Merge 668b089f3418d09158ea72075b9819ac3a6560dc into haskell-updates

maintainers/README.md

@@ -42,7 +42,7 @@ package's `meta.maintainers` list, and send a PR with the changes.
 
 If you're adding yourself as a maintainer as part of another PR (in which
 you become a maintainer of a package, for example), make your change to
-`maintainer-list.nix` in a separate commit.
+`maintainer-list.nix` in a separate commit titled `maintainers: add <name>`.
 
 ### How to lose maintainer status
 
@@ -58,10 +58,34 @@ person as a reviewer, and then waiting a week for a reaction.
 
 The maintainer is welcome to come back at any time.
 
-### Tools for maintainers
+## Tools for maintainers
 
-When a pull request is made against a package, OfBorg will notify the
-appropriate maintainer(s).
+When a pull request is made against a package, nixpkgs CI will notify the appropriate
+maintainer(s) by trying to correlate the files the PR touches with the packages that need rebuilding.
+
+Maintainers can also invoke the [nixpkgs-merge-bot](https://github.com/nixos/nixpkgs-merge-bot)
+to merge pull requests targeting packages they are the maintainer of, which satisfy the current
+security [constraints](https://github.com/NixOS/nixpkgs-merge-bot/blob/main/README.md#constraints).
+Examples: [#397273](https://github.com/NixOS/nixpkgs/pull/397273#issuecomment-2789382120) and [#377027](https://github.com/NixOS/nixpkgs/pull/377027#issuecomment-2614510869)
+
+New maintainers will automatically get invited to join the [NixOS/nixpkgs-maintainers](https://github.com/orgs/NixOS/teams/nixpkgs-maintainers) GitHub team.
+By joining, you will get some triaging rights in the nixpkgs repository, like the ability to close and reopen issues made by others, and managing labels.
+However, the GitHub team invite is usually only sent by email, and is only valid for one week!
+Should it expire, please ask for a re-invite in the [GitHub org owners help desk Matrix channel](https://matrix.to/#/#org_owners:nixos.org).
+
+### Unofficial maintainer tooling
+
+[zh.fail](https://zh.fail/failed/overview.html) tracks all package build failures on `master` grouped by maintainer.
+
+[asymmetric/nixpkgs-update-notifier](https://github.com/asymmetric/nixpkgs-update-notifier) is a matrix
+bot that scrapes the [nixpkgs-update logs](https://nixpkgs-update-logs.nix-community.org/) and notifies
+you if nixpkgs-update/@r-ryantm fails to update any of the packages you've subscribed to.
+
+[repology.org](https://repology.org) tracks and compares the versions of packages between various package repositories, letting you know what packages may be out of date or insecure.
+You can view which packages a specific maintainer maintains and subscribe to updates with atom/rss. Example: [repology.org/maintainer/pbsds](https://repology.org/maintainer/pbsds%40hotmail.com).
+
+[nixpk.gs/pr-tracker](https://nixpk.gs/pr-tracker.html) and [nixpkgs-tracker.ocfox.me](https://nixpkgs-tracker.ocfox.me/)
+can visualize the release status of any nixpkgs pull request.
 
 ## Reviewing contributions
 

maintainers/maintainer-list.nix

@@ -4063,6 +4063,12 @@
       }
     ];
   };
+  cameroncuttingedge = {
+    email = "buckets-taxiway5l@icloud.com";
+    github = "cameroncuttingedge";
+    githubId = 109548666;
+    name = "Cameron Byte";
+  };
   camerondugan = {
     email = "cameron.dugan@protonmail.com";
     github = "camerondugan";
@@ -26579,6 +26585,12 @@
     githubId = 45292658;
     name = "Julius Schmitt";
   };
+  voidnoi = {
+    email = "voidnoi@proton.me";
+    github = "VoidNoi";
+    githubId = 83523507;
+    name = "voidnoi";
+  };
   vojta001 = {
     email = "vojtech.kane@gmail.com";
     github = "vojta001";

nixos/modules/services/home-automation/wyoming/faster-whisper.nix

@@ -282,7 +282,7 @@ in
     mkIf (cfg.servers != { }) {
       assertions = mapAttrsToList (
         server: options: {
-          assertion = options.useTransformers -> options.initialPromt == null;
+          assertion = options.useTransformers -> options.initialPrompt == null;
           message = "wyoming-faster-whisper/${server}: Transformer models (`useTransformers`) do not currently support an `initialPrompt`.";
         }
       );

nixos/modules/services/mail/postfix-tlspol.nix

@@ -10,6 +10,7 @@ let
     hasPrefix
     mkEnableOption
     mkIf
+    mkMerge
     mkOption
     mkPackageOption
     types
@@ -18,6 +19,7 @@ let
   cfg = config.services.postfix-tlspol;
 
   format = pkgs.formats.yaml_1_2 { };
+  configFile = format.generate "postfix-tlspol.yaml" cfg.settings;
 in
 
 {
@@ -121,100 +123,119 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
-    environment.etc."postfix-tlspol/config.yaml".source =
-      format.generate "postfix-tlspol.yaml" cfg.settings;
-
-    environment.systemPackages = [ cfg.package ];
-
-    # https://github.com/Zuplu/postfix-tlspol#postfix-configuration
-    services.postfix.config = mkIf (config.services.postfix.enable && cfg.configurePostfix) {
-      smtp_dns_support_level = "dnssec";
-      smtp_tls_security_level = "dane";
-      smtp_tls_policy_maps =
-        let
-          address =
-            if (hasPrefix "unix:" cfg.settings.server.address) then
-              cfg.settings.server.address
-            else
-              "inet:${cfg.settings.server.address}";
-        in
-        [ "socketmap:${address}:QUERYwithTLSRPT" ];
-    };
-
-    systemd.services.postfix-tlspol = {
-      after = [
-        "nss-lookup.target"
-        "network-online.target"
-      ];
-      wants = [
-        "nss-lookup.target"
-        "network-online.target"
-      ];
-      wantedBy = [ "multi-user.target" ];
-
-      description = "Postfix DANE/MTA-STS TLS policy socketmap service";
-      documentation = [ "https://github.com/Zuplu/postfix-tlspol" ];
-
-      # https://github.com/Zuplu/postfix-tlspol/blob/main/init/postfix-tlspol.service
-      serviceConfig = {
-        ExecStart = toString [
-          (lib.getExe cfg.package)
-          "-config"
-          "/etc/postfix-tlspol/config.yaml"
-        ];
-        ExecReload = "${lib.getExe' pkgs.util-linux "kill"} -HUP $MAINPID";
-        Restart = "always";
-        RestartSec = 5;
-
-        DynamicUser = true;
-
-        CacheDirectory = "postfix-tlspol";
-        CapabilityBoundingSet = [ "" ];
-        LockPersonality = true;
-        MemoryDenyWriteExecute = true;
-        NoNewPrivileges = true;
-        PrivateDevices = true;
-        PrivateTmp = true;
-        PrivateUsers = true;
-        ProcSubset = "pid";
-        ProtectClock = true;
-        ProtectControlGroups = true;
-        ProtectHome = true;
-        ProtectHostname = true;
-        ProtectKernelLogs = true;
-        ProtectKernelModules = true;
-        ProtectKernelTunables = true;
-        ProtectProc = "invisible";
-        ProtectSystem = "strict";
-        ReadOnlyPaths = [ "/etc/postfix-tlspol/config.yaml" ];
-        RemoveIPC = true;
-        RestrictAddressFamilies =
-          [
-            "AF_INET"
-            "AF_INET6"
-          ]
-          ++ lib.optionals (lib.hasPrefix "unix:" cfg.settings.server.address) [
-            "AF_UNIX"
-          ];
-        RestrictNamespace = true;
-        RestrictRealtime = true;
-        RestrictSUIDSGID = true;
-        SystemCallArchitectures = "native";
-        SystemCallFilter = [
-          "@system-service"
-          "~@privileged @resources"
-        ];
-        SystemCallErrorNumber = "EPERM";
-        SecureBits = [
-          "noroot"
-          "noroot-locked"
-        ];
-        RuntimeDirectory = "postfix-tlspol";
-        RuntimeDirectoryMode = "1750";
-        WorkingDirectory = "/var/cache/postfix-tlspol";
-        UMask = "0117";
+  config = mkMerge [
+    (mkIf (cfg.enable && config.services.postfix.enable && cfg.configurePostfix) {
+      # https://github.com/Zuplu/postfix-tlspol#postfix-configuration
+      services.postfix.config = {
+        smtp_dns_support_level = "dnssec";
+        smtp_tls_security_level = "dane";
+        smtp_tls_policy_maps =
+          let
+            address =
+              if (hasPrefix "unix:" cfg.settings.server.address) then
+                cfg.settings.server.address
+              else
+                "inet:${cfg.settings.server.address}";
+          in
+          [ "socketmap:${address}:QUERYwithTLSRPT" ];
       };
-    };
-  };
+
+      systemd.services.postfix = {
+        wants = [ "postfix-tlspol.service" ];
+        after = [ "postfix-tlspol.service" ];
+      };
+
+      users.users.postfix.extraGroups = [ "postfix-tlspol" ];
+    })
+
+    (mkIf cfg.enable {
+      environment.etc."postfix-tlspol/config.yaml".source = configFile;
+
+      environment.systemPackages = [ cfg.package ];
+
+      users.users.postfix-tlspol = {
+        isSystemUser = true;
+        group = "postfix-tlspol";
+      };
+      users.groups.postfix-tlspol = { };
+
+      systemd.services.postfix-tlspol = {
+        after = [
+          "nss-lookup.target"
+          "network-online.target"
+        ];
+        wants = [
+          "nss-lookup.target"
+          "network-online.target"
+        ];
+        wantedBy = [ "multi-user.target" ];
+
+        description = "Postfix DANE/MTA-STS TLS policy socketmap service";
+        documentation = [ "https://github.com/Zuplu/postfix-tlspol" ];
+
+        reloadTriggers = [ configFile ];
+
+        # https://github.com/Zuplu/postfix-tlspol/blob/main/init/postfix-tlspol.service
+        serviceConfig = {
+          ExecStart = toString [
+            (lib.getExe cfg.package)
+            "-config"
+            "/etc/postfix-tlspol/config.yaml"
+          ];
+          ExecReload = "${lib.getExe' pkgs.util-linux "kill"} -HUP $MAINPID";
+          Restart = "always";
+          RestartSec = 5;
+
+          User = "postfix-tlspol";
+          Group = "postfix-tlspol";
+
+          CacheDirectory = "postfix-tlspol";
+          CapabilityBoundingSet = [ "" ];
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          NoNewPrivileges = true;
+          PrivateDevices = true;
+          PrivateTmp = true;
+          PrivateUsers = true;
+          ProcSubset = "pid";
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectProc = "invisible";
+          ProtectSystem = "strict";
+          ReadOnlyPaths = [ "/etc/postfix-tlspol/config.yaml" ];
+          RemoveIPC = true;
+          RestrictAddressFamilies =
+            [
+              "AF_INET"
+              "AF_INET6"
+            ]
+            ++ lib.optionals (lib.hasPrefix "unix:" cfg.settings.server.address) [
+              "AF_UNIX"
+            ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [
+            "@system-service"
+            "~@privileged @resources"
+          ];
+          SystemCallErrorNumber = "EPERM";
+          SecureBits = [
+            "noroot"
+            "noroot-locked"
+          ];
+          RuntimeDirectory = "postfix-tlspol";
+          RuntimeDirectoryMode = "1750";
+          WorkingDirectory = "/var/cache/postfix-tlspol";
+          UMask = "0117";
+        };
+      };
+    })
+  ];
 }

nixos/modules/services/misc/gitea.nix

@@ -27,6 +27,9 @@ let
 
     ${optionalString (cfg.extraConfig != null) cfg.extraConfig}
   '';
+
+  inherit (cfg.settings) mailer;
+  useSendmail = mailer.ENABLED && mailer.PROTOCOL == "sendmail";
 in
 
 {
@@ -366,15 +369,6 @@ in
         description = "Path to a file containing the SMTP password.";
       };
 
-      mailerUseSendmail = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Use the operating system's sendmail command instead of SMTP.
-          Note: some sandbox settings will be disabled.
-        '';
-      };
-
       metricsTokenFile = mkOption {
         type = types.nullOr types.str;
         default = null;
@@ -422,120 +416,157 @@ in
             };
           }
         '';
-        type = types.submodule {
-          freeformType = format.type;
-          options = {
-            log = {
-              ROOT_PATH = mkOption {
-                default = "${cfg.stateDir}/log";
-                defaultText = literalExpression ''"''${config.${opt.stateDir}}/log"'';
-                type = types.str;
-                description = "Root path for log files.";
+        type = types.submodule (
+          { config, options, ... }:
+          {
+            freeformType = format.type;
+            options = {
+              log = {
+                ROOT_PATH = mkOption {
+                  default = "${cfg.stateDir}/log";
+                  defaultText = literalExpression ''"''${config.${opt.stateDir}}/log"'';
+                  type = types.str;
+                  description = "Root path for log files.";
+                };
+                LEVEL = mkOption {
+                  default = "Info";
+                  type = types.enum [
+                    "Trace"
+                    "Debug"
+                    "Info"
+                    "Warn"
+                    "Error"
+                    "Critical"
+                  ];
+                  description = "General log level.";
+                };
               };
-              LEVEL = mkOption {
-                default = "Info";
-                type = types.enum [
-                  "Trace"
-                  "Debug"
-                  "Info"
-                  "Warn"
-                  "Error"
-                  "Critical"
-                ];
-                description = "General log level.";
+
+              mailer = {
+                ENABLED = lib.mkOption {
+                  type = lib.types.bool;
+                  default = false;
+                  description = "Whether to use an email service to send notifications.";
+                };
+
+                PROTOCOL = lib.mkOption {
+                  type = lib.types.enum [
+                    null
+                    "smtp"
+                    "smtps"
+                    "smtp+starttls"
+                    "smtp+unix"
+                    "sendmail"
+                    "dummy"
+                  ];
+                  default = null;
+                  description = "Which mail server protocol to use.";
+                };
+
+                SENDMAIL_PATH = lib.mkOption {
+                  type = lib.types.path;
+                  # somewhat duplicated with useSendmail but cannot be deduped because of infinite recursion
+                  default =
+                    if config.mailer.ENABLED && config.mailer.PROTOCOL == "sendmail" then
+                      "/run/wrappers/bin/sendmail"
+                    else
+                      "sendmail";
+                  defaultText = lib.literalExpression ''if config.${options.mailer.ENABLED} && config.${options.mailer.PROTOCOL} == "sendmail" then "/run/wrappers/bin/sendmail" else "sendmail"'';
+                  description = "Path to sendmail binary or script.";
+                };
+              };
+
+              server = {
+                PROTOCOL = mkOption {
+                  type = types.enum [
+                    "http"
+                    "https"
+                    "fcgi"
+                    "http+unix"
+                    "fcgi+unix"
+                  ];
+                  default = "http";
+                  description = ''Listen protocol. `+unix` means "over unix", not "in addition to."'';
+                };
+
+                HTTP_ADDR = mkOption {
+                  type = types.either types.str types.path;
+                  default =
+                    if lib.hasSuffix "+unix" cfg.settings.server.PROTOCOL then "/run/gitea/gitea.sock" else "0.0.0.0";
+                  defaultText = literalExpression ''if lib.hasSuffix "+unix" cfg.settings.server.PROTOCOL then "/run/gitea/gitea.sock" else "0.0.0.0"'';
+                  description = "Listen address. Must be a path when using a unix socket.";
+                };
+
+                HTTP_PORT = mkOption {
+                  type = types.port;
+                  default = 3000;
+                  description = "Listen port. Ignored when using a unix socket.";
+                };
+
+                DOMAIN = mkOption {
+                  type = types.str;
+                  default = "localhost";
+                  description = "Domain name of your server.";
+                };
+
+                ROOT_URL = mkOption {
+                  type = types.str;
+                  default = "http://${cfg.settings.server.DOMAIN}:${toString cfg.settings.server.HTTP_PORT}/";
+                  defaultText = literalExpression ''"http://''${config.services.gitea.settings.server.DOMAIN}:''${toString config.services.gitea.settings.server.HTTP_PORT}/"'';
+                  description = "Full public URL of gitea server.";
+                };
+
+                STATIC_ROOT_PATH = mkOption {
+                  type = types.either types.str types.path;
+                  default = cfg.package.data;
+                  defaultText = literalExpression "config.${opt.package}.data";
+                  example = "/var/lib/gitea/data";
+                  description = "Upper level of template and static files path.";
+                };
+
+                DISABLE_SSH = mkOption {
+                  type = types.bool;
+                  default = false;
+                  description = "Disable external SSH feature.";
+                };
+
+                SSH_PORT = mkOption {
+                  type = types.port;
+                  default = 22;
+                  example = 2222;
+                  description = ''
+                    SSH port displayed in clone URL.
+                    The option is required to configure a service when the external visible port
+                    differs from the local listening port i.e. if port forwarding is used.
+                  '';
+                };
+              };
+
+              service = {
+                DISABLE_REGISTRATION = mkEnableOption "the registration lock" // {
+                  description = ''
+                    By default any user can create an account on this `gitea` instance.
+                    This can be disabled by using this option.
+
+                    *Note:* please keep in mind that this should be added after the initial
+                    deploy as the first registered user will be the administrator.
+                  '';
+                };
+              };
+
+              session = {
+                COOKIE_SECURE = mkOption {
+                  type = types.bool;
+                  default = false;
+                  description = ''
+                    Marks session cookies as "secure" as a hint for browsers to only send
+                    them via HTTPS. This option is recommend, if gitea is being served over HTTPS.
+                  '';
+                };
               };
             };
-
-            server = {
-              PROTOCOL = mkOption {
-                type = types.enum [
-                  "http"
-                  "https"
-                  "fcgi"
-                  "http+unix"
-                  "fcgi+unix"
-                ];
-                default = "http";
-                description = ''Listen protocol. `+unix` means "over unix", not "in addition to."'';
-              };
-
-              HTTP_ADDR = mkOption {
-                type = types.either types.str types.path;
-                default =
-                  if lib.hasSuffix "+unix" cfg.settings.server.PROTOCOL then "/run/gitea/gitea.sock" else "0.0.0.0";
-                defaultText = literalExpression ''if lib.hasSuffix "+unix" cfg.settings.server.PROTOCOL then "/run/gitea/gitea.sock" else "0.0.0.0"'';
-                description = "Listen address. Must be a path when using a unix socket.";
-              };
-
-              HTTP_PORT = mkOption {
-                type = types.port;
-                default = 3000;
-                description = "Listen port. Ignored when using a unix socket.";
-              };
-
-              DOMAIN = mkOption {
-                type = types.str;
-                default = "localhost";
-                description = "Domain name of your server.";
-              };
-
-              ROOT_URL = mkOption {
-                type = types.str;
-                default = "http://${cfg.settings.server.DOMAIN}:${toString cfg.settings.server.HTTP_PORT}/";
-                defaultText = literalExpression ''"http://''${config.services.gitea.settings.server.DOMAIN}:''${toString config.services.gitea.settings.server.HTTP_PORT}/"'';
-                description = "Full public URL of gitea server.";
-              };
-
-              STATIC_ROOT_PATH = mkOption {
-                type = types.either types.str types.path;
-                default = cfg.package.data;
-                defaultText = literalExpression "config.${opt.package}.data";
-                example = "/var/lib/gitea/data";
-                description = "Upper level of template and static files path.";
-              };
-
-              DISABLE_SSH = mkOption {
-                type = types.bool;
-                default = false;
-                description = "Disable external SSH feature.";
-              };
-
-              SSH_PORT = mkOption {
-                type = types.port;
-                default = 22;
-                example = 2222;
-                description = ''
-                  SSH port displayed in clone URL.
-                  The option is required to configure a service when the external visible port
-                  differs from the local listening port i.e. if port forwarding is used.
-                '';
-              };
-            };
-
-            service = {
-              DISABLE_REGISTRATION = mkEnableOption "the registration lock" // {
-                description = ''
-                  By default any user can create an account on this `gitea` instance.
-                  This can be disabled by using this option.
-
-                  *Note:* please keep in mind that this should be added after the initial
-                  deploy as the first registered user will be the administrator.
-                '';
-              };
-            };
-
-            session = {
-              COOKIE_SECURE = mkOption {
-                type = types.bool;
-                default = false;
-                description = ''
-                  Marks session cookies as "secure" as a hint for browsers to only send
-                  them via HTTPS. This option is recommend, if gitea is being served over HTTPS.
-                '';
-              };
-            };
-          };
-        };
+          }
+        );
       };
 
       extraConfig = mkOption {
@@ -663,15 +694,9 @@ in
           })
         ]);
 
-        mailer = mkMerge [
-          (mkIf (cfg.mailerPasswordFile != null) {
-            PASSWD = "#mailerpass#";
-          })
-          (mkIf cfg.mailerUseSendmail {
-            PROTOCOL = "sendmail";
-            SENDMAIL_PATH = "/run/wrappers/bin/sendmail";
-          })
-        ];
+        mailer = mkIf (cfg.mailerPasswordFile != null) {
+          PASSWD = "#mailerpass#";
+        };
 
         metrics = mkIf (cfg.metricsTokenFile != null) {
           TOKEN = "#metricstoken#";
@@ -884,18 +909,18 @@ in
           cfg.repositoryRoot
           cfg.stateDir
           cfg.lfs.contentDir
-        ] ++ optional cfg.mailerUseSendmail "/var/lib/postfix/queue/maildrop";
+        ] ++ lib.optional (useSendmail && config.services.postfix.enable) "/var/lib/postfix/queue/maildrop";
         UMask = "0027";
         # Capabilities
         CapabilityBoundingSet = "";
         # Security
-        NoNewPrivileges = optional (!cfg.mailerUseSendmail) true;
+        NoNewPrivileges = !useSendmail;
         # Sandboxing
         ProtectSystem = "strict";
         ProtectHome = true;
         PrivateTmp = true;
         PrivateDevices = true;
-        PrivateUsers = optional (!cfg.mailerUseSendmail) true;
+        PrivateUsers = !useSendmail;
         ProtectHostname = true;
         ProtectClock = true;
         ProtectKernelTunables = true;
@@ -906,7 +931,7 @@ in
           "AF_UNIX"
           "AF_INET"
           "AF_INET6"
-        ] ++ optional cfg.mailerUseSendmail "AF_NETLINK";
+        ] ++ lib.optional (useSendmail && config.services.postfix.enable) "AF_NETLINK";
         RestrictNamespaces = true;
         LockPersonality = true;
         MemoryDenyWriteExecute = true;
@@ -916,10 +941,14 @@ in
         PrivateMounts = true;
         # System Call Filtering
         SystemCallArchitectures = "native";
-        SystemCallFilter = [
-          "~@cpu-emulation @debug @keyring @mount @obsolete @setuid"
-          "setrlimit"
-        ] ++ optional (!cfg.mailerUseSendmail) "~@privileged";
+        SystemCallFilter =
+          [
+            "~@cpu-emulation @debug @keyring @mount @obsolete @setuid"
+            "setrlimit"
+          ]
+          ++ lib.optionals (!useSendmail) [
+            "~@privileged"
+          ];
       };
 
       environment = {
@@ -997,7 +1026,6 @@ in
   };
 
   meta.maintainers = with lib.maintainers; [
-    ma27
     techknowlogick
     SuperSandro2000
   ];

nixos/modules/services/web-servers/garage.md

@@ -7,9 +7,6 @@ The server setup can be automated using
  client configured to your local Garage instance is available in
  the global environment as `garage-manage`.
 
-The current default by NixOS is `garage_0_8` which is also the latest
-major version available.
-
 ## General considerations on upgrades {#module-services-garage-upgrade-scenarios}
 
 Garage provides a cookbook documentation on how to upgrade:
@@ -21,20 +18,14 @@ Garage has two types of upgrades: patch-level upgrades and minor/major version u
 In all cases, you should read the changelog and ideally test the upgrade on a staging cluster.
 
 Checking the health of your cluster can be achieved using `garage-manage repair`.
-:::
-
-::: {.warning}
-Until 1.0 is released, patch-level upgrades are considered as minor version upgrades.
-Minor version upgrades are considered as major version upgrades.
-i.e. 0.6 to 0.7 is a major version upgrade.
 :::
 
   - **Straightforward upgrades (patch-level upgrades).**
     Upgrades must be performed one by one, i.e. for each node, stop it, upgrade it : change [stateVersion](#opt-system.stateVersion) or [services.garage.package](#opt-services.garage.package), restart it if it was not already by switching.
   - **Multiple version upgrades.**
     Garage do not provide any guarantee on moving more than one major-version forward.
-    E.g., if you're on `0.7`, you cannot upgrade to `0.9`.
-    You need to upgrade to `0.8` first.
+    E.g., if you're on `0.9`, you cannot upgrade to `2.0`.
+    You need to upgrade to `1.2` first.
     As long as [stateVersion](#opt-system.stateVersion) is declared properly,
     this is enforced automatically. The module will issue a warning to remind the user to upgrade to latest
     Garage *after* that deploy.
@@ -51,7 +42,7 @@ Here are some baseline instructions to handle advanced upgrades in Garage, when
   - Run `systemctl stop garage` to stop the actual Garage version.
   - Backup the metadata folder of ALL your nodes, e.g. for a metadata directory (the default one) in `/var/lib/garage/meta`,
     you can run `pushd /var/lib/garage; tar -acf meta-v0.7.tar.zst meta/; popd`.
-  - Run the offline migration: `nix-shell -p garage_0_8 --run "garage offline-repair --yes"`, this can take some time depending on how many objects are stored in your cluster.
+  - Run the offline migration: `nix-shell -p garage_1 --run "garage offline-repair --yes"`, this can take some time depending on how many objects are stored in your cluster.
   - Bump Garage version in your NixOS configuration, either by changing [stateVersion](#opt-system.stateVersion) or bumping [services.garage.package](#opt-services.garage.package), this should restart Garage automatically.
   - Perform `garage-manage repair --all-nodes --yes tables` and `garage-manage repair --all-nodes --yes blocks`.
   - Wait for a full table sync to run.
@@ -67,8 +58,8 @@ This is inspired from how Nextcloud does it.
 
 While patch-level updates are no problem and can be done directly in the
 package-expression (and should be backported to supported stable branches after that),
-major-releases should be added in a new attribute (e.g. Garage `v0.8.0`
-should be available in `nixpkgs` as `pkgs.garage_0_8_0`).
+major-releases should be added in a new attribute (e.g. Garage `v3.0.0`
+should be available in `nixpkgs` as `pkgs.garage_3`).
 To provide simple upgrade paths it's generally useful to backport those as well to stable
 branches. As long as the package-default isn't altered, this won't break existing setups.
 After that, the versioning-warning in the `garage`-module should be
@@ -83,8 +74,8 @@ packages, but mark them as insecure in an expression like this (in
 ```nix
 /* ... */
 {
-  garage_0_7_3 = generic {
-    version = "0.7.3";
+  garage_1_2_0 = generic {
+    version = "1.2.0";
     sha256 = "0000000000000000000000000000000000000000000000000000";
     eol = true;
   };

nixos/tests/postfix-tlspol.nix

@@ -8,15 +8,20 @@
   meta.maintainers = with lib.maintainers; [ hexa ];
 
   nodes.machine = {
+    services.postfix.enable = true;
     services.postfix-tlspol.enable = true;
-  };
 
-  enableOCR = true;
+    services.dnsmasq = {
+      enable = true;
+      settings.selfmx = true;
+    };
+  };
 
   testScript = ''
     import json
 
     machine.wait_for_unit("postfix-tlspol.service")
+    machine.succeed("getent group postfix-tlspol | grep :postfix")
 
     with subtest("Interact with the service"):
       machine.succeed("postfix-tlspol -purge")
@@ -24,6 +29,10 @@
       response = json.loads((machine.succeed("postfix-tlspol -query localhost")))
       machine.log(json.dumps(response, indent=2))
 
+      assert response["dane"]["policy"] == "", f"Unexpected DANE policy for localhost: {response["dane"]["policy"]}"
+      assert response["mta-sts"]["policy"] == "", f"Unexpected MTA-STS policy for localhost: {response["mta-sts"]["policy"]}"
+
+    machine.log(machine.execute("systemd-analyze security postfix-tlspol.service | grep -v ✓")[1])
   '';
 
 }

pkgs/applications/editors/neovim/tests/default.nix

@@ -260,6 +260,21 @@ pkgs.recurseIntoAttrs (rec {
     [ "$result" = 0 ]
   '';
 
+  # Generate a neovim wrapper with only a init.lua and no init.vim file
+  nvim_with_only_init_lua = wrapNeovim2 "-only-lua-init-file" {
+    luaRcContent = "-- some text";
+  };
+
+  # check that we do not generate an init.vim file if it is not needed
+  no_init_vim_file = runTest nvim_with_only_init_lua ''
+    ${nvim_with_only_init_lua}/bin/nvim -i NONE -e --headless -c 'if len(getscriptinfo({"name":"init.vim"})) == 0 | quit | else | cquit | fi'
+    # This does now work because the lua file is sourced via loadfile() which
+    # does not add the file name to :scriptnames and getscriptinfo().
+    #${nvim_with_only_init_lua}/bin/nvim -i NONE -e --headless -c 'if len(getscriptinfo({"name":"init.lua"})) == 1 | quit | else | cquit | fi'
+
+    assertFileRegex ${nvim_with_only_init_lua}/bin/nvim 'VIMINIT=.*init.lua'
+  '';
+
   # check that the vim-doc hook correctly generates the tag
   # we know for a fact packer has a doc folder
   checkForTags = vimPlugins.packer-nvim.overrideAttrs (oldAttrs: {

pkgs/applications/editors/neovim/wrapper.nix

@@ -119,7 +119,7 @@ let
           ''
             ${luaRcContent}
           ''
-          + lib.optionalString (neovimRcContent' != null) ''
+          + lib.optionalString (neovimRcContent' != "") ''
             vim.cmd.source "${writeText "init.vim" neovimRcContent'}"
           ''
           + lib.concatStringsSep "\n" luaPluginRC;

pkgs/applications/emulators/libretro/cores/beetle-saturn.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-saturn";
-  version = "0-unstable-2025-03-16";
+  version = "0-unstable-2025-06-22";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-saturn-libretro";
-    rev = "06c9daa7ff6de42955437d29a80d8fc4ececc8d3";
-    hash = "sha256-HTOT4/NmfcVjte61FjkqL9neKVQrH7P4dZjmIC9fy0k=";
+    rev = "e6c4275f1bc93163a35db30cbd5399c046cf112d";
+    hash = "sha256-CnjBf/dWkbzwhvsnmYAJFC254mQ7+QkcLu4GavZhg5s=";
   };
 
   makefile = "Makefile";

pkgs/applications/networking/sync/rclone/default.nix

@@ -17,7 +17,7 @@
 
 buildGoModule rec {
   pname = "rclone";
-  version = "1.70.1";
+  version = "1.70.2";
 
   outputs = [
     "out"
@@ -28,10 +28,10 @@ buildGoModule rec {
     owner = "rclone";
     repo = "rclone";
     tag = "v${version}";
-    hash = "sha256-lfBwVRYqMjmSQBq3D20G8TfxnTUTspPM3x88UAqReVE=";
+    hash = "sha256-XQGrXa2sXY+vjyQJnDAEGYp8n7/nGD2ZJFkTN0k4keg=";
   };
 
-  vendorHash = "sha256-9yEWEM96cRUzp1mRXEzxvOaBZQsf7Zifoe163OtJCPw=";
+  vendorHash = "sha256-/A9Sq7KlHitqHxvElVMQtuXUWhweiB0ukut7AJYaJHw=";
 
   subPackages = [ "." ];
 

pkgs/applications/video/kodi/addons/formula1/default.nix

@@ -10,11 +10,11 @@
 buildKodiAddon rec {
   pname = "formula1";
   namespace = "plugin.video.formula1";
-  version = "2.0.4";
+  version = "2.0.5";
 
   src = fetchzip {
     url = "https://mirrors.kodi.tv/addons/${lib.toLower rel}/${namespace}/${namespace}-${version}.zip";
-    sha256 = "sha256-tyVq/yfnPQ5NAnlYCT8lF/s2voh4NOQPRawXX1+ryTU=";
+    sha256 = "sha256-zOEf1CXywEqUpBhan03xjVQ3Rjp3h08X2OgQ4GAjwJQ=";
   };
 
   propagatedBuildInputs = [

pkgs/applications/video/kodi/addons/inputstream-ffmpegdirect/default.nix

@@ -11,13 +11,13 @@
 buildKodiBinaryAddon rec {
   pname = "inputstream-ffmpegdirect";
   namespace = "inputstream.ffmpegdirect";
-  version = "21.3.7";
+  version = "21.3.8";
 
   src = fetchFromGitHub {
     owner = "xbmc";
     repo = "inputstream.ffmpegdirect";
     rev = "${version}-${rel}";
-    sha256 = "sha256-s1Owbj95DT+RR8eBRwMuUHrJwr6JR05efx5M11vH8cQ=";
+    sha256 = "sha256-IgCSEJzu3a2un7FdiZCEVs/boxvIhSNleTPpOCljCZo=";
   };
 
   extraBuildInputs = [

pkgs/applications/video/kodi/addons/sendtokodi/default.nix

@@ -4,42 +4,41 @@
   fetchFromGitHub,
   kodi,
   inputstreamhelper,
+  requests,
 }:
 
 buildKodiAddon rec {
   pname = "sendtokodi";
   namespace = "plugin.video.sendtokodi";
-  version = "0.9.557";
+  version = "0.9.924";
 
   src = fetchFromGitHub {
     owner = "firsttris";
     repo = "plugin.video.sendtokodi";
-    rev = "v${version}";
-    hash = "sha256-Ga+9Q7x8+sEmQmteHbSyCahZ/T/l28BAEM84w7bf7z8=";
+    tag = "v${version}";
+    hash = "sha256-ycp5/NbRX2rcRRpbpX6LlplyxdfoIwCw39EyQDcyzOU=";
   };
 
   patches = [
-    # Unconditionally depend on packaged yt-dlp. This removes the ability to
-    # use youtube_dl, which is unmaintained and considered vulnerable (see
-    # CVE-2024-38519).
-    ./use-packaged-yt-dlp.patch
+    # Use yt-dlp, only. This removes the ability to use youtube_dl, which is
+    # unmaintained and considered vulnerable (see CVE-2024-38519).
+    ./use-yt-dlp-only.patch
   ];
 
   propagatedBuildInputs = [
     inputstreamhelper
+    requests
   ];
 
   postPatch = ''
-    # Remove vendored youtube-dl and yt-dlp libraries.
-    rm -r lib/
+    # Remove youtube-dl, which is unmaintained and vulnerable.
+    rm -r lib/youtube_dl lib/youtube_dl_version
+    # Replace yt-dlp with our own packaged version thereof.
+    rm -r lib/yt_dlp
+    echo "${lib.strings.getVersion kodi.pythonPackages.yt-dlp}" >lib/yt_dlp_version
+    ln -s ${kodi.pythonPackages.yt-dlp}/${kodi.pythonPackages.python.sitePackages}/yt_dlp lib/
   '';
 
-  passthru = {
-    # Instead of the vendored libraries, we propagate yt-dlp via the Python
-    # path.
-    pythonPath = with kodi.pythonPackages; makePythonPath [ yt-dlp ];
-  };
-
   meta = with lib; {
     homepage = "https://github.com/firsttris/plugin.video.sendtokodi";
     description = "Plays various stream sites on Kodi using yt-dlp";

pkgs/applications/video/kodi/addons/sendtokodi/use-yt-dlp-only.patch

@@ -1,18 +1,18 @@
 diff --git a/service.py b/service.py
-index 024ad9a..6ef71dd 100644
+index 5d588682..99123b4b 100644
 --- a/service.py
 +++ b/service.py
-@@ -243,11 +243,8 @@ def playlistIndex(url, playlist):
+@@ -323,12 +323,7 @@ if not sys.argv[2]:
+     xbmcaddon.Addon().openSettings()
+     exit()
  
- 
- # Use the chosen resolver while forcing to use youtube_dl on legacy python 2 systems (dlp is python 3.6+)
+-# Use the chosen resolver while forcing to use youtube_dl on legacy python 2 systems (dlp is python 3.6+)
 -if xbmcplugin.getSetting(int(sys.argv[1]),"resolver") == "0" or sys.version_info[0] == 2:
--    from lib.youtube_dl import YoutubeDL
+-    from youtube_dl import YoutubeDL
 -else:
--    from lib.yt_dlp import YoutubeDL
--    
+-   # import lib.yt_dlp as yt_dlp
+-    from yt_dlp import YoutubeDL
 +from yt_dlp import YoutubeDL
-+
+ 
  # patch broken strptime (see above)
  patch_strptime()
- 

pkgs/applications/window-managers/dwm/default.nix

@@ -6,6 +6,7 @@
   libXinerama,
   libXft,
   writeText,
+  pkg-config,
   patches ? [ ],
   conf ? null,
   # update script dependencies
@@ -21,6 +22,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-Ideev6ny+5MUGDbCZmy4H0eExp1k5/GyNS+blwuglyk=";
   };
 
+  nativeBuildInputs = lib.optional stdenv.hostPlatform.isStatic pkg-config;
+
   buildInputs = [
     libX11
     libXinerama
@@ -31,6 +34,10 @@ stdenv.mkDerivation rec {
     sed -i "s@/usr/local@$out@" config.mk
   '';
 
+  preBuild = lib.optional stdenv.hostPlatform.isStatic ''
+    makeFlagsArray+=(LDFLAGS="$(${stdenv.cc.targetPrefix}pkg-config --static --libs x11 xinerama xft)")
+  '';
+
   # Allow users set their own list of patches
   inherit patches;
 

pkgs/by-name/ad/adguardhome/package.nix

@@ -4,22 +4,23 @@
   buildGoModule,
   buildNpmPackage,
   nixosTests,
+  testers,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "adguardhome";
-  version = "0.107.62";
+  version = "0.107.63";
   src = fetchFromGitHub {
     owner = "AdguardTeam";
     repo = "AdGuardHome";
-    tag = "v${version}";
-    hash = "sha256-CqXf19DyDFgSnd/dziUq9Gl1d1V20OWE5MTQMi260Zc=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-yu+rw1is5Egs1O2mww8MGe48Cl74j7RULm4FB2JhQN4=";
   };
 
-  vendorHash = "sha256-lY24TtW4vpMRUzOZmeX3Ip9ikUc4z1HG49DpeECExdk=";
+  vendorHash = "sha256-9w2P3kNSf8I6tGq3K0ULoV+qeq3rUzrevDC+mktfsis=";
 
   dashboard = buildNpmPackage {
-    inherit src;
+    inherit (finalAttrs) src;
     name = "dashboard";
     postPatch = ''
       cd client
@@ -33,25 +34,34 @@ buildGoModule rec {
   };
 
   preBuild = ''
-    cp -r ${dashboard}/build/static build
+    cp -r ${finalAttrs.dashboard}/build/static build
   '';
 
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/AdguardTeam/AdGuardHome/internal/version.version=${finalAttrs.version}"
+  ];
+
   passthru = {
     updateScript = ./update.sh;
     schema_version = 29;
     tests.adguardhome = nixosTests.adguardhome;
+    tests.version = testers.testVersion {
+      package = finalAttrs.finalPackage;
+    };
   };
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/AdguardTeam/AdGuardHome";
     description = "Network-wide ads & trackers blocking DNS server";
-    maintainers = with maintainers; [
+    maintainers = with lib.maintainers; [
       numkem
       iagoq
       rhoriguchi
       baksa
     ];
-    license = licenses.gpl3Only;
+    license = lib.licenses.gpl3Only;
     mainProgram = "AdGuardHome";
   };
-}
+})

pkgs/by-name/ag/agate/package.nix

@@ -1,41 +1,38 @@
 {
   lib,
-  stdenv,
-  nixosTests,
   fetchFromGitHub,
   rustPlatform,
-  openssl,
+
   pkg-config,
+  openssl,
+
+  versionCheckHook,
+
   nix-update-script,
+  nixosTests,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "agate";
-  version = "3.3.16";
+  version = "3.3.17";
+
+  __darwinAllowLocalNetworking = true;
 
   src = fetchFromGitHub {
     owner = "mbrubeck";
     repo = "agate";
-    tag = "v${version}";
-    hash = "sha256-TLLmoQXrvgDskmH9sKxUi5AqYrCR0ZaJJdbOV03IbMc=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-zT56JGP2SfOqLL/sLxo3PHnbAvLI+lifmCvLdPwzCZM=";
   };
 
-  useFetchCargoVendor = true;
-  cargoHash = "sha256-HA1h06ZlWvq7z5hJFqKxGtXNk8/GHxUivigaVqWQCvA=";
+  cargoHash = "sha256-vemmO7xYf83rBNEvJKaq5CjobG1LUxt7M5zeQegTUmM=";
 
   nativeBuildInputs = [ pkg-config ];
-
   buildInputs = [ openssl ];
 
-  doInstallCheck = true;
-  installCheckPhase = ''
-    runHook preInstallCheck
-    $out/bin/agate --help
-    $out/bin/agate --version 2>&1 | grep "agate ${version}"
-    runHook postInstallCheck
-  '';
+  nativeInstallCheckInputs = [ versionCheckHook ];
 
-  __darwinAllowLocalNetworking = true;
+  doInstallCheck = true;
 
   passthru = {
     tests = {
@@ -46,7 +43,7 @@ rustPlatform.buildRustPackage rec {
 
   meta = {
     homepage = "https://github.com/mbrubeck/agate";
-    changelog = "https://github.com/mbrubeck/agate/releases/tag/v${version}";
+    changelog = "https://github.com/mbrubeck/agate/releases/tag/v${finalAttrs.version}";
     description = "Very simple server for the Gemini hypertext protocol";
     mainProgram = "agate";
     longDescription = ''
@@ -57,8 +54,9 @@ rustPlatform.buildRustPackage rec {
     '';
     license = with lib.licenses; [
       asl20
+      # or
       mit
     ];
     maintainers = with lib.maintainers; [ jk ];
   };
-}
+})

pkgs/by-name/al/alertmanager-ntfy/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule {
   pname = "alertmanager-ntfy";
-  version = "0-unstable-2025-05-31";
+  version = "0-unstable-2025-06-27";
 
   src = fetchFromGitHub {
     owner = "alexbakker";
     repo = "alertmanager-ntfy";
-    rev = "76d5f772f70d6915c89da00414c20009b03cc361";
-    hash = "sha256-newJ1fCMEE3gsZncWU899Q6cS6llPNwJlHT7HdLQZf8=";
+    rev = "dc4ef93f7db7f046a775ef3e4a2a462b2afcec6c";
+    hash = "sha256-J+T3Mt+40vhL3DVBKKH86l45AKSlkT7h+TrfhsWwMac=";
   };
 
   vendorHash = "sha256-e1JAoDNm2+xB/bZcEGr5l4+va8GIg1R8pdj3d+/Y+UY=";

pkgs/by-name/al/aliyun-cli/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "aliyun-cli";
-  version = "3.0.284";
+  version = "3.0.285";
 
   src = fetchFromGitHub {
     owner = "aliyun";
     repo = "aliyun-cli";
     tag = "v${version}";
-    hash = "sha256-NIj5lTvqHtfaORhdAFrt3KBAh1r0YTiWFe3jXYAF19E=";
+    hash = "sha256-BDhIlVuFRLxre5m7gUb0PVCZSYVAgA76pYySHznEsWg=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/as/ast-grep/package.nix

@@ -11,13 +11,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ast-grep";
-  version = "0.38.5";
+  version = "0.38.6";
 
   src = fetchFromGitHub {
     owner = "ast-grep";
     repo = "ast-grep";
     tag = finalAttrs.version;
-    hash = "sha256-yI3uAdP7x1zYMtRz4ppG4ySH/xmfQlnUlmJKoN/6Cw4=";
+    hash = "sha256-bgJzu7n/Qy0JAJ19VRXCvMtZBM/wZkQKT9AAXvIg5Ms=";
   };
 
   # error: linker `aarch64-linux-gnu-gcc` not found
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   '';
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Idd/vrnj6XJYahmmHgGWPoMCmH7hkJFeWhV8YEo41rM=";
+  cargoHash = "sha256-TVPI3394elxDzn/8S4hDkVounWI6bo6vpZeYJJzDOr4=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/bi/bindfs/package.nix

@@ -2,21 +2,36 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
+  autoreconfHook,
   pkg-config,
   fuse,
   fuse3,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "1.17.7";
+  version = "1.18.1";
   pname = "bindfs";
 
   src = fetchurl {
     url = "https://bindfs.org/downloads/bindfs-${finalAttrs.version}.tar.gz";
-    hash = "sha256-wLBg6Uw6IxodSqC88mb/GJmBpO845C++IylqfYFxm3o=";
+    hash = "sha256-KnBk2ZOl8lXFLXI4XvFONJwTG8RBlXZuIXNCjgbSef0=";
   };
 
+  patches = [
+    # This commit fixes macfuse support but breaks fuse support
+    # The condition to include `uint32_t position` in bindfs_setxattr and bindfs_getxattr
+    # is wrong, leading to -Wincompatible-function-pointer-types
+    # https://github.com/mpartel/bindfs/issues/169
+    (fetchpatch {
+      url = "https://github.com/mpartel/bindfs/commit/3293dc98e37eed0fb0cbfcbd40434d3c37c69480.patch";
+      hash = "sha256-dtjvSJTS81R+sksl7n1QiyssseMQXPlm+LJYZ8/CESQ=";
+      revert = true;
+    })
+  ];
+
   nativeBuildInputs = [
+    autoreconfHook
     pkg-config
   ];
 

pkgs/by-name/bi/bitwarden-desktop/fix-lock-files.diff

@@ -0,0 +1,282 @@
+diff --git a/apps/cli/package.json b/apps/cli/package.json
+index 2ec4e6f697..db5981b5ec 100644
+--- a/apps/cli/package.json
++++ b/apps/cli/package.json
+@@ -85,7 +85,7 @@
+     "multer": "1.4.5-lts.2",
+     "node-fetch": "2.6.12",
+     "node-forge": "1.3.1",
+-    "open": "10.1.2",
++    "open": "8.4.2",
+     "papaparse": "5.5.3",
+     "proper-lockfile": "4.1.2",
+     "rxjs": "7.8.1",
+diff --git a/apps/desktop/desktop_native/Cargo.lock b/apps/desktop/desktop_native/Cargo.lock
+index 05663ea7e0..eadd75e598 100644
+--- a/apps/desktop/desktop_native/Cargo.lock
++++ b/apps/desktop/desktop_native/Cargo.lock
+@@ -162,7 +162,7 @@ dependencies = [
+  "serde_repr",
+  "tokio",
+  "url",
+- "zbus 5.6.0",
++ "zbus",
+ ]
+ 
+ [[package]]
+@@ -900,7 +900,7 @@ dependencies = [
+  "widestring",
+  "windows 0.61.1",
+  "windows-future",
+- "zbus 4.4.0",
++ "zbus",
+  "zbus_polkit",
+  "zeroizing-alloc",
+ ]
+@@ -2063,10 +2063,10 @@ dependencies = [
+  "sha2",
+  "subtle",
+  "tokio",
+- "zbus 5.6.0",
+- "zbus_macros 5.6.0",
++ "zbus",
++ "zbus_macros",
+  "zeroize",
+- "zvariant 5.5.1",
++ "zvariant",
+ ]
+ 
+ [[package]]
+@@ -2715,17 +2715,6 @@ dependencies = [
+  "syn",
+ ]
+ 
+-[[package]]
+-name = "sha1"
+-version = "0.10.6"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
+-dependencies = [
+- "cfg-if",
+- "cpufeatures",
+- "digest",
+-]
+-
+ [[package]]
+ name = "sha2"
+ version = "0.10.8"
+@@ -3921,9 +3910,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "zbus"
+-version = "4.4.0"
++version = "5.5.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "bb97012beadd29e654708a0fdb4c84bc046f537aecfde2c3ee0a9e4b4d48c725"
++checksum = "59c333f648ea1b647bc95dc1d34807c8e25ed7a6feff3394034dc4776054b236"
+ dependencies = [
+  "async-broadcast",
+  "async-executor",
+@@ -3938,90 +3927,37 @@ dependencies = [
+  "enumflags2",
+  "event-listener",
+  "futures-core",
+- "futures-sink",
+- "futures-util",
+- "hex",
+- "nix",
+- "ordered-stream",
+- "rand 0.8.5",
+- "serde",
+- "serde_repr",
+- "sha1",
+- "static_assertions",
+- "tracing",
+- "uds_windows",
+- "windows-sys 0.52.0",
+- "xdg-home",
+- "zbus_macros 4.4.0",
+- "zbus_names 3.0.0",
+- "zvariant 4.2.0",
+-]
+-
+-[[package]]
+-name = "zbus"
+-version = "5.6.0"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "2522b82023923eecb0b366da727ec883ace092e7887b61d3da5139f26b44da58"
+-dependencies = [
+- "async-broadcast",
+- "async-recursion",
+- "async-trait",
+- "enumflags2",
+- "event-listener",
+- "futures-core",
+  "futures-lite",
+  "hex",
+  "nix",
+  "ordered-stream",
+  "serde",
+  "serde_repr",
++ "static_assertions",
+  "tokio",
+  "tracing",
+  "uds_windows",
+  "windows-sys 0.59.0",
+  "winnow",
+- "zbus_macros 5.6.0",
+- "zbus_names 4.2.0",
+- "zvariant 5.5.1",
++ "xdg-home",
++ "zbus_macros",
++ "zbus_names",
++ "zvariant",
+ ]
+ 
+ [[package]]
+ name = "zbus_macros"
+-version = "4.4.0"
++version = "5.5.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "267db9407081e90bbfa46d841d3cbc60f59c0351838c4bc65199ecd79ab1983e"
++checksum = "f325ad10eb0d0a3eb060203494c3b7ec3162a01a59db75d2deee100339709fc0"
+ dependencies = [
+  "proc-macro-crate",
+  "proc-macro2",
+  "quote",
+  "syn",
+- "zvariant_utils 2.1.0",
+-]
+-
+-[[package]]
+-name = "zbus_macros"
+-version = "5.6.0"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "05d2e12843c75108c00c618c2e8ef9675b50b6ec095b36dc965f2e5aed463c15"
+-dependencies = [
+- "proc-macro-crate",
+- "proc-macro2",
+- "quote",
+- "syn",
+- "zbus_names 4.2.0",
+- "zvariant 5.5.1",
+- "zvariant_utils 3.2.0",
+-]
+-
+-[[package]]
+-name = "zbus_names"
+-version = "3.0.0"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "4b9b1fef7d021261cc16cba64c351d291b715febe0fa10dc3a443ac5a5022e6c"
+-dependencies = [
+- "serde",
+- "static_assertions",
+- "zvariant 4.2.0",
++ "zbus_names",
++ "zvariant",
++ "zvariant_utils",
+ ]
+ 
+ [[package]]
+@@ -4033,20 +3969,20 @@ dependencies = [
+  "serde",
+  "static_assertions",
+  "winnow",
+- "zvariant 5.5.1",
++ "zvariant",
+ ]
+ 
+ [[package]]
+ name = "zbus_polkit"
+-version = "4.0.0"
++version = "5.0.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "00a29bfa927b29f91b7feb4e1990f2dd1b4604072f493dc2f074cf59e4e0ba90"
++checksum = "ad23d5c4d198c7e2641b33e6e0d1f866f117408ba66fe80bbe52e289eeb77c52"
+ dependencies = [
+  "enumflags2",
+  "serde",
+  "serde_repr",
+  "static_assertions",
+- "zbus 4.4.0",
++ "zbus",
+ ]
+ 
+ [[package]]
+@@ -4149,19 +4085,6 @@ dependencies = [
+  "syn",
+ ]
+ 
+-[[package]]
+-name = "zvariant"
+-version = "4.2.0"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "2084290ab9a1c471c38fc524945837734fbf124487e105daec2bb57fd48c81fe"
+-dependencies = [
+- "endi",
+- "enumflags2",
+- "serde",
+- "static_assertions",
+- "zvariant_derive 4.2.0",
+-]
+-
+ [[package]]
+ name = "zvariant"
+ version = "5.5.1"
+@@ -4173,21 +4096,8 @@ dependencies = [
+  "serde",
+  "url",
+  "winnow",
+- "zvariant_derive 5.5.1",
+- "zvariant_utils 3.2.0",
+-]
+-
+-[[package]]
+-name = "zvariant_derive"
+-version = "4.2.0"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "73e2ba546bda683a90652bac4a279bc146adad1386f25379cf73200d2002c449"
+-dependencies = [
+- "proc-macro-crate",
+- "proc-macro2",
+- "quote",
+- "syn",
+- "zvariant_utils 2.1.0",
++ "zvariant_derive",
++ "zvariant_utils",
+ ]
+ 
+ [[package]]
+@@ -4200,18 +4110,7 @@ dependencies = [
+  "proc-macro2",
+  "quote",
+  "syn",
+- "zvariant_utils 3.2.0",
+-]
+-
+-[[package]]
+-name = "zvariant_utils"
+-version = "2.1.0"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "c51bcff7cc3dbb5055396bcf774748c3dab426b4b8659046963523cee4808340"
+-dependencies = [
+- "proc-macro2",
+- "quote",
+- "syn",
++ "zvariant_utils",
+ ]
+ 
+ [[package]]
+diff --git a/package-lock.json b/package-lock.json
+index 5df63a79dd..702b6d1c81 100644
+--- a/package-lock.json
++++ b/package-lock.json
+@@ -225,7 +225,7 @@
+         "multer": "1.4.5-lts.2",
+         "node-fetch": "2.6.12",
+         "node-forge": "1.3.1",
+-        "open": "10.1.2",
++        "open": "8.4.2",
+         "papaparse": "5.5.3",
+         "proper-lockfile": "4.1.2",
+         "rxjs": "7.8.1",

pkgs/by-name/bi/bitwarden-desktop/package.nix

@@ -5,7 +5,7 @@
   cargo,
   copyDesktopItems,
   darwin,
-  electron_34,
+  electron_36,
   fetchFromGitHub,
   gnome-keyring,
   jq,
@@ -25,7 +25,7 @@
 let
   description = "Secure and free password manager for all of your devices";
   icon = "bitwarden";
-  electron = electron_34;
+  electron = electron_36;
 
   # argon2 npm dependency is using `std::basic_string<uint8_t>`, which is no longer allowed in LLVM 19
   buildNpmPackage' = buildNpmPackage.override {
@@ -34,21 +34,27 @@ let
 in
 buildNpmPackage' rec {
   pname = "bitwarden-desktop";
-  version = "2025.5.1";
+  version = "2025.6.0";
 
   src = fetchFromGitHub {
     owner = "bitwarden";
     repo = "clients";
     rev = "desktop-v${version}";
-    hash = "sha256-1gxd73E7Y7e1A6yU+J3XYQ4QzXZTxuKd+AE+t8HD478=";
+    hash = "sha256-KI6oIMNtqfywVqeTdzthSHBnAlF55cINTr04LNSq0AM=";
   };
 
   patches = [
     ./electron-builder-package-lock.patch
     ./dont-auto-setup-biometrics.patch
-    ./set-exe-path.patch # ensures `app.getPath("exe")` returns our wrapper, not ${electron}/bin/electron
-    ./skip-afterpack-and-aftersign.patch # on linux: don't flip fuses, don't create wrapper script, on darwin: don't try copying safari extensions, don't try re-signing app
-    ./dont-use-platform-triple.patch # since out arch doesn't match upstream, we'll generate and use desktop_napi.node instead of desktop_napi.${platform}-${arch}.node
+    # The nixpkgs tooling trips over upstreams inconsistent lock files, so we fixed them by running npm install open@10.2.1 and cargo b
+    ./fix-lock-files.diff
+
+    # ensures `app.getPath("exe")` returns our wrapper, not ${electron}/bin/electron
+    ./set-exe-path.patch
+    # on linux: don't flip fuses, don't create wrapper script, on darwin: don't try copying safari extensions, don't try re-signing app
+    ./skip-afterpack-and-aftersign.patch
+    # since out arch doesn't match upstream, we'll generate and use desktop_napi.node instead of desktop_napi.${platform}-${arch}.node
+    ./dont-use-platform-triple.patch
   ];
 
   postPatch = ''
@@ -76,7 +82,7 @@ buildNpmPackage' rec {
     "--ignore-scripts"
   ];
   npmWorkspace = "apps/desktop";
-  npmDepsHash = "sha256-0IoBPRGdtkMeTrT5cqZLHB/WrUCONtsJ6YHh0y4K5Ls=";
+  npmDepsHash = "sha256-52cLVrfbeNeRH7OKN5QZdGD5VkUVliN0Rn/cbdohsG0=";
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit
@@ -86,7 +92,7 @@ buildNpmPackage' rec {
       cargoRoot
       patches
       ;
-    hash = "sha256-ZD/UPYRa+HR7hyWDP6S/BKvQpYRDwWQJV6iGF9LT2uY=";
+    hash = "sha256-mt7zWKgH21khAIrfpBFzb+aS2V2mV56zMqCSLzDhGfQ=";
   };
   cargoRoot = "apps/desktop/desktop_native";
 

pkgs/by-name/br/brave/package.nix

@@ -3,24 +3,24 @@
 
 let
   pname = "brave";
-  version = "1.79.123";
+  version = "1.80.113";
 
   allArchives = {
     aarch64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_arm64.deb";
-      hash = "sha256-SINatcbj6EEvvd1St1hLOMrWXA06DZtbSiaecA8hQ5s=";
+      hash = "sha256-fWNRiLLFfbVsvLaay878PEIAK9rKCbRCHZ/Uv/dBuCM=";
     };
     x86_64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-      hash = "sha256-XWw8Kn245KPpJxhSRz6xmFwijJSU5vMgpDUNRyRMf0M=";
+      hash = "sha256-xs9Bywb5ZWj/OINP1HEVxAMWhs2BTJVyU+dBOI+w6f8=";
     };
     aarch64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-arm64.zip";
-      hash = "sha256-8QZVd1//302jqO24Masz6KEogYCkfUxuQ2HpEeuaujY=";
+      hash = "sha256-SWalaT/+TvKvNBaVX9CQbCDMvPUgvJLG5rYhIHtXVkM=";
     };
     x86_64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-x64.zip";
-      hash = "sha256-IB+08osAXOenRDCSvebRxZlNYsFRoh3g0JwGfXUy1kU=";
+      hash = "sha256-YpEAOZZegpAH9UbNCsEAJeLjjAPJYhJcEF5wd/3ewGE=";
     };
   };
 

pkgs/by-name/ca/cargo-fuzz/package.nix

@@ -6,17 +6,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-fuzz";
-  version = "0.12.0";
+  version = "0.13.1";
 
   src = fetchFromGitHub {
     owner = "rust-fuzz";
     repo = "cargo-fuzz";
     rev = version;
-    hash = "sha256-PC36O5+eB+yVLpz+EywBDGcMAtHl79FYwUo/l/JL8hM=";
+    hash = "sha256-wOzzPhAuCaJfp7uRZ1kPpzMIr03couRaIbbrjL0EyYo=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-lyw7UJrGBL1+ATma3TWBpgjstSHGYMWAyTiq1nJNhgE=";
+  cargoHash = "sha256-7HCdWkjIycVKZty760ZnLBtLOZ3gwPhwseIqxqf8xPQ=";
 
   doCheck = false;
 

pkgs/by-name/ch/chatmcp/package.nix

@@ -14,13 +14,13 @@
 
 flutter332.buildFlutterApplication rec {
   pname = "chatmcp";
-  version = "0.0.66";
+  version = "0.0.69";
 
   src = fetchFromGitHub {
     owner = "daodao97";
     repo = "chatmcp";
     tag = "v${version}";
-    hash = "sha256-X4cndztMEncAwosSg2RaK3trvupwumcPpMb94D6JEcE=";
+    hash = "sha256-TA3ncOatmkX7GcaqxJ8yhdpnou2e9cQNweO+AR98Gto=";
   };
 
   pubspecLock = lib.importJSON ./pubspec.lock.json;

pkgs/by-name/ch/chatmcp/pubspec.lock.json

@@ -4,21 +4,21 @@
       "dependency": "transitive",
       "description": {
         "name": "_fe_analyzer_shared",
-        "sha256": "e55636ed79578b9abca5fecf9437947798f5ef7456308b5cb85720b793eac92f",
+        "sha256": "c81659312e021e3b780a502206130ea106487b34793bce61e26dc0f9b84807af",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "82.0.0"
+      "version": "83.0.0"
     },
     "analyzer": {
       "dependency": "transitive",
       "description": {
         "name": "analyzer",
-        "sha256": "904ae5bb474d32c38fb9482e2d925d5454cda04ddd0e55d2e6826bc72f6ba8c0",
+        "sha256": "9c35a79bf2a150b3ea0d40010fbbb45b5ebea143d47096e0f82fd922a324b49b",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "7.4.5"
+      "version": "7.4.6"
     },
     "archive": {
       "dependency": "transitive",
@@ -74,11 +74,11 @@
       "dependency": "transitive",
       "description": {
         "name": "build",
-        "sha256": "cef23f1eda9b57566c81e2133d196f8e3df48f244b317368d65c5943d91148f0",
+        "sha256": "51dc711996cbf609b90cbe5b335bbce83143875a9d58e4b5c6d3c4f684d3dda7",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.4.2"
+      "version": "2.5.4"
     },
     "build_config": {
       "dependency": "transitive",
@@ -104,31 +104,31 @@
       "dependency": "transitive",
       "description": {
         "name": "build_resolvers",
-        "sha256": "b9e4fda21d846e192628e7a4f6deda6888c36b5b69ba02ff291a01fd529140f0",
+        "sha256": "ee4257b3f20c0c90e72ed2b57ad637f694ccba48839a821e87db762548c22a62",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.4.4"
+      "version": "2.5.4"
     },
     "build_runner": {
       "dependency": "direct dev",
       "description": {
         "name": "build_runner",
-        "sha256": "058fe9dce1de7d69c4b84fada934df3e0153dd000758c4d65964d0166779aa99",
+        "sha256": "382a4d649addbfb7ba71a3631df0ec6a45d5ab9b098638144faf27f02778eb53",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.4.15"
+      "version": "2.5.4"
     },
     "build_runner_core": {
       "dependency": "transitive",
       "description": {
         "name": "build_runner_core",
-        "sha256": "22e3aa1c80e0ada3722fe5b63fd43d9c8990759d0a2cf489c8c5d7b2bdebc021",
+        "sha256": "85fbbb1036d576d966332a3f5ce83f2ce66a40bea1a94ad2d5fc29a19a0d3792",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "8.0.0"
+      "version": "9.1.2"
     },
     "built_collection": {
       "dependency": "transitive",
@@ -320,6 +320,16 @@
       "source": "hosted",
       "version": "3.1.0"
     },
+    "dbus": {
+      "dependency": "transitive",
+      "description": {
+        "name": "dbus",
+        "sha256": "79e0c23480ff85dc68de79e2cd6334add97e48f7f4865d17686dd6ea81a47e8c",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.7.11"
+    },
     "dev_build": {
       "dependency": "transitive",
       "description": {
@@ -330,6 +340,26 @@
       "source": "hosted",
       "version": "1.1.2+11"
     },
+    "dio": {
+      "dependency": "direct main",
+      "description": {
+        "name": "dio",
+        "sha256": "253a18bbd4851fecba42f7343a1df3a9a4c1d31a2c1b37e221086b4fa8c8dbc9",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "5.8.0+1"
+    },
+    "dio_web_adapter": {
+      "dependency": "transitive",
+      "description": {
+        "name": "dio_web_adapter",
+        "sha256": "7586e476d70caecaf1686d21eee7247ea43ef5c345eab9e0cc3583ff13378d78",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.1.1"
+    },
     "event_bus": {
       "dependency": "direct main",
       "description": {
@@ -646,11 +676,11 @@
       "dependency": "direct main",
       "description": {
         "name": "flutter_svg",
-        "sha256": "d44bf546b13025ec7353091516f6881f1d4c633993cb109c3916c3a0159dadf1",
+        "sha256": "cd57f7969b4679317c17af6fd16ee233c1e60a82ed209d8a475c54fd6fd6f845",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.1.0"
+      "version": "2.2.0"
     },
     "flutter_switch": {
       "dependency": "direct main",
@@ -744,6 +774,16 @@
       "source": "hosted",
       "version": "1.4.0"
     },
+    "http_methods": {
+      "dependency": "transitive",
+      "description": {
+        "name": "http_methods",
+        "sha256": "6bccce8f1ec7b5d701e7921dca35e202d425b57e317ba1a37f2638590e29e566",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.1.1"
+    },
     "http_multi_server": {
       "dependency": "transitive",
       "description": {
@@ -944,6 +984,16 @@
       "source": "hosted",
       "version": "2.0.0"
     },
+    "mobile_scanner": {
+      "dependency": "direct main",
+      "description": {
+        "name": "mobile_scanner",
+        "sha256": "54005bdea7052d792d35b4fef0f84ec5ddc3a844b250ecd48dc192fb9b4ebc95",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "7.0.1"
+    },
     "mockito": {
       "dependency": "direct dev",
       "description": {
@@ -964,6 +1014,36 @@
       "source": "hosted",
       "version": "1.0.0"
     },
+    "network_info_plus": {
+      "dependency": "direct main",
+      "description": {
+        "name": "network_info_plus",
+        "sha256": "5bd4b86e28fed5ed4e6ac7764133c031dfb7d3f46aa2a81b46f55038aa78ecc0",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "5.0.3"
+    },
+    "network_info_plus_platform_interface": {
+      "dependency": "transitive",
+      "description": {
+        "name": "network_info_plus_platform_interface",
+        "sha256": "7e7496a8a9d8136859b8881affc613c4a21304afeb6c324bcefc4bd0aff6b94b",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.0.2"
+    },
+    "nm": {
+      "dependency": "transitive",
+      "description": {
+        "name": "nm",
+        "sha256": "2c9aae4127bdc8993206464fcc063611e0e36e72018696cd9631023a31b24254",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.5.0"
+    },
     "node_preamble": {
       "dependency": "transitive",
       "description": {
@@ -1184,6 +1264,26 @@
       "source": "hosted",
       "version": "1.5.0"
     },
+    "qr": {
+      "dependency": "transitive",
+      "description": {
+        "name": "qr",
+        "sha256": "5a1d2586170e172b8a8c8470bbbffd5eb0cd38a66c0d77155ea138d3af3a4445",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "3.0.2"
+    },
+    "qr_flutter": {
+      "dependency": "direct main",
+      "description": {
+        "name": "qr_flutter",
+        "sha256": "5095f0fc6e3f71d08adef8feccc8cea4f12eec18a2e31c2e8d82cb6019f4b097",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "4.1.0"
+    },
     "rxdart": {
       "dependency": "transitive",
       "description": {
@@ -1355,7 +1455,7 @@
       "version": "2.4.1"
     },
     "shelf": {
-      "dependency": "transitive",
+      "dependency": "direct main",
       "description": {
         "name": "shelf",
         "sha256": "e7dd780a7ffb623c57850b33f43309312fc863fb6aa3d276a754bb299839ef12",
@@ -1364,6 +1464,16 @@
       "source": "hosted",
       "version": "1.4.2"
     },
+    "shelf_cors_headers": {
+      "dependency": "direct main",
+      "description": {
+        "name": "shelf_cors_headers",
+        "sha256": "a127c80f99bbef3474293db67a7608e3a0f1f0fcdb171dad77fa9bd2cd123ae4",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.1.5"
+    },
     "shelf_packages_handler": {
       "dependency": "transitive",
       "description": {
@@ -1374,6 +1484,16 @@
       "source": "hosted",
       "version": "3.0.2"
     },
+    "shelf_router": {
+      "dependency": "direct main",
+      "description": {
+        "name": "shelf_router",
+        "sha256": "f5e5d492440a7fb165fe1e2e1a623f31f734d3370900070b2b1e0d0428d59864",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.1.4"
+    },
     "shelf_static": {
       "dependency": "transitive",
       "description": {

pkgs/by-name/co/codeql/package.nix

@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation rec {
   pname = "codeql";
-  version = "2.21.4";
+  version = "2.22.1";
 
   dontConfigure = true;
   dontBuild = true;
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   src = fetchzip {
     url = "https://github.com/github/codeql-cli-binaries/releases/download/v${version}/codeql.zip";
-    hash = "sha256-iC6P/GhMw7Sf8Ic6oglB+GFLWBrZZ+YuOJbyNm99ypc=";
+    hash = "sha256-wXwFrAFODwVj/6b9Nh2wWnNjMMyjlnGXOWiT2/HW2r4=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/es/esphome/package.nix

@@ -33,14 +33,14 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "esphome";
-  version = "2025.6.1";
+  version = "2025.6.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "esphome";
     repo = "esphome";
     tag = version;
-    hash = "sha256-iM9AbL8K7Ka2B50/slp/Cfgb4kWWmOhZcMe0Ph3WnP0=";
+    hash = "sha256-45DhWxBvItl70mx/H42o9PqlIipvzIA/A9H6pKDO2fo=";
   };
 
   build-systems = with python.pkgs; [

pkgs/by-name/eu/euphonica/package.nix

@@ -0,0 +1,77 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cargo,
+  meson,
+  ninja,
+  pkg-config,
+  rustPlatform,
+  rustc,
+  wrapGAppsHook4,
+  cairo,
+  dbus,
+  gdk-pixbuf,
+  glib,
+  gtk4,
+  libadwaita,
+  openssl,
+  pango,
+  pipewire,
+  sqlite,
+  desktop-file-utils,
+  libxml2,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "euphonica";
+  version = "0.94.1-alpha";
+
+  src = fetchFromGitHub {
+    owner = "htkhiem";
+    repo = "euphonica";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-1d2GZSTr0HnVC7D6T7LFeL8kXfwGBhjqZ3lC4ZjpOtM=";
+    fetchSubmodules = true;
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-vb9THfSTN27rOfIlpCPkAJm+eLnh+RptOYWLS8hGDpw=";
+  };
+
+  nativeBuildInputs = [
+    cargo
+    meson
+    ninja
+    pkg-config
+    rustPlatform.bindgenHook
+    rustPlatform.cargoSetupHook
+    rustc
+    wrapGAppsHook4
+    desktop-file-utils
+  ];
+
+  buildInputs = [
+    cairo
+    dbus
+    gdk-pixbuf
+    glib
+    gtk4
+    libadwaita
+    openssl
+    pango
+    pipewire
+    sqlite
+    libxml2
+  ];
+
+  meta = {
+    description = "MPD client with delusions of grandeur, made with Rust, GTK and Libadwaita";
+    homepage = "https://github.com/htkhiem/euphonica";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ paperdigits ];
+    mainProgram = "euphonica";
+    platforms = with lib.platforms; linux;
+  };
+})

pkgs/by-name/ex/exploitdb/package.nix

@@ -5,15 +5,15 @@
   makeWrapper,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "exploitdb";
-  version = "2025-06-21";
+  version = "2025-06-27";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = "exploitdb";
-    rev = "refs/tags/${version}";
-    hash = "sha256-6mXku+SW6xmSYxd40Ilis8H/2Ozm6eUecLQHy1xeKtM=";
+    tag = finalAttrs.version;
+    hash = "sha256-Gm3SRdt6a3hSe64iP7j+5HQ5bGZ6s3eKvxFlCkQWZHo=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
@@ -26,19 +26,19 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Archive of public exploits and corresponding vulnerable software";
     homepage = "https://gitlab.com/exploit-database/exploitdb";
-    license = with licenses; [
+    license = with lib.licenses; [
       gpl2Plus
       gpl3Plus
       mit
     ];
-    maintainers = with maintainers; [
+    maintainers = with lib.maintainers; [
       applePrincess
       fab
     ];
     mainProgram = "searchsploit";
-    platforms = platforms.unix;
+    platforms = lib.platforms.unix;
   };
-}
+})

pkgs/by-name/fa/faraday/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "faraday";
-  version = "0.2.11-alpha";
+  version = "0.2.14-alpha";
 
   src = fetchFromGitHub {
     owner = "lightninglabs";
     repo = "faraday";
     rev = "v${version}";
-    hash = "sha256-KiGj24sBeClmzW60lRrvXwgXf3My7jhHTY+VhIMMp0k=";
+    hash = "sha256-7sCNHrtDDpxpcxmHTVq8reHjNMXKyxPbYM6H6Eqo+OY=";
   };
 
-  vendorHash = "sha256-ku/4VE1Gj62vuJLh9J6vKlxpyI7S0RsMDozV7U5YDe4=";
+  vendorHash = "sha256-xlyZEcFphXAV+7iHmJBZiQWKKBDm1cpE2Eax2fWYd0Y=";
 
   subPackages = [
     "cmd/frcli"

pkgs/by-name/ff/ffsend/package.nix

@@ -22,46 +22,23 @@ assert (x11Support && usesX11) -> xclip != null || xsel != null;
 
 rustPlatform.buildRustPackage rec {
   pname = "ffsend";
-  version = "0.2.76";
+  version = "0.2.77";
 
   src = fetchFromGitLab {
     owner = "timvisee";
     repo = "ffsend";
-    rev = "v${version}";
-    hash = "sha256-L1j1lXPxy9nWMeED9uzQHV5y7XTE6+DB57rDnXa4kMo=";
+    tag = "v${version}";
+    hash = "sha256-qq1nLNe4ddcsFJZaGfNQbNtqchz6tPh1kpEH/oDW3jk=";
   };
 
-  useFetchCargoVendor = true;
-  cargoHash = "sha256-Gv70H3SLgiO7SWKYfCKzBhgAHxhjx3Gv7ZPLrGeQ+HY=";
+  cargoHash = "sha256-DQcuyp61r0y9fi8AV33qxN2cOrl0M8q4/VoXuV47gxQ=";
 
   cargoPatches = [
-
-    # Update dependencies (needed for the below patch to merge cleanly)
+    # https://gitlab.com/timvisee/ffsend/-/merge_requests/44
     (fetchpatch {
-      name = "Update-dependencies-1";
-      url = "https://github.com/timvisee/ffsend/commit/afb004680b9ed672c7e87ff23f16bb2c51fea06e.patch";
-      hash = "sha256-eDcbyi05aOq+muVWdLmlLzLXUKcrv/9Y0R+0aHgL4+s=";
-    })
-
-    # Disable unused features in prettytable-rs crate (needed for the below patch to merge cleanly)
-    (fetchpatch {
-      name = "Disable-unused-features";
-      url = "https://github.com/timvisee/ffsend/commit/9b8dee12ea839f911ed207ff9602d929cab5d34b.patch";
-      hash = "sha256-6LK1Fqov+zEbPZ4+B6JCLXtXmgSad9vr9YO2oYodBSM=";
-    })
-
-    # Update dependencies (needed for the below patch to merge cleanly)
-    (fetchpatch {
-      name = "Update-dependencies-2";
-      url = "https://github.com/timvisee/ffsend/commit/fd5b38f9ab9cbc5f962d1024f4809eb36ba8986c.patch";
-      hash = "sha256-BDZKrVtQHpOewmB2Lb6kUfy02swcNK+CYZ3lj3kwFV4=";
-    })
-
-    # Fix seg fault
-    (fetchpatch {
-      name = "Fix-segfault";
-      url = "https://github.com/timvisee/ffsend/commit/3c1c2dc28ca1d88c45f87496a7a96052f5c37858.patch";
-      hash = "sha256-2hWlFXDopNy26Df74nJoB1J8qzPEOpf61wEOEtxOVx8=";
+      name = "rust-1.87.0-compat.patch";
+      url = "https://gitlab.com/timvisee/ffsend/-/commit/29eb167d4367929a2546c20b3f2bbf890b63c631.patch";
+      hash = "sha256-BxJ+0QJP2fzQT1X3BZG1Yy9V+csIEk8xocUKSBgdG9M=";
     })
   ];
 
@@ -86,7 +63,7 @@ rustPlatform.buildRustPackage rec {
   '';
   # There's also .elv and .ps1 completion files but I don't know where to install those
 
-  meta = with lib; {
+  meta = {
     description = "Easily and securely share files from the command line. A fully featured Firefox Send client";
     longDescription = ''
       Easily and securely share files and directories from the command line through a safe, private
@@ -95,9 +72,9 @@ rustPlatform.buildRustPackage rec {
       web browser.
     '';
     homepage = "https://gitlab.com/timvisee/ffsend";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ equirosa ];
-    platforms = platforms.unix;
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ equirosa ];
+    platforms = lib.platforms.unix;
     mainProgram = "ffsend";
   };
 }

pkgs/by-name/fi/firezone-gateway/package.nix

@@ -6,16 +6,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "firezone-gateway";
-  version = "1.4.10";
+  version = "1.4.11";
   src = fetchFromGitHub {
     owner = "firezone";
     repo = "firezone";
     tag = "gateway-${version}";
-    hash = "sha256-3iU7AHu3GupqiZEDkuOEb+rFPA2KB1fjVNX1BY4abXc=";
+    hash = "sha256-tKkp9EHcwAEGHImEjfXrxIhdNyDYe/0w5wXb31EIHjc=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-p2zLhLFL6NbHvVojQU5+1amf+Kh0jRAbIESPt2vqWwg=";
+  cargoHash = "sha256-NCKT6GS6V/5W1BaNl6uQ4hiNTj6ExQTRPR8T7pxMopc=";
   sourceRoot = "${src.name}/rust";
   buildAndTestSubdir = "gateway";
   RUSTFLAGS = "--cfg system_certs";

pkgs/by-name/fl/fluxcd/package.nix

@@ -8,10 +8,10 @@
 }:
 
 let
-  version = "2.6.2";
-  srcHash = "sha256-0Q8U7i1hK2CVWia3t/ayjIzjNjHurhkRGO0oLHLNMH4=";
-  vendorHash = "sha256-LS2qgukhLk6nrjkp5Y00B0N/LFLzOUR/TC3qD80WZAQ=";
-  manifestsHash = "sha256-KXvYURCJ1/BI61jes0Pvy6giKvVmosWOHuzGRHCcqZo=";
+  version = "2.6.3";
+  srcHash = "sha256-0VCeQ3duUzwyjgGIcx0DYXbaPFZXLgw199h9f0sYgCQ=";
+  vendorHash = "sha256-RUEl7o1vxzzkL8UAV9E+ozz+fXF6GaxL4ci2MBbEG0o=";
+  manifestsHash = "sha256-0rS7+yWHjyHmMBE5ZpIwV8wjqPhg3iw1zkX814mX2t8=";
 
   manifests = fetchzip {
     url = "https://github.com/fluxcd/flux2/releases/download/v${version}/manifests.tar.gz";

pkgs/by-name/fz/fzf/package.nix

@@ -12,16 +12,16 @@
 
 buildGoModule rec {
   pname = "fzf";
-  version = "0.62.0";
+  version = "0.63.0";
 
   src = fetchFromGitHub {
     owner = "junegunn";
     repo = "fzf";
     rev = "v${version}";
-    hash = "sha256-c83aJZYcCR8yqUNp1G4Viu3P8lZGD4gIQAArXdtRkc8=";
+    hash = "sha256-XfqqvWlwv8L0FiWbGSim3W6g/hn7Lh+YMKqrTAOwC+w=";
   };
 
-  vendorHash = "sha256-WcrJfvY3GZLDuRr2PZR1ooNPJ6FQ4S3RvUc2+zePw5w=";
+  vendorHash = "sha256-1wxi+wfTSSgJQLNbCdoFTz9G4XLgEX7PpzqpuVjEYL8=";
 
   env.CGO_ENABLED = 0;
 

pkgs/by-name/gi/github-distributed-owners/package.nix

@@ -0,0 +1,35 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nix-update-script,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "github-distributed-owners";
+  version = "0.1.11";
+
+  src = fetchFromGitHub {
+    owner = "andrewring";
+    repo = "github-distributed-owners";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-oLRcH1lgRxlYIlyk3bPWO5YmCIq462YUjBjMSPOF7Ic=";
+  };
+
+  cargoHash = "sha256-pt/GoXF/uSU78pZqG8PgFe+tlbwZH2qpGQD7jgC52NM=";
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Generate GitHub CODEOWNERS files from OWNERS files distributed through the file tree";
+    homepage = "https://github.com/andrewring/github-distributed-owners";
+    changelog = "https://github.com/andrewring/github-distributed-owners/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ cameroncuttingedge ];
+    mainProgram = "github-distributed-owners";
+  };
+})

pkgs/by-name/in/incus-ui-canonical/package.nix

@@ -20,19 +20,19 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "incus-ui-canonical";
-  version = "0.15.4";
+  version = "0.17.1.0";
 
   src = fetchFromGitHub {
     owner = "zabbly";
     repo = "incus-ui-canonical";
     # only use tags prefixed by incus- they are the tested fork versions
     tag = "incus-${version}";
-    hash = "sha256-kY7FMZbwP5D5EJfYH1/ptgKdCceduk05fjVdwtOgUNk=";
+    hash = "sha256-dAYcput4qGLQT6G10O52UUrQ7HN9kXQFgZlm5QN4xI0=";
   };
 
   offlineCache = fetchYarnDeps {
     yarnLock = "${src}/yarn.lock";
-    hash = "sha256-nZyk/ZrTAOyL+A3oMUHY52PIffVZxMG2tvh4FM/A+w0=";
+    hash = "sha256-or/lPf6pamFVJnSWU9CLTss9s6amMNd9A7H8CAFJ6RU=";
   };
 
   patchPhase = ''

pkgs/by-name/ip/ipxe/package.nix

@@ -48,7 +48,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ipxe";
-  version = "1.21.1-unstable-2025-06-17";
+  version = "1.21.1-unstable-2025-06-26";
 
   nativeBuildInputs = [
     mtools
@@ -65,8 +65,8 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "ipxe";
     repo = "ipxe";
-    rev = "60e167c00b138fdb162e7b2192e9cbb196ed3cbd";
-    hash = "sha256-RaYu3gvqAxA+vEJdLOLMbCRtrt+PyrRd/Wqyj2hXYZU=";
+    rev = "4262328c13a3ec085eac7c6c58fbed27d2466a0d";
+    hash = "sha256-FvYGM+NApTloA7vV1KPpsAzIT7oZ2GK6rKw+3mosvTA=";
   };
 
   # Calling syslinux on a FAT image isn't going to work on Aarch64.

pkgs/by-name/ko/komodo/package.nix

@@ -7,18 +7,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "komodo";
-  version = "1.18.3";
+  version = "1.18.4";
 
   src = fetchFromGitHub {
     owner = "moghtech";
     repo = "komodo";
     tag = "v${version}";
-    hash = "sha256-OBap1gKxFUh1QoR5waXi2IrWiTydhp/VtL9rGnEDJSI=";
+    hash = "sha256-allGKoeI3mlMWbF9WsDbX/4eGdBT/eoF71uAk5iK0e4=";
   };
 
   useFetchCargoVendor = true;
 
-  cargoHash = "sha256-P7s+uEnh8CUmRLiBLz/yNbox8auHU5zFk8IiWGW0rAs=";
+  cargoHash = "sha256-nlCGrPlH+AZNz7BYDcoU0WBHBft4DnO4WfqGD5wVLmQ=";
 
   # disable for check. document generation is fail
   # > error: doctest failed, to rerun pass `-p komodo_client --doc`

pkgs/by-name/ku/kuzu/package.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "kuzu";
-  version = "0.10.0";
+  version = "0.10.1";
 
   src = fetchFromGitHub {
     owner = "kuzudb";
     repo = "kuzu";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mc9MLIdlxMTQjvpKAa2N8AlhWJDzydd70x/YU6xX6h0=";
+    hash = "sha256-c4KXtix7CQOdo+/pUhAMauMdGVuMJH/ttNQUI9CS1Nc=";
   };
 
   outputs = [

pkgs/by-name/la/laze/package.nix

@@ -13,17 +13,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "laze";
-  version = "0.1.36";
+  version = "0.1.37";
 
   src = fetchFromGitHub {
     owner = "kaspar030";
     repo = "laze";
     tag = finalAttrs.version;
-    hash = "sha256-516VJ6yzQOn8a1ufpxbJ8lCHcs09PVzPmXyWU7F+REk=";
+    hash = "sha256-jO9GVC4wfMUCpS77tgjcU/1rau5ho+2949gtd1S7GxA=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-vLlkgF8vfL4RbFH7S3pQaAgHs08glHJaIkFIBYLoAWE=";
+  cargoHash = "sha256-jUIvVUQTDNsaIjwt1fFqeUjMNfw342pQByWvNPbgGts=";
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/le/ledger-live-desktop/package.nix

@@ -8,11 +8,11 @@
 
 let
   pname = "ledger-live-desktop";
-  version = "2.117.0";
+  version = "2.118.1";
 
   src = fetchurl {
     url = "https://download.live.ledger.com/${pname}-${version}-linux-x86_64.AppImage";
-    hash = "sha256-YcnTJFbkbPTr9ZfiOEnN1oHjTMl9S2XsJyMxozPXxa8=";
+    hash = "sha256-FG1vlcLUjQpXfoEczvTOyqLFuCYU/72KeAdsg/SMjLQ=";
   };
 
   appimageContents = appimageTools.extractType2 {

pkgs/by-name/li/libwacom/package.nix

@@ -16,7 +16,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libwacom";
-  version = "2.15.0";
+  version = "2.16.1";
 
   outputs = [
     "out"
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "linuxwacom";
     repo = "libwacom";
     rev = "libwacom-${finalAttrs.version}";
-    hash = "sha256-fc7ymkyIJ5BvrPxJg7Vw1h1mBy+icr+5kVDecODxRLQ=";
+    hash = "sha256-YP6z+2HyIRmIAJIdJMbVTQA0rf3EXBZvlCdM4jrmHXM=";
   };
 
   postPatch = ''

pkgs/by-name/li/linux-firmware/package.nix

@@ -22,13 +22,13 @@ let
 in
 stdenvNoCC.mkDerivation rec {
   pname = "linux-firmware";
-  version = "20250624"; # not a real tag, but the current stable tag breaks some AMD GPUs entirely
+  version = "20250627";
 
   src = fetchFromGitLab {
     owner = "kernel-firmware";
     repo = "linux-firmware";
-    rev = "b05fabcd6f2a16d50b5f86c389dde7a33f00bb81";
-    hash = "sha256-AvSsyfKP57Uhb3qMrf6PpNHKbXhD9IvFT1kcz5J7khM=";
+    tag = version;
+    hash = "sha256-mNjCl+HtvvFxyLjlBFsyfyu2TAf6D/9lbRiouKC/vVY=";
   };
 
   postUnpack = ''

pkgs/by-name/mb/mbake/package.nix

@@ -0,0 +1,45 @@
+{
+  lib,
+  fetchFromGitHub,
+  python3Packages,
+  versionCheckHook,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "mbake";
+  version = "1.2.4";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "EbodShojaei";
+    repo = "bake";
+    tag = "v${version}";
+    hash = "sha256-RzM3HC3lYq93mngpqNCohcPMISWQ4+Lwa1V88S0O0To=";
+  };
+
+  build-system = [
+    python3Packages.hatchling
+  ];
+
+  dependencies = with python3Packages; [
+    rich
+    typer
+  ];
+
+  nativeCheckInputs = [
+    python3Packages.pytestCheckHook
+    versionCheckHook
+  ];
+  versionCheckProgramArg = "--version";
+
+  pythonImportsCheck = [ "bake" ];
+
+  meta = {
+    description = "Makefile formatter and linter";
+    homepage = "https://github.com/EbodShojaei/bake";
+    changelog = "https://github.com/EbodShojaei/bake/blob/${src.tag}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    mainProgram = "mbake";
+    maintainers = [ lib.maintainers.amadejkastelic ];
+  };
+}

pkgs/by-name/md/md-tui/package.nix

@@ -8,17 +8,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "md-tui";
-  version = "0.8.7";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "henriklovhaug";
     repo = "md-tui";
     tag = "v${version}";
-    hash = "sha256-O+EIhh83nIYE2GWaThkDLIVsYsg62g/6ksS+1fKm4AY=";
+    hash = "sha256-K+s4p0d4b3c8Xqw8RGaEZb62zsbKo84J0yXM4j+n95I=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-h0ikwdGmyBsCJvILJTlDd9x0DXYwblfBcK2wuWHmjYA=";
+  cargoHash = "sha256-AgWOjsa6n4kaXjQSCqW4lYqhhMqvdemEFlCJp99KiUg=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/me/mesos-dns/package.nix

@@ -29,7 +29,7 @@ buildGoModule (finalAttrs: {
     changelog = "https://github.com/m3scluster/mesos-dns/releases/tag/v${finalAttrs.version}";
     description = "DNS-based service discovery for Mesos";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ aaronjheng ];
+    maintainers = with lib.maintainers; [ ];
     mainProgram = "mesos-dns";
   };
 })

pkgs/by-name/mi/mimir/package.nix

@@ -7,13 +7,13 @@
 }:
 buildGoModule rec {
   pname = "mimir";
-  version = "2.16.0";
+  version = "2.16.1";
 
   src = fetchFromGitHub {
     rev = "mimir-${version}";
     owner = "grafana";
     repo = "mimir";
-    hash = "sha256-75KHS+jIPEvcB7SHBBcBi5uycwY7XR4RNc1khNYVZFE=";
+    hash = "sha256-+GFsWBjZHxRe3a2/ZT0zkoRXDTR4qopTUcU5Fx9t5xA=";
   };
 
   vendorHash = null;

pkgs/by-name/mi/minijinja/package.nix

@@ -6,17 +6,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "minijinja";
-  version = "2.10.2";
+  version = "2.11.0";
 
   src = fetchFromGitHub {
     owner = "mitsuhiko";
     repo = "minijinja";
     rev = version;
-    hash = "sha256-JPR9FRMVQH7DdYyFfh75g1BYDg8R9xCnigirGe8Xx1o=";
+    hash = "sha256-0qRQuYhta4RUNy8Ac+SSCad172vVshddDS6mizSqO2A=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-EInDnhUD29nZUOr2nBT4SuweMVad+RsS5eS767CvjRk=";
+  cargoHash = "sha256-zE0n+vkkJ1R8eT/Tetqx6GSITB6xM/9SgrEB/9pAkqw=";
 
   # The tests relies on the presence of network connection
   doCheck = false;

pkgs/by-name/nr/nrr/package.nix

@@ -7,17 +7,17 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "nrr";
-  version = "0.10.2";
+  version = "0.10.3";
 
   src = fetchFromGitHub {
     owner = "ryanccn";
     repo = "nrr";
     rev = "v${version}";
-    hash = "sha256-qh4YEfdfO6WofdrFHVDvkNocloK2LuWelfZPilxiKPk=";
+    hash = "sha256-RBKFDm6MpK2lDCUvbX0EFEuOASKtHM+5QknWM0A6AKE=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-f8ugfkTtS23TLh0Ss4SpxGy1Y9AeqinE+psDmHVHibg=";
+  cargoHash = "sha256-DiapeSFfsmox+Utx9uW/8/veEQcnWmoaETLNyffpv64=";
 
   env = lib.optionalAttrs enableLTO {
     CARGO_PROFILE_RELEASE_LTO = "fat";

pkgs/by-name/nv/nvidia-container-toolkit/package.nix

@@ -25,14 +25,14 @@ let
   # From https://gitlab.com/nvidia/container-toolkit/container-toolkit/-/blob/03cbf9c6cd26c75afef8a2dd68e0306aace80401/Makefile#L54
   cliVersionPackage = "github.com/NVIDIA/nvidia-container-toolkit/internal/info";
 in
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "nvidia-container-toolkit";
   version = "1.17.8";
 
   src = fetchFromGitHub {
     owner = "NVIDIA";
     repo = "nvidia-container-toolkit";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-B17cPxdrQ8qMNgFh4XcDwwKryukMrn0GV2LNPHM7kBo=";
 
   };
@@ -76,13 +76,10 @@ buildGoModule rec {
   ldflags = [
     "-extldflags=-Wl,-z,lazy" # May be redunandant, cf. `man ld`: "Lazy binding is the default".
     "-s" # "disable symbol table"
-    "-w" # "disable DWARF generation"
 
     # "-X name=value"
-    "-X"
-    "${cliVersionPackage}.version=${version}"
-    "-X"
-    "github.com/NVIDIA/nvidia-container-toolkit/internal/info.gitCommit=${src.rev}"
+    "-X ${cliVersionPackage}.version=${finalAttrs.version}"
+    "-X ${cliVersionPackage}.gitCommit=${finalAttrs.src.rev}"
   ];
 
   nativeBuildInputs = [
@@ -98,10 +95,7 @@ buildGoModule rec {
         "TestDuplicateHook"
       ];
     in
-    [
-      "-skip"
-      "${builtins.concatStringsSep "|" skippedTests}"
-    ];
+    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
 
   postInstall =
     ''
@@ -122,14 +116,14 @@ buildGoModule rec {
         --subst-var-by glibcbin ${lib.getBin glibc}
     '';
 
-  meta = with lib; {
+  meta = {
     homepage = "https://gitlab.com/nvidia/container-toolkit/container-toolkit";
     description = "NVIDIA Container Toolkit";
-    license = licenses.asl20;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [
       cpcloud
       christoph-heiss
     ];
   };
-}
+})

pkgs/by-name/pa/paperless-ngx/package.nix

@@ -26,13 +26,13 @@
   xorg,
 }:
 let
-  version = "2.16.3";
+  version = "2.17.1";
 
   src = fetchFromGitHub {
     owner = "paperless-ngx";
     repo = "paperless-ngx";
     tag = "v${version}";
-    hash = "sha256-mtzr/rRzcYcZl9tUkhxEKoFQWm1QTToOYZJXhynwDmk=";
+    hash = "sha256-6FvP/HgomsPxqCtKrZFxMlD2fFyT2e/JII2L7ANiOao=";
   };
 
   python = python3.override {
@@ -69,7 +69,7 @@ let
 
       pnpmDeps = pnpm.fetchDeps {
         inherit pname version src;
-        hash = "sha256-Z7c+AstVnxbPnEhc51qSqOYhRXqNJVwTvgHFcFp+pYg=";
+        hash = "sha256-VtYYwpMXPAC3g1OESnw3dzLTwiGqJBQcicFZskEucok=";
       };
 
       nativeBuildInputs =

pkgs/by-name/pa/parseable/package.nix

@@ -11,13 +11,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "parseable";
-  version = "2.3.3";
+  version = "2.3.5";
 
   src = fetchFromGitHub {
     owner = "parseablehq";
     repo = "parseable";
     tag = "v${version}";
-    hash = "sha256-E2leEt4M+p9hc7zR0dVO8n/O796kmv1s4wFlZ79VCy0=";
+    hash = "sha256-3kSbhTMnAPA86obH7F8nig8xIvlFpBanWuzgNVU1xFU=";
   };
 
   LOCAL_ASSETS_PATH = fetchzip {
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage rec {
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-WeWWQReKCM+xCjZKKrBSWLUhD+mOXspMHiUNmLKdRrM=";
+  cargoHash = "sha256-oXcOozjFKN10+693Eofg8vS2XryDEezAKkAhbGGNZ0A=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/pk/pkgsite/package.nix

@@ -7,12 +7,12 @@
 
 buildGoModule {
   pname = "pkgsite";
-  version = "0-unstable-2025-06-11";
+  version = "0-unstable-2025-06-24";
 
   src = fetchFromGitHub {
     owner = "golang";
     repo = "pkgsite";
-    rev = "041c7c0b878cb88962867185208d4d2ec79de7d0";
+    rev = "ae590d8f0828128c9ff20b8ed794e7cf3ff86a7c";
     hash = "sha256-dyBOdUwod03c8eU1qfJecSDyKzol//yFpANCOihiseo=";
   };
 

pkgs/by-name/pl/plemoljp-hs/package.nix

@@ -6,11 +6,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "plemoljp-hs";
-  version = "2.0.4";
+  version = "3.0.0";
 
   src = fetchzip {
     url = "https://github.com/yuru7/PlemolJP/releases/download/v${version}/PlemolJP_HS_v${version}.zip";
-    hash = "sha256-+pRbMgRaIbsXo8e7rQre377F8LhbK9rBjG/vYrdeFQM=";
+    hash = "sha256-V21T8ktNZE4nq3SH6aN9iIJHmGTkZuMsvT84yHbwSqI=";
   };
 
   installPhase = ''

pkgs/by-name/pl/plemoljp-nf/package.nix

@@ -6,11 +6,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "plemoljp-nf";
-  version = "2.0.4";
+  version = "3.0.0";
 
   src = fetchzip {
     url = "https://github.com/yuru7/PlemolJP/releases/download/v${version}/PlemolJP_NF_v${version}.zip";
-    hash = "sha256-6CMeo6YtWbEH/6xDD1yERhlMiCcOafAsQzcHeWQxuo4=";
+    hash = "sha256-m8zR9ySl88DnVzG4fKJtc9WjSLDMLU4YDX+KXhcP2WU=";
   };
 
   installPhase = ''

pkgs/by-name/pl/plemoljp/package.nix

@@ -6,11 +6,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "plemoljp";
-  version = "2.0.4";
+  version = "3.0.0";
 
   src = fetchzip {
     url = "https://github.com/yuru7/PlemolJP/releases/download/v${version}/PlemolJP_v${version}.zip";
-    hash = "sha256-pajE86IK05mm3Z507bvoMGy8JJwuGWZnUiSrXndiBTk=";
+    hash = "sha256-R4zC1pnM72FVqBQ5d03z8vyVccsM163BE15m2hdEnSA=";
   };
 
   installPhase = ''

pkgs/by-name/po/polypane/package.nix

@@ -1,44 +0,0 @@
-{
-  lib,
-  fetchurl,
-  appimageTools,
-}:
-
-let
-  pname = "polypane";
-  version = "24.1.2";
-
-  src = fetchurl {
-    url = "https://github.com/firstversionist/${pname}/releases/download/v${version}/${pname}-${version}.AppImage";
-    name = "${pname}-${version}.AppImage";
-    sha256 = "sha256-fFZP8RfAjlgZB/57sbEQ3pzQCNX+9Nd2jdcRUD8TJeo=";
-  };
-
-  appimageContents = appimageTools.extractType2 {
-    inherit pname src version;
-  };
-in
-appimageTools.wrapType2 {
-  inherit pname src version;
-
-  extraPkgs = pkgs: [ pkgs.bash ];
-
-  extraInstallCommands = ''
-    install -m 444 -D ${appimageContents}/${pname}.desktop $out/share/applications/${pname}.desktop
-    install -m 444 -D ${appimageContents}/${pname}.png \
-      $out/share/icons/hicolor/512x512/apps/${pname}.png
-  '';
-
-  meta = with lib; {
-    description = "Browser with unified devtools targeting responsability and accessibility";
-    longDescription = ''
-      The stand-alone browser for ambitious developers that want to build responsive,
-      accessible and performant websites in a fraction of the time it takes with other browsers.
-    '';
-    homepage = "https://polypane.app/";
-    maintainers = with maintainers; [ zoedsoupe ];
-    platforms = [ "x86_64-linux" ];
-    changelog = "https://polypane.app/docs/changelog/";
-    license = licenses.unfree;
-  };
-}

pkgs/by-name/pr/pretalx/package.nix

@@ -83,7 +83,7 @@ python.pkgs.buildPythonApplication rec {
     "bleach"
     "beautifulsoup4"
     "celery"
-    "css-inline"
+    "css_inline"
     "cssutils"
     "defusedxml"
     "django-compressor"

pkgs/by-name/pr/pretix/package.nix

@@ -42,13 +42,13 @@ let
   };
 
   pname = "pretix";
-  version = "2025.5.0";
+  version = "2025.6.0";
 
   src = fetchFromGitHub {
     owner = "pretix";
     repo = "pretix";
     rev = "refs/tags/v${version}";
-    hash = "sha256-vu+7jKXIuNZ4BN2IamdDxGJkraj93eNYUT3sUU2LCAg=";
+    hash = "sha256-bDE4ygTCX7hynWjoni9ZWMGujKvPk0TKaG42SQ6w9Rk=";
   };
 
   npmDeps = buildNpmPackage {
@@ -56,7 +56,7 @@ let
     inherit version src;
 
     sourceRoot = "${src.name}/src/pretix/static/npm_dir";
-    npmDepsHash = "sha256-NSBSL6+0ancoPHbvJu4fBxK8EVj06dbltjHqJi2yh5w=";
+    npmDepsHash = "sha256-LQPbOC9SaolD/fyiFoObndx7pcS7iaYVytz6y+bQZqQ=";
 
     dontBuild = true;
 
@@ -91,6 +91,7 @@ python.pkgs.buildPythonApplication rec {
     "importlib-metadata"
     "kombu"
     "markdown"
+    "oauthlib"
     "phonenumberslite"
     "pillow"
     "protobuf"

pkgs/by-name/pr/pretix/plugins/servicefees/package.nix

@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "pretix-servicefees";
-  version = "1.14.0";
+  version = "1.14.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pretix";
     repo = "pretix-servicefees";
     tag = "v${version}";
-    hash = "sha256-PsVItCBFJ4dRdRY2jKJ7aErYx/bhxKQtDsiJbyXsNKk=";
+    hash = "sha256-iceFpmuWlq4LnZpG57d4Fwx9bXJDGwx+ox58s8oxupU=";
   };
 
   build-system = [

pkgs/by-name/pr/pretix/plugins/zugferd/package.nix

@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "pretix-zugferd";
-  version = "2.4.0";
+  version = "2.4.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pretix";
     repo = "pretix-zugferd";
     rev = "v${version}";
-    hash = "sha256-VtmlgxqV34e3Yu9uTYwJAZoZQ/TQoEJgjHcpqUsxxq8=";
+    hash = "sha256-GChHhtWYION84hmGZl92FKDvfLjlZ0QWHuTcc9ScWk8=";
   };
 
   postPatch = ''

pkgs/by-name/pr/prometheus/package.nix

@@ -33,7 +33,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "prometheus";
-  version = "3.4.1";
+  version = "3.4.2";
 
   outputs = [
     "out"
@@ -45,14 +45,14 @@ buildGoModule (finalAttrs: {
     owner = "prometheus";
     repo = "prometheus";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qF4yXBNAdcndwbXEmDPIhG16agvhqKUVB9ajOsvpgrg=";
+    hash = "sha256-/JeT8+I/jNE7O2YT9qfu7RF3xculPyR3rRrFQIG4YV4=";
   };
 
   vendorHash = "sha256-edR9vvSNexRR8EGEiSCIIYl3ndGckS8XuIWojPrq60U=";
 
   webUiStatic = fetchurl {
     url = "https://github.com/prometheus/prometheus/releases/download/v${finalAttrs.version}/prometheus-web-ui-${finalAttrs.version}.tar.gz";
-    hash = "sha256-GBKjrmlQi+DHtbKICc3pO8IMVdu3IUXh/DTwvd/ArWE=";
+    hash = "sha256-3aXP79aeA/qe99sVsJn0nNRggrzFWTmaRO3dBzOR6UU=";
   };
 
   excludedPackages = [

pkgs/by-name/qo/qownnotes/package.nix

@@ -18,11 +18,11 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "qownnotes";
   appname = "QOwnNotes";
-  version = "25.6.4";
+  version = "25.6.5";
 
   src = fetchurl {
     url = "https://github.com/pbek/QOwnNotes/releases/download/v${finalAttrs.version}/qownnotes-${finalAttrs.version}.tar.xz";
-    hash = "sha256-CL/jrWdyBpE27MuyjMaSO7ofzrCihXie15xbuWVjS28=";
+    hash = "sha256-P53v7Zcx6TtCRyFUTea9tpYTFx6DpXL5R60uH8qcbXk=";
   };
 
   nativeBuildInputs =

pkgs/by-name/qq/qq/sources.nix

@@ -1,12 +1,12 @@
 # Generated by ./update.sh - do not update manually!
-# Last updated: 2025-06-17
+# Last updated: 2025-06-28
 { fetchurl }:
 let
   any-darwin = {
-    version = "6.9.75-2025.6.16";
+    version = "6.9.75-2025.6.26";
     src = fetchurl {
-      url = "https://dldir1v6.qq.com/qqfile/qq/QQNT/Mac/QQ_6.9.75_250616_01.dmg";
-      hash = "sha256-MS2WGrAuBGlbzzxfUlcixoD1snchEaLu4Ecvt84Hdfo=";
+      url = "https://dldir1v6.qq.com/qqfile/qq/QQNT/Mac/QQ_6.9.75_250626_01.dmg";
+      hash = "sha256-tWT0R88tXz0ypPQTDzASrh4znvBvq/ohBhpeDv2PlVc=";
     };
   };
 in
@@ -14,17 +14,17 @@ in
   aarch64-darwin = any-darwin;
   x86_64-darwin = any-darwin;
   aarch64-linux = {
-    version = "3.2.18-2025.6.16";
+    version = "3.2.18-2025.6.26";
     src = fetchurl {
-      url = "https://dldir1v6.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.18_250616_arm64_01.deb";
-      hash = "sha256-wwZC+hyyrmmjhlk4hdJTnf5WkRxjit6smUmD4jPKbM0=";
+      url = "https://dldir1v6.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.18_250626_arm64_01.deb";
+      hash = "sha256-7teJWRvvz5baJsaHmOwnkLgBcBxWOUCGpV2+MHH7Tic=";
     };
   };
   x86_64-linux = {
-    version = "3.2.18-2025.6.16";
+    version = "3.2.18-2025.6.26";
     src = fetchurl {
-      url = "https://dldir1v6.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.18_250616_amd64_01.deb";
-      hash = "sha256-7/c1PwlcWogXO229e7f1gYWktCT+hpyQI1+22TkvzLQ=";
+      url = "https://dldir1v6.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.18_250626_amd64_01.deb";
+      hash = "sha256-xEw6tE+qX90XQS3e2MTudeUJNfx25hwgq1YFROHqfng=";
     };
   };
 }

pkgs/by-name/qv/qview/package.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "qview";
-  version = "6.1";
+  version = "7.0";
 
   src = fetchFromGitHub {
     owner = "jurplel";
     repo = "qView";
     rev = version;
-    hash = "sha256-h1K1Smfy875NoHtgUrOvZZp0IgcQdbyuQhXU9ndM4bA=";
+    hash = "sha256-kFptDhmFu9LX99P6pCfxRbu4iVhWl4br+n6LO+yrGsw=";
   };
 
   qmakeFlags = lib.optionals (!x11Support) [ "CONFIG+=NO_X11" ];

pkgs/by-name/re/renderdoc/package.nix

@@ -13,7 +13,7 @@
   nix-update-script,
   pcre,
   pkg-config,
-  python3Packages,
+  # python3Packages.shiboken2 is currently broken
   python312Packages,
   qt5,
   stdenv,
@@ -24,9 +24,6 @@
 }:
 
 let
-  pythonPackages' =
-    # lib.meta.availableOn does not respect meta.broken?
-    if python3Packages.shiboken2.meta.available then python3Packages else python312Packages;
   custom_swig = fetchFromGitHub {
     owner = "baldurk";
     repo = "swig";
@@ -55,9 +52,9 @@ stdenv.mkDerivation (finalAttrs: {
     [
       libXdmcp
       libpthreadstubs
-      pythonPackages'.pyside2
-      pythonPackages'.pyside2-tools
-      pythonPackages'.shiboken2
+      python312Packages.pyside2
+      python312Packages.pyside2-tools
+      python312Packages.shiboken2
       qt5.qtbase
       qt5.qtsvg
       vulkan-loader
@@ -75,7 +72,7 @@ stdenv.mkDerivation (finalAttrs: {
     makeWrapper
     pcre
     pkg-config
-    pythonPackages'.python
+    python312Packages.python
     qt5.qtx11extras
     qt5.wrapQtAppsHook
   ];
@@ -86,7 +83,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeFeature "BUILD_VERSION_DIST_VER" finalAttrs.version)
     (lib.cmakeFeature "BUILD_VERSION_DIST_CONTACT" "https://github.com/NixOS/nixpkgs/")
     (lib.cmakeBool "BUILD_VERSION_STABLE" true)
-    (lib.cmakeBool "ENABLE_WAYLAND" waylandSupport)
+    (lib.cmakeBool "ENABLE_UNSUPPORTED_EXPERIMENTAL_POSSIBLY_BROKEN_WAYLAND" waylandSupport)
   ];
 
   dontWrapQtApps = true;
@@ -117,6 +114,7 @@ stdenv.mkDerivation (finalAttrs: {
     in
     ''
       wrapQtApp $out/bin/qrenderdoc \
+        --set QT_QPA_PLATFORM "wayland;xcb" \
         --suffix LD_LIBRARY_PATH : "$out/lib:${libPath}"
       wrapProgram $out/bin/renderdoccmd \
         --suffix LD_LIBRARY_PATH : "$out/lib:${libPath}"
@@ -141,7 +139,10 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     license = lib.licenses.mit;
     mainProgram = "renderdoccmd";
-    maintainers = with lib.maintainers; [ pbsds ];
+    maintainers = with lib.maintainers; [
+      pbsds
+      ShyAssassin
+    ];
     platforms = lib.intersectLists lib.platforms.linux (lib.platforms.x86_64 ++ lib.platforms.i686);
   };
 })

pkgs/by-name/ru/ruff/package.nix

@@ -16,19 +16,19 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ruff";
-  version = "0.12.0";
+  version = "0.12.1";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "ruff";
     tag = finalAttrs.version;
-    hash = "sha256-g3fodKPDV4UaqnRalG5tEu4acvyhuoDXUevSQeHunBY=";
+    hash = "sha256-iD9avLPPT8V6ZU1qoWEqPLp8jDk/EhcaTk7FtKLRsyM=";
   };
 
   cargoBuildFlags = [ "--package=ruff" ];
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-GNBQ522FX7Yly963/msRfiYKybpk+XDmn1rujfbO22A=";
+  cargoHash = "sha256-GICd8yQlh3gcxLh1Rfc3xB6rZ8ZsbCAk5C577l5+ogk=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/ru/rutabaga_gfx/package.nix

@@ -92,8 +92,16 @@ stdenv.mkDerivation (finalAttrs: {
     description = "cross-platform abstraction for GPU and display virtualization";
     license = licenses.bsd3;
     maintainers = with maintainers; [ qyliss ];
-    platforms = platforms.darwin ++ platforms.linux;
-    # error[E0432]: unresolved import `self::consts`
-    badPlatforms = [ "loongarch64-linux" ];
+    platforms = [
+      # src/generated/virgl_debug_callback_bindings.rs
+      "aarch64-darwin"
+      "aarch64-linux"
+      "armv5tel-linux"
+      "armv6l-linux"
+      "armv7a-linux"
+      "armv7l-linux"
+      "x86_64-darwin"
+      "x86_64-linux"
+    ];
   };
 })

pkgs/by-name/sd/SDL2_sound/package.nix

@@ -2,53 +2,57 @@
   stdenv,
   lib,
   fetchFromGitHub,
-  fetchpatch,
   cmake,
   SDL2,
-  flac,
-  libmikmod,
-  libvorbis,
-  timidity,
+  nix-update-script,
 }:
 
-stdenv.mkDerivation rec {
+# As of 2025-06-27 this library has no dependents in nixpkgs (https://github.com/NixOS/nixpkgs/pull/420339) and is
+# considered for deletion.
+stdenv.mkDerivation (finalAttrs: {
   pname = "SDL2_sound";
-  version = "2.0.1";
+  version = "2.0.4";
 
   src = fetchFromGitHub {
     owner = "icculus";
     repo = "SDL_sound";
-    rev = "v${version}";
-    hash = "sha256-N2znqy58tMHgYa07vEsSedWLRhoJzDoINcsUu0UYLnA=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-5t2ELm8d8IX+cIJqGl/8sffwXGj5Cm0kZI6+bmjvvPg=";
   };
 
-  patches = [
-    (fetchpatch {
-      # https://github.com/icculus/SDL_sound/pull/32 - fix build on darwin
-      # can be dropped on the next update
-      url = "https://github.com/icculus/SDL_sound/commit/c15d75b7720113b28639baad284f45f943846294.patch";
-      hash = "sha256-4GL8unsZ7eNkzjLXq9QdaxFQMzX2tdP0cBR1jTaRLc0=";
-    })
+  outputs = [
+    "out"
+    "lib"
+    "dev"
   ];
 
   nativeBuildInputs = [ cmake ];
 
-  cmakeFlags = [ "-DSDLSOUND_DECODER_MIDI=1" ];
-
-  buildInputs = [
-    SDL2
-    flac
-    libmikmod
-    libvorbis
-    timidity
+  cmakeFlags = [
+    (lib.cmakeBool "SDLSOUND_DECODER_MIDI" true)
+    (lib.cmakeBool "SDLSOUND_BUILD_SHARED" (!stdenv.hostPlatform.isStatic))
+    (lib.cmakeBool "SDLSOUND_BUILD_STATIC" stdenv.hostPlatform.isStatic)
   ];
 
-  meta = with lib; {
+  buildInputs = [ SDL2 ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     description = "SDL2 sound library";
     mainProgram = "playsound";
-    platforms = platforms.unix;
-    license = licenses.zlib;
+    platforms = lib.platforms.all;
+    license = with lib.licenses; [
+      zlib
+
+      # various vendored decoders
+      publicDomain
+
+      # timidity
+      artistic1
+      lgpl21Only
+    ];
     teams = [ lib.teams.sdl ];
     homepage = "https://www.icculus.org/SDL_sound/";
   };
-}
+})

pkgs/by-name/se/seafile-shared/package.nix

@@ -25,6 +25,10 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-IpRCgPxYy1El4EEvVEfzAlbxP/osQUb7pCP3/BhkecU=";
   };
 
+  postPatch = ''
+    substituteInPlace scripts/breakpad.py --replace-fail "from __future__ import print_function" ""
+  '';
+
   nativeBuildInputs = [
     libwebsockets
     autoreconfHook
@@ -48,7 +52,6 @@ stdenv.mkDerivation rec {
   ];
 
   pythonPath = with python3.pkgs; [
-    future
     pysearpc
   ];
 
@@ -56,12 +59,12 @@ stdenv.mkDerivation rec {
     wrapPythonPrograms
   '';
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/haiwen/seafile";
     description = "Shared components of Seafile: seafile-daemon, libseafile, libseafile python bindings, manuals, and icons";
-    license = licenses.gpl2Plus;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [
       schmittlauch
     ];
   };

pkgs/by-name/se/seahub/package.nix

@@ -26,7 +26,6 @@ python3.pkgs.buildPythonApplication rec {
 
   propagatedBuildInputs = with python3.pkgs; [
     django
-    future
     django-compressor
     django-statici18n
     django-webpack-loader
@@ -57,6 +56,8 @@ python3.pkgs.buildPythonApplication rec {
 
   postPatch = ''
     substituteInPlace seahub/settings.py --replace-fail "SEAFILE_VERSION = '6.3.3'" "SEAFILE_VERSION = '${version}'"
+    substituteInPlace thirdpart/constance/management/commands/constance.py --replace-fail \
+        "from __future__ import unicode_literals" ""
   '';
 
   installPhase = ''
@@ -74,14 +75,14 @@ python3.pkgs.buildPythonApplication rec {
     inherit seafile-server;
   };
 
-  meta = with lib; {
+  meta = {
     description = "Web end of seafile server";
     homepage = "https://github.com/haiwen/seahub";
-    license = licenses.asl20;
-    maintainers = with maintainers; [
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
       schmittlauch
       melvyn2
     ];
-    platforms = platforms.linux;
+    platforms = lib.platforms.linux;
   };
 }

pkgs/by-name/se/serenityos-emoji-font/package.nix

@@ -0,0 +1,112 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  fetchzip,
+  python3Packages,
+  fetchpatch2,
+  parallel,
+}:
+let
+
+  pixart2svg = stdenvNoCC.mkDerivation {
+    name = "pixart2svg";
+    version = "0-unstable-2021-07-18";
+
+    src = fetchzip {
+      name = "pixart2svg";
+      url = "https://gist.github.com/m13253/66284bc244deeff0f0f8863c206421c7/archive/f9454958dc0a33cea787cc6fbd7e8e34ba6eb23b.zip";
+      hash = "sha256-lNA3qWK/bnUcMM/jrCGEgaX+HAk/DjKJnkE8niYmBDU=";
+    };
+
+    patches =
+      let
+        urlFor =
+          name:
+          "https://raw.githubusercontent.com/linusg/serenityos-emoji-font/11c84f33777a5d5bbe97ef2ffe8b74af7d72d27f/patches/${name}.patch";
+      in
+      [
+        (fetchpatch2 {
+          url = urlFor "0001-pixart2svg-rgba";
+          extraPrefix = "./";
+          hash = "sha256-/4a6btqp/6yiBnFhr4vI+SWfOopUjzDfOeW1Fs6Z5yU=";
+        })
+        (fetchpatch2 {
+          url = urlFor "0002-pixart2svg-no-style";
+          extraPrefix = "./";
+          hash = "sha256-FVurs+bEOat74d2egl21JS5ywdkFKKIsqXSFGSJI8MI=";
+        })
+        (fetchpatch2 {
+          url = urlFor "0003-pixart2svg-imageio-deprecation-warning";
+          extraPrefix = "./";
+          hash = "sha256-Vo3JIcXof+AtuEbsczNS3CUaBUEncCR0pnIuY4uF7R4=";
+        })
+      ];
+
+    installPhase = ''
+      mkdir -p $out
+      cp ./pixart2svg.py $out
+    '';
+  };
+
+in
+stdenvNoCC.mkDerivation {
+  name = "serenityos-emoji-font";
+  version = "0-unstable-2025-05-31";
+
+  src = fetchFromGitHub {
+    name = "serenity";
+    owner = "SerenityOS";
+    repo = "serenity";
+    rev = "35fd7a6770144259a05d41dfffbc8092495c4bf2";
+    hash = "sha256-i48egESwQKhcEAObSg2zqubgNdkXE5FlNa+Jukvg2X8=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs =
+    [
+      pixart2svg
+      parallel
+    ]
+    ++ (with python3Packages; [
+      imageio
+      nanoemoji
+      numpy
+    ]);
+
+  buildPhase = ''
+    runHook preBuild
+
+    mkdir -p svgfiles
+
+    total=$(ls -1 Base/res/emoji/*.png | wc -l)
+
+    parallel -j$NIX_BUILD_CORES \
+      echo [{#}/$total] Converting {/} \; python3 ${pixart2svg}/pixart2svg.py {} svgfiles/{/.}.svg \
+      ::: Base/res/emoji/*.png;
+
+    nanoemoji --family "SerenityOS Emoji" --output_file "SerenityOS-Emoji.ttf" --color_format glyf_colr_1 svgfiles/*.svg
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/fonts/truetype
+    cp build/SerenityOS-Emoji.ttf $out/share/fonts/truetype
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "SerenityOS pixel art emojis as a TTF";
+    homepage = "https://emoji.serenityos.org/";
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [
+      voidnoi
+    ];
+    platforms = lib.platforms.all;
+  };
+}

pkgs/by-name/sh/shaperglot-cli/package.nix

@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "shaperglot-cli";
-  version = "0-unstable-2025-05-30";
+  version = "0-unstable-2025-06-20";
 
   src = fetchFromGitHub {
     owner = "googlefonts";
     repo = "shaperglot";
-    rev = "92878be90fabb7bdd93afd81121f4ed885f33d06";
-    hash = "sha256-Hrl/SVmRCEJLk+MR5fA4H0MTjy9hGgrM/HvAK3/lLIc=";
+    rev = "0c521f32f8fe5c927a4aac2236307547fa281972";
+    hash = "sha256-V7eBt0m82mW4NALWZeYVJD4TeU5l0kaOJPyDFxRSIUs=";
   };
 
-  cargoHash = "sha256-bWdO3YCWxKwgGjDdquY9COT5Ma2rRloOyWj51JZ45BE=";
+  cargoHash = "sha256-19amPodlTIxuBue8UT5PfWHUe4evmJsAHcrIAx6YVSk=";
 
   cargoBuildFlags = [
     "--package=shaperglot-cli"

pkgs/by-name/sh/shopify-cli/manifests/package-lock.json

@@ -1,40 +1,43 @@
 {
   "name": "shopify",
-  "version": "3.69.3",
+  "version": "3.81.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "shopify",
-      "version": "3.69.3",
+      "version": "3.81.2",
       "dependencies": {
-        "@shopify/cli": "3.69.3"
+        "@shopify/cli": "3.81.2"
       },
       "bin": {
         "shopify": "node_modules/@shopify/cli/bin/run.js"
       }
     },
     "node_modules/@ast-grep/napi": {
-      "version": "0.11.0",
-      "resolved": "https://registry.npmjs.org/@ast-grep/napi/-/napi-0.11.0.tgz",
-      "integrity": "sha512-b+R8h20+ClsYZBJqcyguLy4THfGmg2a54HgfZ0a1vdCkfe9ftjblALiZf2DsOc0+Si8BDWd09TMNn2psUuibJA==",
+      "version": "0.33.0",
+      "resolved": "https://registry.npmjs.org/@ast-grep/napi/-/napi-0.33.0.tgz",
+      "integrity": "sha512-6heRMmomhSD0dkummRQ+R4xWXXmc41OaDPoPI49mKJXPyvwJPdPZUcQjXdIitOVL4uJV+qM2ZBucDPENDBSixw==",
       "license": "MIT",
       "engines": {
         "node": ">= 10"
       },
       "optionalDependencies": {
-        "@ast-grep/napi-darwin-arm64": "0.11.0",
-        "@ast-grep/napi-darwin-x64": "0.11.0",
-        "@ast-grep/napi-linux-x64-gnu": "0.11.0",
-        "@ast-grep/napi-win32-arm64-msvc": "0.11.0",
-        "@ast-grep/napi-win32-ia32-msvc": "0.11.0",
-        "@ast-grep/napi-win32-x64-msvc": "0.11.0"
+        "@ast-grep/napi-darwin-arm64": "0.33.0",
+        "@ast-grep/napi-darwin-x64": "0.33.0",
+        "@ast-grep/napi-linux-arm64-gnu": "0.33.0",
+        "@ast-grep/napi-linux-arm64-musl": "0.33.0",
+        "@ast-grep/napi-linux-x64-gnu": "0.33.0",
+        "@ast-grep/napi-linux-x64-musl": "0.33.0",
+        "@ast-grep/napi-win32-arm64-msvc": "0.33.0",
+        "@ast-grep/napi-win32-ia32-msvc": "0.33.0",
+        "@ast-grep/napi-win32-x64-msvc": "0.33.0"
       }
     },
     "node_modules/@ast-grep/napi-darwin-arm64": {
-      "version": "0.11.0",
-      "resolved": "https://registry.npmjs.org/@ast-grep/napi-darwin-arm64/-/napi-darwin-arm64-0.11.0.tgz",
-      "integrity": "sha512-IxY3b102tNNm+cYLngZvUKzM1fNKCpDDWz69Yt+QnKCZNx10Hvd7mqrYE2aXTtkaNalmg/p1n6kMA8KmshGgCA==",
+      "version": "0.33.0",
+      "resolved": "https://registry.npmjs.org/@ast-grep/napi-darwin-arm64/-/napi-darwin-arm64-0.33.0.tgz",
+      "integrity": "sha512-FsBQiBNGbqeU6z2sjFgnV6MXuBa0wYUb4PViMnqsKLeWiO7kRii5crmXLCtdTD2hufXTG6Rll8X46AkYOAwGGQ==",
       "cpu": [
         "arm64"
       ],
@@ -48,9 +51,9 @@
       }
     },
     "node_modules/@ast-grep/napi-darwin-x64": {
-      "version": "0.11.0",
-      "resolved": "https://registry.npmjs.org/@ast-grep/napi-darwin-x64/-/napi-darwin-x64-0.11.0.tgz",
-      "integrity": "sha512-6afu1fNUwTkyE7tknVx8+d+BPKVL3623QLI9uJbJ0SZQShzSb1+dRegT4NpzPaPtFdPkflh6KfvOQ4chTw8hUg==",
+      "version": "0.33.0",
+      "resolved": "https://registry.npmjs.org/@ast-grep/napi-darwin-x64/-/napi-darwin-x64-0.33.0.tgz",
+      "integrity": "sha512-rWo1wG7fc7K20z9ExIeN6U4QqjHhoQSpBDDnmxKTR0nIwPfyMq338sS4sWZomutxprcZDtWrekxH1lXjNvfuiA==",
       "cpu": [
         "x64"
       ],
@@ -63,10 +66,58 @@
         "node": ">= 10"
       }
     },
+    "node_modules/@ast-grep/napi-linux-arm64-gnu": {
+      "version": "0.33.0",
+      "resolved": "https://registry.npmjs.org/@ast-grep/napi-linux-arm64-gnu/-/napi-linux-arm64-gnu-0.33.0.tgz",
+      "integrity": "sha512-3ZnA2k57kxfvLg4s9+6rHaCx1FbWt0EF8fumJMf5nwevu7GbVOOhCkzAetZe80FBgZuIOSR4IS2QMj9ZHI0UdQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@ast-grep/napi-linux-arm64-musl": {
+      "version": "0.33.0",
+      "resolved": "https://registry.npmjs.org/@ast-grep/napi-linux-arm64-musl/-/napi-linux-arm64-musl-0.33.0.tgz",
+      "integrity": "sha512-oUGZgCaVCijFgvC+X52ttgoWUqgrIsSVJZgn+1VBY3n4mpzcoYAghFomSUbRTBUL2ebvZweA33Klqks4okY61w==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
     "node_modules/@ast-grep/napi-linux-x64-gnu": {
-      "version": "0.11.0",
-      "resolved": "https://registry.npmjs.org/@ast-grep/napi-linux-x64-gnu/-/napi-linux-x64-gnu-0.11.0.tgz",
-      "integrity": "sha512-Rm0biBfIxg14tL9yAMxW6RngAEA2vYLIq1guff6Uc9Vb7yQ3HE8dnW8WAysyieIqXdVkraTTV2ZwfoUqeKfc1Q==",
+      "version": "0.33.0",
+      "resolved": "https://registry.npmjs.org/@ast-grep/napi-linux-x64-gnu/-/napi-linux-x64-gnu-0.33.0.tgz",
+      "integrity": "sha512-QTAkfxQSsOGRza0hnkeAgJDQqR00iDerRNq42dOGIzgF+Kse491By3UmBEMG4oCbv17yYcBBlknQkzKSKtigjw==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@ast-grep/napi-linux-x64-musl": {
+      "version": "0.33.0",
+      "resolved": "https://registry.npmjs.org/@ast-grep/napi-linux-x64-musl/-/napi-linux-x64-musl-0.33.0.tgz",
+      "integrity": "sha512-PW6bZO7MyQsBNZv0idI/Ah6ak66T8LqZ21wBGjtQp9NDGViOtkLeu+eJJGaZjMqUdidKHKgmMKXksZHl2m8ulQ==",
       "cpu": [
         "x64"
       ],
@@ -80,9 +131,9 @@
       }
     },
     "node_modules/@ast-grep/napi-win32-arm64-msvc": {
-      "version": "0.11.0",
-      "resolved": "https://registry.npmjs.org/@ast-grep/napi-win32-arm64-msvc/-/napi-win32-arm64-msvc-0.11.0.tgz",
-      "integrity": "sha512-TfX6KXxtXGQS/sWzJ1wWwWbpm3OJWpqiWGttpifSGs6DJmzfwuK0b63yX5JlhNXeUVqXkZyfYqIh5RPIPOtXSA==",
+      "version": "0.33.0",
+      "resolved": "https://registry.npmjs.org/@ast-grep/napi-win32-arm64-msvc/-/napi-win32-arm64-msvc-0.33.0.tgz",
+      "integrity": "sha512-ijmFQcFc32JOIQlSfnhDJpb3qFb2RhrRqfeY0EHHN1xRSGwZHfsHTSS66nKR2sREmxTIMgxXOtylKicbyyMVKA==",
       "cpu": [
         "arm64"
       ],
@@ -96,9 +147,9 @@
       }
     },
     "node_modules/@ast-grep/napi-win32-ia32-msvc": {
-      "version": "0.11.0",
-      "resolved": "https://registry.npmjs.org/@ast-grep/napi-win32-ia32-msvc/-/napi-win32-ia32-msvc-0.11.0.tgz",
-      "integrity": "sha512-oQGbxYYfQn6LPbMKQ1T2cjQ+DelYDO06w/gFPmdWrE6M/YUIv+KfKdEscBkr3ehJyvXZW5h3vmxuApiMuCyfAQ==",
+      "version": "0.33.0",
+      "resolved": "https://registry.npmjs.org/@ast-grep/napi-win32-ia32-msvc/-/napi-win32-ia32-msvc-0.33.0.tgz",
+      "integrity": "sha512-NNIb2VK3Z2BwKp0QJSw8gkhwOUp85SgTsxJ38p+wIUAA/KzAKCJOmyOaZ301qGHt4gL+jTHgTIvJJX+9eT/REg==",
       "cpu": [
         "ia32"
       ],
@@ -112,9 +163,9 @@
       }
     },
     "node_modules/@ast-grep/napi-win32-x64-msvc": {
-      "version": "0.11.0",
-      "resolved": "https://registry.npmjs.org/@ast-grep/napi-win32-x64-msvc/-/napi-win32-x64-msvc-0.11.0.tgz",
-      "integrity": "sha512-qrXI4+S8W7IF6e1nlDYX2KfdzxGHyAOj5kGvWk+TqBuAnA0rWQ513hJzdviiGpbB5VPnJkEhOVsDets8acKd6w==",
+      "version": "0.33.0",
+      "resolved": "https://registry.npmjs.org/@ast-grep/napi-win32-x64-msvc/-/napi-win32-x64-msvc-0.33.0.tgz",
+      "integrity": "sha512-gW7viQQjdPA1HoCkpCqoonC81TOwcpP828w/XqZFE/L6uhD8SF2usul8KNBQOiX3O7/fqYEOnbtWMCrwZIqG1Q==",
       "cpu": [
         "x64"
       ],
@@ -127,10 +178,26 @@
         "node": ">= 10"
       }
     },
+    "node_modules/@esbuild/aix-ppc64": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.25.5.tgz",
+      "integrity": "sha512-9o3TMmpmftaCMepOdA5k/yDw8SfInyzWWTjYTFCX3kPSDJMROQTb8jg+h9Cnwnmm1vOzvxN7gIfB5V2ewpjtGA==",
+      "cpu": [
+        "ppc64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "aix"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/@esbuild/android-arm": {
-      "version": "0.19.8",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.19.8.tgz",
-      "integrity": "sha512-31E2lxlGM1KEfivQl8Yf5aYU/mflz9g06H6S15ITUFQueMFtFjESRMoDSkvMo8thYvLBax+VKTPlpnx+sPicOA==",
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.25.5.tgz",
+      "integrity": "sha512-AdJKSPeEHgi7/ZhuIPtcQKr5RQdo6OO2IL87JkianiMYMPbCtot9fxPbrMiBADOWWm3T2si9stAiVsGbTQFkbA==",
       "cpu": [
         "arm"
       ],
@@ -140,13 +207,13 @@
         "android"
       ],
       "engines": {
-        "node": ">=12"
+        "node": ">=18"
       }
     },
     "node_modules/@esbuild/android-arm64": {
-      "version": "0.19.8",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.19.8.tgz",
-      "integrity": "sha512-B8JbS61bEunhfx8kasogFENgQfr/dIp+ggYXwTqdbMAgGDhRa3AaPpQMuQU0rNxDLECj6FhDzk1cF9WHMVwrtA==",
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.25.5.tgz",
+      "integrity": "sha512-VGzGhj4lJO+TVGV1v8ntCZWJktV7SGCs3Pn1GRWI1SBFtRALoomm8k5E9Pmwg3HOAal2VDc2F9+PM/rEY6oIDg==",
       "cpu": [
         "arm64"
       ],
@@ -156,13 +223,13 @@
         "android"
       ],
       "engines": {
-        "node": ">=12"
+        "node": ">=18"
       }
     },
     "node_modules/@esbuild/android-x64": {
-      "version": "0.19.8",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.19.8.tgz",
-      "integrity": "sha512-rdqqYfRIn4jWOp+lzQttYMa2Xar3OK9Yt2fhOhzFXqg0rVWEfSclJvZq5fZslnz6ypHvVf3CT7qyf0A5pM682A==",
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.25.5.tgz",
+      "integrity": "sha512-D2GyJT1kjvO//drbRT3Hib9XPwQeWd9vZoBJn+bu/lVsOZ13cqNdDeqIF/xQ5/VmWvMduP6AmXvylO/PIc2isw==",
       "cpu": [
         "x64"
       ],
@@ -172,13 +239,13 @@
         "android"
       ],
       "engines": {
-        "node": ">=12"
+        "node": ">=18"
       }
     },
     "node_modules/@esbuild/darwin-arm64": {
-      "version": "0.19.8",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.19.8.tgz",
-      "integrity": "sha512-RQw9DemMbIq35Bprbboyf8SmOr4UXsRVxJ97LgB55VKKeJOOdvsIPy0nFyF2l8U+h4PtBx/1kRf0BelOYCiQcw==",
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.25.5.tgz",
+      "integrity": "sha512-GtaBgammVvdF7aPIgH2jxMDdivezgFu6iKpmT+48+F8Hhg5J/sfnDieg0aeG/jfSvkYQU2/pceFPDKlqZzwnfQ==",
       "cpu": [
         "arm64"
       ],
@@ -188,13 +255,13 @@
         "darwin"
       ],
       "engines": {
-        "node": ">=12"
+        "node": ">=18"
       }
     },
     "node_modules/@esbuild/darwin-x64": {
-      "version": "0.19.8",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.19.8.tgz",
-      "integrity": "sha512-3sur80OT9YdeZwIVgERAysAbwncom7b4bCI2XKLjMfPymTud7e/oY4y+ci1XVp5TfQp/bppn7xLw1n/oSQY3/Q==",
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.25.5.tgz",
+      "integrity": "sha512-1iT4FVL0dJ76/q1wd7XDsXrSW+oLoquptvh4CLR4kITDtqi2e/xwXwdCVH8hVHU43wgJdsq7Gxuzcs6Iq/7bxQ==",
       "cpu": [
         "x64"
       ],
@@ -204,13 +271,13 @@
         "darwin"
       ],
       "engines": {
-        "node": ">=12"
+        "node": ">=18"
       }
     },
     "node_modules/@esbuild/freebsd-arm64": {
-      "version": "0.19.8",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.19.8.tgz",
-      "integrity": "sha512-WAnPJSDattvS/XtPCTj1tPoTxERjcTpH6HsMr6ujTT+X6rylVe8ggxk8pVxzf5U1wh5sPODpawNicF5ta/9Tmw==",
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.25.5.tgz",
+      "integrity": "sha512-nk4tGP3JThz4La38Uy/gzyXtpkPW8zSAmoUhK9xKKXdBCzKODMc2adkB2+8om9BDYugz+uGV7sLmpTYzvmz6Sw==",
       "cpu": [
         "arm64"
       ],
@@ -220,13 +287,13 @@
         "freebsd"
       ],
       "engines": {
-        "node": ">=12"
+        "node": ">=18"
       }
     },
     "node_modules/@esbuild/freebsd-x64": {
-      "version": "0.19.8",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.19.8.tgz",
-      "integrity": "sha512-ICvZyOplIjmmhjd6mxi+zxSdpPTKFfyPPQMQTK/w+8eNK6WV01AjIztJALDtwNNfFhfZLux0tZLC+U9nSyA5Zg==",
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.25.5.tgz",
+      "integrity": "sha512-PrikaNjiXdR2laW6OIjlbeuCPrPaAl0IwPIaRv+SMV8CiM8i2LqVUHFC1+8eORgWyY7yhQY+2U2fA55mBzReaw==",
       "cpu": [
         "x64"
       ],
@@ -236,13 +303,13 @@
         "freebsd"
       ],
       "engines": {
-        "node": ">=12"
+        "node": ">=18"
       }
     },
     "node_modules/@esbuild/linux-arm": {
-      "version": "0.19.8",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.19.8.tgz",
-      "integrity": "sha512-H4vmI5PYqSvosPaTJuEppU9oz1dq2A7Mr2vyg5TF9Ga+3+MGgBdGzcyBP7qK9MrwFQZlvNyJrvz6GuCaj3OukQ==",
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.25.5.tgz",
+      "integrity": "sha512-cPzojwW2okgh7ZlRpcBEtsX7WBuqbLrNXqLU89GxWbNt6uIg78ET82qifUy3W6OVww6ZWobWub5oqZOVtwolfw==",
       "cpu": [
         "arm"
       ],
@@ -252,13 +319,13 @@
         "linux"
       ],
       "engines": {
-        "node": ">=12"
+        "node": ">=18"
       }
     },
     "node_modules/@esbuild/linux-arm64": {
-      "version": "0.19.8",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.19.8.tgz",
-      "integrity": "sha512-z1zMZivxDLHWnyGOctT9JP70h0beY54xDDDJt4VpTX+iwA77IFsE1vCXWmprajJGa+ZYSqkSbRQ4eyLCpCmiCQ==",
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.25.5.tgz",
+      "integrity": "sha512-Z9kfb1v6ZlGbWj8EJk9T6czVEjjq2ntSYLY2cw6pAZl4oKtfgQuS4HOq41M/BcoLPzrUbNd+R4BXFyH//nHxVg==",
       "cpu": [
         "arm64"
       ],
@@ -268,13 +335,13 @@
         "linux"
       ],
       "engines": {
-        "node": ">=12"
+        "node": ">=18"
       }
     },
     "node_modules/@esbuild/linux-ia32": {
-      "version": "0.19.8",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.19.8.tgz",
-      "integrity": "sha512-1a8suQiFJmZz1khm/rDglOc8lavtzEMRo0v6WhPgxkrjcU0LkHj+TwBrALwoz/OtMExvsqbbMI0ChyelKabSvQ==",
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.25.5.tgz",
+      "integrity": "sha512-sQ7l00M8bSv36GLV95BVAdhJ2QsIbCuCjh/uYrWiMQSUuV+LpXwIqhgJDcvMTj+VsQmqAHL2yYaasENvJ7CDKA==",
       "cpu": [
         "ia32"
       ],
@@ -284,13 +351,13 @@
         "linux"
       ],
       "engines": {
-        "node": ">=12"
+        "node": ">=18"
       }
     },
     "node_modules/@esbuild/linux-loong64": {
-      "version": "0.19.8",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.19.8.tgz",
-      "integrity": "sha512-fHZWS2JJxnXt1uYJsDv9+b60WCc2RlvVAy1F76qOLtXRO+H4mjt3Tr6MJ5l7Q78X8KgCFudnTuiQRBhULUyBKQ==",
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.25.5.tgz",
+      "integrity": "sha512-0ur7ae16hDUC4OL5iEnDb0tZHDxYmuQyhKhsPBV8f99f6Z9KQM02g33f93rNH5A30agMS46u2HP6qTdEt6Q1kg==",
       "cpu": [
         "loong64"
       ],
@@ -300,13 +367,13 @@
         "linux"
       ],
       "engines": {
-        "node": ">=12"
+        "node": ">=18"
       }
     },
     "node_modules/@esbuild/linux-mips64el": {
-      "version": "0.19.8",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.19.8.tgz",
-      "integrity": "sha512-Wy/z0EL5qZYLX66dVnEg9riiwls5IYnziwuju2oUiuxVc+/edvqXa04qNtbrs0Ukatg5HEzqT94Zs7J207dN5Q==",
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.25.5.tgz",
+      "integrity": "sha512-kB/66P1OsHO5zLz0i6X0RxlQ+3cu0mkxS3TKFvkb5lin6uwZ/ttOkP3Z8lfR9mJOBk14ZwZ9182SIIWFGNmqmg==",
       "cpu": [
         "mips64el"
       ],
@@ -316,13 +383,13 @@
         "linux"
       ],
       "engines": {
-        "node": ">=12"
+        "node": ">=18"
       }
     },
     "node_modules/@esbuild/linux-ppc64": {
-      "version": "0.19.8",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.19.8.tgz",
-      "integrity": "sha512-ETaW6245wK23YIEufhMQ3HSeHO7NgsLx8gygBVldRHKhOlD1oNeNy/P67mIh1zPn2Hr2HLieQrt6tWrVwuqrxg==",
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.25.5.tgz",
+      "integrity": "sha512-UZCmJ7r9X2fe2D6jBmkLBMQetXPXIsZjQJCjgwpVDz+YMcS6oFR27alkgGv3Oqkv07bxdvw7fyB71/olceJhkQ==",
       "cpu": [
         "ppc64"
       ],
@@ -332,13 +399,13 @@
         "linux"
       ],
       "engines": {
-        "node": ">=12"
+        "node": ">=18"
       }
     },
     "node_modules/@esbuild/linux-riscv64": {
-      "version": "0.19.8",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.19.8.tgz",
-      "integrity": "sha512-T2DRQk55SgoleTP+DtPlMrxi/5r9AeFgkhkZ/B0ap99zmxtxdOixOMI570VjdRCs9pE4Wdkz7JYrsPvsl7eESg==",
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.25.5.tgz",
+      "integrity": "sha512-kTxwu4mLyeOlsVIFPfQo+fQJAV9mh24xL+y+Bm6ej067sYANjyEw1dNHmvoqxJUCMnkBdKpvOn0Ahql6+4VyeA==",
       "cpu": [
         "riscv64"
       ],
@@ -348,13 +415,13 @@
         "linux"
       ],
       "engines": {
-        "node": ">=12"
+        "node": ">=18"
       }
     },
     "node_modules/@esbuild/linux-s390x": {
-      "version": "0.19.8",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.19.8.tgz",
-      "integrity": "sha512-NPxbdmmo3Bk7mbNeHmcCd7R7fptJaczPYBaELk6NcXxy7HLNyWwCyDJ/Xx+/YcNH7Im5dHdx9gZ5xIwyliQCbg==",
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.25.5.tgz",
+      "integrity": "sha512-K2dSKTKfmdh78uJ3NcWFiqyRrimfdinS5ErLSn3vluHNeHVnBAFWC8a4X5N+7FgVE1EjXS1QDZbpqZBjfrqMTQ==",
       "cpu": [
         "s390x"
       ],
@@ -364,13 +431,13 @@
         "linux"
       ],
       "engines": {
-        "node": ">=12"
+        "node": ">=18"
       }
     },
     "node_modules/@esbuild/linux-x64": {
-      "version": "0.19.8",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.19.8.tgz",
-      "integrity": "sha512-lytMAVOM3b1gPypL2TRmZ5rnXl7+6IIk8uB3eLsV1JwcizuolblXRrc5ShPrO9ls/b+RTp+E6gbsuLWHWi2zGg==",
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.25.5.tgz",
+      "integrity": "sha512-uhj8N2obKTE6pSZ+aMUbqq+1nXxNjZIIjCjGLfsWvVpy7gKCOL6rsY1MhRh9zLtUtAI7vpgLMK6DxjO8Qm9lJw==",
       "cpu": [
         "x64"
       ],
@@ -380,13 +447,29 @@
         "linux"
       ],
       "engines": {
-        "node": ">=12"
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/netbsd-arm64": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.25.5.tgz",
+      "integrity": "sha512-pwHtMP9viAy1oHPvgxtOv+OkduK5ugofNTVDilIzBLpoWAM16r7b/mxBvfpuQDpRQFMfuVr5aLcn4yveGvBZvw==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
       }
     },
     "node_modules/@esbuild/netbsd-x64": {
-      "version": "0.19.8",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.19.8.tgz",
-      "integrity": "sha512-hvWVo2VsXz/8NVt1UhLzxwAfo5sioj92uo0bCfLibB0xlOmimU/DeAEsQILlBQvkhrGjamP0/el5HU76HAitGw==",
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.25.5.tgz",
+      "integrity": "sha512-WOb5fKrvVTRMfWFNCroYWWklbnXH0Q5rZppjq0vQIdlsQKuw6mdSihwSo4RV/YdQ5UCKKvBy7/0ZZYLBZKIbwQ==",
       "cpu": [
         "x64"
       ],
@@ -396,13 +479,29 @@
         "netbsd"
       ],
       "engines": {
-        "node": ">=12"
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openbsd-arm64": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.25.5.tgz",
+      "integrity": "sha512-7A208+uQKgTxHd0G0uqZO8UjK2R0DDb4fDmERtARjSHWxqMTye4Erz4zZafx7Di9Cv+lNHYuncAkiGFySoD+Mw==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
       }
     },
     "node_modules/@esbuild/openbsd-x64": {
-      "version": "0.19.8",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.19.8.tgz",
-      "integrity": "sha512-/7Y7u77rdvmGTxR83PgaSvSBJCC2L3Kb1M/+dmSIvRvQPXXCuC97QAwMugBNG0yGcbEGfFBH7ojPzAOxfGNkwQ==",
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.25.5.tgz",
+      "integrity": "sha512-G4hE405ErTWraiZ8UiSoesH8DaCsMm0Cay4fsFWOOUcz8b8rC6uCvnagr+gnioEjWn0wC+o1/TAHt+It+MpIMg==",
       "cpu": [
         "x64"
       ],
@@ -412,13 +511,13 @@
         "openbsd"
       ],
       "engines": {
-        "node": ">=12"
+        "node": ">=18"
       }
     },
     "node_modules/@esbuild/sunos-x64": {
-      "version": "0.19.8",
-      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.19.8.tgz",
-      "integrity": "sha512-9Lc4s7Oi98GqFA4HzA/W2JHIYfnXbUYgekUP/Sm4BG9sfLjyv6GKKHKKVs83SMicBF2JwAX6A1PuOLMqpD001w==",
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.25.5.tgz",
+      "integrity": "sha512-l+azKShMy7FxzY0Rj4RCt5VD/q8mG/e+mDivgspo+yL8zW7qEwctQ6YqKX34DTEleFAvCIUviCFX1SDZRSyMQA==",
       "cpu": [
         "x64"
       ],
@@ -428,13 +527,13 @@
         "sunos"
       ],
       "engines": {
-        "node": ">=12"
+        "node": ">=18"
       }
     },
     "node_modules/@esbuild/win32-arm64": {
-      "version": "0.19.8",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.19.8.tgz",
-      "integrity": "sha512-rq6WzBGjSzihI9deW3fC2Gqiak68+b7qo5/3kmB6Gvbh/NYPA0sJhrnp7wgV4bNwjqM+R2AApXGxMO7ZoGhIJg==",
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.25.5.tgz",
+      "integrity": "sha512-O2S7SNZzdcFG7eFKgvwUEZ2VG9D/sn/eIiz8XRZ1Q/DO5a3s76Xv0mdBzVM5j5R639lXQmPmSo0iRpHqUUrsxw==",
       "cpu": [
         "arm64"
       ],
@@ -444,13 +543,13 @@
         "win32"
       ],
       "engines": {
-        "node": ">=12"
+        "node": ">=18"
       }
     },
     "node_modules/@esbuild/win32-ia32": {
-      "version": "0.19.8",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.19.8.tgz",
-      "integrity": "sha512-AIAbverbg5jMvJznYiGhrd3sumfwWs8572mIJL5NQjJa06P8KfCPWZQ0NwZbPQnbQi9OWSZhFVSUWjjIrn4hSw==",
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.25.5.tgz",
+      "integrity": "sha512-onOJ02pqs9h1iMJ1PQphR+VZv8qBMQ77Klcsqv9CNW2w6yLqoURLcgERAIurY6QE63bbLuqgP9ATqajFLK5AMQ==",
       "cpu": [
         "ia32"
       ],
@@ -460,13 +559,13 @@
         "win32"
       ],
       "engines": {
-        "node": ">=12"
+        "node": ">=18"
       }
     },
     "node_modules/@esbuild/win32-x64": {
-      "version": "0.19.8",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.19.8.tgz",
-      "integrity": "sha512-bfZ0cQ1uZs2PqpulNL5j/3w+GDhP36k1K5c38QdQg+Swy51jFZWWeIkteNsufkQxp986wnqRRsb/bHbY1WQ7TA==",
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.25.5.tgz",
+      "integrity": "sha512-TXv6YnJ8ZMVdX+SXWVBo/0p8LTcrUYngpWjvm91TMjjBQii7Oz11Lw5lbDV5Y0TzuhSJHwiH4hEtC1I42mMS0g==",
       "cpu": [
         "x64"
       ],
@@ -476,13 +575,13 @@
         "win32"
       ],
       "engines": {
-        "node": ">=12"
+        "node": ">=18"
       }
     },
     "node_modules/@shopify/cli": {
-      "version": "3.69.3",
-      "resolved": "https://registry.npmjs.org/@shopify/cli/-/cli-3.69.3.tgz",
-      "integrity": "sha512-tc7gH5EOgDvAuSGazTP4zl0Yj4547gwypyDzmUfxb15PExMpj7lMyIQujKyAGwEfu1+LRF3K13Hfgib1sqvUUQ==",
+      "version": "3.81.2",
+      "resolved": "https://registry.npmjs.org/@shopify/cli/-/cli-3.81.2.tgz",
+      "integrity": "sha512-dX5ILPQ86FIvPdUDoYe4A9Jl2cRQ6vZPCD6uT31mRG1xk7cBy/y4rz8PDSZJnB59LjEmiuJQuWC79bq0F1vXVA==",
       "license": "MIT",
       "os": [
         "darwin",
@@ -490,51 +589,290 @@
         "win32"
       ],
       "dependencies": {
-        "@ast-grep/napi": "0.11.0",
-        "esbuild": "0.19.8"
+        "@ast-grep/napi": "0.33.0",
+        "esbuild": "0.25.5",
+        "global-agent": "3.0.0"
       },
       "bin": {
         "shopify": "bin/run.js"
       },
       "engines": {
-        "node": "^18.20.0 || >=20.10.0"
+        "node": ">=20.10.0"
       }
     },
+    "node_modules/boolean": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/boolean/-/boolean-3.2.0.tgz",
+      "integrity": "sha512-d0II/GO9uf9lfUHH2BQsjxzRJZBdsjgsBiW4BvhWk/3qoKwQFjIDVN19PfX8F2D/r9PCMTtLWjYVCFrpeYUzsw==",
+      "deprecated": "Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.",
+      "license": "MIT"
+    },
+    "node_modules/define-data-property": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/define-data-property/-/define-data-property-1.1.4.tgz",
+      "integrity": "sha512-rBMvIzlpA8v6E+SJZoo++HAYqsLrkg7MSfIinMPFhmkorw7X+dOXVJQs+QT69zGkzMyfDnIMN2Wid1+NbL3T+A==",
+      "license": "MIT",
+      "dependencies": {
+        "es-define-property": "^1.0.0",
+        "es-errors": "^1.3.0",
+        "gopd": "^1.0.1"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/define-properties": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/define-properties/-/define-properties-1.2.1.tgz",
+      "integrity": "sha512-8QmQKqEASLd5nx0U1B1okLElbUuuttJ/AnYmRXbbbGDWh6uS208EjD4Xqq/I9wK7u0v6O08XhTWnt5XtEbR6Dg==",
+      "license": "MIT",
+      "dependencies": {
+        "define-data-property": "^1.0.1",
+        "has-property-descriptors": "^1.0.0",
+        "object-keys": "^1.1.1"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/detect-node": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/detect-node/-/detect-node-2.1.0.tgz",
+      "integrity": "sha512-T0NIuQpnTvFDATNuHN5roPwSBG83rFsuO+MXXH9/3N1eFbn4wcPjttvjMLEPWJ0RGUYgQE7cGgS3tNxbqCGM7g==",
+      "license": "MIT"
+    },
+    "node_modules/es-define-property": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
+      "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-errors": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz",
+      "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es6-error": {
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/es6-error/-/es6-error-4.1.1.tgz",
+      "integrity": "sha512-Um/+FxMr9CISWh0bi5Zv0iOD+4cFh5qLeks1qhAopKVAJw3drgKbKySikp7wGhDL0HPeaja0P5ULZrxLkniUVg==",
+      "license": "MIT"
+    },
     "node_modules/esbuild": {
-      "version": "0.19.8",
-      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.19.8.tgz",
-      "integrity": "sha512-l7iffQpT2OrZfH2rXIp7/FkmaeZM0vxbxN9KfiCwGYuZqzMg/JdvX26R31Zxn/Pxvsrg3Y9N6XTcnknqDyyv4w==",
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.25.5.tgz",
+      "integrity": "sha512-P8OtKZRv/5J5hhz0cUAdu/cLuPIKXpQl1R9pZtvmHWQvrAUVd0UNIPT4IB4W3rNOqVO0rlqHmCIbSwxh/c9yUQ==",
       "hasInstallScript": true,
       "license": "MIT",
       "bin": {
         "esbuild": "bin/esbuild"
       },
       "engines": {
-        "node": ">=12"
+        "node": ">=18"
       },
       "optionalDependencies": {
-        "@esbuild/android-arm": "0.19.8",
-        "@esbuild/android-arm64": "0.19.8",
-        "@esbuild/android-x64": "0.19.8",
-        "@esbuild/darwin-arm64": "0.19.8",
-        "@esbuild/darwin-x64": "0.19.8",
-        "@esbuild/freebsd-arm64": "0.19.8",
-        "@esbuild/freebsd-x64": "0.19.8",
-        "@esbuild/linux-arm": "0.19.8",
-        "@esbuild/linux-arm64": "0.19.8",
-        "@esbuild/linux-ia32": "0.19.8",
-        "@esbuild/linux-loong64": "0.19.8",
-        "@esbuild/linux-mips64el": "0.19.8",
-        "@esbuild/linux-ppc64": "0.19.8",
-        "@esbuild/linux-riscv64": "0.19.8",
-        "@esbuild/linux-s390x": "0.19.8",
-        "@esbuild/linux-x64": "0.19.8",
-        "@esbuild/netbsd-x64": "0.19.8",
-        "@esbuild/openbsd-x64": "0.19.8",
-        "@esbuild/sunos-x64": "0.19.8",
-        "@esbuild/win32-arm64": "0.19.8",
-        "@esbuild/win32-ia32": "0.19.8",
-        "@esbuild/win32-x64": "0.19.8"
+        "@esbuild/aix-ppc64": "0.25.5",
+        "@esbuild/android-arm": "0.25.5",
+        "@esbuild/android-arm64": "0.25.5",
+        "@esbuild/android-x64": "0.25.5",
+        "@esbuild/darwin-arm64": "0.25.5",
+        "@esbuild/darwin-x64": "0.25.5",
+        "@esbuild/freebsd-arm64": "0.25.5",
+        "@esbuild/freebsd-x64": "0.25.5",
+        "@esbuild/linux-arm": "0.25.5",
+        "@esbuild/linux-arm64": "0.25.5",
+        "@esbuild/linux-ia32": "0.25.5",
+        "@esbuild/linux-loong64": "0.25.5",
+        "@esbuild/linux-mips64el": "0.25.5",
+        "@esbuild/linux-ppc64": "0.25.5",
+        "@esbuild/linux-riscv64": "0.25.5",
+        "@esbuild/linux-s390x": "0.25.5",
+        "@esbuild/linux-x64": "0.25.5",
+        "@esbuild/netbsd-arm64": "0.25.5",
+        "@esbuild/netbsd-x64": "0.25.5",
+        "@esbuild/openbsd-arm64": "0.25.5",
+        "@esbuild/openbsd-x64": "0.25.5",
+        "@esbuild/sunos-x64": "0.25.5",
+        "@esbuild/win32-arm64": "0.25.5",
+        "@esbuild/win32-ia32": "0.25.5",
+        "@esbuild/win32-x64": "0.25.5"
+      }
+    },
+    "node_modules/escape-string-regexp": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz",
+      "integrity": "sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/global-agent": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/global-agent/-/global-agent-3.0.0.tgz",
+      "integrity": "sha512-PT6XReJ+D07JvGoxQMkT6qji/jVNfX/h364XHZOWeRzy64sSFr+xJ5OX7LI3b4MPQzdL4H8Y8M0xzPpsVMwA8Q==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "boolean": "^3.0.1",
+        "es6-error": "^4.1.1",
+        "matcher": "^3.0.0",
+        "roarr": "^2.15.3",
+        "semver": "^7.3.2",
+        "serialize-error": "^7.0.1"
+      },
+      "engines": {
+        "node": ">=10.0"
+      }
+    },
+    "node_modules/globalthis": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/globalthis/-/globalthis-1.0.4.tgz",
+      "integrity": "sha512-DpLKbNU4WylpxJykQujfCcwYWiV/Jhm50Goo0wrVILAv5jOr9d+H+UR3PhSCD2rCCEIg0uc+G+muBTwD54JhDQ==",
+      "license": "MIT",
+      "dependencies": {
+        "define-properties": "^1.2.1",
+        "gopd": "^1.0.1"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/gopd": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
+      "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/has-property-descriptors": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/has-property-descriptors/-/has-property-descriptors-1.0.2.tgz",
+      "integrity": "sha512-55JNKuIW+vq4Ke1BjOTjM2YctQIvCT7GFzHwmfZPGo5wnrgkid0YQtnAleFSqumZm4az3n2BS+erby5ipJdgrg==",
+      "license": "MIT",
+      "dependencies": {
+        "es-define-property": "^1.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/json-stringify-safe": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/json-stringify-safe/-/json-stringify-safe-5.0.1.tgz",
+      "integrity": "sha512-ZClg6AaYvamvYEE82d3Iyd3vSSIjQ+odgjaTzRuO3s7toCdFKczob2i0zCh7JE8kWn17yvAWhUVxvqGwUalsRA==",
+      "license": "ISC"
+    },
+    "node_modules/matcher": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/matcher/-/matcher-3.0.0.tgz",
+      "integrity": "sha512-OkeDaAZ/bQCxeFAozM55PKcKU0yJMPGifLwV4Qgjitu+5MoAfSQN4lsLJeXZ1b8w0x+/Emda6MZgXS1jvsapng==",
+      "license": "MIT",
+      "dependencies": {
+        "escape-string-regexp": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/object-keys": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/object-keys/-/object-keys-1.1.1.tgz",
+      "integrity": "sha512-NuAESUOUMrlIXOfHKzD6bpPu3tYt3xvjNdRIQ+FeT0lNb4K8WR70CaDxhuNguS2XG+GjkyMwOzsN5ZktImfhLA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/roarr": {
+      "version": "2.15.4",
+      "resolved": "https://registry.npmjs.org/roarr/-/roarr-2.15.4.tgz",
+      "integrity": "sha512-CHhPh+UNHD2GTXNYhPWLnU8ONHdI+5DI+4EYIAOaiD63rHeYlZvyh8P+in5999TTSFgUYuKUAjzRI4mdh/p+2A==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "boolean": "^3.0.1",
+        "detect-node": "^2.0.4",
+        "globalthis": "^1.0.1",
+        "json-stringify-safe": "^5.0.1",
+        "semver-compare": "^1.0.0",
+        "sprintf-js": "^1.1.2"
+      },
+      "engines": {
+        "node": ">=8.0"
+      }
+    },
+    "node_modules/semver": {
+      "version": "7.7.2",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.2.tgz",
+      "integrity": "sha512-RF0Fw+rO5AMf9MAyaRXI4AV0Ulj5lMHqVxxdSgiVbixSCXoEmmX/jk0CuJw4+3SqroYO9VoUh+HcuJivvtJemA==",
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/semver-compare": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/semver-compare/-/semver-compare-1.0.0.tgz",
+      "integrity": "sha512-YM3/ITh2MJ5MtzaM429anh+x2jiLVjqILF4m4oyQB18W7Ggea7BfqdH/wGMK7dDiMghv/6WG7znWMwUDzJiXow==",
+      "license": "MIT"
+    },
+    "node_modules/serialize-error": {
+      "version": "7.0.1",
+      "resolved": "https://registry.npmjs.org/serialize-error/-/serialize-error-7.0.1.tgz",
+      "integrity": "sha512-8I8TjW5KMOKsZQTvoxjuSIa7foAwPWGOts+6o7sgjz41/qMD9VQHEDxi6PBvK2l0MXUmqZyNpUK+T2tQaaElvw==",
+      "license": "MIT",
+      "dependencies": {
+        "type-fest": "^0.13.1"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/sprintf-js": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/sprintf-js/-/sprintf-js-1.1.3.tgz",
+      "integrity": "sha512-Oo+0REFV59/rz3gfJNKQiBlwfHaSESl1pcGyABQsnnIfWOFt6JNj5gCog2U6MLZ//IGYD+nA8nI+mTShREReaA==",
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/type-fest": {
+      "version": "0.13.1",
+      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.13.1.tgz",
+      "integrity": "sha512-34R7HTnG0XIJcBSn5XhDd7nNFPRcXYRZrBB2O2jdKqYODldSzBAqzsWoZYYvduky73toYS/ESqxPvkDf/F0XMg==",
+      "license": "(MIT OR CC0-1.0)",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
       }
     }
   }

pkgs/by-name/sh/shopify-cli/manifests/package.json

@@ -1,11 +1,11 @@
 {
   "name": "shopify",
-  "version": "3.69.3",
+  "version": "3.81.2",
   "private": true,
   "bin": {
     "shopify": "node_modules/@shopify/cli/bin/run.js"
   },
   "dependencies": {
-    "@shopify/cli": "3.69.3"
+    "@shopify/cli": "3.81.2"
   }
 }

pkgs/by-name/sh/shopify-cli/package.nix

@@ -5,7 +5,7 @@
   shopify-cli,
 }:
 let
-  version = "3.69.3";
+  version = "3.81.2";
 in
 buildNpmPackage {
   pname = "shopify";
@@ -13,7 +13,7 @@ buildNpmPackage {
 
   src = ./manifests;
 
-  npmDepsHash = "sha256-QhbOKOs/0GEOeySG4uROzgtD4o7C+6tS/TAaPcmC3xk=";
+  npmDepsHash = "sha256-64D+QM8fZmsknoHpj4S24fNsv8e2YcZfWCZhJRnwgUc=";
   dontNpmBuild = true;
 
   passthru = {

pkgs/by-name/so/socklog/package.nix

@@ -50,6 +50,9 @@ stdenv.mkDerivation (finalAttrs: {
 
   doCheck = true;
 
+  # Needed for tests
+  __darwinAllowLocalNetworking = true;
+
   meta = {
     description = "System and kernel logging services";
     homepage = "https://smarden.org/socklog/";

pkgs/by-name/te/temporal/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "temporal";
-  version = "1.27.2";
+  version = "1.28.0";
 
   src = fetchFromGitHub {
     owner = "temporalio";
     repo = "temporal";
     rev = "v${version}";
-    hash = "sha256-3x94Cccy5CHAKb2eHdMThAC+ONQjuYZ4UyQ8YwrWvgU=";
+    hash = "sha256-LH6utz2SCupF0juXVL+NFO/DQ+inQbOYSyoyTMl5a+w=";
   };
 
-  vendorHash = "sha256-g3XASZFZPS2Zs7gvGQpy9GO5kpA9gSL4Ur3LQhKIL6Y=";
+  vendorHash = "sha256-ycS7uXXNQ6NHuiL796Chc4G2TVNgovn2sXn3k1Ls87Y=";
 
   excludedPackages = [ "./build" ];
 

pkgs/by-name/te/texlab/package.nix

@@ -14,17 +14,17 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "texlab";
-  version = "5.23.0";
+  version = "5.23.1";
 
   src = fetchFromGitHub {
     owner = "latex-lsp";
     repo = "texlab";
     tag = "v${version}";
-    hash = "sha256-bKjogyIPrP3USDHsI4m8u44T+WYF1kyDz8eRpZ4j/xU=";
+    hash = "sha256-QGC2UFmbMCMr0i853M5mdXklqZFYy00fbqeLllpQ4Sg=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Dblnlh9l3tQI4IYWVZdpLz0Hyvg4SY6O5R3Naz515QQ=";
+  cargoHash = "sha256-hJDKzHrNUmN4jqp4P1Is3mYvRC5H3nnHtIW7xjDH+xo=";
 
   outputs = [ "out" ] ++ lib.optional (!isCross) "man";
 

pkgs/by-name/tr/trickest-cli/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "trickest-cli";
-  version = "2.1.1";
+  version = "2.1.2";
 
   src = fetchFromGitHub {
     owner = "trickest";
     repo = "trickest-cli";
     tag = "v${version}";
-    hash = "sha256-43rLYXvAIr3wWImNLSHI/2g8AyxD557ZivWpC3he60o=";
+    hash = "sha256-OuCiW/5g4swtSpqM2rhLyB1syiRkyTbJsghEvyosz/A=";
   };
 
   vendorHash = "sha256-Ae0fNzYOAeCMrNFVhw4VvG/BkOMcguIMiBvLGt7wxEo=";

pkgs/by-name/up/upbound/sources-main.json

@@ -8,38 +8,38 @@
   "fetchurlAttrSet": {
     "docker-credential-up": {
       "aarch64-darwin": {
-        "hash": "sha256-EPJXlxa4Vx7jzdX5/ekIer/EKTAFuqWBcAp4mYyS+JA=",
-        "url": "https://cli.upbound.io/main/v0.39.0-43.g3cca6045/bundle/docker-credential-up/darwin_arm64.tar.gz"
+        "hash": "sha256-ByiFy8k6qwKXTp7iLoojUNNKhhZnbqc6ms6g+r4f9u0=",
+        "url": "https://cli.upbound.io/main/v0.39.0-87.g20595f83/bundle/docker-credential-up/darwin_arm64.tar.gz"
       },
       "aarch64-linux": {
-        "hash": "sha256-cM8F+Qyg34ypdIusI2jFOzoxM3B+tLRyvmqdeUSpz0c=",
-        "url": "https://cli.upbound.io/main/v0.39.0-43.g3cca6045/bundle/docker-credential-up/linux_arm64.tar.gz"
+        "hash": "sha256-qis91nt43HGEfuqcCH5ri/s4QiHiMrRMTinSUjQeI3o=",
+        "url": "https://cli.upbound.io/main/v0.39.0-87.g20595f83/bundle/docker-credential-up/linux_arm64.tar.gz"
       },
       "x86_64-darwin": {
-        "hash": "sha256-jvBe0GEDNMj3HlbMBFcwS1CA2y3QnDkYgv943GW0tLs=",
-        "url": "https://cli.upbound.io/main/v0.39.0-43.g3cca6045/bundle/docker-credential-up/darwin_amd64.tar.gz"
+        "hash": "sha256-s2ORdd3G87Vo9I5zSZXGisjSMr0x86sCu6WOxOZBWTk=",
+        "url": "https://cli.upbound.io/main/v0.39.0-87.g20595f83/bundle/docker-credential-up/darwin_amd64.tar.gz"
       },
       "x86_64-linux": {
-        "hash": "sha256-c/tjuO3j+pYFlyGRAeA3jJLit4sZqreEzMa0LRxnTv0=",
-        "url": "https://cli.upbound.io/main/v0.39.0-43.g3cca6045/bundle/docker-credential-up/linux_amd64.tar.gz"
+        "hash": "sha256-5q/XactXioaOqUYwrojg5xgZg+pKjqnxR9tB8ILaaHg=",
+        "url": "https://cli.upbound.io/main/v0.39.0-87.g20595f83/bundle/docker-credential-up/linux_amd64.tar.gz"
       }
     },
     "up": {
       "aarch64-darwin": {
-        "hash": "sha256-ecNGveGSxYsKFGkAqWNkpr8RKquL1k+/8LsZBNEgWq8=",
-        "url": "https://cli.upbound.io/main/v0.39.0-43.g3cca6045/bundle/up/darwin_arm64.tar.gz"
+        "hash": "sha256-Rud8CPSlxl08cRjChFsZFG6Mfro8BiRWN7f2+DRwUsE=",
+        "url": "https://cli.upbound.io/main/v0.39.0-87.g20595f83/bundle/up/darwin_arm64.tar.gz"
       },
       "aarch64-linux": {
-        "hash": "sha256-70c9eE+SewPICRPzIdOmAj503xB/cL5ud2sQc4uJkJQ=",
-        "url": "https://cli.upbound.io/main/v0.39.0-43.g3cca6045/bundle/up/linux_arm64.tar.gz"
+        "hash": "sha256-KN84vzXue9Tc8O9Ci/4emI7GOX8pETcVc/hpFuBJmy4=",
+        "url": "https://cli.upbound.io/main/v0.39.0-87.g20595f83/bundle/up/linux_arm64.tar.gz"
       },
       "x86_64-darwin": {
-        "hash": "sha256-DQZNsUYLM97zo7ua5xmxSqkxbC91qqLe49yI6X9ELbM=",
-        "url": "https://cli.upbound.io/main/v0.39.0-43.g3cca6045/bundle/up/darwin_amd64.tar.gz"
+        "hash": "sha256-qHN7PSqU5nK5Dh8k4HEjwTmjN/yIoJh7VBoQ/dJS3/s=",
+        "url": "https://cli.upbound.io/main/v0.39.0-87.g20595f83/bundle/up/darwin_amd64.tar.gz"
       },
       "x86_64-linux": {
-        "hash": "sha256-WmsFhA5fteS3+12wPAGym0TZHax+v3zicbh+48aaW0Q=",
-        "url": "https://cli.upbound.io/main/v0.39.0-43.g3cca6045/bundle/up/linux_amd64.tar.gz"
+        "hash": "sha256-mw80qJ+9CRQFFKF7bhWiEYcW1P7Jm4dqkXTN+F8erPM=",
+        "url": "https://cli.upbound.io/main/v0.39.0-87.g20595f83/bundle/up/linux_amd64.tar.gz"
       }
     }
   },
@@ -49,5 +49,5 @@
     "x86_64-darwin",
     "x86_64-linux"
   ],
-  "version": "0.39.0-43.g3cca6045"
+  "version": "0.39.0-87.g20595f83"
 }

pkgs/by-name/uv/uv/package.nix

@@ -18,17 +18,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "uv";
-  version = "0.7.15";
+  version = "0.7.16";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "uv";
     tag = finalAttrs.version;
-    hash = "sha256-onBeTfzT9XhhiHAWcYMYMV8GRKudfPHRpuxg+2AVJls=";
+    hash = "sha256-E9tFjJwV+zDOxsFdDeX6D8DqD0zFNW8kryeY9FmA63U=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-03iQp/0HSqnXJU5PAdQNiTa+0UiKQKx5FiqvoaUeF+U=";
+  cargoHash = "sha256-Eg4YVqKxjYEPS67qnc0y1Tuy6HAFEy6rCjr7/ZXF3yE=";
 
   buildInputs = [
     rust-jemalloc-sys

pkgs/by-name/yo/youtrack/package.nix

@@ -10,11 +10,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "youtrack";
-  version = "2025.1.76253";
+  version = "2025.1.82518";
 
   src = fetchzip {
     url = "https://download.jetbrains.com/charisma/youtrack-${finalAttrs.version}.zip";
-    hash = "sha256-DW3LZAlkfB7Uqy+xj4Oe3LkYD5fQyi4lDcgv/6brSEs=";
+    hash = "sha256-xltAkkD6JuRk+Bl3yP9l44ix/6+rTVuhgKqlroIUIFs=";
   };
 
   nativeBuildInputs = [ makeBinaryWrapper ];

pkgs/development/beam-modules/hex/default.nix

@@ -18,13 +18,13 @@ let
     self:
     stdenv.mkDerivation rec {
       pname = "hex";
-      version = "2.2.1";
+      version = "2.2.2";
 
       src = fetchFromGitHub {
         owner = "hexpm";
         repo = "hex";
         rev = "v${version}";
-        sha256 = "sha256-a4VNBlvW+IM7HuI66dYGqOmIF9kO6wWFqVz4vYtQOhw=";
+        sha256 = "sha256-Qih10OeI7KsnAthAW0yuH+YL8uoeLy7tOVn9rdkGA4M=";
       };
 
       setupHook = writeText "setupHook.sh" ''

pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml

@@ -130,8 +130,6 @@ extra-packages:
 
 # keep-sorted start skip_lines=1 case=no
 package-maintainers:
-  abbradar:
-    - Agda
   alexfmpe:
     - aeson-gadt-th
     - android-activity
@@ -380,6 +378,7 @@ package-maintainers:
     - warp-systemd
     - amazonka
   ncfavier:
+    - Agda
     - irc-client
     - lambdabot
     - shake

pkgs/development/haskell-modules/hackage-packages.nix

@@ -1605,8 +1605,8 @@ self: {
       description = "A dependently typed functional programming language and proof assistant";
       license = lib.licenses.mit;
       maintainers = [
-        lib.maintainers.abbradar
         lib.maintainers.iblech
+        lib.maintainers.ncfavier
         lib.maintainers.turion
       ];
     }

pkgs/development/python-modules/aiolifx-themes/default.nix

@@ -13,16 +13,16 @@
 
 buildPythonPackage rec {
   pname = "aiolifx-themes";
-  version = "0.6.11";
+  version = "1.0.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.9";
+  disabled = pythonOlder "3.12";
 
   src = fetchFromGitHub {
     owner = "Djelibeybi";
     repo = "aiolifx-themes";
     tag = "v${version}";
-    hash = "sha256-H5fjmGfvC/d1qTzEHtmGDPlZ0aY1UaTYPOqUAxDmb3I=";
+    hash = "sha256-02ciRYc5aQ1nES/uctKUWwyBM9dO0hZ5OEWC5MT4Nuo=";
   };
 
   build-system = [ poetry-core ];

pkgs/development/python-modules/ansible/default.nix

@@ -24,7 +24,7 @@
 
 let
   pname = "ansible";
-  version = "11.5.0";
+  version = "11.7.0";
 in
 buildPythonPackage {
   inherit pname version;
@@ -34,7 +34,7 @@ buildPythonPackage {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-GKP8cxIKSa3pqaZ+uPnU9QCdIQbDT/65ZjrZKLdu1Zs=";
+    hash = "sha256-+d83xx1Af2W8ucXAbJkY4pfZ6nS1za9ZJsTJqp5E218=";
   };
 
   # we make ansible-core depend on ansible, not the other way around,

pkgs/development/python-modules/asdf-standard/default.nix

@@ -2,27 +2,21 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  importlib-resources,
-  pythonOlder,
   setuptools-scm,
 }:
 
 buildPythonPackage rec {
   pname = "asdf-standard";
-  version = "1.2.0";
-  format = "pyproject";
-
-  disabled = pythonOlder "3.7";
+  version = "1.3.0";
+  pyproject = true;
 
   src = fetchPypi {
     pname = "asdf_standard";
     inherit version;
-    hash = "sha256-5wmRL68L4vWEOiOvJzHm927WwnmynfWYnhUgmS+jxc8=";
+    hash = "sha256-WViWHzmd6tIACnhyTaN/Wu6wSZp4C72a5Pw+y+Pq7WQ=";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
-
-  propagatedBuildInputs = lib.optionals (pythonOlder "3.9") [ importlib-resources ];
+  build-system = [ setuptools-scm ];
 
   # Circular dependency on asdf
   doCheck = false;
@@ -32,6 +26,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Standards document describing ASDF";
     homepage = "https://github.com/asdf-format/asdf-standard";
+    changelog = "https://github.com/asdf-format/asdf-standard/releases/tag/${version}";
     license = licenses.bsd3;
     maintainers = with maintainers; [ fab ];
   };

pkgs/development/python-modules/bitarray/default.nix

@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "bitarray";
-  version = "3.4.1";
+  version = "3.4.3";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-5fqIcyu8+1Q37lVOGPhCqPbIa+c2VrBYDuFG/Tcxdsk=";
+    hash = "sha256-3d+yvwhrZq7BwBENxGZCtxYfWHpkQc/nTanjI5dfYvA=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/bottleneck/default.nix

@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "bottleneck";
-  version = "1.4.2";
+  version = "1.5.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-+o6OF5nepUg85maUYmYPnZqVZJ9vmKgNMVuE7In0SfQ=";
+    hash = "sha256-yGAkLPIOadWqsuw8XWyMKhXxnkslsouPyiwqEs766dg=";
   };
 
   propagatedBuildInputs = [ numpy ];

pkgs/development/python-modules/cmd2/default.nix

@@ -7,38 +7,27 @@
   fetchPypi,
   glibcLocales,
   gnureadline,
-  importlib-metadata,
   pyperclip,
   pytest-cov-stub,
   pytest-mock,
   pytestCheckHook,
   pythonOlder,
   setuptools-scm,
-  typing-extensions,
   wcwidth,
 }:
 
 buildPythonPackage rec {
   pname = "cmd2";
-  version = "2.6.0";
+  version = "2.6.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-jP+rp4EFJkIcqzv6AQG0kH4SmP8rzYEZYVllourl2V8=";
+    hash = "sha256-ZQpYkr8psjPT1ndbXjzIE2SM/w15E09weYH2a6rtn0I=";
   };
 
-  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    # Fake the impure dependencies pbpaste and pbcopy
-    mkdir bin
-    echo '#!${stdenv.shell}' > bin/pbpaste
-    echo '#!${stdenv.shell}' > bin/pbcopy
-    chmod +x bin/{pbcopy,pbpaste}
-    export PATH=$(realpath bin):$PATH
-  '';
-
   build-system = [ setuptools-scm ];
 
   dependencies = [
@@ -48,7 +37,7 @@ buildPythonPackage rec {
     wcwidth
   ] ++ lib.optional stdenv.hostPlatform.isDarwin gnureadline;
 
-  doCheck = !stdenv.hostPlatform.isDarwin;
+  doCheck = true;
 
   nativeCheckInputs = [
     glibcLocales

pkgs/development/python-modules/compliance-trestle/default.nix

@@ -28,14 +28,14 @@
 
 buildPythonPackage rec {
   pname = "compliance-trestle";
-  version = "3.8.1";
+  version = "3.9.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "oscal-compass";
     repo = "compliance-trestle";
     tag = "v${version}";
-    hash = "sha256-aEIV3XfoRnyMfR0nssmxIkQwrsx7DXxqidOZ8wZ+lWw=";
+    hash = "sha256-WWqrUfDlzpZAXtOlq3Uq8AmUOerUmMCr9KPjdjk4JHg=";
     fetchSubmodules = true;
   };
 

pkgs/development/python-modules/css-inline/default.nix

@@ -17,19 +17,22 @@
 
 buildPythonPackage rec {
   pname = "css-inline";
-  version = "0.14.6";
+  version = "0.15.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Stranger6667";
     repo = "css-inline";
     rev = "python-v${version}";
-    hash = "sha256-x0DxoEKXgMMIlebzL6xVedViGGra2Bx/aox0XiXi+Dc=";
+    hash = "sha256-js9n+m5xDlzxMbXtN74klS0rjTCsHL3LhVAp0tx48b0=";
   };
 
   postPatch = ''
     cd bindings/python
     ln -s ${./Cargo.lock} Cargo.lock
+
+    # don't rebuild std
+    rm .cargo/config.toml
   '';
 
   # call `cargo build --release` in bindings/python and copy the
@@ -40,7 +43,7 @@ buildPythonPackage rec {
       cd bindings/python
       ln -s ${./Cargo.lock} Cargo.lock
     '';
-    hash = "sha256-4zi29ZdALummwcWxYqDDEPAjKptmLqyYUJzWMrEK4os=";
+    hash = "sha256-4DVLcJrK2at1vlThey0N97IWFHd1NM2MEXXA74BYfZs=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/cucumber-tag-expressions/default.nix

@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "cucumber-tag-expressions";
-  version = "6.1.2";
+  version = "6.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cucumber";
     repo = "tag-expressions";
     tag = "v${version}";
-    hash = "sha256-ptDsN6loFXrKT1xeR138kXzA5TbHPH1G7I/25ZD8Nj4=";
+    hash = "sha256-m6CmRs/Fz2e9GTtHrE3FF8GPK2vs6i37xcI3BM64rlc=";
   };
 
   sourceRoot = "${src.name}/python";