",
+-		"system:User32.lib",
+-		"system:Shell32.lib",
+-	}
+-} else when ODIN_OS == .Linux  {
+-	foreign import lib {
+-		// Note(bumbread): I'm not sure why in `linux/` folder there are
+-		// multiple copies of raylib.so, but since these bindings are for
+-		// particular version of the library, I better specify it. Ideally,
+-		// though, it's best specified in terms of major (.so.4)
+-		"linux/libraylib.so.550" when RAYLIB_SHARED else "linux/libraylib.a",
+-		"system:dl",
+-		"system:pthread",
+-	}
+-} else when ODIN_OS == .Darwin {
+-	foreign import lib {
+-		"macos/libraylib.550.dylib" when RAYLIB_SHARED else "macos/libraylib.a",
+-		"system:Cocoa.framework",
+-		"system:OpenGL.framework",
+-		"system:IOKit.framework",
+-	} 
+-} else when ODIN_ARCH == .wasm32 || ODIN_ARCH == .wasm64p32 {
+-	foreign import lib {
+-		RAYLIB_WASM_LIB,
+-	}
+-} else {
+-	foreign import lib "system:raylib"
+-}
++foreign import lib "system:raylib"
+ 
+ VERSION_MAJOR :: 5
+ VERSION_MINOR :: 5
+diff --git a/vendor/raylib/rlgl/rlgl.odin b/vendor/raylib/rlgl/rlgl.odin
+index 6ac19695d..78a483a59 100644
+--- a/vendor/raylib/rlgl/rlgl.odin
++++ b/vendor/raylib/rlgl/rlgl.odin
+@@ -112,47 +112,12 @@ import rl "../."
+ 
+ VERSION :: "5.0"
+ 
+-RAYLIB_SHARED :: #config(RAYLIB_SHARED, false)
+-RAYLIB_WASM_LIB :: #config(RAYLIB_WASM_LIB, "../wasm/libraylib.a")
+-
+ // Note: We pull in the full raylib library. If you want a truly stand-alone rlgl, then:
+ // - Compile a separate rlgl library and use that in the foreign import blocks below.
+ // - Remove the `import rl "../."` line
+ // - Copy the code from raylib.odin for any types we alias from that package (see PixelFormat etc)
+ 
+-when ODIN_OS == .Windows {
+-	@(extra_linker_flags="/NODEFAULTLIB:" + ("msvcrt" when RAYLIB_SHARED else "libcmt"))
+-	foreign import lib {
+-		"../windows/raylibdll.lib" when RAYLIB_SHARED else "../windows/raylib.lib" ,
+-		"system:Winmm.lib",
+-		"system:Gdi32.lib",
+-		"system:User32.lib",
+-		"system:Shell32.lib",
+-	}
+-} else when ODIN_OS == .Linux  {
+-	foreign import lib {
+-		// Note(bumbread): I'm not sure why in `linux/` folder there are
+-		// multiple copies of raylib.so, but since these bindings are for
+-		// particular version of the library, I better specify it. Ideally,
+-		// though, it's best specified in terms of major (.so.4)
+-		"../linux/libraylib.so.550" when RAYLIB_SHARED else "../linux/libraylib.a",
+-		"system:dl",
+-		"system:pthread",
+-	}
+-} else when ODIN_OS == .Darwin {
+-	foreign import lib {
+-		"../macos/libraylib.550.dylib" when RAYLIB_SHARED else "../macos/libraylib.a",
+-		"system:Cocoa.framework",
+-		"system:OpenGL.framework",
+-		"system:IOKit.framework",
+-	} 
+-} else when ODIN_ARCH == .wasm32 || ODIN_ARCH == .wasm64p32 {
+-	foreign import lib {
+-		RAYLIB_WASM_LIB,
+-	}
+-} else {
+-	foreign import lib "system:raylib"
+-}
++foreign import lib "system:raylib"
+ 
+ GRAPHICS_API_OPENGL_11  :: false
+ GRAPHICS_API_OPENGL_21  :: true

pkgs/by-name/pe/petsc/package.nix

···
     homepage = "https://petsc.org/release/";
     license = lib.licenses.bsd2;
     platforms = lib.platforms.unix;
-    maintainers = with lib.maintainers; [
-      cburstedde
-      qbisi
-    ];
+    maintainers = with lib.maintainers; [ qbisi ];
   };
 })

pkgs/by-name/pp/pphack/package.nix

···
   lib,
   buildGoModule,
   fetchFromGitHub,
+  versionCheckHook,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "pphack";
   version = "0.1.0";
 
   src = fetchFromGitHub {
     owner = "edoardottt";
     repo = "pphack";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-SWMY+t8NzbUqAeLsqia5KAXXOjoMRMZVVa8YdTLcG5A=";
   };
 
   vendorHash = "sha256-smJp3GDo1KOrEjEJnxtyrlHmb/L70QqhDWjCZ4U1qJs=";
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
 
   ldflags = [
     "-s"
     "-w"
   ];
 
+  doInstallCheck = true;
+
   meta = {
     description = "Client-Side Prototype Pollution Scanner";
     homepage = "https://github.com/edoardottt/pphack";
-    changelog = "https://github.com/edoardottt/pphack/releases/tag/${src.tag}";
+    changelog = "https://github.com/edoardottt/pphack/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "pphack";
   };
-}
+})

pkgs/by-name/rp/rpi-imager/package.nix

···
       (lib.cmakeBool "ENABLE_TELEMETRY" false)
     ];
 
+  qtWrapperArgs = [
+    "--unset QT_QPA_PLATFORMTHEME"
+    "--unset QT_STYLE_OVERRIDE"
+  ];
+
   passthru = {
     tests.version = testers.testVersion {
       package = finalAttrs.finalPackage;

pkgs/by-name/se/send/package.nix

···
 }:
 buildNpmPackage rec {
   pname = "send";
-  version = "3.4.25";
+  version = "3.4.27";
 
   src = fetchFromGitHub {
     owner = "timvisee";
     repo = "send";
     tag = "v${version}";
-    hash = "sha256-2XeChKJi57auIf9aSe2JlP55tiE8dmrCBtUfCkziYi8=";
+    hash = "sha256-tfntox8Sw3xzlCOJgY/LThThm+mptYY5BquYDjzHonQ=";
   };
 
-  npmDepsHash = "sha256-DY+4qOzoURx8xmemhutxcNxg0Tv2u6tyJHK5RhBjo8w=";
+  npmDepsHash = "sha256-ZVegUECrwkn/DlAwqx5VDmcwEIJV/jAAV99Dq29Tm2w=";
 
   nativeBuildInputs = [
     makeBinaryWrapper

pkgs/by-name/si/signalbackup-tools/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "signalbackup-tools";
-  version = "20250630-2";
+  version = "20250701-1";
 
   src = fetchFromGitHub {
     owner = "bepaald";
     repo = "signalbackup-tools";
     rev = version;
-    hash = "sha256-/zbBiVWqHoKG2h6ExIDIP6ZQH1F8LByZYWbx8wysGDw=";
+    hash = "sha256-lkVbDtdvgaPIHOf/TrDVaFP1W5EvuyQ5X+HfTc6CbeQ=";
   };
 
   nativeBuildInputs =

pkgs/by-name/sp/spire/package.nix

···
 
 buildGoModule (finalAttrs: {
   pname = "spire";
-  version = "1.12.3";
+  version = "1.12.4";
 
   outputs = [
     "out"
···
     owner = "spiffe";
     repo = "spire";
     tag = "v${finalAttrs.version}";
-    sha256 = "sha256-ZtSJ5/Qg4r2dkFGM/WiDWwQc2OtkX45kGXTdXU35Cng=";
+    sha256 = "sha256-gyACFRoA0WwIea4GRmKvZlC83YGtjyZROH6QB0GyHOg=";
   };
 
-  vendorHash = "sha256-1ngjcqGwUNMyR/wBCo0MYguD1gGH8rbI2j9BB+tGL9k=";
+  vendorHash = "sha256-yWONqvSNOgeXkYU5TX1Sec8xNCnaqdVLXk3ylhGBvyE=";
 
   ldflags = [
     "-s"

pkgs/by-name/te/telepresence2/package.nix

···
 in
 buildGoModule rec {
   pname = "telepresence2";
-  version = "2.23.2";
+  version = "2.23.3";
 
   src = fetchFromGitHub {
     owner = "telepresenceio";
     repo = "telepresence";
     rev = "v${version}";
-    hash = "sha256-xEPR7AXFcKWv3edblWngZah0ujkqIaEizFpLKEA3GpI=";
+    hash = "sha256-T0ywV3wg1t15yF7YoXMt2If+CVKr/GI6nsgXYaVILeo=";
   };
 
   propagatedBuildInputs = [
···
     export CGO_ENABLED=0
   '';
 
-  vendorHash = "sha256-7FMcKjovVL3mnZ3HUWeALJ8efsmbvoQcCgfX9g0X60A=";
+  vendorHash = "sha256-hO+Zw7l1ktDJe1RMjyFEvYPaUdafEYgEeeYAXJtL43E=";
 
   ldflags = [
     "-s"

pkgs/by-name/te/terraform-iam-policy-validator/package.nix

···
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "terraform-iam-policy-validator";
+  version = "0.0.9";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "awslabs";
+    repo = "terraform-iam-policy-validator";
+    tag = "v${version}";
+    hash = "sha256-RGZqnt2t+aSNGt8Ubi2dzZE04n9Zfkw+T3Zmol/FO+I=";
+  };
+
+  build-system = with python3Packages; [ poetry-core ];
+
+  dependencies = with python3Packages; [
+    boto3
+    pyyaml
+  ];
+
+  nativeCheckInputs = with python3Packages; [ pytestCheckHook ];
+
+  # Some tests require network
+  disabledTestPaths = [ "test/test_accessAnalyzer.py" ];
+
+  # Tests need to be run relative to a subdir
+  preCheck = ''
+    pushd iam_check
+  '';
+  postCheck = ''
+    popd
+  '';
+
+  pythonImportsCheck = [ "iam_check" ];
+
+  meta = {
+    description = "CLI tool that validates AWS IAM Policies in a Terraform template against AWS IAM best practices";
+    homepage = "https://github.com/awslabs/terraform-iam-policy-validator";
+    changelog = "https://github.com/awslabs/terraform-iam-policy-validator/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jherland ];
+    mainProgram = "tf-policy-validator";
+  };
+}

pkgs/by-name/ur/uriparser/package.nix

···
 {
   lib,
   stdenv,
-  fetchurl,
+  fetchFromGitHub,
   cmake,
   gtest,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "uriparser";
   version = "0.9.8";
 
-  # Release tarball differs from source tarball
-  src = fetchurl {
-    url = "https://github.com/uriparser/uriparser/releases/download/${pname}-${version}/${pname}-${version}.tar.bz2";
-    hash = "sha256-ctG1Wb46GAb3iKPZvjShsGPUKqI4spuk7mM9bv/NM70=";
+  src = fetchFromGitHub {
+    owner = "uriparser";
+    repo = "uriparser";
+    tag = "uriparser-${finalAttrs.version}";
+    hash = "sha256-U/AM8ULKGDfL3t+VUcn+t9sn4z/uc+pDjf2HHwHLI2M=";
   };
 
   nativeBuildInputs = [ cmake ];
 
   cmakeFlags = [
-    "-DURIPARSER_BUILD_DOCS=OFF"
-  ] ++ lib.optional (!doCheck) "-DURIPARSER_BUILD_TESTS=OFF";
+    (lib.cmakeBool "URIPARSER_BUILD_DOCS" false)
+    (lib.cmakeBool "URIPARSER_BUILD_TESTS" finalAttrs.finalPackage.doCheck)
+  ];
 
   nativeCheckInputs = [ gtest ];
-  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
 
   meta = {
-    changelog = "https://github.com/uriparser/uriparser/blob/uriparser-${version}/ChangeLog";
+    changelog = "https://github.com/uriparser/uriparser/blob/uriparser-${finalAttrs.version}/ChangeLog";
     description = "Strictly RFC 3986 compliant URI parsing library";
     longDescription = ''
       uriparser is a strictly RFC 3986 compliant URI parsing and handling library written in C.
···
     mainProgram = "uriparse";
     platforms = lib.platforms.unix;
   };
-}
+})

pkgs/by-name/xp/xplr/package.nix

···
 }:
 rustPlatform.buildRustPackage rec {
   pname = "xplr";
-  version = "1.0.0";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "sayanarijit";
     repo = "xplr";
     rev = "v${version}";
-    hash = "sha256-QeR7KXwRGfAU31ueI6v26pKnoQdj2C7bXlcMP4qKvZg=";
+    hash = "sha256-78MHWdvWxXGcptMW3AUTYrpfdAai59x1KnW4uMaUZC8=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-UkyRl2eY520JPxtcOl7hvkY3MCH2bi2jL9zCJEdkQmU=";
+  cargoHash = "sha256-qC9KutkGLUuG7xQeO/Vg3oRqh8hCQuHisJA5diYizAg=";
 
   # fixes `thread 'main' panicked at 'cannot find strip'` on x86_64-darwin
   env = lib.optionalAttrs (stdenv.hostPlatform.isx86_64 && stdenv.hostPlatform.isDarwin) {

pkgs/development/libraries/science/math/p4est-sc/default.nix

···
     homepage = "https://www.p4est.org/";
     downloadPage = "https://github.com/cburstedde/libsc.git";
     license = lib.licenses.lgpl21Plus;
-    maintainers = [ lib.maintainers.cburstedde ];
+    maintainers = [ ];
   };
 }

pkgs/development/libraries/science/math/p4est/default.nix

···
     homepage = "https://www.p4est.org/";
     downloadPage = "https://github.com/cburstedde/p4est.git";
     license = lib.licenses.gpl2Plus;
-    maintainers = [ lib.maintainers.cburstedde ];
+    maintainers = [ ];
   };
 }

pkgs/development/python-modules/aider-chat/default.nix

···
     d.stopwords
   ]);
 
-  version = "0.85.0";
+  version = "0.85.1";
   aider-chat = buildPythonPackage {
     pname = "aider-chat";
     inherit version;
···
       owner = "Aider-AI";
       repo = "aider";
       tag = "v${version}";
-      hash = "sha256-ZYjDRu4dAOkmz+fMOG8KU6y27RI/t3iEoTSUebundqo=";
+      hash = "sha256-T2v07AFhrpq9a3XEU2B2orSu0afZFUsb3FRTBcJHDoQ=";
     };
 
     pythonRelaxDeps = true;

pkgs/development/python-modules/arch/default.nix

···
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  cython,
+  numpy,
+  pandas,
+  property-cached,
+  pytestCheckHook,
+  scipy,
+  setuptools,
+  setuptools-scm,
+  statsmodels,
+}:
+
+buildPythonPackage rec {
+  pname = "arch";
+  version = "7.2.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "bashtage";
+    repo = "arch";
+    tag = "v${version}";
+    hash = "sha256-3H/6mdPg8rg+N1wecqLDzc7Ot3SnUVpOagns4PsTD/Q=";
+  };
+
+  postPatch = ''
+    substituteInPlace setup.cfg \
+      --replace 'PytestRemovedIn8Warning' 'PytestRemovedIn9Warning'
+  '';
+
+  build-system = [
+    setuptools
+    setuptools-scm
+    cython
+  ];
+
+  dependencies = [
+    numpy
+    pandas
+    property-cached
+    scipy
+    statsmodels
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  disabledTestPaths = [
+    # Skip long-running/failing tests
+    "arch/tests/univariate/test_forecast.py"
+    "arch/tests/univariate/test_mean.py"
+  ];
+
+  pythonImportsCheck = [ "arch" ];
+
+  meta = {
+    description = "Autoregressive Conditional Heteroskedasticity (ARCH) and other tools for financial econometrics";
+    homepage = "https://github.com/bashtage/arch";
+    changelog = "https://github.com/bashtage/arch/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jherland ];
+  };
+}

pkgs/development/python-modules/bilibili-api-python/default.nix

···
 }:
 buildPythonPackage rec {
   pname = "bilibili-api-python";
-  version = "17.2.1";
+  version = "17.3.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "bilibili_api_python";
     inherit version;
-    hash = "sha256-ln+HNgcw3KPpOF9Ei8Ta4vrb+tGKsE4/vSim/ioKpgI=";
+    hash = "sha256-Rlnz3ws023x5MiwabGR4gARH0bdUgucoixIMRqj+Z64=";
   };
 
   # The upstream uses requirements.txt, which overly strict version constraints.

pkgs/development/python-modules/finvizfinance/default.nix

···
 
 buildPythonPackage rec {
   pname = "finvizfinance";
-  version = "1.1.0";
+  version = "1.1.1";
   pyproject = true;
 
   disabled = pythonOlder "3.5";
···
     owner = "lit26";
     repo = "finvizfinance";
     tag = "v${version}";
-    hash = "sha256-HCxq8jCT3aHOXeYue7KP5sYzO6nJnB9Sy8gKGZpZHbc=";
+    hash = "sha256-QVR0ig51EHdMVzg6wBDpvMGjPnmO2ZGBs2Q0SVxauik=";
   };
 
   build-system = [ setuptools ];
···
   meta = with lib; {
     description = "Finviz Finance information downloader";
     homepage = "https://github.com/lit26/finvizfinance";
-    changelog = "https://github.com/lit26/finvizfinance/releases/tag/v${version}";
+    changelog = "https://github.com/lit26/finvizfinance/releases/tag/${src.tag}";
     license = licenses.mit;
     maintainers = with maintainers; [ icyrockcom ];
   };

pkgs/development/python-modules/paddleocr/default.nix

···
 
 buildPythonPackage rec {
   pname = "paddleocr";
-  version = "3.0.3";
+  version = "3.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "PaddlePaddle";
     repo = "PaddleOCR";
     tag = "v${version}";
-    hash = "sha256-K01RIyxlh9gp0RerGkqY/AiUy6/u1GAICwj2oz27muw=";
+    hash = "sha256-h564ngDxJjJSgx8AmrGhte8odms5zcqDVR2EaBmXIDI=";
   };
 
   patches = [

pkgs/development/python-modules/posthog/default.nix

···
 
 buildPythonPackage rec {
   pname = "posthog";
-  version = "5.4.0";
+  version = "6.0.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "PostHog";
     repo = "posthog-python";
     tag = "v${version}";
-    hash = "sha256-UUINopWw2q5INuFiveI5si7jPRLT0Mad3hnfbykHs6M=";
+    hash = "sha256-6ZSQFcwuHDgCv301D/7/3QjF9+ZaxXPItvoA+6x0O4U=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/presto-python-client/default.nix

···
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  click,
+  future,
+  httpretty,
+  pytestCheckHook,
+  requests,
+  requests-kerberos,
+  setuptools,
+  six,
+}:
+
+buildPythonPackage rec {
+  pname = "presto-python-client";
+  version = "0.8.4";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "prestodb";
+    repo = "presto-python-client";
+    tag = version;
+    hash = "sha256-ZpVcmX6jRu4PJ1RxtIR8i0EpfhhhP8HZVVkB7CWLrsM=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    click
+    future
+    requests
+    requests-kerberos
+    six
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    httpretty
+  ];
+
+  # Integration tests require network access
+  disabledTestPaths = [ "integration_tests" ];
+
+  pythonImportsCheck = [ "prestodb" ];
+
+  meta = {
+    description = "Client for Presto (https://prestodb.io), a distributed SQL engine for interactive and batch big data processing";
+    homepage = "https://github.com/prestodb/presto-python-client";
+    changelog = "https://github.com/prestodb/presto-python-client/releases/tag/${version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ jherland ];
+  };
+}

pkgs/development/python-modules/pyreadstat/default.nix

···
 
 buildPythonPackage rec {
   pname = "pyreadstat";
-  version = "1.2.9";
+  version = "1.3.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
···
     owner = "Roche";
     repo = "pyreadstat";
     tag = "v${version}";
-    hash = "sha256-4SdA4yYf3ha42ktyObTa2eOG16sq5tq+7Iyi16V00bw=";
+    hash = "sha256-ZcdCUX8mNBipOV5k+y7WdgxCZLfsZZlClyeuL8sQ6BI=";
   };
 
   build-system = [

pkgs/development/python-modules/pytubefix/default.nix

···
 
 buildPythonPackage rec {
   pname = "pytubefix";
-  version = "9.2.0";
+  version = "9.2.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "JuanBindez";
     repo = "pytubefix";
     tag = "v${version}";
-    hash = "sha256-Jnqgttcz6HuZ8PpTQMspFu6CTtdqUzOkuKiiNivxE1s=";
+    hash = "sha256-Abx4VIA8dnEZpl86IyGJYSR8n6sPmtCTq5eJbqKyNRM=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/warp-lang/darwin-libcxx.patch

···
 diff --git a/warp/build_dll.py b/warp/build_dll.py
-index 4d411e1b..a9304c6a 100644
+index 2218ff13..53786017 100644
 --- a/warp/build_dll.py
 +++ b/warp/build_dll.py
-@@ -316,6 +316,8 @@ def build_dll_for_arch(args, dll_path, cpp_paths, cu_path, libs, arch, mode=None
+@@ -408,6 +408,7 @@ def build_dll_for_arch(args, dll_path, cpp_paths, cu_path, arch, libs: Optional[
+         cpp_includes += f' -I"{warp_home_path.parent}/_build/host-deps/llvm-project/release-{arch}/include"'
          cuda_includes = f' -I"{cuda_home}/include"' if cu_path else ""
          includes = cpp_includes + cuda_includes
- 
 +        includes += " -isystem @LIBCXX_DEV@/include/c++/v1"
-+
+ 
          if sys.platform == "darwin":
              version = f"--target={arch}-apple-macos11"
-         else:
-@@ -345,6 +347,8 @@ def build_dll_for_arch(args, dll_path, cpp_paths, cu_path, libs, arch, mode=None
-                 build_cmd = f'g++ {cpp_flags} -c "{cpp_path}" -o "{cpp_out}"'
+@@ -441,6 +442,7 @@ def build_dll_for_arch(args, dll_path, cpp_paths, cu_path, arch, libs: Optional[
+                 build_cmd = f'{cpp_compiler} {cpp_flags} -c "{cpp_path}" -o "{cpp_out}"'
                  run_cmd(build_cmd)
  
 +        ld_inputs.append('-L"@LIBCXX_LIB@/lib" -lc++')
-+
          if cu_path:
              cu_out = cu_path + ".o"
  

pkgs/development/python-modules/warp-lang/darwin-single-target.patch

···
 diff --git a/build_llvm.py b/build_llvm.py
-index 9d5a26a7..0be02a89 100644
+index aee0a9f1..bf281f6d 100644
 --- a/build_llvm.py
 +++ b/build_llvm.py
-@@ -389,15 +389,4 @@ def build_warp_clang_for_arch(args, lib_name, arch):
- 
+@@ -402,16 +402,4 @@ def build_warp_clang_for_arch(args, lib_name: str, arch: str) -> None:
  
- def build_warp_clang(args, lib_name):
+ def build_warp_clang(args, lib_name: str) -> None:
+     """Build the CPU-only Warp library using Clang/LLVM."""
+-
 -    if sys.platform == "darwin":
 -        # create a universal binary by combining x86-64 and AArch64 builds
 -        build_warp_clang_for_arch(args, lib_name + "-x86_64", "x86_64")
···
 -        build_warp_clang_for_arch(args, lib_name, machine_architecture())
 +    build_warp_clang_for_arch(args, lib_name, machine_architecture())
 diff --git a/warp/build_dll.py b/warp/build_dll.py
-index 4d411e1b..4cf4a6c2 100644
+index 2218ff13..c0d978ce 100644
 --- a/warp/build_dll.py
 +++ b/warp/build_dll.py
-@@ -317,7 +317,7 @@ def build_dll_for_arch(args, dll_path, cpp_paths, cu_path, libs, arch, mode=None
+@@ -410,7 +410,7 @@ def build_dll_for_arch(args, dll_path, cpp_paths, cu_path, arch, libs: Optional[
          includes = cpp_includes + cuda_includes
  
          if sys.platform == "darwin":
 -            version = f"--target={arch}-apple-macos11"
 +            version = ""
          else:
-             version = "-fabi-version=13"  # GCC 8.2+
+             if cpp_compiler == "g++":
+                 version = "-fabi-version=13"  # GCC 8.2+
+@@ -491,14 +491,4 @@ def build_dll_for_arch(args, dll_path, cpp_paths, cu_path, arch, libs: Optional[
  
-@@ -392,14 +392,4 @@ def build_dll(args, dll_path, cpp_paths, cu_path, libs=None):
-     if libs is None:
-         libs = []
  
+ def build_dll(args, dll_path, cpp_paths, cu_path, libs=None):
 -    if sys.platform == "darwin":
 -        # create a universal binary by combining x86-64 and AArch64 builds
--        build_dll_for_arch(args, dll_path + "-x86_64", cpp_paths, cu_path, libs, "x86_64")
--        build_dll_for_arch(args, dll_path + "-aarch64", cpp_paths, cu_path, libs, "aarch64")
+-        build_dll_for_arch(args, dll_path + "-x86_64", cpp_paths, cu_path, "x86_64", libs)
+-        build_dll_for_arch(args, dll_path + "-aarch64", cpp_paths, cu_path, "aarch64", libs)
 -
 -        run_cmd(f"lipo -create -output {dll_path} {dll_path}-x86_64 {dll_path}-aarch64")
 -        os.remove(f"{dll_path}-x86_64")
 -        os.remove(f"{dll_path}-aarch64")
 -
 -    else:
--        build_dll_for_arch(args, dll_path, cpp_paths, cu_path, libs, machine_architecture())
-+    build_dll_for_arch(args, dll_path, cpp_paths, cu_path, libs, machine_architecture())
+-        build_dll_for_arch(args, dll_path, cpp_paths, cu_path, machine_architecture(), libs)
++    build_dll_for_arch(args, dll_path, cpp_paths, cu_path, machine_architecture(), libs)

pkgs/development/python-modules/warp-lang/default.nix

···
   effectiveStdenv = if cudaSupport then cudaPackages.backendStdenv else args.stdenv;
   stdenv = builtins.throw "Use effectiveStdenv instead of stdenv directly, as it may be replaced by cudaPackages.backendStdenv";
 
-  version = "1.7.2.post1";
+  version = "1.8.0";
 
   libmathdx = effectiveStdenv.mkDerivation (finalAttrs: {
     # NOTE: The version used should match the version Warp requires:
-    # https://github.com/NVIDIA/warp/blob/4ad209076ce09668b18dedc74dce0d5cf8b9e409/deps/libmathdx-deps.packman.xml
+    # https://github.com/NVIDIA/warp/blob/${version}/deps/libmathdx-deps.packman.xml
     pname = "libmathdx";
-    version = "0.1.2";
+    version = "0.2.1";
 
     outputs = [
       "out"
···
           effectiveStdenv.hostPlatform.parsed.cpu.name
           finalAttrs.version
         ];
+
+        # nix-hash --type sha256 --to-sri $(nix-prefetch-url "https://...")
         hashes = {
-          aarch64-linux = "sha256-7HEXfzxPF62q/7pdZidj4eO09u588yxcpSu/bWot/9A=";
-          x86_64-linux = "sha256-MImBFv+ooRSUqdL/YEe/bJIcVBnHMCk7SLS5eSeh0cQ=";
+          aarch64-linux = "sha256-smB13xev2TG1xUx4+06KRgYEnPMczpjBOOX7uC1APbE=";
+          x86_64-linux = "sha256-+3TbLuL5Y2flLRicQgPVLs8KZQBqNYJYJ8P3etgX7g0=";
         };
       in
       lib.mapNullable (
···
     dontConfigure = true;
     dontBuild = true;
 
-    # NOTE: The leading component is stripped because the 0.1.2 release is within the `libmathdx` directory.
     installPhase = ''
       runHook preInstall
 
       mkdir -p "$out"
-      tar -xzf "$src" --strip-components=1 -C "$out"
+      tar -xzf "$src" -C "$out"
 
       mkdir -p "$static"
       moveToOutput "lib/libmathdx_static.a" "$static"
···
     owner = "NVIDIA";
     repo = "warp";
     tag = "v${version}";
-    hash = "sha256-cT0CrD71nNZnQMimGrmnSQl6RQx4MiUv2xBFPWNI/0s=";
+    hash = "sha256-zCRB92acxOiIFGjfRh2Cr1qq8pbhm+Rd011quMP/D88=";
   };
 
   patches =
···
 
   postPatch =
     # Patch build_dll.py to use our gencode flags rather than NVIDIA's very broad defaults.
-    # NOTE: After 1.7.2, patching will need to be updated like this:
-    # https://github.com/ConnorBaker/cuda-packages/blob/2fc8ba8c37acee427a94cdd1def55c2ec701ad82/pkgs/development/python-modules/warp/default.nix#L56-L65
     lib.optionalString cudaSupport ''
       nixLog "patching $PWD/warp/build_dll.py to use our gencode flags"
       substituteInPlace "$PWD/warp/build_dll.py" \
-        --replace-fail \
-          'nvcc_opts = gencode_opts + [' \
-          'nvcc_opts = [ ${
-            lib.concatMapStringsSep ", " (gencodeString: ''"${gencodeString}"'') cudaPackages.flags.gencode
-          }, '
+          --replace-fail \
+            '*gencode_opts,' \
+            '${
+              lib.concatMapStringsSep ", " (gencodeString: ''"${gencodeString}"'') cudaPackages.flags.gencode
+            },' \
+          --replace-fail \
+            '*clang_arch_flags,' \
+            '${
+              lib.concatMapStringsSep ", " (
+                realArch: ''"--cuda-gpu-arch=${realArch}"''
+              ) cudaPackages.flags.realArches
+            },'
     ''
     # Patch build_dll.py to use dynamic libraries rather than static ones.
     # NOTE: We do not patch the `nvptxcompiler_static` path because it is not available as a dynamic library.
···
         --replace-fail \
           '-lmathdx_static' \
           '-lmathdx'
-    ''
-    + ''
-      nixLog "patching $PWD/warp/build_dll.py to use our C++ compiler"
-      substituteInPlace "$PWD/warp/build_dll.py" \
-        --replace-fail "g++" "c++"
     ''
     # Broken tests on aarch64. Since unittest doesn't support disabling a
     # single test, and pytest isn't compatible, we patch the test file directly
···
           'add_function_test(TestFem, "test_integrate_gradient", test_integrate_gradient, devices=devices)' \
           ""
     ''
+    # AssertionError: 0.4082476496696472 != 0.40824246406555176 within 5 places
+    + lib.optionalString effectiveStdenv.hostPlatform.isDarwin ''
+      nixLog "patching $PWD/warp/tests/test_fem.py to disable broken tests on darwin"
+      substituteInPlace "$PWD/warp/tests/test_codegen.py" \
+        --replace-fail \
+          'places=5' \
+          'places=4'
+    ''
     # These tests fail on CPU and CUDA.
     + ''
       nixLog "patching $PWD/warp/tests/test_reload.py to disable broken tests"
···
   preBuild =
     let
       buildOptions =
-        lib.optionals (!standaloneSupport) [
+        lib.optionals effectiveStdenv.cc.isClang [
+          "--clang_build_toolchain"
+        ]
+        ++ lib.optionals (!standaloneSupport) [
           "--no_standalone"
         ]
         ++ lib.optionals cudaSupport [

pkgs/development/python-modules/warp-lang/standalone-cxx11-abi.patch

···
 diff --git a/build_llvm.py b/build_llvm.py
-index 9d5a26a7..839909ad 100644
+index aee0a9f1..5e1c3557 100644
 --- a/build_llvm.py
 +++ b/build_llvm.py
-@@ -161,7 +161,6 @@ def build_from_source_for_arch(args, arch, llvm_source):
+@@ -171,7 +171,6 @@ def build_llvm_clang_from_source_for_arch(args, arch: str, llvm_source: str) ->
          "-D", "LLVM_INCLUDE_TESTS=FALSE",
          "-D", "LLVM_INCLUDE_TOOLS=TRUE",  # Needed by Clang
          "-D", "LLVM_INCLUDE_UTILS=FALSE",
···
          "-D", f"LLVM_HOST_TRIPLE={host_triple}",
          "-D", f"CMAKE_OSX_ARCHITECTURES={osx_architectures}",
 diff --git a/warp/build_dll.py b/warp/build_dll.py
-index 4d411e1b..4177725b 100644
+index 2218ff13..2354f69f 100644
 --- a/warp/build_dll.py
 +++ b/warp/build_dll.py
-@@ -321,7 +321,7 @@ def build_dll_for_arch(args, dll_path, cpp_paths, cu_path, libs, arch, mode=None
-         else:
-             version = "-fabi-version=13"  # GCC 8.2+
-
--        cpp_flags = f'{version} --std=c++17 -fno-rtti -D{cuda_enabled} -D{mathdx_enabled} -D{cuda_compat_enabled} -fPIC -fvisibility=hidden -D_GLIBCXX_USE_CXX11_ABI=0 -I"{native_dir}" {includes} '
-+        cpp_flags = f'{version} --std=c++17 -fno-rtti -D{cuda_enabled} -D{mathdx_enabled} -D{cuda_compat_enabled} -fPIC -fvisibility=hidden -I"{native_dir}" {includes} '
-
+@@ -417,7 +417,7 @@ def build_dll_for_arch(args, dll_path, cpp_paths, cu_path, arch, libs: Optional[
+             else:
+                 version = ""
+ 
+-        cpp_flags = f'-Werror -Wuninitialized {version} --std=c++17 -fno-rtti -D{cuda_enabled} -D{mathdx_enabled} -D{cuda_compat_enabled} -fPIC -fvisibility=hidden -D_GLIBCXX_USE_CXX11_ABI=0 -I"{native_dir}" {includes} '
++        cpp_flags = f'-Werror -Wuninitialized {version} --std=c++17 -fno-rtti -D{cuda_enabled} -D{mathdx_enabled} -D{cuda_compat_enabled} -fPIC -fvisibility=hidden -I"{native_dir}" {includes} '
+ 
          if mode == "debug":
              cpp_flags += "-O0 -g -D_DEBUG -DWP_ENABLE_DEBUG=1 -fkeep-inline-functions"

pkgs/development/python-modules/warp-lang/standalone-llvm.patch

···
 diff --git a/build_llvm.py b/build_llvm.py
-index 9d5a26a7..3663e9c9 100644
+index aee0a9f1..6b9806c9 100644
 --- a/build_llvm.py
 +++ b/build_llvm.py
-@@ -338,25 +338,19 @@ def build_warp_clang_for_arch(args, lib_name, arch):
+@@ -350,25 +350,19 @@ def build_warp_clang_for_arch(args, lib_name: str, arch: str) -> None:
  
          clang_dll_path = os.path.join(build_path, f"bin/{lib_name}")
  
···
          else:
              libs = [f"-l{lib[3:-2]}" for lib in libs if os.path.splitext(lib)[1] == ".a"]
              if sys.platform == "darwin":
-@@ -364,7 +358,8 @@ def build_warp_clang_for_arch(args, lib_name, arch):
+@@ -376,7 +370,8 @@ def build_warp_clang_for_arch(args, lib_name: str, arch: str) -> None:
              else:
                  libs.insert(0, "-Wl,--start-group")
                  libs.append("-Wl,--end-group")
···
              libs.append("-ldl")
              if sys.platform != "darwin":
 diff --git a/warp/build_dll.py b/warp/build_dll.py
-index 4d411e1b..95fb7eaf 100644
+index 2218ff13..3fcf5796 100644
 --- a/warp/build_dll.py
 +++ b/warp/build_dll.py
-@@ -311,8 +311,8 @@ def build_dll_for_arch(args, dll_path, cpp_paths, cu_path, libs, arch, mode=None
-             run_cmd(link_cmd)
+@@ -404,8 +404,8 @@ def build_dll_for_arch(args, dll_path, cpp_paths, cu_path, arch, libs: Optional[
+         cuda_compiler = "clang++" if getattr(args, "clang_build_toolchain", False) else "nvcc"
+         cpp_compiler = "clang++" if getattr(args, "clang_build_toolchain", False) else "g++"
  
-     else:
 -        cpp_includes = f' -I"{warp_home_path.parent}/external/llvm-project/out/install/{mode}-{arch}/include"'
 -        cpp_includes += f' -I"{warp_home_path.parent}/_build/host-deps/llvm-project/release-{arch}/include"'
 +        cpp_includes = ' -I"@LLVM_DEV@/include"'

pkgs/development/tools/build-managers/sbt/default.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sbt";
-  version = "1.11.2";
+  version = "1.11.3";
 
   src = fetchurl {
     url = "https://github.com/sbt/sbt/releases/download/v${finalAttrs.version}/sbt-${finalAttrs.version}.tgz";
-    hash = "sha256-hMe52OIMXcg1YVSltxRsCouGq6lyaM6f4aWF0siQj08=";
+    hash = "sha256-PqUJFayLmJuLH8niTllKYNPBgdQwE/6WSxX+s4RIOzw=";
   };
 
   postPatch = ''

pkgs/games/quakespasm/vulkan.nix

···
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "vkquake";
-  version = "1.32.3";
+  version = "1.32.3.1";
 
   src = fetchFromGitHub {
     owner = "Novum";
     repo = "vkQuake";
     tag = finalAttrs.version;
-    hash = "sha256-Nb3nTU0cJK5vNitfNBF7Usc0vTgMxZdQ3I3mjM1E9po=";
+    hash = "sha256-Hsj6LgxlEICI3MMDMCE1KvslYrsYfQPhShpP5kzLCTI=";
   };
 
   nativeBuildInputs = [

pkgs/servers/http/jetty/default.nix

···
   };
 
   jetty_12 = common {
-    version = "12.0.22";
-    hash = "sha256-Ey3z+C+cBh8clWqcGULEsQQcbSbuaGwGr+arJE+GChs=";
+    version = "12.0.23";
+    hash = "sha256-oY6IU59ir52eM4qO2arOLErN4CEUCT0iRM4I9ip+m3I=";
   };
 }

pkgs/tools/misc/coreboot-utils/default.nix

···
 }:
 
 let
-  version = "25.03";
+  version = "25.06";
 
   commonMeta = {
     description = "Various coreboot-related tools";
···
         src = fetchgit {
           url = "https://review.coreboot.org/coreboot";
           rev = finalAttrs.version;
-          hash = "sha256-tsNdsH+GxjLUTd7KXHMZUTNTIAWeKJ3BNy1Lehjo8Eo=";
+          hash = "sha256-D7W8LtL6eeaKiRYoxVkcjeZ2aMIEXCvNakVtexe0mG8=";
         };
 
         enableParallelBuilding = true;

pkgs/tools/networking/rosenpass/default.nix

···
   cmake,
   libsodium,
   pkg-config,
+  nix-update-script,
 }:
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rosenpass";
   version = "0.2.2";
 
   src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
-    rev = "v${version}";
+    owner = "rosenpass";
+    repo = "rosenpass";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-fQIeKGyTkFWUV9M1o256G4U1Os5OlVsRZu+5olEkbD4=";
   };
 
···
     installManPage doc/rosenpass.1
   '';
 
-  passthru.tests.rosenpass = nixosTests.rosenpass;
+  passthru = {
+    tests = { inherit (nixosTests) rosenpass; };
+    updateScript = nix-update-script { };
+  };
 
-  meta = with lib; {
+  meta = {
     description = "Build post-quantum-secure VPNs with WireGuard";
     homepage = "https://rosenpass.eu/";
-    license = with licenses; [
+    license = with lib.licenses; [
       mit # or
       asl20
     ];
-    maintainers = with maintainers; [ wucke13 ];
+    maintainers = with lib.maintainers; [ wucke13 ];
+    teams = with lib.teams; [ ngi ];
     platforms = [
       "aarch64-darwin"
       "aarch64-linux"
···
     ];
     mainProgram = "rosenpass";
   };
-}
+})

pkgs/top-level/python-packages.nix

···
 
   arcam-fmj = callPackage ../development/python-modules/arcam-fmj { };
 
+  arch = callPackage ../development/python-modules/arch { };
+
   archinfo = callPackage ../development/python-modules/archinfo { };
 
   archspec = callPackage ../development/python-modules/archspec { };
···
   presenterm-export = callPackage ../development/python-modules/presenterm-export { };
 
   preshed = callPackage ../development/python-modules/preshed { };
+
+  presto-python-client = callPackage ../development/python-modules/presto-python-client { };
 
   pretend = callPackage ../development/python-modules/pretend { };