Merge master into staging-next

2025-07-03 18:05:45 +00:00 · 2025-07-03 18:05:45 +00:00 · 1bbf3e06dd
commit 1bbf3e06dd
parent 842e1e5f1a bed266e629
66 changed files with 2091 additions and 175 deletions
--- a/doc/languages-frameworks/beam.section.md
+++ b/doc/languages-frameworks/beam.section.md
@ -295,6 +295,8 @@ in
      '';
      Restart = "on-failure";
      RestartSec = 5;
+    };
+    unitConfig = {
      StartLimitBurst = 3;
      StartLimitInterval = 10;
    };
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -4279,6 +4279,13 @@
    githubId = 44584960;
    name = "Denis Khalmatov";
  };
+  ccicnce113424 = {
+    email = "ccicnce113424@gmail.com";
+    matrix = "@ccicnce113424:matrix.org";
+    github = "ccicnce113424";
+    githubId = 30774232;
+    name = "ccicnce113424";
+  };
  cdepillabout = {
    email = "cdep.illabout@gmail.com";
    matrix = "@cdepillabout:matrix.org";
@ -12323,6 +12330,13 @@
    githubId = 31407988;
    name = "Jon Bosque";
  };
+  jonhermansen = {
+    name = "Jon Hermansen";
+    email = "jon@jh86.org";
+    matrix = "@jonhermansen:matrix.org";
+    github = "jonhermansen";
+    githubId = 660911;
+  };
  jonnybolton = {
    email = "jonnybolton@gmail.com";
    github = "jonnynightingale";
@ -21138,6 +21152,12 @@
    githubId = 77415970;
    name = "Redhawk";
  };
+  redlonghead = {
+    email = "git@beardit.net";
+    github = "Redlonghead";
+    githubId = 52263558;
+    name = "Connor Beard";
+  };
  redvers = {
    email = "red@infect.me";
    github = "redvers";
--- a/nixos/doc/manual/redirects.json
+++ b/nixos/doc/manual/redirects.json
@ -1320,6 +1320,9 @@
  "module-services-postgres-authentication-user-mapping": [
    "index.html#module-services-postgres-authentication-user-mapping"
  ],
+  "module-services-postgres-pg_config": [
+    "index.html#module-services-postgres-pg_config"
+  ],
  "module-services-postgres-upgrading": [
    "index.html#module-services-postgres-upgrading"
  ],
--- a/nixos/modules/services/cluster/spark/default.nix
+++ b/nixos/modules/services/cluster/spark/default.nix
@ -123,9 +123,11 @@ in
            ExecStart = "${cfg.package}/sbin/start-master.sh";
            ExecStop = "${cfg.package}/sbin/stop-master.sh";
            TimeoutSec = 300;
-            StartLimitBurst = 10;
            Restart = "always";
          };
+          unitConfig = {
+            StartLimitBurst = 10;
+          };
        };
        spark-worker = lib.mkIf cfg.worker.enable {
          path = with pkgs; [
@ -151,9 +153,11 @@ in
            ExecStart = "${cfg.package}/sbin/start-worker.sh spark://${cfg.worker.master}";
            ExecStop = "${cfg.package}/sbin/stop-worker.sh";
            TimeoutSec = 300;
-            StartLimitBurst = 10;
            Restart = "always";
          };
+          unitConfig = {
+            StartLimitBurst = 10;
+          };
        };
      };
      tmpfiles.rules = [
--- a/nixos/modules/services/databases/postgresql.md
+++ b/nixos/modules/services/databases/postgresql.md
@ -260,6 +260,28 @@ Thus:

 This leaves a small gap of a couple of weeks after the latest minor release and the end of our support window for the .05 release, in which there could be an emergency release to other major versions of PostgreSQL - but not the oldest major we have in that branch. In that case: If we can't trivially patch the issue, we will mark the package/version as insecure **immediately**.

+## `pg_config` {#module-services-postgres-pg_config}
+
+`pg_config` is not part of the `postgresql`-package itself.
+It is available under `postgresql_<major>.pg_config` and `libpq.pg_config`.
+Use the `pg_config` from the postgresql package you're using in your build.
+
+Also, `pg_config` is a shell-script that replicates the behavior of the upstream `pg_config` and ensures at build-time that the output doesn't change.
+
+This approach is done for the following reasons:
+
+* By using a shell script, cross compilation of extensions is made easier.
+
+* The separation allowed a massive reduction of the runtime closure's size.
+  Any attempts to move `pg_config` into `$dev` resulted in brittle and more complex solutions
+  (see commits [`0c47767`](https://github.com/NixOS/nixpkgs/commit/0c477676412564bd2d5dadc37cf245fe4259f4d9), [`435f51c`](https://github.com/NixOS/nixpkgs/commit/435f51c37faf74375134dfbd7c5a4560da2a9ea7)).
+
+* `pg_config` is only needed to build extensions or in some exceptions for building client libraries linking to `libpq.so`.
+  If such a build works without `pg_config`, this is strictly preferable over adding `pg_config` to the build environment.
+
+  With the current approach it's now explicit that this is needed.
+
+
 ## Options {#module-services-postgres-options}

 A complete list of options for the PostgreSQL module may be found [here](#opt-services.postgresql.enable).
--- a/nixos/modules/services/games/xonotic.nix
+++ b/nixos/modules/services/games/xonotic.nix
@ -195,6 +195,8 @@ in

        Restart = "on-failure";
        RestartSec = 10;
+      };
+      unitConfig = {
        StartLimitBurst = 5;
      };
    };
--- a/nixos/modules/services/matrix/conduit.nix
+++ b/nixos/modules/services/matrix/conduit.nix
@ -157,9 +157,11 @@ in
        ExecStart = "${cfg.package}/bin/conduit";
        Restart = "on-failure";
        RestartSec = 10;
-        StartLimitBurst = 5;
        UMask = "077";
      };
+      unitConfig = {
+        StartLimitBurst = 5;
+      };
    };
  };
 }
--- a/nixos/modules/services/networking/fedimintd.nix
+++ b/nixos/modules/services/networking/fedimintd.nix
@ -310,7 +310,6 @@ in

              Restart = "always";
              RestartSec = 10;
-              StartLimitBurst = 5;
              UMask = "007";
              LimitNOFILE = "100000";

@ -341,6 +340,9 @@ in
                "~@privileged"
              ];
            };
+            unitConfig = {
+              StartLimitBurst = 5;
+            };
          }
        ))
      ) eachFedimintd;
--- a/nixos/modules/services/networking/frr.nix
+++ b/nixos/modules/services/networking/frr.nix
@ -298,7 +298,6 @@ in
          Nice = -5;
          Type = "forking";
          NotifyAccess = "all";
-          StartLimitBurst = "3";
          TimeoutSec = 120;
          WatchdogSec = 60;
          RestartSec = 5;
@ -309,6 +308,9 @@ in
          ExecStop = "${pkgs.frr}/libexec/frr/frrinit.sh stop";
          ExecReload = "${pkgs.frr}/libexec/frr/frrinit.sh reload";
        };
+        unitConfig = {
+          StartLimitBurst = "3";
+        };
      };
    };

--- a/nixos/modules/services/web-apps/homebox.nix
+++ b/nixos/modules/services/web-apps/homebox.nix
@ -32,7 +32,7 @@ in
      '';
      description = ''
        The homebox configuration as Environment variables. For definitions and available options see the upstream
-        [documentation](https://homebox.software/en/configure-homebox.html).
+        [documentation](https://homebox.software/en/configure/#configure-homebox).
      '';
    };
    database = {
--- a/nixos/modules/virtualisation/docker-rootless.nix
+++ b/nixos/modules/virtualisation/docker-rootless.nix
@ -82,7 +82,6 @@ in
        TimeoutSec = 0;
        RestartSec = 2;
        Restart = "always";
-        StartLimitBurst = 3;
        LimitNOFILE = "infinity";
        LimitNPROC = "infinity";
        LimitCORE = "infinity";
@ -90,6 +89,9 @@ in
        NotifyAccess = "all";
        KillMode = "mixed";
      };
+      unitConfig = {
+        StartLimitBurst = 3;
+      };
    };
  };

--- a/nixos/tests/vault-postgresql.nix
+++ b/nixos/tests/vault-postgresql.nix
@ -29,7 +29,7 @@
        ];
        # Try for about 10 minutes rather than the default of 5 attempts.
        serviceConfig.RestartSec = 1;
-        serviceConfig.StartLimitBurst = 600;
+        unitConfig.StartLimitBurst = 600;
      };
      # systemd.services.vault.unitConfig.RequiresMountsFor = "/run/keys/";

--- a/pkgs/applications/misc/organicmaps/default.nix
+++ b/pkgs/applications/misc/organicmaps/default.nix
@ -33,13 +33,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "organicmaps";
-  version = "2025.06.12-3";
+  version = "2025.06.26-3";

  src = fetchFromGitHub {
    owner = "organicmaps";
    repo = "organicmaps";
    tag = "${finalAttrs.version}-android";
-    hash = "sha256-hOSa3soCDvRHUMKg+IYtzBdzJ9S5X5z3+Ynd5JJgLTs=";
+    hash = "sha256-IXpSY1ZGKAPqFT3B4C8Y+FHUuFQJPVptSKKhXZCYSfo=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
@ -10,11 +10,11 @@
 buildMozillaMach rec {
  pname = "firefox-beta";
  binaryName = pname;
-  version = "141.0b4";
+  version = "141.0b5";
  applicationName = "Firefox Beta";
  src = fetchurl {
    url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "89a5e3fdc7fa3ec7ba91930baea05f231354c2b2f44d6b3cb82e15575a5a05812ef6eda29605ce652a72145733d2bd7cd84e22942e566e0434b0fed116922e0b";
+    sha512 = "1b77e890ea06e0ea468fc65a3f19e9b3e5c9881aa64bf4276911a1fe7d1c1c887e3a59be4a54bce8f29b705a09c2ada723d189cbead107a80cfa4dd48fa7fab9";
  };

  meta = {
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
@ -10,13 +10,13 @@
 buildMozillaMach rec {
  pname = "firefox-devedition";
  binaryName = pname;
-  version = "141.0b4";
+  version = "141.0b5";
  applicationName = "Firefox Developer Edition";
  requireSigning = false;
  branding = "browser/branding/aurora";
  src = fetchurl {
    url = "mirror://mozilla/devedition/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "c96fb731ff935176f9dfd8b31693dc49c2eac63e6d5b935fe3ebf1f9d39023bfeb9c9cfa07f4f759dfbd45cf911684b90a810879e412028d35c3ab6ec419b2ba";
+    sha512 = "0bb3da49a048eec25a97de40a1446aab3e737c927d339f1da5025751758d40a518b5c934ff295d8294e98a4f67b7ca9a1e10b3813746048a02d244916220962c";
  };

  # buildMozillaMach sets MOZ_APP_REMOTINGNAME during configuration, but
--- a/pkgs/by-name/es/esphome/package.nix
+++ b/pkgs/by-name/es/esphome/package.nix
@ -33,14 +33,14 @@ let
 in
 python.pkgs.buildPythonApplication rec {
  pname = "esphome";
-  version = "2025.6.2";
+  version = "2025.6.3";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "esphome";
    repo = "esphome";
    tag = version;
-    hash = "sha256-45DhWxBvItl70mx/H42o9PqlIipvzIA/A9H6pKDO2fo=";
+    hash = "sha256-3Xcxn12QKQg0jxdOPP7y01YaikvxmPPX9JL2JBvdsUM=";
  };

  build-systems = with python.pkgs; [
--- a/pkgs/by-name/ex/exploitdb/package.nix
+++ b/pkgs/by-name/ex/exploitdb/package.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "exploitdb";
-  version = "2025-06-27";
+  version = "2025-07-03";

  src = fetchFromGitLab {
    owner = "exploit-database";
    repo = "exploitdb";
    tag = finalAttrs.version;
-    hash = "sha256-Gm3SRdt6a3hSe64iP7j+5HQ5bGZ6s3eKvxFlCkQWZHo=";
+    hash = "sha256-/mNq9366QK/rcKV+JM/2WJcnSPBUy7NoezUriQgupOk=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/by-name/fi/firefly-iii/package.nix
+++ b/pkgs/by-name/fi/firefly-iii/package.nix
@ -13,13 +13,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "firefly-iii";
-  version = "6.2.18";
+  version = "6.2.20";

  src = fetchFromGitHub {
    owner = "firefly-iii";
    repo = "firefly-iii";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-QQlfUbDanyj3n0EOhPxfMqsrl9laQq2CQbwRY4/gH8k=";
+    hash = "sha256-3AFbzalyrdQxPEBuQwJydydh8YaIN9m5XfT2h6Rcd/Y=";
  };

  buildInputs = [ php84 ];
@ -38,13 +38,13 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    composerNoScripts = true;
    composerStrictValidation = true;
    strictDeps = true;
-    vendorHash = "sha256-h/DWKOlffEBWZhdf5iQf4f33IK+1Ie289Oqjb7GHfVY=";
+    vendorHash = "sha256-1tgNR1WXFymIqmTgFRPOvvuondVolT9uil0HDMTEL8Q=";
  };

  npmDeps = fetchNpmDeps {
    inherit (finalAttrs) src;
    name = "${finalAttrs.pname}-npm-deps";
-    hash = "sha256-YbMUM+fXIuXVrv7QMlPklct3mDHI05PoOW+fgHf8c3I=";
+    hash = "sha256-FHJVaAWBxZ6IsGT5Sqrfv3yCJC0DPX1SrrLFD70TAFY=";
  };

  preInstall = ''
--- a/pkgs/by-name/go/gobuster/package.nix
+++ b/pkgs/by-name/go/gobuster/package.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "gobuster";
-  version = "3.6.0";
+  version = "3.7.0";

  src = fetchFromGitHub {
    owner = "OJ";
    repo = "gobuster";
    tag = "v${version}";
-    hash = "sha256-LZL9Zje2u0v6iAQinfjflvusV57ys5J5Il6Q7br3Suc=";
+    hash = "sha256-RiT9WUvMCv64Q1kl3WoZ6hu8whpAuG2SN6S0897SE2k=";
  };

-  vendorHash = "sha256-w+G5PsWXhKipjYIHtz633sia+Wg9FSFVpcugEl8fp0E=";
+  vendorHash = "sha256-3okd9ixxfFJTVYMj3qLnezfeR6esfagEfUNfWl6Oo60=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/go/golangci-lint/package.nix
+++ b/pkgs/by-name/go/golangci-lint/package.nix
@ -1,22 +1,24 @@
 {
-  buildGo124Module,
+  buildGoModule,
+  buildPackages,
  fetchFromGitHub,
-  lib,
  installShellFiles,
+  lib,
+  stdenv,
 }:

-buildGo124Module rec {
+buildGoModule (finalAttrs: {
  pname = "golangci-lint";
-  version = "2.1.6";
+  version = "2.2.1";

  src = fetchFromGitHub {
    owner = "golangci";
    repo = "golangci-lint";
-    rev = "v${version}";
-    hash = "sha256-L0TsVOUSU+nfxXyWsFLe+eU4ZxWbW3bHByQVatsTpXA=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-c71Oe1PrH2PfbvOb0/gw9q/BxqC8zoxN+31FWV8rcsU=";
  };

-  vendorHash = "sha256-tYoAUumnHgA8Al3jKjS8P/ZkUlfbmmmBcJYUR7+5u9w=";
+  vendorHash = "sha256-iYfgvY2hboawbdzMvuSYeHeKN5E00hevk/kRz5jNlkw=";

  subPackages = [ "cmd/golangci-lint" ];

@ -24,22 +26,31 @@ buildGo124Module rec {

  ldflags = [
    "-s"
-    "-X main.version=${version}"
-    "-X main.commit=v${version}"
+    "-w"
+    "-X main.version=${finalAttrs.version}"
+    "-X main.commit=v${finalAttrs.version}"
    "-X main.date=19700101-00:00:00"
  ];

-  postInstall = ''
-    for shell in bash zsh fish; do
-      HOME=$TMPDIR $out/bin/golangci-lint completion $shell > golangci-lint.$shell
-      installShellCompletion golangci-lint.$shell
-    done
-  '';
+  postInstall =
+    let
+      golangcilintBin =
+        if stdenv.buildPlatform.canExecute stdenv.hostPlatform then
+          "$out"
+        else
+          lib.getBin buildPackages.golangci-lint;
+    in
+    ''
+      installShellCompletion --cmd golangci-lint \
+        --bash <(${golangcilintBin}/bin/golangci-lint completion bash) \
+        --fish <(${golangcilintBin}/bin/golangci-lint completion fish) \
+        --zsh <(${golangcilintBin}/bin/golangci-lint completion zsh)
+    '';

  meta = {
    description = "Fast linters Runner for Go";
    homepage = "https://golangci-lint.run/";
-    changelog = "https://github.com/golangci/golangci-lint/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/golangci/golangci-lint/blob/v${finalAttrs.version}/CHANGELOG.md";
    mainProgram = "golangci-lint";
    license = lib.licenses.gpl3Plus;
    maintainers = with lib.maintainers; [
@ -47,4 +58,4 @@ buildGo124Module rec {
      mic92
    ];
  };
-}
+})
--- a/pkgs/by-name/je/jellyfin-tui/package.nix
+++ b/pkgs/by-name/je/jellyfin-tui/package.nix
@ -1,5 +1,6 @@
 {
  lib,
+  stdenv,
  fetchFromGitHub,
  rustPlatform,
  pkg-config,
@ -37,7 +38,9 @@ rustPlatform.buildRustPackage rec {
  versionCheckProgramArg = "--version";
  versionCheckKeepEnvironment = [ "HOME" ];
  preInstallCheck = ''
-    mkdir -p $HOME/.local/share
+    mkdir -p "$HOME/${
+      if stdenv.buildPlatform.isDarwin then "Library/Application Support" else ".local/share"
+    }"
  '';
  doInstallCheck = true;

--- a/pkgs/by-name/lu/luau/package.nix
+++ b/pkgs/by-name/lu/luau/package.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "luau";
-  version = "0.679";
+  version = "0.680";

  src = fetchFromGitHub {
    owner = "luau-lang";
    repo = "luau";
    tag = finalAttrs.version;
-    hash = "sha256-PLYiGMdXA/PFZaOOv/fmRjU5b9fNmvUoExNjFq81tto=";
+    hash = "sha256-CMQC11NkNq+dzHcPM/YFLdr/EWkqy3zaDc6W1EX32D4=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix
+++ b/pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix
@ -18,14 +18,14 @@ let
 in
 python3.pkgs.buildPythonApplication rec {
  pname = "matrix-synapse";
-  version = "1.132.0";
+  version = "1.133.0";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "element-hq";
    repo = "synapse";
    rev = "v${version}";
-    hash = "sha256-yKoBYwd2djHAawBJRcbdrJH16+MHpYQnU7h39SvWqYE=";
+    hash = "sha256-SCpLM/4sxE9xA781tgjrNNXpScCQOtgKnZKq64eCay8=";
  };

  patches = [
@ -39,7 +39,7 @@ python3.pkgs.buildPythonApplication rec {

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit pname version src;
-    hash = "sha256-9VJnn8aPkShqK2wYGFr+S5koIjma7VOr+LkLXwStL1E=";
+    hash = "sha256-qgQU041VlAFFgEg2RhbK6g+aike+HN0FYuvHYtufzW8=";
  };

  postPatch = ''
--- a/pkgs/by-name/me/mediawriter/package.nix
+++ b/pkgs/by-name/me/mediawriter/package.nix
@ -12,13 +12,13 @@

 stdenv.mkDerivation rec {
  pname = "mediawriter";
-  version = "5.2.6";
+  version = "5.2.7";

  src = fetchFromGitHub {
    owner = "FedoraQt";
    repo = "MediaWriter";
    tag = version;
-    hash = "sha256-3O+b55H2/qbr8RrHNGz8dPQTt+ecVHtUWSDa24l2Dwc=";
+    hash = "sha256-wowhV8h8vUw1eehcoXS0DFZtPfLmPfQUTcNDiZjWL3A=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/mi/miru/package.nix
+++ b/pkgs/by-name/mi/miru/package.nix
@ -12,7 +12,6 @@ let
    license = lib.licenses.gpl3Plus;
    maintainers = with lib.maintainers; [
      d4ilyrun
-      matteopacini
    ];
    mainProgram = "miru";

--- a/pkgs/by-name/na/namespace-cli/package.nix
+++ b/pkgs/by-name/na/namespace-cli/package.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "namespace-cli";
-  version = "0.0.425";
+  version = "0.0.428";

  src = fetchFromGitHub {
    owner = "namespacelabs";
    repo = "foundation";
    rev = "v${version}";
-    hash = "sha256-HO6aSZg6M0OE5OLzKOIJLtDEz9Ow16xlw+dQfsFm/Qs=";
+    hash = "sha256-W2IUEr7jN6GN03Gm7dJY8hl558eaMNdp0j33i+d8Qqs=";
  };

-  vendorHash = "sha256-Xmd8OTW/1MfRWItcx/a13BV993aVWnsvkcTwr/ROS4w=";
+  vendorHash = "sha256-5cZy89dJbekxba7BTxKtJkicRPUsl4PyLiNZnG564U4=";

  subPackages = [
    "cmd/nsc"
--- a/pkgs/by-name/ne/netbox_4_3/package.nix
+++ b/pkgs/by-name/ne/netbox_4_3/package.nix
@ -16,14 +16,14 @@ let
 in
 py.pkgs.buildPythonApplication rec {
  pname = "netbox";
-  version = "4.3.2";
+  version = "4.3.3";
  pyproject = false;

  src = fetchFromGitHub {
    owner = "netbox-community";
    repo = "netbox";
    tag = "v${version}";
-    hash = "sha256-20X/0k60q2cPsWuz+qpgcfXGkg+A2k5qaWx6zHkmpWc=";
+    hash = "sha256-KmnTDTb3k8WtDN7sWjKOriG9i5dHY7BHXty6zPDqPqA=";
  };

  patches = [
--- a/pkgs/by-name/nu/nuclei/package.nix
+++ b/pkgs/by-name/nu/nuclei/package.nix
@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "nuclei";
-  version = "3.4.5";
+  version = "3.4.6";

  src = fetchFromGitHub {
    owner = "projectdiscovery";
    repo = "nuclei";
    tag = "v${version}";
-    hash = "sha256-X2jgmSEpfeq6vet37wWL2SP3GRHIyQpU6eMNIEPISZQ=";
+    hash = "sha256-Z5GRnecr1+Uz+zL/QsYQQp78261ceE9i/Hp/ebwFKH8=";
  };

-  vendorHash = "sha256-eRuTv4F669S7YqKC4cbwRp7veWUUsIGMMyyUzLqbZ5k=";
+  vendorHash = "sha256-+DKiQAwZhxJZtPsGa6wuNu+jgtqrtgZtx3KSa0ROz/E=";

  proxyVendor = true; # hash mismatch between Linux and Darwin

--- a/pkgs/by-name/nx/nxwitness-client/package.nix
+++ b/pkgs/by-name/nx/nxwitness-client/package.nix
@ -0,0 +1,124 @@
+{
+  stdenv,
+  lib,
+  autoPatchelfHook,
+  buildFHSEnv,
+  dpkg,
+  fetchurl,
+  glib,
+  gst_all_1,
+  libGL,
+  libgudev,
+  libudev-zero,
+  libxcb,
+  libxkbfile,
+  libxml2,
+  libxslt,
+  openal,
+  qt6Packages,
+  wayland,
+  xcbutilimage,
+  xcbutilkeysyms,
+  xcbutilrenderutil,
+  xcbutilwm,
+}:
+let
+  version = "6.0.3";
+  build = "40736";
+
+  libxml2_13 = libxml2.overrideAttrs (oldAttrs: rec {
+    version = "2.13.8";
+    src = fetchurl {
+      url = "mirror://gnome/sources/libxml2/${lib.versions.majorMinor version}/libxml2-${version}.tar.xz";
+      hash = "sha256-J3KUyzMRmrcbK8gfL0Rem8lDW4k60VuyzSsOhZoO6Eo=";
+    };
+    meta = oldAttrs.meta // {
+      knownVulnerabilities = oldAttrs.meta.knownVulnerabilities or [ ] ++ [
+        "CVE-2025-6021"
+      ];
+    };
+  });
+
+  buildInputs = [
+    glib
+    gst_all_1.gst-plugins-base
+    gst_all_1.gstreamer
+    libGL
+    libgudev
+    libudev-zero
+    libxcb
+    libxkbfile
+    libxml2_13
+    libxslt
+    openal
+    qt6Packages.qtbase
+    qt6Packages.qtquicktimeline
+    qt6Packages.qtwayland
+    qt6Packages.qtwebengine
+    qt6Packages.qtwebsockets
+    qt6Packages.qtwebview
+    wayland
+    xcbutilimage
+    xcbutilkeysyms
+    xcbutilrenderutil
+    xcbutilwm
+  ];
+
+  meta = {
+    description = "Desktop Client for Nx Witness Video Systems";
+    homepage = "https://nxvms.com/";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ netali ];
+    platforms = [ "x86_64-linux" ];
+  };
+
+  nxwitness_client = stdenv.mkDerivation (finalAttrs: {
+    inherit buildInputs meta;
+    pname = "nxwitness-client";
+    version = "${version}.${build}";
+
+    src = fetchurl {
+      url = "https://updates.networkoptix.com/default/${build}/linux/nxwitness-client-${finalAttrs.version}-linux_x64.deb";
+      hash = "sha256-flOTNKklovpvtFDWE64clL3Jk1cmT4SVgs1NQZZaXpc=";
+    };
+
+    nativeBuildInputs = [
+      autoPatchelfHook
+      dpkg
+    ];
+
+    dontUnpack = true;
+    dontWrapQtApps = true;
+
+    installPhase = ''
+      dpkg -x $src $out
+      rm -r $out/usr
+      mv $out/opt/networkoptix/client/${finalAttrs.version}/* $out/
+      rm -r $out/opt
+
+      # remove as many vendored libs as we can
+      rm $out/lib/libgst*
+      rm $out/lib/libxkb*
+      rm $out/lib/libxcb*
+      rm $out/lib/libhidapi*
+      rm $out/lib/libopenal*
+      rm $out/lib/libXss*
+      rm -r $out/lib/stdcpp
+      rm -r $out/lib/opengl
+      rm -r $out/lib/libva-drivers
+    '';
+  });
+in
+# only runs in an FHS env for some reason
+buildFHSEnv {
+  inherit (nxwitness_client) pname version meta;
+  targetPkgs = (
+    pkgs:
+    [
+      nxwitness_client
+    ]
+    ++ buildInputs
+  );
+  runScript = "nxwitness_client";
+}
--- a/pkgs/by-name/op/openvas-scanner/package.nix
+++ b/pkgs/by-name/op/openvas-scanner/package.nix
@ -31,13 +31,13 @@

 stdenv.mkDerivation rec {
  pname = "openvas-scanner";
-  version = "23.20.1";
+  version = "23.20.2";

  src = fetchFromGitHub {
    owner = "greenbone";
    repo = "openvas-scanner";
    tag = "v${version}";
-    hash = "sha256-JXZMgf7HTmRADApnriWxszvFcVNxIb4ylfdgb5ebVSw=";
+    hash = "sha256-n8ojCp2pGITsy7kY/8qZzKrVwD+4xxA1IEp+AEmU+FE=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/pa/pakku/deps.json
+++ b/pkgs/by-name/pa/pakku/deps.json
--- a/pkgs/by-name/pa/pakku/package.nix
+++ b/pkgs/by-name/pa/pakku/package.nix
@ -0,0 +1,93 @@
+{
+  jre,
+  lib,
+  stdenv,
+  gradle,
+  makeWrapper,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+  installShellFiles,
+  stripJavaArchivesHook,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "pakku";
+  version = "1.2.1";
+
+  src = fetchFromGitHub {
+    owner = "juraj-hrivnak";
+    repo = "Pakku";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-hWQq2awZV07wX4jK9K/QoXekrlZukuDv6CtY1O09ZkQ=";
+  };
+
+  gradleBuildTask = "jvmJar";
+
+  nativeBuildInputs = [
+    gradle
+    makeWrapper
+    installShellFiles
+    stripJavaArchivesHook
+  ];
+
+  mitmCache = gradle.fetchDeps {
+    inherit (finalAttrs) pname;
+    data = ./deps.json;
+  };
+
+  # this is required for using mitm-cache on Darwin
+  __darwinAllowLocalNetworking = true;
+
+  gradleCheckTask = "jvmTest";
+  doCheck = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/{bin,share/pakku}
+    cp build/libs/pakku.jar $out/share/pakku
+
+    makeWrapper ${jre}/bin/java $out/bin/pakku --add-flags "-jar $out/share/pakku/pakku.jar"
+
+    runHook postInstall
+  '';
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd pakku \
+      --bash <($out/bin/pakku --generate-completion=bash) \
+      --fish <($out/bin/pakku --generate-completion=fish) \
+      --zsh <($out/bin/pakku --generate-completion=zsh)
+  '';
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--subpackage"
+      "mitmCache"
+    ];
+  };
+
+  meta = {
+    description = "Multiplatform modpack manager for Minecraft: Java Edition";
+    longDescription = ''
+      With Pakku, you can create modpacks for CurseForge, Modrinth or both simultaneously.
+
+      It's a package manager that significantly simplifies Minecraft modpack development, inspired by package managers like npm and Cargo. In addition to package management itself, it enables support for version control, simplifies collaboration options, and adds support for CI/CD.
+    '';
+    homepage = "https://github.com/juraj-hrivnak/Pakku";
+    downloadPage = "https://github.com/juraj-hrivnak/Pakku/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/juraj-hrivnak/Pakku/releases/tag/v${finalAttrs.version}";
+    mainProgram = "pakku";
+    license = lib.licenses.eupl12;
+    platforms = jre.meta.platforms;
+    sourceProvenance = with lib.sourceTypes; [
+      fromSource
+      binaryBytecode # mitm cache
+    ];
+    maintainers = with lib.maintainers; [ redlonghead ];
+  };
+})
--- a/pkgs/by-name/pa/paretosecurity/package.nix
+++ b/pkgs/by-name/pa/paretosecurity/package.nix
@ -17,16 +17,16 @@ buildGoModule (finalAttrs: {
    webkitgtk_4_1
  ];
  pname = "paretosecurity";
-  version = "0.2.36";
+  version = "0.2.37";

  src = fetchFromGitHub {
    owner = "ParetoSecurity";
    repo = "agent";
    rev = finalAttrs.version;
-    hash = "sha256-PAH5aswkN8MxK+sZNucXgw50Fc2CkhBLM7+wwxkgAvs=";
+    hash = "sha256-kwGZmj7YJtciFGNVYGKOE8yqGUxMlDBwivBNXmSAfQk=";
  };

-  vendorHash = "sha256-RAKYaNi+MXUfNnEJmZF5g9jFBDOPIVBOZWtqZp2FwWY=";
+  vendorHash = "sha256-nN2FS0XEZyyk83xXyoaQktZcGzPRtxND1qmskvqxEII=";
  proxyVendor = true;

  # Skip building the Windows installer
--- a/pkgs/by-name/po/podget/package.nix
+++ b/pkgs/by-name/po/podget/package.nix
@ -0,0 +1,58 @@
+{
+  stdenvNoCC,
+  lib,
+  fetchFromGitHub,
+  makeWrapper,
+  installShellFiles,
+  coreutils,
+  findutils,
+  gawk,
+  iconv,
+  wget,
+}:
+stdenvNoCC.mkDerivation rec {
+  pname = "podget";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "dvehrs";
+    repo = "podget";
+    tag = "V${version}";
+    hash = "sha256-0I42UPWTdSzfRJodB1v3BNI5vwt8GRGpHR7eACoR9YQ=";
+  };
+
+  buildInputs = [
+    coreutils
+    findutils
+    gawk
+    iconv
+    wget
+  ];
+  nativeBuildInputs = [
+    makeWrapper
+    installShellFiles
+  ];
+  installPhase = ''
+    installManPage DOC/podget.7
+    install -m 755 -D podget $out/bin/podget
+    wrapProgram $out/bin/podget --prefix PATH : ${
+      lib.makeBinPath [
+        coreutils
+        findutils
+        gawk
+        iconv
+        wget
+      ]
+    }
+  '';
+
+  meta = {
+    description = "Podcast aggregator optimized for running as a scheduled job (i.e. cron) on Linux";
+    homepage = "https://github.com/dvehrs/podget";
+    changelog = "https://github.com/dvehrs/podget/blob/dev/Changelog";
+    license = lib.licenses.gpl3;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ _9R ];
+    mainProgram = "podget";
+  };
+}
--- a/pkgs/by-name/po/postgresql_jdbc/package.nix
+++ b/pkgs/by-name/po/postgresql_jdbc/package.nix
@ -6,12 +6,12 @@

 stdenv.mkDerivation rec {
  pname = "postgresql-jdbc";
-  version = "42.6.1";
+  version = "42.7.7";

  src = fetchMavenArtifact {
    artifactId = "postgresql";
    groupId = "org.postgresql";
-    hash = "sha256-ywd0/X0JsjniHp0Es3RKQId7/0Y6jVjD9AfPfZdsNVc=";
+    hash = "sha256-FXlj1grmbWB+CUZujAzfgIfpyyDQFZiZ/8qWvKJShGA=";
    inherit version;
  };

--- a/pkgs/by-name/re/redpanda-client/package.nix
+++ b/pkgs/by-name/re/redpanda-client/package.nix
@ -7,12 +7,12 @@
  stdenv,
 }:
 let
-  version = "25.1.5";
+  version = "25.1.6";
  src = fetchFromGitHub {
    owner = "redpanda-data";
    repo = "redpanda";
    rev = "v${version}";
-    sha256 = "sha256-K0MYcxz5EE9PAJZby3VcI3lpRaOfZDJoD6YwCbSw49I=";
+    sha256 = "sha256-Cl2coxcK2f53uJnC5CBkqJ/oAQ+jpvjo2vknKqx7FXQ=";
  };
 in
 buildGoModule rec {
--- a/pkgs/by-name/ru/ruffle/package.nix
+++ b/pkgs/by-name/ru/ruffle/package.nix
@ -21,17 +21,17 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "ruffle";
-  version = "0-nightly-2025-06-21";
+  version = "0-nightly-2025-06-30";

  src = fetchFromGitHub {
    owner = "ruffle-rs";
    repo = "ruffle";
    tag = lib.strings.removePrefix "0-" finalAttrs.version;
-    hash = "sha256-rlNDqdN+hPKndxABTCm4kv6QH5k4dMJ86ADQSxONawQ=";
+    hash = "sha256-D2IkIypkJMa4ndZnmIkSJwCKl5k3ZIa+99uMz/zEysQ=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-k3nDnLbB/9xx6uT8mNw7L5fMtDNZBrIPFBRsVCdVIc8=";
+  cargoHash = "sha256-RboGtauRMuui8vewxF5mTiRF3/STxxG/ZG5Z9J/GtSI=";
  cargoBuildFlags = lib.optional withRuffleTools "--workspace";

  env =
--- a/pkgs/by-name/ru/rundeck-cli/package.nix
+++ b/pkgs/by-name/ru/rundeck-cli/package.nix
@ -11,11 +11,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "rundeck-cli";
-  version = "2.0.8";
+  version = "2.0.9";

  src = fetchurl {
    url = "https://github.com/rundeck/rundeck-cli/releases/download/v${finalAttrs.version}/rundeck-cli-${finalAttrs.version}-all.jar";
-    hash = "sha256-mpy4oS7zCUdt4Q+KQPrGGbw6Gzmh1Msygl+NXDmFhDw=";
+    hash = "sha256-c6QAgwyRCtoOlS7DEmjyK3BwHV122bilL6H+Hzrv2dQ=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/by-name/sp/splayer/package.nix
+++ b/pkgs/by-name/sp/splayer/package.nix
@ -0,0 +1,108 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  pnpm_10,
+  nodejs,
+  electron,
+  makeWrapper,
+  copyDesktopItems,
+  makeDesktopItem,
+  nix-update-script,
+}:
+stdenv.mkDerivation (final: {
+  pname = "splayer";
+  version = "3.0.0-beta.1";
+
+  src = fetchFromGitHub {
+    owner = "imsyy";
+    repo = "SPlayer";
+    tag = "v${final.version}";
+    fetchSubmodules = false;
+    hash = "sha256-Sw5L474gowpOVkIc3CHWVEzknMgJvBmtNXRCxzwY8BA=";
+  };
+
+  pnpm = pnpm_10;
+
+  pnpmDeps = final.pnpm.fetchDeps {
+    inherit (final) pname version src;
+    hash = "sha256-mC1iJtkZpTd2Vte5DLI3ntZ7vSO5Gka2qOk7ihQd3Gs=";
+  };
+
+  nativeBuildInputs = [
+    final.pnpm.configHook
+    nodejs
+    makeWrapper
+    copyDesktopItems
+  ];
+
+  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+
+  postConfigure = ''
+    cp .env.example .env
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    pnpm build
+
+    npm exec electron-builder -- \
+        --dir \
+        --config electron-builder.yml \
+        -c.electronDist=${electron.dist} \
+        -c.electronVersion=${electron.version}
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out/share/splayer"
+    cp -Pr --no-preserve=ownership dist/*-unpacked/{locales,resources{,.pak}} $out/share/splayer
+
+    _icon_sizes=(16x16 32x32 96x96 192x192 256x256 512x512)
+    for _icons in "''${_icon_sizes[@]}";do
+      install -D public/icons/favicon-$_icons.png $out/share/icons/hicolor/$_icons/apps/splayer.png
+    done
+
+    makeWrapper '${lib.getExe electron}' "$out/bin/splayer" \
+      --add-flags $out/share/splayer/resources/app.asar \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true --wayland-text-input-version=3}}" \
+      --set-default ELECTRON_FORCE_IS_PACKAGED 1 \
+      --set-default ELECTRON_IS_DEV 0 \
+      --inherit-argv0
+
+    runHook postInstall
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "splayer";
+      desktopName = "SPlayer";
+      exec = "splayer %U";
+      terminal = false;
+      type = "Application";
+      icon = "splayer";
+      startupWMClass = "SPlayer";
+      comment = "A minimalist music player";
+      categories = [
+        "AudioVideo"
+        "Audio"
+        "Music"
+      ];
+    })
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Simple Netease Cloud Music player";
+    homepage = "https://github.com/imsyy/SPlayer";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ ccicnce113424 ];
+    mainProgram = "splayer";
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/by-name/te/terraform-mcp-server/package.nix
+++ b/pkgs/by-name/te/terraform-mcp-server/package.nix
@ -5,16 +5,16 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "terraform-mcp-server";
-  version = "0.1.0";
+  version = "0.2.0";

  src = fetchFromGitHub {
    owner = "hashicorp";
    repo = "terraform-mcp-server";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-HYiA0Mfp87czQShiXbS+y20yQzxTn0+hfM0M1kLFZFM=";
+    hash = "sha256-wc9XnaVC/mQIy57PETDgJBskzqjU/HscAQTCFh11Q28=";
  };

-  vendorHash = "sha256-m4J2WGcL0KB1InyciQEmLOSBw779/kagUOIkTwc4CE4=";
+  vendorHash = "sha256-R3sfdx7xffmldH2jzE/q/tBaB/YLOhdLAoFvEScFvn0=";

  ldflags = [
    "-X main.version=${finalAttrs.version}"
--- a/pkgs/by-name/up/upbound/sources-stable.json
+++ b/pkgs/by-name/up/upbound/sources-stable.json
@ -8,38 +8,38 @@
  "fetchurlAttrSet": {
    "docker-credential-up": {
      "aarch64-darwin": {
-        "hash": "sha256-mBL2ytAXOtGwkitBzk1VB4SHS1oZ/9wcyZbCbfxyFko=",
-        "url": "https://cli.upbound.io/stable/v0.39.0/bundle/docker-credential-up/darwin_arm64.tar.gz"
+        "hash": "sha256-ifzc5of2hpZGjbwwkf4iSCgOv5cMoXMxOIZjqfxIwIA=",
+        "url": "https://cli.upbound.io/stable/v0.39.1/bundle/docker-credential-up/darwin_arm64.tar.gz"
      },
      "aarch64-linux": {
-        "hash": "sha256-7BZ9MuszhhWfK6OaDhij8Q6qPXBm58sWLcPN/XjF/QY=",
-        "url": "https://cli.upbound.io/stable/v0.39.0/bundle/docker-credential-up/linux_arm64.tar.gz"
+        "hash": "sha256-Qmtrk4DIMsUiIy2L6oWRC11Xvr6TlXuqOxpkh36LXoY=",
+        "url": "https://cli.upbound.io/stable/v0.39.1/bundle/docker-credential-up/linux_arm64.tar.gz"
      },
      "x86_64-darwin": {
-        "hash": "sha256-wH3KGhRcdDj3bAwTbRZDiKSNyKgsxzfFRtmZKmFCc8A=",
-        "url": "https://cli.upbound.io/stable/v0.39.0/bundle/docker-credential-up/darwin_amd64.tar.gz"
+        "hash": "sha256-rgTp3NPi4aeiRdIbIeXAYkb3HqD3lEkDX8ZhcFlTEZ0=",
+        "url": "https://cli.upbound.io/stable/v0.39.1/bundle/docker-credential-up/darwin_amd64.tar.gz"
      },
      "x86_64-linux": {
-        "hash": "sha256-VChdnWUJgS2meK0POrF3HoPFVskgHTQgUkJaj/yAIFA=",
-        "url": "https://cli.upbound.io/stable/v0.39.0/bundle/docker-credential-up/linux_amd64.tar.gz"
+        "hash": "sha256-mD/TfgFKbBC2OcZF5OZ3ve8l9kHNROnb1jq5XUmvZ7w=",
+        "url": "https://cli.upbound.io/stable/v0.39.1/bundle/docker-credential-up/linux_amd64.tar.gz"
      }
    },
    "up": {
      "aarch64-darwin": {
-        "hash": "sha256-NL0erDPBa35mQoxGscLEYOZEf4QPWIrtEi20v0kkjD4=",
-        "url": "https://cli.upbound.io/stable/v0.39.0/bundle/up/darwin_arm64.tar.gz"
+        "hash": "sha256-jlcAEKJBU8W8SujMTq4+Y3WMDm7FT2GYZQ4725yZQN0=",
+        "url": "https://cli.upbound.io/stable/v0.39.1/bundle/up/darwin_arm64.tar.gz"
      },
      "aarch64-linux": {
-        "hash": "sha256-kZeD9NyUpXJCjEP+KdCy9JnyEBEMNvUJ0DxkKtL/5HI=",
-        "url": "https://cli.upbound.io/stable/v0.39.0/bundle/up/linux_arm64.tar.gz"
+        "hash": "sha256-mJoURxoG5PUi7Jntt6Htyut2aB1FOq9vNYxvrBNQEYk=",
+        "url": "https://cli.upbound.io/stable/v0.39.1/bundle/up/linux_arm64.tar.gz"
      },
      "x86_64-darwin": {
-        "hash": "sha256-0bIC7h4Eor9wFCzxiJaSv3OlDONmiDxLM7aApCcG7bY=",
-        "url": "https://cli.upbound.io/stable/v0.39.0/bundle/up/darwin_amd64.tar.gz"
+        "hash": "sha256-l1APkZL0yYJPcfJ6qzOn/5U/mohfPDXlQ+S+ApSKPJU=",
+        "url": "https://cli.upbound.io/stable/v0.39.1/bundle/up/darwin_amd64.tar.gz"
      },
      "x86_64-linux": {
-        "hash": "sha256-ihjjtkhfXsUPnkeEfCaMTjkX4J+hbyrfpjnMY4kGuSQ=",
-        "url": "https://cli.upbound.io/stable/v0.39.0/bundle/up/linux_amd64.tar.gz"
+        "hash": "sha256-4upXd7g5XDwtMwSbsuZSwOVNkHXjNiB4P9TNXGTqcJc=",
+        "url": "https://cli.upbound.io/stable/v0.39.1/bundle/up/linux_amd64.tar.gz"
      }
    }
  },
@ -49,5 +49,5 @@
    "x86_64-darwin",
    "x86_64-linux"
  ],
-  "version": "0.39.0"
+  "version": "0.39.1"
 }
--- a/pkgs/by-name/va/vault-unseal/package.nix
+++ b/pkgs/by-name/va/vault-unseal/package.nix
@ -5,7 +5,7 @@
 }:

 let
-  version = "0.7.1";
+  version = "0.7.2";
 in
 buildGoModule {
  pname = "vault-unseal";
@ -15,7 +15,7 @@ buildGoModule {
    owner = "lrstanley";
    repo = "vault-unseal";
    rev = "v${version}";
-    hash = "sha256-6beLN+Qw1rXGTEAjUco7xkMzQTFUniJ6pwucDTLKei8=";
+    hash = "sha256-xv33wx/JjvpL9ryyWeZde+a6UPWqYXQcsAxOzmHFAyo=";
  };

  vendorHash = "sha256-hhTJB1g35vB5dLOEY7V7V5ma7Zzyq2bo9kk3gpEcEsY=";
--- a/pkgs/by-name/wa/wayfreeze/package.nix
+++ b/pkgs/by-name/wa/wayfreeze/package.nix
@ -8,19 +8,19 @@

 rustPlatform.buildRustPackage {
  pname = "wayfreeze";
-  version = "0-unstable-2025-03-18";
+  version = "0-unstable-2025-06-29";

  src = fetchFromGitHub {
    owner = "Jappie3";
    repo = "wayfreeze";
-    rev = "8277f981b4aace2a8411b39e2fbd4e15ad211078";
-    hash = "sha256-3lYBzVO1Nssq/uxbZsop7v45yQ+mZs8QhfTMB6XoTzM=";
+    rev = "57877b94804b23e725257fcf26f7c296a5a38f8c";
+    hash = "sha256-dArJwfAm3jqJurNYMUOVzGMMp1ska0D+SkQ6tj0HhqQ=";
  };

  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-jA+hVVV2hM/Hw/9rzGM63UuT/aq488kTMC/AKwSmoJk=";
+  cargoHash = "sha256-uzTT4WyR7kCL/HPu7JHGQqG9tbO1JGIW1Jtlza5lhPk=";

  buildInputs = [
    libxkbcommon
--- a/pkgs/by-name/xb/xbill/package.nix
+++ b/pkgs/by-name/xb/xbill/package.nix
@ -1,21 +1,26 @@
 {
  stdenv,
  lib,
+  autoreconfHook,
  makeDesktopItem,
  copyDesktopItems,
+  fetchpatch,
  fetchurl,
  libX11,
  libXpm,
  libXt,
  motif,
-  ...
 }:

 stdenv.mkDerivation rec {
  pname = "xbill";
  version = "2.1";

-  nativeBuildInputs = [ copyDesktopItems ];
+  nativeBuildInputs = [
+    autoreconfHook # Fix configure script that fails basic compilation check
+    copyDesktopItems
+  ];
+
  buildInputs = [
    libX11
    libXpm
@ -32,9 +37,17 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "http://www.xbill.org/download/${pname}-${version}.tar.gz";
-    sha256 = "13b08lli2gvppmvyhy0xs8cbjbkvrn4b87302mx0pxrdrvqzzz8f";
+    hash = "sha256-Dv3/8c4t9wt6FWActIjNey65GNIdeOh3vXc/ESlFYI0=";
  };

+  # xbill requires strcasecmp and strncasecmp but is missing proper includes
+  patches = [
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/gentoo/gentoo/7c2c329a5a80781a9aaca24221675a0db66fd244/games-arcade/xbill/files/xbill-2.1-clang16.patch";
+      hash = "sha256-Eg8qbSOdUoENcYruH6hSVIHcORkJeP8FXvp09cj/IXA=";
+    })
+  ];
+
  desktopItems = [
    (makeDesktopItem {
      name = "xbill";
@ -53,11 +66,14 @@ stdenv.mkDerivation rec {
    install -Dm644 pixmaps/icon.xpm $out/share/pixmaps/xbill.xpm
  '';

-  meta = with stdenv; {
+  meta = {
    description = "Protect a computer network from getting infected";
    homepage = "http://www.xbill.org/";
    license = lib.licenses.gpl1Only;
-    maintainers = with lib.maintainers; [ aw ];
+    maintainers = with lib.maintainers; [
+      aw
+      jonhermansen
+    ];
    longDescription = ''
      Ever get the feeling that nothing is going right? You're a sysadmin,
      and someone's trying to destroy your computers. The little people
@ -66,5 +82,6 @@ stdenv.mkDerivation rec {
      operating system.
    '';
    mainProgram = "xbill";
+    platforms = lib.platforms.unix;
  };
 }
--- a/pkgs/by-name/ya/yaralyzer/package.nix
+++ b/pkgs/by-name/ya/yaralyzer/package.nix
@ -6,14 +6,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "yaralyzer";
-  version = "0.9.6";
+  version = "1.0.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "michelcrypt4d4mus";
    repo = "yaralyzer";
    tag = "v${version}";
-    hash = "sha256-P2bpwdKbMEoa40RNu8TfbDlRsksEJlYfPiAo9jrXuoE=";
+    hash = "sha256-HrYO7Fz9aLabx7nsilo/b/xe6OOzIq0P2PzVFtAPNEU=";
  };

  pythonRelaxDeps = [
@ -40,7 +40,7 @@ python3.pkgs.buildPythonApplication rec {
  meta = {
    description = "Tool to visually inspect and force decode YARA and regex matches";
    homepage = "https://github.com/michelcrypt4d4mus/yaralyzer";
-    changelog = "https://github.com/michelcrypt4d4mus/yaralyzer/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/michelcrypt4d4mus/yaralyzer/blob/${src.tag}/CHANGELOG.md";
    license = lib.licenses.gpl3Plus;
    maintainers = with lib.maintainers; [ fab ];
    mainProgram = "yaralyze";
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@ -99,7 +99,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "zed-editor";
-  version = "0.192.8";
+  version = "0.193.3";

  outputs =
    [ "out" ]
@ -111,7 +111,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "zed-industries";
    repo = "zed";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-SvfxveVgi2GvnG4d3YUFSn0LY92YrNmwXAicQP5mivk=";
+    hash = "sha256-6/WRuO0UgQFtV0nK8/u3mZPYfAqVzemi3LzuCprOSgY=";
  };

  patches = [
@ -138,7 +138,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    '';

  useFetchCargoVendor = true;
-  cargoHash = "sha256-H7IgJJsdL7UsAWavdzrMQAc8SZqErJSINaLkzh+0Qic=";
+  cargoHash = "sha256-FG2JFnruGqUbIbCeBCqhuzrT/pwDv1tqpAYRMnmvxHk=";

  nativeBuildInputs =
    [
--- a/pkgs/by-name/zi/zipline/package.nix
+++ b/pkgs/by-name/zi/zipline/package.nix
@ -32,18 +32,18 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "zipline";
-  version = "4.1.2";
+  version = "4.2.0";

  src = fetchFromGitHub {
    owner = "diced";
    repo = "zipline";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-xxe64tGxZ2Udr+p21CKTZCHJ19ZOsdgPLlil+v+j5j4=";
+    hash = "sha256-zm2xNhWghg/Pa9LhLzV+AG/tfiSjAiSnGs8OMnC0Tpw=";
  };

  pnpmDeps = pnpm_10.fetchDeps {
    inherit (finalAttrs) pname version src;
-    hash = "sha256-O8RLaKff4Dj/JDeUOyf7GtcFcOu/aOuclyaZmVqVi5s=";
+    hash = "sha256-kIneqtLPZ29PzluKUGO4XbQYHbNddu0kTfoP4C22k7U=";
  };

  buildInputs = [
@ -121,5 +121,6 @@ stdenv.mkDerivation (finalAttrs: {
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ defelo ];
    mainProgram = "zipline";
+    platforms = lib.platforms.linux;
  };
 })
--- a/pkgs/development/libraries/libressl/default.nix
+++ b/pkgs/development/libraries/libressl/default.nix
@ -148,4 +148,9 @@ in
      })
    ];
  };
+
+  libressl_4_1 = generic {
+    version = "4.1.0";
+    hash = "sha256-D3HBa9NL2qzNy5al2UpJIb+2EuxuDrp6gNiFTu/Yu2E=";
+  };
 }
--- a/pkgs/development/python-modules/awsiotsdk/default.nix
+++ b/pkgs/development/python-modules/awsiotsdk/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "awsiotsdk";
-  version = "1.23.0";
+  version = "1.24.0";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "aws";
    repo = "aws-iot-device-sdk-python-v2";
    tag = "v${version}";
-    hash = "sha256-3WrmR6YV4j+itxj/NHFnGw4qoa12aKhqeekMALZ5kUo=";
+    hash = "sha256-bjUppd1neOEeaY+RGcyqXpjhq+plJcopxPRLUBGhks8=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/bloodyad/default.nix
+++ b/pkgs/development/python-modules/bloodyad/default.nix
@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "bloodyad";
-  version = "2.1.20";
+  version = "2.1.21";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -26,7 +26,7 @@ buildPythonPackage rec {
    owner = "CravateRouge";
    repo = "bloodyAD";
    tag = "v${version}";
-    hash = "sha256-mPomYeGuTbj5cKR+/null7EIjuSVsNbKqnPIqAOkZQY=";
+    hash = "sha256-9yzKYSEmaPMv6AWhgr4UPPEx8s75Pg/hwqJnV29WocM=";
  };

  pythonRelaxDeps = [ "cryptography" ];
--- a/pkgs/development/python-modules/celery/default.nix
+++ b/pkgs/development/python-modules/celery/default.nix
@ -118,10 +118,6 @@ buildPythonPackage rec {

  pythonImportsCheck = [ "celery" ];

-  passthru.tests = {
-    inherit (nixosTests) sourcehut;
-  };
-
  meta = with lib; {
    description = "Distributed task queue";
    homepage = "https://github.com/celery/celery/";
--- a/pkgs/development/python-modules/cf-xarray/default.nix
+++ b/pkgs/development/python-modules/cf-xarray/default.nix
@ -24,14 +24,14 @@

 buildPythonPackage rec {
  pname = "cf-xarray";
-  version = "0.10.5";
+  version = "0.10.6";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "xarray-contrib";
    repo = "cf-xarray";
    tag = "v${version}";
-    hash = "sha256-ty7gPBs2vp0mVnn914F84Dg4+DLCBLl7aHMqqrXx9So=";
+    hash = "sha256-zBjNOWDuO6yZNwD4Sv69X2i9ajUGIqvjlRA3gqmtgU8=";
  };

  build-system = [
--- a/pkgs/development/python-modules/django/5_2.nix
+++ b/pkgs/development/python-modules/django/5_2.nix
@ -43,7 +43,7 @@

 buildPythonPackage rec {
  pname = "django";
-  version = "5.2.3";
+  version = "5.2.4";
  pyproject = true;

  disabled = pythonOlder "3.10";
@ -52,7 +52,7 @@ buildPythonPackage rec {
    owner = "django";
    repo = "django";
    rev = "refs/tags/${version}";
-    hash = "sha256-P2WnWkQbzqHNzlIac8boe2VIe2IBdCIB5J6av6J0nvg=";
+    hash = "sha256-0AtH3vyEeQUKep17j5koiUi/ACgLc9JLMxkwWovCkvE=";
  };

  patches =
--- a/pkgs/development/python-modules/model-checker/default.nix
+++ b/pkgs/development/python-modules/model-checker/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "model-checker";
-  version = "0.9.21";
+  version = "0.9.26";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -19,7 +19,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "model_checker";
    inherit version;
-    hash = "sha256-13pGiFrh2EtgSpBZbwWRZh+W9n18Qrikrsc/MBhbBAM=";
+    hash = "sha256-UPqTdKhXDb1D8Ig1dMk8QIiLuyZPQxMp/P1pAKqJ+Bs=";
  };

  # z3 does not provide a dist-info, so python-runtime-deps-check will fail
--- a/pkgs/development/python-modules/msgraph-sdk/default.nix
+++ b/pkgs/development/python-modules/msgraph-sdk/default.nix
@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "msgraph-sdk";
-  version = "1.34.0";
+  version = "1.35.0";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -26,7 +26,7 @@ buildPythonPackage rec {
    owner = "microsoftgraph";
    repo = "msgraph-sdk-python";
    tag = "v${version}";
-    hash = "sha256-fd3ts6El2b3spg0T+awnNlkY7SxXKIAdvbIpo0SkHec=";
+    hash = "sha256-fgblM9KdKbP8mXsOF5FX4pXiJrE6FRxjlh2Kz6Q/rB0=";
  };

  build-system = [ flit-core ];
--- a/pkgs/development/python-modules/py-ocsf-models/default.nix
+++ b/pkgs/development/python-modules/py-ocsf-models/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "py-ocsf-models";
-  version = "0.5.0";
+  version = "0.6.0";
  pyproject = true;

  disabled = pythonOlder "3.9";
@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "prowler-cloud";
    repo = "py-ocsf-models";
    tag = version;
-    hash = "sha256-AK/QaeJNVrVa5TRMJZAjZnemvRwHuxqIWA/mK7Cs4Xc=";
+    hash = "sha256-aHde/dYgY4x5b/iwIddqvfQ3/pRhEp0zDsrK3+jMV44=";
  };

  pythonRelaxDeps = true;
--- a/pkgs/development/python-modules/pyais/default.nix
+++ b/pkgs/development/python-modules/pyais/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "pyais";
-  version = "2.10.0";
+  version = "2.11.1";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "M0r13n";
    repo = "pyais";
    tag = "v${version}";
-    hash = "sha256-/9huwpBO8rMBBOp4icSxRrVvCTSzKJp34brDFKgs+Vk=";
+    hash = "sha256-/etiTXKNcf5sMHxdl2dq1gH3OwKTwrz7zyH3CXmx/vQ=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/pypdf/default.nix
+++ b/pkgs/development/python-modules/pypdf/default.nix
@ -27,7 +27,7 @@

 buildPythonPackage rec {
  pname = "pypdf";
-  version = "5.6.0";
+  version = "5.6.1";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -38,7 +38,7 @@ buildPythonPackage rec {
    tag = version;
    # fetch sample files used in tests
    fetchSubmodules = true;
-    hash = "sha256-tXcpts/7eEmbt5FSXp3f6mS2al01sU9SnzkTAMbD0yc=";
+    hash = "sha256-+/tb370yraT78wGeLc0WVYQ5/SE9PBXMtuazGLiaAJc=";
  };

  outputs = [
--- a/pkgs/os-specific/linux/iputils/default.nix
+++ b/pkgs/os-specific/linux/iputils/default.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "iputils";
-  version = "20240905";
+  version = "20250605";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = version;
-    hash = "sha256-2CjzIOe1hrW3He9DN+w+Wi2zaaMBkVEdA7dezTpkx8I=";
+    hash = "sha256-AJgNPIE90kALu4ihANELr9Dh28LhJ4camLksOIRV8Xo=";
  };

  outputs = [
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@ -27,14 +27,6 @@
        "version": "6.12.35",
        "hash": "sha256:0j577lqmzbzx45gxvxirx627pv6cbhq9slzb50rqqmyy3nqf1x05"
    },
-    "6.13": {
-        "version": "6.13.12",
-        "hash": "sha256:0hhj49k3ksjcp0dg5yiahqzryjfdpr9c1a9ph6j9slzmkikbn7v1"
-    },
-    "6.14": {
-        "version": "6.14.11",
-        "hash": "sha256:06rvydmc2yfspidnsay5hin3i8p4fxy3bvzwnry7gjf9dl5cs71z"
-    },
    "6.15": {
        "version": "6.15.4",
        "hash": "sha256:05psir6p8x5a89d9kxkxlv5iifln67yf803xj5rqvx82nqkxdbqf"
--- a/pkgs/os-specific/linux/tt-kmd/default.nix
+++ b/pkgs/os-specific/linux/tt-kmd/default.nix
@ -0,0 +1,43 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  kernel,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "tt-kmd";
+  version = "2.0.0";
+
+  src = fetchFromGitHub {
+    owner = "tenstorrent";
+    repo = "tt-kmd";
+    tag = "ttkmd-${finalAttrs.version}";
+    hash = "sha256-Y85857oWzsltRyRWpK8Wi0H38mBFwqM3+iXkwVK4DPY=";
+  };
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  buildFlags = [
+    "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  installFlags = finalAttrs.buildFlags ++ [
+    "INSTALL_MOD_PATH=${placeholder "out"}"
+    "INSTALL_MOD_DIR=misc"
+  ];
+
+  installTargets = [ "modules_install" ];
+
+  postInstall = ''
+    mkdir -p $out/lib/udev/rules.d
+    cp udev-50-tenstorrent.rules $out/lib/udev/rules.d/50-tenstorrent.rules
+  '';
+
+  meta = {
+    description = "Tenstorrent Kernel Module";
+    homepage = "https://github.com/tenstorrent/tt-kmd";
+    maintainers = with lib.maintainers; [ RossComputerGuy ];
+    license = with lib.licenses; [ gpl2Only ];
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/servers/home-assistant/custom-components/homematicip_local/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/homematicip_local/package.nix
@ -9,13 +9,13 @@
 buildHomeAssistantComponent rec {
  owner = "SukramJ";
  domain = "homematicip_local";
-  version = "1.84.0";
+  version = "1.84.1";

  src = fetchFromGitHub {
    owner = "SukramJ";
    repo = "custom_homematic";
    tag = version;
-    hash = "sha256-vOMd+C+Is/bj4ZwNu1jkgEvS9EvwdvwxGnmqahMJg8k=";
+    hash = "sha256-iR+y2hY8wF4flMWsh52gcupZbnaAlbwibHx1sY5JmmM=";
  };

  postPatch = ''
--- a/pkgs/stdenv/linux/make-bootstrap-tools-cross.nix
+++ b/pkgs/stdenv/linux/make-bootstrap-tools-cross.nix
@ -32,7 +32,8 @@ lib.mapAttrs (n: make) (
    mipsel-unknown-linux-gnu = mipsel-linux-gnu;
    mips64el-unknown-linux-gnuabin32 = mips64el-linux-gnuabin32;
    mips64el-unknown-linux-gnuabi64 = mips64el-linux-gnuabi64;
-    powerpc64-unknown-linux-gnuabielfv2 = ppc64;
+    powerpc64-unknown-linux-gnuabielfv1 = ppc64-elfv1;
+    powerpc64-unknown-linux-gnuabielfv2 = ppc64-elfv2;
    powerpc64le-unknown-linux-gnu = powernv;
    riscv64-unknown-linux-gnu = riscv64;
    s390x-unknown-linux-gnu = s390x;
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -1150,6 +1150,10 @@ mapAliases {
  linuxPackages_latest_xen_dom0_hardened = linuxPackages_latest_hardened;

  # Added 2021-08-16
+  linuxPackages_6_13_hardened = linuxKernel.packages.linux_6_13_hardened;
+  linux_6_13_hardened = linuxKernel.kernels.linux_6_13_hardened;
+  linuxPackages_6_14_hardened = linuxKernel.packages.linux_6_14_hardened;
+  linux_6_14_hardened = linuxKernel.kernels.linux_6_14_hardened;
  linuxPackages_latest_hardened = throw ''
    The attribute `linuxPackages_hardened_latest' was dropped because the hardened patches
    frequently lag behind the upstream kernel. In some cases this meant that this attribute
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -9141,9 +9141,10 @@ with pkgs;
  inherit (callPackages ../development/libraries/libressl { })
    libressl_3_9
    libressl_4_0
+    libressl_4_1
    ;

-  libressl = libressl_4_0;
+  libressl = libressl_4_1;

  openssl = openssl_3_4;

@ -11062,10 +11063,6 @@ with pkgs;
  linux_6_6_hardened = linuxKernel.kernels.linux_6_6_hardened;
  linuxPackages_6_12_hardened = linuxKernel.packages.linux_6_12_hardened;
  linux_6_12_hardened = linuxKernel.kernels.linux_6_12_hardened;
-  linuxPackages_6_13_hardened = linuxKernel.packages.linux_6_13_hardened;
-  linux_6_13_hardened = linuxKernel.kernels.linux_6_13_hardened;
-  linuxPackages_6_14_hardened = linuxKernel.packages.linux_6_14_hardened;
-  linux_6_14_hardened = linuxKernel.kernels.linux_6_14_hardened;

  # GNU Linux-libre kernels
  linuxPackages-libre = linuxKernel.packages.linux_libre;
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@ -211,22 +211,6 @@ in
          ];
        };

-        linux_6_13 = callPackage ../os-specific/linux/kernel/mainline.nix {
-          branch = "6.13";
-          kernelPatches = [
-            kernelPatches.bridge_stp_helper
-            kernelPatches.request_key_helper
-          ];
-        };
-
-        linux_6_14 = callPackage ../os-specific/linux/kernel/mainline.nix {
-          branch = "6.14";
-          kernelPatches = [
-            kernelPatches.bridge_stp_helper
-            kernelPatches.request_key_helper
-          ];
-        };
-
        linux_6_15 = callPackage ../os-specific/linux/kernel/mainline.nix {
          branch = "6.15";
          kernelPatches = [
@ -318,8 +302,6 @@ in
        linux_6_1_hardened = hardenedKernelFor kernels.linux_6_1 { };
        linux_6_6_hardened = hardenedKernelFor kernels.linux_6_6 { };
        linux_6_12_hardened = hardenedKernelFor kernels.linux_6_12 { };
-        linux_6_13_hardened = hardenedKernelFor kernels.linux_6_13 { };
-        linux_6_14_hardened = hardenedKernelFor kernels.linux_6_14 { };

      }
      // lib.optionalAttrs config.allowAliases {
@ -327,11 +309,15 @@ in
        linux_6_9 = throw "linux 6.9 was removed because it has reached its end of life upstream";
        linux_6_10 = throw "linux 6.10 was removed because it has reached its end of life upstream";
        linux_6_11 = throw "linux 6.11 was removed because it has reached its end of life upstream";
+        linux_6_13 = throw "linux 6.13 was removed because it has reached its end of life upstream";
+        linux_6_14 = throw "linux 6.14 was removed because it has reached its end of life upstream";

        linux_4_19_hardened = throw "linux 4.19 was removed because it will reach its end of life within 24.11";
        linux_6_9_hardened = throw "linux 6.9 was removed because it has reached its end of life upstream";
        linux_6_10_hardened = throw "linux 6.10 was removed because it has reached its end of life upstream";
        linux_6_11_hardened = throw "linux 6.11 was removed because it has reached its end of life upstream";
+        linux_6_13_hardened = throw "linux 6.13 was removed because it has reached its end of life upstream";
+        linux_6_14_hardened = throw "linux 6.14 was removed because it has reached its end of life upstream";

        linux_ham = throw "linux_ham has been removed in favour of the standard kernel packages";
      }
@ -624,6 +610,8 @@ in

        tp_smapi = callPackage ../os-specific/linux/tp_smapi { };

+        tt-kmd = callPackage ../os-specific/linux/tt-kmd { };
+
        turbostat = callPackage ../os-specific/linux/turbostat { };

        corefreq = callPackage ../os-specific/linux/corefreq { };
@ -742,8 +730,6 @@ in
      linux_6_1 = recurseIntoAttrs (packagesFor kernels.linux_6_1);
      linux_6_6 = recurseIntoAttrs (packagesFor kernels.linux_6_6);
      linux_6_12 = recurseIntoAttrs (packagesFor kernels.linux_6_12);
-      linux_6_13 = recurseIntoAttrs (packagesFor kernels.linux_6_13);
-      linux_6_14 = recurseIntoAttrs (packagesFor kernels.linux_6_14);
      linux_6_15 = recurseIntoAttrs (packagesFor kernels.linux_6_15);
    }
    // lib.optionalAttrs config.allowAliases {
@ -751,6 +737,8 @@ in
      linux_6_9 = throw "linux 6.9 was removed because it reached its end of life upstream"; # Added 2024-08-02
      linux_6_10 = throw "linux 6.10 was removed because it reached its end of life upstream"; # Added 2024-10-23
      linux_6_11 = throw "linux 6.11 was removed because it reached its end of life upstream"; # Added 2025-03-23
+      linux_6_13 = throw "linux 6.13 was removed because it reached its end of life upstream"; # Added 2025-06-22
+      linux_6_14 = throw "linux 6.14 was removed because it reached its end of life upstream"; # Added 2025-06-22
    };

  rtPackages = {
@ -786,8 +774,6 @@ in
      linux_6_1_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_1_hardened);
      linux_6_6_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_6_hardened);
      linux_6_12_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_12_hardened);
-      linux_6_13_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_13_hardened);
-      linux_6_14_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_14_hardened);

      linux_zen = recurseIntoAttrs (packagesFor kernels.linux_zen);
      linux_lqx = recurseIntoAttrs (packagesFor kernels.linux_lqx);
@ -805,6 +791,8 @@ in
      linux_6_9_hardened = throw "linux 6.9 was removed because it has reached its end of life upstream";
      linux_6_10_hardened = throw "linux 6.10 was removed because it has reached its end of life upstream";
      linux_6_11_hardened = throw "linux 6.11 was removed because it has reached its end of life upstream";
+      linux_6_13_hardened = throw "linux 6.13 was removed because it has reached its end of life upstream";
+      linux_6_14_hardened = throw "linux 6.14 was removed because it has reached its end of life upstream";
      linux_ham = throw "linux_ham has been removed in favour of the standard kernel packages";
    }
  );