Merge master into staging-next

nixos/tests/k3s/default.nix

···
     n: _: lib.strings.hasPrefix "k3s_" n && (builtins.tryEval pkgs.${n}).success
   ) pkgs;
 in
-lib.recurseIntoAttrs {
+{
   airgap-images = lib.mapAttrs (
     _: k3s: import ./airgap-images.nix { inherit system pkgs k3s; }
   ) allK3s;

nixos/tests/stalwart-mail.nix

···
           session.auth.directory = "'in-memory'";
           storage.directory = "in-memory";
 
+          storage.data = "rocksdb";
+          storage.fts = "rocksdb";
+          storage.blob = "rocksdb";
+          storage.lookup = "rocksdb";
+
           session.rcpt.directory = "'in-memory'";
           queue.outbound.next-hop = "'local'";
+
+          store."rocksdb" = {
+            type = "rocksdb";
+            path = "/var/lib/stalwart-mail/data";
+            compression = "lz4";
+          };
 
           directory."in-memory" = {
             type = "memory";
···
       main.wait_for_open_port(143)
 
       main.succeed("test-smtp-submission")
+
+      # restart stalwart to test rocksdb compaction of existing database
+      main.succeed("systemctl restart stalwart-mail.service")
+      main.wait_for_open_port(587)
+      main.wait_for_open_port(143)
+
       main.succeed("test-imap-read")
     '';
 

pkgs/applications/editors/vscode/extensions/default.nix

···
         mktplcRef = {
           name = "ng-template";
           publisher = "Angular";
-          version = "20.0.0";
-          hash = "sha256-87SImzcGbwvf9xtdbD3etqaWe6fMVeCKc+f8qTyFnUA=";
+          version = "20.0.1";
+          hash = "sha256-N+2uNX1gXGHAvkx2aff9DfB7vji8bXNLt86yaSYt0o0=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/Angular.ng-template/changelog";
···
           # semver scheme, contrary to preview versions which are listed on
           # the VSCode Marketplace and use a calver scheme. We should avoid
           # using preview versions, because they expire after two weeks.
-          version = "17.1.0";
-          hash = "sha256-WPSMf1yLXSDqImpMTxn1eXcSrimVSVjjaXDzFMQ/l0E=";
+          version = "17.1.1";
+          hash = "sha256-hlhq4bR3v0AqI3lxilgNEgjjEEBVL0xfvIWbV/Ronh4=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/eamodio.gitlens/changelog";

pkgs/applications/networking/cluster/terraform-providers/providers.json

···
 {
+  "_assert": {
+    "hash": "sha256-ngHxzV7lRg6pOtyNTdCv3ToRK/vO016Vp2mlh7QT8Rc=",
+    "homepage": "https://registry.terraform.io/providers/hashicorp/assert",
+    "owner": "hashicorp",
+    "repo": "terraform-provider-assert",
+    "rev": "v0.16.0",
+    "spdx": "MPL-2.0",
+    "vendorHash": "sha256-nHaBNYCKfTvaDnz2SeexM2cyNVK5ThPYn4rnGEw7Wi0="
+  },
   "aci": {
     "hash": "sha256-NS5q6ElCGEGSceOCIVudKE6m6EzXMV/3HGHHXwYopOA=",
     "homepage": "https://registry.terraform.io/providers/CiscoDevNet/aci",

pkgs/applications/networking/instant-messengers/discord/linux.nix

···
   moonlight,
   withTTS ? true,
   enableAutoscroll ? false,
+  # Disabling this would normally break Discord.
+  # The intended use-case for this is when SKIP_HOST_UPDATE is enabled via other means,
+  # for example if a settings.json is linked declaratively (e.g., with home-manager).
+  disableUpdates ? true,
 }:
 assert lib.assertMsg (
   !(withMoonlight && withVencord)
···
         ${lib.strings.optionalString enableAutoscroll "--add-flags \"--enable-blink-features=MiddleClickAutoscroll\""} \
         --prefix XDG_DATA_DIRS : "${gtk3}/share/gsettings-schemas/${gtk3.name}/" \
         --prefix LD_LIBRARY_PATH : ${libPath}:$out/opt/${binaryName} \
-        --run "${lib.getExe disableBreakingUpdates}"
+        ${lib.strings.optionalString disableUpdates "--run ${lib.getExe disableBreakingUpdates}"}
 
     ln -s $out/opt/${binaryName}/${binaryName} $out/bin/
     # Without || true the install would fail on case-insensitive filesystems

pkgs/by-name/de/deno/package.nix

···
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "deno";
-  version = "2.3.3";
+  version = "2.3.5";
 
   src = fetchFromGitHub {
     owner = "denoland";
     repo = "deno";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-KfgxKmxkF5/BrAsXkpmyWXV2H+vwX31dnzQORtt3A90=";
+    hash = "sha256-ASP+1EuGLU9BBY7iBer92AbnVEeQc4nwtOEyULlvc2w=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-DWODuTslGvx9PHUMsxY+MS15IcECcq7Ne7IUEovWoa0=";
+  cargoHash = "sha256-XJy7+cARYEX8tAPXLHJnEwXyZIwPaqhM7ZUzoem1Wo0=";
 
   postPatch = ''
     # Use patched nixpkgs libffi in order to fix https://github.com/libffi/libffi/pull/857

pkgs/by-name/ha/hamrs-pro/package.nix

···
 
 let
   pname = "hamrs-pro";
-  version = "2.37.1";
+  version = "2.38.0";
 
   throwSystem = throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}";
 
   srcs = {
     x86_64-linux = fetchurl {
       url = "https://hamrs-dist.s3.amazonaws.com/hamrs-pro-${version}-linux-x86_64.AppImage";
-      hash = "sha256-kLYgqRH+RpyitUSZVoZFfqVsrJjTXeZp80ILHGQmGTk=";
+      hash = "sha256-G9zap1AaPZepIajZHbUDMODJ7l+7JSD8oJq7EecmE+M=";
     };
 
     aarch64-linux = fetchurl {
       url = "https://hamrs-dist.s3.amazonaws.com/hamrs-pro-${version}-linux-arm64.AppImage";
-      hash = "sha256-BKS7xPzVoIUToqEbtI+8t4Gf7HvZSWhzfXmToghFPEk=";
+      hash = "sha256-eVt2ciWFTKJdV0YoQyU98DD90aMUoOWTqzbZ/s0G+0E=";
     };
 
     x86_64-darwin = fetchurl {
       url = "https://hamrs-dist.s3.amazonaws.com/hamrs-pro-${version}-mac-x64.dmg";
-      hash = "sha256-gejyYoW7VcR0ILD/PSwFGC2tzLiiR2vjEsErBxbvJ3o=";
+      hash = "sha256-ggWnB5QcJM9bsOyyVe9dSvOU63hr8heWQTE6ncPgriU=";
     };
 
     aarch64-darwin = fetchurl {
       url = "https://hamrs-dist.s3.amazonaws.com/hamrs-pro-${version}-mac-arm64.dmg";
-      hash = "sha256-Hi/t5ShfhUFw0aEzb2XIhOIppXg04qnq8tl3LKNH3qQ=";
+      hash = "sha256-s8Ly1UYBy0EzUCKUCJxx1PcxVQe2gkeuXDudqnSuYjE=";
     };
   };
 

pkgs/by-name/io/iosevka/package.nix

···
 
 buildNpmPackage rec {
   pname = "Iosevka${toString set}";
-  version = "33.2.3";
+  version = "33.2.4";
 
   src = fetchFromGitHub {
     owner = "be5invis";
     repo = "iosevka";
     rev = "v${version}";
-    hash = "sha256-dCHJYGZYTvjDtM2V+NdwXNxHg4kkcVAQD0G3DPtu5ps=";
+    hash = "sha256-1QxM9PWZirAKIdd/kzHLDStXbkxTGr0q8GQSER2NEXc=";
   };
 
-  npmDepsHash = "sha256-eqWf5d9uCMkvDNPlICUt7QVT+2WsU0u+TE14ZraWXXE=";
+  npmDepsHash = "sha256-1XRbwd1x7ofQGnEth7U8QAHX92QDHMm4OmQAQgZZLTw=";
 
   nativeBuildInputs =
     [

pkgs/by-name/k9/k9s/package.nix

···
 
 buildGoModule rec {
   pname = "k9s";
-  version = "0.50.5";
+  version = "0.50.6";
 
   src = fetchFromGitHub {
     owner = "derailed";
     repo = "k9s";
     rev = "v${version}";
-    hash = "sha256-hh00R0PCqhAUlwFps40CQ+hc6p2634WEGqNjX1mi/J8=";
+    hash = "sha256-cL7OD9OtkVx325KcANU8FudcOk6HMct6ve2p0qSkEoc=";
   };
 
   ldflags = [
···
 
   proxyVendor = true;
 
-  vendorHash = "sha256-g2tS1EpmG+Wba3kF9cH83JAG6EhKK4LrASGUSFtYYY8=";
+  vendorHash = "sha256-dATWFH5XKicdP8sftGGm2zopTef189MJWd9AM/Gxsjw=";
 
   # TODO investigate why some config tests are failing
   doCheck = !(stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64);
···
       markus1189
       bryanasdev000
       qjoly
+      devusb
     ];
   };
 }

pkgs/by-name/mi/midisheetmusic/package.nix

···
   stdenv,
   fetchurl,
   mono,
-  dotnetPackages,
+  mkNugetDeps,
   makeWrapper,
+  makeFontsConf,
   gtk2,
   cups,
   timidity,
 }:
 
 let
+  deps = mkNugetDeps {
+    name = "midisheetmusic-deps";
+    nugetDeps =
+      { fetchNuGet }:
+      [
+        (fetchNuGet {
+          pname = "NUnit.Console";
+          version = "3.0.1";
+          hash = "sha256-FkzpEk12msmUp5I05ZzlGiG+UInoYhBmar/vB5Gt4H8=";
+        })
+        (fetchNuGet {
+          pname = "NUnit";
+          version = "2.6.4";
+          hash = "sha256-Kkft3QO9T5WwsvyPRNGT2nut7RS7OWArDjIYxvwA8qU=";
+        })
+      ];
+  };
+
   version = "2.6";
 in
 stdenv.mkDerivation {
···
     sha256 = "05c6zskj50g29f51lx8fvgzsi3f31z01zj6ssjjrgr7jfs7ak70p";
   };
 
-  nativeCheckInputs = (with dotnetPackages; [ NUnitConsole ]);
   nativeBuildInputs = [
     mono
     makeWrapper
···
   buildPhase = ''
     for i in Classes/MidiPlayer.cs Classes/MidiSheetMusic.cs
     do
-      substituteInPlace $i --replace "/usr/bin/timidity" "${timidity}/bin/timidity"
+      substituteInPlace $i --replace-fail "/usr/bin/timidity" "${timidity}/bin/timidity"
     done
 
     ./build.sh
   '';
 
-  # include missing file with unit tests for building
-  # switch from mono nunit dll to standalone dll otherwise mono compiler barks
-  # run via nunit3 console, because mono nunit console wants access $HOME
+  doCheck = true;
+
   checkPhase = ''
+    # Resolves the warning "Fontconfig error: No writable cache directories"
+    export XDG_CACHE_HOME="$(mktemp -d)"
+
+    # Adds one file with tests that's missing from compiliation
+    # Makes sure NUnit framework from NuGet can be found
     substituteInPlace UnitTestDLL.csproj \
-      --replace "</Compile>" '</Compile><Compile Include="Classes\UnitTest.cs"/>' \
-      --replace nunit.framework.dll "${dotnetPackages.NUnit}/lib/dotnet/NUnit/nunit.framework.dll"
+      --replace-fail '</Compile>' '</Compile><Compile Include="Classes\UnitTest.cs"/>' \
+      --replace-fail 'nunit.framework.dll' '${deps}/share/nuget/packages/nunit/2.6.4/lib/nunit.framework.dll'
     ./build_unit_test.sh
-    nunit3-console bin/Debug/UnitTest.dll
+
+    # 2 tests are still failing, we exclude them for now
+    mono ${deps}/share/nuget/packages/nunit.console/3.0.1/tools/nunit3-console.exe bin/Debug/UnitTest.dll \
+      --where "test != 'MidiFileTest.TestChangeSoundTrack' && test != 'MidiFileTest.TestChangeSoundPerChannelTracks'"
   '';
 
-  # 2 tests of 47 are still failing
-  doCheck = false;
+  # This fixes tests that fail because of missing fonts
+  FONTCONFIG_FILE = makeFontsConf { fontDirectories = [ ]; };
 
   installPhase = ''
     mkdir -p $out/share/applications $out/share/pixmaps $out/bin
···
       --add-flags $out/bin/.MidiSheetMusic.exe
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Convert MIDI Files to Piano Sheet Music for two hands";
     mainProgram = "midisheetmusic.mono.exe";
     homepage = "http://midisheetmusic.com";
-    license = licenses.gpl2;
-    maintainers = [ ];
-    platforms = platforms.linux;
+    license = lib.licenses.gpl2;
+    maintainers = [ lib.maintainers.mdarocha ];
+    platforms = lib.platforms.linux;
   };
 }

pkgs/by-name/ne/netbird/package.nix

···
 in
 buildGoModule (finalAttrs: {
   pname = "netbird";
-  version = "0.45.1";
+  version = "0.45.2";
 
   src = fetchFromGitHub {
     owner = "netbirdio";
     repo = "netbird";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-55Vyhzt0WtJRq9CcH7mXw7cklAce/lvC1S+MBMDnMbo=";
+    hash = "sha256-lvulqneKFxmZ/EQDmQbx1SzsfZxLb8tGyLFJo8z9U0w=";
   };
 
   vendorHash = "sha256-EVhtxYDinmid5C/3N8UGmCzWw1qIE3m0rXes4uFpcOM=";

pkgs/by-name/ne/netron/package.nix

···
 in
 buildNpmPackage (finalAttrs: {
   pname = "netron";
-  version = "8.3.4";
+  version = "8.3.5";
 
   src = fetchFromGitHub {
     owner = "lutzroeder";
     repo = "netron";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-P7lv0pnhrdU9zFwCzQYwYilq6qJ1UUaYgVDMiRZP5M8=";
+    hash = "sha256-YxvUUn8VWv5M6FvIHJCaXQl7PRGcZ8qSgrZ7K0+8iME=";
   };
 
-  npmDepsHash = "sha256-gPRxgf4XTxIZIKTZbr07zzEJW1n0Waas+zms6Ap6RAY=";
+  npmDepsHash = "sha256-fsF40qUKUNXeqvdM1m/IEgnxRZrnGW/aOYS3oZKQNpk=";
 
   nativeBuildInputs = [ jq ];
 

pkgs/by-name/ny/nyan/package.nix

···
     hash = "sha256-BtvMZaQutcPqTSCN5gxYUU3CQTyCns1ldkcnjwJOFa8=";
   };
 
+  strictDeps = true;
+
   nativeBuildInputs = [
     clang
     cmake
+    flex
   ];
 
   buildInputs = [

pkgs/by-name/op/opshin/package.nix

···
   python3,
 }:
 
-python3.pkgs.buildPythonApplication rec {
+let
+  python3' = python3.override {
+    self = python3;
+    packageOverrides = (
+      final: prev: {
+        cbor2 = prev.cbor2WithoutCExtensions;
+      }
+    );
+  };
+in
+
+python3'.pkgs.buildPythonApplication rec {
   pname = "opshin";
-  version = "0.24.1";
+  version = "0.24.2";
 
   format = "pyproject";
 
···
     owner = "OpShin";
     repo = "opshin";
     tag = version;
-    hash = "sha256-+uuTEszA5p/qhvthM3Uje6yX3urbIUAKKfDZ4JXEYYQ=";
+    hash = "sha256-L0vWEXlghXssT9oUw5AYG3/4ALoB/NH90JV8Kdl2n30=";
   };
 
-  propagatedBuildInputs = with python3.pkgs; [
+  propagatedBuildInputs = with python3'.pkgs; [
     setuptools
     poetry-core
     uplc
···
     frozenlist2
     astunparse
     ordered-set
-  ];
-
-  pythonRelaxDeps = [
-    "pluthon"
-    "uplc"
   ];
 
   meta = with lib; {

pkgs/by-name/re/readest/package.nix

···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "readest";
-  version = "0.9.43";
+  version = "0.9.51";
 
   src = fetchFromGitHub {
     owner = "readest";
     repo = "readest";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9ACeMGbOpa3Nh6NQIGckcI2oYNjtQ1pE4Zn++qcE0tM=";
+    hash = "sha256-UJ4H+pBR+EWr2O34WUmbF2rd3pTVssE/8b9iO9bbx7Y=";
     fetchSubmodules = true;
   };
 
···
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-ozRDNXWqg0CZ1IgU33C6yJu4e05010jsHeTdIVhB72M=";
+    hash = "sha256-Bd+7MHYBMo4N7UpwkXGmk4oQBbyBMJOtnv6iTVQgn64=";
   };
 
   pnpmRoot = "../..";
···
       --replace-fail '"Readest"' '"readest"'
     jq 'del(.plugins."deep-link")' src-tauri/tauri.conf.json | sponge src-tauri/tauri.conf.json
     substituteInPlace src/services/constants.ts \
-      --replace-fail "autoCheckUpdates: true" "autoCheckUpdates: false"
+      --replace-fail "autoCheckUpdates: true" "autoCheckUpdates: false" \
+      --replace-fail "telemetryEnabled: true" "telemetryEnabled: false"
   '';
 
   nativeBuildInputs = [

pkgs/by-name/ru/ruff/package.nix

···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ruff";
-  version = "0.11.11";
+  version = "0.11.12";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "ruff";
     tag = finalAttrs.version;
-    hash = "sha256-PPryfsdge0kOb7RyEkGl7c3pFucRzt0+9tACet3nDGM=";
+    hash = "sha256-5oLMhP4PKzZTp0ab+Fitq97GAVLV/GJmR2JH9IXlfuU";
   };
 
   cargoBuildFlags = [ "--package=ruff" ];
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-LAEuoGTvSXXtx74t1OX+TaGxgvI8UAB3bM+fwiSfFws=";
+  cargoHash = "sha256-PIzR9d0O82M/b7HgmPigc2h8KwjSHi08vs3jAQyXbzs";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/sn/snakemake/package.nix

···
 
 python3Packages.buildPythonApplication rec {
   pname = "snakemake";
-  version = "9.5.0";
+  version = "9.5.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "snakemake";
     repo = "snakemake";
     tag = "v${version}";
-    hash = "sha256-rZTx/ZDAaZ579u7ef18qlTUtg1ieWd9sF9UXvEOyLMk=";
+    hash = "sha256-cSFqPSLeM7hw1bxQZ2FhlHUP+O3iyrwBz4+Jz90Zck8=";
   };
 
   postPatch = ''

pkgs/by-name/st/stalwart-mail/package.nix

···
   sqlite,
   foundationdb,
   zstd,
+  rust-jemalloc-sys-unprefixed,
   stdenv,
   nix-update-script,
   nixosTests,
···
   stalwartEnterprise ? false,
 }:
 
+let
+  rocksdbJemalloc = rocksdb.override { enableJemalloc = true; };
+in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "stalwart-mail" + (lib.optionalString stalwartEnterprise "-enterprise");
   version = "0.11.8";
···
     hash = "sha256-VqGosbSQxNeOS+kGtvXAmz6vyz5mJlXvKZM57B1Xue4=";
   };
 
+  # rocksdb does not properly distinguish between pointers it has allocated itself
+  # and pointers which were passed in and might be registered with a different
+  # allocator, so we enable the unprefixed_malloc_on_supported_platforms to use
+  # jemalloc implicitly in the entire process.
+  postPatch = ''
+    for file in crates/main/Cargo.toml tests/Cargo.toml; do
+      substituteInPlace $file --replace-fail \
+        'jemallocator = "0.5.0"' 'jemallocator = { version = "0.5.0", features = ["unprefixed_malloc_on_supported_platforms"] }'
+    done
+  '';
+
   useFetchCargoVendor = true;
   cargoHash = "sha256-iheURWxO0cOvO+FV01l2Vmo0B+S2mXzue6mx3gapftQ=";
 
···
     openssl
     sqlite
     zstd
+    rust-jemalloc-sys-unprefixed
+    rocksdbJemalloc
   ] ++ lib.optionals (stdenv.hostPlatform.isLinux && withFoundationdb) [ foundationdb ];
 
   # Issue: https://github.com/stalwartlabs/mail-server/issues/1104
···
   env = {
     OPENSSL_NO_VENDOR = true;
     ZSTD_SYS_USE_PKG_CONFIG = true;
-    ROCKSDB_INCLUDE_DIR = "${rocksdb}/include";
-    ROCKSDB_LIB_DIR = "${rocksdb}/lib";
+    ROCKSDB_INCLUDE_DIR = "${rocksdbJemalloc}/include";
+    ROCKSDB_LIB_DIR = "${rocksdbJemalloc}/lib";
   };
 
   postInstall = ''
···
   __darwinAllowLocalNetworking = true;
 
   passthru = {
-    inherit rocksdb; # make used rocksdb version available (e.g., for backup scripts)
+    rocksdb = rocksdbJemalloc; # make used rocksdb version available (e.g., for backup scripts)
     webadmin = callPackage ./webadmin.nix { };
     updateScript = nix-update-script { };
     tests.stalwart-mail = nixosTests.stalwart-mail;

pkgs/by-name/sw/sweet/package.nix

···
   stdenvNoCC.mkDerivation
   (finalAttrs: {
     inherit pname;
-    version = "5.0";
+    version = "6.0";
 
     srcs = [
       (fetchurl {
         url = "https://github.com/EliverLara/Sweet/releases/download/v${finalAttrs.version}/Sweet-Ambar-Blue-Dark-v40.tar.xz";
-        hash = "sha256-fCCkkEYr4XPnP5aPrs3HAwIwM/Qb0NFY8Rf1ABu0ygY=";
+        hash = "sha256-LufK9MexE6YMuVniyfcNNaPfVLBMHnNmWBBNnGA2nUo=";
       })
       (fetchurl {
         url = "https://github.com/EliverLara/Sweet/releases/download/v${finalAttrs.version}/Sweet-Ambar-Blue-Dark.tar.xz";
-        hash = "sha256-xMAqUsol1FPeFoq8KLTmKCeZMF34FDAjhiagsRmjGT8=";
+        hash = "sha256-J0YOADP4FXKYMl/Nn70clD3h7Y5LtlTfWV9VLsWL9yo=";
       })
       (fetchurl {
         url = "https://github.com/EliverLara/Sweet/releases/download/v${finalAttrs.version}/Sweet-Ambar-Blue-v40.tar.xz";
-        hash = "sha256-JlpomJ8Ao4bJFJbCDliRtxNckEG3LzINBqhWzfTARJs=";
+        hash = "sha256-HH9oZQ+F1nFhIJyP9d9W2CL+mA0bolq5GiNQtKQgrZk=";
       })
       (fetchurl {
         url = "https://github.com/EliverLara/Sweet/releases/download/v${finalAttrs.version}/Sweet-Ambar-Blue.tar.xz";
-        hash = "sha256-HKJ/Ca5cy91kJZVEETyMcOcrgLliHF/S2rdBmWfKi08=";
+        hash = "sha256-2dcryd5Zj+Iu3R4jR++uJtyToGNoa1LtTpN1G6+kBRw=";
       })
       (fetchurl {
         url = "https://github.com/EliverLara/Sweet/releases/download/v${finalAttrs.version}/Sweet-Ambar-v40.tar.xz";
-        hash = "sha256-0LjARDbSPyQWN5nT97k2c//eebxhgStGYsebpNQn9+w=";
+        hash = "sha256-mpShu1fmBajl/wzlnu9zBWkskMlza5nEVS3u8Sh3b7s=";
       })
       (fetchurl {
         url = "https://github.com/EliverLara/Sweet/releases/download/v${finalAttrs.version}/Sweet-Ambar.tar.xz";
-        hash = "sha256-UjH4popJCqQ18HZUngsO6cE4axSAM7/EXwM8nHAdVS4=";
+        hash = "sha256-wcbJW6MUctGSM8GW1ouLvUCmdcDHQkjTw9h0foRBgTg=";
       })
       (fetchurl {
         url = "https://github.com/EliverLara/Sweet/releases/download/v${finalAttrs.version}/Sweet-Dark-v40.tar.xz";
-        hash = "sha256-4/e81slrkcO3WdrQ2atGHdZsErlzme4mRImfLvmGJnQ=";
+        hash = "sha256-aYPjnOEZMN9mPvnhK3eoCm1ybUxKPqPSoOL+kwsZsG4=";
       })
       (fetchurl {
         url = "https://github.com/EliverLara/Sweet/releases/download/v${finalAttrs.version}/Sweet-Dark.tar.xz";
-        hash = "sha256-Tv+xtUee1TIdRLlnP84aVfk+V6xgeeeICRZCdeSSjE8=";
+        hash = "sha256-Ej9p7/txrMhGUCyDTAEQHIS/pi92pfLrCV1L4HxWdZk=";
       })
       (fetchurl {
         url = "https://github.com/EliverLara/Sweet/releases/download/v${finalAttrs.version}/Sweet-mars-v40.tar.xz";
-        hash = "sha256-FmJoPeQ8iLA6X6lFawBqG8lviQXWBHG5lgQsZvU68BM=";
+        hash = "sha256-AKTNa6FHlPr1ZqlK5QYZzXRiPb5Nmzw2lTSNcWAtMAg=";
       })
       (fetchurl {
         url = "https://github.com/EliverLara/Sweet/releases/download/v${finalAttrs.version}/Sweet-mars.tar.xz";
-        hash = "sha256-bqL9jR8yPF9ZnEZ1O+P3/e6E59m+MY7mQNT3BhYVhu4=";
+        hash = "sha256-bCL/DqiQGiHR24aaPtPyJKAkk8X+DyMxYeYuFJBuK6Y=";
       })
       (fetchurl {
         url = "https://github.com/EliverLara/Sweet/releases/download/v${finalAttrs.version}/Sweet-v40.tar.xz";
-        hash = "sha256-Oesx/McKmTlqwJX8u6RrV3AtOIB73BQveD8slbD14js=";
+        hash = "sha256-1kHWoK9r3mRYIkizekVVYyFpWXU78BExKuNUsRB4uv4=";
       })
       (fetchurl {
         url = "https://github.com/EliverLara/Sweet/releases/download/v${finalAttrs.version}/Sweet.tar.xz";
-        hash = "sha256-m0tQHV/3UkDoOAmBZF6Nvugj6fEkmLbeLPdQ/IFkHOo=";
+        hash = "sha256-WzsquuUreT7b6TA6qGSYqGVrVWlIdQjlIdqWGMNJFpo=";
       })
     ];
 

pkgs/by-name/ta/tailscale/package.nix

···
 
           # context deadline exceeded
           "TestPacketFilterFromNetmap"
+
+          # flaky: https://github.com/tailscale/tailscale/issues/15348
+          "TestSafeFuncHappyPath"
         ]
         ++ lib.optionals stdenv.hostPlatform.isDarwin [
           # syscall default route interface en0 differs from netstat

pkgs/by-name/ud/udevCheckHook/package.nix

···
   lib,
   makeSetupHook,
   systemdMinimal,
-  udev,
   stdenv,
 }:
 let
   # udev rules can only be checked if systemd (specifically, 'udevadm') can be executed on build platform
-  # if udev is not available on hostPlatform, there is no point in checking rules
-  applyHook =
-    lib.meta.availableOn stdenv.hostPlatform udev
-    && lib.meta.availableOn stdenv.buildPlatform systemdMinimal;
+  # If cross-compiling linux -> non-linux, udev rules are still checked, even if they end up being unused.
+  # This is not a problem:
+  # - If there are no udev rules, the hook is a noop
+  # - If the udev rules are broken, they should be flagged as such
+  # - if rules are not needed on a target platform where they are broken, they should be deleted from package output
+  applyHook = lib.meta.availableOn stdenv.buildPlatform systemdMinimal;
 in
 makeSetupHook {
   name = "udev-check-hook";

pkgs/by-name/vs/vsce/package.nix

···
 
 buildNpmPackage (finalAttrs: {
   pname = "vsce";
-  version = "3.4.1";
+  version = "3.4.2";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "vscode-vsce";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ufSEKkLqP+D/D5l5teL82RsoVgIFhbyOVjnZfnecsKI=";
+    hash = "sha256-T3uboozO4YRA8qqu833pIFt4yzIYRBZQdm8nawEZo2s=";
   };
 
   npmDepsHash = "sha256-J7ES/a6RHeTY1grdzgYu9ex7BOzadqng2/h2LlTZLns=";

pkgs/by-name/wi/windsurf/info.json

···
 {
   "aarch64-darwin": {
-    "version": "1.9.0",
+    "version": "1.9.2",
     "vscodeVersion": "1.99.1",
-    "url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/fbebfca390b10f7a152fd231f94606109d576e12/Windsurf-darwin-arm64-1.9.0.zip",
-    "sha256": "44706f90321bdc4c2a2320a03c79fdd01c911236daa4cc675c597851974a268c"
+    "url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/8cb7f313303c8b35844a56b6fe0f76e508261569/Windsurf-darwin-arm64-1.9.2.zip",
+    "sha256": "b3edf57d19fab5ceac0cd3daee3c54052e503b052efebad0b6bfeac3b9f5a979"
   },
   "x86_64-darwin": {
-    "version": "1.9.0",
+    "version": "1.9.2",
     "vscodeVersion": "1.99.1",
-    "url": "https://windsurf-stable.codeiumdata.com/darwin-x64/stable/fbebfca390b10f7a152fd231f94606109d576e12/Windsurf-darwin-x64-1.9.0.zip",
-    "sha256": "ae398d597cd143144c2bdc8bf0a853a1c57b6de2c86c95087a4be5db78252e75"
+    "url": "https://windsurf-stable.codeiumdata.com/darwin-x64/stable/8cb7f313303c8b35844a56b6fe0f76e508261569/Windsurf-darwin-x64-1.9.2.zip",
+    "sha256": "227ed7b01b9f7637d126ef880b6e0c07daa263b0740e6394e32ad4ebedd05d78"
   },
   "x86_64-linux": {
-    "version": "1.9.0",
+    "version": "1.9.2",
     "vscodeVersion": "1.99.1",
-    "url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/fbebfca390b10f7a152fd231f94606109d576e12/Windsurf-linux-x64-1.9.0.tar.gz",
-    "sha256": "941640e3514a5ee524943135b439219243adb288fec484712ebc2935173aa938"
+    "url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/8cb7f313303c8b35844a56b6fe0f76e508261569/Windsurf-linux-x64-1.9.2.tar.gz",
+    "sha256": "ee5a4ac38f9a2518a54429cb235bae76d74b3fff0f5947dbfc29738d78f28542"
   }
 }

pkgs/by-name/ya/yazi/plugins/yatline-githead/default.nix

···
+{
+  lib,
+  fetchFromGitHub,
+  mkYaziPlugin,
+}:
+mkYaziPlugin {
+  pname = "yatline-githead.yazi";
+  version = "0-unstable-2025-05-31";
+
+  src = fetchFromGitHub {
+    owner = "imsi32";
+    repo = "yatline-githead.yazi";
+    rev = "f8f969e84c39ad4215334ea5012183a2a5a6160b";
+    hash = "sha256-Cs8zSYtUfdCmKwIkJwQGyQNeSOmmpPvObCMnGm+32zg=";
+  };
+
+  meta = {
+    description = "githead.yazi with yatline.yazi support";
+    homepage = "https://github.com/imsi32/yatline-githead.yazi";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ khaneliman ];
+  };
+}

pkgs/by-name/ya/yazi/plugins/yatline/default.nix

···
 }:
 mkYaziPlugin {
   pname = "yatline.yazi";
-  version = "0-unstable-2025-04-22";
+  version = "0-unstable-2025-05-31";
 
   src = fetchFromGitHub {
     owner = "imsi32";
     repo = "yatline.yazi";
-    rev = "2ecf715d33866e5f8a63af25f6a242821746ddb7";
-    hash = "sha256-l4IrdALlgKd1USxE2+bD0Lkw3DgBoQDBxgxevrFhytU=";
+    rev = "4872af0da53023358154c8233ab698581de5b2b2";
+    hash = "sha256-7uk8QXAlck0/4bynPdh/m7Os2ayW1UXbELmusPqRmf4=";
   };
 
   meta = {

pkgs/by-name/ye/yetris/package.nix

···
     hash = "sha256-k9CXXIaDk1eAtRBEj0VCfE+D1FtmIDX3niubAdrfjqw=";
   };
 
+  postPatch = ''
+    substituteInPlace src/Game/Entities/RotationSystemSRS.cpp \
+      --replace-fail 'char' 'signed char'
+    substituteInPlace src/Game/Entities/PieceDefinitions.cpp \
+      --replace-fail 'char' 'signed char'
+    substituteInPlace src/Game/Entities/PieceDefinitions.hpp \
+      --replace-fail 'char' 'signed char'
+  '';
+
   buildInputs = [
     ncurses
   ];

pkgs/development/beam-modules/ex_doc/default.nix

···
 
 let
   pname = "ex_doc";
-  version = "0.38.1";
+  version = "0.38.2";
   src = fetchFromGitHub {
     owner = "elixir-lang";
     repo = "${pname}";
     rev = "v${version}";
-    hash = "sha256-lsz+r/7Pre15qWOqla9j712I6HExyHfvBfupmKuePmI=";
+    hash = "sha256-Qv1vDfDGquWoem42IqA8lDiFWEtznT7ONIXSOCvn39g=";
   };
 in
 mixRelease {

pkgs/development/python-modules/aider-chat/default.nix

···
     d.stopwords
   ]);
 
-  version = "0.83.2";
+  version = "0.84.0";
   aider-chat = buildPythonPackage {
     pname = "aider-chat";
     inherit version;
···
       owner = "Aider-AI";
       repo = "aider";
       tag = "v${version}";
-      hash = "sha256-fVysmaB2jGS2XJlxyFIdJmQShzxz2q4TQf8zNuCT2GE=";
+      hash = "sha256-TOlqwJM9wIAURSimuh9mysYDwgH9AfFev8jY9elLNk8=";
     };
 
     pythonRelaxDeps = true;

pkgs/development/python-modules/cbor2/default.nix

···
   fetchPypi,
   pythonOlder,
 
+  withCExtensions ? true,
+
   # build-system
   setuptools,
   setuptools-scm,
···
     pytest-cov-stub
     pytestCheckHook
   ];
+
+  env = lib.optionalAttrs (!withCExtensions) {
+    CBOR2_BUILD_C_EXTENSION = "0";
+  };
+
+  passthru = {
+    inherit withCExtensions;
+  };
 
   meta = with lib; {
     changelog = "https://github.com/agronholm/cbor2/releases/tag/${version}";

pkgs/development/python-modules/msmart-ng/default.nix

···
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch2,
 
   # build-system
   setuptools,
···
 
 buildPythonPackage rec {
   pname = "msmart-ng";
-  version = "2025.3.3";
+  version = "2025.5.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mill1000";
     repo = "midea-msmart";
     tag = version;
-    hash = "sha256-M8Gl6QXj0tRN7VFDhop47vINk8MeWSyCJ9bboo3j8Go=";
+    hash = "sha256-dZD93ZZiQLmWuMAR/nnYB7oGBBYr4YPEi+LdpSzweVc=";
   };
-
-  patches = [
-    (fetchpatch2 {
-      # Revert <https://github.com/mill1000/midea-msmart/pull/209> until setuptools
-      # implements support for <https://peps.python.org/pep-0639/>.
-      name = "revert-pyproject-license-declaration-pep639-syntax.patch";
-      url = "https://github.com/mill1000/midea-msmart/commit/e5d6a982135e497c251095e421d3de4686f36056.patch?full_index=1";
-      hash = "sha256-+mxmFGZd04MZY2C5eo4k1lFoXsM8XyeJNazShnjAseE=";
-      revert = true;
-    })
-  ];
 
   build-system = [
     setuptools

pkgs/development/python-modules/pluthon/default.nix

···
 
 buildPythonPackage rec {
   pname = "pluthon";
-  version = "1.0.0";
+  version = "1.1.0";
 
   format = "pyproject";
 
···
     owner = "OpShin";
     repo = "pluthon";
     rev = version;
-    hash = "sha256-IYpkb/RXRu53HoeVKik7Jog5FyXwrWItrxSla9dN0s4=";
+    hash = "sha256-t8KWm2eBq6CzFPAWN9pgbpF62hvNNZWCpphJsY5T2OQ=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/pycardano/default.nix

···
 }:
 
 let
-  cose_0_9_dev8 = cose.overridePythonAttrs (old: rec {
+  cose_0_9_dev8 = (cose.override { inherit cbor2; }).overridePythonAttrs (old: rec {
     version = "0.9.dev8";
     src = (
       old.src.override {
···
 in
 buildPythonPackage rec {
   pname = "pycardano";
-  version = "0.12.3";
+  version = "0.14.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Python-Cardano";
     repo = "pycardano";
     tag = "v${version}";
-    hash = "sha256-jxgskdQ7Us+utndUgFYK7G2IW/e5QbeXytOsxQfFiJI=";
+    hash = "sha256-W5N254tND7mI0oR82YhMFWn4zVVs3ygYOqXOBMO3sXY=";
   };
 
   build-system = [
···
     homepage = "https://github.com/Python-Cardano/pycardano";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ t4ccer ];
+    # https://github.com/Python-Cardano/pycardano/blob/v0.13.2/Makefile#L26-L39
+    # cbor2 with C extensions fail tests due to differences in used sized vs unsized arrays
+    # more info: https://github.com/NixOS/nixpkgs/pull/402433#issuecomment-2916520286
+    broken = cbor2.withCExtensions; # consider overriding cbor2 with cbor2WithoutCExtensions
   };
 }

pkgs/development/python-modules/pymupdf/default.nix

···
   fetchFromGitHub,
   fetchpatch,
   python,
+  toPythonModule,
 
   # build-system
   libclang,
···
     enableBarcode = true;
     python3 = python;
   };
+  mupdf-cxx-lib = toPythonModule (lib.getLib mupdf-cxx);
+  mupdf-cxx-dev = lib.getDev mupdf-cxx;
 in
 buildPythonPackage rec {
   pname = "pymupdf";
···
     gumbo
   ];
 
-  propagatedBuildInputs = [ mupdf-cxx ];
+  propagatedBuildInputs = [ mupdf-cxx-lib ];
 
   env = {
     # force using system MuPDF (must be defined in environment and empty)
···
     # Setup the name of the package away from the default 'libclang'
     PYMUPDF_SETUP_LIBCLANG = "clang";
     # provide MuPDF paths
-    PYMUPDF_MUPDF_LIB = "${lib.getLib mupdf-cxx}/lib";
-    PYMUPDF_MUPDF_INCLUDE = "${lib.getDev mupdf-cxx}/include";
+    PYMUPDF_MUPDF_LIB = "${mupdf-cxx-lib}/lib";
+    PYMUPDF_MUPDF_INCLUDE = "${mupdf-cxx-dev}/include";
   };
 
   # TODO: manually add mupdf rpath until upstream fixes it
   postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
     for lib in */*.so $out/${python.sitePackages}/*/*.so; do
-      install_name_tool -add_rpath ${lib.getLib mupdf-cxx}/lib "$lib"
+      install_name_tool -add_rpath ${mupdf-cxx-lib}/lib "$lib"
     done
   '';
 

pkgs/development/python-modules/uplc/default.nix

···
   setuptools,
   poetry-core,
   frozendict,
+  cbor2WithoutCExtensions,
   cbor2,
   rply,
   pycardano,
+  uplc,
 }:
 
 buildPythonPackage rec {
   pname = "uplc";
-  version = "1.0.7";
+  version = "1.0.10";
 
   format = "pyproject";
 
···
     owner = "OpShin";
     repo = "uplc";
     tag = version;
-    hash = "sha256-xK2k0XLybWqyP5Qa2Oby8YBgiiswR++yVK7NPgpdSa0=";
+    hash = "sha256-Owo4W4jChrdYnz11BbWQdm2SiwFwOJlqjYutuRyjpxs=";
   };
 
   propagatedBuildInputs = [
···
     python-secp256k1-cardano
   ];
 
+  # Support cbor2 without C extensions
+  postPatch = lib.optionalString (!cbor2.withCExtensions) ''
+    substituteInPlace uplc/ast.py --replace-fail 'from _cbor2' 'from cbor2'
+  '';
+
   pythonImportsCheck = [ "uplc" ];
+
+  passthru.tests.withoutCExtensions = uplc.override {
+    cbor2 = cbor2WithoutCExtensions;
+  };
 
   meta = with lib; {
     description = "Python implementation of untyped plutus language core";

pkgs/development/python-modules/uv/default.nix

···
 {
   buildPythonPackage,
-  installShellFiles,
-  rustPlatform,
-  pkgs,
-  versionCheckHook,
+  hatchling,
+  lib,
+  uv,
 }:
 
 buildPythonPackage {
-  inherit (pkgs.uv)
+  inherit (uv)
     pname
     version
     src
-    cargoDeps
     meta
-    cargoBuildFlags
-    postInstall
-    versionCheckProgramArg
     ;
+  pyproject = true;
 
-  postPatch = ''
-    substituteInPlace python/uv/_find_uv.py \
-      --replace-fail '"""Return the uv binary path."""' "return '$out/bin/uv'"
-  '';
+  build-system = [ hatchling ];
+
+  postPatch =
+    # Do not rely on path lookup at runtime to find the uv binary.
+    # Use the propagated binary instead.
+    ''
+      substituteInPlace python/uv/_find_uv.py \
+        --replace-fail '"""Return the uv binary path."""' "return '${lib.getExe uv}'"
+    ''
+    # Sidestep the maturin build system in favour of reusing the binary already built by nixpkgs,
+    # to avoid rebuilding the uv binary for every active python package set.
+    + ''
+      substituteInPlace pyproject.toml \
+        --replace-fail 'requires = ["maturin>=1.0,<2.0"]' 'requires = ["hatchling"]' \
+        --replace-fail 'build-backend = "maturin"' 'build-backend = "hatchling.build"'
 
-  nativeBuildInputs = [
-    installShellFiles
-    rustPlatform.cargoSetupHook
-    rustPlatform.maturinBuildHook
-  ];
+      cat >> pyproject.toml <<EOF
+      [tool.hatch.build]
+      packages = ['python/uv']
 
-  nativeCheckInputs = [ versionCheckHook ];
+      EOF
+    '';
 
-  pyproject = true;
+  postInstall = ''
+    mkdir -p $out/bin && ln -s ${lib.getExe uv} $out/bin/uv
+  '';
+
   pythonImportsCheck = [ "uv" ];
 }

pkgs/development/python-modules/weasyprint/default.nix

···
 {
-  stdenv,
   lib,
+  stdenv,
   pkgs,
   buildPythonPackage,
-  cffi,
-  cssselect2,
-  fetchPypi,
-  flit-core,
+  fetchFromGitHub,
   fontconfig,
-  fonttools,
   glib,
   harfbuzz,
   pango,
+
+  # build-system
+  flit-core,
+
+  # dependencies
+  cffi,
+  cssselect2,
+  fonttools,
   pillow,
   pydyf,
   pyphen,
+  tinycss2,
+  tinyhtml5,
+
+  # tests
   pytest-cov-stub,
   pytestCheckHook,
-  pythonOlder,
   replaceVars,
-  tinycss2,
-  tinyhtml5,
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
 }:
 
 buildPythonPackage rec {
···
   version = "65.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.9";
-
-  src = fetchPypi {
-    inherit version;
-    pname = "weasyprint";
-    hash = "sha256-EgKBvb1C/6p9flztvjGCos7zbqWtl/6fNX5DvmoeWOo=";
+  src = fetchFromGitHub {
+    owner = "Kozea";
+    repo = "WeasyPrint";
+    tag = "v${version}";
+    hash = "sha256-iSeuRX1dnnrGZbcb1yTxOJPD5kgIWY6oz/0v02QJqSs=";
   };
 
   patches = [
···
     pkgs.ghostscript
     pytest-cov-stub
     pytestCheckHook
+    versionCheckHook
+    writableTmpDirAsHomeHook
   ];
+  versionCheckProgramArg = "--version";
 
   disabledTests = [
     # needs the Ahem font (fails on macOS)
···
   # Set env variable explicitly for Darwin, but allow overriding when invoking directly
   makeWrapperArgs = [ "--set-default FONTCONFIG_FILE ${FONTCONFIG_FILE}" ];
 
-  preCheck = ''
-    # Fontconfig wants to create a cache.
-    export HOME=$TMPDIR
-  '';
-
   pythonImportsCheck = [ "weasyprint" ];
 
   meta = {
···
     homepage = "https://weasyprint.org/";
     license = lib.licenses.bsd3;
     teams = [ lib.teams.apm ];
+    badPlatforms = [
+      # Fatal Python error: Segmentation fault
+      # "...weasyprint/pdf/fonts.py", line 221 in _harfbuzz_subset
+      lib.systems.inspect.patterns.isDarwin
+    ];
   };
 }

pkgs/servers/home-assistant/custom-components/midea_ac/package.nix

···
 buildHomeAssistantComponent rec {
   owner = "mill1000";
   domain = "midea_ac";
-  version = "2025.4.0";
+  version = "2025.5.1";
 
   src = fetchFromGitHub {
     owner = "mill1000";
     repo = "midea-ac-py";
     tag = version;
-    hash = "sha256-ZkLC0GhfN+jp1DWv30LNVCP+NEZywt9Pxycs2RWBzrM=";
+    hash = "sha256-6CNxhgygAyzpy3idj3RkVvI8WMHCfar9v0GG21Y7YKE=";
   };
 
   dependencies = [ msmart-ng ];

pkgs/top-level/python-packages.nix

···
 
   cbor2 = callPackage ../development/python-modules/cbor2 { };
 
+  cbor2WithoutCExtensions = callPackage ../development/python-modules/cbor2 {
+    withCExtensions = false;
+  };
+
   cccolutils = callPackage ../development/python-modules/cccolutils { krb5-c = pkgs.krb5; };
 
   cdcs = callPackage ../development/python-modules/cdcs { };
···
 
   uuid6 = callPackage ../development/python-modules/uuid6 { };
 
-  uv = callPackage ../development/python-modules/uv { };
+  uv = callPackage ../development/python-modules/uv { inherit (pkgs) uv; };
 
   uv-build = callPackage ../development/python-modules/uv-build { };