Merge staging-next into staging

doc/release-notes/rl-2511.section.md

···
 
 - `lima` package now only includes the guest agent for the host's architecture by default. If your guest VM's architecture differs from your Lima host's, you'll need to enable the `lima-additional-guestagents` package by setting `withAdditionalGuestAgents = true` when overriding lima with this input.
 
+- `neovimUtils.makeNeovimConfig` now uses `customLuaRC` parameter instead of accepting `luaRcContent`. The old usage is deprecated but still works with a warning.
+
 - `telegram-desktop` packages now uses `Telegram` for its binary. The previous name was `telegram-desktop`. This is due to [an upstream decision](https://github.com/telegramdesktop/tdesktop/commit/56ff5808a3d766f892bc3c3305afb106b629ef6f) to make the name consistent with other platforms.
 
 - `podofo` has been updated from `0.9.8` to `1.0.0`. These releases are by nature very incompatable due to major api changes. The legacy versions can be found under `podofo_0_10` and `podofo_0_9`.

nixos/tests/vector/dnstap.nix

···
         services.clickhouse.enable = true;
       };
 
+    knot =
+      {
+        config,
+        nodes,
+        pkgs,
+        ...
+      }:
+      let
+        exampleZone = pkgs.writeTextDir "example.com.zone" ''
+          @ SOA ns.example.com. noc.example.com. 2019031301 86400 7200 3600000 172800
+          @       NS      ns1
+          @       NS      ns2
+          ns1     A       192.168.0.1
+          ns1     AAAA    fd00::1
+          ns2     A       192.168.0.2
+          ns2     AAAA    fd00::2
+          www     A       192.0.2.1
+          www     AAAA    2001:DB8::1
+          sub     NS      ns.example.com.
+        '';
+
+        knotZonesEnv = pkgs.buildEnv {
+          name = "knot-zones";
+          paths = [
+            exampleZone
+          ];
+        };
+      in
+      {
+        networking.firewall.allowedUDPPorts = [ 53 ];
+
+        services.vector = {
+          enable = true;
+
+          settings = {
+            sources = {
+              dnstap = {
+                type = "dnstap";
+                multithreaded = true;
+                mode = "unix";
+                lowercase_hostnames = true;
+                socket_file_mode = 504;
+                socket_path = "${dnstapSocket}";
+              };
+            };
+
+            sinks = {
+              vector_dnstap_sink = {
+                type = "vector";
+                inputs = [ "dnstap" ];
+                address = "clickhouse:6000";
+              };
+            };
+          };
+        };
+
+        systemd.services.vector.serviceConfig = {
+          RuntimeDirectory = "vector";
+          RuntimeDirectoryMode = "0770";
+        };
+
+        services.knot = {
+          enable = true;
+          settings = {
+            server = {
+              listen = [
+                "0.0.0.0@53"
+                "::@53"
+              ];
+              automatic-acl = true;
+            };
+            template.default = {
+              storage = knotZonesEnv;
+              dnssec-signing = false;
+              # Input-only zone files
+              # https://www.knot-dns.cz/docs/2.8/html/operation.html#example-3
+              # prevents modification of the zonefiles, since the zonefiles are immutable
+              zonefile-sync = -1;
+              zonefile-load = "difference";
+              journal-content = "changes";
+              global-module = "mod-dnstap/capture_all";
+            };
+            zone = {
+              "example.com".file = "example.com.zone";
+            };
+
+            mod-dnstap = [
+              {
+                id = "capture_all";
+                sink = "unix:${dnstapSocket}";
+              }
+            ];
+          };
+        };
+
+        systemd.services.knot = {
+          after = [ "vector.service" ];
+          wants = [ "vector.service" ];
+          serviceConfig = {
+            # DNSTAP access
+            ReadWritePaths = [ "/var/run/vector" ];
+            SupplementaryGroups = [ "vector" ];
+          };
+        };
+      };
+
     unbound =
-      { config, pkgs, ... }:
+      {
+        config,
+        nodes,
+        pkgs,
+        ...
+      }:
       {
         networking.firewall.allowedUDPPorts = [ 53 ];
 
···
               ];
             };
 
+            forward-zone = [
+              {
+                name = "example.com.";
+                forward-addr = [
+                  nodes.knot.networking.primaryIPv6Address
+                  nodes.knot.networking.primaryIPAddress
+                ];
+              }
+            ];
+
             dnstap = {
               dnstap-enable = "yes";
               dnstap-socket-path = "${dnstapSocket}";
···
         )
         ENGINE = MergeTree()
         PARTITION BY toYYYYMM(timestamp)
-        ORDER BY (serverId, timestamp)
+        ORDER BY (serverId, toStartOfHour(timestamp), domain, timestamp)
         POPULATE AS
         SELECT
           timestamp,
···
         WHERE messageTypeId = 5 # ClientQuery
       '';
 
-      selectQuery = pkgs.writeText "select.sql" ''
+      selectDomainCountQuery = pkgs.writeText "select-domain-count.sql" ''
         SELECT
           domain,
           count(domain)
         FROM dnstap.domains_view
         GROUP BY domain
+      '';
+
+      selectAuthResponseQuery = pkgs.writeText "select-auth-response.sql" ''
+        SELECT
+          *
+        FROM dnstap.records
+        WHERE messageType = 'AuthResponse'
       '';
     in
     ''
···
         "cat ${tableView} | clickhouse-client",
       )
 
+      knot.wait_for_unit("knot")
       unbound.wait_for_unit("unbound")
-      unbound.wait_for_unit("vector")
 
-      unbound.wait_until_succeeds(
-        "journalctl -o cat -u vector.service | grep 'Socket permissions updated to 0o770'"
-      )
-      unbound.wait_until_succeeds(
-        "journalctl -o cat -u vector.service | grep 'component_type=dnstap' | grep 'Listening... path=\"${dnstapSocket}\"'"
-      )
+      for machine in knot, unbound:
+        machine.wait_for_unit("vector")
 
-      unbound.wait_for_file("${dnstapSocket}")
-      unbound.succeed("test 770 -eq $(stat -c '%a' ${dnstapSocket})")
+        machine.wait_until_succeeds(
+          "journalctl -o cat -u vector.service | grep 'Socket permissions updated to 0o770'"
+        )
+        machine.wait_until_succeeds(
+          "journalctl -o cat -u vector.service | grep 'component_type=dnstap' | grep 'Listening... path=\"${dnstapSocket}\"'"
+        )
+
+        machine.wait_for_file("${dnstapSocket}")
+        machine.succeed("test 770 -eq $(stat -c '%a' ${dnstapSocket})")
 
       dnsclient.systemctl("start network-online.target")
       dnsclient.wait_for_unit("network-online.target")
       dnsclient.succeed(
-        "dig @unbound test.local"
+        "dig @unbound test.local",
+        "dig @unbound www.example.com"
       )
 
       unbound.wait_for_file("/var/lib/vector/logs.log")
···
       )
 
       clickhouse.log(clickhouse.wait_until_succeeds(
-        "cat ${selectQuery} | clickhouse-client | grep 'test.local.'"
+        "cat ${selectDomainCountQuery} | clickhouse-client | grep 'test.local.'"
+      ))
+
+      clickhouse.log(clickhouse.wait_until_succeeds(
+        "cat ${selectDomainCountQuery} | clickhouse-client | grep 'www.example.com.'"
+      ))
+
+      clickhouse.log(clickhouse.wait_until_succeeds(
+        "cat ${selectAuthResponseQuery} | clickhouse-client | grep 'Knot DNS ${pkgs.knot-dns.version}'"
       ))
     '';
 }

nixos/tests/vector/journald-clickhouse.nix

···
         m = {}
         m.app = .SYSLOG_IDENTIFIER
         m.host = .host
+        m.boot_id = ._BOOT_ID
         m.severity = to_int(.PRIORITY) ?? 0
         m.level = to_syslog_level(m.severity) ?? ""
         m.message = strip_ansi_escape_codes!(.message)
···
                   "vector_source"
                 ];
                 endpoint = "http://localhost:8123";
+                auth = {
+                  strategy = "basic";
+                  user = "vector";
+                  password = "helloclickhouseworld";
+                };
                 database = "journald";
                 table = "logs";
                 date_time_best_effort = true;
···
 
         services.clickhouse = {
           enable = true;
+        };
+
+        # ACL configuration for Vector
+        environment = {
+          etc."clickhouse-server/users.d/vector.xml".text = ''
+            <clickhouse>
+              <users>
+                <vector>
+                  <password>helloclickhouseworld</password>
+
+                  <access_management>0</access_management>
+
+                  <quota>default</quota>
+                  <default_database>journald</default_database>
+
+                  <grants>
+                    <query>GRANT INSERT ON journald.logs</query>
+                  </grants>
+                </vector>
+              </users>
+            </clickhouse>
+          '';
+
+          # ACL configuration for read-only client
+          etc."clickhouse-server/users.d/grafana.xml".text = ''
+            <clickhouse>
+              <users>
+                <grafana>
+                  <password>helloclickhouseworld2</password>
+
+                  <access_management>0</access_management>
+
+                  <quota>default</quota>
+                  <default_database>journald</default_database>
+
+                  <grants>
+                    <query>GRANT SELECT ON journald.logs</query>
+                  </grants>
+                </grafana>
+              </users>
+            </clickhouse>
+          '';
         };
       };
 
···
       databaseDDL = pkgs.writeText "database.sql" "CREATE DATABASE IF NOT EXISTS journald";
 
       # https://clickhouse.com/blog/storing-log-data-in-clickhouse-fluent-bit-vector-open-telemetry
+      # ORDER BY advice: https://kb.altinity.com/engines/mergetree-table-engine-family/pick-keys/
       tableDDL = pkgs.writeText "table.sql" ''
         CREATE TABLE IF NOT EXISTS journald.logs (
           timestamp DateTime64(6),
-          app LowCardinality(String),
           host LowCardinality(String),
+          boot_id LowCardinality(String),
+          app LowCardinality(String),
           level LowCardinality(String),
           severity UInt8,
           message String,
···
           pid UInt32,
         )
         ENGINE = MergeTree()
-        ORDER BY (host, app, timestamp)
+        ORDER BY (host, boot_id, toStartOfHour(timestamp), app, timestamp)
         PARTITION BY toYYYYMM(timestamp)
       '';
 
···
           "journalctl -o cat -u vector.service | grep 'Vector has started'"
         )
 
+      clickhouse.fail(
+        "cat ${selectQuery} | clickhouse-client --user vector --password helloclickhouseworld | grep 2"
+      )
+
       clickhouse.wait_until_succeeds(
-        "cat ${selectQuery} | clickhouse-client | grep 2"
+        "cat ${selectQuery} | clickhouse-client --user grafana --password helloclickhouseworld2 | grep 2"
       )
     '';
 }

pkgs/applications/editors/neovim/utils.nix

···
     attrs
     // {
       neovimRcContent = customRC;
-      luaRcContent = customLuaRC;
+      luaRcContent =
+        if attrs ? luaRcContent then
+          lib.warn "makeNeovimConfig: luaRcContent parameter is deprecated. Please use customLuaRC instead." attrs.luaRcContent
+        else
+          customLuaRC;
       wrapperArgs = lib.optionals (luaEnv != null) [
         "--prefix"
         "LUA_PATH"

pkgs/applications/editors/vscode/extensions/default.nix

···
           # semver scheme, contrary to preview versions which are listed on
           # the VSCode Marketplace and use a calver scheme. We should avoid
           # using preview versions, because they expire after two weeks.
-          version = "17.2.0";
-          hash = "sha256-jruhqXJfCACYBFUbPCL22nhqCSrm1QFSMIpsPguQ6J8=";
+          version = "17.2.1";
+          hash = "sha256-1p4DDZEFFOIFHV6bkduXmrUGhjMDwrqf5/U2tO00iD0=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/eamodio.gitlens/changelog";

pkgs/applications/editors/vscode/extensions/ms-toolsai.jupyter/default.nix

···
   mktplcRef = {
     name = "jupyter";
     publisher = "ms-toolsai";
-    version = "2025.4.1";
-    hash = "sha256-RLkelWU5chIpGS6dToQ+/jNeEbZYGi2JxeZTqqHAdVA=";
+    version = "2025.5.0";
+    hash = "sha256-3tMuPAyTjvryiHOk0ozIQ8KqIqBV/kxJM01fgC5ZMWE=";
   };
 
   nativeBuildInputs = [

pkgs/applications/editors/vscode/vscode.nix

···
 
   hash =
     {
-      x86_64-linux = "sha256-Rr7JNWloV4VkgGk9zDEnD/WRHSYv5su8UrOSIl3247c=";
-      x86_64-darwin = "sha256-hHAJVmFKwD0Z8YyqvNlM4SpWnSIniVvdMwR3fhk/mKE=";
-      aarch64-linux = "sha256-/pYykG/1IJU7aJ9wtO5oo3dUdCGtfxklre0SGMpgnq8=";
-      aarch64-darwin = "sha256-pWMCQlgxoJ4EGfycuz3H76r9Sc3x006el1ITOM6E4wE=";
-      armv7l-linux = "sha256-M0fK1n/HMuNQvN85I4g5GV8QAg3n6vQtR6V/B1PFAwQ=";
+      x86_64-linux = "sha256-72KrCDUBe+xJjnSY/nnrNH92EP4tp71x1fadh0Pe0DM=";
+      x86_64-darwin = "sha256-Ua3oh0Hv0oiW15u3Rb0pSYu+JD8m1oYMAm5pEzXD6Rw=";
+      aarch64-linux = "sha256-5L0ZArj+7M5dhZDGzYj6NaxYYZEb8q89Vhngvjuw7wQ=";
+      aarch64-darwin = "sha256-uWOF/QGgXocKZAkFMN4Kh7HjiQTSIi+PVPy3V90wrAA=";
+      armv7l-linux = "sha256-FyGPvQeVz8yLhLjFGtCXPTVPvCB0/EX6pRe5RCAmXTU=";
     }
     .${system} or throwSystem;
 in
 callPackage ./generic.nix rec {
   # Please backport all compatible updates to the stable release.
   # This is important for the extension ecosystem.
-  version = "1.101.1";
+  version = "1.101.2";
   pname = "vscode" + lib.optionalString isInsiders "-insiders";
 
   # This is used for VS Code - Remote SSH test
-  rev = "18e3a1ec544e6907be1e944a94c496e302073435";
+  rev = "2901c5ac6db8a986a5666c3af51ff804d05af0d4";
 
   executableName = "code" + lib.optionalString isInsiders "-insiders";
   longName = "Visual Studio Code" + lib.optionalString isInsiders " - Insiders";
···
     src = fetchurl {
       name = "vscode-server-${rev}.tar.gz";
       url = "https://update.code.visualstudio.com/commit:${rev}/server-linux-x64/stable";
-      hash = "sha256-Myq0OUrwv6bq53Q5FDCVtt+wfGlEX2bjz9CMeVLfd+4=";
+      hash = "sha256-Bocoiz8pxQNAZxmWdOgh+y44QTnqvDjcqFCodny7VoY=";
     };
     stdenv = stdenvNoCC;
   };

pkgs/applications/networking/browsers/firefox/packages/firefox.nix

···
 
 buildMozillaMach rec {
   pname = "firefox";
-  version = "140.0.1";
+  version = "140.0.2";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "d521405f49a38b8449a24f90e5ea14d4337085918779d93d282cec80b2627f381648529d6f69930eb6e90e37302797b0049fec5846d25dc40f556bbd86d55ef1";
+    sha512 = "11d3295c82835668f43a888bd5aada22248776e033aecc7558348e6ee26626bf4b65bbaae2680f7285a6b2b6209ec5d4aea453f1e0603544cd48bf45c735b2ea";
   };
 
   meta = {

pkgs/applications/networking/remote/citrix-workspace/generic.nix

···
     '';
   };
 
-  libxml2' = libxml2.overrideAttrs rec {
+  libxml2' = libxml2.overrideAttrs (oldAttrs: rec {
     version = "2.13.8";
     src = fetchurl {
       url = "mirror://gnome/sources/libxml2/${lib.versions.majorMinor version}/libxml2-${version}.tar.xz";
       hash = "sha256-J3KUyzMRmrcbK8gfL0Rem8lDW4k60VuyzSsOhZoO6Eo=";
     };
-  };
+    meta = oldAttrs.meta // {
+      knownVulnerabilities = oldAttrs.meta.knownVulnerabilities or [ ] ++ [
+        "CVE-2025-6021"
+      ];
+    };
+  });
 
 in
 

pkgs/by-name/bi/bink-player/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  autoPatchelfHook,
+  p7zip,
+  libGL,
+  libX11,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "bink-player";
+  version = "2025.05";
+
+  src = fetchurl {
+    url = "https://web.archive.org/web/20250602103030if_/https://www.radgametools.com/down/Bink/BinkLinuxPlayer.7z";
+    hash = "sha256-A3IDQtdYlIcU2U8uieQI6xe1SvW4BqH+5ZwPYJxr83M=";
+  };
+
+  unpackPhase = ''
+    runHook preUnpack
+
+    7z x $src
+
+    runHook postUnpack
+  '';
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    p7zip
+  ];
+
+  buildInputs = [
+    stdenv.cc.cc.lib
+    libGL
+    libX11
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 BinkPlayer64 -t $out/bin/
+    install -Dm755 BinkPlayer -t $out/bin/
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Play videos in the Bink format";
+    homepage = "https://www.radgametools.com/bnkmain.htm";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    license = lib.licenses.unfree;
+    mainProgram = "BinkPlayer64";
+    maintainers = with lib.maintainers; [ nilathedragon ];
+    platforms = [ "x86_64-linux" ];
+  };
+})

pkgs/by-name/ci/ciscoPacketTracer7/package.nix

···
     ];
   };
 
-  libxml2' = libxml2.overrideAttrs rec {
+  libxml2' = libxml2.overrideAttrs (oldAttrs: rec {
     version = "2.13.8";
     src = fetchurl {
       url = "mirror://gnome/sources/libxml2/${lib.versions.majorMinor version}/libxml2-${version}.tar.xz";
       hash = "sha256-J3KUyzMRmrcbK8gfL0Rem8lDW4k60VuyzSsOhZoO6Eo=";
     };
-  };
+    meta = oldAttrs.meta // {
+      knownVulnerabilities = oldAttrs.meta.knownVulnerabilities or [ ] ++ [
+        "CVE-2025-6021"
+      ];
+    };
+  });
 
   fhs = buildFHSEnv {
     pname = "packettracer7";

pkgs/by-name/ci/ciscoPacketTracer8/package.nix

···
     "8.2.2" = "CiscoPacketTracer822_amd64_signed.deb";
   };
 
-  libxml2' = libxml2.overrideAttrs rec {
+  libxml2' = libxml2.overrideAttrs (oldAttrs: rec {
     version = "2.13.8";
     src = fetchurl {
       url = "mirror://gnome/sources/libxml2/${lib.versions.majorMinor version}/libxml2-${version}.tar.xz";
       hash = "sha256-J3KUyzMRmrcbK8gfL0Rem8lDW4k60VuyzSsOhZoO6Eo=";
     };
-  };
+    meta = oldAttrs.meta // {
+      knownVulnerabilities = oldAttrs.meta.knownVulnerabilities or [ ] ++ [
+        "CVE-2025-6021"
+      ];
+    };
+  });
 
   unwrapped = stdenvNoCC.mkDerivation {
     name = "ciscoPacketTracer8-unwrapped";

pkgs/by-name/gi/github-mcp-server/package.nix

···
 
 buildGoModule (finalAttrs: {
   pname = "github-mcp-server";
-  version = "0.5.0";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "github";
     repo = "github-mcp-server";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-dbzO8yTAIfdAwcZEdoJqp+loPQea8iRSsAHdk2DfZ2A=";
+    hash = "sha256-jW/X8vwV47J20aa3E+WqjRL5n9H+Pb2EQwIVIg1pfug=";
   };
 
-  vendorHash = "sha256-gVR7Md3xYrPpeMhHRTKCQKCJvRRIl85uXo+QwlVaPzk=";
+  vendorHash = "sha256-GYfK5QQH0DhoJqc4ynZBWuhhrG5t6KoGpUkZPSfWfEQ=";
 
   ldflags = [
     "-s"

pkgs/by-name/he/headphones/package.nix

···
 
 python3.pkgs.buildPythonApplication rec {
   pname = "headphones";
-  version = "0.6.3";
+  version = "0.6.4";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "rembo10";
     repo = "headphones";
     rev = "v${version}";
-    sha256 = "195v0ylhqd49bqq3dpig5nh0kivmwgmn0977fknix9j14jpvmd3b";
+    sha256 = "0gv7rasjbm4rf9izghibgf5fbjykvzv0ibqc2in1naagjivqrpq4";
   };
 
   dontBuild = true;

pkgs/by-name/ht/html2text/gettext-0.25.patch

···
+diff --git a/Makefile.am b/Makefile.am
+index af28077..e746147 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -13,6 +13,8 @@
+ AUTOMAKE_OPTIONS = foreign
+ ACLOCAL_AMFLAGS = -I m4
+ 
++SUBDIRS =
++
+ AM_YFLAGS = -d -Wno-yacc
+ 
+ bin_PROGRAMS = html2text
+diff --git a/configure.ac b/configure.ac
+index 999c6fe..30c2536 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -15,8 +15,11 @@
+ 
+ AC_PREREQ([2.71])
+ AC_INIT([html2text], [2.3.0], [BUG-REPORT-ADDRESS])
++AC_CONFIG_MACRO_DIRS([m4])
+ AM_INIT_AUTOMAKE
+ AM_MAINTAINER_MODE([disable])
++AM_GNU_GETTEXT_VERSION([0.20])
++AM_GNU_GETTEXT([external])
+ AM_ICONV
+ #AC_CONFIG_SRCDIR([html.h])
+ #AC_CONFIG_HEADERS([config.h])

pkgs/by-name/ht/html2text/package.nix

···
   lib,
   stdenv,
   fetchFromGitLab,
+  autoconf-archive,
   autoreconfHook,
+  bison,
+  gettext,
   libiconv,
 }:
 
 stdenv.mkDerivation rec {
   pname = "html2text";
-  version = "2.2.3";
+  version = "2.3.0";
 
   src = fetchFromGitLab {
     owner = "grobian";
     repo = "html2text";
     rev = "v${version}";
-    hash = "sha256-7Ch51nJ5BeRqs4PEIPnjCGk+Nm2ydgJQCtkcpihXun8=";
+    hash = "sha256-e/KWyc7lOdWhtFC7ZAD7sYgCsO3JzGkLUThVI7edqIQ=";
   };
 
-  nativeBuildInputs = [ autoreconfHook ];
+  nativeBuildInputs = [
+    autoconf-archive
+    autoreconfHook
+    bison
+    gettext
+  ];
+
+  # These changes have all been made in HEAD, across several commits
+  # amongst other changes.
+  # See https://gitlab.com/grobian/html2text/-/merge_requests/57
+  patches = [ ./gettext-0.25.patch ];
 
   buildInputs = lib.optional stdenv.hostPlatform.isDarwin libiconv;
 

pkgs/by-name/lu/lunatask/package.nix

···
 }:
 
 let
-  version = "2.0.22";
+  version = "2.1.1";
   pname = "lunatask";
 
   src = fetchurl {
     url = "https://github.com/lunatask/lunatask/releases/download/v${version}/Lunatask-${version}.AppImage";
-    hash = "sha256-5V4h7x9NMZPAEinWmvhcBj8WrtKXp7naacSaMOEzwl0=";
+    hash = "sha256-2ks5sqE0NuVa3fyJzKJ/466Ztq9M/RhDxHZCL8tSwo4=";
   };
 
   appimageContents = appimageTools.extract {

pkgs/by-name/mi/microsoft-edge/package.nix

···
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "microsoft-edge";
-  version = "137.0.3296.93";
+  version = "138.0.3351.55";
 
   src = fetchurl {
     url = "https://packages.microsoft.com/repos/edge/pool/main/m/microsoft-edge-stable/microsoft-edge-stable_${finalAttrs.version}-1_amd64.deb";
-    hash = "sha256-SC8h6UQ/ee5ZlQWAZsmC1Co5Ky4kaXuoMpvVZtTIMHQ=";
+    hash = "sha256-SZCtAjhzY8BqwM9IMS2081RWxRT+4gQgrjve7avM7Bo=";
   };
 
   # With strictDeps on, some shebangs were not being patched correctly

pkgs/by-name/op/open-policy-agent/package.nix

···
 
 buildGoModule (finalAttrs: {
   pname = "open-policy-agent";
-  version = "1.5.1";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "open-policy-agent";
     repo = "opa";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gIwi+38oUBEVK5DiTU8Avt+lQtXaIf/udyVi4LLvTu8=";
+    hash = "sha256-p03yjLPphS4jp0dK3hlREKzAzCKRPOpvUnmGaGzrwww=";
   };
 
   vendorHash = null;

pkgs/by-name/pa/parca-debuginfo/package.nix

···
 
 buildGoModule rec {
   pname = "parca-debuginfo";
-  version = "0.12.0";
+  version = "0.12.2";
 
   src = fetchFromGitHub {
     owner = "parca-dev";
     repo = "parca-debuginfo";
     tag = "v${version}";
-    hash = "sha256-FXi/iLVDdzyfClRD1tk0FQ9oF5zxW2dfGl4JuDPyZQE=";
+    hash = "sha256-tJ3Xc5b9XnTL460u11RkCmbIc41vHKql/oZ7enTaPgQ=";
   };
 
   vendorHash = "sha256-bH7Y1y9BDMQJGtYfEaSrq+sWVLnovvV/uGbutJUXV2w=";

pkgs/by-name/pa/patch2pr/package.nix

···
 
 buildGoModule rec {
   pname = "patch2pr";
-  version = "0.35.0";
+  version = "0.36.0";
 
   src = fetchFromGitHub {
     owner = "bluekeyes";
     repo = "patch2pr";
     rev = "v${version}";
-    hash = "sha256-dj8xDTl7S1XETJqDI61rdRvQebJ4xgit+xc1xRyaV4M=";
+    hash = "sha256-KaU77UYJJqcTJZrFPiqcdzYIVoih6oSeaPWiQdDiZ2s=";
   };
 
-  vendorHash = "sha256-pn2x6f+N9VYncc490VtPzXkJxwC0nZgj4pDNB+no2Lo=";
+  vendorHash = "sha256-MO6LrUvSu7pYidtjaDgjIEAxoIKM/U9hcePZr336Mbw=";
 
   ldflags = [
     "-X main.version=${version}"

pkgs/by-name/pe/petsc/package.nix

···
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "petsc";
-  version = "3.23.3";
+  version = "3.23.4";
 
   src = fetchzip {
     url = "https://web.cels.anl.gov/projects/petsc/download/release-snapshots/petsc-${finalAttrs.version}.tar.gz";
-    hash = "sha256-1ycMyER09PIN5JyT5nQxUe3GnaVC6WFUUiuug9aXyKc=";
+    hash = "sha256-7UugWo3SzRap3Ed6NySRZOJgD+Wkb9J+QEGRUfLbOPI=";
   };
 
   strictDeps = true;

pkgs/by-name/pr/proton-ge-bin/package.nix

···
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "proton-ge-bin";
-  version = "GE-Proton10-4";
+  version = "GE-Proton10-7";
 
   src = fetchzip {
     url = "https://github.com/GloriousEggroll/proton-ge-custom/releases/download/${finalAttrs.version}/${finalAttrs.version}.tar.gz";
-    hash = "sha256-Si/CQ2PINfhmsC+uW3iFBUoSczZdkqwCZ8FAFuipu68=";
+    hash = "sha256-XlZVQ+xYgg1H1xAHBcXZmF5//7k6w9NNspXJ/1KhzX8=";
   };
 
   dontUnpack = true;

pkgs/by-name/ps/ps3-disc-dumper/deps.json

···
 [
   {
     "pname": "Avalonia",
-    "version": "11.3.0",
-    "hash": "sha256-Hot4dWkrP5x+JzaP2/7E1QOOiXfPGhkvK1nzBacHvzg="
+    "version": "11.3.1",
+    "hash": "sha256-732wl4/JmvYFS26NLvPD7T/V3J3JZUDy6Xwj5p1TNyE="
   },
   {
     "pname": "Avalonia.Angle.Windows.Natives",
-    "version": "2.1.22045.20230930",
-    "hash": "sha256-RxPcWUT3b/+R3Tu5E5ftpr5ppCLZrhm+OTsi0SwW3pc="
+    "version": "2.1.25547.20250602",
+    "hash": "sha256-LE/lENAHptmz6t3T/AoJwnhpda+xs7PqriNGzdcfg8M="
   },
   {
     "pname": "Avalonia.BuildServices",
···
   },
   {
     "pname": "Avalonia.Desktop",
-    "version": "11.3.0",
-    "hash": "sha256-XZXmsKrYCOEWzFUbnwNKvEz5OCD/1lAPi+wM4BiMB7I="
+    "version": "11.3.1",
+    "hash": "sha256-H6SLCi3by9bFF1YR12PnNZSmtC44UQPKr+5+8LvqC90="
   },
   {
     "pname": "Avalonia.Fonts.Inter",
-    "version": "11.3.0",
-    "hash": "sha256-/ObA3b0iPpPFcXBUiD8TmdCXFVqZKToK7YRuU3QUWtg="
+    "version": "11.3.1",
+    "hash": "sha256-LfNYF+SywrIzUw4T+GRE/Mr8E7GQskQQTTfK3Kc5YVQ="
   },
   {
     "pname": "Avalonia.FreeDesktop",
-    "version": "11.3.0",
-    "hash": "sha256-nWIW3aDPI/00/k52BNU4n43sS3ymuw+e97EBSsjjtU4="
+    "version": "11.3.1",
+    "hash": "sha256-Iph1SQazNNr9liox0LR7ITidAEEWhp8Mg9Zn4MZVkRQ="
   },
   {
     "pname": "Avalonia.Native",
-    "version": "11.3.0",
-    "hash": "sha256-l6gcCeGd422mLQgVLp2sxh4/+vZxOPoMrxyfjGyhYLs="
+    "version": "11.3.1",
+    "hash": "sha256-jNzqmHm58bbPGs/ogp6gFvinbN81Psg+sg+Z5UsbcDs="
   },
   {
     "pname": "Avalonia.Remote.Protocol",
-    "version": "11.3.0",
-    "hash": "sha256-7ytabxzTbPLR3vBCCb7Z6dYRZZVvqiDpvxweOYAqi7I="
+    "version": "11.3.1",
+    "hash": "sha256-evkhJOxKjsR+jNLrXRcrhqjFdlrxYMMMRBJ6FK08vMM="
   },
   {
     "pname": "Avalonia.Skia",
-    "version": "11.3.0",
-    "hash": "sha256-p+mWsyrYsC9PPhNjOxPZwarGuwmIjxaQ4Ml/2XiEuEc="
+    "version": "11.3.1",
+    "hash": "sha256-zN09CcuSqtLcQrTCQOoPJrhLd4LioZqt/Qi4sDp/cJI="
   },
   {
     "pname": "Avalonia.Themes.Fluent",
-    "version": "11.3.0",
-    "hash": "sha256-o5scZcwaflLKXQD6VLGZYe4vvQ322Xzgh7F3IvriMfk="
+    "version": "11.3.1",
+    "hash": "sha256-PApWHwIoLzbzrnyXJQLVy85Rbxag7NFEKMXOs2iVVaA="
   },
   {
     "pname": "Avalonia.Win32",
-    "version": "11.3.0",
-    "hash": "sha256-Ltf6EuL6aIG+YSqOqD/ecdqUDsuwhNuh+XilIn7pmlE="
+    "version": "11.3.1",
+    "hash": "sha256-w3+8luJByeIchiVQ0wsq0olDabX/DndigyBEuK8Ty04="
   },
   {
     "pname": "Avalonia.X11",
-    "version": "11.3.0",
-    "hash": "sha256-QOprHb0HjsggEMWOW7/U8pqlD8M4m97FeTMWlriYHaU="
+    "version": "11.3.1",
+    "hash": "sha256-0iUFrDM+10T3OiOeGSEiqQ6EzEucQL3shZUNqOiqkyQ="
   },
   {
     "pname": "CommunityToolkit.Mvvm",
···
   },
   {
     "pname": "HarfBuzzSharp",
-    "version": "7.3.0.3",
-    "hash": "sha256-1vDIcG1aVwVABOfzV09eAAbZLFJqibip9LaIx5k+JxM="
+    "version": "8.3.1.1",
+    "hash": "sha256-614yv6bK9ynhdUnvW4wIkgpBe2sqTh28U9cDZzdhPc0="
   },
   {
     "pname": "HarfBuzzSharp.NativeAssets.Linux",
-    "version": "7.3.0.3",
-    "hash": "sha256-HW5r16wdlgDMbE/IfE5AQGDVFJ6TS6oipldfMztx+LM="
+    "version": "8.3.1.1",
+    "hash": "sha256-sBbez6fc9axVcsBbIHbpQh/MM5NHlMJgSu6FyuZzVyU="
   },
   {
     "pname": "HarfBuzzSharp.NativeAssets.macOS",
-    "version": "7.3.0.3",
-    "hash": "sha256-UpAVfRIYY8Wh8xD4wFjrXHiJcvlBLuc2Xdm15RwQ76w="
+    "version": "8.3.1.1",
+    "hash": "sha256-hK20KbX2OpewIO5qG5gWw5Ih6GoLcIDgFOqCJIjXR/Q="
   },
   {
     "pname": "HarfBuzzSharp.NativeAssets.WebAssembly",
-    "version": "7.3.0.3",
-    "hash": "sha256-jHrU70rOADAcsVfVfozU33t/5B5Tk0CurRTf4fVQe3I="
+    "version": "8.3.1.1",
+    "hash": "sha256-mLKoLqI47ZHXqTMLwP1UCm7faDptUfQukNvdq6w/xxw="
   },
   {
     "pname": "HarfBuzzSharp.NativeAssets.Win32",
-    "version": "7.3.0.3",
-    "hash": "sha256-v/PeEfleJcx9tsEQAo5+7Q0XPNgBqiSLNnB2nnAGp+I="
+    "version": "8.3.1.1",
+    "hash": "sha256-Um4iwLdz9XtaDSAsthNZdev6dMiy7OBoHOrorMrMYyo="
   },
   {
     "pname": "LTRData.DiscUtils.Core",
-    "version": "1.0.54",
-    "hash": "sha256-6n68/HVei6xzPvjTxP8utmHWUYWQ8bA6j19LT7hxCHc="
+    "version": "1.0.57",
+    "hash": "sha256-W3MWde/i+/AjEnVrddhcBiuyHmujVAxq+NpJudgoIpc="
   },
   {
     "pname": "LTRData.DiscUtils.Iso9660",
-    "version": "1.0.54",
-    "hash": "sha256-pW2wKBlMeqNFHXI58p2yR9uEkf3B5MqhRNfIjDt2JYE="
+    "version": "1.0.57",
+    "hash": "sha256-h1LEAyKcrLB/QY77HH2eLAPtdFQccVeycwkVPr7x9/U="
   },
   {
     "pname": "LTRData.DiscUtils.OpticalDisk",
-    "version": "1.0.54",
-    "hash": "sha256-k8DJcb6m2aEFd2SWICAjsZ+8IK4bPX7UP/od3ddI2eY="
+    "version": "1.0.57",
+    "hash": "sha256-SD26HhU4622oUBWU+iK2yTj025RQh+P8ZJybJsZyUSs="
   },
   {
     "pname": "LTRData.DiscUtils.Streams",
-    "version": "1.0.54",
-    "hash": "sha256-e0QWGFOAYFMCp/FDi/0kQ8Rd1hF3oWZ3pwrQX9sCFZg="
+    "version": "1.0.57",
+    "hash": "sha256-00o7vHJGU0yNzFp9FlKBH+gCHVie4VBcx2PnTdW5XZQ="
   },
   {
     "pname": "LTRData.DiscUtils.Udf",
-    "version": "1.0.54",
-    "hash": "sha256-K9Fs4SzQjW+ESuvvVqr9+fTs1hvGv571WCRc2Nl5jfo="
+    "version": "1.0.57",
+    "hash": "sha256-HHCfCaW7SUpOiYBXARnXeAq0yKfPLudVL8HwLrmhL0g="
   },
   {
     "pname": "LTRData.Extensions",
···
   },
   {
     "pname": "System.IO.Hashing",
-    "version": "9.0.4",
-    "hash": "sha256-rbcQzEncB3VuUZIcsE1tq30suf5rvRE4HkE+0lR/skU="
+    "version": "9.0.6",
+    "hash": "sha256-QhOlqpeQsqJ2Lly8xV0lzSaNBmkGPEgtyTe9xSvkyAw="
   },
   {
     "pname": "System.IO.Pipelines",
···
   },
   {
     "pname": "System.Text.Encoding.CodePages",
-    "version": "9.0.4",
-    "hash": "sha256-gW3nGw3ElYCYTEuYxZOk1oyHsj3wBenr6uwJGK0u+IQ="
+    "version": "9.0.5",
+    "hash": "sha256-trMfhFwGMnM60+UUqud7gFLL2YF5pCdhleKSonkkd84="
   },
   {
     "pname": "System.Threading",
···
   },
   {
     "pname": "WmiLight",
-    "version": "6.13.0",
-    "hash": "sha256-dliebNR45yj1Gvyv4WE7dMnWcdHx94PLjBv3AWhdS5I="
+    "version": "6.14.0",
+    "hash": "sha256-MmfXmWsLonyTKNXqmszFbvyaDjPexgH5UoCGI8h2JlA="
   }
 ]

pkgs/by-name/ps/ps3-disc-dumper/package.nix

···
 
 buildDotnetModule rec {
   pname = "ps3-disc-dumper";
-  version = "4.3.6";
+  version = "4.3.9";
 
   src = fetchFromGitHub {
     owner = "13xforever";
     repo = "ps3-disc-dumper";
     tag = "v${version}";
-    hash = "sha256-dHd5pAWvol4TQBXcbb1E71TTxEWvLogvj0K4VL9huNs=";
+    hash = "sha256-F+FyCuxzg7oTF2iRxWygXeGnspHrZ3Za8HhCSKNgoR4=";
   };
 
   dotnet-sdk = dotnetCorePackages.sdk_9_0;

pkgs/by-name/sh/sheldon/package.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "sheldon";
-  version = "0.8.2";
+  version = "0.8.3";
 
   src = fetchFromGitHub {
     owner = "rossmacarthur";
     repo = "sheldon";
     rev = version;
-    hash = "sha256-4tI/D9Z5+BAH7K9mA/sU/qPKWcPvZqpY5v4dDA0qfr0=";
+    hash = "sha256-+NtiscyNlrXNNj3njvdZQB8dHs/PBYpEo9VwodEOtDs=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-MHQbCsZng7YRvY5K+l9u90M/zyyfz2nl01RN46EUSXk=";
+  cargoHash = "sha256-O9v77mwOeTnT4LetcrzQjdd3MDXDbpptUODMAVBwZv8=";
 
   buildInputs =
     [ openssl ]

pkgs/by-name/sh/shopware-cli/package.nix

···
 
 buildGoModule rec {
   pname = "shopware-cli";
-  version = "0.6.10";
+  version = "0.6.16";
   src = fetchFromGitHub {
     repo = "shopware-cli";
     owner = "FriendsOfShopware";
     tag = version;
-    hash = "sha256-kzf54rPac/OYmmqEAoQPWFjtzMj0FOGOMoxdX2zlX8s=";
+    hash = "sha256-oEWJ51XeAOE92u6U2Cjj875mn47R8IRbZ2BHy1zLblw=";
   };
 
   nativeBuildInputs = [
···
     dart-sass
   ];
 
-  vendorHash = "sha256-gw0O9cLRkCo8FMlUSgVsL7c5xSSP7sAcwL/WUAy6MiI=";
+  vendorHash = "sha256-am8tGpevz5KXX+8ckhlNVtoUbG3g739O9KP6rLsF0y8=";
 
   postInstall = ''
     installShellCompletion --cmd shopware-cli \

pkgs/by-name/si/signaturepdf/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "signaturepdf";
-  version = "1.7.4";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "24eme";
     repo = "signaturepdf";
     rev = "v${version}";
-    hash = "sha256-8R1eowMpdb4oj3j+gMJ2RsWVzHvNiXPwFaLHR0jqFJo=";
+    hash = "sha256-Sk59yHnLSmO/Dd+cAntiAXzYyo6Rsp779Q+SszonbMc=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/by-name/sl/slepc/package.nix

···
 assert pythonSupport -> petsc.pythonSupport;
 stdenv.mkDerivation (finalAttrs: {
   pname = "slepc";
-  version = "3.23.1";
+  version = "3.23.2";
 
   src = fetchFromGitLab {
     owner = "slepc";
     repo = "slepc";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-K38/QH4AG8/SksrRLc+jIs1WO8FKFFTNkuHFbBER/tg=";
+    hash = "sha256-nRY8ARc31Q2Qi8Tf7921vBf5nPpI4evSjmpTYUTUigQ=";
   };
 
   postPatch = ''

pkgs/by-name/su/sudo-rs/package.nix

···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "sudo-rs";
-  version = "0.2.6";
+  version = "0.2.7";
 
   src = fetchFromGitHub {
     owner = "trifectatechfoundation";
     repo = "sudo-rs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vZv3IVSW6N0puoWJBYQPmNntgHPt9SPV07TEuWN/bHw=";
+    hash = "sha256-02ODKMumYUKcmSfPAiCwpRph5+Zy+g5uqqbJ9ThRxRg=";
   };
   useFetchCargoVendor = true;
-  cargoHash = "sha256-/CbU2ds2VQ2IXx7GKxRO3vePzLXJXabA1FcyIGPsngw=";
+  cargoHash = "sha256-o3//zJxB6CNHQl1DtfmFnSBP9npC4I9/hRuzpWrKoNs=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/tl/tlsinfo/package.nix

···
 
 buildGoModule rec {
   pname = "tlsinfo";
-  version = "0.1.47";
+  version = "0.1.48";
 
   src = fetchFromGitHub {
     owner = "paepckehh";
     repo = "tlsinfo";
     tag = "v${version}";
-    hash = "sha256-9YOFsUDNxZi1C59ZSQ31QXE9comFa6DGEzvRah0bruY=";
+    hash = "sha256-1483Y1SoAVsXIjpa1CbOvVQsOol6adoQD9PCxHgSgU4=";
   };
 
-  vendorHash = "sha256-f7Rkpz6qGiJNhxlYPJo2G3ykItj+55PvGnNPNOU1ftI=";
+  vendorHash = "sha256-wHCHj7/DBzW0m16aXdQBjPRKjIlf2iab1345ud+ulVQ=";
 
   ldflags = [
     "-s"

pkgs/by-name/ts/tscli/package.nix

···
 
 buildGoModule rec {
   pname = "tscli";
-  version = "0.0.8";
+  version = "0.0.9";
 
   src = fetchFromGitHub {
     owner = "jaxxstorm";
     repo = "tscli";
     tag = "v${version}";
-    hash = "sha256-DlWUJukc4XSZCPtmcUwr5V7Wkn9WoG+tSHdH3YvYLaA=";
+    hash = "sha256-GJkFiofMO9dMFDqISzp/ewH5hxpp04o/dXJ/XNUZk74=";
   };
 
   vendorHash = "sha256-a/1I1enzmtVY/js7w/cCLTts8lGmMKMiCowH0Hr+xdM=";

pkgs/by-name/uw/uwsm/package.nix

···
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "uwsm";
-  version = "0.22.0";
+  version = "0.23.0";
 
   src = fetchFromGitHub {
     owner = "Vladimir-csp";
     repo = "uwsm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8MdgtfmgWVUl5YPP/91KrGNNHl60P2ID2TUMZ4V3BiI=";
+    hash = "sha256-VQhU88JvL7O2MP41JVuBdieIopmqrNiAWacGWvsNhSc=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ve/vector/package.nix

···
 
 let
   pname = "vector";
-  version = "0.47.0";
+  version = "0.48.0";
 in
 rustPlatform.buildRustPackage {
   inherit pname version;
···
     owner = "vectordotdev";
     repo = "vector";
     rev = "v${version}";
-    hash = "sha256-09CjhSckptXbbTzBneo5aQ76YwLPSacRlsMpexsw54c=";
+    hash = "sha256-qgf3aMZc1cgPlsAzgtaXLUx99KwN5no1amdkwFVyl4Y=";
   };
 
-  cargoHash = "sha256-9cCqdi65C4JCMP743nhrNmBlJsIFiNPGguyVEEJpGww=";
+  cargoHash = "sha256-t8mfZpLrzrxj1WUpJPqZWyfBf9XobcqZY/hAeVGzhcM=";
 
   nativeBuildInputs =
     [

pkgs/by-name/za/zashboard/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zashboard";
-  version = "1.94.2";
+  version = "1.96.0";
 
   src = fetchFromGitHub {
     owner = "Zephyruso";
     repo = "zashboard";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bG4fa6lsOsHYly6ORDx9WzUjgW5liY8hgUblYicbXXY=";
+    hash = "sha256-3sY3C4iNqVPhbwWCzGRRJ9pDfewPq7q70kMrXuqZQpc=";
   };
 
   nativeBuildInputs = [

pkgs/development/ocaml-modules/pcre/default.nix

···
 
 buildDunePackage rec {
   pname = "pcre";
-  version = "8.0.3";
+  version = "8.0.4";
 
   useDune2 = true;
 
···
 
   src = fetchurl {
     url = "https://github.com/mmottl/pcre-ocaml/releases/download/${version}/pcre-${version}.tbz";
-    sha256 = "sha256-FIgCeBEAHKz7/6bNsUoqbH2c3eMq62gphVdEa+kNf3k=";
+    sha256 = "sha256-CIoy3Co4YnVZ5AkEjkUarqV0u08ZAqU0IQsaL1SnuCA=";
   };
 
   buildInputs = [ dune-configurator ];

pkgs/development/python-modules/fast-array-utils/default.nix

···
+{
+  buildPythonPackage,
+  dask,
+  fetchFromGitHub,
+  hatch-docstring-description,
+  hatch-fancy-pypi-readme,
+  hatch-min-requirements,
+  hatch-vcs,
+  hatchling,
+  lib,
+  numba,
+  numpy,
+  pytest-codspeed,
+  pytest-doctestplus,
+  pytestCheckHook,
+  scipy,
+}:
+
+buildPythonPackage rec {
+  pname = "fast-array-utils";
+  version = "1.2.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "scverse";
+    repo = "fast-array-utils";
+    tag = "v${version}";
+    hash = "sha256-SQaumXgjFn2+/MqllEs0zRnl2t7m2JZyOd+39vZPU2U=";
+  };
+
+  # hatch-min-requirements tries to talk to PyPI by default. See https://github.com/tlambert03/hatch-min-requirements?tab=readme-ov-file#environment-variables.
+  env.MIN_REQS_OFFLINE = "1";
+
+  build-system = [
+    hatch-docstring-description
+    hatch-fancy-pypi-readme
+    hatch-min-requirements
+    hatch-vcs
+    hatchling
+  ];
+
+  dependencies = [
+    numpy
+  ];
+
+  nativeCheckInputs = [
+    dask
+    numba
+    pytest-codspeed
+    pytest-doctestplus
+    pytestCheckHook
+    scipy
+  ];
+
+  pythonImportsCheck = [
+    "fast_array_utils.conv"
+    "fast_array_utils.types"
+    "fast_array_utils.typing"
+    "fast_array_utils"
+  ];
+
+  meta = {
+    description = "Fast array utilities";
+    homepage = "https://icb-fast-array-utils.readthedocs-hosted.com";
+    license = lib.licenses.mpl20;
+    maintainers = with lib.maintainers; [
+      samuela
+    ];
+  };
+}

pkgs/development/python-modules/hatch-docstring-description/default.nix

···
+{
+  buildPythonPackage,
+  fetchFromGitHub,
+  hatch-vcs,
+  hatchling,
+  lib,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "hatch-docstring-description";
+  version = "1.1.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "flying-sheep";
+    repo = "hatch-docstring-description";
+    tag = "v${version}";
+    hash = "sha256-ouor0FV3qdXYJx5EWFUWSKp8Cc/EuD1WXrtLvbYG+XI=";
+  };
+
+  build-system = [
+    hatchling
+    hatch-vcs
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  disabledTests = [
+    # See https://github.com/flying-sheep/hatch-docstring-description/issues/107
+    "test_e2e[.]"
+    "test_e2e[src]"
+  ];
+
+  pythonImportsCheck = [ "hatch_docstring_description" ];
+
+  meta = {
+    description = "Derive PyPI package description from Python package docstring";
+    homepage = "https://github.com/flying-sheep/hatch-docstring-description";
+    license = lib.licenses.gpl3;
+    maintainers = with lib.maintainers; [
+      samuela
+    ];
+  };
+}

pkgs/development/python-modules/hatch-min-requirements/default.nix

···
+{
+  buildPythonPackage,
+  fetchFromGitHub,
+  hatch-vcs,
+  hatchling,
+  lib,
+}:
+
+buildPythonPackage rec {
+  pname = "hatch-min-requirements";
+  version = "0.1.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "tlambert03";
+    repo = "hatch-min-requirements";
+    tag = "v${version}";
+    hash = "sha256-7/6Es0DHDJ8jZ76kVbWkQjWFd8hWuB+PwCbOmIjzK5o=";
+  };
+
+  build-system = [
+    hatchling
+    hatch-vcs
+  ];
+
+  # As of v0.1.0 all tests attempt to use the network
+  doCheck = false;
+
+  pythonImportsCheck = [ "hatch_min_requirements" ];
+
+  meta = {
+    description = "Hatchling plugin to create optional-dependencies pinned to minimum versions";
+    homepage = "https://github.com/tlambert03/hatch-min-requirements";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [
+      samuela
+    ];
+  };
+}

pkgs/development/python-modules/orbax-checkpoint/default.nix

···
 
 buildPythonPackage rec {
   pname = "orbax-checkpoint";
-  version = "0.11.16";
+  version = "0.11.18";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "orbax";
     tag = "v${version}";
-    hash = "sha256-C5glSasB4LtxcaDx8U5rn7Y5J39+ieP0Mh2ITE1y1k8=";
+    hash = "sha256-Uosd2TfC3KJMp46SnNnodPBc+G1nNdqFOwPQA+aVyrQ=";
   };
 
   sourceRoot = "${src.name}/checkpoint";

pkgs/development/python-modules/wandb/default.nix

···
 
     # broke somewhere between sentry-sdk 2.15.0 and 2.22.0
     "tests/unit_tests/test_analytics/test_sentry.py"
+
+    # Server connection times out under load
+    "tests/unit_tests/test_wandb_login.py"
+
+    # PermissionError: unable to write to .cache/wandb/artifacts
+    "tests/unit_tests/test_artifacts/test_wandb_artifacts.py"
   ];
 
   disabledTests =
···
       "test_log_media_prefixed_with_multiple_slashes"
       "test_log_media_saves_to_run_directory"
       "test_log_media_with_path_traversal"
+
+      # HandleAbandonedError / SystemExit when run in sandbox
+      "test_makedirs_raises_oserror__uses_temp_dir"
+
+      # AssertionError: Not all requests have been executed
+      "test_image_refs"
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       # AssertionError: assert not copy2_mock.called
···
 
       # RuntimeError: *** -[__NSPlaceholderArray initWithObjects:count:]: attempt to insert nil object from objects[1]
       "test_wandb_image_with_matplotlib_figure"
-
-      # HandleAbandonedError / SystemExit when run in sandbox
-      "test_makedirs_raises_oserror__uses_temp_dir"
     ];
 
   pythonImportsCheck = [ "wandb" ];

pkgs/shells/fish/plugins/forgit.nix

···
 
 buildFishPlugin rec {
   pname = "forgit";
-  version = "25.06.0";
+  version = "25.07.0";
 
   src = fetchFromGitHub {
     owner = "wfxr";
     repo = "forgit";
     rev = version;
-    hash = "sha256-D1we3pOPXNsK8KgEaRBAmD5eH1i2ud4zX1GwYbOyZvY=";
+    hash = "sha256-h9li2nwKG6SnOQntWZpdeBbU3RrwO4+4yO7tAwuOwhE=";
   };
 
   postInstall = ''

pkgs/tools/admin/pgadmin/default.nix

···
   nixosTests,
   postgresqlTestHook,
   postgresql,
-  yarn-berry_3,
+  yarn-berry_4,
   nodejs,
   autoconf,
   automake,
···
 
 let
   pname = "pgadmin";
-  version = "9.4";
-  yarnHash = "sha256-AlAyHtadjmKZb0rHNIlaPtEcGFQ15Fc6rExMsNFGwDc=";
+  version = "9.5";
+  yarnHash = "sha256-i3WCEpcZepB7K0A4QgjoLfkO7icew/8usJCo4DkWT6I=";
 
   src = fetchFromGitHub {
     owner = "pgadmin-org";
     repo = "pgadmin4";
     rev = "REL-${lib.versions.major version}_${lib.versions.minor version}";
-    hash = "sha256-oslp9g63mYeP9CmpCzF80nlyqF1ftGbMRIsp6goJOx4=";
+    hash = "sha256-5FwYkdhpg/2Cidi2qiFhhsQYbIwsp80K3MNxw5rp4ww=";
   };
 
   mozjpeg-bin = fetchFromGitHub {
···
 pythonPackages.buildPythonApplication rec {
   inherit pname version src;
 
-  offlineCache = yarn-berry_3.fetchYarnBerryDeps {
+  offlineCache = yarn-berry_4.fetchYarnBerryDeps {
     # mozjpeg fails to build on darwin due to a hardocded path
     # this has been fixed upstream on master but no new version
     # has been released. We therefore point yarn to upstream
···
     export LD=$CC
     export HOME=$(mktemp -d)
     export YARN_ENABLE_SCRIPTS=1
-    YARN_IGNORE_PATH=1 ${yarn-berry_3.yarn-berry-offline}/bin/yarn config set enableTelemetry false
-    YARN_IGNORE_PATH=1 ${yarn-berry_3.yarn-berry-offline}/bin/yarn config set enableGlobalCache false
+    YARN_IGNORE_PATH=1 ${yarn-berry_4.yarn-berry-offline}/bin/yarn config set enableTelemetry false
+    YARN_IGNORE_PATH=1 ${yarn-berry_4.yarn-berry-offline}/bin/yarn config set enableGlobalCache false
     export npm_config_nodedir="${srcOnly nodejs}"
     export npm_config_node_gyp="${nodejs}/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js"
-    YARN_IGNORE_PATH=1 ${yarn-berry_3.yarn-berry-offline}/bin/yarn install --inline-builds
+    YARN_IGNORE_PATH=1 ${yarn-berry_4.yarn-berry-offline}/bin/yarn install --inline-builds
     )
     yarn webpacker
     cp -r * ../pip-build/pgadmin4
···
     cython
     pip
     sphinx
-    yarn-berry_3
-    yarn-berry_3.yarnBerryConfigHook
+    yarn-berry_4
+    yarn-berry_4.yarnBerryConfigHook
     nodejs
 
     # for building mozjpeg2

pkgs/tools/admin/pgadmin/mozjpeg.patch

···
 diff --git a/yarn.lock b/yarn.lock
-index fa189ef..54066a6 100644
+index 8bfff31..0f12f87 100644
 --- a/yarn.lock
 +++ b/yarn.lock
-@@ -7299,6 +7299,23 @@ __metadata:
+@@ -7347,6 +7347,23 @@ __metadata:
    languageName: node
    linkType: hard
- 
+
 +"execa@npm:^7.1.1":
 +  version: 7.1.1
 +  resolution: "execa@npm:7.1.1"
 +  dependencies:
-+    cross-spawn: ^7.0.3
-+    get-stream: ^6.0.1
-+    human-signals: ^3.0.1
-+    is-stream: ^3.0.0
-+    merge-stream: ^2.0.0
-+    npm-run-path: ^5.1.0
-+    onetime: ^6.0.0
-+    signal-exit: ^3.0.7
-+    strip-final-newline: ^3.0.0
-+  checksum: 21fa46fc69314ace4068cf820142bdde5b643a5d89831c2c9349479c1555bff137a291b8e749e7efca36535e4e0a8c772c11008ca2e84d2cbd6ca141a3c8f937
++    cross-spawn: "npm:^7.0.3"
++    get-stream: "npm:^6.0.1"
++    human-signals: "npm:^3.0.1"
++    is-stream: "npm:^3.0.0"
++    merge-stream: "npm:^2.0.0"
++    npm-run-path: "npm:^5.1.0"
++    onetime: "npm:^6.0.0"
++    signal-exit: "npm:^3.0.7"
++    strip-final-newline: "npm:^3.0.0"
++  checksum: 0da5ee1c895b62142bc3d1567d1974711c28c2cfa6bae96e1923379bd597e476d762a13f282f92815d8ebfa33407949634fa32a0d6db8334a20e625fe11d4351
 +  languageName: node
 +  linkType: hard
 +
  "executable@npm:^4.1.0":
    version: 4.1.1
    resolution: "executable@npm:4.1.1"
-@@ -11027,13 +11044,14 @@ __metadata:
- 
+@@ -11120,13 +11137,14 @@ __metadata:
+
  "mozjpeg@npm:^8.0.0":
    version: 8.0.0
 -  resolution: "mozjpeg@npm:8.0.0"
 +  resolution: "mozjpeg@https://github.com/imagemin/mozjpeg-bin.git#commit=c0587fbc00b21ed8cad8bae499a0827baeaf7ffa"
    dependencies:
-     bin-build: ^3.0.0
-     bin-wrapper: ^4.0.0
-+    execa: ^7.1.1
+     bin-build: "npm:^3.0.0"
+     bin-wrapper: "npm:^4.0.0"
++    execa: "npm:^7.1.1"
    bin:
      mozjpeg: cli.js
--  checksum: cba27c2efbc21a48434da1c6c8d6886988432430f958315fc59ef9b52bc2d6ee597e19f1cf6aae0fd611d5b2a113561fe2e85ec30a1ccd55c007340c638eb557
+-  checksum: 10c0/e91294c15bb31dcaa5eb0780e772214052aa8cb1efc35f74a5c4fe85c9af9d3d6e2f3dc64d3379a86a63b5cbc86a2618c23e350c9131e55ac76726647537b7e8
 +  checksum: cba27c2efbc21a48434da1c6c8d6886988432430f958315fc59ef9b52bc2d6ee597e19f1cf6aae0fd611d5b2a113561fe2e85ec30a1ccd55c007340c638eb556
    languageName: node
    linkType: hard
- 

pkgs/tools/admin/pgadmin/update.sh

···
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl wget jq common-updater-scripts yarn-berry_3 yarn-berry_3.yarn-berry-fetcher
+#!nix-shell -i bash -p curl wget jq common-updater-scripts yarn-berry_4 yarn-berry_4.yarn-berry-fetcher
 
 set -eu -o pipefail
 

pkgs/tools/typesetting/tex/texlive/bin.nix

···
         url = "https://bugs.debian.org/cgi-bin/bugreport.cgi?att=1;bug=1009196;filename=lua_fixed_hash.patch;msg=45";
         sha256 = "sha256-FTu1eRd3AUU7IRs2/7e7uwHuvZsrzTBPypbcEZkU7y4=";
       })
+      # The original LuaJIT version number used here is 2.1.1736781742.
+      # The patch number in this is the unix epoch timestamp of the commit used.
+      # TexLive already truncates the patch number to the last 5 digits (81742
+      # in this case), however, this number will roll over every 1.1 days (1e5
+      # seconds), making it non-monotonic.
+      # Furthermore, the nix-darwin linker requires version numbers to be <=
+      # 1023.
+      # We therefore opt to choose a 3-digit sequence from the unix epoch that
+      # gives a good tradeoff between when it will roll over, and how often it
+      # will actually change: digits 9-7 (counting from the right, i.e., 736 in
+      # this case) yields a number that changes every 11.6 days (1e6 seconds,
+      # it is unlikely texlive will be updated on a shorter interval), and will
+      # stay stable for 31.7 years (1e9 seconds).
+      ./truncate-luajit-version-number.patch
     ];
 
     hardeningDisable = [ "format" ];

pkgs/tools/typesetting/tex/texlive/truncate-luajit-version-number.patch

···
+From 2da802031f7b7f2c9f5327b5155af9aec0d02686 Mon Sep 17 00:00:00 2001
+From: Christoph Jabs <[e-mail]>
+Date: Tue, 1 Jul 2025 13:05:54 +0300
+Subject: [PATCH] truncate luajit version number
+
+---
+ libs/luajit/configure        | 24 ++++++++++++------------
+ libs/luajit/native/configure | 20 ++++++++++----------
+ libs/luajit/version.ac       |  2 +-
+ 3 files changed, 23 insertions(+), 23 deletions(-)
+
+diff --git a/libs/luajit/configure b/libs/luajit/configure
+index c1bc09c039..2ba3598fb8 100755
+--- a/libs/luajit/configure
++++ b/libs/luajit/configure
+@@ -1,6 +1,6 @@
+ #! /bin/sh
+ # Guess values for system-dependent variables and create Makefiles.
+-# Generated by GNU Autoconf 2.72 for luajit for TeX Live 2.1.81742.
++# Generated by GNU Autoconf 2.72 for luajit for TeX Live 2.1.736.
+ #
+ # Report bugs to <[e-mail]>.
+ #
+@@ -614,8 +614,8 @@ MAKEFLAGS=
+ # Identity of this package.
+ PACKAGE_NAME='luajit for TeX Live'
+ PACKAGE_TARNAME='luajit-for-tex-live'
+-PACKAGE_VERSION='2.1.81742'
+-PACKAGE_STRING='luajit for TeX Live 2.1.81742'
++PACKAGE_VERSION='2.1.736'
++PACKAGE_STRING='luajit for TeX Live 2.1.736'
+ PACKAGE_BUGREPORT='[e-mail]'
+ PACKAGE_URL=''
+ 
+@@ -1385,7 +1385,7 @@ if test "$ac_init_help" = "long"; then
+   # Omit some internal or obsolete options to make the list less imposing.
+   # This message is too long to be a string in the A/UX 3.1 sh.
+   cat <<_ACEOF
+-'configure' configures luajit for TeX Live 2.1.81742 to adapt to many kinds of systems.
++'configure' configures luajit for TeX Live 2.1.736 to adapt to many kinds of systems.
+ 
+ Usage: $0 [OPTION]... [VAR=VALUE]...
+ 
+@@ -1457,7 +1457,7 @@ fi
+ 
+ if test -n "$ac_init_help"; then
+   case $ac_init_help in
+-     short | recursive ) echo "Configuration of luajit for TeX Live 2.1.81742:";;
++     short | recursive ) echo "Configuration of luajit for TeX Live 2.1.736:";;
+    esac
+   cat <<\_ACEOF
+ 
+@@ -1578,7 +1578,7 @@ fi
+ test -n "$ac_init_help" && exit $ac_status
+ if $ac_init_version; then
+   cat <<\_ACEOF
+-luajit for TeX Live configure 2.1.81742
++luajit for TeX Live configure 2.1.736
+ generated by GNU Autoconf 2.72
+ 
+ Copyright (C) 2023 Free Software Foundation, Inc.
+@@ -2134,7 +2134,7 @@ cat >config.log <<_ACEOF
+ This file contains any messages produced by compilers while
+ running configure, to aid debugging if configure makes a mistake.
+ 
+-It was created by luajit for TeX Live $as_me 2.1.81742, which was
++It was created by luajit for TeX Live $as_me 2.1.736, which was
+ generated by GNU Autoconf 2.72.  Invocation command line was
+ 
+   $ $0$ac_configure_args_raw
+@@ -5102,7 +5102,7 @@ fi
+ 
+ # Define the identity of the package.
+  PACKAGE='luajit-for-tex-live'
+- VERSION='2.1.81742'
++ VERSION='2.1.736'
+ 
+ 
+ printf "%s\n" "#define PACKAGE \"$PACKAGE\"" >>confdefs.h
+@@ -6703,10 +6703,10 @@ printf "%s\n" "no, using $LN_S" >&6; }
+ fi
+ 
+ 
+-LUAJITVERSION=2.1.81742
++LUAJITVERSION=2.1.736
+ 
+ 
+-LUAJIT_LT_VERSINFO=3:81742:1
++LUAJIT_LT_VERSINFO=3:736:1
+ 
+ 
+ case `pwd` in
+@@ -17377,7 +17377,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
+ # report actual input values of CONFIG_FILES etc. instead of their
+ # values after options handling.
+ ac_log="
+-This file was extended by luajit for TeX Live $as_me 2.1.81742, which was
++This file was extended by luajit for TeX Live $as_me 2.1.736, which was
+ generated by GNU Autoconf 2.72.  Invocation command line was
+ 
+   CONFIG_FILES    = $CONFIG_FILES
+@@ -17445,7 +17445,7 @@ ac_cs_config_escaped=`printf "%s\n" "$ac_cs_config" | sed "s/^ //; s/'/'\\\\\\\\
+ cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
+ ac_cs_config='$ac_cs_config_escaped'
+ ac_cs_version="\\
+-luajit for TeX Live config.status 2.1.81742
++luajit for TeX Live config.status 2.1.736
+ configured by $0, generated by GNU Autoconf 2.72,
+   with options \\"\$ac_cs_config\\"
+ 
+diff --git a/libs/luajit/native/configure b/libs/luajit/native/configure
+index 23c4d29bf0..8f9c93f8ff 100755
+--- a/libs/luajit/native/configure
++++ b/libs/luajit/native/configure
+@@ -1,6 +1,6 @@
+ #! /bin/sh
+ # Guess values for system-dependent variables and create Makefiles.
+-# Generated by GNU Autoconf 2.72 for luajit native 2.1.81742.
++# Generated by GNU Autoconf 2.72 for luajit native 2.1.736.
+ #
+ # Report bugs to <[e-mail]>.
+ #
+@@ -604,8 +604,8 @@ MAKEFLAGS=
+ # Identity of this package.
+ PACKAGE_NAME='luajit native'
+ PACKAGE_TARNAME='luajit-native'
+-PACKAGE_VERSION='2.1.81742'
+-PACKAGE_STRING='luajit native 2.1.81742'
++PACKAGE_VERSION='2.1.736'
++PACKAGE_STRING='luajit native 2.1.736'
+ PACKAGE_BUGREPORT='[e-mail]'
+ PACKAGE_URL=''
+ 
+@@ -1316,7 +1316,7 @@ if test "$ac_init_help" = "long"; then
+   # Omit some internal or obsolete options to make the list less imposing.
+   # This message is too long to be a string in the A/UX 3.1 sh.
+   cat <<_ACEOF
+-'configure' configures luajit native 2.1.81742 to adapt to many kinds of systems.
++'configure' configures luajit native 2.1.736 to adapt to many kinds of systems.
+ 
+ Usage: $0 [OPTION]... [VAR=VALUE]...
+ 
+@@ -1387,7 +1387,7 @@ fi
+ 
+ if test -n "$ac_init_help"; then
+   case $ac_init_help in
+-     short | recursive ) echo "Configuration of luajit native 2.1.81742:";;
++     short | recursive ) echo "Configuration of luajit native 2.1.736:";;
+    esac
+   cat <<\_ACEOF
+ 
+@@ -1484,7 +1484,7 @@ fi
+ test -n "$ac_init_help" && exit $ac_status
+ if $ac_init_version; then
+   cat <<\_ACEOF
+-luajit native configure 2.1.81742
++luajit native configure 2.1.736
+ generated by GNU Autoconf 2.72
+ 
+ Copyright (C) 2023 Free Software Foundation, Inc.
+@@ -1883,7 +1883,7 @@ cat >config.log <<_ACEOF
+ This file contains any messages produced by compilers while
+ running configure, to aid debugging if configure makes a mistake.
+ 
+-It was created by luajit native $as_me 2.1.81742, which was
++It was created by luajit native $as_me 2.1.736, which was
+ generated by GNU Autoconf 2.72.  Invocation command line was
+ 
+   $ $0$ac_configure_args_raw
+@@ -4851,7 +4851,7 @@ fi
+ 
+ # Define the identity of the package.
+  PACKAGE='luajit-native'
+- VERSION='2.1.81742'
++ VERSION='2.1.736'
+ 
+ 
+ printf "%s\n" "#define PACKAGE \"$PACKAGE\"" >>confdefs.h
+@@ -6905,7 +6905,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
+ # report actual input values of CONFIG_FILES etc. instead of their
+ # values after options handling.
+ ac_log="
+-This file was extended by luajit native $as_me 2.1.81742, which was
++This file was extended by luajit native $as_me 2.1.736, which was
+ generated by GNU Autoconf 2.72.  Invocation command line was
+ 
+   CONFIG_FILES    = $CONFIG_FILES
+@@ -6973,7 +6973,7 @@ ac_cs_config_escaped=`printf "%s\n" "$ac_cs_config" | sed "s/^ //; s/'/'\\\\\\\\
+ cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
+ ac_cs_config='$ac_cs_config_escaped'
+ ac_cs_version="\\
+-luajit native config.status 2.1.81742
++luajit native config.status 2.1.736
+ configured by $0, generated by GNU Autoconf 2.72,
+   with options \\"\$ac_cs_config\\"
+ 
+diff --git a/libs/luajit/version.ac b/libs/luajit/version.ac
+index 4aac6497c1..534f508733 100644
+--- a/libs/luajit/version.ac
++++ b/libs/luajit/version.ac
+@@ -11,4 +11,4 @@ dnl  m4-include this file to define the current luajit version
+ dnl m4_define([luajit_version], [2.1.1736781742])
+ dnl libtool:   error: REVISION '1736781742' must be a nonnegative integer
+ dnl libtool:   error: '3:1736781742:1' is not valid version information
+-m4_define([luajit_version], [2.1.81742])
++m4_define([luajit_version], [2.1.736])
+-- 
+2.49.0
+

pkgs/top-level/python-packages.nix

···
 
   farama-notifications = callPackage ../development/python-modules/farama-notifications { };
 
+  fast-array-utils = callPackage ../development/python-modules/fast-array-utils { };
+
   fast-histogram = callPackage ../development/python-modules/fast-histogram { };
 
   fastai = callPackage ../development/python-modules/fastai { };
···
 
   hatch-babel = callPackage ../development/python-modules/hatch-babel { };
 
+  hatch-docstring-description =
+    callPackage ../development/python-modules/hatch-docstring-description
+      { };
+
   hatch-fancy-pypi-readme = callPackage ../development/python-modules/hatch-fancy-pypi-readme { };
 
   hatch-jupyter-builder = callPackage ../development/python-modules/hatch-jupyter-builder { };
+
+  hatch-min-requirements = callPackage ../development/python-modules/hatch-min-requirements { };
 
   hatch-nodejs-version = callPackage ../development/python-modules/hatch-nodejs-version { };