Merge staging-next into staging

.github/actions/get-merge-commit/action.yml

@@ -1,23 +1,31 @@
 name: Get merge commit
 
-description: 'Checks whether the Pull Request is mergeable and returns two commit hashes: The result of a temporary merge of the head branch into the target branch ("merged"), and the parent of that commit on the target branch ("target"). Handles push events and merge conflicts gracefully.'
+description: 'Checks whether the Pull Request is mergeable and checks out the repo at up to two commits: The result of a temporary merge of the head branch into the target branch ("merged"), and the parent of that commit on the target branch ("target"). Handles push events and merge conflicts gracefully.'
+
+inputs:
+  merged-as-untrusted:
+    description: "Whether to checkout the merge commit in the ./untrusted folder."
+    type: boolean
+  target-as-trusted:
+    description: "Whether to checkout the target commit in the ./trusted folder."
+    type: boolean
 
 outputs:
   mergedSha:
     description: "The merge commit SHA"
-    value: ${{ fromJSON(steps.merged.outputs.result).mergedSha }}
+    value: ${{ steps.commits.outputs.mergedSha }}
   targetSha:
     description: "The target commit SHA"
-    value: ${{ fromJSON(steps.merged.outputs.result).targetSha }}
+    value: ${{ steps.commits.outputs.targetSha }}
 
 runs:
   using: composite
   steps:
-    - id: merged
+    - id: commits
       uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
       with:
         script: |
-          if (context.eventName == 'push') return { mergedSha: context.sha }
+          if (context.eventName == 'push') return core.setOutput('mergedSha', context.sha)
 
           for (const retryInterval of [5, 10, 20, 40, 80]) {
             console.log("Checking whether the pull request can be merged...")
@@ -35,32 +43,46 @@ runs:
               continue
             }
 
+            let mergedSha, targetSha
+
             if (prInfo.mergeable) {
               console.log("The PR can be merged.")
 
-              const mergedSha = prInfo.merge_commit_sha
-              const targetSha = (await github.rest.repos.getCommit({
+              mergedSha = prInfo.merge_commit_sha
+              targetSha = (await github.rest.repos.getCommit({
                 owner: context.repo.owner,
                 repo: context.repo.repo,
                 ref: prInfo.merge_commit_sha
               })).data.parents[0].sha
-
-              console.log(`Checking the commits:\nmerged:${mergedSha}\ntarget:${targetSha}`)
-
-              return { mergedSha, targetSha }
             } else {
               console.log("The PR has a merge conflict.")
 
-              const mergedSha = prInfo.head.sha
-              const targetSha = (await github.rest.repos.compareCommitsWithBasehead({
+              mergedSha = prInfo.head.sha
+              targetSha = (await github.rest.repos.compareCommitsWithBasehead({
                 owner: context.repo.owner,
                 repo: context.repo.repo,
                 basehead: `${prInfo.base.sha}...${prInfo.head.sha}`
               })).data.merge_base_commit.sha
-
-              console.log(`Checking the commits:\nmerged:${mergedSha}\ntarget:${targetSha}`)
-
-              return { mergedSha, targetSha }
             }
+
+            console.log(`Checking the commits:\nmerged:${mergedSha}\ntarget:${targetSha}`)
+            core.setOutput('mergedSha', mergedSha)
+            core.setOutput('targetSha', targetSha)
+            return
           }
           throw new Error("Not retrying anymore. It's likely that GitHub is having internal issues: check https://www.githubstatus.com.")
+
+      # Would be great to do the checkouts in git worktrees of the existing spare checkout instead,
+      # but Nix is broken with them:
+      # https://github.com/NixOS/nix/issues/6073
+    - if: inputs.merged-as-untrusted && steps.commits.outputs.mergedSha
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with:
+        ref: ${{ steps.commits.outputs.mergedSha }}
+        path: untrusted
+
+    - if: inputs.target-as-trusted && steps.commits.outputs.targetSha
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with:
+        ref: ${{ steps.commits.outputs.targetSha }}
+        path: trusted

.github/workflows/check-cherry-picks.yml

@@ -21,10 +21,11 @@ jobs:
         with:
           fetch-depth: 0
           filter: blob:none
+          path: trusted
 
       - name: Check cherry-picks
         env:
           BASE_SHA: ${{ github.event.pull_request.base.sha }}
           HEAD_SHA: ${{ github.event.pull_request.head.sha }}
         run: |
-          ./maintainers/scripts/check-cherry-picks.sh "$BASE_SHA" "$HEAD_SHA"
+          ./trusted/maintainers/scripts/check-cherry-picks.sh "$BASE_SHA" "$HEAD_SHA"

.github/workflows/check-format.yml

@@ -16,13 +16,10 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           sparse-checkout: .github/actions
-      - name: Check if the PR can be merged and get the test merge commit
+      - name: Check if the PR can be merged and checkout the merge commit
         uses: ./.github/actions/get-merge-commit
-        id: get-merge-commit
-
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: ${{ steps.get-merge-commit.outputs.mergedSha }}
+          merged-as-untrusted: true
 
       - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
         with:
@@ -33,7 +30,7 @@ jobs:
           # Note that it's fine to run this on untrusted code because:
           # - There's no secrets accessible here
           # - The build is sandboxed
-          if ! nix-build ci -A fmt.check; then
+          if ! nix-build untrusted/ci -A fmt.check; then
             echo "Some files are not properly formatted"
             echo "Please format them by going to the Nixpkgs root directory and running one of:"
             echo "  nix-shell --run treefmt"

.github/workflows/check-shell.yml

@@ -33,15 +33,12 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           sparse-checkout: .github/actions
-      - name: Check if the PR can be merged and get the test merge commit
+      - name: Check if the PR can be merged and checkout the merge commit
         uses: ./.github/actions/get-merge-commit
-        id: get-merge-commit
-
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: ${{ steps.get-merge-commit.outputs.mergedSha }}
+          merged-as-untrusted: true
 
       - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
 
       - name: Build shell
-        run: nix-build ci -A shell
+        run: nix-build untrusted/ci -A shell

.github/workflows/codeowners-v2.yml

@@ -46,9 +46,11 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           sparse-checkout: .github/actions
-      - name: Check if the PR can be merged and get the test merge commit
+      - name: Check if the PR can be merged and checkout the merge and target commits
         uses: ./.github/actions/get-merge-commit
-        id: get-merge-commit
+        with:
+          merged-as-untrusted: true
+          target-as-trusted: true
 
       - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
 
@@ -58,15 +60,8 @@ jobs:
           name: nixpkgs-ci
           authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
 
-      # Important: Because we use pull_request_target, this checks out the base branch of the PR, not the PR itself.
-      # We later build and run code from the base branch with access to secrets,
-      # so it's important this is not the PRs code.
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          path: base
-
       - name: Build codeowners validator
-        run: nix-build base/ci -A codeownersValidator
+        run: nix-build trusted/ci -A codeownersValidator
 
       - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
         if: vars.OWNER_RO_APP_ID
@@ -77,17 +72,12 @@ jobs:
           permission-administration: read
           permission-members: read
 
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          ref: ${{ steps.get-merge-commit.outputs.mergedSha }}
-          path: pr
-
       - name: Validate codeowners
         if: steps.app-token.outputs.token
         env:
-          OWNERS_FILE: pr/${{ env.OWNERS_FILE }}
+          OWNERS_FILE: untrusted/${{ env.OWNERS_FILE }}
           GITHUB_ACCESS_TOKEN: ${{ steps.app-token.outputs.token }}
-          REPOSITORY_PATH: pr
+          REPOSITORY_PATH: untrusted
           OWNER_CHECKER_REPOSITORY: ${{ github.repository }}
           # Set this to "notowned,avoid-shadowing" to check that all files are owned by somebody
           EXPERIMENTAL_CHECKS: "avoid-shadowing"
@@ -104,6 +94,8 @@ jobs:
       # Important: Because we use pull_request_target, this checks out the base branch of the PR, not the PR head.
       # This is intentional, because we need to request the review of owners as declared in the base branch.
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          path: trusted
 
       - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
         if: vars.OWNER_APP_ID
@@ -116,7 +108,7 @@ jobs:
           permission-pull-requests: write
 
       - name: Build review request package
-        run: nix-build ci -A requestReviews
+        run: nix-build trusted/ci -A requestReviews
 
       - name: Request reviews
         if: steps.app-token.outputs.token

.github/workflows/eval-aliases.yml

@@ -16,15 +16,10 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           sparse-checkout: .github/actions
-      - name: Check if the PR can be merged and get the test merge commit
+      - name: Check if the PR can be merged and checkout the merge commit
         uses: ./.github/actions/get-merge-commit
-        id: get-merge-commit
-
-      - name: Check out the PR at the test merge commit
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: ${{ steps.get-merge-commit.outputs.mergedSha }}
-          path: nixpkgs
+          merged-as-untrusted: true
 
       - name: Install Nix
         uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
@@ -32,8 +27,8 @@ jobs:
           extra_nix_config: sandbox = true
 
       - name: Ensure flake outputs on all systems still evaluate
-        run: nix flake check --all-systems --no-build ./nixpkgs
+        run: nix flake check --all-systems --no-build ./untrusted
 
       - name: Query nixpkgs with aliases enabled to check for basic syntax errors
         run: |
-          time nix-env -I ./nixpkgs -f ./nixpkgs -qa '*' --option restrict-eval true --option allow-import-from-derivation false >/dev/null
+          time nix-env -I ./untrusted -f ./untrusted -qa '*' --option restrict-eval true --option allow-import-from-derivation false >/dev/null

.github/workflows/eval.yml

@@ -61,7 +61,7 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ref: ${{ needs.prepare.outputs.mergedSha }}
-          path: nixpkgs
+          path: untrusted
 
       - name: Install Nix
         uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
@@ -72,7 +72,7 @@ jobs:
         env:
           MATRIX_SYSTEM: ${{ matrix.system }}
         run: |
-          nix-build nixpkgs/ci -A eval.singleSystem \
+          nix-build untrusted/ci -A eval.singleSystem \
             --argstr evalSystem "$MATRIX_SYSTEM" \
             --arg chunkSize 10000
           # If it uses too much memory, slightly decrease chunkSize
@@ -101,8 +101,7 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ref: ${{ needs.prepare.outputs.mergedSha }}
-          fetch-depth: 2
-          path: nixpkgs
+          path: untrusted
 
       - name: Install Nix
         uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
@@ -111,7 +110,7 @@ jobs:
 
       - name: Combine all output paths and eval stats
         run: |
-          nix-build nixpkgs/ci -A eval.combine \
+          nix-build untrusted/ci -A eval.combine \
             --arg resultsDir ./intermediate \
             -o prResult
 
@@ -168,12 +167,13 @@ jobs:
         env:
           AUTHOR_ID: ${{ github.event.pull_request.user.id }}
         run: |
-          git -C nixpkgs worktree add ../target ${{ needs.prepare.outputs.targetSha }}
-          git -C nixpkgs diff --name-only ${{ needs.prepare.outputs.targetSha }} \
+          git -C untrusted fetch --depth 1 origin ${{ needs.prepare.outputs.targetSha }}
+          git -C untrusted worktree add ../trusted ${{ needs.prepare.outputs.targetSha }}
+          git -C untrusted diff --name-only ${{ needs.prepare.outputs.targetSha }} \
             | jq --raw-input --slurp 'split("\n")[:-1]' > touched-files.json
 
           # Use the target branch to get accurate maintainer info
-          nix-build target/ci -A eval.compare \
+          nix-build trusted/ci -A eval.compare \
             --arg beforeResultDir ./targetResult \
             --arg afterResultDir "$(realpath prResult)" \
             --arg touchedFilesJson ./touched-files.json \
@@ -222,15 +222,15 @@ jobs:
 
       # Important: This workflow job runs with extra permissions,
       # so we need to make sure to not run untrusted code from PRs
-      - name: Check out Nixpkgs at the base commit
+      - name: Check out Nixpkgs at the target commit
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ref: ${{ needs.prepare.outputs.targetSha }}
-          path: base
+          path: trusted
           sparse-checkout: ci
 
       - name: Build the requestReviews derivation
-        run: nix-build base/ci -A requestReviews
+        run: nix-build trusted/ci -A requestReviews
 
       - name: Labelling pull request
         if: ${{ github.event_name == 'pull_request_target' && github.repository_owner == 'NixOS' }}

.github/workflows/lib-tests.yml

@@ -19,13 +19,10 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           sparse-checkout: .github/actions
-      - name: Check if the PR can be merged and get the test merge commit
+      - name: Check if the PR can be merged and checkout the merge commit
         uses: ./.github/actions/get-merge-commit
-        id: get-merge-commit
-
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: ${{ steps.get-merge-commit.outputs.mergedSha }}
+          merged-as-untrusted: true
 
       - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
         with:
@@ -33,4 +30,4 @@ jobs:
 
       - name: Building Nixpkgs lib-tests
         run: |
-          nix-build ci -A lib-tests
+          nix-build untrusted/ci -A lib-tests

.github/workflows/manual-nixos-v2.yml

@@ -35,13 +35,10 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           sparse-checkout: .github/actions
-      - name: Check if the PR can be merged and get the test merge commit
+      - name: Check if the PR can be merged and checkout the merge commit
         uses: ./.github/actions/get-merge-commit
-        id: get-merge-commit
-
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: ${{ steps.get-merge-commit.outputs.mergedSha }}
+          merged-as-untrusted: true
 
       - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
         with:
@@ -55,7 +52,7 @@ jobs:
 
       - name: Build NixOS manual
         id: build-manual
-        run: NIX_PATH=nixpkgs=$(pwd) nix-build --option restrict-eval true ci -A manual-nixos --argstr system ${{ matrix.system }}
+        run: NIX_PATH=nixpkgs=$(pwd)/untrusted nix-build --option restrict-eval true untrusted/ci -A manual-nixos --argstr system ${{ matrix.system }}
 
       - name: Upload NixOS manual
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2

.github/workflows/manual-nixpkgs-v2.yml

@@ -22,13 +22,10 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           sparse-checkout: .github/actions
-      - name: Check if the PR can be merged and get the test merge commit
+      - name: Check if the PR can be merged and checkout the merge commit
         uses: ./.github/actions/get-merge-commit
-        id: get-merge-commit
-
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: ${{ steps.get-merge-commit.outputs.mergedSha }}
+          merged-as-untrusted: true
 
       - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
         with:
@@ -41,4 +38,4 @@ jobs:
           authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
 
       - name: Building Nixpkgs manual
-        run: NIX_PATH=nixpkgs=$(pwd) nix-build --option restrict-eval true ci -A manual-nixpkgs -A manual-nixpkgs-tests
+        run: NIX_PATH=nixpkgs=$(pwd)/untrusted nix-build --option restrict-eval true untrusted/ci -A manual-nixpkgs -A manual-nixpkgs-tests

.github/workflows/nix-parse-v2.yml

@@ -17,13 +17,10 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           sparse-checkout: .github/actions
-      - name: Check if the PR can be merged and get the test merge commit
+      - name: Check if the PR can be merged and checkout the merge commit
         uses: ./.github/actions/get-merge-commit
-        id: get-merge-commit
-
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: ${{ steps.get-merge-commit.outputs.mergedSha }}
+          merged-as-untrusted: true
 
       - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
         with:
@@ -33,4 +30,4 @@ jobs:
       - name: Parse all nix files
         run: |
           # Tests multiple versions at once, let's make sure all of them run, so keep-going.
-          nix-build ci -A parse --keep-going
+          nix-build untrusted/ci -A parse --keep-going

.github/workflows/nixpkgs-vet.yml

@@ -19,51 +19,27 @@ permissions: {}
 jobs:
   check:
     name: nixpkgs-vet
-    # This needs to be x86_64-linux, because we depend on the tooling being pre-built in the GitHub releases.
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-24.04-arm
     # This should take 1 minute at most, but let's be generous. The default of 6 hours is definitely too long.
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           sparse-checkout: .github/actions
-      - name: Check if the PR can be merged and get the test merge commit
+      - name: Check if the PR can be merged and checkout merged and target commits
         uses: ./.github/actions/get-merge-commit
-        id: get-merge-commit
-
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: ${{ steps.get-merge-commit.outputs.mergedSha }}
-          # Fetches the merge commit and its parents
-          fetch-depth: 2
-
-      - name: Checking out target branch
-        run: |
-          target=$(mktemp -d)
-          git worktree add "$target" "$(git rev-parse HEAD^1)"
-          echo "target=$target" >> "$GITHUB_ENV"
+          merged-as-untrusted: true
+          target-as-trusted: true
 
       - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
 
-      - name: Fetching the pinned tool
-        # Update the pinned version using ci/nixpkgs-vet/update-pinned-tool.sh
-        run: |
-          # The pinned version of the tooling to use.
-          toolVersion=$(<ci/nixpkgs-vet/pinned-version.txt)
-
-          # Fetch the x86_64-linux-specific release artifact containing the gzipped NAR of the pre-built tool.
-          toolPath=$(curl -sSfL https://github.com/NixOS/nixpkgs-vet/releases/download/"$toolVersion"/x86_64-linux.nar.gz \
-            | gzip -cd | nix-store --import | tail -1)
-
-          # Adds a result symlink as a GC root.
-          nix-store --realise "$toolPath" --add-root result
-
       - name: Running nixpkgs-vet
         env:
           # Force terminal colors to be enabled. The library that `nixpkgs-vet` uses respects https://bixense.com/clicolors/
           CLICOLOR_FORCE: 1
         run: |
-          if result/bin/nixpkgs-vet --base "$target" .; then
+          if nix-build untrusted/ci -A nixpkgs-vet --arg base "./trusted" --arg head "./untrusted"; then
             exit 0
           else
             exitCode=$?

ci/default.nix

@@ -84,6 +84,7 @@ in
   manual-nixos = (import ../nixos/release.nix { }).manual.${system} or null;
   manual-nixpkgs = (import ../pkgs/top-level/release.nix { }).manual;
   manual-nixpkgs-tests = (import ../pkgs/top-level/release.nix { }).manual.tests;
+  nixpkgs-vet = pkgs.callPackage ./nixpkgs-vet.nix { };
   parse = pkgs.lib.recurseIntoAttrs {
     latest = pkgs.callPackage ./parse.nix { nix = pkgs.nixVersions.latest; };
     lix = pkgs.callPackage ./parse.nix { nix = pkgs.lix; };

ci/nixpkgs-vet.nix

@@ -0,0 +1,31 @@
+{
+  lib,
+  nix,
+  nixpkgs-vet,
+  runCommand,
+}:
+{
+  base ? ../.,
+  head ? ../.,
+}:
+let
+  filtered =
+    with lib.fileset;
+    path:
+    toSource {
+      fileset = (gitTracked path);
+      root = path;
+    };
+in
+runCommand "nixpkgs-vet"
+  {
+    nativeBuildInputs = [
+      nixpkgs-vet
+    ];
+    env.NIXPKGS_VET_NIX_PACKAGE = nix;
+  }
+  ''
+    nixpkgs-vet --base ${filtered base} ${filtered head}
+
+    touch $out
+  ''

ci/nixpkgs-vet.sh

@@ -65,7 +65,5 @@ trace -n "Reading pinned nixpkgs-vet version from pinned-version.txt.. "
 toolVersion=$(<"$tmp/merged/ci/nixpkgs-vet/pinned-version.txt")
 trace -e "\e[34m$toolVersion\e[0m"
 
-trace -n "Building tool.. "
-nix-build https://github.com/NixOS/nixpkgs-vet/tarball/"$toolVersion" -o "$tmp/tool" -A build
 trace "Running nixpkgs-vet.."
-"$tmp/tool/bin/nixpkgs-vet" --base "$tmp/base" "$tmp/merged"
+nix-build ci -A nixpkgs-vet --argstr base "$tmp/base" --argstr head "$tmp/merged"

doc/release-notes/rl-2505.section.md

@@ -247,6 +247,10 @@
 - `strawberry` has been updated to 1.2, which drops support for the VLC backend and Qt 5. The `strawberry-qt5` package
   and `withGstreamer`/`withVlc` override options have been removed due to this.
 
+- `nexusmods-app` has been upgraded from version 0.6.3. If you were running a version older than 0.7.0, then before upgrading, you **must reset all app state** (mods, games, settings, etc). Otherwise, NexusMods.App will crash due to app state files incompatibility.
+  - Typically, you can can reset to a clean state by running `NexusMods.App uninstall-app`. See Nexus Mod's [how to uninstall the app](https://nexus-mods.github.io/NexusMods.App/users/Uninstall) documentation for more detail and alternative methods.
+  - This should not be necessary going forward, because loading app state from 0.7.0 or newer is now supported. This is documented in the [0.7.1 changelog](https://github.com/Nexus-Mods/NexusMods.App/releases/tag/v0.7.1).
+
 - `nezha` and its agent `nezha-agent` have been updated to v1, which contains breaking changes. See the [official wiki](https://nezha.wiki/en_US/) for more details.
 
 - `ps3-disc-dumper` was updated to 4.2.5, which removed the CLI project and now exclusively offers the GUI
@@ -538,11 +542,6 @@
 
 - `ddclient` was updated from 3.11.2 to 4.0.0 [Release notes](https://github.com/ddclient/ddclient/releases/tag/v4.0.0)
 
-- `nexusmods-app` has been upgraded from version 0.6.3 to 0.10.2.
-  - Before upgrading, you **must reset all app state** (mods, games, settings, etc). NexusMods.App will crash if any state from a version older than 0.7.0 is still present.
-  - Typically, you can can reset to a clean state by running `NexusMods.App uninstall-app`. See Nexus Mod's [how to uninstall the app](https://nexus-mods.github.io/NexusMods.App/users/Uninstall) documentation for more detail and alternative methods.
-  - This should not be necessary going forward, because loading app state from 0.7.0 or newer is now supported. This is documented in the [0.7.1 changelog](https://github.com/Nexus-Mods/NexusMods.App/releases/tag/v0.7.1).
-
 ## Nixpkgs Library {#sec-nixpkgs-release-25.05-lib}
 
 ### Breaking changes {#sec-nixpkgs-release-25.05-lib-breaking}

nixos/modules/services/backup/borgmatic.nix

@@ -17,7 +17,7 @@ let
   addRequiredBinaries =
     s:
     s
-    // {
+    // (lib.optionalAttrs (s ? postgresql_databases && s.postgresql_databases != [ ]) {
       postgresql_databases = map (
         d:
         let
@@ -33,7 +33,9 @@ let
           psql_command = "${as_user}${postgresql}/bin/psql";
         }
         // d
-      ) (s.postgresql_databases or [ ]);
+      ) s.postgresql_databases;
+    })
+    // (lib.optionalAttrs (s ? mariadb_databases && s.mariadb_databases != [ ]) {
       mariadb_databases = map (
         d:
         {
@@ -41,7 +43,9 @@ let
           mariadb_command = "${mysql}/bin/mariadb";
         }
         // d
-      ) (s.mariadb_databases or [ ]);
+      ) s.mariadb_databases;
+    })
+    // (lib.optionalAttrs (s ? mysql_databases && s.mysql_databases != [ ]) {
       mysql_databases = map (
         d:
         {
@@ -49,8 +53,8 @@ let
           mysql_command = "${mysql}/bin/mysql";
         }
         // d
-      ) (s.mysql_databases or [ ]);
-    };
+      ) s.mysql_databases;
+    });
 
   repository =
     with lib.types;
@@ -149,7 +153,9 @@ in
   config =
     let
       configFiles =
-        (lib.optionalAttrs (cfg.settings != null) { "borgmatic/config.yaml".source = cfgfile; })
+        (lib.optionalAttrs (cfg.settings != null) {
+          "borgmatic/config.yaml".source = cfgfile;
+        })
         // lib.mapAttrs' (
           name: value:
           lib.nameValuePair "borgmatic.d/${name}.yaml" {

pkgs/applications/editors/vscode/extensions/default.nix

@@ -1018,8 +1018,8 @@ let
         mktplcRef = {
           name = "coder-remote";
           publisher = "coder";
-          version = "1.8.0";
-          hash = "sha256-zAe2IFT69oZ/OLVSaaY5lGSiF/7FGiQngz/EXekwQtM=";
+          version = "1.9.0";
+          hash = "sha256-34Qu6BOQIbTsPeIGCp8Lcsz+FoDrP36PuYpX/4mqpvw=";
         };
         meta = {
           description = "Extension for Visual Studio Code to open any Coder workspace in VS Code with a single click";

pkgs/applications/editors/vscode/extensions/ms-windows-ai-studio.windows-ai-studio/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "windows-ai-studio";
     publisher = "ms-windows-ai-studio";
-    version = "0.12.1";
-    hash = "sha256-uj+4o5gH6qfYCJjapoas/JDWymFWSl4kHFu5Ys9rTlU=";
+    version = "0.14.0";
+    hash = "sha256-qfEPvDHYjFWT+NMN6jlouRljtTflKOqn2wHL83tnUi0=";
   };
 
   meta = {

pkgs/applications/misc/gpxsee/default.nix

@@ -18,13 +18,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gpxsee";
-  version = "13.42";
+  version = "13.43";
 
   src = fetchFromGitHub {
     owner = "tumic0";
     repo = "GPXSee";
     tag = finalAttrs.version;
-    hash = "sha256-94zCDtja1b85Wgz4slG17ETT/TMPPCyXld3WdtGjBzA=";
+    hash = "sha256-IP5l8YUsCNm9rixgpQqbyyhfcBNQgrZha1MNjetug2c=";
   };
 
   buildInputs =
@@ -66,7 +66,6 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   meta = {
-    broken = isQt6 && stdenv.hostPlatform.isDarwin;
     changelog = "https://build.opensuse.org/package/view_file/home:tumic:GPXSee/gpxsee/gpxsee.changes";
     description = "GPS log file viewer and analyzer";
     mainProgram = "gpxsee";

pkgs/by-name/dc/dclib/package.nix

@@ -1,36 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  libxml2,
-  openssl,
-  bzip2,
-  zlib,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "dclib";
-  version = "0.3.7";
-
-  src = fetchurl {
-    url = "ftp://ftp.debian.nl/pub/freebsd/ports/distfiles/dclib-${version}.tar.bz2";
-    sha256 = "02jdzm5hqzs1dv2rd596vgpcjaapm55pqqapz5m94l30v4q72rfc";
-  };
-
-  buildInputs = [
-    libxml2
-    openssl
-    bzip2
-    zlib
-  ];
-
-  meta = with lib; {
-    description = "Peer-to-Peer file sharing client";
-    homepage = "http://dcgui.berlios.de";
-    platforms = platforms.linux;
-    license = [
-      licenses.openssl
-      licenses.gpl2
-    ];
-  };
-}

pkgs/by-name/ge/gensio/package.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gensio";
-  version = "2.8.14";
+  version = "2.8.15";
 
   src = fetchFromGitHub {
     owner = "cminyard";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-vxa1r0vloiqMrGhXriIbBfJC6wmm54YWg0nCnB8MDG0=";
+    sha256 = "sha256-EDa95r8x5yIXibJigJXR3PCYTTvJlqB6XBN1RZHq6KM=";
   };
 
   passthru = {

pkgs/by-name/gj/gjay/package.nix

@@ -1,44 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  pkg-config,
-  dbus-glib,
-  audacious,
-  gtk2,
-  gsl,
-  libaudclient,
-  libmpdclient,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "gjay";
-  version = "0.3.2";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/project/gjay/${pname}-${version}.tar.gz";
-    sha256 = "1a1vv4r0vnxjdyl0jyv7gga3zfd5azxlwjm1l6hjrf71lb228zn8";
-  };
-
-  nativeBuildInputs = [ pkg-config ];
-
-  buildInputs = [
-    libmpdclient
-    dbus-glib
-    audacious
-    gtk2
-    gsl
-    libaudclient
-  ];
-
-  hardeningDisable = [ "format" ];
-
-  meta = with lib; {
-    description = "Generates playlists such that each song sounds good following the previous song";
-    homepage = "https://gjay.sourceforge.net/";
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ pSub ];
-    platforms = with platforms; linux;
-    mainProgram = "gjay";
-  };
-}

pkgs/by-name/id/ida-free/package.nix

@@ -2,7 +2,7 @@
   autoPatchelfHook,
   cairo,
   dbus,
-  fetchurl,
+  requireFile,
   fontconfig,
   freetype,
   glib,
@@ -24,11 +24,12 @@
 
 stdenv.mkDerivation rec {
   pname = "ida-free";
-  version = "9.0sp1";
+  version = "9.1";
 
-  src = fetchurl {
-    url = "https://archive.org/download/ida-free-pc_90sp1_x64linux/ida-free-pc_90sp1_x64linux.run";
-    hash = "sha256-e5uCcJVn6xDwmVm14QCBUvNcB1MpVxNA2WcLyuK23vo=";
+  src = requireFile {
+    name = "ida-free-pc_${lib.replaceStrings [ "." ] [ "" ] version}_x64linux.run";
+    url = "https://my.hex-rays.com/dashboard/download-center/${version}/ida-free";
+    hash = "sha256-DIkxr9yD6yvziO8XHi0jt80189bXueRxmSFyq2LM0cg=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/md/mdbook/package.nix

@@ -7,7 +7,7 @@
   installShellFiles,
 }:
 let
-  version = "0.4.49";
+  version = "0.4.50";
 in
 rustPlatform.buildRustPackage rec {
   inherit version;
@@ -17,11 +17,11 @@ rustPlatform.buildRustPackage rec {
     owner = "rust-lang";
     repo = "mdBook";
     tag = "v${version}";
-    hash = "sha256-X+ptqzAOjCX2Tt5jDfH/jdUy99WrITGfzDj+F2DoI5w=";
+    hash = "sha256-ooXfYXqE12wTxrrHKF0IO8JNY7P4sPplrnhVJ6kEUyI=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-ZPJkSMcxyTOivfwThPfaO6oRkfewH048rrCDCwCtE8c=";
+  cargoHash = "sha256-kyk7fwuR5A0GEGUw+W81IjwDNsa3I2DT3SFnT75IvLs=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/ne/nexusmods-app/package.nix

@@ -24,12 +24,12 @@ let
 in
 buildDotnetModule (finalAttrs: {
   inherit pname;
-  version = "0.10.2";
+  version = "0.11.3";
 
   src = fetchgit {
     url = "https://github.com/Nexus-Mods/NexusMods.App.git";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-L75nmxjymPfuu6CM5QRE1jInElNrD2OuAXMR8+c2tGQ=";
+    hash = "sha256-EP51nhFKYfYRjOpgHiGLwXGmpDULoTlGh3hQXhR8sy8=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/no/noto-fonts-color-emoji/package.nix

@@ -7,18 +7,11 @@
   cairo,
   imagemagick,
   zopfli,
+  nototools,
   pngquant,
   which,
 }:
 
-let
-  emojiPythonEnv = buildPackages.python3.withPackages (
-    p: with p; [
-      fonttools
-      nototools
-    ]
-  );
-in
 stdenvNoCC.mkDerivation rec {
   pname = "noto-fonts-color-emoji";
   version = "2.047";
@@ -39,9 +32,10 @@ stdenvNoCC.mkDerivation rec {
   nativeBuildInputs = [
     imagemagick
     zopfli
+    nototools
     pngquant
     which
-    emojiPythonEnv
+    buildPackages.python3.pkgs.fonttools
   ];
 
   postPatch = ''

pkgs/by-name/no/nototools/package.nix

@@ -1,45 +1,14 @@
 {
   fetchFromGitHub,
   lib,
-  buildPythonPackage,
-  pythonOlder,
-  afdko,
-  appdirs,
-  attrs,
-  booleanoperations,
-  brotlipy,
-  click,
-  defcon,
-  fontmath,
-  fontparts,
-  fontpens,
-  fonttools,
-  lxml,
-  mutatormath,
-  pathspec,
-  psautohint,
-  pyclipper,
-  pytz,
-  regex,
-  scour,
-  toml,
-  typed-ast,
-  ufonormalizer,
-  ufoprocessor,
-  unicodedata2,
-  zopfli,
-  pillow,
-  six,
   bash,
-  setuptools-scm,
+  python3Packages,
 }:
 
-buildPythonPackage rec {
+python3Packages.buildPythonApplication rec {
   pname = "nototools";
   version = "0.2.20";
 
-  disabled = pythonOlder "3.6";
-
   src = fetchFromGitHub {
     owner = "googlefonts";
     repo = "nototools";
@@ -51,9 +20,14 @@ buildPythonPackage rec {
     sed -i 's/use_scm_version=.*,/version="${version}",/' setup.py
   '';
 
-  nativeBuildInputs = [ setuptools-scm ];
+  build-system = with python3Packages; [ setuptools-scm ];
 
-  propagatedBuildInputs = [
+  pythonRemoveDeps = [
+    # https://github.com/notofonts/nototools/pull/901
+    "typed-ast"
+  ];
+
+  dependencies = with python3Packages; [
     afdko
     appdirs
     attrs
@@ -74,7 +48,6 @@ buildPythonPackage rec {
     regex
     scour
     toml
-    typed-ast
     ufonormalizer
     ufoprocessor
     unicodedata2
@@ -82,8 +55,8 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    pillow
-    six
+    python3Packages.pillow
+    python3Packages.six
     bash
   ];
 

pkgs/by-name/oc/oci-cli/package.nix

@@ -25,14 +25,14 @@ in
 
 py.pkgs.buildPythonApplication rec {
   pname = "oci-cli";
-  version = "3.55.0";
+  version = "3.56.1";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "oracle";
     repo = pname;
     tag = "v${version}";
-    hash = "sha256-+XKoB8lychQJXjrYA536TSYYYSeRsSAfgi6ER2tLaqA=";
+    hash = "sha256-KvyhQ8MM74MYR8gf18XVYZrOSEKcOqdmyITg2UyNqp8=";
   };
 
   nativeBuildInputs = [ installShellFiles ];

pkgs/by-name/pa/paretosecurity/package.nix

@@ -17,16 +17,16 @@ buildGoModule (finalAttrs: {
     webkitgtk_4_1
   ];
   pname = "paretosecurity";
-  version = "0.2.17";
+  version = "0.2.23";
 
   src = fetchFromGitHub {
     owner = "ParetoSecurity";
     repo = "agent";
     rev = finalAttrs.version;
-    hash = "sha256-2Ev6LJWa+iPV7/Y/o9HrNf4vR4dbnIOim+qb4HdRXqU=";
+    hash = "sha256-jqjfaTvbwp/3P3E7eYv8CFaaYNjPfnbrFIzD6JcccV4=";
   };
 
-  vendorHash = "sha256-YnyACP/hJYxi4AWMwr0We4YUTbWwahKAIYN6RnHmzls=";
+  vendorHash = "sha256-v9M1CX6mIK8MdaI5TVa0Uc+HnIy+oCg+vYlH3eU809Q=";
   proxyVendor = true;
 
   # Skip building the Windows installer

pkgs/by-name/pi/pixelorama/package.nix

@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  godot_4_3,
+  godot_4,
   nix-update-script,
 }:
 
@@ -16,17 +16,17 @@ let
     presets.${stdenv.hostPlatform.system}
       or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
-  godot = godot_4_3;
+  godot = godot_4;
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "pixelorama";
-  version = "1.1";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "Orama-Interactive";
     repo = "Pixelorama";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-UJ9sQ9igB2YAtkeHRUPvA60lbR2OXd4tqBDFxf9YTnI=";
+    hash = "sha256-HXCfZ/ePqEMnaEN+fxGVoaFWsO1isTAyYoRpLY6opRg=";
   };
 
   strictDeps = true;

pkgs/by-name/po/postgres-lsp/package.nix

@@ -5,18 +5,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "postgres-lsp";
-  version = "0.6.0";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "supabase-community";
     repo = "postgres-language-server";
     tag = finalAttrs.version;
-    hash = "sha256-PL8irQ3R8m//BbtTjODBrBcG/bAdK+t6GZGAj0PkJwE=";
+    hash = "sha256-78DUSoJwh310TAO0a8usa6+IwZhDdOCNys9fEAky3VY=";
     fetchSubmodules = true;
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-lUZpjX3HljOXi0Wt2xZCUru8uinWlngLEs5wlqfFiJA=";
+  cargoHash = "sha256-IxVuxDauxH3AzXirJ3Zq8QLSdUL3H3j/oSGqfNs0J20=";
 
   nativeBuildInputs = [
     rustPlatform.bindgenHook
@@ -35,6 +35,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
   checkFlags = [
     # Tries to write to the file system relatively to the current path
     "--skip=syntax_error"
+    # Requires a database connection
+    "--skip=test_cli_check_command"
   ];
 
   meta = {

pkgs/by-name/qu/quarkus/package.nix

@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "quarkus-cli";
-  version = "3.22.2";
+  version = "3.22.3";
 
   src = fetchurl {
     url = "https://github.com/quarkusio/quarkus/releases/download/${finalAttrs.version}/quarkus-cli-${finalAttrs.version}.tar.gz";
-    hash = "sha256-RCWkaPoE3Purq9VG1xhlakMxqXhnxi+q10YcgOyScqg=";
+    hash = "sha256-kUIjIsVK7hn2tNOpuqfNdwuX1ZQewcY8SItAknG7cRk=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/by-name/re/retroarch-assets/package.nix

@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "retroarch-assets";
-  version = "1.20.0-unstable-2025-03-21";
+  version = "1.20.0-unstable-2025-05-23";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "retroarch-assets";
-    rev = "818aca56efd784624a241a12936b5c0864e3ddd8";
-    hash = "sha256-14n9oQbvzl66pgWLMYEpAM7uJUH5e8a3xRCy5f1TFIw=";
+    rev = "2d24ef2972a709f870cc3f73853158fa2376f37d";
+    hash = "sha256-8FtY9W51Y0cLD61GHGz83TWoSyUuRfXEaAuEBKcFKRU=";
   };
 
   makeFlags = [

pkgs/by-name/ru/ruqola/package.nix

@@ -0,0 +1,65 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitLab,
+  cmake,
+  extra-cmake-modules,
+  kdePackages,
+  qt6,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  name = "ruqola";
+  version = "2.5.0";
+
+  src = fetchFromGitLab {
+    domain = "invent.kde.org";
+    owner = "network";
+    repo = "ruqola";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-gcdu/+JTutY7gvokHNVbWH5D82HhtLXkL6PLZN81ano=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    extra-cmake-modules
+    qt6.wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    kdePackages.karchive
+    kdePackages.kcodecs
+    kdePackages.kcoreaddons
+    kdePackages.kcrash
+    kdePackages.ki18n
+    kdePackages.kiconthemes
+    kdePackages.kidletime
+    kdePackages.kio
+    kdePackages.knotifyconfig
+    kdePackages.kstatusnotifieritem
+    kdePackages.ktextaddons
+    kdePackages.ktextwidgets
+    kdePackages.kxmlgui
+    kdePackages.plasma-activities
+    kdePackages.prison
+    kdePackages.purpose
+    kdePackages.qtkeychain
+    kdePackages.sonnet
+    kdePackages.syntax-highlighting
+    qt6.qtbase
+    qt6.qtmultimedia
+    qt6.qtnetworkauth
+    qt6.qtwebsockets
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "KDE client for Rocket Chat";
+    homepage = "https://invent.kde.org/network/ruqola";
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ lykos153 ];
+    mainProgram = "ruqola";
+  };
+})

pkgs/by-name/se/servo/package.nix

@@ -61,13 +61,13 @@ in
 
 rustPlatform.buildRustPackage {
   pname = "servo";
-  version = "0-unstable-2025-05-15";
+  version = "0-unstable-2025-05-25";
 
   src = fetchFromGitHub {
     owner = "servo";
     repo = "servo";
-    rev = "103cbed928b0b9ecd7084b5e9dcab135eca19327";
-    hash = "sha256-TMrtD7f0bay6NtodM3SZfi8tLCQp6dE5iBicyGXZAco=";
+    rev = "3a04f4195eb650f092c44d5a05fee178b9e84fbe";
+    hash = "sha256-7dbt7h4qUPWgsKBt0wo9by6yTB4034SzlzdqMXmw2Xg=";
     # Breaks reproducibility depending on whether the picked commit
     # has other ref-names or not, which may change over time, i.e. with
     # "ref-names: HEAD -> main" as long this commit is the branch HEAD
@@ -78,7 +78,7 @@ rustPlatform.buildRustPackage {
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-7PTrE2FA2cvOKU35qTYBr7cop65gWY+zSOVlDZiJdow=";
+  cargoHash = "sha256-XTtM7yU1kpzK2cspnYdgp7yrt4Xk7xeQ98rmBgu46Tg=";
 
   # set `HOME` to a temp dir for write access
   # Fix invalid option errors during linking (https://github.com/mozilla/nixpkgs-mozilla/commit/c72ff151a3e25f14182569679ed4cd22ef352328)

pkgs/by-name/sm/smatch/package.nix

@@ -29,6 +29,7 @@ stdenv.mkDerivation {
   ];
 
   nativeBuildInputs = [ pkg-config ];
+  patches = [ ./remove_const.patch ];
 
   buildInputs =
     [

pkgs/by-name/sm/smatch/remove_const.patch

@@ -0,0 +1,32 @@
+diff --git a/smatch.h b/smatch.h
+index 36ae3497..ceb1907c 100644
+--- a/smatch.h
++++ b/smatch.h
+@@ -1375,7 +1375,7 @@ bool buf_comp_has_bytes(struct expression *buf, struct expression *var);
+ bool buf_comp2_has_bytes(struct expression *buf_expr, struct expression *var);
+ 
+ /* smatch_untracked_param.c */
+-void mark_untracked(struct expression *expr, int param, const char *key, const char *value);
++void mark_untracked(struct expression *expr, int param, char *key, char *value);
+ void add_untracked_param_hook(void (func)(struct expression *call, int param));
+ void add_lost_param_hook(void (func)(struct expression *call, int param));
+ void mark_all_params_untracked(int return_id, char *return_ranges, struct expression *expr);
+diff --git a/smatch_untracked_param.c b/smatch_untracked_param.c
+index 4bb3c244..d24958e7 100644
+--- a/smatch_untracked_param.c
++++ b/smatch_untracked_param.c
+@@ -120,12 +120,12 @@ free:
+ 
+ }
+ 
+-void mark_untracked(struct expression *expr, int param, const char *key, const char *value)
++void mark_untracked(struct expression *expr, int param, char *key, char *value)
+ {
+ 	mark_untracked_lost(expr, param, key, UNTRACKED_PARAM);
+ }
+ 
+-void mark_lost(struct expression *expr, int param, const char *key, const char *value)
++void mark_lost(struct expression *expr, int param, char *key, char *value)
+ {
+ 	mark_untracked_lost(expr, param, key, LOST_PARAM);
+ }

pkgs/by-name/tf/tflint/package.nix

@@ -11,7 +11,7 @@
 
 let
   pname = "tflint";
-  version = "0.57.0";
+  version = "0.58.0";
 in
 buildGoModule {
   inherit pname version;
@@ -20,10 +20,10 @@ buildGoModule {
     owner = "terraform-linters";
     repo = pname;
     tag = "v${version}";
-    hash = "sha256-mmrXP81CVyFObmzLveqZNwHbRTnDyKfoTPFlq1WyxxE=";
+    hash = "sha256-AaY2UghPvYveZ4xtUphPOnnoA6FcyO9Y2Uzz3bN8Q8I=";
   };
 
-  vendorHash = "sha256-ljJnMAD+cvlq7NxrbrbE53+uPWknRqN5KD8SYqqjZ9w=";
+  vendorHash = "sha256-lmV23xDzBaMxV4MQeatX4sF0UwDZBlekdW21CMGtIqs=";
 
   doCheck = false;
 

pkgs/by-name/ti/tiledb/package.nix

@@ -36,13 +36,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "tiledb";
-  version = "2.27.2";
+  version = "2.28.0";
 
   src = fetchFromGitHub {
     owner = "TileDB-Inc";
     repo = "TileDB";
     tag = version;
-    hash = "sha256-zk4jkXJMh6wpuEKaCvuKUDod+F8B/6W5Lw8gwelcPEM=";
+    hash = "sha256-jNKnc8IPkXDxRUY9QJ+35qt2na1nO6RPeCVWBLb7lME=";
   };
 
   patches = lib.optionals stdenv.hostPlatform.isDarwin [ ./generate_embedded_data_header.patch ];

pkgs/by-name/to/touchegg/package.nix

@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "touchegg";
-  version = "2.0.17";
+  version = "2.0.18";
 
   src = fetchFromGitHub {
     owner = "JoseExposito";
     repo = "touchegg";
     rev = version;
-    sha256 = "sha256-he6ERl6ZNWuD5StUqQWsUjeJ35nD0b8KddIAvntqlOI=";
+    sha256 = "sha256-7LJ5gD2e6e4edKDabqmsiXTdNKJ39557Q4sEGWF8H1U=";
   };
 
   patches = lib.optionals withPantheon [

pkgs/by-name/tw/twitter-color-emoji/package.nix

@@ -7,6 +7,7 @@
   fetchFromGitHub,
   cairo,
   imagemagick,
+  nototools,
   pkg-config,
   pngquant,
   python3,
@@ -25,14 +26,6 @@ let
     rev = "v${version}";
     hash = "sha256-FLOqXDpSFyClBlG5u3IRL0EKeu1mckCfRizJh++IWxo=";
   };
-
-  pythonEnv = python3.withPackages (
-    ps: with ps; [
-      fonttools
-      nototools
-    ]
-  );
-
 in
 stdenv.mkDerivation rec {
   pname = "twitter-color-emoji";
@@ -52,10 +45,11 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     cairo
+    python3.pkgs.fonttools
     imagemagick
+    nototools
     pkg-config
     pngquant
-    pythonEnv
     which
     zopfli
   ];

pkgs/by-name/un/unstructured-api/package.nix

@@ -5,8 +5,6 @@
   python3,
   makeWrapper,
   nix-update-script,
-  symlinkJoin,
-  nltk-data,
 }:
 let
   pythonEnv = python3.withPackages (
@@ -147,14 +145,10 @@ let
     ++ unstructured.optional-dependencies.all-docs
   );
   version = "0.0.82";
-  unstructured_api_nltk_data = symlinkJoin {
-    name = "unstructured_api_nltk_data";
-
-    paths = [
-      nltk-data.punkt
-      nltk-data.averaged-perceptron-tagger
-    ];
-  };
+  unstructured_api_nltk_data = python3.pkgs.nltk.dataDir (d: [
+    d.punkt
+    d.averaged-perceptron-tagger
+  ]);
 in
 stdenvNoCC.mkDerivation {
   pname = "unstructured-api";

pkgs/by-name/wh/whatsapp-emoji-font/package.nix

@@ -4,8 +4,8 @@
   fetchFromGitHub,
   imagemagick,
   nix-update-script,
+  nototools,
   pngquant,
-  python3Packages,
   which,
   zopfli,
 }:
@@ -29,8 +29,8 @@ stdenvNoCC.mkDerivation rec {
 
   nativeBuildInputs = [
     imagemagick
+    nototools
     pngquant
-    python3Packages.nototools
     which
     zopfli
   ];

pkgs/by-name/xt/xtf/package.nix

@@ -10,7 +10,7 @@
 
 stdenv.mkDerivation {
   pname = "xtf";
-  version = "0-unstable-2024-11-01";
+  version = "0-unstable-2025-05-19";
 
   outputs = [
     "out" # xtf-runner and test suite.
@@ -20,8 +20,8 @@ stdenv.mkDerivation {
 
   src = fetchgit {
     url = "https://xenbits.xenproject.org/git-http/xtf.git";
-    rev = "294532089d5251170abfd65a6620c8247cea729d";
-    hash = "sha256-CQK7300nepZ3bNiHEJ5jrS9wkipr5JUbvtL5DNrULGI=";
+    rev = "419daf21e0685a1c9ca519bb744f4aadf992e007";
+    hash = "sha256-yCBEUd+0c6D5InoO67p1Ip1bi8qpwPG9CKQtXN7pDIg=";
   };
 
   nativeBuildInputs =

pkgs/by-name/zi/zipline/package.nix

@@ -2,10 +2,10 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  pnpm_9,
-  nodejs,
+  pnpm_10,
+  nodejs_24,
   makeWrapper,
-  pkgs,
+  prisma-engines,
   ffmpeg,
   openssl,
   vips,
@@ -15,22 +15,6 @@
 }:
 
 let
-  prisma-engines = pkgs.prisma-engines.overrideAttrs (
-    finalAttrs: prevAttrs: {
-      version = "6.5.0";
-      src = fetchFromGitHub {
-        inherit (prevAttrs.src) owner repo;
-        rev = finalAttrs.version;
-        hash = "sha256-m3LBIMIVMI5GlY0+QNw/nTlNWt2rGOZ28z+CfdP51cY=";
-      };
-      cargoHash = "sha256-yG+omKAS1eWq3sFgKXMoZWhTP4M34dVRes7OhhTUyTQ=";
-      cargoDeps = pkgs.rustPlatform.fetchCargoVendor {
-        inherit (finalAttrs) pname version src;
-        hash = finalAttrs.cargoHash;
-      };
-    }
-  );
-
   environment = {
     NEXT_TELEMETRY_DISABLED = "1";
     FFMPEG_PATH = lib.getExe ffmpeg;
@@ -45,25 +29,25 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zipline";
-  version = "4.0.2";
+  version = "4.1.0";
 
   src = fetchFromGitHub {
     owner = "diced";
     repo = "zipline";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-waUc2DzD7oQ/ZuPKvUwu3Yj6uxrZauR4phcQwh7YfKw=";
+    hash = "sha256-5qa2K17RmWHO5mrkz/Imoxv4ODEaJow3BMUBNzl7Dg8=";
   };
 
-  pnpmDeps = pnpm_9.fetchDeps {
+  pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-Q1PHXoiqUorAGcpIvM5iBvPINLRv+dAo0awhG4gvsrI=";
+    hash = "sha256-xFe1Fdsp8Tpz0r+xvPSYuPR8gXTts6iWTq0a9u+Xh3U=";
   };
 
   buildInputs = [ vips ];
 
   nativeBuildInputs = [
-    pnpm_9.configHook
-    nodejs
+    pnpm_10.configHook
+    nodejs_24
     makeWrapper
   ];
 
@@ -82,10 +66,10 @@ stdenv.mkDerivation (finalAttrs: {
 
     mkdir -p $out/{bin,share/zipline}
 
-    cp -r build node_modules prisma .next mimes.json code.json package.json $out/share/zipline
+    cp -r build generated node_modules prisma .next mimes.json code.json package.json $out/share/zipline
 
     mkBin() {
-      makeWrapper ${lib.getExe nodejs} "$out/bin/$1" \
+      makeWrapper ${lib.getExe nodejs_24} "$out/bin/$1" \
         --chdir "$out/share/zipline" \
         --set NODE_ENV production \
         --prefix PATH : ${lib.makeBinPath [ openssl ]} \

pkgs/desktops/lomiri/applications/lomiri-system-settings/default.nix

@@ -2,7 +2,6 @@
   stdenv,
   lib,
   fetchFromGitLab,
-  fetchpatch,
   gitUpdater,
   testers,
   accountsservice,
@@ -49,13 +48,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lomiri-system-settings-unwrapped";
-  version = "1.3.0";
+  version = "1.3.2";
 
   src = fetchFromGitLab {
     owner = "ubports";
     repo = "development/core/lomiri-system-settings";
-    rev = finalAttrs.version;
-    hash = "sha256-8X5a2zJ0y8bSSnbqDvRoYm/2VPAWcfZZuiH+5p8eXi4=";
+    tag = finalAttrs.version;
+    hash = "sha256-bVBxJgOy1eXqwzcgBRUTlFoJxxw9I1Qc+Wn92U0QzA4=";
   };
 
   outputs = [
@@ -64,14 +63,6 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   patches = [
-    # Fixes compat with newer ICU
-    # Remove when version > 1.3.0
-    (fetchpatch {
-      name = "0001-lomiri-system-settings-unwrapped-Unpin-Cxx-standard.patch";
-      url = "https://gitlab.com/ubports/development/core/lomiri-system-settings/-/commit/c0b1c773237b28ea50850810b8844033b13fb666.patch";
-      hash = "sha256-M73gQxstKyuzzx1VxdOiNYyfQbSZPIy2gxiCtKcdS1M=";
-    })
-
     ./2000-Support-wrapping-for-Nixpkgs.patch
   ];
 
@@ -80,8 +71,6 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail "\''${CMAKE_INSTALL_LIBDIR}/qt5/qml" "\''${CMAKE_INSTALL_PREFIX}/${qtbase.qtQmlPrefix}" \
 
     # Port from lomiri-keyboard to maliit-keyboard
-    substituteInPlace plugins/language/CMakeLists.txt \
-      --replace-fail 'LOMIRI_KEYBOARD_PLUGIN_PATH=\"''${CMAKE_INSTALL_FULL_LIBDIR}/lomiri-keyboard/plugins\"' 'LOMIRI_KEYBOARD_PLUGIN_PATH=\"${lib.getLib maliit-keyboard}/lib/maliit/keyboard2/languages\"'
     substituteInPlace plugins/language/{PageComponent,SpellChecking,ThemeValues}.qml plugins/language/onscreenkeyboard-plugin.cpp plugins/sound/PageComponent.qml \
       --replace-fail 'com.lomiri.keyboard.maliit' 'org.maliit.keyboard.maliit'
 
@@ -164,6 +153,7 @@ stdenv.mkDerivation (finalAttrs: {
   cmakeFlags = [
     (lib.cmakeBool "ENABLE_LIBDEVICEINFO" true)
     (lib.cmakeBool "ENABLE_TESTS" finalAttrs.finalPackage.doCheck)
+    (lib.cmakeFeature "LOMIRI_KEYBOARD_PLUGIN_PATH" "${lib.getLib maliit-keyboard}/lib/maliit/keyboard2/languages")
   ];
 
   # The linking for this normally ignores missing symbols, which is inconvenient for figuring out why subpages may be
@@ -207,7 +197,9 @@ stdenv.mkDerivation (finalAttrs: {
   meta = with lib; {
     description = "System Settings application for Lomiri";
     homepage = "https://gitlab.com/ubports/development/core/lomiri-system-settings";
-    changelog = "https://gitlab.com/ubports/development/core/lomiri-system-settings/-/blob/${finalAttrs.version}/ChangeLog";
+    changelog = "https://gitlab.com/ubports/development/core/lomiri-system-settings/-/blob/${
+      if (!builtins.isNull finalAttrs.src.tag) then finalAttrs.src.tag else finalAttrs.src.rev
+    }/ChangeLog";
     license = licenses.gpl3Only;
     mainProgram = "lomiri-system-settings";
     teams = [ teams.lomiri ];

pkgs/desktops/xfce/panel-plugins/xfce4-timer-plugin/default.nix

@@ -3,31 +3,32 @@
   stdenv,
   fetchurl,
   gettext,
+  meson,
+  ninja,
   pkg-config,
   libxfce4util,
   xfce4-panel,
   libxfce4ui,
   glib,
   gtk3,
-  hicolor-icon-theme,
   gitUpdater,
 }:
 
-let
-  category = "panel-plugins";
-in
-
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "xfce4-timer-plugin";
-  version = "1.7.3";
+  version = "1.8.0";
 
   src = fetchurl {
-    url = "mirror://xfce/src/${category}/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-rPTIYa+IYIuegCp2pLBYRr0wGJ4AhegmaAzBebbfTNM=";
+    url = "mirror://xfce/src/panel-plugins/xfce4-timer-plugin/${lib.versions.majorMinor finalAttrs.version}/xfce4-timer-plugin-${finalAttrs.version}.tar.xz";
+    hash = "sha256-HTrDqixDRUAMAlZCd452Q6q0EEdiK6+c3AC7rHjon5k=";
   };
 
+  strictDeps = true;
+
   nativeBuildInputs = [
     gettext
+    meson
+    ninja
     pkg-config
   ];
 
@@ -37,21 +38,18 @@ stdenv.mkDerivation rec {
     xfce4-panel
     glib
     gtk3
-    hicolor-icon-theme
   ];
 
-  hardeningDisable = [ "format" ];
-
   passthru.updateScript = gitUpdater {
-    url = "https://gitlab.xfce.org/panel-plugins/${pname}";
-    rev-prefix = "${pname}-";
+    url = "https://gitlab.xfce.org/panel-plugins/xfce4-timer-plugin";
+    rev-prefix = "xfce4-timer-plugin-";
   };
 
-  meta = with lib; {
+  meta = {
     homepage = "https://docs.xfce.org/panel-plugins/xfce4-timer-plugin";
     description = "Simple countdown and alarm plugin for the Xfce panel";
-    platforms = platforms.linux;
-    license = licenses.gpl2Plus;
-    teams = [ teams.xfce ];
+    platforms = lib.platforms.linux;
+    license = lib.licenses.gpl2Plus;
+    teams = [ lib.teams.xfce ];
   };
-}
+})

pkgs/desktops/xfce/panel-plugins/xfce4-verve-plugin/default.nix

@@ -1,19 +1,40 @@
 {
+  stdenv,
   lib,
-  mkXfceDerivation,
+  fetchFromGitLab,
+  gettext,
+  meson,
+  ninja,
+  pkg-config,
   glib,
   gtk3,
   libxfce4ui,
   libxfce4util,
   pcre2,
   xfce4-panel,
+  gitUpdater,
 }:
 
-mkXfceDerivation {
-  category = "panel-plugins";
+stdenv.mkDerivation (finalAttrs: {
   pname = "xfce4-verve-plugin";
-  version = "2.0.4";
-  sha256 = "sha256-j0uKYj9PeLEVaocHRw87Dz+YFqDr1BImejEpDPYObQg=";
+  version = "2.1.0";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.xfce.org";
+    owner = "panel-plugins";
+    repo = "xfce4-verve-plugin";
+    tag = "xfce4-verve-plugin-${finalAttrs.version}";
+    hash = "sha256-mxSjYBeBc2HjdTFVdZSVdspAQTEyS+uQA6K17lJoLlc=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    gettext
+    meson
+    ninja
+    pkg-config
+  ];
 
   buildInputs = [
     glib
@@ -24,8 +45,13 @@ mkXfceDerivation {
     xfce4-panel
   ];
 
-  meta = with lib; {
+  passthru.updateScript = gitUpdater { rev-prefix = "xfce4-verve-plugin-"; };
+
+  meta = {
     description = "Command-line plugin";
-    teams = [ teams.xfce ];
+    homepage = "https://gitlab.xfce.org/panel-plugins/xfce4-verve-plugin";
+    license = lib.licenses.gpl2Plus;
+    teams = [ lib.teams.xfce ];
+    platforms = lib.platforms.linux;
   };
-}
+})

pkgs/desktops/xfce/panel-plugins/xfce4-weather-plugin/default.nix

@@ -4,8 +4,9 @@
   fetchurl,
   fetchpatch,
   gettext,
+  meson,
+  ninja,
   pkg-config,
-  xfce4-dev-tools,
   glib,
   gtk3,
   json_c,
@@ -19,36 +20,32 @@
   gitUpdater,
 }:
 
-let
-  category = "panel-plugins";
-in
-
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "xfce4-weather-plugin";
-  version = "0.11.3";
+  version = "0.12.0";
 
   src = fetchurl {
-    url = "mirror://xfce/src/${category}/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-AC0f5jkG0vOgEvPLWMzv8d+8xGZ1njbHbTsD3QHA3Fc=";
+    url = "mirror://xfce/src/panel-plugins/xfce4-weather-plugin/${lib.versions.majorMinor finalAttrs.version}/xfce4-weather-plugin-${finalAttrs.version}.tar.xz";
+    hash = "sha256-XdkLAywG70tkuBgCMVTvlGOixpSgKQ5X80EilsdUX/Y=";
   };
 
   patches = [
-    # Port to libsoup-3.0
-    # https://gitlab.xfce.org/panel-plugins/xfce4-weather-plugin/-/merge_requests/28
+    # meson-build: Add missing HAVE_UPOWER_GLIB definition
+    # https://gitlab.xfce.org/panel-plugins/xfce4-weather-plugin/-/merge_requests/37
     (fetchpatch {
-      url = "https://gitlab.xfce.org/panel-plugins/xfce4-weather-plugin/-/commit/c0653a903c6f2cecdf41ac9eaeba4f4617656ffe.patch";
-      hash = "sha256-wAowm4ppBSKvYwOowZbbs5pnTh9EQ9XX05lA81wtsRM=";
-    })
-    (fetchpatch {
-      url = "https://gitlab.xfce.org/panel-plugins/xfce4-weather-plugin/-/commit/279c975dc1f95bd1ce9152eee1d19122e7deb9a8.patch";
-      hash = "sha256-gVfyXkE0bjBfvcQU9fDp+Gm59bD3VbAam04Jak8i31k=";
+      url = "https://gitlab.xfce.org/panel-plugins/xfce4-weather-plugin/-/commit/1d8e5e5dbbc4d53e4b810f9b01a460197cd47b64.patch";
+      hash = "sha256-g9AIp1iBcA3AxD1tpnv32PvxxulXYjFvQh3EqD1gmHg=";
     })
   ];
 
+  strictDeps = true;
+
   nativeBuildInputs = [
     gettext
+    glib # glib-compile-resources
+    meson
+    ninja
     pkg-config
-    xfce4-dev-tools
   ];
 
   buildInputs = [
@@ -64,20 +61,16 @@ stdenv.mkDerivation rec {
     xfconf
   ];
 
-  configureFlags = [ "--enable-maintainer-mode" ];
-
-  enableParallelBuilding = true;
-
   passthru.updateScript = gitUpdater {
-    url = "https://gitlab.xfce.org/panel-plugins/${pname}";
-    rev-prefix = "${pname}-";
+    url = "https://gitlab.xfce.org/panel-plugins/xfce4-weather-plugin";
+    rev-prefix = "xfce4-weather-plugin-";
   };
 
-  meta = with lib; {
+  meta = {
     homepage = "https://docs.xfce.org/panel-plugins/xfce4-weather-plugin";
     description = "Weather plugin for the Xfce desktop environment";
-    license = licenses.gpl2Plus;
-    platforms = platforms.unix;
-    teams = [ teams.xfce ];
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.unix;
+    teams = [ lib.teams.xfce ];
   };
-}
+})

pkgs/desktops/xfce/panel-plugins/xfce4-whiskermenu-plugin/default.nix

@@ -1,11 +1,15 @@
 {
-  mkXfceDerivation,
+  stdenv,
   lib,
-  cmake,
+  fetchFromGitLab,
+  gettext,
+  meson,
+  ninja,
+  pkg-config,
+  wrapGAppsHook3,
   accountsservice,
   exo,
   garcon,
-  gettext,
   glib,
   gtk-layer-shell,
   gtk3,
@@ -13,25 +17,35 @@
   libxfce4util,
   xfce4-panel,
   xfconf,
+  gitUpdater,
 }:
 
-mkXfceDerivation {
-  category = "panel-plugins";
+stdenv.mkDerivation (finalAttrs: {
   pname = "xfce4-whiskermenu-plugin";
-  version = "2.9.2";
-  rev-prefix = "v";
-  odd-unstable = false;
-  sha256 = "sha256-M9eraJwArCrASrLz+URUOmYtulWPNxR39Sn+alfWoy4=";
+  version = "2.10.0";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.xfce.org";
+    owner = "panel-plugins";
+    repo = "xfce4-whiskermenu-plugin";
+    tag = "xfce4-whiskermenu-plugin-${finalAttrs.version}";
+    hash = "sha256-2FACsP6mKx0k91xG3DaVS6hdvdLrjLu9Y9rVOW6PZ3M=";
+  };
+
+  strictDeps = true;
 
   nativeBuildInputs = [
-    cmake
+    gettext
+    meson
+    ninja
+    pkg-config
+    wrapGAppsHook3
   ];
 
   buildInputs = [
     accountsservice
     exo
     garcon
-    gettext
     glib
     gtk-layer-shell
     gtk3
@@ -41,9 +55,14 @@ mkXfceDerivation {
     xfconf
   ];
 
-  meta = with lib; {
+  passthru.updateScript = gitUpdater { rev-prefix = "xfce4-whiskermenu-plugin-"; };
+
+  meta = {
     description = "Alternate application launcher for Xfce";
     mainProgram = "xfce4-popup-whiskermenu";
-    teams = [ teams.xfce ];
+    homepage = "https://gitlab.xfce.org/panel-plugins/xfce4-whiskermenu-plugin";
+    license = lib.licenses.gpl2Plus;
+    teams = [ lib.teams.xfce ];
+    platforms = lib.platforms.linux;
   };
-}
+})

pkgs/desktops/xfce/panel-plugins/xfce4-windowck-plugin/default.nix

@@ -3,7 +3,10 @@
   lib,
   fetchurl,
   gettext,
+  meson,
+  ninja,
   pkg-config,
+  python3,
   glib,
   gtk3,
   libwnck,
@@ -14,19 +17,24 @@
   gitUpdater,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "xfce4-windowck-plugin";
-  version = "0.5.2";
+  version = "0.6.0";
 
   src = fetchurl {
-    # Use dist tarballs to avoid pulling extra deps and generating images ourselves.
-    url = "mirror://xfce/src/panel-plugins/xfce4-windowck-plugin/${lib.versions.majorMinor version}/xfce4-windowck-plugin-${version}.tar.bz2";
-    sha256 = "sha256-3E7V3JS9Bd5UlUQfDKuyYKs+H2ziex+skuN/kJwM/go=";
+    url = "mirror://xfce/src/panel-plugins/xfce4-windowck-plugin/${lib.versions.majorMinor finalAttrs.version}/xfce4-windowck-plugin-${finalAttrs.version}.tar.xz";
+    hash = "sha256-dJeSszth86ICe2VHBW5JOYqNajPgeg66hYOvnF9hdj8=";
   };
 
+  strictDeps = true;
+
   nativeBuildInputs = [
     gettext
+    glib # glib-compile-resources
+    meson
+    ninja
     pkg-config
+    python3
   ];
 
   buildInputs = [
@@ -44,11 +52,11 @@ stdenv.mkDerivation rec {
     rev-prefix = "xfce4-windowck-plugin-";
   };
 
-  meta = with lib; {
+  meta = {
     description = "Xfce panel plugin for displaying window title and buttons";
     homepage = "https://gitlab.xfce.org/panel-plugins/xfce4-windowck-plugin";
-    license = licenses.gpl3Plus;
-    platforms = platforms.linux;
-    teams = [ teams.xfce ];
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.linux;
+    teams = [ lib.teams.xfce ];
   };
-}
+})

pkgs/desktops/xfce/panel-plugins/xfce4-xkb-plugin/default.nix

@@ -1,6 +1,12 @@
 {
+  stdenv,
   lib,
-  mkXfceDerivation,
+  fetchFromGitLab,
+  gettext,
+  meson,
+  ninja,
+  pkg-config,
+  glib,
   gtk3,
   libnotify,
   librsvg,
@@ -11,18 +17,35 @@
   libxfce4util,
   xfce4-panel,
   xfconf,
+  gitUpdater,
 }:
 
-mkXfceDerivation {
-  category = "panel-plugins";
+stdenv.mkDerivation (finalAttrs: {
   pname = "xfce4-xkb-plugin";
-  version = "0.8.5";
-  sha256 = "sha256-oG3+OudjJIXfGII16bYaIGy4QMno00HX3kX+8H0VUcU=";
+  version = "0.9.0";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.xfce.org";
+    owner = "panel-plugins";
+    repo = "xfce4-xkb-plugin";
+    tag = "xfce4-xkb-plugin-${finalAttrs.version}";
+    hash = "sha256-yLlUKp7X8bylJs7ioQJ36mfqFlsiZXOgFXa0ZP7AG1E=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    gettext
+    meson
+    ninja
+    pkg-config
+  ];
 
   buildInputs = [
     garcon
+    glib
     gtk3
-    libnotify # optional notification support
+    libnotify
     librsvg
     libxfce4ui
     libxfce4util
@@ -32,8 +55,13 @@ mkXfceDerivation {
     xfconf
   ];
 
-  meta = with lib; {
+  passthru.updateScript = gitUpdater { rev-prefix = "xfce4-xkb-plugin-"; };
+
+  meta = {
     description = "Allows you to setup and use multiple keyboard layouts";
-    teams = [ teams.xfce ];
+    homepage = "https://gitlab.xfce.org/panel-plugins/xfce4-xkb-plugin";
+    license = lib.licenses.gpl2Plus;
+    teams = [ lib.teams.xfce ];
+    platforms = lib.platforms.linux;
   };
-}
+})

pkgs/development/python-modules/add-trailing-comma/default.nix

@@ -16,7 +16,7 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "asottile";
-    repo = pname;
+    repo = "add-trailing-comma";
     rev = "v${version}";
     hash = "sha256-B+wjBy42RwabVz/6qEMGpB0JmwJ9hqSskwcNj4x/B/k=";
   };

pkgs/development/python-modules/advocate/default.nix

@@ -18,7 +18,7 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "JordanMilne";
-    repo = pname;
+    repo = "advocate";
     rev = "v${version}";
     hash = "sha256-opObkjkad+yrLE2b7DULHjGuNeVhu4fEmSavgA39YPw=";
   };

pkgs/development/python-modules/aggdraw/default.nix

@@ -19,7 +19,7 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "pytroll";
-    repo = pname;
+    repo = "aggdraw";
     rev = "v${version}";
     hash = "sha256-J9+mxlUxOoRBFdz+p8me2T93jaov5rNvKbAZ2YX/VhA=";
   };

pkgs/development/python-modules/aider-chat/default.nix

@@ -6,8 +6,6 @@
   gitMinimal,
   portaudio,
   playwright-driver,
-  symlinkJoin,
-  nltk-data,
   pythonOlder,
   pythonAtLeast,
   setuptools-scm,
@@ -122,13 +120,10 @@
 }:
 
 let
-  aider-nltk-data = symlinkJoin {
-    name = "aider-nltk-data";
-    paths = [
-      nltk-data.punkt-tab
-      nltk-data.stopwords
-    ];
-  };
+  aider-nltk-data = nltk.dataDir (d: [
+    d.punkt-tab
+    d.stopwords
+  ]);
 
   version = "0.83.1";
   aider-chat = buildPythonPackage {

pkgs/development/python-modules/aioblescan/default.nix

@@ -15,7 +15,7 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "frawau";
-    repo = pname;
+    repo = "aioblescan";
     tag = version;
     hash = "sha256-JeA9jX566OSRiejdnlifbcNGm0J0C+xzA6zXDUyZ6jc=";
   };

pkgs/development/python-modules/aiodocker/default.nix

@@ -2,33 +2,39 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  hatchling,
+  hatch-vcs,
   aiohttp,
-  typing-extensions,
 }:
 
 buildPythonPackage rec {
   pname = "aiodocker";
-  # unstable includes support for python 3.10+
-  version = "unstable-2022-01-20";
-  format = "setuptools";
+  version = "0.24.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aio-libs";
-    repo = pname;
-    rev = "f1dbdc3d42147f4c2ab5e6802acf6f7d0f885be4";
-    sha256 = "RL5Ck4wsBZO88afmoojeFKbdIeCjDo/SwNqUcERH6Ls=";
+    repo = "aiodocker";
+    tag = "v${version}";
+    hash = "sha256-qCOAM4ZyJoLc91FjQpBO97Nyfo1ZOEi0nhXZ7nwLsHk=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [
+    hatchling
+    hatch-vcs
+  ];
+
+  dependencies = [
     aiohttp
-    typing-extensions
   ];
 
   # tests require docker daemon
   doCheck = false;
+
   pythonImportsCheck = [ "aiodocker" ];
 
   meta = with lib; {
+    changelog = "https://github.com/aio-libs/aiodocker/releases/tag/${src.tag}";
     description = "Docker API client for asyncio";
     homepage = "https://github.com/aio-libs/aiodocker";
     license = licenses.asl20;

pkgs/development/python-modules/aioemonitor/default.nix

@@ -19,7 +19,7 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "bdraco";
-    repo = pname;
+    repo = "aioemonitor";
     rev = "v${version}";
     sha256 = "0h8zqqy8v8r1fl9bp3m8icr2sy44p0mbfl1hbb0zni17r9r50dhn";
   };

pkgs/development/python-modules/aiohttp-wsgi/default.nix

@@ -15,7 +15,7 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "etianen";
-    repo = pname;
+    repo = "aiohttp-wsgi";
     rev = "v${version}";
     hash = "sha256-3Q00FidZWV1KueuHyHKQf1PsDJGOaRW6v/kBy7lzD4Q=";
   };

pkgs/development/python-modules/aiohwenergy/default.nix

@@ -15,7 +15,7 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "DCSBL";
-    repo = pname;
+    repo = "aiohwenergy";
     rev = version;
     hash = "sha256-WfkwIxyDzLNzhWNWST/V3iN9Bhu2oXDwGiA5UXCq5ho=";
   };

pkgs/development/python-modules/aiokef/default.nix

@@ -17,7 +17,7 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "basnijholt";
-    repo = pname;
+    repo = "aiokef";
     rev = "v${version}";
     sha256 = "0ms0dwrpj80w55svcppbnp7vyl5ipnjfp1c436k5c7pph4q5pxk9";
   };

pkgs/development/python-modules/aiolimiter/default.nix

@@ -20,7 +20,7 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "mjpieters";
-    repo = pname;
+    repo = "aiolimiter";
     tag = "v${version}";
     hash = "sha256-wgHR0GzaPXlhL4ErklFqmWNFO49dvd5X5MgyYHVH4Eo=";
   };

pkgs/development/python-modules/aiolookin/default.nix

@@ -19,7 +19,7 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "ANMalko";
-    repo = pname;
+    repo = "aiolookin";
     tag = "v${version}";
     hash = "sha256-G3/lUgV60CMLskUo83TlvLLIfJtu5DEz+94mdVI4OrI=";
   };

pkgs/development/python-modules/aionanoleaf/default.nix

@@ -15,7 +15,7 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "milanmeu";
-    repo = pname;
+    repo = "aionanoleaf";
     tag = "v${version}";
     hash = "sha256-f0TyXhuAzI0s0n6sXH9mKWA4nad2YchZkQ0+jw/Bmv0=";
   };

pkgs/development/python-modules/aiopg/default.nix

@@ -16,7 +16,7 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "aio-libs";
-    repo = pname;
+    repo = "aiopg";
     rev = "v${version}";
     hash = "sha256-GD5lRSUjASTwBk5vEK8v3xD8eNyxpwSrO3HHvtwubmk=";
   };

pkgs/development/python-modules/aiopurpleair/default.nix

@@ -22,7 +22,7 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "bachya";
-    repo = pname;
+    repo = "aiopurpleair";
     tag = version;
     hash = "sha256-2Ngo2pvzwcgQvpyW5Q97VQN/tGSVhVJwRj0DMaPn+O4=";
   };

pkgs/development/python-modules/aiopyarr/default.nix

@@ -20,7 +20,7 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "tkdrob";
-    repo = pname;
+    repo = "aiopyarr";
     tag = version;
     hash = "sha256-CzNB6ymvDTktiOGdcdCvWLVQ3mKmbdMpc/vezSXCpG4=";
   };

pkgs/development/python-modules/aiopylgtv/default.nix

@@ -16,7 +16,7 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "bendavid";
-    repo = pname;
+    repo = "aiopylgtv";
     rev = version;
     hash = "sha256-NkWJGy5QUrhpbARoscrXy/ilCjAz01YxeVTH0I+IjNM=";
   };

pkgs/development/python-modules/aioqsw/default.nix

@@ -17,7 +17,7 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "Noltari";
-    repo = pname;
+    repo = "aioqsw";
     tag = version;
     hash = "sha256-h/rTwMF3lc/hWwpzCvK6UMq0rjq3xkw/tEY3BqOPS2s=";
   };

pkgs/development/python-modules/aiorecollect/default.nix

@@ -20,7 +20,7 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "bachya";
-    repo = pname;
+    repo = "aiorecollect";
     tag = version;
     hash = "sha256-Rj0+r7eERLY5VzmuDQH/TeVLfmvmKwPqcvd1b/To0Ts=";
   };

pkgs/development/python-modules/aioridwell/default.nix

@@ -26,7 +26,7 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "bachya";
-    repo = pname;
+    repo = "aioridwell";
     tag = version;
     hash = "sha256-B5k8uXDHq0U6fJVW8oy2sWUj5OIVGUfe9EtCjnIr3OE=";
   };

pkgs/development/python-modules/aiosenz/default.nix

@@ -17,7 +17,7 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "milanmeu";
-    repo = pname;
+    repo = "aiosenz";
     rev = version;
     hash = "sha256-ODdWPS14zzptxuS6mff51f0s1SYnIqjF40DmvT0sL0w=";
   };

pkgs/development/python-modules/aiosignal/default.nix

@@ -18,7 +18,7 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "aio-libs";
-    repo = pname;
+    repo = "aiosignal";
     rev = "v${version}";
     hash = "sha256-CvNarJpSq8EKnt+PuSerMK/ZVbxL9rp7rQ4dkWykG1M=";
   };

pkgs/development/python-modules/aiosonic/default.nix

@@ -10,26 +10,13 @@
   h2,
   onecache,
   # test dependencies
-  asgiref,
-  black,
-  django,
-  click,
   httpx,
-  proxy-py,
   pytest-aiohttp,
-  pytest-asyncio,
   pytest-cov-stub,
-  pytest-django,
   pytest-mock,
-  pytest-sugar,
-  pytest-timeout,
   uvicorn,
-  httptools,
-  typed-ast,
-  uvloop,
   requests,
   aiohttp,
-  aiodns,
   pytestCheckHook,
   stdenv,
 }:
@@ -66,27 +53,13 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     aiohttp
-    aiodns
-    asgiref
-    black
-    django
-    click
     httpx
-    proxy-py
     pytest-aiohttp
-    pytest-asyncio
     pytest-cov-stub
-    pytest-django
     pytest-mock
-    pytest-sugar
-    pytest-timeout
     uvicorn
-    httptools
-    typed-ast
-    uvloop
     requests
     pytestCheckHook
-    nodejs
   ];
 
   pythonImportsCheck = [ "aiosonic" ];

pkgs/development/python-modules/aiowatttime/default.nix

@@ -22,7 +22,7 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "bachya";
-    repo = pname;
+    repo = "aiowatttime";
     tag = version;
     hash = "sha256-c5L+Nx+CoWEc6Bs61GOHPBelExe5I7EOlMQ+QV6nktI=";
   };

pkgs/development/python-modules/airtouch4pyapi/default.nix

@@ -15,7 +15,7 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "LonePurpleWolf";
-    repo = pname;
+    repo = "airtouch4pyapi";
     tag = "v${version}";
     hash = "sha256-RiRwebumidn0nijL/e9J74ZYx0DASi1up5BTNxYoGEA=";
   };

pkgs/development/python-modules/aladdin-connect/default.nix

@@ -15,7 +15,7 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "shoejosh";
-    repo = pname;
+    repo = "aladdin-connect";
     tag = version;
     hash = "sha256-kLvMpSGa5WyDOH3ejAJyFGsB9IiMXp+nvVxM/ZkxyFw=";
   };

pkgs/development/python-modules/allpairspy/default.nix

@@ -13,7 +13,7 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "thombashi";
-    repo = pname;
+    repo = "allpairspy";
     tag = "v${version}";
     hash = "sha256-0wzoQDHB7Tt80ZTlKrNxFutztsgUuin5D2eb80c4PBI=";
   };

pkgs/development/python-modules/amqtt/default.nix

@@ -17,7 +17,7 @@
   websockets,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage {
   pname = "amqtt";
   version = "unstable-2022-05-29";
   format = "pyproject";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "Yakifo";
-    repo = pname;
+    repo = "amqtt";
     rev = "09ac98d39a711dcff0d8f22686916e1c2495144b";
     hash = "sha256-8T1XhBSOiArlUQbQ41LsUogDgOurLhf+M8mjIrrAC4s=";
   };

pkgs/development/python-modules/ancp-bids/default.nix

@@ -19,7 +19,7 @@ buildPythonPackage rec {
   # `tests/data` dir missing from PyPI dist
   src = fetchFromGitHub {
     owner = "ANCPLabOldenburg";
-    repo = pname;
+    repo = "ancp-bids";
     tag = version;
     hash = "sha256-vmw8SAikvbaHnPOthBQxTbyvDwnnZwCOV97aUogIgxw=";
   };

pkgs/development/python-modules/androguard/default.nix

@@ -39,8 +39,8 @@ buildPythonPackage rec {
   pyproject = true;
 
   src = fetchFromGitHub {
-    repo = pname;
-    owner = pname;
+    repo = "androguard";
+    owner = "androguard";
     tag = "v${version}";
     sha256 = "sha256-qz6x7UgYXal1DbQGzi4iKnSGEn873rKibKme/pF7tLk=";
   };

pkgs/development/python-modules/ansi/default.nix

@@ -13,7 +13,7 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "tehmaze";
-    repo = pname;
+    repo = "ansi";
     tag = "ansi-${version}";
     hash = "sha256-PmgB1glksu4roQeZ1o7uilMJNm9xaYqw680N2z+tUUM=";
   };

pkgs/development/python-modules/ansiconv/default.nix

@@ -12,7 +12,7 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "ansible";
-    repo = pname;
+    repo = "ansiconv";
     rev = "v${version}";
     sha256 = "0ljfpl8x069arzginvpi1v6hlaq4x2qpjqj01qds2ylz33scq8r4";
   };

pkgs/development/python-modules/aqualogic/default.nix

@@ -15,7 +15,7 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "swilson";
-    repo = pname;
+    repo = "aqualogic";
     rev = version;
     hash = "sha256-hBg02Wypd+MyqM2SUD53djhm5OMP2QAmsp8Stf+UT2c=";
   };

pkgs/development/python-modules/arc4/default.nix

@@ -15,7 +15,7 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "manicmaniac";
-    repo = pname;
+    repo = "arc4";
     rev = version;
     hash = "sha256-DlZIygf5v3ZNY2XFmrKOA15ccMo3Rv0kf6hZJ0CskeQ=";
   };

pkgs/development/python-modules/aria2p/default.nix

@@ -29,7 +29,7 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "pawamoy";
-    repo = pname;
+    repo = "aria2p";
     tag = version;
     hash = "sha256-JEXTCDfFjxI1hooiEQq0KIGGoS2F7fyzOM0GMl+Jr7w=";
   };

pkgs/development/python-modules/arpy/default.nix

@@ -12,7 +12,7 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "viraptor";
-    repo = pname;
+    repo = "arpy";
     rev = version;
     hash = "sha256-jD1XJJhcpJymn0CwZ65U06xLKm1JjHffmx/umEO7a5s=";
   };

pkgs/development/python-modules/asn1ate/default.nix

@@ -14,7 +14,7 @@ buildPythonPackage rec {
     sha256 = "1p8hv4gsyqsdr0gafcq497n52pybiqmc22di8ai4nsj60fv0km45";
     rev = "v${version}";
     owner = "kimgr";
-    repo = pname;
+    repo = "asn1ate";
   };
 
   propagatedBuildInputs = [ pyparsing ];

pkgs/development/python-modules/assay/default.nix

@@ -5,14 +5,14 @@
   pythonAtLeast,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage {
   pname = "assay";
   version = "0-unstable-2024-05-09";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "brandon-rhodes";
-    repo = pname;
+    repo = "assay";
     rev = "74617d70e77afa09f58b3169cf496679ac5d5621";
     hash = "sha256-zYpLtcXZ16EJWKSCqxFkSz/G9PwIZEQGBrYiJKuqnc4=";
   };

pkgs/development/python-modules/assertpy/default.nix

@@ -11,8 +11,8 @@ buildPythonPackage rec {
   format = "setuptools";
 
   src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
+    owner = "assertpy";
+    repo = "assertpy";
     rev = version;
     sha256 = "0hnfh45cmqyp7zasrllwf8gbq3mazqlhhk0sq1iqlh6fig0yfq2f";
   };

pkgs/development/python-modules/asyncio-throttle/default.nix

@@ -15,7 +15,7 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "hallazzang";
-    repo = pname;
+    repo = "asyncio-throttle";
     rev = "v${version}";
     sha256 = "1hsjcymdcm0hf4l68scf9n8j7ba89azgh96xhxrnyvwxfs5acnmv";
   };

pkgs/development/python-modules/asyncmy/default.nix

@@ -17,7 +17,7 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "long2ice";
-    repo = pname;
+    repo = "asyncmy";
     tag = "v${version}";
     hash = "sha256-HQZmt22yPYaWfJzL20+jBc855HR4dVW983Z0LrN1Xa0=";
   };

pkgs/development/python-modules/atlassian-python-api/default.nix

@@ -24,7 +24,7 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "atlassian-api";
-    repo = pname;
+    repo = "atlassian-python-api";
     tag = version;
     hash = "sha256-m8B6t9tTlef8cdsh/wnsc0iyNLsB0RYjUhq/bA9MeII=";
   };

pkgs/development/python-modules/aurorapy/default.nix

@@ -19,7 +19,7 @@ buildPythonPackage rec {
 
   src = fetchFromGitLab {
     owner = "energievalsabbia";
-    repo = pname;
+    repo = "aurorapy";
     rev = version;
     hash = "sha256-rGwfGq3zdoG9NCGqVN29Q4bWApk5B6CRdsW9ctWgOec=";
   };

pkgs/development/python-modules/avea/default.nix

@@ -12,7 +12,7 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "k0rventen";
-    repo = pname;
+    repo = "avea";
     rev = "v${version}";
     sha256 = "1dirf0zdf4hb941w1dvh97vsvcy4h3w9r8jwdgr1ggmhdf9kfx4v";
   };

pkgs/development/python-modules/babelfont/default.nix

@@ -25,7 +25,7 @@ buildPythonPackage rec {
   # PyPI source tarballs omit tests, fetch from Github instead
   src = fetchFromGitHub {
     owner = "simoncozens";
-    repo = pname;
+    repo = "babelfont";
     tag = "v${version}";
     hash = "sha256-XNoyM3kjKRc0NWA94ufzC2DBzAsufJNJbzFDUbLu8Lc=";
   };

pkgs/development/python-modules/backoff/default.nix

@@ -15,7 +15,7 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "litl";
-    repo = pname;
+    repo = "backoff";
     tag = "v${version}";
     hash = "sha256-g8bYGJ6Kw6y3BUnuoP1IAye5CL0geH5l7pTb3xxq7jI=";
   };