Merge staging-next into staging

maintainers/maintainer-list.nix

@@ -27974,6 +27974,17 @@
     githubId = 908716;
     name = "Zach Coyle";
   };
+  Zaczero = {
+    name = "Kamil Monicz";
+    email = "kamil@monicz.dev";
+    github = "Zaczero";
+    githubId = 10835147;
+    keys = [
+      {
+        fingerprint = "4E67 A4AC 2FA4 2A28 DB40  1FC8 F9FB 19F1 C1DC 9C23";
+      }
+    ];
+  };
   Zaechus = {
     email = "zaechus@proton.me";
     github = "Zaechus";

nixos/modules/services/mail/dovecot.nix

@@ -692,23 +692,67 @@ in
 
     environment.etc."dovecot/dovecot.conf".source = cfg.configFile;
 
-    systemd.services.dovecot2 = {
+    systemd.services.dovecot = {
+      aliases = [ "dovecot2.service" ];
       description = "Dovecot IMAP/POP3 server";
+      documentation = [
+        "man:dovecot(1)"
+        "https://doc.dovecot.org"
+      ];
 
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
-      restartTriggers = [
+      restartTriggers = [ cfg.configFile ];
-        cfg.configFile
-      ];
 
       startLimitIntervalSec = 60; # 1 min
       serviceConfig = {
         Type = "notify";
         ExecStart = "${dovecotPkg}/sbin/dovecot -F";
         ExecReload = "${dovecotPkg}/sbin/doveadm reload";
+
+        CapabilityBoundingSet = [
+          "CAP_CHOWN"
+          "CAP_DAC_OVERRIDE"
+          "CAP_FOWNER"
+          "CAP_NET_BIND_SERVICE"
+          "CAP_SETGID"
+          "CAP_SETUID"
+          "CAP_SYS_CHROOT"
+          "CAP_SYS_RESOURCE"
+        ];
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        OOMPolicy = "continue";
+        PrivateTmp = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = lib.mkDefault false;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "full";
+        PrivateDevices = true;
         Restart = "on-failure";
         RestartSec = "1s";
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = false; # sets sgid on maildirs
         RuntimeDirectory = [ "dovecot2" ];
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service @resources"
+          "~@privileged"
+          "@chown @setuid capset chroot"
+        ];
       };
 
       # When copying sieve scripts preserve the original time stamp

nixos/modules/services/monitoring/ups.nix

@@ -359,7 +359,7 @@ let
           {
             MINSUPPLIES = 1;
             MONITOR = <generated from config.power.ups.upsmon.monitor>
-            NOTIFYCMD = "''${pkgs.nut}/bin/upssched";
+            NOTIFYCMD = "''${cfg.package}/bin/upssched";
             POWERDOWNFLAG = "/run/killpower";
             SHUTDOWNCMD = "''${pkgs.systemd}/bin/shutdown now";
           }
@@ -396,7 +396,7 @@ let
             type
           ]
         );
-        NOTIFYCMD = lib.mkDefault "${pkgs.nut}/bin/upssched";
+        NOTIFYCMD = lib.mkDefault "${cfg.package}/bin/upssched";
         POWERDOWNFLAG = lib.mkDefault "/run/killpower";
         SHUTDOWNCMD = lib.mkDefault "${pkgs.systemd}/bin/shutdown now";
       };
@@ -459,6 +459,8 @@ in
         Supplies, Power Distribution Units and Solar Controllers
       '';
 
+      package = lib.mkPackageOption pkgs "nut" { };
+
       mode = lib.mkOption {
         default = "standalone";
         type = lib.types.enum [
@@ -577,7 +579,7 @@ in
     ];
 
     # For interactive use.
-    environment.systemPackages = [ pkgs.nut ];
+    environment.systemPackages = [ cfg.package ];
     environment.variables = envVars;
 
     networking.firewall = lib.mkIf cfg.openFirewall {
@@ -606,8 +608,8 @@ in
         serviceConfig = {
           Type = "forking";
           ExecStartPre = "${createUpsmonConf}";
-          ExecStart = "${pkgs.nut}/sbin/upsmon -u ${cfg.upsmon.user}";
+          ExecStart = "${cfg.package}/sbin/upsmon -u ${cfg.upsmon.user}";
-          ExecReload = "${pkgs.nut}/sbin/upsmon -c reload";
+          ExecReload = "${cfg.package}/sbin/upsmon -c reload";
           LoadCredential = lib.mapAttrsToList (
             name: monitor: "upsmon_password_${name}:${monitor.passwordFile}"
           ) cfg.upsmon.monitor;
@@ -633,8 +635,8 @@ in
           Type = "forking";
           ExecStartPre = "${createUpsdUsers}";
           # TODO: replace 'root' by another username.
-          ExecStart = "${pkgs.nut}/sbin/upsd -u root";
+          ExecStart = "${cfg.package}/sbin/upsd -u root";
-          ExecReload = "${pkgs.nut}/sbin/upsd -c reload";
+          ExecReload = "${cfg.package}/sbin/upsd -c reload";
           LoadCredential = lib.mapAttrsToList (
             name: user: "upsdusers_password_${name}:${user.passwordFile}"
           ) cfg.users;
@@ -655,7 +657,7 @@ in
         Type = "oneshot";
         RemainAfterExit = true;
         # TODO: replace 'root' by another username.
-        ExecStart = "${pkgs.nut}/bin/upsdrvctl -u root start";
+        ExecStart = "${cfg.package}/bin/upsdrvctl -u root start";
         Slice = "system-ups.slice";
       };
       environment = envVars;
@@ -677,7 +679,7 @@ in
       environment = envVars;
       serviceConfig = {
         Type = "oneshot";
-        ExecStart = "${pkgs.nut}/bin/upsdrvctl shutdown";
+        ExecStart = "${cfg.package}/bin/upsdrvctl shutdown";
         Slice = "system-ups.slice";
       };
     };
@@ -702,14 +704,14 @@ in
       "nut/upsmon.conf".source = "/run/nut/upsmon.conf";
     };
 
-    power.ups.schedulerRules = lib.mkDefault "${pkgs.nut}/etc/upssched.conf.sample";
+    power.ups.schedulerRules = lib.mkDefault "${cfg.package}/etc/upssched.conf.sample";
 
     systemd.tmpfiles.rules = [
       "d /var/state/ups -"
       "d /var/lib/nut 700"
     ];
 
-    services.udev.packages = [ pkgs.nut ];
+    services.udev.packages = [ cfg.package ];
 
     users.users.nutmon = lib.mkIf (cfg.upsmon.user == "nutmon") {
       isSystemUser = true;

nixos/tests/dovecot.nix

@@ -84,11 +84,13 @@ import ./make-test-python.nix {
 
   testScript = ''
     machine.wait_for_unit("postfix.service")
-    machine.wait_for_unit("dovecot2.service")
+    machine.wait_for_unit("dovecot.service")
     machine.succeed("send-testmail")
     machine.succeed("send-lda")
     machine.wait_until_fails('[ "$(postqueue -p)" != "Mail queue is empty" ]')
     machine.succeed("test-imap")
     machine.succeed("test-pop")
+
+    machine.log(machine.succeed("systemd-analyze security dovecot.service | grep -v ✓"))
   '';
 }

pkgs/applications/emulators/libretro/cores/pcsx2.nix

@@ -11,13 +11,13 @@
 }:
 mkLibretroCore {
   core = "pcsx2";
-  version = "0-unstable-2025-03-15";
+  version = "0-unstable-2025-07-03";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "ps2";
-    rev = "6cc162de2162a0ffe92a4e0470141b9c7c095bf3";
+    rev = "f8c9740897cbba47ee5ecda9f1c34d73daf81379";
-    hash = "sha256-hzM4nt7Cp7l2fLtG60YmqVchuFskqVDyaZPHIO0E6Ws=";
+    hash = "sha256-2/CYjilppD/7o3G4kNMUTbEP91DQYct0ojHwShNy8cw=";
     fetchSubmodules = true;
   };
 

pkgs/applications/gis/qgis/unwrapped-ltr.nix

@@ -82,14 +82,14 @@ let
   ];
 in
 mkDerivation rec {
-  version = "3.40.7";
+  version = "3.40.8";
   pname = "qgis-ltr-unwrapped";
 
   src = fetchFromGitHub {
     owner = "qgis";
     repo = "QGIS";
     rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-XC3UVKtOokFH9MDnz7M1+aTfNFVQKGYV2jTThE69jQs=";
+    hash = "sha256-3zVZP+cRln896nV/uPbaqauJaxv7aFsKWUXfvjMqAh8=";
   };
 
   passthru = {

pkgs/applications/version-management/git-repo-updater/default.nix

@@ -1,6 +1,7 @@
 {
   lib,
   buildPythonApplication,
+  hatchling,
   colorama,
   fetchPypi,
   gitpython,
@@ -8,14 +9,15 @@
 
 buildPythonApplication rec {
   pname = "gitup";
-  version = "0.5.1";
+  version = "0.5.2";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1pa612rcc94nc461zs9sag9p46sycc214622b06gdn35rmwp0y2g";
+    sha256 = "sha256-51DWPJ9JOMrRdWGaiiL4qzo4VFFeT1rG5yyI6Ej+ZRw=";
   };
 
+  build-system = [ hatchling ];
   propagatedBuildInputs = [
     colorama
     gitpython
@@ -28,7 +30,10 @@ buildPythonApplication rec {
     description = "Easily update multiple Git repositories at once";
     homepage = "https://github.com/earwig/git-repo-updater";
     license = licenses.mit;
-    maintainers = with maintainers; [ bdesham ];
+    maintainers = with maintainers; [
+      bdesham
+      artturin
+    ];
     mainProgram = "gitup";
   };
 }

pkgs/by-name/_1/_1password-gui/sources.json

@@ -29,15 +29,15 @@
   },
   "beta": {
     "linux": {
-      "version": "8.10.82-27.BETA",
+      "version": "8.11.0-25.BETA",
       "sources": {
         "x86_64": {
-          "url": "https://downloads.1password.com/linux/tar/beta/x86_64/1password-8.10.82-27.BETA.x64.tar.gz",
+          "url": "https://downloads.1password.com/linux/tar/beta/x86_64/1password-8.11.0-25.BETA.x64.tar.gz",
-          "hash": "sha256-6ncTm+rgEPGRwMquOCWH8sXin9CrjiHsUDLKo3CrLIM="
+          "hash": "sha256-TMVquYVZPxJGxn7vEwhSsD5eebM+9xovdBB/5/y2ygc="
         },
         "aarch64": {
-          "url": "https://downloads.1password.com/linux/tar/beta/aarch64/1password-8.10.82-27.BETA.arm64.tar.gz",
+          "url": "https://downloads.1password.com/linux/tar/beta/aarch64/1password-8.11.0-25.BETA.arm64.tar.gz",
-          "hash": "sha256-fRgTfZjQRrPbYUKIub+y9iYSBvsElN90ag0maPKTM2g="
+          "hash": "sha256-eV6gTKbTWkC1Kg5vyGf4tgiBxOQ5ZOKha03PSTGVE9Q="
         }
       }
     },
@@ -56,3 +56,4 @@
     }
   }
 }
+

pkgs/by-name/ch/chirpstack-rest-api/package.nix

@@ -6,16 +6,16 @@
 }:
 buildGoModule rec {
   pname = "chirpstack-rest-api";
-  version = "4.12.0";
+  version = "4.13.0";
 
   src = fetchFromGitHub {
     owner = "chirpstack";
     repo = "chirpstack-rest-api";
     rev = "v${version}";
-    hash = "sha256-0OeWrE+9YJTf72+1KTpySutjlY53QYqSdl8bwS2MY10=";
+    hash = "sha256-uJF8VZO3hAdjcvmc370Gw1qJqmOlYCzRJNYYGUImKgE=";
   };
 
-  vendorHash = "sha256-5fP2v5JTsBkJ1SLx94HWLKwf5Jb3desLen3VxwER9vE=";
+  vendorHash = "sha256-rnlsWvA98OT6gd4yw7kF5h+6obQ3UwmZLldujEOIWBw=";
 
   ldflags = [
     "-s"

pkgs/by-name/di/diebahn/package.nix

@@ -24,18 +24,18 @@
 
 stdenv.mkDerivation rec {
   pname = "diebahn";
-  version = "2.8.1";
+  version = "2.8.2";
 
   src = fetchFromGitLab {
     owner = "schmiddi-on-mobile";
     repo = "railway";
     tag = version;
-    hash = "sha256-mHHebsQKxjwsQd14oVDnencCCL8hOWIWhKF/J9aVeBU=";
+    hash = "sha256-pPjOl46R8hBpyKdwq/gwHv/qCtFkI0LVDsqxcQOgtkU=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-M6z8HfGehd+AdOEJZgmmonfqQa7Jevte+TaaatqRZHQ=";
+    hash = "sha256-kxt6z2RaSnlso/Jz36B9VNwti2o3b8+Ggd4zDIjFf2c=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/en/enzyme/package.nix

@@ -7,13 +7,13 @@
 }:
 llvmPackages.stdenv.mkDerivation rec {
   pname = "enzyme";
-  version = "0.0.183";
+  version = "0.0.184";
 
   src = fetchFromGitHub {
     owner = "EnzymeAD";
     repo = "Enzyme";
     rev = "v${version}";
-    hash = "sha256-fXkDT+4n8gXZ2AD+RBjHJ3tGPnZlUU7p62bdiOumaBY=";
+    hash = "sha256-qLV21DlZpRrGobjqcpwNvm7J+gCi/2yj1eXKPbC/j8A=";
   };
 
   postPatch = ''

pkgs/by-name/kl/kluctl/package.nix

@@ -1,61 +1,72 @@
 {
   lib,
+  stdenv,
   buildGoModule,
+  buildPackages,
   fetchFromGitHub,
+  installShellFiles,
   testers,
   makeWrapper,
   python310,
-  kluctl,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "kluctl";
-  version = "2.26.0";
+  version = "2.27.0";
 
   src = fetchFromGitHub {
     owner = "kluctl";
     repo = "kluctl";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
-    hash = "sha256-qtntImc+fiRPMUHVM4A8d2e17zklV47CJ10M9A8oa7k=";
+    hash = "sha256-m/bfZb+sp0gqxfMdBr/gAOxfYHdrPwKRcJAqprkAkQE=";
   };
 
   subPackages = [ "cmd" ];
 
-  vendorHash = "sha256-89VEYX8xBdV36hHNIaRP8JoXTEGXmgzL7iL/Y4+1mzA=";
+  vendorHash = "sha256-TKMMMZ+8bv5kKgrHIp3CXmt4tpi5VejPpXv/oiX4M3c=";
 
   ldflags = [
     "-s"
     "-w"
-    "-X main.version=v${version}"
+    "-X main.version=v${finalAttrs.version}"
   ];
 
   # Depends on docker
   doCheck = false;
 
   nativeBuildInputs = [
+    installShellFiles
     makeWrapper
   ];
 
   passthru.tests.version = testers.testVersion {
-    package = kluctl;
+    package = finalAttrs.finalPackage;
-    version = "v${version}";
+    version = "v${finalAttrs.version}";
   };
 
-  postInstall = ''
+  postInstall =
-    mv $out/bin/{cmd,kluctl}
+    let
-    wrapProgram $out/bin/kluctl \
+      emulator = stdenv.hostPlatform.emulator buildPackages;
+    in
+    ''
+      mv $out/bin/{cmd,kluctl}
+      wrapProgram $out/bin/kluctl \
         --set KLUCTL_USE_SYSTEM_PYTHON 1 \
         --prefix PATH : '${lib.makeBinPath [ python310 ]}'
-  '';
+      installShellCompletion --cmd kluctl \
+        --bash <(${emulator} $out/bin/kluctl completion bash) \
+        --fish <(${emulator} $out/bin/kluctl completion fish) \
+        --zsh  <(${emulator} $out/bin/kluctl completion zsh)
+    '';
 
-  meta = with lib; {
+  meta = {
     description = "Missing glue to put together large Kubernetes deployments";
     mainProgram = "kluctl";
     homepage = "https://kluctl.io/";
-    license = licenses.asl20;
+    license = lib.licenses.asl20;
-    maintainers = with maintainers; [
+    maintainers = with lib.maintainers; [
       sikmir
       netthier
     ];
   };
-}
+})

pkgs/by-name/lu/lutgen/package.nix

@@ -4,24 +4,35 @@
   rustPlatform,
   stdenv,
   installShellFiles,
+  nix-update-script,
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "lutgen";
-  version = "0.12.1";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "ozwaldorf";
     repo = "lutgen-rs";
-    rev = "v${version}";
+    tag = "lutgen-v${version}";
-    hash = "sha256-JFVDiq53AZhiTqEXplCuKoATxeHp/HDJ8p0a6WzVq6I=";
+    hash = "sha256-hJ5yD8Yu08kcr2rWY59iVEFJH+chroEWSsP2g5agFuo=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-tOFO2eRWd03zzGX3Ia1IBQ27kmSMX7JgbXmaejRTfp4=";
+  cargoHash = "sha256-VsKRLxh6uRG2A5AvJBMdD+bXg/X9mp5o1iPR9MZhrbQ=";
 
   nativeBuildInputs = [ installShellFiles ];
 
+  cargoBuildFlags = [
+    "--bin"
+    "lutgen"
+  ];
+
+  cargoTestFlags = [
+    "-p"
+    "lutgen-cli"
+  ];
+
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd lutgen \
       --bash <($out/bin/lutgen --bpaf-complete-style-bash) \
@@ -29,6 +40,10 @@ rustPlatform.buildRustPackage rec {
       --zsh <($out/bin/lutgen --bpaf-complete-style-zsh)
   '';
 
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version-regex=^lutgen-v([0-9.]+)$" ];
+  };
+
   meta = with lib; {
     description = "Blazingly fast interpolated LUT generator and applicator for arbitrary and popular color palettes";
     homepage = "https://github.com/ozwaldorf/lutgen-rs";

pkgs/by-name/ma/mapproxy/package.nix

@@ -7,7 +7,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "mapproxy";
-  version = "4.1.2";
+  version = "5.0.0";
   format = "setuptools";
   disabled = python3Packages.pythonOlder "3.8";
 
@@ -15,16 +15,15 @@ python3Packages.buildPythonApplication rec {
     owner = "mapproxy";
     repo = "mapproxy";
     tag = version;
-    hash = "sha256-sh0kViv1Ax/2YPL2ON+X03d5Moa2oPWhb4Rp6Ni5AAY=";
+    hash = "sha256-+L9ZTgWh4E5cUGeP0rTclDbnqIzc/DlHvIXR+kDcjm8=";
   };
 
   prePatch = ''
-    substituteInPlace mapproxy/util/ext/serving.py --replace "args = [sys.executable] + sys.argv" "args = sys.argv"
+    substituteInPlace mapproxy/util/ext/serving.py --replace-warn "args = [sys.executable] + sys.argv" "args = sys.argv"
   '';
 
   dependencies = with python3Packages; [
     boto3 # needed for caches service
-    future
     jsonschema
     pillow
     pyyaml

pkgs/by-name/nu/nut/package.nix

@@ -21,7 +21,31 @@
   systemd,
   udev,
   gnused,
+  withApcModbus ? false,
+  fetchFromGitHub,
 }:
+let
+  # rebuild libmodbus with downstream usb patches from
+  # https://github.com/networkupstools/libmodbus
+  # finding the docs for this was actually relatively hard
+  # so save them here for reference
+  # https://github.com/networkupstools/nut/wiki/APC-UPS-with-Modbus-protocol
+  libmodbus' = libmodbus.overrideAttrs (finalAttrs: {
+    version = "3.1.11-withUsbRTU-NUT";
+
+    src = fetchFromGitHub {
+      owner = "networkupstools";
+      repo = "libmodbus";
+      rev = "8b9bdcde6938f85415098af74b720b7ad5ed74b4";
+      hash = "sha256-ZimIVLKhVjknLNFB+1jGA9N/3YqxHfGX1+l1mpk5im4=";
+    };
+
+    buildInputs = [
+      libusb1
+    ];
+  });
+  modbus = if withApcModbus then libmodbus' else libmodbus;
+in
 
 stdenv.mkDerivation rec {
   pname = "nut";
@@ -46,7 +70,7 @@ stdenv.mkDerivation rec {
       libgpiod = "${libgpiod_1}/lib";
       libusb = "${libusb1}/lib";
       neon = "${neon}/lib";
-      libmodbus = "${libmodbus}/lib";
+      libmodbus = "${modbus}/lib";
       netsnmp = "${net-snmp.lib}/lib";
     })
   ];
@@ -59,11 +83,11 @@ stdenv.mkDerivation rec {
     avahi
     freeipmi
     libgpiod_1
-    libmodbus
     libtool
     i2c-tools
     net-snmp
     gd
+    modbus
   ];
 
   nativeBuildInputs = [
@@ -73,17 +97,20 @@ stdenv.mkDerivation rec {
   ];
 
   doInstallCheck = true;
-
+  configureFlags =
-  configureFlags = [
+    [
-    "--with-all"
+      "--with-all"
-    "--with-ssl"
+      "--with-ssl"
-    "--without-powerman" # Until we have it ...
+      "--without-powerman" # Until we have it ...
-    "--with-systemdsystempresetdir=$(out)/lib/systemd/system-preset"
+      "--with-systemdsystempresetdir=$(out)/lib/systemd/system-preset"
-    "--with-systemdsystemunitdir=$(out)/lib/systemd/system"
+      "--with-systemdsystemunitdir=$(out)/lib/systemd/system"
-    "--with-systemdshutdowndir=$(out)/lib/systemd/system-shutdown"
+      "--with-systemdshutdowndir=$(out)/lib/systemd/system-shutdown"
-    "--with-systemdtmpfilesdir=$(out)/lib/tmpfiles.d"
+      "--with-systemdtmpfilesdir=$(out)/lib/tmpfiles.d"
-    "--with-udev-dir=$(out)/etc/udev"
+      "--with-udev-dir=$(out)/etc/udev"
-  ];
+    ]
+    ++ (lib.lists.optionals withApcModbus [
+      "--with-modbus+usb"
+    ]);
 
   enableParallelBuilding = true;
 

pkgs/by-name/ra/rattler-build/package.nix

@@ -14,17 +14,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rattler-build";
-  version = "0.43.1";
+  version = "0.44.0";
 
   src = fetchFromGitHub {
     owner = "prefix-dev";
     repo = "rattler-build";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-thpo6tD2qWs3FruqujoLd0WLuSDidI3/wdIDOlyEioU=";
+    hash = "sha256-VgthpzZNFBIV4SwikmHJkRsuEP0j16hVt+CxOBuOy6s=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-eXsZ0tO1yR5A67GiQQHYv+i4tip7QDLa1oERkVJVQwk=";
+  cargoHash = "sha256-HO4DXuCs/Jtz7kzp3jn/X/75Zdh9gS0ZO3eS9GFCbXA=";
 
   doCheck = false; # test requires network access
 

pkgs/by-name/sc/scala-cli/sources.json

@@ -1,21 +1,21 @@
 {
-  "version": "1.8.2",
+  "version": "1.8.3",
   "assets": {
     "aarch64-darwin": {
       "asset": "scala-cli-aarch64-apple-darwin.gz",
-      "sha256": "1sc2ay5mka4widdls50fic4fhvbsw31wwjhzvziq2zz4mp6f60dm"
+      "sha256": "0r5ximsin9b2xd9m7cbh5d294mcdhc6w41lsydkh0xs6kvy7gkd1"
     },
     "aarch64-linux": {
       "asset": "scala-cli-aarch64-pc-linux.gz",
-      "sha256": "0h5b3dh0sdw496wx4y2xz9p513prl7y4sgbz4rgz6vxkhv6sdns3"
+      "sha256": "0913pvppxk8yxs74zqrqf78vjw891r0dx1cn5n1djkn9nim8fxg7"
     },
     "x86_64-darwin": {
       "asset": "scala-cli-x86_64-apple-darwin.gz",
-      "sha256": "1ar3mfrbrw1dqc7bdk1snh08h3gqraqd2kvmhlxbck4ba1vn86nx"
+      "sha256": "0z757cb44gm0d7vqm1dsl3jkcqp7cmbypll74ih28c8gf4llnrgd"
     },
     "x86_64-linux": {
       "asset": "scala-cli-x86_64-pc-linux.gz",
-      "sha256": "0nk7z4h47jk1mr89clkalnw34xvhzsmr408gd0xzf7wvmyfh9kwg"
+      "sha256": "0ddk8f8pr24hmnc9a8r8smswh19fxgya16mkakmvhxk3xb0i1gz0"
     }
   }
 }

pkgs/by-name/uv/uv/package.nix

@@ -18,17 +18,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "uv";
-  version = "0.7.17";
+  version = "0.7.19";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "uv";
     tag = finalAttrs.version;
-    hash = "sha256-XZ0wlnj76iWgK6jvckI+bSo75PFKAbqUm6jLBKt9+ys=";
+    hash = "sha256-p5Wzir6rXdI3piz9K7xyoWhDYhN7sZW9eWEVonvCdlM=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-imcz/qzq2p9mwDjaqVzIvz7QY0Hte/WSBNNcLa5Njv0=";
+  cargoHash = "sha256-RftLwT/I+o86JEIXijB5SJc50ZJ960O/Tricngokan8=";
 
   buildInputs = [
     rust-jemalloc-sys

pkgs/by-name/wa/wac-cli/package.nix

@@ -0,0 +1,29 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  name = "wac-cli";
+  version = "0.7.0";
+  src = fetchFromGitHub {
+    owner = "bytecodealliance";
+    repo = "wac";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-VJq7xWTQcvXSzwCqdU53GNAk778f/Xp0IAomsD3c8pQ=";
+  };
+
+  cargoHash = "sha256-connilUNS+BKdVXDPCSA+QY/DY3wVt+SzxGAto8eeZE=";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "WebAssembly Composition (WAC) tooling";
+    license = lib.licenses.asl20;
+    homepage = "https://github.com/bytecodealliance/wac";
+    maintainers = with lib.maintainers; [ water-sucks ];
+    mainProgram = "wac";
+  };
+})

pkgs/development/julia-modules/default.nix

@@ -7,8 +7,6 @@
   makeWrapper,
   python3,
   runCommand,
-  system,
-  writeText,
   writeTextFile,
 
   # Artifacts dependencies

pkgs/development/libraries/sqlite/default.nix

@@ -80,6 +80,8 @@ stdenv.mkDerivation rec {
       "--libdir=${placeholder "out"}/lib"
     ]
     ++ lib.optional (!interactive) "--disable-readline"
+    # autosetup only looks up readline.h in predefined set of directories.
+    ++ lib.optional interactive "--with-readline-header=${lib.getDev readline}/include/readline/readline.h"
     ++ lib.optional (stdenv.hostPlatform.isStatic) "--disable-shared";
 
   env.NIX_CFLAGS_COMPILE = toString [

pkgs/development/python-modules/coiled/default.nix

@@ -39,12 +39,12 @@
 
 buildPythonPackage rec {
   pname = "coiled";
-  version = "1.103.1";
+  version = "1.106.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-EtshOvxaGbciOf0bc0EaNVkOEKI6Z2PbR6ZtgPCuzkc=";
+    hash = "sha256-efy+ajZywr+/zREq1jnVbJm89cckRbmOX/0Jtc5AZCA=";
   };
 
   build-system = [

pkgs/development/python-modules/starlette-compress/default.nix

@@ -48,6 +48,9 @@ buildPythonPackage rec {
     description = "Compression middleware for Starlette - supporting ZStd, Brotli, and GZip";
     homepage = "https://pypi.org/p/starlette-compress";
     license = lib.licenses.bsd0;
-    maintainers = with lib.maintainers; [ wrvsrx ];
+    maintainers = with lib.maintainers; [
+      wrvsrx
+      Zaczero
+    ];
   };
 }

pkgs/kde/gear/kdepim-runtime/default.nix

@@ -1,5 +1,4 @@
 {
-  fetchpatch,
   mkKdeDerivation,
   pkg-config,
   shared-mime-info,
@@ -15,15 +14,6 @@
 mkKdeDerivation {
   pname = "kdepim-runtime";
 
-  # Backport patch recommended by upstream
-  # FIXME: remove in next update
-  patches = [
-    (fetchpatch {
-      url = "https://invent.kde.org/pim/kdepim-runtime/-/commit/25202045186262a081c960461a8b791f84fccb5c.patch";
-      hash = "sha256-D769X/v16drueNNr4HfbIZPpjNul8qiKHpOu0BNcbc8=";
-    })
-  ];
-
   extraNativeBuildInputs = [
     pkg-config
     shared-mime-info

pkgs/servers/home-assistant/custom-components/yandex-station/package.nix

@@ -10,19 +10,23 @@
 buildHomeAssistantComponent rec {
   owner = "AlexxIT";
   domain = "yandex_station";
-  version = "3.18.3";
+  version = "3.19.1";
 
   src = fetchFromGitHub {
     owner = "AlexxIT";
     repo = "YandexStation";
     tag = "v${version}";
-    hash = "sha256-l8DsL8g6K8/SjCIk7rjfQSk4iRsKBoGgzJpy7UhxQ7o=";
+    hash = "sha256-O+LHD9wKnXaNX/aVrt5lOuuqi1ymF+YqEJP+24NVBhw=";
   };
 
   dependencies = [
     zeroconf
   ];
 
+  pytestFlagsArray = [
+    # this test seems to be broken
+    "--deselect=tests/test_local.py::test_track"
+  ];
   nativeCheckInputs = [
     home-assistant
     pytestCheckHook