Merge master into staging-next

2025-07-05 12:06:19 +00:00 · 2025-07-05 12:06:19 +00:00 · d5e57e9a43
commit d5e57e9a43
parent 2d8cca0a45 a2024a3842
105 changed files with 2508 additions and 1417 deletions
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@ -56,6 +56,8 @@

 - [mautrix-discord](https://github.com/mautrix/discord), a Matrix-Discord puppeting/relay bridge. Available as [services.mautrix-discord](#opt-services.mautrix-discord.enable).

+- [SuiteNumérique Meet](https://github.com/suitenumerique/meet) is an open source alternative to Google Meet and Zoom powered by LiveKit: HD video calls, screen sharing, and chat features. Built with Django and React. Available as [services.lasuite-meet](#opt-services.lasuite-meet.enable).
+
 ## Backward Incompatibilities {#sec-release-25.11-incompatibilities}

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
--- a/nixos/modules/i18n/input-method/fcitx5.nix
+++ b/nixos/modules/i18n/input-method/fcitx5.nix
@ -155,9 +155,10 @@ in
      // lib.optionalAttrs (!cfg.waylandFrontend) {
        GTK_IM_MODULE = "fcitx";
        QT_IM_MODULE = "fcitx";
-      }
-      // lib.optionalAttrs cfg.ignoreUserConfig {
-        SKIP_FCITX_USER_PATH = "1";
      };
+
+    environment.sessionVariables = lib.mkIf cfg.ignoreUserConfig {
+      SKIP_FCITX_USER_PATH = "1";
+    };
  };
 }
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -1596,6 +1596,7 @@
  ./services/web-apps/komga.nix
  ./services/web-apps/lanraragi.nix
  ./services/web-apps/lasuite-docs.nix
+  ./services/web-apps/lasuite-meet.nix
  ./services/web-apps/lemmy.nix
  ./services/web-apps/limesurvey.nix
  ./services/web-apps/mainsail.nix
--- a/nixos/modules/programs/fish.nix
+++ b/nixos/modules/programs/fish.nix
@ -293,7 +293,7 @@ in
                ''
                  mkdir -p $out
                  if [ -d $package/share/man ]; then
-                    find $package/share/man -type f | xargs ${pkgs.python3.pythonOnBuildForHost.interpreter} ${patchedGenerator}/create_manpage_completions.py --directory $out >/dev/null
+                    find -L $package/share/man -type f | xargs ${pkgs.python3.pythonOnBuildForHost.interpreter} ${patchedGenerator}/create_manpage_completions.py --directory $out >/dev/null
                  fi
                '';
          in
--- a/nixos/modules/programs/rust-motd.nix
+++ b/nixos/modules/programs/rust-motd.nix
@ -150,13 +150,10 @@ in
      wantedBy = [ "timers.target" ];
      timerConfig.OnCalendar = cfg.refreshInterval;
    };
-    security.pam.services.sshd.text = lib.mkIf cfg.enableMotdInSSHD (
-      lib.mkDefault (
-        lib.mkAfter ''
-          session optional ${pkgs.pam}/lib/security/pam_motd.so motd=/var/lib/rust-motd/motd
-        ''
-      )
-    );
+
+    security.pam.services.sshd.showMotd = lib.mkIf cfg.enableMotdInSSHD true;
+    users.motdFile = lib.mkIf cfg.enableMotdInSSHD "/var/lib/rust-motd/motd";
+
    services.openssh.extraConfig =
      lib.mkIf (cfg.settings ? last_login && cfg.settings.last_login != { })
        ''
--- a/nixos/modules/services/web-apps/lasuite-meet.nix
+++ b/nixos/modules/services/web-apps/lasuite-meet.nix
@ -0,0 +1,449 @@
+{
+  config,
+  lib,
+  pkgs,
+  utils,
+  ...
+}:
+let
+  inherit (lib)
+    getExe
+    mapAttrs
+    mkEnableOption
+    mkIf
+    mkPackageOption
+    mkOption
+    types
+    optional
+    optionalString
+    ;
+
+  cfg = config.services.lasuite-meet;
+
+  pythonEnvironment = mapAttrs (
+    _: value:
+    if value == null then
+      "None"
+    else if value == true then
+      "True"
+    else if value == false then
+      "False"
+    else
+      toString value
+  ) cfg.settings;
+
+  commonServiceConfig = {
+    RuntimeDirectory = "lasuite-meet";
+    StateDirectory = "lasuite-meet";
+    WorkingDirectory = "/var/lib/lasuite-meet";
+
+    User = "lasuite-meet";
+    DynamicUser = true;
+    SupplementaryGroups = mkIf cfg.redis.createLocally [
+      config.services.redis.servers.lasuite-meet.group
+    ];
+    # hardening
+    AmbientCapabilities = "";
+    CapabilityBoundingSet = [ "" ];
+    DevicePolicy = "closed";
+    LockPersonality = true;
+    NoNewPrivileges = true;
+    PrivateDevices = true;
+    PrivateTmp = true;
+    PrivateUsers = true;
+    ProcSubset = "pid";
+    ProtectClock = true;
+    ProtectControlGroups = true;
+    ProtectHome = true;
+    ProtectHostname = true;
+    ProtectKernelLogs = true;
+    ProtectKernelModules = true;
+    ProtectKernelTunables = true;
+    ProtectProc = "invisible";
+    ProtectSystem = "strict";
+    RemoveIPC = true;
+    RestrictAddressFamilies = [
+      "AF_INET"
+      "AF_INET6"
+      "AF_UNIX"
+    ];
+    RestrictNamespaces = true;
+    RestrictRealtime = true;
+    RestrictSUIDSGID = true;
+    SystemCallArchitectures = "native";
+    MemoryDenyWriteExecute = true;
+    EnvironmentFile = optional (cfg.environmentFile != null) cfg.environmentFile;
+    UMask = "0077";
+  };
+in
+{
+  options.services.lasuite-meet = {
+    enable = mkEnableOption "SuiteNumérique Meet";
+
+    backendPackage = mkPackageOption pkgs "lasuite-meet" { };
+
+    frontendPackage = mkPackageOption pkgs "lasuite-meet-frontend" { };
+
+    bind = mkOption {
+      type = types.str;
+      default = "unix:/run/lasuite-meet/gunicorn.sock";
+      example = "127.0.0.1:8000";
+      description = ''
+        The path, host/port or file descriptior to bind the gunicorn socket to.
+
+        See  <https://docs.gunicorn.org/en/stable/settings.html#bind> for possible options.
+      '';
+    };
+
+    enableNginx = mkEnableOption "enable and configure Nginx for reverse proxying" // {
+      default = true;
+    };
+
+    secretKeyPath = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = ''
+        Path to the Django secret key.
+
+        The key can be generated using:
+        ```
+        python3 -c 'import secrets; print(secrets.token_hex())'
+        ```
+
+        If not set, the secret key will be automatically generated.
+      '';
+    };
+
+    postgresql = {
+      createLocally = mkEnableOption "Configure local PostgreSQL database server for meet";
+    };
+
+    redis = {
+      createLocally = mkEnableOption "Configure local Redis cache server for meet";
+    };
+
+    livekit = {
+      enable = mkEnableOption "Configure local livekit server" // {
+        default = true;
+      };
+
+      openFirewall = mkEnableOption "Open firewall ports for livekit";
+
+      keyFile = mkOption {
+        type = lib.types.path;
+        description = ''
+          LiveKit key file holding one or multiple application secrets.
+          Use `livekit-server generate-keys` to generate a random key name and secret.
+
+          The file should have the YAML format `<keyname>: <secret>`.
+          Example:
+          `lasuite-meet: f6lQGaHtM5HfgZjIcec3cOCRfiDqIine4CpZZnqdT5cE`
+
+          Individual key/secret pairs need to be passed to clients to connect to this instance.
+        '';
+
+      };
+
+      settings = mkOption {
+        type = types.attrs;
+        default = { };
+        description = ''
+          Settings to pass to the livekit server.
+
+          See `services.livekit.settings` for more details.
+        '';
+      };
+    };
+
+    gunicorn = {
+      extraArgs = mkOption {
+        type = types.listOf types.str;
+        default = [
+          "--name=meet"
+          "--workers=3"
+        ];
+        description = ''
+          Extra arguments to pass to the gunicorn process.
+        '';
+      };
+    };
+
+    celery = {
+      extraArgs = mkOption {
+        type = types.listOf types.str;
+        default = [ ];
+        description = ''
+          Extra arguments to pass to the celery process.
+        '';
+      };
+    };
+
+    domain = mkOption {
+      type = types.str;
+      description = ''
+        Domain name of the meet instance.
+      '';
+    };
+
+    settings = mkOption {
+      type = types.submodule {
+        freeformType = types.attrsOf (
+          types.nullOr (
+            types.oneOf [
+              types.str
+              types.bool
+              types.path
+              types.int
+            ]
+          )
+        );
+
+        options = {
+          DJANGO_CONFIGURATION = mkOption {
+            type = types.str;
+            internal = true;
+            default = "Production";
+            description = "The configuration that Django will use";
+          };
+
+          DJANGO_SETTINGS_MODULE = mkOption {
+            type = types.str;
+            internal = true;
+            default = "meet.settings";
+            description = "The configuration module that Django will use";
+          };
+
+          DJANGO_SECRET_KEY_FILE = mkOption {
+            type = types.path;
+            default =
+              if cfg.secretKeyPath == null then "/var/lib/lasuite-meet/django_secret_key" else cfg.secretKeyPath;
+            description = "The path to the file containing Django's secret key";
+          };
+
+          DJANGO_DATA_DIR = mkOption {
+            type = types.path;
+            default = "/var/lib/lasuite-meet";
+            description = "Path to the data directory";
+          };
+
+          DJANGO_ALLOWED_HOSTS = mkOption {
+            type = types.str;
+            default = if cfg.enableNginx then "localhost,127.0.0.1,${cfg.domain}" else "";
+            defaultText = lib.literalExpression ''
+              if cfg.enableNginx then "localhost,127.0.0.1,$${cfg.domain}" else ""
+            '';
+            description = "Comma-separated list of hosts that are able to connect to the server";
+          };
+
+          DB_NAME = mkOption {
+            type = types.str;
+            default = "lasuite-meet";
+            description = "Name of the database";
+          };
+
+          DB_USER = mkOption {
+            type = types.str;
+            default = "lasuite-meet";
+            description = "User of the database";
+          };
+
+          DB_HOST = mkOption {
+            type = types.nullOr types.str;
+            default = if cfg.postgresql.createLocally then "/run/postgresql" else null;
+            description = "Host of the database";
+          };
+
+          REDIS_URL = mkOption {
+            type = types.nullOr types.str;
+            default =
+              if cfg.redis.createLocally then
+                "unix://${config.services.redis.servers.lasuite-meet.unixSocket}?db=0"
+              else
+                null;
+            description = "URL of the redis backend";
+          };
+
+          CELERY_BROKER_URL = mkOption {
+            type = types.nullOr types.str;
+            default =
+              if cfg.redis.createLocally then
+                "redis+socket://${config.services.redis.servers.lasuite-meet.unixSocket}?db=1"
+              else
+                null;
+            description = "URL of the redis backend for celery";
+          };
+
+          LIVEKIT_API_URL = mkOption {
+            type = types.nullOr types.str;
+            default = if cfg.enableNginx && cfg.livekit.enable then "http://${cfg.domain}/livekit" else null;
+            defaultText = lib.literalExpression ''
+              if cfg.enableNginx && cfg.livekit.enable then
+                "http://$${cfg.domain}/livekit"
+              else
+                null
+            '';
+            description = "URL to the livekit server";
+          };
+        };
+      };
+
+      default = { };
+      example = ''
+        {
+          DJANGO_ALLOWED_HOSTS = "*";
+        }
+      '';
+      description = ''
+        Configuration options of meet.
+        See https://github.com/suitenumerique/meet/blob/v${cfg.backendPackage.version}/docs/env.md
+        `REDIS_URL` and `CELERY_BROKER_URL` are set if `services.lasuite-meet.redis.createLocally` is true.
+        `DB_NAME` `DB_USER` and `DB_HOST` are set if `services.lasuite-meet.postgresql.createLocally` is true.
+      '';
+    };
+
+    environmentFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = ''
+        Path to environment file.
+
+        This can be useful to pass secrets to meet via tools like `agenix` or `sops`.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.lasuite-meet = {
+      description = "Meet from SuiteNumérique";
+      after =
+        [ "network.target" ]
+        ++ (optional cfg.postgresql.createLocally "postgresql.service")
+        ++ (optional cfg.redis.createLocally "redis-lasuite-meet.service");
+
+      wants =
+        (optional cfg.postgresql.createLocally "postgresql.service")
+        ++ (optional cfg.redis.createLocally "redis-lasuite-meet.service");
+
+      wantedBy = [ "multi-user.target" ];
+
+      preStart = ''
+        ln -sfT ${cfg.backendPackage}/share/static /var/lib/lasuite-meet/static
+
+        if [ ! -f .version ]; then
+          touch .version
+        fi
+
+        if [ "${cfg.backendPackage.version}" != "$(cat .version)" ]; then
+          ${getExe cfg.backendPackage} migrate
+          echo -n "${cfg.backendPackage.version}" > .version
+        fi
+        ${optionalString (cfg.secretKeyPath == null) ''
+          if [[ ! -f /var/lib/lasuite-meet/django_secret_key ]]; then
+            (
+              umask 0377
+              tr -dc A-Za-z0-9 < /dev/urandom | head -c64 | ${pkgs.moreutils}/bin/sponge /var/lib/lasuite-meet/django_secret_key
+            )
+          fi
+        ''}
+      '';
+
+      environment = pythonEnvironment;
+
+      serviceConfig = {
+        ExecStart = utils.escapeSystemdExecArgs (
+          [
+            (lib.getExe' cfg.backendPackage "gunicorn")
+            "--bind=${cfg.bind}"
+          ]
+          ++ cfg.gunicorn.extraArgs
+          ++ [ "meet.wsgi:application" ]
+        );
+      } // commonServiceConfig;
+    };
+
+    systemd.services.lasuite-meet-celery = {
+      description = "Meet Celery broker from SuiteNumérique";
+      after =
+        [ "network.target" ]
+        ++ (optional cfg.postgresql.createLocally "postgresql.service")
+        ++ (optional cfg.redis.createLocally "redis-lasuite-meet.service");
+
+      wants =
+        (optional cfg.postgresql.createLocally "postgresql.service")
+        ++ (optional cfg.redis.createLocally "redis-lasuite-meet.service");
+
+      wantedBy = [ "multi-user.target" ];
+
+      environment = pythonEnvironment;
+
+      serviceConfig = {
+        ExecStart = utils.escapeSystemdExecArgs (
+          [ (lib.getExe' cfg.backendPackage "celery") ]
+          ++ cfg.celery.extraArgs
+          ++ [
+            "--app=meet.celery_app"
+            "worker"
+          ]
+        );
+      } // commonServiceConfig;
+    };
+
+    services.postgresql = mkIf cfg.postgresql.createLocally {
+      enable = true;
+      ensureDatabases = [ "lasuite-meet" ];
+      ensureUsers = [
+        {
+          name = "lasuite-meet";
+          ensureDBOwnership = true;
+        }
+      ];
+    };
+
+    services.redis.servers.lasuite-meet = mkIf cfg.redis.createLocally { enable = true; };
+
+    services.livekit = mkIf cfg.livekit.enable {
+      inherit (cfg.livekit)
+        enable
+        settings
+        keyFile
+        openFirewall
+        ;
+    };
+
+    services.nginx = mkIf cfg.enableNginx {
+      enable = true;
+
+      virtualHosts.${cfg.domain} = {
+        root = cfg.frontendPackage;
+
+        extraConfig = ''
+          error_page 404 = /index.html;
+        '';
+
+        locations."/api" = {
+          proxyPass = "http://${cfg.bind}";
+          recommendedProxySettings = true;
+        };
+
+        locations."/admin" = {
+          proxyPass = "http://${cfg.bind}";
+          recommendedProxySettings = true;
+        };
+
+        locations."/livekit" = mkIf cfg.livekit.enable {
+          proxyPass = "http://localhost:${toString config.services.livekit.settings.port}";
+          recommendedProxySettings = true;
+          proxyWebsockets = true;
+          extraConfig = ''
+            rewrite ^/livekit/(.*)$ /$1 break;
+          '';
+        };
+      };
+    };
+  };
+
+  meta = {
+    buildDocsInSandbox = false;
+    maintainers = [ lib.maintainers.soyouzpanda ];
+  };
+}
--- a/nixos/modules/services/web-apps/nextcloud-notify_push.nix
+++ b/nixos/modules/services/web-apps/nextcloud-notify_push.nix
@ -164,7 +164,7 @@ in
        nginx.virtualHosts.${cfgN.hostName}.locations."^~ /push/" = {
          proxyPass = "http://unix:${cfg.socketPath}";
          proxyWebsockets = true;
-          recommendedProxySettings = true;
+          recommendedProxySettings = lib.mkDefault true;
          extraConfig = # nginx
            ''
              # disable in case it was configured on a higher level
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@ -577,11 +577,14 @@ in

    config = {
      dbtype = mkOption {
-        type = types.enum [
-          "sqlite"
-          "pgsql"
-          "mysql"
-        ];
+        type = types.nullOr (
+          types.enum [
+            "sqlite"
+            "pgsql"
+            "mysql"
+          ]
+        );
+        default = null;
        description = "Database type.";
      };
      dbname = mkOption {
@ -1086,6 +1089,17 @@ in
            instead of password.
          '';
        }
+        {
+          assertion = cfg.config.dbtype != null;
+          message = ''
+            `services.nextcloud.config.dbtype` must be set explicitly (pgsql, mysql, or sqlite)
+
+            Before 25.05, it used to default to sqlite but that is not recommended by upstream.
+            Either set it to sqlite as it used to be, or convert to another type as described
+            in the official db conversion page:
+            https://docs.nextcloud.com/server/latest/admin_manual/configuration_database/db_conversion.html
+          '';
+        }
      ];
    }

--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -771,6 +771,7 @@ in
    _module.args.latestKernel = true;
  };
  lasuite-docs = runTest ./web-apps/lasuite-docs.nix;
+  lasuite-meet = runTest ./web-apps/lasuite-meet.nix;
  lavalink = runTest ./lavalink.nix;
  leaps = runTest ./leaps.nix;
  lemmy = runTest ./lemmy.nix;
--- a/nixos/tests/web-apps/lasuite-meet.nix
+++ b/nixos/tests/web-apps/lasuite-meet.nix
@ -0,0 +1,141 @@
+{ lib, ... }:
+let
+  domain = "meet.local";
+  oidcDomain = "127.0.0.1:8080";
+in
+
+{
+  name = "lasuite-meet";
+  meta.maintainers = with lib.maintainers; [ soyouzpanda ];
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      virtualisation.memorySize = 4 * 1024;
+
+      networking.hosts."127.0.0.1" = [ domain ];
+
+      environment.systemPackages = with pkgs; [ jq ];
+
+      services.lasuite-meet = {
+        enable = true;
+        enableNginx = true;
+        livekit = {
+          enable = true;
+          keyFile = pkgs.writeText "lasuite-meet-livekit-keys" ''
+            lasuite-meet: ca50qKzxEXVIu61wHshAyJNzlWw8vlIwUuzxQbUK1rG
+          '';
+        };
+        redis.createLocally = true;
+        postgresql.createLocally = true;
+
+        inherit domain;
+
+        settings = {
+          DJANGO_SECRET_KEY_FILE = pkgs.writeText "django-secret-file" ''
+            8540db59c03943d48c3ed1a0f96ce3b560e0f45274f120f7ee4dace3cc366a6b
+          '';
+
+          OIDC_OP_JWKS_ENDPOINT = "http://${oidcDomain}/dex/keys";
+          OIDC_OP_AUTHORIZATION_ENDPOINT = "http://${oidcDomain}/dex/auth/mock";
+          OIDC_OP_TOKEN_ENDPOINT = "http://${oidcDomain}/dex/token";
+          OIDC_OP_USER_ENDPOINT = "http://${oidcDomain}/dex/userinfo";
+          OIDC_RP_CLIENT_ID = "lasuite-meet";
+          OIDC_RP_SIGN_ALGO = "RS256";
+          OIDC_RP_SCOPES = "openid email";
+          OIDC_RP_CLIENT_SECRET = "lasuitemeetclientsecret";
+
+          LOGIN_REDIRECT_URL = "http://${domain}";
+          LOGIN_REDIRECT_URL_FAILURE = "http://${domain}";
+          LOGOUT_REDIRECT_URL = "http://${domain}";
+
+          LIVEKIT_API_KEY = "lasuite-meet";
+          LIVEKIT_API_SECRET = "ca50qKzxEXVIu61wHshAyJNzlWw8vlIwUuzxQbUK1rG";
+
+          # Disable HTTPS feature in tests because we're running on a HTTP connection
+          DJANGO_SECURE_PROXY_SSL_HEADER = "";
+          DJANGO_SECURE_SSL_REDIRECT = false;
+          DJANGO_CSRF_COOKIE_SECURE = false;
+          DJANGO_SESSION_COOKIE_SECURE = false;
+          DJANGO_CSRF_TRUSTED_ORIGINS = "http://*";
+        };
+      };
+
+      services.dex = {
+        enable = true;
+        settings = {
+          issuer = "http://${oidcDomain}/dex";
+          storage = {
+            type = "postgres";
+            config.host = "/var/run/postgresql";
+          };
+          web.http = "127.0.0.1:8080";
+          oauth2.skipApprovalScreen = true;
+          staticClients = [
+            {
+              id = "lasuite-meet";
+              name = "Meet";
+              redirectURIs = [ "http://${domain}/api/v1.0/callback/" ];
+              secretFile = "/etc/dex/lasuite-meet";
+            }
+          ];
+          connectors = [
+            {
+              type = "mockPassword";
+              id = "mock";
+              name = "Example";
+              config = {
+                username = "admin";
+                password = "password";
+              };
+            }
+          ];
+        };
+      };
+
+      environment.etc."dex/lasuite-meet" = {
+        mode = "0400";
+        user = "dex";
+        text = "lasuitemeetclientsecret";
+      };
+
+      services.postgresql = {
+        enable = true;
+        ensureDatabases = [ "dex" ];
+        ensureUsers = [
+          {
+            name = "dex";
+            ensureDBOwnership = true;
+          }
+        ];
+      };
+    };
+
+  testScript = ''
+    with subtest("Wait for units to start"):
+      machine.wait_for_unit("dex.service")
+      machine.wait_for_unit("lasuite-meet.service")
+      machine.wait_for_unit("lasuite-meet-celery.service")
+
+    with subtest("Wait for web servers to start"):
+      machine.wait_until_succeeds("curl -fs 'http://${domain}/api/v1.0/authenticate/'", timeout=120)
+      machine.wait_until_succeeds("curl -fs '${oidcDomain}/dex/auth/mock?client_id=lasuite-meet&response_type=code&redirect_uri=http://${domain}/api/v1.0/callback/&scope=openid'", timeout=120)
+
+    with subtest("Login"):
+      state, nonce = machine.succeed("curl -fs -c cjar 'http://${domain}/api/v1.0/authenticate/' -w '%{redirect_url}' | sed -n 's/.*state=\\(.*\\)&nonce=\\(.*\\)/\\1 \\2/p'").strip().split(' ')
+
+      oidc_state = machine.succeed(f"curl -fs '${oidcDomain}/dex/auth/mock?client_id=lasuite-meet&response_type=code&redirect_uri=http://${domain}/api/v1.0/callback/&scope=openid+email&state={state}&nonce={nonce}' | sed -n 's/.*state=\\(.*\\)\">.*/\\1/p'").strip()
+
+      code = machine.succeed(f"curl -fs '${oidcDomain}/dex/auth/mock/login?back=&state={oidc_state}' -d 'login=admin&password=password' -w '%{{redirect_url}}' | sed -n 's/.*code=\\(.*\\)&.*/\\1/p'").strip()
+      print(f"Got approval code {code}")
+
+      machine.succeed(f"curl -fs -c cjar -b cjar 'http://${domain}/api/v1.0/callback/?code={code}&state={state}'")
+
+    with subtest("Create a room"):
+      csrf_token = machine.succeed("grep csrftoken cjar | cut -f 7 | tr -d '\n'")
+
+      room_id = machine.succeed(f"curl -fs -c cjar -b cjar 'http://${domain}/api/v1.0/rooms/' -X POST -H 'Content-Type: application/json' -H 'X-CSRFToken: {csrf_token}' -H 'Referer: http://${domain}' -d '{{\"name\": \"aaa-bbbb-ccc\"}}' | jq .id -r").strip()
+
+      print(f"Created room with id {room_id}")
+  '';
+}
--- a/pkgs/applications/emulators/libretro/cores/mupen64plus.nix
+++ b/pkgs/applications/emulators/libretro/cores/mupen64plus.nix
@ -12,13 +12,13 @@
 }:
 mkLibretroCore {
  core = "mupen64plus-next";
-  version = "0-unstable-2025-06-04";
+  version = "0-unstable-2025-07-01";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "mupen64plus-libretro-nx";
-    rev = "0346d3ef26016bb4de604cf918d004bd791447ee";
-    hash = "sha256-DV6X94BHr97S1jW3zNUDx6w35JcEnSFNgv6fCi2amek=";
+    rev = "1b693cdac7c42979f6ef53ffe260a76454f0cf45";
+    hash = "sha256-hano/fv7LcinEOYfwwzhn+gXTsB8hDav0KQw5XkmXmY=";
  };

  # Fix for GCC 14
--- a/pkgs/applications/kde/default.nix
+++ b/pkgs/applications/kde/default.nix
@ -108,7 +108,6 @@ let
      grantleetheme = callPackage ./grantleetheme { };
      gwenview = callPackage ./gwenview { };
      incidenceeditor = callPackage ./incidenceeditor.nix { };
-      itinerary = callPackage ./itinerary.nix { };
      juk = callPackage ./juk.nix { };
      kaccounts-integration = callPackage ./kaccounts-integration.nix { };
      kaccounts-providers = callPackage ./kaccounts-providers.nix { };
@ -271,7 +270,6 @@ let
      krecorder = callPackage ./krecorder.nix { };
      ktrip = callPackage ./ktrip.nix { };
      kweather = callPackage ./kweather.nix { };
-      neochat = callPackage ./neochat.nix { };
      plasmatube = callPackage ./plasmatube { };
      qmlkonsole = callPackage ./qmlkonsole.nix { };
      telly-skout = callPackage ./telly-skout.nix { };
--- a/pkgs/applications/kde/itinerary.nix
+++ b/pkgs/applications/kde/itinerary.nix
@ -1,73 +0,0 @@
-{
-  mkDerivation,
-  lib,
-  extra-cmake-modules,
-  karchive,
-  kcalendarcore,
-  kcontacts,
-  kdbusaddons,
-  kfilemetadata,
-  kholidays,
-  kio,
-  kirigami-addons,
-  kitemmodels,
-  kitinerary,
-  kmime,
-  knotifications,
-  kosmindoormap,
-  kpkpass,
-  kpublictransport,
-  kunitconversion,
-  libquotient,
-  networkmanager-qt,
-  prison,
-  qqc2-desktop-style,
-  qtpositioning,
-  qtquickcontrols2,
-  shared-mime-info,
-}:
-
-mkDerivation {
-  pname = "itinerary";
-  outputs = [
-    "out"
-    "dev"
-  ];
-
-  nativeBuildInputs = [
-    extra-cmake-modules
-    shared-mime-info # for update-mime-database
-  ];
-
-  buildInputs = [
-    karchive
-    kcalendarcore
-    kcontacts
-    kdbusaddons
-    kfilemetadata
-    kholidays
-    kio
-    kirigami-addons
-    kitemmodels
-    kitinerary
-    kmime
-    knotifications
-    kosmindoormap
-    kpkpass
-    kpublictransport
-    kunitconversion
-    libquotient
-    networkmanager-qt
-    prison
-    qqc2-desktop-style
-    qtpositioning
-    qtquickcontrols2
-  ];
-
-  meta.license = with lib.licenses; [
-    asl20
-    bsd3
-    cc0
-    lgpl2Plus
-  ];
-}
--- a/pkgs/applications/kde/neochat.nix
+++ b/pkgs/applications/kde/neochat.nix
@ -1,77 +0,0 @@
-{
-  mkDerivation,
-  lib,
-
-  cmake,
-  extra-cmake-modules,
-  pkg-config,
-  wrapQtAppsHook,
-
-  cmark,
-  kconfig,
-  kdbusaddons,
-  ki18n,
-  kio,
-  kirigami-addons,
-  kirigami2,
-  kitemmodels,
-  knotifications,
-  kquickcharts,
-  kquickimageedit,
-  libpulseaudio,
-  libquotient,
-  libsecret,
-  olm,
-  qcoro,
-  qqc2-desktop-style,
-  qtgraphicaleffects,
-  qtlocation,
-  qtmultimedia,
-  qtquickcontrols2,
-  sonnet,
-}:
-
-mkDerivation {
-  pname = "neochat";
-
-  nativeBuildInputs = [
-    cmake
-    extra-cmake-modules
-    pkg-config
-    wrapQtAppsHook
-  ];
-
-  buildInputs = [
-    cmark
-    kconfig
-    kdbusaddons
-    kio
-    ki18n
-    kirigami-addons
-    kirigami2
-    kitemmodels
-    knotifications
-    kquickcharts
-    kquickimageedit
-    libpulseaudio
-    libquotient
-    libsecret
-    olm
-    qcoro
-    qtgraphicaleffects
-    qtlocation
-    qtmultimedia
-    qtquickcontrols2
-    qqc2-desktop-style
-    sonnet
-  ];
-
-  meta = with lib; {
-    description = "Client for matrix, the decentralized communication protocol";
-    mainProgram = "neochat";
-    homepage = "https://apps.kde.org/en/neochat";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ peterhoeg ];
-    platforms = with platforms; linux;
-  };
-}
--- a/pkgs/applications/kde/srcs.nix
+++ b/pkgs/applications/kde/srcs.nix
@ -331,14 +331,6 @@
      name = "incidenceeditor-23.08.5.tar.xz";
    };
  };
-  itinerary = {
-    version = "23.08.5";
-    src = fetchurl {
-      url = "${mirror}/stable/release-service/23.08.5/src/itinerary-23.08.5.tar.xz";
-      sha256 = "19r7k64a4dalarxm7j2jf2p86cnxqxah0iqj68ibazhl1sdqrqs2";
-      name = "itinerary-23.08.5.tar.xz";
-    };
-  };
  juk = {
    version = "23.08.5";
    src = fetchurl {
@ -1747,14 +1739,6 @@
      name = "minuet-23.08.5.tar.xz";
    };
  };
-  neochat = {
-    version = "23.08.5";
-    src = fetchurl {
-      url = "${mirror}/stable/release-service/23.08.5/src/neochat-23.08.5.tar.xz";
-      sha256 = "0cj6j08g5ng1vifpb49rks9kp4mfb3h466n6afw9dk0xxgccc06k";
-      name = "neochat-23.08.5.tar.xz";
-    };
-  };
  okular = {
    version = "23.08.5";
    src = fetchurl {
--- a/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
--- a/pkgs/applications/plasma-mobile/srcs.nix
+++ b/pkgs/applications/plasma-mobile/srcs.nix
@ -115,14 +115,6 @@
      name = "kweather-23.01.0.tar.xz";
    };
  };
-  neochat = {
-    version = "23.01.0";
-    src = fetchurl {
-      url = "${mirror}/stable/plasma-mobile/23.01.0/neochat-23.01.0.tar.xz";
-      sha256 = "0pkas8whwy1ih4sx9vaa7k55iiiy955dh4d53i4l1d0sjdf8pysd";
-      name = "neochat-23.01.0.tar.xz";
-    };
-  };
  plasma-dialer = {
    version = "23.01.0";
    src = fetchurl {
--- a/pkgs/by-name/am/amazon-q-cli/package.nix
+++ b/pkgs/by-name/am/amazon-q-cli/package.nix
@ -7,13 +7,13 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "amazon-q-cli";
-  version = "1.12.1";
+  version = "1.12.2";

  src = fetchFromGitHub {
    owner = "aws";
    repo = "amazon-q-developer-cli-autocomplete";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-oY2hDOsws2WVQPKEFhGNPHITo26p/UZ5XzvRX7DoMyc=";
+    hash = "sha256-TIKG1nzpmjiHE+EjTJR+/GklQNJQeUzmDXaPEiRT80Y=";
  };

  nativeBuildInputs = [
@ -22,7 +22,7 @@ rustPlatform.buildRustPackage (finalAttrs: {

  useFetchCargoVendor = true;

-  cargoHash = "sha256-xriK88OY6W1cOZVgiUPBIuItVHwEyFNq5Ywh367K6CU=";
+  cargoHash = "sha256-lJbHPqQ3eybo03oZY2VyKlsxcTdbdrc8q8AjV+IahEY=";

  cargoBuildFlags = [
    "-p"
--- a/pkgs/by-name/ar/arjun/package.nix
+++ b/pkgs/by-name/ar/arjun/package.nix
@ -6,32 +6,28 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "arjun";
-  version = "2.2.2";
+  version = "2.2.7";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "s0md3v";
    repo = "Arjun";
    tag = version;
-    hash = "sha256-odVUFs517RSp66MymniSeTKTntQtXomjC68Hhdsglf0=";
+    hash = "sha256-XEfCQEvRCvmNQ8yOlaR0nd7knhK1fQIrXEfQgrdVDrs=";
  };

-  nativeBuildInputs = with python3.pkgs; [
-    setuptools
-    wheel
-  ];
+  build-system = with python3.pkgs; [ setuptools ];

-  propagatedBuildInputs = with python3.pkgs; [
-    requests
+  dependencies = with python3.pkgs; [
    dicttoxml
+    ratelimit
+    requests
  ];

  # Project has no tests
  doCheck = false;

-  pythonImportsCheck = [
-    "arjun"
-  ];
+  pythonImportsCheck = [ "arjun" ];

  meta = {
    description = "HTTP parameter discovery suite";
--- a/pkgs/by-name/ar/arping/package.nix
+++ b/pkgs/by-name/ar/arping/package.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "arping";
-  version = "2.25";
+  version = "2.26";

  src = fetchFromGitHub {
    owner = "ThomasHabets";
    repo = "arping";
    rev = "arping-${version}";
-    hash = "sha256-SAdbgPmApmFToYrAm8acUapZMEMQr5MO7bQOTO2hd2c=";
+    hash = "sha256-uZsUo12ez6sz95fmOg5cmVBJNRH3eEhio8V2efQ29BU=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ba/bandwhich/package.nix
+++ b/pkgs/by-name/ba/bandwhich/package.nix
@ -23,8 +23,7 @@ rustPlatform.buildRustPackage rec {

  nativeBuildInputs = [ installShellFiles ];

-  # 10 passed; 47 failed https://hydra.nixos.org/build/148943783/nixlog/1
-  doCheck = !stdenv.hostPlatform.isDarwin;
+  __darwinAllowLocalNetworking = true;

  preConfigure = ''
    export BANDWHICH_GEN_DIR=_shell-files
--- a/pkgs/by-name/bi/binaryninja-free/package.nix
+++ b/pkgs/by-name/bi/binaryninja-free/package.nix
@ -16,6 +16,7 @@
  xcbutilkeysyms,
  xcbutilrenderutil,
  xcbutilwm,
+  libxml2,
 }:
 stdenv.mkDerivation rec {
  pname = "binaryninja-free";
@ -66,6 +67,12 @@ stdenv.mkDerivation rec {
    xcbutilwm
  ];

+  preFixup = ''
+    # Fix libxml2 breakage. See https://github.com/NixOS/nixpkgs/pull/396195#issuecomment-2881757108
+    mkdir -p "$out/lib"
+    ln -s "${lib.getLib libxml2}/lib/libxml2.so" "$out/lib/libxml2.so.2"
+  '';
+
  installPhase = ''
    runHook preInstall
    mkdir -p $out/
--- a/pkgs/by-name/cc/cctz/package.nix
+++ b/pkgs/by-name/cc/cctz/package.nix
@ -15,6 +15,8 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-YCE0DXuOT5tCOfLlemMH7I2F8c7HEK1NEUJvtfqnCg8=";
  };

+  env.NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-framework CoreFoundation";
+
  makeFlags = [ "PREFIX=$(out)" ];

  installTargets =
--- a/pkgs/by-name/ce/certspotter/package.nix
+++ b/pkgs/by-name/ce/certspotter/package.nix
@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "certspotter";
-  version = "0.20.0";
+  version = "0.21.0";

  src = fetchFromGitHub {
    owner = "SSLMate";
    repo = "certspotter";
    rev = "v${version}";
-    hash = "sha256-CX0YchfX6EwIjH+m1FEHqfuXurg51JC4l+97BgXYXJg=";
+    hash = "sha256-cJIjJyWvy/prx97jUvVToJsEdMa0MpqATD9rO8G2biY=";
  };

-  vendorHash = "sha256-+6Gu3y708XXX7CHvZmEh7j3ILNBi/++8Mud34mOrtmA=";
+  vendorHash = "sha256-CLq/QFnZ5OLv7wT+VYr5SkSgmwt1g6cBYcAlB4Z/3wE=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/ch/chatbox/package.nix
+++ b/pkgs/by-name/ch/chatbox/package.nix
@ -6,11 +6,11 @@
 }:
 let
  pname = "chatbox";
-  version = "1.14.1";
+  version = "1.14.3";

  src = fetchurl {
    url = "https://download.chatboxai.app/releases/Chatbox-${version}-x86_64.AppImage";
-    hash = "sha256-2k2G6VMO83ztuknr4FRE0eUtsweV0eu9JSNgKaVuatQ=";
+    hash = "sha256-Qsf58SQANBic3LHY52vzCHO9W74cdP0EWtHB2uL45R0=";
  };

  appimageContents = appimageTools.extract { inherit pname version src; };
--- a/pkgs/by-name/ci/cilium-cli/package.nix
+++ b/pkgs/by-name/ci/cilium-cli/package.nix
@ -9,13 +9,13 @@

 buildGoModule rec {
  pname = "cilium-cli";
-  version = "0.18.4";
+  version = "0.18.5";

  src = fetchFromGitHub {
    owner = "cilium";
    repo = "cilium-cli";
    tag = "v${version}";
-    hash = "sha256-S+LtNIbtZVxk77eySYYZqr+Bicibl7vLo0nqkxUpkME=";
+    hash = "sha256-2lmf0bKmlNt+axgwiNPKcaq08Bf/88sp3JEkS8dkP7M=";
  };

  nativeBuildInputs = [ installShellFiles ];
--- a/pkgs/by-name/cl/clickhouse/package.nix
+++ b/pkgs/by-name/cl/clickhouse/package.nix
@ -21,7 +21,7 @@

 llvmPackages_19.stdenv.mkDerivation (finalAttrs: {
  pname = "clickhouse";
-  version = "25.3.4.190";
+  version = "25.3.5.42";

  src = fetchFromGitHub rec {
    owner = "ClickHouse";
@ -29,7 +29,7 @@ llvmPackages_19.stdenv.mkDerivation (finalAttrs: {
    tag = "v${finalAttrs.version}-lts";
    fetchSubmodules = true;
    name = "clickhouse-${tag}.tar.gz";
-    hash = "sha256-8KH0mziVlayu9g4EwW+hpSV97P72CYDKwGCZ5ycDUwE=";
+    hash = "sha256-LvGl9XJK6Emt7HnV/Orp7qEmJSr3TBJZtApL6GrWIMg=";
    postFetch = ''
      # delete files that make the source too big
      rm -rf $out/contrib/llvm-project/llvm/test
--- a/pkgs/by-name/cl/clusterlint/package.nix
+++ b/pkgs/by-name/cl/clusterlint/package.nix
@ -0,0 +1,37 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "clusterlint";
+  version = "0.12.0";
+
+  src = fetchFromGitHub {
+    owner = "digitalocean";
+    repo = "clusterlint";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-R6Dm7raIYxpulVtadU5AsSwCd5waOBOJRdD3o2vgGM4=";
+  };
+
+  vendorHash = null;
+
+  ldflags = [ "-X main.Version=${finalAttrs.version}" ];
+
+  # One subpackage fails to build
+  excludedPackages = [ "example-plugin" ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  meta = {
+    description = "Best practices checker for Kubernetes clusters";
+    homepage = "https://github.com/digitalocean/clusterlint";
+    changelog = "https://github.com/digitalocean/clusterlint/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ jherland ];
+    mainProgram = "clusterlint";
+  };
+})
--- a/pkgs/by-name/cn/cnquery/package.nix
+++ b/pkgs/by-name/cn/cnquery/package.nix
@ -6,18 +6,18 @@

 buildGoModule rec {
  pname = "cnquery";
-  version = "11.59.0";
+  version = "11.60.0";

  src = fetchFromGitHub {
    owner = "mondoohq";
    repo = "cnquery";
    tag = "v${version}";
-    hash = "sha256-xSHIKy9kQrbDhLuTfJd1yDAt/Z7mqYNv4XT6fQZftho=";
+    hash = "sha256-Vu7UfTinjuyc49Kb5GW8uXrP5/bszGt9ktxilGDqY0M=";
  };

  subPackages = [ "apps/cnquery" ];

-  vendorHash = "sha256-NGrDYN7+JozAmtysSBUcKPiQwKs/fUiQkUVEGrmTTCk=";
+  vendorHash = "sha256-5vNLaOG4vYgetiQLRIzFkrlFgH6Dwa/VHCv0HWWow30=";

  ldflags = [
    "-w"
--- a/pkgs/by-name/db/dbeaver-bin/package.nix
+++ b/pkgs/by-name/db/dbeaver-bin/package.nix
@ -55,18 +55,29 @@ stdenvNoCC.mkDerivation (finalAttrs: {
  dontConfigure = true;
  dontBuild = true;

-  prePatch = ''
-    substituteInPlace ${lib.optionalString stdenvNoCC.hostPlatform.isDarwin "Contents/Eclipse/"}dbeaver.ini \
-      --replace-fail '-Xmx1024m' '-Xmx${override_xmx}'
-  '';
+  prePatch =
+    ''
+      substituteInPlace ${lib.optionalString stdenvNoCC.hostPlatform.isDarwin "Contents/Eclipse/"}dbeaver.ini \
+        --replace-fail '-Xmx1024m' '-Xmx${override_xmx}'
+    ''
+    # remove the bundled JRE configuration on Darwin
+    # dont use substituteInPlace here because it would match "-vmargs"
+    + lib.optionalString stdenvNoCC.hostPlatform.isDarwin ''
+      sed -i -e '/^-vm$/ { N; d; }' Contents/Eclipse/dbeaver.ini
+    '';

-  preInstall = ''
-    # most directories are for different architectures, only keep what we need
-    shopt -s extglob
-    pushd ${lib.optionalString stdenvNoCC.hostPlatform.isDarwin "Contents/Eclipse/"}plugins/com.sun.jna_*/com/sun/jna/
-    rm -r !(ptr|internal|linux-x86-64|linux-aarch64|darwin-x86-64|darwin-aarch64)/
-    popd
-  '';
+  preInstall =
+    ''
+      # most directories are for different architectures, only keep what we need
+      shopt -s extglob
+      pushd ${lib.optionalString stdenvNoCC.hostPlatform.isDarwin "Contents/Eclipse/"}plugins/com.sun.jna_*/com/sun/jna/
+      rm -r !(ptr|internal|linux-x86-64|linux-aarch64|darwin-x86-64|darwin-aarch64)/
+      popd
+    ''
+    # remove the bundled JRE on Darwin
+    + lib.optionalString stdenvNoCC.hostPlatform.isDarwin ''
+      rm -r Contents/Eclipse/jre/
+    '';

  installPhase =
    if !stdenvNoCC.hostPlatform.isDarwin then
--- a/pkgs/by-name/de/densify/package.nix
+++ b/pkgs/by-name/de/densify/package.nix
@ -8,6 +8,7 @@
  xorg,
  gnugrep,
  ghostscript,
+  libnotify,
 }:

 python3Packages.buildPythonApplication rec {
@ -44,6 +45,7 @@ python3Packages.buildPythonApplication rec {
          ghostscript
          gnugrep
          xorg.xrandr
+          libnotify
        ]
      }"
    )
--- a/pkgs/by-name/do/dotbot/package.nix
+++ b/pkgs/by-name/do/dotbot/package.nix
@ -6,14 +6,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "dotbot";
-  version = "1.21.0";
+  version = "1.22.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "anishathalye";
    repo = "dotbot";
    tag = "v${version}";
-    hash = "sha256-f+ykGXcQ1hLptGElQ5ZTt8z0SXnlTbdcf922AVF78bU=";
+    hash = "sha256-3U8lIsqy95Ulxa5f2hHGFmuAqQ7WZtikvgaplX6GTF0=";
  };

  preCheck = ''
@ -37,7 +37,7 @@ python3Packages.buildPythonApplication rec {
      dotfiles.
    '';
    homepage = "https://github.com/anishathalye/dotbot";
-    changelog = "https://github.com/anishathalye/dotbot/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/anishathalye/dotbot/blob/${src.tag}/CHANGELOG.md";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ ludat ];
  };
--- a/pkgs/by-name/ec/ecapture/package.nix
+++ b/pkgs/by-name/ec/ecapture/package.nix
@ -1,7 +1,6 @@
 {
  buildGoModule,
  fetchFromGitHub,
-  stdenv,
  bpftools,
  lib,
  nspr,
@ -18,6 +17,9 @@
  bash,
  zsh,
  nix-update-script,
+  llvmPackages,
+  withNonBTF ? false,
+  kernel ? null,
 }:

 buildGoModule rec {
@ -33,6 +35,7 @@ buildGoModule rec {
  };

  nativeBuildInputs = [
+    llvmPackages.libllvm
    clang
    fd
    bpftools
@ -94,16 +97,23 @@ buildGoModule rec {
      --replace-fail '"errors"' ' '
  '';

-  postConfigure = ''
-    sed -i '/git/d' Makefile
-    sed -i '/git/d' variables.mk
+  postConfigure =
+    ''
+      sed -i '/git/d' Makefile
+      sed -i '/git/d' variables.mk

-    substituteInPlace Makefile \
-      --replace-fail '/bin/bash' '${lib.getExe bash}'
-
-    make ebpf
-    go-bindata -pkg assets -o "assets/ebpf_probe.go" $(find user/bytecode -name "*.o" -printf "./%p ")
-  '';
+      substituteInPlace Makefile \
+        --replace-fail '/bin/bash' '${lib.getExe bash}'
+    ''
+    + lib.optionalString withNonBTF ''
+      substituteInPlace variables.mk \
+        --replace-fail "-emit-llvm" "-emit-llvm -I${kernel.dev}/lib/modules/${kernel.modDirVersion}/build/include -Wno-error=implicit-function-declaration"
+      KERN_BUILD_PATH=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build KERN_SRC_PATH=${kernel.dev}/lib/modules/${kernel.modDirVersion}/source make ebpf_noncore
+    ''
+    + ''
+      make ebpf
+      go-bindata -pkg assets -o "assets/ebpf_probe.go" $(find user/bytecode -name "*.o" -printf "./%p ")
+    '';

  checkFlags =
    let
--- a/pkgs/by-name/fa/fastfetch/package.nix
+++ b/pkgs/by-name/fa/fastfetch/package.nix
@ -59,13 +59,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "fastfetch";
-  version = "2.46.0";
+  version = "2.47.0";

  src = fetchFromGitHub {
    owner = "fastfetch-cli";
    repo = "fastfetch";
    tag = finalAttrs.version;
-    hash = "sha256-gRDG3lbUcApUushUPCpTkzc6FOB/CHrsVZwdRn6IEL8=";
+    hash = "sha256-xe86u40zW1+2O4s6e64HlpxiaLIRpjgKLPNnSEGlioQ=";
  };

  outputs = [
--- a/pkgs/by-name/fu/fusee-launcher/package.nix
+++ b/pkgs/by-name/fu/fusee-launcher/package.nix
@ -1,60 +0,0 @@
-{
-  lib,
-  stdenv,
-  python3Packages,
-  python3,
-  fetchFromGitHub,
-  pkgsCross,
-  makeWrapper,
-}:
-
-let
-  arm-embedded-cc = pkgsCross.arm-embedded.buildPackages.gcc;
-in
-
-stdenv.mkDerivation {
-  pname = "fusee-launcher";
-  version = "unstable-2018-07-14";
-
-  src = fetchFromGitHub {
-    owner = "Cease-and-DeSwitch";
-    repo = "fusee-launcher";
-    rev = "265e8f3e1987751ec41db6f1946d132b296aba43";
-    sha256 = "1pqkgw5bk0xcz9x7pc1f0r0b9nsc8jnnvcs1315d8ml8mx23fshm";
-  };
-
-  makeFlags = [
-    "CROSS_COMPILE=${arm-embedded-cc.targetPrefix}"
-  ];
-
-  installPhase = ''
-    mkdir -p $out/bin $out/share
-    cp fusee-launcher.py $out/bin/fusee-launcher
-    cp intermezzo.bin $out/share/intermezzo.bin
-
-    # Wrap with path to intermezzo.bin relocator binary in /share
-    wrapProgram $out/bin/fusee-launcher \
-      --add-flags "--relocator $out/share/intermezzo.bin" \
-      --prefix PYTHONPATH : "$PYTHONPATH:$(toPythonPath $out)"
-  '';
-
-  nativeBuildInputs = [
-    arm-embedded-cc
-    makeWrapper
-    python3Packages.wrapPython
-  ];
-  buildInputs = [
-    python3
-    python3Packages.pyusb
-  ];
-  pythonPath = with python3Packages; [ pyusb ];
-
-  meta = with lib; {
-    homepage = "https://github.com/Cease-and-DeSwitch/fusee-launcher";
-    description = "Work-in-progress launcher for one of the Tegra X1 bootROM exploits";
-    mainProgram = "fusee-launcher";
-    license = licenses.gpl2;
-    maintainers = with maintainers; [ pneumaticat ];
-  };
-
-}
--- a/pkgs/by-name/gh/gh-poi/package.nix
+++ b/pkgs/by-name/gh/gh-poi/package.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "gh-poi";
-  version = "0.13.0";
+  version = "0.14.0";

  src = fetchFromGitHub {
    owner = "seachicken";
    repo = "gh-poi";
    rev = "v${version}";
-    hash = "sha256-foUv6+QIfPlYwgTwxFvEgGeOw/mpC80+ntHo29LQbB8=";
+    hash = "sha256-bbmNzxGRg7nKfB8xu90ZkKrhWwY24G6h8TW07f9IpTY=";
  };

  ldflags = [
@ -20,10 +20,10 @@ buildGoModule rec {
    "-w"
  ];

-  vendorHash = "sha256-D/YZLwwGJWCekq9mpfCECzJyJ/xSlg7fC6leJh+e8i0=";
+  vendorHash = "sha256-ciOJpVqSPJJLX/sqrztqB3YSoMUrEnn52gGddE80rV0=";

  # Skip checks because some of test suites require fixture.
-  # See: https://github.com/seachicken/gh-poi/blob/v0.13.0/.github/workflows/contract-test.yml#L28-L29
+  # See: https://github.com/seachicken/gh-poi/blob/v0.14.0/.github/workflows/contract-test.yml#L28-L29
  doCheck = false;

  meta = with lib; {
--- a/pkgs/by-name/go/go-errorlint/package.nix
+++ b/pkgs/by-name/go/go-errorlint/package.nix
@ -2,6 +2,7 @@
  lib,
  buildGoModule,
  fetchFromGitHub,
+  nix-update-script,
 }:

 buildGoModule rec {
@ -22,12 +23,16 @@ buildGoModule rec {
    "-w"
  ];

+  passthru.updateScript = nix-update-script { };
  meta = with lib; {
    description = "Source code linter that can be used to find code that will cause problems with Go's error wrapping scheme";
    homepage = "https://github.com/polyfloyd/go-errorlint";
    changelog = "https://github.com/polyfloyd/go-errorlint/blob/${src.rev}/CHANGELOG.md";
    license = licenses.mit;
-    maintainers = with maintainers; [ meain ];
+    maintainers = with maintainers; [
+      meain
+      polyfloyd
+    ];
    mainProgram = "go-errorlint";
  };
 }
--- a/pkgs/by-name/ho/home-manager/package.nix
+++ b/pkgs/by-name/ho/home-manager/package.nix
@ -19,14 +19,14 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "home-manager";
-  version = "0-unstable-2025-06-22";
+  version = "0-unstable-2025-07-02";

  src = fetchFromGitHub {
    name = "home-manager-source";
    owner = "nix-community";
    repo = "home-manager";
-    rev = "7c35504839f915abec86a96435b881ead7eb6a2b";
-    hash = "sha256-6WH0aRFay79r775RuTqUcnoZNm6A4uHxU1sbcNIk63s=";
+    rev = "89af52d9a893af013f5f4c1d2d56912106827153";
+    hash = "sha256-ENTd/sd4Vz/VJYn14SVqW1OH2m7WIAvsm9A9SrmDZRY=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/hu/hut/package.nix
+++ b/pkgs/by-name/hu/hut/package.nix
@ -5,15 +5,15 @@
  scdoc,
 }:

-buildGoModule rec {
+buildGoModule (finalAttrs: {
  pname = "hut";
  version = "0.7.0";

  src = fetchFromSourcehut {
    owner = "~xenrox";
    repo = "hut";
-    rev = "v${version}";
-    sha256 = "sha256-pc6E3ORDmaMhoNe8GQeYZrxhe5ySQqsMPe/iUbclnGk=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-pc6E3ORDmaMhoNe8GQeYZrxhe5ySQqsMPe/iUbclnGk=";
  };

  vendorHash = "sha256-/51cv/EvcBCyCOf91vJ5M75p0bkAQqVoRUp+C+i70Os=";
@ -24,6 +24,11 @@ buildGoModule rec {

  makeFlags = [ "PREFIX=$(out)" ];

+  ldflags = [
+    # Recommended in 0.7.0 release notes https://git.sr.ht/~xenrox/hut/refs/v0.7.0
+    "-X main.version=v${finalAttrs.version}"
+  ];
+
  postBuild = ''
    make $makeFlags completions doc/hut.1
  '';
@ -32,11 +37,11 @@ buildGoModule rec {
    make $makeFlags install
  '';

-  meta = with lib; {
+  meta = {
    homepage = "https://sr.ht/~xenrox/hut/";
    description = "CLI tool for Sourcehut / sr.ht";
-    license = licenses.agpl3Only;
-    maintainers = with maintainers; [ fgaz ];
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ fgaz ];
    mainProgram = "hut";
  };
-}
+})
--- a/pkgs/by-name/ju/junicode/package.nix
+++ b/pkgs/by-name/ju/junicode/package.nix
@ -8,11 +8,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "junicode";
-  version = "2.209";
+  version = "2.211";

  src = fetchzip {
    url = "https://github.com/psb1558/Junicode-font/releases/download/v${version}/Junicode_${version}.zip";
-    hash = "sha256-hdCDLwTiyE2ZpFgmYAX7YWCujUwozIozD+k/lCStJUg=";
+    hash = "sha256-ZFJqNIsuWVph3U73lbcXVKXgzt+5cPxetvcAAzt0jvg=";
  };

  outputs = [
--- a/pkgs/by-name/ju/junicode/tex-font-path.patch
+++ b/pkgs/by-name/ju/junicode/tex-font-path.patch
@ -5,10 +5,10 @@ locations, which are later patched up to refer to the package outputs,
 thus ensuring the style always uses the fonts packaged with it.

 diff --git a/TeX/junicode.sty b/TeX/junicode.sty
-index 83bd45d..8fe671c 100644
+index 3f80068..af3e3ba 100644
 --- a/TeX/junicode.sty
 +++ b/TeX/junicode.sty
-@@ -208,7 +208,14 @@
+@@ -211,7 +211,14 @@
 
 \RequirePackage{fontspec}
 \defaultfontfeatures{Ligatures=TeX, Extension=.\junicode@fonttype}
@ -24,7 +24,7 @@ index 83bd45d..8fe671c 100644
 
 \ifxetex
 \typeout{\junicode@regstylename}
-@@ -219,6 +226,7 @@
+@@ -222,6 +229,7 @@
    ItalicFont =        *-\junicode@italstylename,
    BoldFont =          *-\junicode@boldstylename,
    BoldItalicFont =    *-\junicode@boldstylename Italic,
@ -32,7 +32,7 @@ index 83bd45d..8fe671c 100644
   ]{Junicode}
 \fi
 \ifluatex
-@@ -230,6 +238,7 @@
+@@ -233,6 +241,7 @@
    ItalicFont =        *-\junicode@italstylename,
    BoldFont =          *-\junicode@boldstylename,
    BoldItalicFont =    *-\junicode@boldstylename Italic,
@ -40,7 +40,7 @@ index 83bd45d..8fe671c 100644
   ]{Junicode}
 \fi
 
-@@ -242,6 +251,7 @@
+@@ -245,6 +254,7 @@
         #3
         Numbers =           {\junicode@figurealign,\junicode@figurestyle},
         SmallCapsFeatures = {Letters=SmallCaps},
@ -48,7 +48,7 @@ index 83bd45d..8fe671c 100644
     ]
 }
 \fi
-@@ -252,6 +262,7 @@
+@@ -255,6 +265,7 @@
         #3
         Numbers =           {\junicode@figurealign,\junicode@figurestyle},
         SmallCapsFeatures = {Letters=SmallCaps},
@ -57,10 +57,10 @@ index 83bd45d..8fe671c 100644
 }
 \fi
 diff --git a/TeX/junicodevf.lua b/TeX/junicodevf.lua
-index 7148668..acebe82 100644
+index 9c58f79..6ddcb55 100644
 --- a/TeX/junicodevf.lua
 +++ b/TeX/junicodevf.lua
-@@ -148,7 +148,7 @@ function mkfontcommands()
+@@ -118,7 +118,7 @@ function mkfontcommands()
          romfontcmd = "jRegular"
          italfontcmd = "jItalic"
       end
@ -70,12 +70,12 @@ index 7148668..acebe82 100644
    end
 end
 diff --git a/TeX/junicodevf.sty b/TeX/junicodevf.sty
-index c01ccaf..07a99ad 100644
+index da987d0..4475add 100644
 --- a/TeX/junicodevf.sty
 +++ b/TeX/junicodevf.sty
-@@ -168,11 +168,13 @@ mkwidthcommands(wdindex, adjustment)}}
- 
- % DECLARE THE FONTS
+@@ -132,10 +132,12 @@ mkmainfontcommand(style_idx, weight_option, weight_adjust, width_option, width_a
+ % Set the main font, then the alternate styles. It appears that
+ % the fonts aren't embedded in the PDF unless actually used.
 
 -\setmainfont{JunicodeVF}[
 -    ItalicFont =         {*-Italic},
@ -85,35 +85,35 @@ index c01ccaf..07a99ad 100644
 +    ItalicFont =         {JunicodeVF-Italic},
 +    BoldFont =           {JunicodeVF-Roman},
 +    BoldItalicFont =     {JunicodeVF-Italic},
-     Renderer =           HarfBuzz,
 +    Extension =          .ttf,
 +    Path =               @@@truetype_path@@@,
+     Renderer =           {\junicodevf@renderer},
     Numbers =            {\junicodevf@figurealign,\junicodevf@figurestyle},
     \MainDef,
-     UprightFeatures =    {\MainRegDef
-@@ -188,6 +190,8 @@ mkwidthcommands(wdindex, adjustment)}}
+@@ -152,6 +154,8 @@ mkmainfontcommand(style_idx, weight_option, weight_adjust, width_option, width_a
 \newcommand*{\junicodevf@newfont}[4]{
     \setfontface#1{#2}[
-         Renderer =          HarfBuzz,
+         Renderer =          {\junicodevf@renderer},
 +        Extension =          .ttf,
 +        Path =               @@@truetype_path@@@,
         Numbers =           {\junicodevf@figurealign,\junicodevf@figurestyle},
         SmallCapsFont =     {*},
         SmallCapsFeatures = {Letters=SmallCaps},
-@@ -200,43 +204,59 @@ mkwidthcommands(wdindex, adjustment)}}
+@@ -164,43 +168,60 @@ mkmainfontcommand(style_idx, weight_option, weight_adjust, width_option, width_a
 
 % ENLARGED FACES
 
 -\setfontface\EnlargedOne{JunicodeVF}[
 +\setfontface\EnlargedOne{JunicodeVF-Roman}[
-     Renderer = HarfBuzz,
+     Renderer = {\junicodevf@renderer},
 +    Extension = .ttf,
 +    Path = @@@truetype_path@@@,
     \ENLAOneSizeDef
 ]
 
 \setfontface\EnlargedOneItalic{JunicodeVF-Italic}[
-     Renderer = HarfBuzz,
+     Renderer = {\junicodevf@renderer},
+    Renderer = HarfBuzz,
 +    Extension = .ttf,
 +    Path = @@@truetype_path@@@,
     \ENLAOneSizeDef
@ -121,14 +121,14 @@ index c01ccaf..07a99ad 100644
 
 -\setfontface\EnlargedTwo{JunicodeVF}[
 +\setfontface\EnlargedTwo{JunicodeVF-Roman}[
-     Renderer = HarfBuzz,
+     Renderer = {\junicodevf@renderer},
 +    Extension = .ttf,
 +    Path = @@@truetype_path@@@,
     \ENLATwoSizeDef
 ]
 
 \setfontface\EnlargedTwoItalic{JunicodeVF-Italic}[
-     Renderer = HarfBuzz,
+     Renderer = {\junicodevf@renderer},
 +    Extension = .ttf,
 +    Path = @@@truetype_path@@@,
     \ENLATwoSizeDef
@ -136,14 +136,14 @@ index c01ccaf..07a99ad 100644
 
 -\setfontface\EnlargedThree{JunicodeVF}[
 +\setfontface\EnlargedThree{JunicodeVF-Roman}[
-     Renderer = HarfBuzz,
+     Renderer = {\junicodevf@renderer},
 +    Extension = .ttf,
 +    Path = @@@truetype_path@@@,
     \ENLAThreeSizeDef
 ]
 
 \setfontface\EnlargedThreeItalic{JunicodeVF-Italic}[
-     Renderer = HarfBuzz,
+     Renderer = {\junicodevf@renderer},
 +    Extension = .ttf,
 +    Path = @@@truetype_path@@@,
     \ENLAThreeSizeDef
@ -151,14 +151,14 @@ index c01ccaf..07a99ad 100644
 
 -\setfontface\EnlargedFour{JunicodeVF}[
 +\setfontface\EnlargedFour{JunicodeVF-Roman}[
-     Renderer = HarfBuzz,
+     Renderer = {\junicodevf@renderer},
 +    Extension = .ttf,
 +    Path = @@@truetype_path@@@,
     \ENLAFourSizeDef
 ]
 
 \setfontface\EnlargedFourItalic{JunicodeVF-Italic}[
-     Renderer = HarfBuzz,
+     Renderer = {\junicodevf@renderer},
 +    Extension = .ttf,
 +    Path = @@@truetype_path@@@,
     \ENLAFourSizeDef
--- a/pkgs/by-name/ka/kamailio/package.nix
+++ b/pkgs/by-name/ka/kamailio/package.nix
@ -22,11 +22,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "kamailio";
-  version = "6.0.1";
+  version = "6.0.2";

  src = fetchurl {
    url = "https://www.kamailio.org/pub/kamailio/${finalAttrs.version}/src/kamailio-${finalAttrs.version}_src.tar.gz";
-    hash = "sha256-jB1htMFHBtwnSNN7GtQFU5cnYgWpTgvXDjn9mMR1PQE=";
+    hash = "sha256-Ax3MhQZJ8cCuGUTZUThiT2XWAGgFIlwjnKqQvao28h0=";
  };

  buildInputs = [
--- a/pkgs/by-name/kr/krillinai/package.nix
+++ b/pkgs/by-name/kr/krillinai/package.nix
@ -15,7 +15,7 @@ buildGoModule (finalAttrs: {

  src = fetchFromGitHub {
    owner = "krillinai";
-    repo = "KrillinAI";
+    repo = "KlicStudio";
    tag = "v${finalAttrs.version}";
    hash = "sha256-RHlQeTFeG23LjLwczSGIghH3XPFTR6ZVDFk2KlRQGoA=";
  };
@ -46,8 +46,8 @@ buildGoModule (finalAttrs: {

  meta = {
    description = "Video translation and dubbing tool";
-    homepage = "https://github.com/krillinai/KrillinAI";
-    changelog = "https://github.com/krillinai/KrillinAI/releases/tag/v${finalAttrs.version}";
+    homepage = "https://github.com/krillinai/KlicStudio";
+    changelog = "https://github.com/krillinai/KlicStudio/releases/tag/v${finalAttrs.version}";
    mainProgram = "krillinai-desktop";
    license = lib.licenses.gpl3Plus;
    maintainers = with lib.maintainers; [ emaryn ];
--- a/pkgs/by-name/la/lasuite-meet-frontend/package.nix
+++ b/pkgs/by-name/la/lasuite-meet-frontend/package.nix
@ -0,0 +1,51 @@
+{
+  lib,
+  fetchFromGitHub,
+  fetchNpmDeps,
+  buildNpmPackage,
+}:
+
+buildNpmPackage rec {
+  pname = "lasuite-meet-frontend";
+  version = "0.1.27";
+
+  src = fetchFromGitHub {
+    owner = "suitenumerique";
+    repo = "meet";
+    tag = "v${version}";
+    hash = "sha256-EMhsQPrONaQmNJ/FFoYlP5KKXT8vm7LwUHmEZd0oZeE=";
+  };
+
+  sourceRoot = "source/src/frontend";
+
+  npmDeps = fetchNpmDeps {
+    inherit version src;
+    sourceRoot = "source/src/frontend";
+    hash = "sha256-7wXzcn6aGAkRUOCI6MU0AlPGngBWJtdbAfnZZDaMWec=";
+  };
+
+  buildPhase = ''
+    runHook preBuild
+
+    npm run build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    cp -r dist $out
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Open source alternative to Google Meet and Zoom powered by LiveKit: HD video calls, screen sharing, and chat features. Built with Django and React";
+    homepage = "https://github.com/suitenumerique/meet";
+    changelog = "https://github.com/suitenumerique/meet/blob/${src.tag}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ soyouzpanda ];
+    platforms = lib.platforms.all;
+  };
+}
--- a/pkgs/by-name/la/lasuite-meet/package.nix
+++ b/pkgs/by-name/la/lasuite-meet/package.nix
@ -0,0 +1,113 @@
+{
+  lib,
+  python3,
+  fetchFromGitHub,
+  nixosTests,
+}:
+let
+  python = python3.override {
+    self = python3;
+    packageOverrides = (self: super: { django = super.django_5_2; });
+  };
+in
+
+python.pkgs.buildPythonApplication rec {
+  pname = "lasuite-meet";
+  version = "0.1.27";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "suitenumerique";
+    repo = "meet";
+    tag = "v${version}";
+    hash = "sha256-EMhsQPrONaQmNJ/FFoYlP5KKXT8vm7LwUHmEZd0oZeE=";
+  };
+
+  sourceRoot = "source/src/backend";
+
+  patches = [
+    # Support configuration throught environment variables for SECURE_*
+    ./secure_settings.patch
+  ];
+
+  build-system = with python.pkgs; [ setuptools ];
+
+  dependencies = with python.pkgs; [
+    aiohttp
+    boto3
+    brevo-python
+    brotli
+    celery
+    django
+    django-configurations
+    django-cors-headers
+    django-countries
+    django-extensions
+    django-lasuite
+    django-parler
+    django-redis
+    django-storages
+    django-timezone-field
+    djangorestframework
+    dockerflow
+    drf-spectacular
+    drf-spectacular-sidecar
+    easy-thumbnails
+    factory-boy
+    gunicorn
+    jsonschema
+    june-analytics-python
+    livekit-api
+    markdown
+    mozilla-django-oidc
+    nested-multipart-parser
+    psycopg
+    pyjwt
+    pyopenssl
+    python-frontmatter
+    redis
+    requests
+    sentry-sdk
+    whitenoise
+  ];
+
+  pythonRelaxDeps = true;
+
+  postBuild = ''
+    export DJANGO_DATA_DIR=$(pwd)/data
+    ${python.pythonOnBuildForHost.interpreter} manage.py collectstatic --noinput --clear
+  '';
+
+  postInstall =
+    let
+      pythonPath = python.pkgs.makePythonPath dependencies;
+    in
+    ''
+      mkdir -p $out/{bin,share}
+
+      cp ./manage.py $out/bin/.manage.py
+      cp -r data/static $out/share
+      chmod +x $out/bin/.manage.py
+
+      makeWrapper $out/bin/.manage.py $out/bin/meet \
+        --prefix PYTHONPATH : "${pythonPath}"
+      makeWrapper ${lib.getExe python.pkgs.celery} $out/bin/celery \
+        --prefix PYTHONPATH : "${pythonPath}:$out/${python.sitePackages}"
+      makeWrapper ${lib.getExe python.pkgs.gunicorn} $out/bin/gunicorn \
+        --prefix PYTHONPATH : "${pythonPath}:$out/${python.sitePackages}"
+    '';
+
+  passthru.tests = {
+    login-and-create-room = nixosTests.lasuite-meet;
+  };
+
+  meta = {
+    description = "Open source alternative to Google Meet and Zoom powered by LiveKit: HD video calls, screen sharing, and chat features. Built with Django and React";
+    homepage = "https://github.com/suitenumerique/meet";
+    changelog = "https://github.com/suitenumerique/meet/blob/${src.tag}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ soyouzpanda ];
+    mainProgram = "meet";
+    platforms = lib.platforms.all;
+  };
+}
--- a/pkgs/by-name/la/lasuite-meet/secure_settings.patch
+++ b/pkgs/by-name/la/lasuite-meet/secure_settings.patch
@ -0,0 +1,52 @@
+From d7bbf24df5eecb61caebdf55b0d26da60a9d9609 Mon Sep 17 00:00:00 2001
+From: soyouzpanda <soyouzpanda@soyouzpanda.fr>
+Date: Fri, 16 May 2025 23:41:12 +0200
+Subject: [PATCH 1/2] =?UTF-8?q?=F0=9F=94=A7(backend)=20allow=20SECURE=20en?=
+ =?UTF-8?q?vironment=20variables=20to=20be=20configured?=
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+---
+ meet/settings.py | 19 ++++++++++++-------
+ 1 file changed, 12 insertions(+), 7 deletions(-)
+
+diff --git a/meet/settings.py b/meet/settings.py
+index ebb0837..9c67986 100755
+--- a/meet/settings.py
+++ b/meet/settings.py
+@@ -755,19 +755,24 @@ class Production(Base):
+     # - Your proxy sets the X-Forwarded-Proto header and sends it to Django
+     #
+     # In other cases, you should comment the following line to avoid security issues.
+-    SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
+-    SECURE_HSTS_SECONDS = 60
+-    SECURE_HSTS_PRELOAD = True
+-    SECURE_HSTS_INCLUDE_SUBDOMAINS = True
+-    SECURE_SSL_REDIRECT = True
+    SECURE_PROXY_SSL_HEADER = values.TupleValue(("HTTP_X_FORWARDED_PROTO", "https"),
+                                                environ_name="SECURE_PROXY_SSL_HEADER")
+    SECURE_HSTS_SECONDS = values.IntegerValue(
+        60, environ_name="SECURE_HSTS_SECONDS")
+    SECURE_HSTS_PRELOAD = values.BooleanValue(
+        True, environ_name="SECURE_HSTS_PRELOAD")
+    SECURE_HSTS_INCLUDE_SUBDOMAINS = values.BooleanValue(
+        True, environ_name="SECURE_HSTS_INCLUDE_SUBDOMAINS")
+    SECURE_SSL_REDIRECT = values.BooleanValue(
+        True, environ_name="SECURE_SSL_REDIRECT")
+     SECURE_REDIRECT_EXEMPT = [
+         "^__lbheartbeat__",
+         "^__heartbeat__",
+     ]
+ 
+     # Modern browsers require to have the `secure` attribute on cookies with `Samesite=none`
+-    CSRF_COOKIE_SECURE = True
+-    SESSION_COOKIE_SECURE = True
+    CSRF_COOKIE_SECURE = values.BooleanValue(True, environ_name="CSRF_COOKIE_SECURE")
+    SESSION_COOKIE_SECURE = values.BooleanValue(True, environ_name="SESSION_COOKIE_SECURE")
+ 
+     # Privacy
+     SECURE_REFERRER_POLICY = "same-origin"
+-- 
+2.47.2
+
--- a/pkgs/by-name/la/lazygit/package.nix
+++ b/pkgs/by-name/la/lazygit/package.nix
@ -8,13 +8,13 @@
 }:
 buildGoModule rec {
  pname = "lazygit";
-  version = "0.52.0";
+  version = "0.53.0";

  src = fetchFromGitHub {
    owner = "jesseduffield";
    repo = "lazygit";
    tag = "v${version}";
-    hash = "sha256-tbFRovaB0f+0VyX34DEXvWYjV3fipc5kbRNhm7rVMlo=";
+    hash = "sha256-u9ccwRdRQEVNC1/nFRSKJ9RCWJI1mM9Ak3bDVMIWD6E=";
  };

  vendorHash = null;
--- a/pkgs/by-name/lb/lbreakouthd/package.nix
+++ b/pkgs/by-name/lb/lbreakouthd/package.nix
@ -18,6 +18,14 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-QFqNGv2+XXe1Dt8HAoqXEHWXFNU/IQ2c9FYEqehrWdI=";
  };

+  # On macOS with a case-insensitive filesystem, "sdl.h" shadows <SDL.h>
+  postPatch = lib.optionalString stdenv.buildPlatform.isDarwin ''
+    mv src/sdl.h src/lbhd_sdl.h
+    for file in src/*.cpp src/*.h; do
+      substituteInPlace "$file" --replace-quiet 'sdl.h' 'lbhd_sdl.h'
+    done
+  '';
+
  buildInputs = [
    SDL2
    SDL2_image
@ -40,6 +48,5 @@ stdenv.mkDerivation (finalAttrs: {
    mainProgram = "lbreakouthd";
    maintainers = with lib.maintainers; [ ];
    inherit (SDL2.meta) platforms;
-    broken = stdenv.hostPlatform.isDarwin;
  };
 })
--- a/pkgs/by-name/mc/mcp-k8s-go/package.nix
+++ b/pkgs/by-name/mc/mcp-k8s-go/package.nix
@ -0,0 +1,42 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "mcp-k8s-go";
+  version = "0.3.5";
+
+  src = fetchFromGitHub {
+    owner = "strowk";
+    repo = "mcp-k8s-go";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-6DKhcUwXBap7Ts+T46GJJxKS6LXTfScZZEQV0PhuVfQ=";
+  };
+
+  vendorHash = "sha256-nP9cVXV1qyYancePz1mMNq911Ou7k5nVckQzbM05HpQ=";
+
+  doCheck = false;
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=${finalAttrs.version}"
+  ];
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  doInstallCheck = true;
+  versionCheckProgramArg = "--version";
+
+  meta = {
+    description = "MCP server connecting to Kubernetes";
+    homepage = "https://github.com/strowk/mcp-k8s-go";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ pilz ];
+    mainProgram = "mcp-k8s-go";
+  };
+})
--- a/pkgs/applications/misc/mediaelch/default.nix
+++ b/pkgs/applications/misc/mediaelch/default.nix
@ -5,59 +5,33 @@
  fetchpatch,

  cmake,
-  qttools,
-  wrapQtAppsHook,

  curl,
  ffmpeg,
  libmediainfo,
  libzen,
-  qt5compat ? null, # qt6 only
-  qtbase,
-  qtdeclarative,
-  qtmultimedia,
-  qtsvg,
-  qtwayland,
-  quazip,
+  libsForQt5,
+  qt6Packages,
+
+  qtVersion ? 6,
 }:
+
 let
-  qtVersion = lib.versions.major qtbase.version;
+  qt' = if qtVersion == 5 then libsForQt5 else qt6Packages;
+
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "mediaelch";
  version = "2.12.0";

  src = fetchFromGitHub {
    owner = "Komet";
    repo = "MediaElch";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-m2d4lnyD8HhhqovMdeG36dMK+4kJA7rlPHE2tlhfevo=";
    fetchSubmodules = true;
  };

-  nativeBuildInputs = [
-    cmake
-    qttools
-    wrapQtAppsHook
-  ];
-
-  buildInputs =
-    [
-      curl
-      ffmpeg
-      libmediainfo
-      libzen
-      qtbase
-      qtdeclarative
-      qtmultimedia
-      qtsvg
-      qtwayland
-      quazip
-    ]
-    ++ lib.optionals (qtVersion == "6") [
-      qt5compat
-    ];
-
  patches = [
    # fix from: https://github.com/Komet/MediaElch/pull/1878
    (fetchpatch {
@ -66,10 +40,34 @@ stdenv.mkDerivation rec {
    })
  ];

+  nativeBuildInputs = [
+    cmake
+    qt'.qttools
+    qt'.wrapQtAppsHook
+  ];
+
+  buildInputs =
+    [
+      curl
+      ffmpeg
+      libmediainfo
+      libzen
+      qt'.qtbase
+      qt'.qtdeclarative
+      qt'.qtmultimedia
+      qt'.qtsvg
+      qt'.qtwayland
+      qt'.quazip
+    ]
+    ++ lib.optionals (qtVersion == 6) [
+      qt'.qt5compat
+    ];
+
  cmakeFlags = [
-    "-DDISABLE_UPDATER=ON"
-    "-DUSE_EXTERN_QUAZIP=ON"
-    "-DMEDIAELCH_FORCE_QT${qtVersion}=ON"
+    (lib.cmakeBool "DISABLE_UPDATER" true)
+    (lib.cmakeBool "ENABLE_TESTS" finalAttrs.finalPackage.doCheck or false)
+    (lib.cmakeBool "MEDIAELCH_FORCE_QT${toString qtVersion}" true)
+    (lib.cmakeBool "USE_EXTERN_QUAZIP" true)
  ];

  # libmediainfo.so.0 is loaded dynamically
@ -77,12 +75,22 @@ stdenv.mkDerivation rec {
    "--prefix LD_LIBRARY_PATH : ${libmediainfo}/lib"
  ];

-  meta = with lib; {
+  env = {
+    HOME = "/tmp"; # for the font cache
+    LANG = "C.UTF-8";
+    QT_QPA_PLATFORM = "offscreen"; # the tests require a UI
+  };
+
+  doCheck = true;
+
+  checkTarget = "unit_test"; # the other tests require network connectivity
+
+  meta = {
    homepage = "https://mediaelch.de/mediaelch/";
    description = "Media Manager for Kodi";
    mainProgram = "MediaElch";
-    license = licenses.lgpl3Only;
-    maintainers = with maintainers; [ stunkymonkey ];
-    platforms = platforms.linux;
+    license = lib.licenses.lgpl3Only;
+    maintainers = with lib.maintainers; [ stunkymonkey ];
+    platforms = lib.platforms.linux;
  };
-}
+})
--- a/pkgs/by-name/me/memcached-exporter/package.nix
+++ b/pkgs/by-name/me/memcached-exporter/package.nix
@ -0,0 +1,31 @@
+{
+  buildGoModule,
+  fetchFromGitHub,
+  lib,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "memcached-exporter";
+  version = "0.15.3";
+
+  src = fetchFromGitHub {
+    owner = "prometheus";
+    repo = "memcached_exporter";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Y2y8XMR+YHbxFQFYqwtQ4aRi71jD6l3witEwjxAjuOc=";
+  };
+
+  vendorHash = "sha256-Q2b8/QA12HI6ynLU5aNmwOal+snHd1Be6p3UWk4DJhw=";
+
+  # Tests touch the network
+  doCheck = false;
+
+  meta = {
+    changelog = "https://github.com/prometheus/memcached_exporter/releases/tag/${finalAttrs.src.tag}";
+    description = "Exports metrics from memcached servers for consumption by Prometheus";
+    homepage = "https://github.com/prometheus/memcached_exporter";
+    license = lib.licenses.asl20;
+    mainProgram = "memcached_exporter";
+    teams = with lib.teams; [ deshaw ];
+  };
+})
--- a/pkgs/by-name/mo/moon/package.nix
+++ b/pkgs/by-name/mo/moon/package.nix
@ -13,16 +13,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "moon";
-  version = "1.37.3";
+  version = "1.38.0";

  src = fetchFromGitHub {
    owner = "moonrepo";
    repo = "moon";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-XBuB26ghUUXkQrUDZCt7L4c8aW5odI7BqDdM6Si8Nck=";
+    hash = "sha256-z1wMXbpKtHei2cLehfYFd0hUAl8yooZlqeLA/sozFoo=";
  };

-  cargoHash = "sha256-7XcpJngFzWvVdmYWLf3jYLVG/rgXaetP1w4vAt6INDQ=";
+  cargoHash = "sha256-m7nQE+6rp1RHVgR5xt41RCIgcWm+2jomYDQQUIpsfIE=";

  env = {
    RUSTFLAGS = "-C strip=symbols";
--- a/pkgs/by-name/mu/mupdf/package.nix
+++ b/pkgs/by-name/mu/mupdf/package.nix
@ -233,7 +233,7 @@ stdenv.mkDerivation rec {
    '')
    + (lib.optionalString (enableX11 || enableGL) ''
      mkdir -p $bin/share/icons/hicolor/48x48/apps
-      cp docs/logo/mupdf-icon-48.png $bin/share/icons/hicolor/48x48/apps
+      cp docs/logo/mupdf-icon-48.png $bin/share/icons/hicolor/48x48/apps/mupdf.png
    '')
    + (
      if enableGL then
--- a/pkgs/by-name/nh/nhost-cli/package.nix
+++ b/pkgs/by-name/nh/nhost-cli/package.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "nhost-cli";
-  version = "1.29.9";
+  version = "1.31.0";

  src = fetchFromGitHub {
    owner = "nhost";
    repo = "cli";
    tag = "v${version}";
-    hash = "sha256-9UxB/tshTwMg4K7K0Fs1Ld96ET6Drg77GJgONj4cRmM=";
+    hash = "sha256-JMRFvJv/Ynnk0maT27sprTpWjCgGDw0x2sK+woS9uQk=";
  };

  vendorHash = null;
--- a/pkgs/by-name/no/noto-fonts/package.nix
+++ b/pkgs/by-name/no/noto-fonts/package.nix
@ -20,13 +20,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "noto-fonts${suffix}";
-  version = "2025.06.01";
+  version = "2025.07.01";

  src = fetchFromGitHub {
    owner = "notofonts";
    repo = "notofonts.github.io";
    rev = "noto-monthly-release-${version}";
-    hash = "sha256-6lbNJjkf6lnPPZzHO3vtsXEuPQs6ewslgnQIeDhF2yk=";
+    hash = "sha256-H2mUG2+7+lVCjoAVvsuFK5NNm5LpjyF9ySlF3vriR1w=";
  };

  outputs = [
--- a/pkgs/by-name/op/openrct2/package.nix
+++ b/pkgs/by-name/op/openrct2/package.nix
@ -33,7 +33,7 @@
 }:

 let
-  openrct2-version = "0.4.22";
+  openrct2-version = "0.4.23";

  # Those versions MUST match the pinned versions within the CMakeLists.txt
  # file. The REPLAYS repository from the CMakeLists.txt is not necessary.
@ -67,7 +67,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "OpenRCT2";
    repo = "OpenRCT2";
    rev = "v${openrct2-version}";
-    hash = "sha256-dFELAfJIgizM0nRc4SMrFGIqFQo/ImTtR89GVkb4/TQ=";
+    hash = "sha256-vCnMVfRTF79oWsYorsI5/Mj7/P32G5uZMskW2SUSYlg=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/or/orchard/package.nix
+++ b/pkgs/by-name/or/orchard/package.nix
@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "orchard";
-  version = "0.34.0";
+  version = "0.35.0";

  src = fetchFromGitHub {
    owner = "cirruslabs";
    repo = "orchard";
    rev = version;
-    hash = "sha256-7XKiFViGjz0/jrvN6JdCFy1lw4fN2Bz43WWKcgZ7ZzU=";
+    hash = "sha256-K9lPI1wl+F6piksRMh7WgRPIAXpAvSTPjX+5MIddIZQ=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
@ -24,7 +24,7 @@ buildGoModule rec {
    '';
  };

-  vendorHash = "sha256-LExITpIVaMIxt+CkH7SRkbSPRO842Pl9lgSqZenE4uA=";
+  vendorHash = "sha256-+lH9TNceOYmGeoWUy4xnDr1TtSW81ZELljPfCv8zwEE=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/pl/pluto/package.nix
+++ b/pkgs/by-name/pl/pluto/package.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "pluto";
-  version = "5.21.7";
+  version = "5.21.8";

  src = fetchFromGitHub {
    owner = "FairwindsOps";
    repo = "pluto";
    rev = "v${version}";
-    hash = "sha256-1Sgq8WBx0jPPmuNvUfiDs9CvV0IjCp0+n8OUlVjGj3w=";
+    hash = "sha256-41ud7SRaivhmtBY6ekKIpRijTuLqJ/tLi0dTHDsGAps=";
  };

  vendorHash = "sha256-4kiLgwr8wr/L4anxgZVAE6IFdbBvTgcUlf5KIcT+lRk=";
--- a/pkgs/by-name/pp/pphack/package.nix
+++ b/pkgs/by-name/pp/pphack/package.nix
@ -0,0 +1,33 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "pphack";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "edoardottt";
+    repo = "pphack";
+    tag = "v${version}";
+    hash = "sha256-SWMY+t8NzbUqAeLsqia5KAXXOjoMRMZVVa8YdTLcG5A=";
+  };
+
+  vendorHash = "sha256-smJp3GDo1KOrEjEJnxtyrlHmb/L70QqhDWjCZ4U1qJs=";
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  meta = {
+    description = "Client-Side Prototype Pollution Scanner";
+    homepage = "https://github.com/edoardottt/pphack";
+    changelog = "https://github.com/edoardottt/pphack/releases/tag/${src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "pphack";
+  };
+}
--- a/pkgs/by-name/pr/proto/package.nix
+++ b/pkgs/by-name/pr/proto/package.nix
@ -10,17 +10,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "proto";
-  version = "0.50.0";
+  version = "0.50.1";

  src = fetchFromGitHub {
    owner = "moonrepo";
    repo = "proto";
    rev = "v${version}";
-    hash = "sha256-ilbqT5826FB20uCzt2a6QYCD2rDNto7nxz1mjHGDbAA=";
+    hash = "sha256-Ol0l+9pkMDmb09a6gsDxP9KIpIIeDNHp9cGBbfWHBNA=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-bAsFzu1RzOMufFb2WCRd0pDl8O8eVsoZn79BPWql1xg=";
+  cargoHash = "sha256-kc/NC1WGOChdPXq1q83j5GBrcYTEpPCauIZ/q02caUU=";

  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
    libiconv
--- a/pkgs/by-name/pr/protoc-gen-lint/package.nix
+++ b/pkgs/by-name/pr/protoc-gen-lint/package.nix
@ -0,0 +1,31 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "protoc-gen-lint";
+  version = "0.3.0";
+
+  src = fetchFromGitHub {
+    owner = "ckaznocha";
+    repo = "protoc-gen-lint";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-8+fPkXmigP8ZqcFGCnw1KZhJQcahDjKnZUJ1eqaHhs0=";
+  };
+
+  vendorHash = null;
+
+  meta = {
+    description = "Plug-in for Google's Protocol Buffers compiler to check .proto files for style violations";
+    homepage = "https://github.com/ckaznocha/protoc-gen-lint";
+    changelog = "https://github.com/ckaznocha/protoc-gen-lint/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      jherland
+      jk
+    ];
+    mainProgram = "protoc-gen-lint";
+  };
+})
--- a/pkgs/by-name/ps/pssh/package.nix
+++ b/pkgs/by-name/ps/pssh/package.nix
@ -8,16 +8,18 @@

 python3Packages.buildPythonApplication rec {
  pname = "pssh";
-  version = "2.3.4";
-  format = "setuptools";
+  version = "2.3.5";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "lilydjwg";
    repo = "pssh";
-    rev = "v${version}";
-    hash = "sha256-B1dIa6hNeq4iE8GKVhTp3Gzq7vp+v5Yyzj8uF8X71yg=";
+    tag = "v${version}";
+    hash = "sha256-JZOO5xmW34lvWzGL4tC9fquZOOYhub0/aa/iQ63rjHE=";
  };

+  build-system = with python3Packages; [ setuptools ];
+
  postPatch = ''
    for f in bin/*; do
      substituteInPlace $f \
@ -37,6 +39,7 @@ python3Packages.buildPythonApplication rec {
      including pssh, pscp, prsync, pnuke and pslurp.
    '';
    inherit (src.meta) homepage;
+    changelog = "https://github.com/lilydjwg/pssh/blob/${src.tag}/ChangeLog";
    license = licenses.bsd3;
    platforms = platforms.linux ++ platforms.darwin;
    maintainers = with maintainers; [ chris-martin ];
--- a/pkgs/by-name/re/redis/package.nix
+++ b/pkgs/by-name/re/redis/package.nix
@ -98,9 +98,7 @@ stdenv.mkDerivation (finalAttrs: {
      --tags -leaks \
      --skipunit integration/aof-multi-part \
      --skipunit integration/failover \
-      ${lib.optionalString (
-        stdenv.hostPlatform.system == "aarch64-linux"
-      ) "--skipunit integration/replication-rdbchannel"}
+      --skipunit integration/replication-rdbchannel

    runHook postCheck
  '';
--- a/pkgs/by-name/ro/rosa/package.nix
+++ b/pkgs/by-name/ro/rosa/package.nix
@ -11,13 +11,13 @@

 buildGoModule rec {
  pname = "rosa";
-  version = "1.2.53";
+  version = "1.2.54";

  src = fetchFromGitHub {
    owner = "openshift";
    repo = "rosa";
    rev = "v${version}";
-    hash = "sha256-t8hJscLk0tRi7CC6maE478CEbOkJtVkbXA0Ag1DxFB4=";
+    hash = "sha256-mW4uwviyzGI8mMaQsnedV1vTm26ae6VSoihMzvSCAjc=";
  };
  vendorHash = null;

--- a/pkgs/by-name/s7/s7/package.nix
+++ b/pkgs/by-name/s7/s7/package.nix
@ -19,14 +19,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "s7";
-  version = "11.5-unstable-2025-06-25";
+  version = "11.5-unstable-2025-07-04";

  src = fetchFromGitLab {
    domain = "cm-gitlab.stanford.edu";
    owner = "bil";
    repo = "s7";
-    rev = "0030b5a1e968bc0d6d3cdfd083703c9f5dcf93aa";
-    hash = "sha256-SqRzPSzahZeWxbWhQIUyXzRBq0x6gxb6Sd7oVqTIaF4=";
+    rev = "3bf6fbd10602b1148addb1d5c59560a3599472a1";
+    hash = "sha256-cI7DIZNFL1QmTYlP+yQp/BbgIvn8ej59PxzvfhTnpwM=";
  };

  buildInputs = [
--- a/pkgs/by-name/sa/saman_ttf/package.nix
+++ b/pkgs/by-name/sa/saman_ttf/package.nix
@ -0,0 +1,32 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  unzip,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "saman_ttf";
+  version = "1.001";
+
+  src = fetchurl {
+    url = "https://github.com/tcgumus/saman/releases/download/v${finalAttrs.version}/SamanDere-Regular.ttf";
+    hash = "sha256-hLlo4qtxL1RDiA9PpRvo2F7rdCVGPs2G8NHKydLfJXU=";
+  };
+
+  dontUnpack = true;
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm644 $src $out/share/fonts/truetype/SamanDere-Regular.ttf
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Medium contrast sans serif font for web use";
+    homepage = "https://github.com/tcgumus/saman";
+    license = lib.licenses.ofl;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ gigahawk ];
+  };
+})
--- a/pkgs/by-name/si/simple-http-server/package.nix
+++ b/pkgs/by-name/si/simple-http-server/package.nix
@ -8,17 +8,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "simple-http-server";
-  version = "0.6.12";
+  version = "0.6.13";

  src = fetchFromGitHub {
    owner = "TheWaWaR";
    repo = "simple-http-server";
    rev = "v${version}";
-    sha256 = "sha256-WaUBMGZaIjce83mskEtH9PLYDDlBL1MNoY8lz4++684=";
+    sha256 = "sha256-uTzzQg1UJ+PG2poIKd+LO0T0y7z48ZK0f196zIgeZhs=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-5oZTT2qBtupuF2thhfko7mgWLu+e7+P92V+DPsPZ1Ak=";
+  cargoHash = "sha256-y+pNDg73fAHs9m0uZr6z0HTA/vB3fFM5qukJycuIxnY=";

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/by-name/sv/svd2rust-form/package.nix
+++ b/pkgs/by-name/sv/svd2rust-form/package.nix
@ -0,0 +1,30 @@
+{
+  lib,
+  rustPlatform,
+  fetchCrate,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "svd2rust-form";
+  version = "0.13.0";
+
+  src = fetchCrate {
+    pname = "form";
+    inherit (finalAttrs) version;
+    hash = "sha256-7+5HEyP7480UM5dydavoiclX3YTvW46V8r+Vpqt4xWk=";
+  };
+
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-ItNBQKye1GD01KFBubMLxksv8OCWIxya/LlZ9g6Jdg8=";
+
+  meta = {
+    description = "Library for splitting apart a large file with multiple modules into the idiomatic rust directory structure";
+    mainProgram = "form";
+    homepage = "https://github.com/djmcgill/form";
+    changelog = "https://github.com/djmcgill/form/blob/main/CHANGELOG.md";
+    license = with lib.licenses; [
+      mit
+    ];
+    maintainers = with lib.maintainers; [ fidgetingbits ];
+  };
+})
--- a/pkgs/by-name/ta/tailscale/package.nix
+++ b/pkgs/by-name/ta/tailscale/package.nix
@ -23,7 +23,7 @@
 }:

 let
-  version = "1.84.2";
+  version = "1.84.3";
 in
 buildGoModule {
  pname = "tailscale";
@ -38,7 +38,7 @@ buildGoModule {
    owner = "tailscale";
    repo = "tailscale";
    rev = "v${version}";
-    hash = "sha256-dSYophk7oogLmlRBr05Quhx+iMUuJU2VXhAZVtJLTts=";
+    hash = "sha256-0HvUNpyi6xzS3PtbgMvh6bLRhV77CZRrVSKGMr7JtbE=";
  };

  vendorHash = "sha256-QBYCMOWQOBCt+69NtJtluhTZIOiBWcQ78M9Gbki6bN0=";
--- a/pkgs/by-name/te/termusic/package.nix
+++ b/pkgs/by-name/te/termusic/package.nix
@ -16,17 +16,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "termusic";
-  version = "0.10.0";
+  version = "0.11.0";

  src = fetchFromGitHub {
    owner = "tramhao";
    repo = "termusic";
    rev = "v${version}";
-    hash = "sha256-Yd23Jk2BFuLtxgF8vgat0wTGq6ahHHBd/HjGI9BY9z4=";
+    hash = "sha256-89eqOeSq9uI4re3Oq0/ORMzMjYA4pLw7ZYyfGPXWtfg=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-1WomL0O5QS2NHu4k6TuA2jLtDKyxlY0iVCgH9pb6CHI=";
+  cargoHash = "sha256-yzmZC1JwTHefAE2X/D1yfVZN4wGxnH+FkXGqKMuaVeM=";

  useNextest = true;

--- a/pkgs/by-name/ts/tslib/package.nix
+++ b/pkgs/by-name/ts/tslib/package.nix
@ -3,27 +3,30 @@
  stdenv,
  fetchFromGitHub,
  cmake,
+  nix-update-script,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "tslib";
  version = "1.23";
-  hash = "sha256-2YJDADh/WCksAEIjngAdji98YGmwjpvxSBZkxAwFc7k=";

  src = fetchFromGitHub {
    owner = "libts";
    repo = "tslib";
-    rev = finalAttrs.version;
-    sha256 = finalAttrs.hash;
+    tag = finalAttrs.version;
+    hash = "sha256-2YJDADh/WCksAEIjngAdji98YGmwjpvxSBZkxAwFc7k=";
  };

  nativeBuildInputs = [ cmake ];

+  passthru.updateScript = nix-update-script { };
+
  meta = {
    description = "Touchscreen access library";
    homepage = "http://www.tslib.org/";
    license = lib.licenses.lgpl21;
    platforms = lib.platforms.all;
    maintainers = with lib.maintainers; [ shogo ];
+    teams = with lib.teams; [ ngi ];
  };
 })
--- a/pkgs/by-name/ty/typora/package.nix
+++ b/pkgs/by-name/ty/typora/package.nix
@ -24,7 +24,10 @@ let
  pname = "typora";
  version = "1.10.8";
  src = fetchurl {
-    url = "https://download.typora.io/linux/typora_${version}_amd64.deb";
+    urls = [
+      "https://download.typora.io/linux/typora_${version}_amd64.deb"
+      "https://download2.typoraio.cn/linux/typora_${version}_amd64.deb"
+    ];
    hash = "sha256-7auxTtdVafvM2fIpQVvEey1Q6eLVG3mLdjdZXcqSE/Q=";
  };

--- a/pkgs/by-name/ve/versitygw/package.nix
+++ b/pkgs/by-name/ve/versitygw/package.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "versitygw";
-  version = "1.0.14";
+  version = "1.0.15";

  src = fetchFromGitHub {
    owner = "versity";
    repo = "versitygw";
    tag = "v${version}";
-    hash = "sha256-/64SiVZUXGRI3guvSIqDBXOmbxucPCZEceCObTee6jI=";
+    hash = "sha256-gRVUR1BlGVLS6+OZUvOVgoRNDiHrDSDu2L3iBwZ/zbg=";
  };

-  vendorHash = "sha256-HzPjHNZdQ+IJl91QviVG6zydhTb/1tOZGdFBpHLUTfE=";
+  vendorHash = "sha256-7efskc/3bj8/8D5LgQnkC4TYib+73fpDyRKDDcFVRvA=";

  doCheck = false; # Require access to online S3 services

--- a/pkgs/by-name/vp/vpp/package.nix
+++ b/pkgs/by-name/vp/vpp/package.nix
@ -50,13 +50,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "vpp";
-  version = "25.02";
+  version = "25.06";

  src = fetchFromGitHub {
    owner = "FDio";
    repo = "vpp";
    rev = "v${version}";
-    hash = "sha256-UDO1mlOEQNCmtR18CCTF+ng5Ms9gfTsnohSygLlPopY=";
+    hash = "sha256-BuHKPQA4qHoADqBg2IztlzUMpbvYKK5uH7ktChSW5vk=";
  };

  postPatch = ''
--- a/pkgs/by-name/wa/waycheck/package.nix
+++ b/pkgs/by-name/wa/waycheck/package.nix
@ -14,14 +14,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "waycheck";
-  version = "1.6.0";
+  version = "1.7.0";

  src = fetchFromGitLab {
    domain = "gitlab.freedesktop.org";
    owner = "serebit";
    repo = "waycheck";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-w6JasxkxwWrkWECsW/dCMj2HcnmeM/VVMnkOXzwNWCQ=";
+    hash = "sha256-wO3+Vwi4wM/NfRdHUt0AVEE6UPr7wkY12JBVzLFqM4c=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/wg/wgsl-analyzer/package.nix
+++ b/pkgs/by-name/wg/wgsl-analyzer/package.nix
@ -7,17 +7,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "wgsl-analyzer";
-  version = "2025-06-02";
+  version = "2025-06-28";

  src = fetchFromGitHub {
    owner = "wgsl-analyzer";
    repo = "wgsl-analyzer";
    tag = finalAttrs.version;
-    hash = "sha256-bLwehCmWzqDmmg4iGM21BOUquSYJSY2LIqlKuB1bAlA=";
+    hash = "sha256-X4BUZWrCmyixM6D7785jsQ4XYhXemQ7ycl0FUijevkg=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-Z+slANnmrY5bhM8+Ki+l29OAbpqnx38n53CFCuOR6cM=";
+  cargoHash = "sha256-PEhvnIVjNi0O2ZqzSW/CRaK4r5pzd7sMUDhB2eGpqk8=";

  checkFlags = [
    # Imports failures
--- a/pkgs/by-name/xk/xk6/package.nix
+++ b/pkgs/by-name/xk/xk6/package.nix
@ -9,13 +9,13 @@

 buildGoModule rec {
  pname = "xk6";
-  version = "1.0.0";
+  version = "1.0.1";

  src = fetchFromGitHub {
    owner = "grafana";
    repo = "xk6";
    tag = "v${version}";
-    hash = "sha256-lSEMToo4Bjh9j2Z/wG64TIeHdJ/+HpYlEXyqIK9MJ/Y=";
+    hash = "sha256-uFW8TogMq0Uo0SXzO7V8xK4UCo+u6CTArIWIwz+kyZc=";
  };

  vendorHash = null;
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@ -231,6 +231,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
      # Flaky: unreliably fails on certain hosts (including Hydra)
      "--skip=zed::tests::test_window_edit_state_restoring_enabled"
    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      # Flaky: unreliably fails on certain hosts (including Hydra)
+      "--skip=zed::open_listener::tests::test_open_workspace_with_directory"
+    ]
    ++ lib.optionals stdenv.hostPlatform.isLinux [
      # Fails on certain hosts (including Hydra) for unclear reason
      "--skip=test_open_paths_action"
--- a/pkgs/development/libraries/astal/source.nix
+++ b/pkgs/development/libraries/astal/source.nix
@ -7,15 +7,15 @@ let
  originalDrv = fetchFromGitHub {
    owner = "Aylur";
    repo = "astal";
-    rev = "4820a3e37cc8eb81db6ed991528fb23472a8e4de";
-    hash = "sha256-SaHAtzUyfm4urAcUEZlBFn7dWhoDqA6kaeFZ11CCTf8=";
+    rev = "ac90f09385a2295da9fdc108aaba4a317aaeacc7";
+    hash = "sha256-AodIKw7TmI7rHVcOfEsO82stupMYIMVQeLAUQfVxnkU=";
  };
 in
 originalDrv.overrideAttrs (
  final: prev: {
    name = "${final.pname}-${final.version}"; # fetchFromGitHub already defines name
    pname = "astal-source";
-    version = "0-unstable-2025-05-12";
+    version = "0-unstable-2025-06-28";

    meta = prev.meta // {
      description = "Building blocks for creating custom desktop shells (source)";
--- a/pkgs/development/libraries/libquotient/default.nix
+++ b/pkgs/development/libraries/libquotient/default.nix
@ -10,9 +10,6 @@
  qtkeychain,
 }:

-let
-  isQt6 = lib.versions.major qtbase.version == "6";
-in
 stdenv.mkDerivation rec {
  pname = "libquotient";
  version = "0.9.1";
@ -41,7 +38,6 @@ stdenv.mkDerivation rec {

  cmakeFlags = [
    "-DQuotient_ENABLE_E2EE=ON"
-    (lib.cmakeBool "BUILD_WITH_QT6" isQt6)
  ];

  # https://github.com/quotient-im/libQuotient/issues/551
--- a/pkgs/development/python-modules/aiobafi6/default.nix
+++ b/pkgs/development/python-modules/aiobafi6/default.nix
@ -6,27 +6,24 @@
  protobuf,
  pytest-asyncio,
  pytestCheckHook,
-  pythonOlder,
  zeroconf,
 }:

 buildPythonPackage rec {
  pname = "aiobafi6";
-  version = "0.9.0";
-  format = "pyproject";
-
-  disabled = pythonOlder "3.10";
+  version = "0.10.0";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "jfroy";
    repo = "aiobafi6";
    tag = version;
-    hash = "sha256-QxjrspvNrcMcGChjj1B4QF/SnWCsGmPxnI2bWAL6BiI=";
+    hash = "sha256-7NIpIRVs6PFPByrGfVDA6P7JTvXGrzbH/lOPdPfZH04=";
  };

-  nativeBuildInputs = [ poetry-core ];
+  build-system = [ poetry-core ];

-  propagatedBuildInputs = [
+  dependencies = [
    protobuf
    zeroconf
  ];
@ -40,10 +37,10 @@ buildPythonPackage rec {

  meta = with lib; {
    description = "Library for communication with the Big Ass Fans i6 firmware";
-    mainProgram = "aiobafi6";
    homepage = "https://github.com/jfroy/aiobafi6";
-    changelog = "https://github.com/jfroy/aiobafi6/releases/tag/0.8.2";
+    changelog = "https://github.com/jfroy/aiobafi6/releases/tag/${src.tag}";
    license = licenses.asl20;
    maintainers = with maintainers; [ fab ];
+    mainProgram = "aiobafi6";
  };
 }
--- a/pkgs/development/python-modules/fast-simplification/default.nix
+++ b/pkgs/development/python-modules/fast-simplification/default.nix
@ -0,0 +1,68 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  cython,
+  numpy,
+  setuptools,
+  wheel,
+  pytestCheckHook,
+  pyvista,
+  nix-update-script,
+}:
+
+buildPythonPackage rec {
+  pname = "fast-simplification";
+  version = "0.1.11";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "pyvista";
+    repo = "fast-simplification";
+    tag = "v${version}";
+    hash = "sha256-3mqcFTNrq1W376ctJJumzeQccaB4cvoTNW8BHEnv5t8=";
+  };
+
+  build-system = [
+    cython
+    numpy
+    setuptools
+    wheel
+  ];
+
+  dependencies = [
+    numpy
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pyvista
+  ];
+
+  disabledTests = [
+    # need network to download data
+    "test_collapses_louis"
+    "test_human"
+  ];
+
+  # make sure import the built version, not the source one
+  preCheck = ''
+    rm -r fast_simplification
+  '';
+
+  pythonImportsCheck = [
+    "fast_simplification"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Fast Quadratic Mesh Simplification";
+    homepage = "https://github.com/pyvista/fast-simplification";
+    changelog = "https://github.com/pyvista/fast-simplification/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      yzx9
+    ];
+  };
+}
--- a/pkgs/development/python-modules/homematicip/default.nix
+++ b/pkgs/development/python-modules/homematicip/default.nix
@ -16,7 +16,7 @@

 buildPythonPackage rec {
  pname = "homematicip";
-  version = "2.0.6";
+  version = "2.0.7";
  pyproject = true;

  disabled = pythonOlder "3.12";
@ -25,7 +25,7 @@ buildPythonPackage rec {
    owner = "hahn-th";
    repo = "homematicip-rest-api";
    tag = version;
-    hash = "sha256-HV+4ZmYr6LsSBbQnr4PUD2u0y6uWxuCMUgNh7gG9IH8=";
+    hash = "sha256-j4/QKNzX8Zi8mgS4DOBVBAwLBsM4qBEXCSIkub04KBQ=";
  };

  build-system = [
--- a/pkgs/development/python-modules/intervals/default.nix
+++ b/pkgs/development/python-modules/intervals/default.nix
@ -0,0 +1,37 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  infinity,
+  pytestCheckHook,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "intervals";
+  version = "0.9.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "kvesteri";
+    repo = "intervals";
+    tag = version;
+    hash = "sha256-5SwbGF7RU+2wgGnqhhFCdV89tsEIum4w7RwPU7+3MRQ=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ infinity ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "intervals" ];
+
+  meta = {
+    description = "Tools for handling intervals (ranges of comparable objects)";
+    homepage = "https://github.com/kvesteri/intervals";
+    changelog = "https://github.com/kvesteri/intervals/blob/${version}/CHANGES.rst";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ jherland ];
+  };
+}
--- a/pkgs/development/python-modules/llama-index-vector-stores-postgres/default.nix
+++ b/pkgs/development/python-modules/llama-index-vector-stores-postgres/default.nix
@ -11,13 +11,13 @@

 buildPythonPackage rec {
  pname = "llama-index-vector-stores-postgres";
-  version = "0.5.3";
+  version = "0.5.4";
  pyproject = true;

  src = fetchPypi {
    pname = "llama_index_vector_stores_postgres";
    inherit version;
-    hash = "sha256-P4gn+1mm4m8iah7F1yAbMm9+cAfyt+WKxH4Jcq+9O2k=";
+    hash = "sha256-328F/9fBSOTTZjqzhs8Fmnb7WbPJs0EQrdl/wVShbio=";
  };

  pythonRemoveDeps = [ "psycopg2-binary" ];
--- a/pkgs/development/python-modules/pytest-asyncio-cooperative/default.nix
+++ b/pkgs/development/python-modules/pytest-asyncio-cooperative/default.nix
@ -0,0 +1,43 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  poetry-core,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "pytest-asyncio-cooperative";
+  version = "0.40.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "willemt";
+    repo = "pytest-asyncio-cooperative";
+    tag = "v${version}";
+    hash = "sha256-WA2swhgpn7Ct409tk91gQiHUZCXQLO0eznqskOVlU1U=";
+  };
+
+  build-system = [ poetry-core ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+  disabledTestPaths = [
+    "example/hypothesis_test.py"
+  ];
+  disabledTests = [
+    "test_tmp_path"
+    "test_session_scope_gen"
+    "test_session_scope_async_gen"
+    "test_retry"
+  ];
+
+  pythonImportsCheck = [ "pytest_asyncio_cooperative" ];
+
+  meta = {
+    description = "Use asyncio to run your I/O bound test suite efficiently and quickly";
+    homepage = "https://github.com/willemt/pytest-asyncio-cooperative";
+    changelog = "https://github.com/willemt/pytest-asyncio-cooperative/releases/tag/v${version}";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ jherland ];
+  };
+}
--- a/pkgs/development/python-modules/python-ldap/default.nix
+++ b/pkgs/development/python-modules/python-ldap/default.nix
@ -68,7 +68,7 @@ buildPythonPackage rec {
    "test_tls_ext_noca"
  ];

-  doCheck = !stdenv.hostPlatform.isDarwin;
+  __darwinAllowLocalNetworking = true;

  meta = with lib; {
    description = "Python modules for implementing LDAP clients";
--- a/pkgs/development/python-modules/python-mystrom/default.nix
+++ b/pkgs/development/python-modules/python-mystrom/default.nix
@ -1,28 +1,31 @@
 {
  lib,
-  buildPythonPackage,
-  fetchPypi,
  aiohttp,
+  buildPythonPackage,
  click,
+  fetchFromGitHub,
+  poetry-core,
  requests,
-  setuptools,
 }:

 buildPythonPackage rec {
  pname = "python-mystrom";
-  version = "2.2.0";
-  format = "setuptools";
+  version = "2.4.0";
+  pyproject = true;

-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-VFsTA/isBw0H7qXQhOX6K2p1QcVxO7q5TIzf8YivVgc=";
+  src = fetchFromGitHub {
+    owner = "home-assistant-ecosystem";
+    repo = "python-mystrom";
+    tag = version;
+    hash = "sha256-zG1T+wC0GznNwP3fi8GKtY9Csq9hyX0vw+h7ARVPQFQ=";
  };

-  propagatedBuildInputs = [
+  build-system = [ poetry-core ];
+
+  dependencies = [
    aiohttp
    click
    requests
-    setuptools
  ];

  # no tests are present
@ -36,14 +39,14 @@ buildPythonPackage rec {

  meta = with lib; {
    description = "Python API client for interacting with myStrom devices";
-    mainProgram = "mystrom";
    longDescription = ''
      Asynchronous Python API client for interacting with myStrom devices.
      There is support for bulbs, motion sensors, plugs and buttons.
    '';
    homepage = "https://github.com/home-assistant-ecosystem/python-mystrom";
-    changelog = "https://github.com/home-assistant-ecosystem/python-mystrom/releases/tag/${version}";
-    license = with licenses; [ mit ];
+    changelog = "https://github.com/home-assistant-ecosystem/python-mystrom/releases/tag/${src.tag}";
+    license = licenses.mit;
    maintainers = with maintainers; [ fab ];
+    mainProgram = "mystrom";
  };
 }
--- a/pkgs/development/python-modules/python-roborock/default.nix
+++ b/pkgs/development/python-modules/python-roborock/default.nix
@ -24,7 +24,7 @@

 buildPythonPackage rec {
  pname = "python-roborock";
-  version = "2.19.0";
+  version = "2.23.0";
  pyproject = true;

  disabled = pythonOlder "3.11";
@ -33,7 +33,7 @@ buildPythonPackage rec {
    owner = "humbertogontijo";
    repo = "python-roborock";
    tag = "v${version}";
-    hash = "sha256-d0rjMo9/ZsqygxdNf78t3Ct2VJjvYQrCrYkIeG6Zkkc=";
+    hash = "sha256-R4whfpm7DuR5KNbQv0e+KEK9clNO5AN7wCQ6ShyaGC0=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/scipy-stubs/default.nix
+++ b/pkgs/development/python-modules/scipy-stubs/default.nix
@ -0,0 +1,49 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pythonOlder,
+  hatchling,
+  optype,
+  scipy,
+}:
+
+buildPythonPackage rec {
+  pname = "scipy-stubs";
+  version = "1.16.0.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "scipy";
+    repo = "scipy-stubs";
+    tag = "v${version}";
+    hash = "sha256-LuBypvtbLp7Zo8Rou1JwBwJjZr0BBic25dhX5Yg1Esk=";
+  };
+
+  disabled = pythonOlder "3.11";
+
+  build-system = [
+    hatchling
+  ];
+
+  dependencies = [
+    optype
+  ];
+
+  optional-dependencies = {
+    scipy = [
+      scipy
+    ];
+  };
+
+  nativeCheckInputs = [
+    scipy
+  ];
+
+  meta = {
+    description = "Typing Stubs for SciPy";
+    homepage = "https://github.com/scipy/scipy-stubs";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ jolars ];
+  };
+}
--- a/pkgs/development/python-modules/tftpy/default.nix
+++ b/pkgs/development/python-modules/tftpy/default.nix
@ -7,12 +7,12 @@

 buildPythonPackage rec {
  pname = "tftpy";
-  version = "0.8.5";
+  version = "0.8.6";
  format = "pyproject";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-3TjjdEUw0MMPoccV1/pFQxm8jTmbtAwFg5zHcfBdDmw=";
+    hash = "sha256-9hb2pDo21IHCZlc2CFl7ndPHxjgYQV1yqgTx0XlUgOo=";
  };

  nativeBuildInputs = [ setuptools ];
--- a/pkgs/servers/monitoring/prometheus/fastly-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/fastly-exporter.nix
@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "fastly-exporter";
-  version = "9.4.0";
+  version = "9.5.0";

  src = fetchFromGitHub {
    owner = "fastly";
    repo = "fastly-exporter";
    rev = "v${version}";
-    hash = "sha256-C2lm9E60mjMCkMnUNdm3P+OXx0nUc7JwV1zNYnmlVt0=";
+    hash = "sha256-W3VVnI83RKwNkQj4njvZS+ANklNR27BWIrJmdcmSq2I=";
  };

  vendorHash = "sha256-wbkm6b8xTGAQ4bCjIOVvJVA7sckPxtDiwMcjglaL/Pk=";
--- a/pkgs/tools/package-management/lix/default.nix
+++ b/pkgs/tools/package-management/lix/default.nix
@ -13,6 +13,7 @@
  editline,
  ncurses,
  clangStdenv,
+  nixpkgs-review,
  nix-direnv,
  nix-fast-build,
  colmena,
@ -92,6 +93,10 @@ let
            stdenv = lixStdenv;
          };

+          nixpkgs-review = nixpkgs-review.override {
+            nix = self.lix;
+          };
+
          nix-direnv = nix-direnv.override {
            nix = self.lix;
          };
--- a/pkgs/tools/security/ghidra/build-extension.nix
+++ b/pkgs/tools/security/ghidra/build-extension.nix
@ -21,16 +21,17 @@ let
      platforms = oldMeta.platforms or ghidra.meta.platforms;
    };

-  buildGhidraExtension =
-    {
-      pname,
-      nativeBuildInputs ? [ ],
-      meta ? { },
-      ...
-    }@args:
-    stdenv.mkDerivation (
-      args
-      // {
+  buildGhidraExtension = lib.extendMkDerivation {
+    constructDrv = stdenv.mkDerivation;
+    extendDrvArgs =
+      finalAttrs:
+      {
+        pname,
+        nativeBuildInputs ? [ ],
+        meta ? { },
+        ...
+      }@args:
+      {
        nativeBuildInputs = nativeBuildInputs ++ [
          unzip
          jdk
@ -67,18 +68,19 @@ let
          '';

        meta = metaCommon meta;
-      }
-    );
+      };
+  };

-  buildGhidraScripts =
-    {
-      pname,
-      meta ? { },
-      ...
-    }@args:
-    stdenv.mkDerivation (
-      args
-      // {
+  buildGhidraScripts = lib.extendMkDerivation {
+    constructDrv = stdenv.mkDerivation;
+    extendDrvArgs =
+      finalAttrs:
+      {
+        pname,
+        meta ? { },
+        ...
+      }@args:
+      {
        installPhase = ''
          runHook preInstall

@ -100,8 +102,8 @@ let
        '';

        meta = metaCommon meta;
-      }
-    );
+      };
+  };
 in
 {
  inherit buildGhidraExtension buildGhidraScripts;
--- a/pkgs/tools/security/ghidra/extensions/findcrypt/default.nix
+++ b/pkgs/tools/security/ghidra/extensions/findcrypt/default.nix
@ -3,26 +3,23 @@
  fetchFromGitHub,
  buildGhidraExtension,
 }:
-let
-  version = "3.0.6";
-in
-buildGhidraExtension {
+buildGhidraExtension (finalAttrs: {
  pname = "findcrypt";
-  inherit version;
+  version = "3.0.6";

  src = fetchFromGitHub {
    owner = "antoniovazquezblanco";
    repo = "GhidraFindcrypt";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
    hash = "sha256-VWi1MP72Vl4XCrbTvRA6qYPk2QyvRyVb9N8QQ/Zml0A=";
  };

  meta = {
    description = "Ghidra analysis plugin to locate cryptographic constants";
    homepage = "https://github.com/antoniovazquezblanco/GhidraFindcrypt";
-    downloadPage = "https://github.com/antoniovazquezblanco/GhidraFindcrypt/releases/tag/v${version}";
-    changelog = "https://github.com/antoniovazquezblanco/GhidraFindcrypt/releases/tag/v${version}";
+    downloadPage = "https://github.com/antoniovazquezblanco/GhidraFindcrypt/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/antoniovazquezblanco/GhidraFindcrypt/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.gpl3;
    maintainers = [ lib.maintainers.BonusPlay ];
  };
-}
+})
--- a/pkgs/tools/security/ghidra/extensions/ghidra-delinker-extension/default.nix
+++ b/pkgs/tools/security/ghidra/extensions/ghidra-delinker-extension/default.nix
@ -4,40 +4,36 @@
  gradle,
  fetchFromGitHub,
 }:
-let
+ghidra.buildGhidraExtension (finalAttrs: {
+  pname = "ghidra-delinker-extension";
  version = "0.5.1";
-  self = ghidra.buildGhidraExtension {
-    pname = "ghidra-delinker-extension";
-    inherit version;

-    src = fetchFromGitHub {
-      owner = "boricj";
-      repo = "ghidra-delinker-extension";
-      rev = "v${version}";
-      hash = "sha256-h6F50Z7S6tPOl9mIhChLKoFxHuAkq/n36ysUEFwWGxI=";
-    };
-
-    postPatch = ''
-      substituteInPlace build.gradle \
-        --replace-fail '"''${getGitHash()}"' '"v${version}"'
-    '';
-
-    gradleBuildTask = "buildExtension";
-
-    __darwinAllowLocalNetworking = true;
-
-    mitmCache = gradle.fetchDeps {
-      pkg = self;
-      data = ./deps.json;
-    };
-
-    meta = {
-      description = "Ghidra extension for delinking executables back to object files";
-      homepage = "https://github.com/boricj/ghidra-delinker-extension";
-      license = lib.licenses.asl20;
-      maintainers = [ lib.maintainers.jchw ];
-      platforms = lib.platforms.unix;
-    };
+  src = fetchFromGitHub {
+    owner = "boricj";
+    repo = "ghidra-delinker-extension";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-h6F50Z7S6tPOl9mIhChLKoFxHuAkq/n36ysUEFwWGxI=";
  };
-in
-self
+
+  postPatch = ''
+    substituteInPlace build.gradle \
+      --replace-fail '"''${getGitHash()}"' '"v${finalAttrs.version}"'
+  '';
+
+  gradleBuildTask = "buildExtension";
+
+  __darwinAllowLocalNetworking = true;
+
+  mitmCache = gradle.fetchDeps {
+    pkg = finalAttrs.finalPackage;
+    data = ./deps.json;
+  };
+
+  meta = {
+    description = "Ghidra extension for delinking executables back to object files";
+    homepage = "https://github.com/boricj/ghidra-delinker-extension";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.jchw ];
+    platforms = lib.platforms.unix;
+  };
+})
--- a/pkgs/tools/security/ghidra/extensions/ghidra-golanganalyzerextension/default.nix
+++ b/pkgs/tools/security/ghidra/extensions/ghidra-golanganalyzerextension/default.nix
@ -3,22 +3,22 @@
  fetchFromGitHub,
  buildGhidraExtension,
 }:
-buildGhidraExtension rec {
+buildGhidraExtension (finalAttrs: {
  pname = "Ghidra-GolangAnalyzerExtension";
  version = "1.2.4";

  src = fetchFromGitHub {
    owner = "mooncat-greenpy";
    repo = "Ghidra_GolangAnalyzerExtension";
-    rev = version;
+    rev = finalAttrs.version;
    hash = "sha256-uxozIJ+BLcP1vBnLOCZD9ueY10hd37fON/Miii3zabo=";
  };

  meta = {
    description = "Facilitates the analysis of Golang binaries using Ghidra";
    homepage = "https://github.com/mooncat-greenpy/Ghidra_GolangAnalyzerExtension";
-    downloadPage = "https://github.com/mooncat-greenpy/Ghidra_GolangAnalyzerExtension/releases/tag/${version}";
+    downloadPage = "https://github.com/mooncat-greenpy/Ghidra_GolangAnalyzerExtension/releases/tag/${finalAttrs.version}";
    license = lib.licenses.mit;
    maintainers = [ lib.maintainers.ivyfanchiang ];
  };
-}
+})
--- a/pkgs/tools/security/ghidra/extensions/kaiju/default.nix
+++ b/pkgs/tools/security/ghidra/extensions/kaiju/default.nix
@ -24,14 +24,14 @@ let
    }
  );

-  self = buildGhidraExtension rec {
+  self = buildGhidraExtension (finalAttrs: {
    pname = "kaiju";
    version = "250610";

    src = fetchFromGitHub {
      owner = "CERTCC";
      repo = "kaiju";
-      rev = version;
+      rev = finalAttrs.version;
      hash = "sha256-qqUnWakQDOBw3sI/6iWD9140iRAsM5PUEQJSV/3/8FQ=";
    };

@ -58,7 +58,7 @@ let
    meta = {
      description = "A Java implementation of some features of the CERT Pharos Binary Analysis Framework for Ghidra";
      homepage = "https://github.com/CERTCC/kaiju";
-      downloadPage = "https://github.com/CERTCC/kaiju/releases/tag/${version}";
+      downloadPage = "https://github.com/CERTCC/kaiju/releases/tag/${finalAttrs.version}";
      license = lib.licenses.bsd3;
      maintainers = [ lib.maintainers.ivyfanchiang ];
      platforms = [
@ -68,6 +68,6 @@ let
        "aarch64-darwin"
      ];
    };
-  };
+  });
 in
 self
--- a/pkgs/tools/security/ghidra/extensions/lightkeeper/default.nix
+++ b/pkgs/tools/security/ghidra/extensions/lightkeeper/default.nix
@ -3,14 +3,14 @@
  fetchFromGitHub,
  buildGhidraExtension,
 }:
-buildGhidraExtension rec {
+buildGhidraExtension (finalAttrs: {
  pname = "lightkeeper";
  version = "1.2.4";

  src = fetchFromGitHub {
    owner = "WorksButNotTested";
    repo = "lightkeeper";
-    rev = version;
+    rev = finalAttrs.version;
    hash = "sha256-aGMWg6VQleKH/txlxpSw19QOotWZSqeW5Ve2SpWGhgA=";
  };
  preConfigure = ''
@ -21,4 +21,4 @@ buildGhidraExtension rec {
    homepage = "https://github.com/WorksButNotTested/lightkeeper";
    license = lib.licenses.asl20;
  };
-}
+})
--- a/pkgs/tools/security/ghidra/extensions/wasm/default.nix
+++ b/pkgs/tools/security/ghidra/extensions/wasm/default.nix
@ -5,17 +5,14 @@
  ghidra,
  ant,
 }:
-let
-  version = "2.3.1";
-in
-buildGhidraExtension {
+buildGhidraExtension (finalAttrs: {
  pname = "wasm";
-  inherit version;
+  version = "2.3.1";

  src = fetchFromGitHub {
    owner = "nneonneo";
    repo = "ghidra-wasm-plugin";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
    hash = "sha256-aoSMNzv+TgydiXM4CbvAyu/YsxmdZPvpkZkYEE3C+V4=";
  };

@ -35,9 +32,9 @@ buildGhidraExtension {
  meta = {
    description = "Ghidra Wasm plugin with disassembly and decompilation support";
    homepage = "https://github.com/nneonneo/ghidra-wasm-plugin";
-    downloadPage = "https://github.com/nneonneo/ghidra-wasm-plugin/releases/tag/v${version}";
-    changelog = "https://github.com/nneonneo/ghidra-wasm-plugin/releases/tag/v${version}";
+    downloadPage = "https://github.com/nneonneo/ghidra-wasm-plugin/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/nneonneo/ghidra-wasm-plugin/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.gpl3;
    maintainers = [ lib.maintainers.BonusPlay ];
  };
-}
+})
--- a/Show More
+++ b/Show More