Merge master into staging-next

nixos/doc/manual/release-notes/rl-2511.section.md

@@ -56,6 +56,8 @@
 
 - [mautrix-discord](https://github.com/mautrix/discord), a Matrix-Discord puppeting/relay bridge. Available as [services.mautrix-discord](#opt-services.mautrix-discord.enable).
 
+- [SuiteNumérique Meet](https://github.com/suitenumerique/meet) is an open source alternative to Google Meet and Zoom powered by LiveKit: HD video calls, screen sharing, and chat features. Built with Django and React. Available as [services.lasuite-meet](#opt-services.lasuite-meet.enable).
+
 ## Backward Incompatibilities {#sec-release-25.11-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

nixos/modules/i18n/input-method/fcitx5.nix

@@ -155,8 +155,9 @@ in
       // lib.optionalAttrs (!cfg.waylandFrontend) {
         GTK_IM_MODULE = "fcitx";
         QT_IM_MODULE = "fcitx";
-      }
+      };
-      // lib.optionalAttrs cfg.ignoreUserConfig {
+
+    environment.sessionVariables = lib.mkIf cfg.ignoreUserConfig {
       SKIP_FCITX_USER_PATH = "1";
     };
   };

nixos/modules/module-list.nix

@@ -1596,6 +1596,7 @@
   ./services/web-apps/komga.nix
   ./services/web-apps/lanraragi.nix
   ./services/web-apps/lasuite-docs.nix
+  ./services/web-apps/lasuite-meet.nix
   ./services/web-apps/lemmy.nix
   ./services/web-apps/limesurvey.nix
   ./services/web-apps/mainsail.nix

nixos/modules/programs/fish.nix

@@ -293,7 +293,7 @@ in
                 ''
                   mkdir -p $out
                   if [ -d $package/share/man ]; then
-                    find $package/share/man -type f | xargs ${pkgs.python3.pythonOnBuildForHost.interpreter} ${patchedGenerator}/create_manpage_completions.py --directory $out >/dev/null
+                    find -L $package/share/man -type f | xargs ${pkgs.python3.pythonOnBuildForHost.interpreter} ${patchedGenerator}/create_manpage_completions.py --directory $out >/dev/null
                   fi
                 '';
           in

nixos/modules/programs/rust-motd.nix

@@ -150,13 +150,10 @@ in
       wantedBy = [ "timers.target" ];
       timerConfig.OnCalendar = cfg.refreshInterval;
     };
-    security.pam.services.sshd.text = lib.mkIf cfg.enableMotdInSSHD (
+
-      lib.mkDefault (
+    security.pam.services.sshd.showMotd = lib.mkIf cfg.enableMotdInSSHD true;
-        lib.mkAfter ''
+    users.motdFile = lib.mkIf cfg.enableMotdInSSHD "/var/lib/rust-motd/motd";
-          session optional ${pkgs.pam}/lib/security/pam_motd.so motd=/var/lib/rust-motd/motd
+
-        ''
-      )
-    );
     services.openssh.extraConfig =
       lib.mkIf (cfg.settings ? last_login && cfg.settings.last_login != { })
         ''

nixos/modules/services/web-apps/lasuite-meet.nix

@@ -0,0 +1,449 @@
+{
+  config,
+  lib,
+  pkgs,
+  utils,
+  ...
+}:
+let
+  inherit (lib)
+    getExe
+    mapAttrs
+    mkEnableOption
+    mkIf
+    mkPackageOption
+    mkOption
+    types
+    optional
+    optionalString
+    ;
+
+  cfg = config.services.lasuite-meet;
+
+  pythonEnvironment = mapAttrs (
+    _: value:
+    if value == null then
+      "None"
+    else if value == true then
+      "True"
+    else if value == false then
+      "False"
+    else
+      toString value
+  ) cfg.settings;
+
+  commonServiceConfig = {
+    RuntimeDirectory = "lasuite-meet";
+    StateDirectory = "lasuite-meet";
+    WorkingDirectory = "/var/lib/lasuite-meet";
+
+    User = "lasuite-meet";
+    DynamicUser = true;
+    SupplementaryGroups = mkIf cfg.redis.createLocally [
+      config.services.redis.servers.lasuite-meet.group
+    ];
+    # hardening
+    AmbientCapabilities = "";
+    CapabilityBoundingSet = [ "" ];
+    DevicePolicy = "closed";
+    LockPersonality = true;
+    NoNewPrivileges = true;
+    PrivateDevices = true;
+    PrivateTmp = true;
+    PrivateUsers = true;
+    ProcSubset = "pid";
+    ProtectClock = true;
+    ProtectControlGroups = true;
+    ProtectHome = true;
+    ProtectHostname = true;
+    ProtectKernelLogs = true;
+    ProtectKernelModules = true;
+    ProtectKernelTunables = true;
+    ProtectProc = "invisible";
+    ProtectSystem = "strict";
+    RemoveIPC = true;
+    RestrictAddressFamilies = [
+      "AF_INET"
+      "AF_INET6"
+      "AF_UNIX"
+    ];
+    RestrictNamespaces = true;
+    RestrictRealtime = true;
+    RestrictSUIDSGID = true;
+    SystemCallArchitectures = "native";
+    MemoryDenyWriteExecute = true;
+    EnvironmentFile = optional (cfg.environmentFile != null) cfg.environmentFile;
+    UMask = "0077";
+  };
+in
+{
+  options.services.lasuite-meet = {
+    enable = mkEnableOption "SuiteNumérique Meet";
+
+    backendPackage = mkPackageOption pkgs "lasuite-meet" { };
+
+    frontendPackage = mkPackageOption pkgs "lasuite-meet-frontend" { };
+
+    bind = mkOption {
+      type = types.str;
+      default = "unix:/run/lasuite-meet/gunicorn.sock";
+      example = "127.0.0.1:8000";
+      description = ''
+        The path, host/port or file descriptior to bind the gunicorn socket to.
+
+        See  <https://docs.gunicorn.org/en/stable/settings.html#bind> for possible options.
+      '';
+    };
+
+    enableNginx = mkEnableOption "enable and configure Nginx for reverse proxying" // {
+      default = true;
+    };
+
+    secretKeyPath = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = ''
+        Path to the Django secret key.
+
+        The key can be generated using:
+        ```
+        python3 -c 'import secrets; print(secrets.token_hex())'
+        ```
+
+        If not set, the secret key will be automatically generated.
+      '';
+    };
+
+    postgresql = {
+      createLocally = mkEnableOption "Configure local PostgreSQL database server for meet";
+    };
+
+    redis = {
+      createLocally = mkEnableOption "Configure local Redis cache server for meet";
+    };
+
+    livekit = {
+      enable = mkEnableOption "Configure local livekit server" // {
+        default = true;
+      };
+
+      openFirewall = mkEnableOption "Open firewall ports for livekit";
+
+      keyFile = mkOption {
+        type = lib.types.path;
+        description = ''
+          LiveKit key file holding one or multiple application secrets.
+          Use `livekit-server generate-keys` to generate a random key name and secret.
+
+          The file should have the YAML format `<keyname>: <secret>`.
+          Example:
+          `lasuite-meet: f6lQGaHtM5HfgZjIcec3cOCRfiDqIine4CpZZnqdT5cE`
+
+          Individual key/secret pairs need to be passed to clients to connect to this instance.
+        '';
+
+      };
+
+      settings = mkOption {
+        type = types.attrs;
+        default = { };
+        description = ''
+          Settings to pass to the livekit server.
+
+          See `services.livekit.settings` for more details.
+        '';
+      };
+    };
+
+    gunicorn = {
+      extraArgs = mkOption {
+        type = types.listOf types.str;
+        default = [
+          "--name=meet"
+          "--workers=3"
+        ];
+        description = ''
+          Extra arguments to pass to the gunicorn process.
+        '';
+      };
+    };
+
+    celery = {
+      extraArgs = mkOption {
+        type = types.listOf types.str;
+        default = [ ];
+        description = ''
+          Extra arguments to pass to the celery process.
+        '';
+      };
+    };
+
+    domain = mkOption {
+      type = types.str;
+      description = ''
+        Domain name of the meet instance.
+      '';
+    };
+
+    settings = mkOption {
+      type = types.submodule {
+        freeformType = types.attrsOf (
+          types.nullOr (
+            types.oneOf [
+              types.str
+              types.bool
+              types.path
+              types.int
+            ]
+          )
+        );
+
+        options = {
+          DJANGO_CONFIGURATION = mkOption {
+            type = types.str;
+            internal = true;
+            default = "Production";
+            description = "The configuration that Django will use";
+          };
+
+          DJANGO_SETTINGS_MODULE = mkOption {
+            type = types.str;
+            internal = true;
+            default = "meet.settings";
+            description = "The configuration module that Django will use";
+          };
+
+          DJANGO_SECRET_KEY_FILE = mkOption {
+            type = types.path;
+            default =
+              if cfg.secretKeyPath == null then "/var/lib/lasuite-meet/django_secret_key" else cfg.secretKeyPath;
+            description = "The path to the file containing Django's secret key";
+          };
+
+          DJANGO_DATA_DIR = mkOption {
+            type = types.path;
+            default = "/var/lib/lasuite-meet";
+            description = "Path to the data directory";
+          };
+
+          DJANGO_ALLOWED_HOSTS = mkOption {
+            type = types.str;
+            default = if cfg.enableNginx then "localhost,127.0.0.1,${cfg.domain}" else "";
+            defaultText = lib.literalExpression ''
+              if cfg.enableNginx then "localhost,127.0.0.1,$${cfg.domain}" else ""
+            '';
+            description = "Comma-separated list of hosts that are able to connect to the server";
+          };
+
+          DB_NAME = mkOption {
+            type = types.str;
+            default = "lasuite-meet";
+            description = "Name of the database";
+          };
+
+          DB_USER = mkOption {
+            type = types.str;
+            default = "lasuite-meet";
+            description = "User of the database";
+          };
+
+          DB_HOST = mkOption {
+            type = types.nullOr types.str;
+            default = if cfg.postgresql.createLocally then "/run/postgresql" else null;
+            description = "Host of the database";
+          };
+
+          REDIS_URL = mkOption {
+            type = types.nullOr types.str;
+            default =
+              if cfg.redis.createLocally then
+                "unix://${config.services.redis.servers.lasuite-meet.unixSocket}?db=0"
+              else
+                null;
+            description = "URL of the redis backend";
+          };
+
+          CELERY_BROKER_URL = mkOption {
+            type = types.nullOr types.str;
+            default =
+              if cfg.redis.createLocally then
+                "redis+socket://${config.services.redis.servers.lasuite-meet.unixSocket}?db=1"
+              else
+                null;
+            description = "URL of the redis backend for celery";
+          };
+
+          LIVEKIT_API_URL = mkOption {
+            type = types.nullOr types.str;
+            default = if cfg.enableNginx && cfg.livekit.enable then "http://${cfg.domain}/livekit" else null;
+            defaultText = lib.literalExpression ''
+              if cfg.enableNginx && cfg.livekit.enable then
+                "http://$${cfg.domain}/livekit"
+              else
+                null
+            '';
+            description = "URL to the livekit server";
+          };
+        };
+      };
+
+      default = { };
+      example = ''
+        {
+          DJANGO_ALLOWED_HOSTS = "*";
+        }
+      '';
+      description = ''
+        Configuration options of meet.
+        See https://github.com/suitenumerique/meet/blob/v${cfg.backendPackage.version}/docs/env.md
+        `REDIS_URL` and `CELERY_BROKER_URL` are set if `services.lasuite-meet.redis.createLocally` is true.
+        `DB_NAME` `DB_USER` and `DB_HOST` are set if `services.lasuite-meet.postgresql.createLocally` is true.
+      '';
+    };
+
+    environmentFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = ''
+        Path to environment file.
+
+        This can be useful to pass secrets to meet via tools like `agenix` or `sops`.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.lasuite-meet = {
+      description = "Meet from SuiteNumérique";
+      after =
+        [ "network.target" ]
+        ++ (optional cfg.postgresql.createLocally "postgresql.service")
+        ++ (optional cfg.redis.createLocally "redis-lasuite-meet.service");
+
+      wants =
+        (optional cfg.postgresql.createLocally "postgresql.service")
+        ++ (optional cfg.redis.createLocally "redis-lasuite-meet.service");
+
+      wantedBy = [ "multi-user.target" ];
+
+      preStart = ''
+        ln -sfT ${cfg.backendPackage}/share/static /var/lib/lasuite-meet/static
+
+        if [ ! -f .version ]; then
+          touch .version
+        fi
+
+        if [ "${cfg.backendPackage.version}" != "$(cat .version)" ]; then
+          ${getExe cfg.backendPackage} migrate
+          echo -n "${cfg.backendPackage.version}" > .version
+        fi
+        ${optionalString (cfg.secretKeyPath == null) ''
+          if [[ ! -f /var/lib/lasuite-meet/django_secret_key ]]; then
+            (
+              umask 0377
+              tr -dc A-Za-z0-9 < /dev/urandom | head -c64 | ${pkgs.moreutils}/bin/sponge /var/lib/lasuite-meet/django_secret_key
+            )
+          fi
+        ''}
+      '';
+
+      environment = pythonEnvironment;
+
+      serviceConfig = {
+        ExecStart = utils.escapeSystemdExecArgs (
+          [
+            (lib.getExe' cfg.backendPackage "gunicorn")
+            "--bind=${cfg.bind}"
+          ]
+          ++ cfg.gunicorn.extraArgs
+          ++ [ "meet.wsgi:application" ]
+        );
+      } // commonServiceConfig;
+    };
+
+    systemd.services.lasuite-meet-celery = {
+      description = "Meet Celery broker from SuiteNumérique";
+      after =
+        [ "network.target" ]
+        ++ (optional cfg.postgresql.createLocally "postgresql.service")
+        ++ (optional cfg.redis.createLocally "redis-lasuite-meet.service");
+
+      wants =
+        (optional cfg.postgresql.createLocally "postgresql.service")
+        ++ (optional cfg.redis.createLocally "redis-lasuite-meet.service");
+
+      wantedBy = [ "multi-user.target" ];
+
+      environment = pythonEnvironment;
+
+      serviceConfig = {
+        ExecStart = utils.escapeSystemdExecArgs (
+          [ (lib.getExe' cfg.backendPackage "celery") ]
+          ++ cfg.celery.extraArgs
+          ++ [
+            "--app=meet.celery_app"
+            "worker"
+          ]
+        );
+      } // commonServiceConfig;
+    };
+
+    services.postgresql = mkIf cfg.postgresql.createLocally {
+      enable = true;
+      ensureDatabases = [ "lasuite-meet" ];
+      ensureUsers = [
+        {
+          name = "lasuite-meet";
+          ensureDBOwnership = true;
+        }
+      ];
+    };
+
+    services.redis.servers.lasuite-meet = mkIf cfg.redis.createLocally { enable = true; };
+
+    services.livekit = mkIf cfg.livekit.enable {
+      inherit (cfg.livekit)
+        enable
+        settings
+        keyFile
+        openFirewall
+        ;
+    };
+
+    services.nginx = mkIf cfg.enableNginx {
+      enable = true;
+
+      virtualHosts.${cfg.domain} = {
+        root = cfg.frontendPackage;
+
+        extraConfig = ''
+          error_page 404 = /index.html;
+        '';
+
+        locations."/api" = {
+          proxyPass = "http://${cfg.bind}";
+          recommendedProxySettings = true;
+        };
+
+        locations."/admin" = {
+          proxyPass = "http://${cfg.bind}";
+          recommendedProxySettings = true;
+        };
+
+        locations."/livekit" = mkIf cfg.livekit.enable {
+          proxyPass = "http://localhost:${toString config.services.livekit.settings.port}";
+          recommendedProxySettings = true;
+          proxyWebsockets = true;
+          extraConfig = ''
+            rewrite ^/livekit/(.*)$ /$1 break;
+          '';
+        };
+      };
+    };
+  };
+
+  meta = {
+    buildDocsInSandbox = false;
+    maintainers = [ lib.maintainers.soyouzpanda ];
+  };
+}

nixos/modules/services/web-apps/nextcloud-notify_push.nix

@@ -164,7 +164,7 @@ in
         nginx.virtualHosts.${cfgN.hostName}.locations."^~ /push/" = {
           proxyPass = "http://unix:${cfg.socketPath}";
           proxyWebsockets = true;
-          recommendedProxySettings = true;
+          recommendedProxySettings = lib.mkDefault true;
           extraConfig = # nginx
             ''
               # disable in case it was configured on a higher level

nixos/modules/services/web-apps/nextcloud.nix

@@ -577,11 +577,14 @@ in
 
     config = {
       dbtype = mkOption {
-        type = types.enum [
+        type = types.nullOr (
+          types.enum [
             "sqlite"
             "pgsql"
             "mysql"
-        ];
+          ]
+        );
+        default = null;
         description = "Database type.";
       };
       dbname = mkOption {
@@ -1086,6 +1089,17 @@ in
             instead of password.
           '';
         }
+        {
+          assertion = cfg.config.dbtype != null;
+          message = ''
+            `services.nextcloud.config.dbtype` must be set explicitly (pgsql, mysql, or sqlite)
+
+            Before 25.05, it used to default to sqlite but that is not recommended by upstream.
+            Either set it to sqlite as it used to be, or convert to another type as described
+            in the official db conversion page:
+            https://docs.nextcloud.com/server/latest/admin_manual/configuration_database/db_conversion.html
+          '';
+        }
       ];
     }
 

nixos/tests/all-tests.nix

@@ -771,6 +771,7 @@ in
     _module.args.latestKernel = true;
   };
   lasuite-docs = runTest ./web-apps/lasuite-docs.nix;
+  lasuite-meet = runTest ./web-apps/lasuite-meet.nix;
   lavalink = runTest ./lavalink.nix;
   leaps = runTest ./leaps.nix;
   lemmy = runTest ./lemmy.nix;

nixos/tests/web-apps/lasuite-meet.nix

@@ -0,0 +1,141 @@
+{ lib, ... }:
+let
+  domain = "meet.local";
+  oidcDomain = "127.0.0.1:8080";
+in
+
+{
+  name = "lasuite-meet";
+  meta.maintainers = with lib.maintainers; [ soyouzpanda ];
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      virtualisation.memorySize = 4 * 1024;
+
+      networking.hosts."127.0.0.1" = [ domain ];
+
+      environment.systemPackages = with pkgs; [ jq ];
+
+      services.lasuite-meet = {
+        enable = true;
+        enableNginx = true;
+        livekit = {
+          enable = true;
+          keyFile = pkgs.writeText "lasuite-meet-livekit-keys" ''
+            lasuite-meet: ca50qKzxEXVIu61wHshAyJNzlWw8vlIwUuzxQbUK1rG
+          '';
+        };
+        redis.createLocally = true;
+        postgresql.createLocally = true;
+
+        inherit domain;
+
+        settings = {
+          DJANGO_SECRET_KEY_FILE = pkgs.writeText "django-secret-file" ''
+            8540db59c03943d48c3ed1a0f96ce3b560e0f45274f120f7ee4dace3cc366a6b
+          '';
+
+          OIDC_OP_JWKS_ENDPOINT = "http://${oidcDomain}/dex/keys";
+          OIDC_OP_AUTHORIZATION_ENDPOINT = "http://${oidcDomain}/dex/auth/mock";
+          OIDC_OP_TOKEN_ENDPOINT = "http://${oidcDomain}/dex/token";
+          OIDC_OP_USER_ENDPOINT = "http://${oidcDomain}/dex/userinfo";
+          OIDC_RP_CLIENT_ID = "lasuite-meet";
+          OIDC_RP_SIGN_ALGO = "RS256";
+          OIDC_RP_SCOPES = "openid email";
+          OIDC_RP_CLIENT_SECRET = "lasuitemeetclientsecret";
+
+          LOGIN_REDIRECT_URL = "http://${domain}";
+          LOGIN_REDIRECT_URL_FAILURE = "http://${domain}";
+          LOGOUT_REDIRECT_URL = "http://${domain}";
+
+          LIVEKIT_API_KEY = "lasuite-meet";
+          LIVEKIT_API_SECRET = "ca50qKzxEXVIu61wHshAyJNzlWw8vlIwUuzxQbUK1rG";
+
+          # Disable HTTPS feature in tests because we're running on a HTTP connection
+          DJANGO_SECURE_PROXY_SSL_HEADER = "";
+          DJANGO_SECURE_SSL_REDIRECT = false;
+          DJANGO_CSRF_COOKIE_SECURE = false;
+          DJANGO_SESSION_COOKIE_SECURE = false;
+          DJANGO_CSRF_TRUSTED_ORIGINS = "http://*";
+        };
+      };
+
+      services.dex = {
+        enable = true;
+        settings = {
+          issuer = "http://${oidcDomain}/dex";
+          storage = {
+            type = "postgres";
+            config.host = "/var/run/postgresql";
+          };
+          web.http = "127.0.0.1:8080";
+          oauth2.skipApprovalScreen = true;
+          staticClients = [
+            {
+              id = "lasuite-meet";
+              name = "Meet";
+              redirectURIs = [ "http://${domain}/api/v1.0/callback/" ];
+              secretFile = "/etc/dex/lasuite-meet";
+            }
+          ];
+          connectors = [
+            {
+              type = "mockPassword";
+              id = "mock";
+              name = "Example";
+              config = {
+                username = "admin";
+                password = "password";
+              };
+            }
+          ];
+        };
+      };
+
+      environment.etc."dex/lasuite-meet" = {
+        mode = "0400";
+        user = "dex";
+        text = "lasuitemeetclientsecret";
+      };
+
+      services.postgresql = {
+        enable = true;
+        ensureDatabases = [ "dex" ];
+        ensureUsers = [
+          {
+            name = "dex";
+            ensureDBOwnership = true;
+          }
+        ];
+      };
+    };
+
+  testScript = ''
+    with subtest("Wait for units to start"):
+      machine.wait_for_unit("dex.service")
+      machine.wait_for_unit("lasuite-meet.service")
+      machine.wait_for_unit("lasuite-meet-celery.service")
+
+    with subtest("Wait for web servers to start"):
+      machine.wait_until_succeeds("curl -fs 'http://${domain}/api/v1.0/authenticate/'", timeout=120)
+      machine.wait_until_succeeds("curl -fs '${oidcDomain}/dex/auth/mock?client_id=lasuite-meet&response_type=code&redirect_uri=http://${domain}/api/v1.0/callback/&scope=openid'", timeout=120)
+
+    with subtest("Login"):
+      state, nonce = machine.succeed("curl -fs -c cjar 'http://${domain}/api/v1.0/authenticate/' -w '%{redirect_url}' | sed -n 's/.*state=\\(.*\\)&nonce=\\(.*\\)/\\1 \\2/p'").strip().split(' ')
+
+      oidc_state = machine.succeed(f"curl -fs '${oidcDomain}/dex/auth/mock?client_id=lasuite-meet&response_type=code&redirect_uri=http://${domain}/api/v1.0/callback/&scope=openid+email&state={state}&nonce={nonce}' | sed -n 's/.*state=\\(.*\\)\">.*/\\1/p'").strip()
+
+      code = machine.succeed(f"curl -fs '${oidcDomain}/dex/auth/mock/login?back=&state={oidc_state}' -d 'login=admin&password=password' -w '%{{redirect_url}}' | sed -n 's/.*code=\\(.*\\)&.*/\\1/p'").strip()
+      print(f"Got approval code {code}")
+
+      machine.succeed(f"curl -fs -c cjar -b cjar 'http://${domain}/api/v1.0/callback/?code={code}&state={state}'")
+
+    with subtest("Create a room"):
+      csrf_token = machine.succeed("grep csrftoken cjar | cut -f 7 | tr -d '\n'")
+
+      room_id = machine.succeed(f"curl -fs -c cjar -b cjar 'http://${domain}/api/v1.0/rooms/' -X POST -H 'Content-Type: application/json' -H 'X-CSRFToken: {csrf_token}' -H 'Referer: http://${domain}' -d '{{\"name\": \"aaa-bbbb-ccc\"}}' | jq .id -r").strip()
+
+      print(f"Created room with id {room_id}")
+  '';
+}

pkgs/applications/emulators/libretro/cores/mupen64plus.nix

@@ -12,13 +12,13 @@
 }:
 mkLibretroCore {
   core = "mupen64plus-next";
-  version = "0-unstable-2025-06-04";
+  version = "0-unstable-2025-07-01";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "mupen64plus-libretro-nx";
-    rev = "0346d3ef26016bb4de604cf918d004bd791447ee";
+    rev = "1b693cdac7c42979f6ef53ffe260a76454f0cf45";
-    hash = "sha256-DV6X94BHr97S1jW3zNUDx6w35JcEnSFNgv6fCi2amek=";
+    hash = "sha256-hano/fv7LcinEOYfwwzhn+gXTsB8hDav0KQw5XkmXmY=";
   };
 
   # Fix for GCC 14

pkgs/applications/kde/default.nix

@@ -108,7 +108,6 @@ let
       grantleetheme = callPackage ./grantleetheme { };
       gwenview = callPackage ./gwenview { };
       incidenceeditor = callPackage ./incidenceeditor.nix { };
-      itinerary = callPackage ./itinerary.nix { };
       juk = callPackage ./juk.nix { };
       kaccounts-integration = callPackage ./kaccounts-integration.nix { };
       kaccounts-providers = callPackage ./kaccounts-providers.nix { };
@@ -271,7 +270,6 @@ let
       krecorder = callPackage ./krecorder.nix { };
       ktrip = callPackage ./ktrip.nix { };
       kweather = callPackage ./kweather.nix { };
-      neochat = callPackage ./neochat.nix { };
       plasmatube = callPackage ./plasmatube { };
       qmlkonsole = callPackage ./qmlkonsole.nix { };
       telly-skout = callPackage ./telly-skout.nix { };

pkgs/applications/kde/itinerary.nix

@@ -1,73 +0,0 @@
-{
-  mkDerivation,
-  lib,
-  extra-cmake-modules,
-  karchive,
-  kcalendarcore,
-  kcontacts,
-  kdbusaddons,
-  kfilemetadata,
-  kholidays,
-  kio,
-  kirigami-addons,
-  kitemmodels,
-  kitinerary,
-  kmime,
-  knotifications,
-  kosmindoormap,
-  kpkpass,
-  kpublictransport,
-  kunitconversion,
-  libquotient,
-  networkmanager-qt,
-  prison,
-  qqc2-desktop-style,
-  qtpositioning,
-  qtquickcontrols2,
-  shared-mime-info,
-}:
-
-mkDerivation {
-  pname = "itinerary";
-  outputs = [
-    "out"
-    "dev"
-  ];
-
-  nativeBuildInputs = [
-    extra-cmake-modules
-    shared-mime-info # for update-mime-database
-  ];
-
-  buildInputs = [
-    karchive
-    kcalendarcore
-    kcontacts
-    kdbusaddons
-    kfilemetadata
-    kholidays
-    kio
-    kirigami-addons
-    kitemmodels
-    kitinerary
-    kmime
-    knotifications
-    kosmindoormap
-    kpkpass
-    kpublictransport
-    kunitconversion
-    libquotient
-    networkmanager-qt
-    prison
-    qqc2-desktop-style
-    qtpositioning
-    qtquickcontrols2
-  ];
-
-  meta.license = with lib.licenses; [
-    asl20
-    bsd3
-    cc0
-    lgpl2Plus
-  ];
-}

pkgs/applications/kde/neochat.nix

@@ -1,77 +0,0 @@
-{
-  mkDerivation,
-  lib,
-
-  cmake,
-  extra-cmake-modules,
-  pkg-config,
-  wrapQtAppsHook,
-
-  cmark,
-  kconfig,
-  kdbusaddons,
-  ki18n,
-  kio,
-  kirigami-addons,
-  kirigami2,
-  kitemmodels,
-  knotifications,
-  kquickcharts,
-  kquickimageedit,
-  libpulseaudio,
-  libquotient,
-  libsecret,
-  olm,
-  qcoro,
-  qqc2-desktop-style,
-  qtgraphicaleffects,
-  qtlocation,
-  qtmultimedia,
-  qtquickcontrols2,
-  sonnet,
-}:
-
-mkDerivation {
-  pname = "neochat";
-
-  nativeBuildInputs = [
-    cmake
-    extra-cmake-modules
-    pkg-config
-    wrapQtAppsHook
-  ];
-
-  buildInputs = [
-    cmark
-    kconfig
-    kdbusaddons
-    kio
-    ki18n
-    kirigami-addons
-    kirigami2
-    kitemmodels
-    knotifications
-    kquickcharts
-    kquickimageedit
-    libpulseaudio
-    libquotient
-    libsecret
-    olm
-    qcoro
-    qtgraphicaleffects
-    qtlocation
-    qtmultimedia
-    qtquickcontrols2
-    qqc2-desktop-style
-    sonnet
-  ];
-
-  meta = with lib; {
-    description = "Client for matrix, the decentralized communication protocol";
-    mainProgram = "neochat";
-    homepage = "https://apps.kde.org/en/neochat";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ peterhoeg ];
-    platforms = with platforms; linux;
-  };
-}

pkgs/applications/kde/srcs.nix

@@ -331,14 +331,6 @@
       name = "incidenceeditor-23.08.5.tar.xz";
     };
   };
-  itinerary = {
-    version = "23.08.5";
-    src = fetchurl {
-      url = "${mirror}/stable/release-service/23.08.5/src/itinerary-23.08.5.tar.xz";
-      sha256 = "19r7k64a4dalarxm7j2jf2p86cnxqxah0iqj68ibazhl1sdqrqs2";
-      name = "itinerary-23.08.5.tar.xz";
-    };
-  };
   juk = {
     version = "23.08.5";
     src = fetchurl {
@@ -1747,14 +1739,6 @@
       name = "minuet-23.08.5.tar.xz";
     };
   };
-  neochat = {
-    version = "23.08.5";
-    src = fetchurl {
-      url = "${mirror}/stable/release-service/23.08.5/src/neochat-23.08.5.tar.xz";
-      sha256 = "0cj6j08g5ng1vifpb49rks9kp4mfb3h466n6afw9dk0xxgccc06k";
-      name = "neochat-23.08.5.tar.xz";
-    };
-  };
   okular = {
     version = "23.08.5";
     src = fetchurl {

pkgs/applications/plasma-mobile/srcs.nix

@@ -115,14 +115,6 @@
       name = "kweather-23.01.0.tar.xz";
     };
   };
-  neochat = {
-    version = "23.01.0";
-    src = fetchurl {
-      url = "${mirror}/stable/plasma-mobile/23.01.0/neochat-23.01.0.tar.xz";
-      sha256 = "0pkas8whwy1ih4sx9vaa7k55iiiy955dh4d53i4l1d0sjdf8pysd";
-      name = "neochat-23.01.0.tar.xz";
-    };
-  };
   plasma-dialer = {
     version = "23.01.0";
     src = fetchurl {

pkgs/by-name/am/amazon-q-cli/package.nix

@@ -7,13 +7,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "amazon-q-cli";
-  version = "1.12.1";
+  version = "1.12.2";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "amazon-q-developer-cli-autocomplete";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-oY2hDOsws2WVQPKEFhGNPHITo26p/UZ5XzvRX7DoMyc=";
+    hash = "sha256-TIKG1nzpmjiHE+EjTJR+/GklQNJQeUzmDXaPEiRT80Y=";
   };
 
   nativeBuildInputs = [
@@ -22,7 +22,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   useFetchCargoVendor = true;
 
-  cargoHash = "sha256-xriK88OY6W1cOZVgiUPBIuItVHwEyFNq5Ywh367K6CU=";
+  cargoHash = "sha256-lJbHPqQ3eybo03oZY2VyKlsxcTdbdrc8q8AjV+IahEY=";
 
   cargoBuildFlags = [
     "-p"

pkgs/by-name/ar/arjun/package.nix

@@ -6,32 +6,28 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "arjun";
-  version = "2.2.2";
+  version = "2.2.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "s0md3v";
     repo = "Arjun";
     tag = version;
-    hash = "sha256-odVUFs517RSp66MymniSeTKTntQtXomjC68Hhdsglf0=";
+    hash = "sha256-XEfCQEvRCvmNQ8yOlaR0nd7knhK1fQIrXEfQgrdVDrs=";
   };
 
-  nativeBuildInputs = with python3.pkgs; [
+  build-system = with python3.pkgs; [ setuptools ];
-    setuptools
-    wheel
-  ];
 
-  propagatedBuildInputs = with python3.pkgs; [
+  dependencies = with python3.pkgs; [
-    requests
     dicttoxml
+    ratelimit
+    requests
   ];
 
   # Project has no tests
   doCheck = false;
 
-  pythonImportsCheck = [
+  pythonImportsCheck = [ "arjun" ];
-    "arjun"
-  ];
 
   meta = {
     description = "HTTP parameter discovery suite";

pkgs/by-name/ar/arping/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "arping";
-  version = "2.25";
+  version = "2.26";
 
   src = fetchFromGitHub {
     owner = "ThomasHabets";
     repo = "arping";
     rev = "arping-${version}";
-    hash = "sha256-SAdbgPmApmFToYrAm8acUapZMEMQr5MO7bQOTO2hd2c=";
+    hash = "sha256-uZsUo12ez6sz95fmOg5cmVBJNRH3eEhio8V2efQ29BU=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ba/bandwhich/package.nix

@@ -23,8 +23,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  # 10 passed; 47 failed https://hydra.nixos.org/build/148943783/nixlog/1
+  __darwinAllowLocalNetworking = true;
-  doCheck = !stdenv.hostPlatform.isDarwin;
 
   preConfigure = ''
     export BANDWHICH_GEN_DIR=_shell-files

pkgs/by-name/bi/binaryninja-free/package.nix

@@ -16,6 +16,7 @@
   xcbutilkeysyms,
   xcbutilrenderutil,
   xcbutilwm,
+  libxml2,
 }:
 stdenv.mkDerivation rec {
   pname = "binaryninja-free";
@@ -66,6 +67,12 @@ stdenv.mkDerivation rec {
     xcbutilwm
   ];
 
+  preFixup = ''
+    # Fix libxml2 breakage. See https://github.com/NixOS/nixpkgs/pull/396195#issuecomment-2881757108
+    mkdir -p "$out/lib"
+    ln -s "${lib.getLib libxml2}/lib/libxml2.so" "$out/lib/libxml2.so.2"
+  '';
+
   installPhase = ''
     runHook preInstall
     mkdir -p $out/

pkgs/by-name/cc/cctz/package.nix

@@ -15,6 +15,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-YCE0DXuOT5tCOfLlemMH7I2F8c7HEK1NEUJvtfqnCg8=";
   };
 
+  env.NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-framework CoreFoundation";
+
   makeFlags = [ "PREFIX=$(out)" ];
 
   installTargets =

pkgs/by-name/ce/certspotter/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "certspotter";
-  version = "0.20.0";
+  version = "0.21.0";
 
   src = fetchFromGitHub {
     owner = "SSLMate";
     repo = "certspotter";
     rev = "v${version}";
-    hash = "sha256-CX0YchfX6EwIjH+m1FEHqfuXurg51JC4l+97BgXYXJg=";
+    hash = "sha256-cJIjJyWvy/prx97jUvVToJsEdMa0MpqATD9rO8G2biY=";
   };
 
-  vendorHash = "sha256-+6Gu3y708XXX7CHvZmEh7j3ILNBi/++8Mud34mOrtmA=";
+  vendorHash = "sha256-CLq/QFnZ5OLv7wT+VYr5SkSgmwt1g6cBYcAlB4Z/3wE=";
 
   ldflags = [
     "-s"

pkgs/by-name/ch/chatbox/package.nix

@@ -6,11 +6,11 @@
 }:
 let
   pname = "chatbox";
-  version = "1.14.1";
+  version = "1.14.3";
 
   src = fetchurl {
     url = "https://download.chatboxai.app/releases/Chatbox-${version}-x86_64.AppImage";
-    hash = "sha256-2k2G6VMO83ztuknr4FRE0eUtsweV0eu9JSNgKaVuatQ=";
+    hash = "sha256-Qsf58SQANBic3LHY52vzCHO9W74cdP0EWtHB2uL45R0=";
   };
 
   appimageContents = appimageTools.extract { inherit pname version src; };

pkgs/by-name/ci/cilium-cli/package.nix

@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "cilium-cli";
-  version = "0.18.4";
+  version = "0.18.5";
 
   src = fetchFromGitHub {
     owner = "cilium";
     repo = "cilium-cli";
     tag = "v${version}";
-    hash = "sha256-S+LtNIbtZVxk77eySYYZqr+Bicibl7vLo0nqkxUpkME=";
+    hash = "sha256-2lmf0bKmlNt+axgwiNPKcaq08Bf/88sp3JEkS8dkP7M=";
   };
 
   nativeBuildInputs = [ installShellFiles ];

pkgs/by-name/cl/clickhouse/package.nix

@@ -21,7 +21,7 @@
 
 llvmPackages_19.stdenv.mkDerivation (finalAttrs: {
   pname = "clickhouse";
-  version = "25.3.4.190";
+  version = "25.3.5.42";
 
   src = fetchFromGitHub rec {
     owner = "ClickHouse";
@@ -29,7 +29,7 @@ llvmPackages_19.stdenv.mkDerivation (finalAttrs: {
     tag = "v${finalAttrs.version}-lts";
     fetchSubmodules = true;
     name = "clickhouse-${tag}.tar.gz";
-    hash = "sha256-8KH0mziVlayu9g4EwW+hpSV97P72CYDKwGCZ5ycDUwE=";
+    hash = "sha256-LvGl9XJK6Emt7HnV/Orp7qEmJSr3TBJZtApL6GrWIMg=";
     postFetch = ''
       # delete files that make the source too big
       rm -rf $out/contrib/llvm-project/llvm/test

pkgs/by-name/cl/clusterlint/package.nix

@@ -0,0 +1,37 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "clusterlint";
+  version = "0.12.0";
+
+  src = fetchFromGitHub {
+    owner = "digitalocean";
+    repo = "clusterlint";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-R6Dm7raIYxpulVtadU5AsSwCd5waOBOJRdD3o2vgGM4=";
+  };
+
+  vendorHash = null;
+
+  ldflags = [ "-X main.Version=${finalAttrs.version}" ];
+
+  # One subpackage fails to build
+  excludedPackages = [ "example-plugin" ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  meta = {
+    description = "Best practices checker for Kubernetes clusters";
+    homepage = "https://github.com/digitalocean/clusterlint";
+    changelog = "https://github.com/digitalocean/clusterlint/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ jherland ];
+    mainProgram = "clusterlint";
+  };
+})

pkgs/by-name/cn/cnquery/package.nix

@@ -6,18 +6,18 @@
 
 buildGoModule rec {
   pname = "cnquery";
-  version = "11.59.0";
+  version = "11.60.0";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnquery";
     tag = "v${version}";
-    hash = "sha256-xSHIKy9kQrbDhLuTfJd1yDAt/Z7mqYNv4XT6fQZftho=";
+    hash = "sha256-Vu7UfTinjuyc49Kb5GW8uXrP5/bszGt9ktxilGDqY0M=";
   };
 
   subPackages = [ "apps/cnquery" ];
 
-  vendorHash = "sha256-NGrDYN7+JozAmtysSBUcKPiQwKs/fUiQkUVEGrmTTCk=";
+  vendorHash = "sha256-5vNLaOG4vYgetiQLRIzFkrlFgH6Dwa/VHCv0HWWow30=";
 
   ldflags = [
     "-w"

pkgs/by-name/db/dbeaver-bin/package.nix

@@ -55,17 +55,28 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   dontConfigure = true;
   dontBuild = true;
 
-  prePatch = ''
+  prePatch =
+    ''
       substituteInPlace ${lib.optionalString stdenvNoCC.hostPlatform.isDarwin "Contents/Eclipse/"}dbeaver.ini \
         --replace-fail '-Xmx1024m' '-Xmx${override_xmx}'
+    ''
+    # remove the bundled JRE configuration on Darwin
+    # dont use substituteInPlace here because it would match "-vmargs"
+    + lib.optionalString stdenvNoCC.hostPlatform.isDarwin ''
+      sed -i -e '/^-vm$/ { N; d; }' Contents/Eclipse/dbeaver.ini
     '';
 
-  preInstall = ''
+  preInstall =
+    ''
       # most directories are for different architectures, only keep what we need
       shopt -s extglob
       pushd ${lib.optionalString stdenvNoCC.hostPlatform.isDarwin "Contents/Eclipse/"}plugins/com.sun.jna_*/com/sun/jna/
       rm -r !(ptr|internal|linux-x86-64|linux-aarch64|darwin-x86-64|darwin-aarch64)/
       popd
+    ''
+    # remove the bundled JRE on Darwin
+    + lib.optionalString stdenvNoCC.hostPlatform.isDarwin ''
+      rm -r Contents/Eclipse/jre/
     '';
 
   installPhase =

pkgs/by-name/de/densify/package.nix

@@ -8,6 +8,7 @@
   xorg,
   gnugrep,
   ghostscript,
+  libnotify,
 }:
 
 python3Packages.buildPythonApplication rec {
@@ -44,6 +45,7 @@ python3Packages.buildPythonApplication rec {
           ghostscript
           gnugrep
           xorg.xrandr
+          libnotify
         ]
       }"
     )

pkgs/by-name/do/dotbot/package.nix

@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "dotbot";
-  version = "1.21.0";
+  version = "1.22.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "anishathalye";
     repo = "dotbot";
     tag = "v${version}";
-    hash = "sha256-f+ykGXcQ1hLptGElQ5ZTt8z0SXnlTbdcf922AVF78bU=";
+    hash = "sha256-3U8lIsqy95Ulxa5f2hHGFmuAqQ7WZtikvgaplX6GTF0=";
   };
 
   preCheck = ''
@@ -37,7 +37,7 @@ python3Packages.buildPythonApplication rec {
       dotfiles.
     '';
     homepage = "https://github.com/anishathalye/dotbot";
-    changelog = "https://github.com/anishathalye/dotbot/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/anishathalye/dotbot/blob/${src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ ludat ];
   };

pkgs/by-name/ec/ecapture/package.nix

@@ -1,7 +1,6 @@
 {
   buildGoModule,
   fetchFromGitHub,
-  stdenv,
   bpftools,
   lib,
   nspr,
@@ -18,6 +17,9 @@
   bash,
   zsh,
   nix-update-script,
+  llvmPackages,
+  withNonBTF ? false,
+  kernel ? null,
 }:
 
 buildGoModule rec {
@@ -33,6 +35,7 @@ buildGoModule rec {
   };
 
   nativeBuildInputs = [
+    llvmPackages.libllvm
     clang
     fd
     bpftools
@@ -94,13 +97,20 @@ buildGoModule rec {
       --replace-fail '"errors"' ' '
   '';
 
-  postConfigure = ''
+  postConfigure =
+    ''
       sed -i '/git/d' Makefile
       sed -i '/git/d' variables.mk
 
       substituteInPlace Makefile \
         --replace-fail '/bin/bash' '${lib.getExe bash}'
-
+    ''
+    + lib.optionalString withNonBTF ''
+      substituteInPlace variables.mk \
+        --replace-fail "-emit-llvm" "-emit-llvm -I${kernel.dev}/lib/modules/${kernel.modDirVersion}/build/include -Wno-error=implicit-function-declaration"
+      KERN_BUILD_PATH=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build KERN_SRC_PATH=${kernel.dev}/lib/modules/${kernel.modDirVersion}/source make ebpf_noncore
+    ''
+    + ''
       make ebpf
       go-bindata -pkg assets -o "assets/ebpf_probe.go" $(find user/bytecode -name "*.o" -printf "./%p ")
     '';

pkgs/by-name/fa/fastfetch/package.nix

@@ -59,13 +59,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "fastfetch";
-  version = "2.46.0";
+  version = "2.47.0";
 
   src = fetchFromGitHub {
     owner = "fastfetch-cli";
     repo = "fastfetch";
     tag = finalAttrs.version;
-    hash = "sha256-gRDG3lbUcApUushUPCpTkzc6FOB/CHrsVZwdRn6IEL8=";
+    hash = "sha256-xe86u40zW1+2O4s6e64HlpxiaLIRpjgKLPNnSEGlioQ=";
   };
 
   outputs = [

pkgs/by-name/fu/fusee-launcher/package.nix

@@ -1,60 +0,0 @@
-{
-  lib,
-  stdenv,
-  python3Packages,
-  python3,
-  fetchFromGitHub,
-  pkgsCross,
-  makeWrapper,
-}:
-
-let
-  arm-embedded-cc = pkgsCross.arm-embedded.buildPackages.gcc;
-in
-
-stdenv.mkDerivation {
-  pname = "fusee-launcher";
-  version = "unstable-2018-07-14";
-
-  src = fetchFromGitHub {
-    owner = "Cease-and-DeSwitch";
-    repo = "fusee-launcher";
-    rev = "265e8f3e1987751ec41db6f1946d132b296aba43";
-    sha256 = "1pqkgw5bk0xcz9x7pc1f0r0b9nsc8jnnvcs1315d8ml8mx23fshm";
-  };
-
-  makeFlags = [
-    "CROSS_COMPILE=${arm-embedded-cc.targetPrefix}"
-  ];
-
-  installPhase = ''
-    mkdir -p $out/bin $out/share
-    cp fusee-launcher.py $out/bin/fusee-launcher
-    cp intermezzo.bin $out/share/intermezzo.bin
-
-    # Wrap with path to intermezzo.bin relocator binary in /share
-    wrapProgram $out/bin/fusee-launcher \
-      --add-flags "--relocator $out/share/intermezzo.bin" \
-      --prefix PYTHONPATH : "$PYTHONPATH:$(toPythonPath $out)"
-  '';
-
-  nativeBuildInputs = [
-    arm-embedded-cc
-    makeWrapper
-    python3Packages.wrapPython
-  ];
-  buildInputs = [
-    python3
-    python3Packages.pyusb
-  ];
-  pythonPath = with python3Packages; [ pyusb ];
-
-  meta = with lib; {
-    homepage = "https://github.com/Cease-and-DeSwitch/fusee-launcher";
-    description = "Work-in-progress launcher for one of the Tegra X1 bootROM exploits";
-    mainProgram = "fusee-launcher";
-    license = licenses.gpl2;
-    maintainers = with maintainers; [ pneumaticat ];
-  };
-
-}

pkgs/by-name/gh/gh-poi/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "gh-poi";
-  version = "0.13.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "seachicken";
     repo = "gh-poi";
     rev = "v${version}";
-    hash = "sha256-foUv6+QIfPlYwgTwxFvEgGeOw/mpC80+ntHo29LQbB8=";
+    hash = "sha256-bbmNzxGRg7nKfB8xu90ZkKrhWwY24G6h8TW07f9IpTY=";
   };
 
   ldflags = [
@@ -20,10 +20,10 @@ buildGoModule rec {
     "-w"
   ];
 
-  vendorHash = "sha256-D/YZLwwGJWCekq9mpfCECzJyJ/xSlg7fC6leJh+e8i0=";
+  vendorHash = "sha256-ciOJpVqSPJJLX/sqrztqB3YSoMUrEnn52gGddE80rV0=";
 
   # Skip checks because some of test suites require fixture.
-  # See: https://github.com/seachicken/gh-poi/blob/v0.13.0/.github/workflows/contract-test.yml#L28-L29
+  # See: https://github.com/seachicken/gh-poi/blob/v0.14.0/.github/workflows/contract-test.yml#L28-L29
   doCheck = false;
 
   meta = with lib; {

pkgs/by-name/go/go-errorlint/package.nix

@@ -2,6 +2,7 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  nix-update-script,
 }:
 
 buildGoModule rec {
@@ -22,12 +23,16 @@ buildGoModule rec {
     "-w"
   ];
 
+  passthru.updateScript = nix-update-script { };
   meta = with lib; {
     description = "Source code linter that can be used to find code that will cause problems with Go's error wrapping scheme";
     homepage = "https://github.com/polyfloyd/go-errorlint";
     changelog = "https://github.com/polyfloyd/go-errorlint/blob/${src.rev}/CHANGELOG.md";
     license = licenses.mit;
-    maintainers = with maintainers; [ meain ];
+    maintainers = with maintainers; [
+      meain
+      polyfloyd
+    ];
     mainProgram = "go-errorlint";
   };
 }

pkgs/by-name/ho/home-manager/package.nix

@@ -19,14 +19,14 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "home-manager";
-  version = "0-unstable-2025-06-22";
+  version = "0-unstable-2025-07-02";
 
   src = fetchFromGitHub {
     name = "home-manager-source";
     owner = "nix-community";
     repo = "home-manager";
-    rev = "7c35504839f915abec86a96435b881ead7eb6a2b";
+    rev = "89af52d9a893af013f5f4c1d2d56912106827153";
-    hash = "sha256-6WH0aRFay79r775RuTqUcnoZNm6A4uHxU1sbcNIk63s=";
+    hash = "sha256-ENTd/sd4Vz/VJYn14SVqW1OH2m7WIAvsm9A9SrmDZRY=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/hu/hut/package.nix

@@ -5,15 +5,15 @@
   scdoc,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "hut";
   version = "0.7.0";
 
   src = fetchFromSourcehut {
     owner = "~xenrox";
     repo = "hut";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-pc6E3ORDmaMhoNe8GQeYZrxhe5ySQqsMPe/iUbclnGk=";
+    hash = "sha256-pc6E3ORDmaMhoNe8GQeYZrxhe5ySQqsMPe/iUbclnGk=";
   };
 
   vendorHash = "sha256-/51cv/EvcBCyCOf91vJ5M75p0bkAQqVoRUp+C+i70Os=";
@@ -24,6 +24,11 @@ buildGoModule rec {
 
   makeFlags = [ "PREFIX=$(out)" ];
 
+  ldflags = [
+    # Recommended in 0.7.0 release notes https://git.sr.ht/~xenrox/hut/refs/v0.7.0
+    "-X main.version=v${finalAttrs.version}"
+  ];
+
   postBuild = ''
     make $makeFlags completions doc/hut.1
   '';
@@ -32,11 +37,11 @@ buildGoModule rec {
     make $makeFlags install
   '';
 
-  meta = with lib; {
+  meta = {
     homepage = "https://sr.ht/~xenrox/hut/";
     description = "CLI tool for Sourcehut / sr.ht";
-    license = licenses.agpl3Only;
+    license = lib.licenses.agpl3Only;
-    maintainers = with maintainers; [ fgaz ];
+    maintainers = with lib.maintainers; [ fgaz ];
     mainProgram = "hut";
   };
-}
+})

pkgs/by-name/ju/junicode/package.nix

@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "junicode";
-  version = "2.209";
+  version = "2.211";
 
   src = fetchzip {
     url = "https://github.com/psb1558/Junicode-font/releases/download/v${version}/Junicode_${version}.zip";
-    hash = "sha256-hdCDLwTiyE2ZpFgmYAX7YWCujUwozIozD+k/lCStJUg=";
+    hash = "sha256-ZFJqNIsuWVph3U73lbcXVKXgzt+5cPxetvcAAzt0jvg=";
   };
 
   outputs = [

pkgs/by-name/ju/junicode/tex-font-path.patch

@@ -5,10 +5,10 @@ locations, which are later patched up to refer to the package outputs,
 thus ensuring the style always uses the fonts packaged with it.
 
 diff --git a/TeX/junicode.sty b/TeX/junicode.sty
-index 83bd45d..8fe671c 100644
+index 3f80068..af3e3ba 100644
 --- a/TeX/junicode.sty
 +++ b/TeX/junicode.sty
-@@ -208,7 +208,14 @@
+@@ -211,7 +211,14 @@
  
  \RequirePackage{fontspec}
  \defaultfontfeatures{Ligatures=TeX, Extension=.\junicode@fonttype}
@@ -24,7 +24,7 @@ index 83bd45d..8fe671c 100644
  
  \ifxetex
  \typeout{\junicode@regstylename}
-@@ -219,6 +226,7 @@
+@@ -222,6 +229,7 @@
     ItalicFont =        *-\junicode@italstylename,
     BoldFont =          *-\junicode@boldstylename,
     BoldItalicFont =    *-\junicode@boldstylename Italic,
@@ -32,7 +32,7 @@ index 83bd45d..8fe671c 100644
    ]{Junicode}
  \fi
  \ifluatex
-@@ -230,6 +238,7 @@
+@@ -233,6 +241,7 @@
     ItalicFont =        *-\junicode@italstylename,
     BoldFont =          *-\junicode@boldstylename,
     BoldItalicFont =    *-\junicode@boldstylename Italic,
@@ -40,7 +40,7 @@ index 83bd45d..8fe671c 100644
    ]{Junicode}
  \fi
  
-@@ -242,6 +251,7 @@
+@@ -245,6 +254,7 @@
          #3
          Numbers =           {\junicode@figurealign,\junicode@figurestyle},
          SmallCapsFeatures = {Letters=SmallCaps},
@@ -48,7 +48,7 @@ index 83bd45d..8fe671c 100644
      ]
  }
  \fi
-@@ -252,6 +262,7 @@
+@@ -255,6 +265,7 @@
          #3
          Numbers =           {\junicode@figurealign,\junicode@figurestyle},
          SmallCapsFeatures = {Letters=SmallCaps},
@@ -57,10 +57,10 @@ index 83bd45d..8fe671c 100644
  }
  \fi
 diff --git a/TeX/junicodevf.lua b/TeX/junicodevf.lua
-index 7148668..acebe82 100644
+index 9c58f79..6ddcb55 100644
 --- a/TeX/junicodevf.lua
 +++ b/TeX/junicodevf.lua
-@@ -148,7 +148,7 @@ function mkfontcommands()
+@@ -118,7 +118,7 @@ function mkfontcommands()
           romfontcmd = "jRegular"
           italfontcmd = "jItalic"
        end
@@ -70,12 +70,12 @@ index 7148668..acebe82 100644
     end
  end
 diff --git a/TeX/junicodevf.sty b/TeX/junicodevf.sty
-index c01ccaf..07a99ad 100644
+index da987d0..4475add 100644
 --- a/TeX/junicodevf.sty
 +++ b/TeX/junicodevf.sty
-@@ -168,11 +168,13 @@ mkwidthcommands(wdindex, adjustment)}}
+@@ -132,10 +132,12 @@ mkmainfontcommand(style_idx, weight_option, weight_adjust, width_option, width_a
- 
+ % Set the main font, then the alternate styles. It appears that
- % DECLARE THE FONTS
+ % the fonts aren't embedded in the PDF unless actually used.
  
 -\setmainfont{JunicodeVF}[
 -    ItalicFont =         {*-Italic},
@@ -85,35 +85,35 @@ index c01ccaf..07a99ad 100644
 +    ItalicFont =         {JunicodeVF-Italic},
 +    BoldFont =           {JunicodeVF-Roman},
 +    BoldItalicFont =     {JunicodeVF-Italic},
-     Renderer =           HarfBuzz,
 +    Extension =          .ttf,
 +    Path =               @@@truetype_path@@@,
+     Renderer =           {\junicodevf@renderer},
      Numbers =            {\junicodevf@figurealign,\junicodevf@figurestyle},
      \MainDef,
-     UprightFeatures =    {\MainRegDef
+@@ -152,6 +154,8 @@ mkmainfontcommand(style_idx, weight_option, weight_adjust, width_option, width_a
-@@ -188,6 +190,8 @@ mkwidthcommands(wdindex, adjustment)}}
  \newcommand*{\junicodevf@newfont}[4]{
      \setfontface#1{#2}[
-         Renderer =          HarfBuzz,
+         Renderer =          {\junicodevf@renderer},
 +        Extension =          .ttf,
 +        Path =               @@@truetype_path@@@,
          Numbers =           {\junicodevf@figurealign,\junicodevf@figurestyle},
          SmallCapsFont =     {*},
          SmallCapsFeatures = {Letters=SmallCaps},
-@@ -200,43 +204,59 @@ mkwidthcommands(wdindex, adjustment)}}
+@@ -164,43 +168,60 @@ mkmainfontcommand(style_idx, weight_option, weight_adjust, width_option, width_a
  
  % ENLARGED FACES
  
 -\setfontface\EnlargedOne{JunicodeVF}[
 +\setfontface\EnlargedOne{JunicodeVF-Roman}[
-     Renderer = HarfBuzz,
+     Renderer = {\junicodevf@renderer},
 +    Extension = .ttf,
 +    Path = @@@truetype_path@@@,
      \ENLAOneSizeDef
  ]
  
  \setfontface\EnlargedOneItalic{JunicodeVF-Italic}[
-     Renderer = HarfBuzz,
+     Renderer = {\junicodevf@renderer},
++    Renderer = HarfBuzz,
 +    Extension = .ttf,
 +    Path = @@@truetype_path@@@,
      \ENLAOneSizeDef
@@ -121,14 +121,14 @@ index c01ccaf..07a99ad 100644
  
 -\setfontface\EnlargedTwo{JunicodeVF}[
 +\setfontface\EnlargedTwo{JunicodeVF-Roman}[
-     Renderer = HarfBuzz,
+     Renderer = {\junicodevf@renderer},
 +    Extension = .ttf,
 +    Path = @@@truetype_path@@@,
      \ENLATwoSizeDef
  ]
  
  \setfontface\EnlargedTwoItalic{JunicodeVF-Italic}[
-     Renderer = HarfBuzz,
+     Renderer = {\junicodevf@renderer},
 +    Extension = .ttf,
 +    Path = @@@truetype_path@@@,
      \ENLATwoSizeDef
@@ -136,14 +136,14 @@ index c01ccaf..07a99ad 100644
  
 -\setfontface\EnlargedThree{JunicodeVF}[
 +\setfontface\EnlargedThree{JunicodeVF-Roman}[
-     Renderer = HarfBuzz,
+     Renderer = {\junicodevf@renderer},
 +    Extension = .ttf,
 +    Path = @@@truetype_path@@@,
      \ENLAThreeSizeDef
  ]
  
  \setfontface\EnlargedThreeItalic{JunicodeVF-Italic}[
-     Renderer = HarfBuzz,
+     Renderer = {\junicodevf@renderer},
 +    Extension = .ttf,
 +    Path = @@@truetype_path@@@,
      \ENLAThreeSizeDef
@@ -151,14 +151,14 @@ index c01ccaf..07a99ad 100644
  
 -\setfontface\EnlargedFour{JunicodeVF}[
 +\setfontface\EnlargedFour{JunicodeVF-Roman}[
-     Renderer = HarfBuzz,
+     Renderer = {\junicodevf@renderer},
 +    Extension = .ttf,
 +    Path = @@@truetype_path@@@,
      \ENLAFourSizeDef
  ]
  
  \setfontface\EnlargedFourItalic{JunicodeVF-Italic}[
-     Renderer = HarfBuzz,
+     Renderer = {\junicodevf@renderer},
 +    Extension = .ttf,
 +    Path = @@@truetype_path@@@,
      \ENLAFourSizeDef

pkgs/by-name/ka/kamailio/package.nix

@@ -22,11 +22,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "kamailio";
-  version = "6.0.1";
+  version = "6.0.2";
 
   src = fetchurl {
     url = "https://www.kamailio.org/pub/kamailio/${finalAttrs.version}/src/kamailio-${finalAttrs.version}_src.tar.gz";
-    hash = "sha256-jB1htMFHBtwnSNN7GtQFU5cnYgWpTgvXDjn9mMR1PQE=";
+    hash = "sha256-Ax3MhQZJ8cCuGUTZUThiT2XWAGgFIlwjnKqQvao28h0=";
   };
 
   buildInputs = [

pkgs/by-name/kr/krillinai/package.nix

@@ -15,7 +15,7 @@ buildGoModule (finalAttrs: {
 
   src = fetchFromGitHub {
     owner = "krillinai";
-    repo = "KrillinAI";
+    repo = "KlicStudio";
     tag = "v${finalAttrs.version}";
     hash = "sha256-RHlQeTFeG23LjLwczSGIghH3XPFTR6ZVDFk2KlRQGoA=";
   };
@@ -46,8 +46,8 @@ buildGoModule (finalAttrs: {
 
   meta = {
     description = "Video translation and dubbing tool";
-    homepage = "https://github.com/krillinai/KrillinAI";
+    homepage = "https://github.com/krillinai/KlicStudio";
-    changelog = "https://github.com/krillinai/KrillinAI/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/krillinai/KlicStudio/releases/tag/v${finalAttrs.version}";
     mainProgram = "krillinai-desktop";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [ emaryn ];

pkgs/by-name/la/lasuite-meet-frontend/package.nix

@@ -0,0 +1,51 @@
+{
+  lib,
+  fetchFromGitHub,
+  fetchNpmDeps,
+  buildNpmPackage,
+}:
+
+buildNpmPackage rec {
+  pname = "lasuite-meet-frontend";
+  version = "0.1.27";
+
+  src = fetchFromGitHub {
+    owner = "suitenumerique";
+    repo = "meet";
+    tag = "v${version}";
+    hash = "sha256-EMhsQPrONaQmNJ/FFoYlP5KKXT8vm7LwUHmEZd0oZeE=";
+  };
+
+  sourceRoot = "source/src/frontend";
+
+  npmDeps = fetchNpmDeps {
+    inherit version src;
+    sourceRoot = "source/src/frontend";
+    hash = "sha256-7wXzcn6aGAkRUOCI6MU0AlPGngBWJtdbAfnZZDaMWec=";
+  };
+
+  buildPhase = ''
+    runHook preBuild
+
+    npm run build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    cp -r dist $out
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Open source alternative to Google Meet and Zoom powered by LiveKit: HD video calls, screen sharing, and chat features. Built with Django and React";
+    homepage = "https://github.com/suitenumerique/meet";
+    changelog = "https://github.com/suitenumerique/meet/blob/${src.tag}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ soyouzpanda ];
+    platforms = lib.platforms.all;
+  };
+}

pkgs/by-name/la/lasuite-meet/package.nix

@@ -0,0 +1,113 @@
+{
+  lib,
+  python3,
+  fetchFromGitHub,
+  nixosTests,
+}:
+let
+  python = python3.override {
+    self = python3;
+    packageOverrides = (self: super: { django = super.django_5_2; });
+  };
+in
+
+python.pkgs.buildPythonApplication rec {
+  pname = "lasuite-meet";
+  version = "0.1.27";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "suitenumerique";
+    repo = "meet";
+    tag = "v${version}";
+    hash = "sha256-EMhsQPrONaQmNJ/FFoYlP5KKXT8vm7LwUHmEZd0oZeE=";
+  };
+
+  sourceRoot = "source/src/backend";
+
+  patches = [
+    # Support configuration throught environment variables for SECURE_*
+    ./secure_settings.patch
+  ];
+
+  build-system = with python.pkgs; [ setuptools ];
+
+  dependencies = with python.pkgs; [
+    aiohttp
+    boto3
+    brevo-python
+    brotli
+    celery
+    django
+    django-configurations
+    django-cors-headers
+    django-countries
+    django-extensions
+    django-lasuite
+    django-parler
+    django-redis
+    django-storages
+    django-timezone-field
+    djangorestframework
+    dockerflow
+    drf-spectacular
+    drf-spectacular-sidecar
+    easy-thumbnails
+    factory-boy
+    gunicorn
+    jsonschema
+    june-analytics-python
+    livekit-api
+    markdown
+    mozilla-django-oidc
+    nested-multipart-parser
+    psycopg
+    pyjwt
+    pyopenssl
+    python-frontmatter
+    redis
+    requests
+    sentry-sdk
+    whitenoise
+  ];
+
+  pythonRelaxDeps = true;
+
+  postBuild = ''
+    export DJANGO_DATA_DIR=$(pwd)/data
+    ${python.pythonOnBuildForHost.interpreter} manage.py collectstatic --noinput --clear
+  '';
+
+  postInstall =
+    let
+      pythonPath = python.pkgs.makePythonPath dependencies;
+    in
+    ''
+      mkdir -p $out/{bin,share}
+
+      cp ./manage.py $out/bin/.manage.py
+      cp -r data/static $out/share
+      chmod +x $out/bin/.manage.py
+
+      makeWrapper $out/bin/.manage.py $out/bin/meet \
+        --prefix PYTHONPATH : "${pythonPath}"
+      makeWrapper ${lib.getExe python.pkgs.celery} $out/bin/celery \
+        --prefix PYTHONPATH : "${pythonPath}:$out/${python.sitePackages}"
+      makeWrapper ${lib.getExe python.pkgs.gunicorn} $out/bin/gunicorn \
+        --prefix PYTHONPATH : "${pythonPath}:$out/${python.sitePackages}"
+    '';
+
+  passthru.tests = {
+    login-and-create-room = nixosTests.lasuite-meet;
+  };
+
+  meta = {
+    description = "Open source alternative to Google Meet and Zoom powered by LiveKit: HD video calls, screen sharing, and chat features. Built with Django and React";
+    homepage = "https://github.com/suitenumerique/meet";
+    changelog = "https://github.com/suitenumerique/meet/blob/${src.tag}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ soyouzpanda ];
+    mainProgram = "meet";
+    platforms = lib.platforms.all;
+  };
+}

pkgs/by-name/la/lasuite-meet/secure_settings.patch

@@ -0,0 +1,52 @@
+From d7bbf24df5eecb61caebdf55b0d26da60a9d9609 Mon Sep 17 00:00:00 2001
+From: soyouzpanda <soyouzpanda@soyouzpanda.fr>
+Date: Fri, 16 May 2025 23:41:12 +0200
+Subject: [PATCH 1/2] =?UTF-8?q?=F0=9F=94=A7(backend)=20allow=20SECURE=20en?=
+ =?UTF-8?q?vironment=20variables=20to=20be=20configured?=
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+---
+ meet/settings.py | 19 ++++++++++++-------
+ 1 file changed, 12 insertions(+), 7 deletions(-)
+
+diff --git a/meet/settings.py b/meet/settings.py
+index ebb0837..9c67986 100755
+--- a/meet/settings.py
++++ b/meet/settings.py
+@@ -755,19 +755,24 @@ class Production(Base):
+     # - Your proxy sets the X-Forwarded-Proto header and sends it to Django
+     #
+     # In other cases, you should comment the following line to avoid security issues.
+-    SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
+-    SECURE_HSTS_SECONDS = 60
+-    SECURE_HSTS_PRELOAD = True
+-    SECURE_HSTS_INCLUDE_SUBDOMAINS = True
+-    SECURE_SSL_REDIRECT = True
++    SECURE_PROXY_SSL_HEADER = values.TupleValue(("HTTP_X_FORWARDED_PROTO", "https"),
++                                                environ_name="SECURE_PROXY_SSL_HEADER")
++    SECURE_HSTS_SECONDS = values.IntegerValue(
++        60, environ_name="SECURE_HSTS_SECONDS")
++    SECURE_HSTS_PRELOAD = values.BooleanValue(
++        True, environ_name="SECURE_HSTS_PRELOAD")
++    SECURE_HSTS_INCLUDE_SUBDOMAINS = values.BooleanValue(
++        True, environ_name="SECURE_HSTS_INCLUDE_SUBDOMAINS")
++    SECURE_SSL_REDIRECT = values.BooleanValue(
++        True, environ_name="SECURE_SSL_REDIRECT")
+     SECURE_REDIRECT_EXEMPT = [
+         "^__lbheartbeat__",
+         "^__heartbeat__",
+     ]
+ 
+     # Modern browsers require to have the `secure` attribute on cookies with `Samesite=none`
+-    CSRF_COOKIE_SECURE = True
+-    SESSION_COOKIE_SECURE = True
++    CSRF_COOKIE_SECURE = values.BooleanValue(True, environ_name="CSRF_COOKIE_SECURE")
++    SESSION_COOKIE_SECURE = values.BooleanValue(True, environ_name="SESSION_COOKIE_SECURE")
+ 
+     # Privacy
+     SECURE_REFERRER_POLICY = "same-origin"
+-- 
+2.47.2
+

pkgs/by-name/la/lazygit/package.nix

@@ -8,13 +8,13 @@
 }:
 buildGoModule rec {
   pname = "lazygit";
-  version = "0.52.0";
+  version = "0.53.0";
 
   src = fetchFromGitHub {
     owner = "jesseduffield";
     repo = "lazygit";
     tag = "v${version}";
-    hash = "sha256-tbFRovaB0f+0VyX34DEXvWYjV3fipc5kbRNhm7rVMlo=";
+    hash = "sha256-u9ccwRdRQEVNC1/nFRSKJ9RCWJI1mM9Ak3bDVMIWD6E=";
   };
 
   vendorHash = null;

pkgs/by-name/lb/lbreakouthd/package.nix

@@ -18,6 +18,14 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-QFqNGv2+XXe1Dt8HAoqXEHWXFNU/IQ2c9FYEqehrWdI=";
   };
 
+  # On macOS with a case-insensitive filesystem, "sdl.h" shadows <SDL.h>
+  postPatch = lib.optionalString stdenv.buildPlatform.isDarwin ''
+    mv src/sdl.h src/lbhd_sdl.h
+    for file in src/*.cpp src/*.h; do
+      substituteInPlace "$file" --replace-quiet 'sdl.h' 'lbhd_sdl.h'
+    done
+  '';
+
   buildInputs = [
     SDL2
     SDL2_image
@@ -40,6 +48,5 @@ stdenv.mkDerivation (finalAttrs: {
     mainProgram = "lbreakouthd";
     maintainers = with lib.maintainers; [ ];
     inherit (SDL2.meta) platforms;
-    broken = stdenv.hostPlatform.isDarwin;
   };
 })

pkgs/by-name/mc/mcp-k8s-go/package.nix

@@ -0,0 +1,42 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "mcp-k8s-go";
+  version = "0.3.5";
+
+  src = fetchFromGitHub {
+    owner = "strowk";
+    repo = "mcp-k8s-go";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-6DKhcUwXBap7Ts+T46GJJxKS6LXTfScZZEQV0PhuVfQ=";
+  };
+
+  vendorHash = "sha256-nP9cVXV1qyYancePz1mMNq911Ou7k5nVckQzbM05HpQ=";
+
+  doCheck = false;
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=${finalAttrs.version}"
+  ];
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  doInstallCheck = true;
+  versionCheckProgramArg = "--version";
+
+  meta = {
+    description = "MCP server connecting to Kubernetes";
+    homepage = "https://github.com/strowk/mcp-k8s-go";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ pilz ];
+    mainProgram = "mcp-k8s-go";
+  };
+})

pkgs/by-name/me/mediaelch/package.nix

@@ -5,59 +5,33 @@
   fetchpatch,
 
   cmake,
-  qttools,
-  wrapQtAppsHook,
 
   curl,
   ffmpeg,
   libmediainfo,
   libzen,
-  qt5compat ? null, # qt6 only
+  libsForQt5,
-  qtbase,
+  qt6Packages,
-  qtdeclarative,
+
-  qtmultimedia,
+  qtVersion ? 6,
-  qtsvg,
-  qtwayland,
-  quazip,
 }:
+
 let
-  qtVersion = lib.versions.major qtbase.version;
+  qt' = if qtVersion == 5 then libsForQt5 else qt6Packages;
+
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "mediaelch";
   version = "2.12.0";
 
   src = fetchFromGitHub {
     owner = "Komet";
     repo = "MediaElch";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-m2d4lnyD8HhhqovMdeG36dMK+4kJA7rlPHE2tlhfevo=";
     fetchSubmodules = true;
   };
 
-  nativeBuildInputs = [
-    cmake
-    qttools
-    wrapQtAppsHook
-  ];
-
-  buildInputs =
-    [
-      curl
-      ffmpeg
-      libmediainfo
-      libzen
-      qtbase
-      qtdeclarative
-      qtmultimedia
-      qtsvg
-      qtwayland
-      quazip
-    ]
-    ++ lib.optionals (qtVersion == "6") [
-      qt5compat
-    ];
-
   patches = [
     # fix from: https://github.com/Komet/MediaElch/pull/1878
     (fetchpatch {
@@ -66,10 +40,34 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  nativeBuildInputs = [
+    cmake
+    qt'.qttools
+    qt'.wrapQtAppsHook
+  ];
+
+  buildInputs =
+    [
+      curl
+      ffmpeg
+      libmediainfo
+      libzen
+      qt'.qtbase
+      qt'.qtdeclarative
+      qt'.qtmultimedia
+      qt'.qtsvg
+      qt'.qtwayland
+      qt'.quazip
+    ]
+    ++ lib.optionals (qtVersion == 6) [
+      qt'.qt5compat
+    ];
+
   cmakeFlags = [
-    "-DDISABLE_UPDATER=ON"
+    (lib.cmakeBool "DISABLE_UPDATER" true)
-    "-DUSE_EXTERN_QUAZIP=ON"
+    (lib.cmakeBool "ENABLE_TESTS" finalAttrs.finalPackage.doCheck or false)
-    "-DMEDIAELCH_FORCE_QT${qtVersion}=ON"
+    (lib.cmakeBool "MEDIAELCH_FORCE_QT${toString qtVersion}" true)
+    (lib.cmakeBool "USE_EXTERN_QUAZIP" true)
   ];
 
   # libmediainfo.so.0 is loaded dynamically
@@ -77,12 +75,22 @@ stdenv.mkDerivation rec {
     "--prefix LD_LIBRARY_PATH : ${libmediainfo}/lib"
   ];
 
-  meta = with lib; {
+  env = {
+    HOME = "/tmp"; # for the font cache
+    LANG = "C.UTF-8";
+    QT_QPA_PLATFORM = "offscreen"; # the tests require a UI
+  };
+
+  doCheck = true;
+
+  checkTarget = "unit_test"; # the other tests require network connectivity
+
+  meta = {
     homepage = "https://mediaelch.de/mediaelch/";
     description = "Media Manager for Kodi";
     mainProgram = "MediaElch";
-    license = licenses.lgpl3Only;
+    license = lib.licenses.lgpl3Only;
-    maintainers = with maintainers; [ stunkymonkey ];
+    maintainers = with lib.maintainers; [ stunkymonkey ];
-    platforms = platforms.linux;
+    platforms = lib.platforms.linux;
   };
-}
+})

pkgs/by-name/me/memcached-exporter/package.nix

@@ -0,0 +1,31 @@
+{
+  buildGoModule,
+  fetchFromGitHub,
+  lib,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "memcached-exporter";
+  version = "0.15.3";
+
+  src = fetchFromGitHub {
+    owner = "prometheus";
+    repo = "memcached_exporter";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Y2y8XMR+YHbxFQFYqwtQ4aRi71jD6l3witEwjxAjuOc=";
+  };
+
+  vendorHash = "sha256-Q2b8/QA12HI6ynLU5aNmwOal+snHd1Be6p3UWk4DJhw=";
+
+  # Tests touch the network
+  doCheck = false;
+
+  meta = {
+    changelog = "https://github.com/prometheus/memcached_exporter/releases/tag/${finalAttrs.src.tag}";
+    description = "Exports metrics from memcached servers for consumption by Prometheus";
+    homepage = "https://github.com/prometheus/memcached_exporter";
+    license = lib.licenses.asl20;
+    mainProgram = "memcached_exporter";
+    teams = with lib.teams; [ deshaw ];
+  };
+})

pkgs/by-name/mo/moon/package.nix

@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "moon";
-  version = "1.37.3";
+  version = "1.38.0";
 
   src = fetchFromGitHub {
     owner = "moonrepo";
     repo = "moon";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-XBuB26ghUUXkQrUDZCt7L4c8aW5odI7BqDdM6Si8Nck=";
+    hash = "sha256-z1wMXbpKtHei2cLehfYFd0hUAl8yooZlqeLA/sozFoo=";
   };
 
-  cargoHash = "sha256-7XcpJngFzWvVdmYWLf3jYLVG/rgXaetP1w4vAt6INDQ=";
+  cargoHash = "sha256-m7nQE+6rp1RHVgR5xt41RCIgcWm+2jomYDQQUIpsfIE=";
 
   env = {
     RUSTFLAGS = "-C strip=symbols";

pkgs/by-name/mu/mupdf/package.nix

@@ -233,7 +233,7 @@ stdenv.mkDerivation rec {
     '')
     + (lib.optionalString (enableX11 || enableGL) ''
       mkdir -p $bin/share/icons/hicolor/48x48/apps
-      cp docs/logo/mupdf-icon-48.png $bin/share/icons/hicolor/48x48/apps
+      cp docs/logo/mupdf-icon-48.png $bin/share/icons/hicolor/48x48/apps/mupdf.png
     '')
     + (
       if enableGL then

pkgs/by-name/nh/nhost-cli/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "nhost-cli";
-  version = "1.29.9";
+  version = "1.31.0";
 
   src = fetchFromGitHub {
     owner = "nhost";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-9UxB/tshTwMg4K7K0Fs1Ld96ET6Drg77GJgONj4cRmM=";
+    hash = "sha256-JMRFvJv/Ynnk0maT27sprTpWjCgGDw0x2sK+woS9uQk=";
   };
 
   vendorHash = null;

pkgs/by-name/no/noto-fonts/package.nix

@@ -20,13 +20,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "noto-fonts${suffix}";
-  version = "2025.06.01";
+  version = "2025.07.01";
 
   src = fetchFromGitHub {
     owner = "notofonts";
     repo = "notofonts.github.io";
     rev = "noto-monthly-release-${version}";
-    hash = "sha256-6lbNJjkf6lnPPZzHO3vtsXEuPQs6ewslgnQIeDhF2yk=";
+    hash = "sha256-H2mUG2+7+lVCjoAVvsuFK5NNm5LpjyF9ySlF3vriR1w=";
   };
 
   outputs = [

pkgs/by-name/op/openrct2/package.nix

@@ -33,7 +33,7 @@
 }:
 
 let
-  openrct2-version = "0.4.22";
+  openrct2-version = "0.4.23";
 
   # Those versions MUST match the pinned versions within the CMakeLists.txt
   # file. The REPLAYS repository from the CMakeLists.txt is not necessary.
@@ -67,7 +67,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "OpenRCT2";
     repo = "OpenRCT2";
     rev = "v${openrct2-version}";
-    hash = "sha256-dFELAfJIgizM0nRc4SMrFGIqFQo/ImTtR89GVkb4/TQ=";
+    hash = "sha256-vCnMVfRTF79oWsYorsI5/Mj7/P32G5uZMskW2SUSYlg=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/or/orchard/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "orchard";
-  version = "0.34.0";
+  version = "0.35.0";
 
   src = fetchFromGitHub {
     owner = "cirruslabs";
     repo = "orchard";
     rev = version;
-    hash = "sha256-7XKiFViGjz0/jrvN6JdCFy1lw4fN2Bz43WWKcgZ7ZzU=";
+    hash = "sha256-K9lPI1wl+F6piksRMh7WgRPIAXpAvSTPjX+5MIddIZQ=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -24,7 +24,7 @@ buildGoModule rec {
     '';
   };
 
-  vendorHash = "sha256-LExITpIVaMIxt+CkH7SRkbSPRO842Pl9lgSqZenE4uA=";
+  vendorHash = "sha256-+lH9TNceOYmGeoWUy4xnDr1TtSW81ZELljPfCv8zwEE=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/pl/pluto/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "pluto";
-  version = "5.21.7";
+  version = "5.21.8";
 
   src = fetchFromGitHub {
     owner = "FairwindsOps";
     repo = "pluto";
     rev = "v${version}";
-    hash = "sha256-1Sgq8WBx0jPPmuNvUfiDs9CvV0IjCp0+n8OUlVjGj3w=";
+    hash = "sha256-41ud7SRaivhmtBY6ekKIpRijTuLqJ/tLi0dTHDsGAps=";
   };
 
   vendorHash = "sha256-4kiLgwr8wr/L4anxgZVAE6IFdbBvTgcUlf5KIcT+lRk=";

pkgs/by-name/pp/pphack/package.nix

@@ -0,0 +1,33 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "pphack";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "edoardottt";
+    repo = "pphack";
+    tag = "v${version}";
+    hash = "sha256-SWMY+t8NzbUqAeLsqia5KAXXOjoMRMZVVa8YdTLcG5A=";
+  };
+
+  vendorHash = "sha256-smJp3GDo1KOrEjEJnxtyrlHmb/L70QqhDWjCZ4U1qJs=";
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  meta = {
+    description = "Client-Side Prototype Pollution Scanner";
+    homepage = "https://github.com/edoardottt/pphack";
+    changelog = "https://github.com/edoardottt/pphack/releases/tag/${src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "pphack";
+  };
+}

pkgs/by-name/pr/proto/package.nix

@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "proto";
-  version = "0.50.0";
+  version = "0.50.1";
 
   src = fetchFromGitHub {
     owner = "moonrepo";
     repo = "proto";
     rev = "v${version}";
-    hash = "sha256-ilbqT5826FB20uCzt2a6QYCD2rDNto7nxz1mjHGDbAA=";
+    hash = "sha256-Ol0l+9pkMDmb09a6gsDxP9KIpIIeDNHp9cGBbfWHBNA=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-bAsFzu1RzOMufFb2WCRd0pDl8O8eVsoZn79BPWql1xg=";
+  cargoHash = "sha256-kc/NC1WGOChdPXq1q83j5GBrcYTEpPCauIZ/q02caUU=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     libiconv

pkgs/by-name/pr/protoc-gen-lint/package.nix

@@ -0,0 +1,31 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "protoc-gen-lint";
+  version = "0.3.0";
+
+  src = fetchFromGitHub {
+    owner = "ckaznocha";
+    repo = "protoc-gen-lint";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-8+fPkXmigP8ZqcFGCnw1KZhJQcahDjKnZUJ1eqaHhs0=";
+  };
+
+  vendorHash = null;
+
+  meta = {
+    description = "Plug-in for Google's Protocol Buffers compiler to check .proto files for style violations";
+    homepage = "https://github.com/ckaznocha/protoc-gen-lint";
+    changelog = "https://github.com/ckaznocha/protoc-gen-lint/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      jherland
+      jk
+    ];
+    mainProgram = "protoc-gen-lint";
+  };
+})

pkgs/by-name/ps/pssh/package.nix

@@ -8,16 +8,18 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "pssh";
-  version = "2.3.4";
+  version = "2.3.5";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lilydjwg";
     repo = "pssh";
-    rev = "v${version}";
+    tag = "v${version}";
-    hash = "sha256-B1dIa6hNeq4iE8GKVhTp3Gzq7vp+v5Yyzj8uF8X71yg=";
+    hash = "sha256-JZOO5xmW34lvWzGL4tC9fquZOOYhub0/aa/iQ63rjHE=";
   };
 
+  build-system = with python3Packages; [ setuptools ];
+
   postPatch = ''
     for f in bin/*; do
       substituteInPlace $f \
@@ -37,6 +39,7 @@ python3Packages.buildPythonApplication rec {
       including pssh, pscp, prsync, pnuke and pslurp.
     '';
     inherit (src.meta) homepage;
+    changelog = "https://github.com/lilydjwg/pssh/blob/${src.tag}/ChangeLog";
     license = licenses.bsd3;
     platforms = platforms.linux ++ platforms.darwin;
     maintainers = with maintainers; [ chris-martin ];

pkgs/by-name/re/redis/package.nix

@@ -98,9 +98,7 @@ stdenv.mkDerivation (finalAttrs: {
       --tags -leaks \
       --skipunit integration/aof-multi-part \
       --skipunit integration/failover \
-      ${lib.optionalString (
+      --skipunit integration/replication-rdbchannel
-        stdenv.hostPlatform.system == "aarch64-linux"
-      ) "--skipunit integration/replication-rdbchannel"}
 
     runHook postCheck
   '';

pkgs/by-name/ro/rosa/package.nix

@@ -11,13 +11,13 @@
 
 buildGoModule rec {
   pname = "rosa";
-  version = "1.2.53";
+  version = "1.2.54";
 
   src = fetchFromGitHub {
     owner = "openshift";
     repo = "rosa";
     rev = "v${version}";
-    hash = "sha256-t8hJscLk0tRi7CC6maE478CEbOkJtVkbXA0Ag1DxFB4=";
+    hash = "sha256-mW4uwviyzGI8mMaQsnedV1vTm26ae6VSoihMzvSCAjc=";
   };
   vendorHash = null;
 

pkgs/by-name/s7/s7/package.nix

@@ -19,14 +19,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "s7";
-  version = "11.5-unstable-2025-06-25";
+  version = "11.5-unstable-2025-07-04";
 
   src = fetchFromGitLab {
     domain = "cm-gitlab.stanford.edu";
     owner = "bil";
     repo = "s7";
-    rev = "0030b5a1e968bc0d6d3cdfd083703c9f5dcf93aa";
+    rev = "3bf6fbd10602b1148addb1d5c59560a3599472a1";
-    hash = "sha256-SqRzPSzahZeWxbWhQIUyXzRBq0x6gxb6Sd7oVqTIaF4=";
+    hash = "sha256-cI7DIZNFL1QmTYlP+yQp/BbgIvn8ej59PxzvfhTnpwM=";
   };
 
   buildInputs = [

pkgs/by-name/sa/saman_ttf/package.nix

@@ -0,0 +1,32 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  unzip,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "saman_ttf";
+  version = "1.001";
+
+  src = fetchurl {
+    url = "https://github.com/tcgumus/saman/releases/download/v${finalAttrs.version}/SamanDere-Regular.ttf";
+    hash = "sha256-hLlo4qtxL1RDiA9PpRvo2F7rdCVGPs2G8NHKydLfJXU=";
+  };
+
+  dontUnpack = true;
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm644 $src $out/share/fonts/truetype/SamanDere-Regular.ttf
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Medium contrast sans serif font for web use";
+    homepage = "https://github.com/tcgumus/saman";
+    license = lib.licenses.ofl;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ gigahawk ];
+  };
+})

pkgs/by-name/si/simple-http-server/package.nix

@@ -8,17 +8,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "simple-http-server";
-  version = "0.6.12";
+  version = "0.6.13";
 
   src = fetchFromGitHub {
     owner = "TheWaWaR";
     repo = "simple-http-server";
     rev = "v${version}";
-    sha256 = "sha256-WaUBMGZaIjce83mskEtH9PLYDDlBL1MNoY8lz4++684=";
+    sha256 = "sha256-uTzzQg1UJ+PG2poIKd+LO0T0y7z48ZK0f196zIgeZhs=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-5oZTT2qBtupuF2thhfko7mgWLu+e7+P92V+DPsPZ1Ak=";
+  cargoHash = "sha256-y+pNDg73fAHs9m0uZr6z0HTA/vB3fFM5qukJycuIxnY=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/sv/svd2rust-form/package.nix

@@ -0,0 +1,30 @@
+{
+  lib,
+  rustPlatform,
+  fetchCrate,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "svd2rust-form";
+  version = "0.13.0";
+
+  src = fetchCrate {
+    pname = "form";
+    inherit (finalAttrs) version;
+    hash = "sha256-7+5HEyP7480UM5dydavoiclX3YTvW46V8r+Vpqt4xWk=";
+  };
+
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-ItNBQKye1GD01KFBubMLxksv8OCWIxya/LlZ9g6Jdg8=";
+
+  meta = {
+    description = "Library for splitting apart a large file with multiple modules into the idiomatic rust directory structure";
+    mainProgram = "form";
+    homepage = "https://github.com/djmcgill/form";
+    changelog = "https://github.com/djmcgill/form/blob/main/CHANGELOG.md";
+    license = with lib.licenses; [
+      mit
+    ];
+    maintainers = with lib.maintainers; [ fidgetingbits ];
+  };
+})

pkgs/by-name/ta/tailscale/package.nix

@@ -23,7 +23,7 @@
 }:
 
 let
-  version = "1.84.2";
+  version = "1.84.3";
 in
 buildGoModule {
   pname = "tailscale";
@@ -38,7 +38,7 @@ buildGoModule {
     owner = "tailscale";
     repo = "tailscale";
     rev = "v${version}";
-    hash = "sha256-dSYophk7oogLmlRBr05Quhx+iMUuJU2VXhAZVtJLTts=";
+    hash = "sha256-0HvUNpyi6xzS3PtbgMvh6bLRhV77CZRrVSKGMr7JtbE=";
   };
 
   vendorHash = "sha256-QBYCMOWQOBCt+69NtJtluhTZIOiBWcQ78M9Gbki6bN0=";

pkgs/by-name/te/termusic/package.nix

@@ -16,17 +16,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "termusic";
-  version = "0.10.0";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "tramhao";
     repo = "termusic";
     rev = "v${version}";
-    hash = "sha256-Yd23Jk2BFuLtxgF8vgat0wTGq6ahHHBd/HjGI9BY9z4=";
+    hash = "sha256-89eqOeSq9uI4re3Oq0/ORMzMjYA4pLw7ZYyfGPXWtfg=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-1WomL0O5QS2NHu4k6TuA2jLtDKyxlY0iVCgH9pb6CHI=";
+  cargoHash = "sha256-yzmZC1JwTHefAE2X/D1yfVZN4wGxnH+FkXGqKMuaVeM=";
 
   useNextest = true;
 

pkgs/by-name/ts/tslib/package.nix

@@ -3,27 +3,30 @@
   stdenv,
   fetchFromGitHub,
   cmake,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tslib";
   version = "1.23";
-  hash = "sha256-2YJDADh/WCksAEIjngAdji98YGmwjpvxSBZkxAwFc7k=";
 
   src = fetchFromGitHub {
     owner = "libts";
     repo = "tslib";
-    rev = finalAttrs.version;
+    tag = finalAttrs.version;
-    sha256 = finalAttrs.hash;
+    hash = "sha256-2YJDADh/WCksAEIjngAdji98YGmwjpvxSBZkxAwFc7k=";
   };
 
   nativeBuildInputs = [ cmake ];
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Touchscreen access library";
     homepage = "http://www.tslib.org/";
     license = lib.licenses.lgpl21;
     platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [ shogo ];
+    teams = with lib.teams; [ ngi ];
   };
 })

pkgs/by-name/ty/typora/package.nix

@@ -24,7 +24,10 @@ let
   pname = "typora";
   version = "1.10.8";
   src = fetchurl {
-    url = "https://download.typora.io/linux/typora_${version}_amd64.deb";
+    urls = [
+      "https://download.typora.io/linux/typora_${version}_amd64.deb"
+      "https://download2.typoraio.cn/linux/typora_${version}_amd64.deb"
+    ];
     hash = "sha256-7auxTtdVafvM2fIpQVvEey1Q6eLVG3mLdjdZXcqSE/Q=";
   };
 

pkgs/by-name/ve/versitygw/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "versitygw";
-  version = "1.0.14";
+  version = "1.0.15";
 
   src = fetchFromGitHub {
     owner = "versity";
     repo = "versitygw";
     tag = "v${version}";
-    hash = "sha256-/64SiVZUXGRI3guvSIqDBXOmbxucPCZEceCObTee6jI=";
+    hash = "sha256-gRVUR1BlGVLS6+OZUvOVgoRNDiHrDSDu2L3iBwZ/zbg=";
   };
 
-  vendorHash = "sha256-HzPjHNZdQ+IJl91QviVG6zydhTb/1tOZGdFBpHLUTfE=";
+  vendorHash = "sha256-7efskc/3bj8/8D5LgQnkC4TYib+73fpDyRKDDcFVRvA=";
 
   doCheck = false; # Require access to online S3 services
 

pkgs/by-name/vp/vpp/package.nix

@@ -50,13 +50,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "vpp";
-  version = "25.02";
+  version = "25.06";
 
   src = fetchFromGitHub {
     owner = "FDio";
     repo = "vpp";
     rev = "v${version}";
-    hash = "sha256-UDO1mlOEQNCmtR18CCTF+ng5Ms9gfTsnohSygLlPopY=";
+    hash = "sha256-BuHKPQA4qHoADqBg2IztlzUMpbvYKK5uH7ktChSW5vk=";
   };
 
   postPatch = ''

pkgs/by-name/wa/waycheck/package.nix

@@ -14,14 +14,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "waycheck";
-  version = "1.6.0";
+  version = "1.7.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "serebit";
     repo = "waycheck";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-w6JasxkxwWrkWECsW/dCMj2HcnmeM/VVMnkOXzwNWCQ=";
+    hash = "sha256-wO3+Vwi4wM/NfRdHUt0AVEE6UPr7wkY12JBVzLFqM4c=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/wg/wgsl-analyzer/package.nix

@@ -7,17 +7,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "wgsl-analyzer";
-  version = "2025-06-02";
+  version = "2025-06-28";
 
   src = fetchFromGitHub {
     owner = "wgsl-analyzer";
     repo = "wgsl-analyzer";
     tag = finalAttrs.version;
-    hash = "sha256-bLwehCmWzqDmmg4iGM21BOUquSYJSY2LIqlKuB1bAlA=";
+    hash = "sha256-X4BUZWrCmyixM6D7785jsQ4XYhXemQ7ycl0FUijevkg=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Z+slANnmrY5bhM8+Ki+l29OAbpqnx38n53CFCuOR6cM=";
+  cargoHash = "sha256-PEhvnIVjNi0O2ZqzSW/CRaK4r5pzd7sMUDhB2eGpqk8=";
 
   checkFlags = [
     # Imports failures

pkgs/by-name/xk/xk6/package.nix

@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "xk6";
-  version = "1.0.0";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "xk6";
     tag = "v${version}";
-    hash = "sha256-lSEMToo4Bjh9j2Z/wG64TIeHdJ/+HpYlEXyqIK9MJ/Y=";
+    hash = "sha256-uFW8TogMq0Uo0SXzO7V8xK4UCo+u6CTArIWIwz+kyZc=";
   };
 
   vendorHash = null;

pkgs/by-name/ze/zed-editor/package.nix

@@ -231,6 +231,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
       # Flaky: unreliably fails on certain hosts (including Hydra)
       "--skip=zed::tests::test_window_edit_state_restoring_enabled"
     ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      # Flaky: unreliably fails on certain hosts (including Hydra)
+      "--skip=zed::open_listener::tests::test_open_workspace_with_directory"
+    ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       # Fails on certain hosts (including Hydra) for unclear reason
       "--skip=test_open_paths_action"

pkgs/development/libraries/astal/source.nix

@@ -7,15 +7,15 @@ let
   originalDrv = fetchFromGitHub {
     owner = "Aylur";
     repo = "astal";
-    rev = "4820a3e37cc8eb81db6ed991528fb23472a8e4de";
+    rev = "ac90f09385a2295da9fdc108aaba4a317aaeacc7";
-    hash = "sha256-SaHAtzUyfm4urAcUEZlBFn7dWhoDqA6kaeFZ11CCTf8=";
+    hash = "sha256-AodIKw7TmI7rHVcOfEsO82stupMYIMVQeLAUQfVxnkU=";
   };
 in
 originalDrv.overrideAttrs (
   final: prev: {
     name = "${final.pname}-${final.version}"; # fetchFromGitHub already defines name
     pname = "astal-source";
-    version = "0-unstable-2025-05-12";
+    version = "0-unstable-2025-06-28";
 
     meta = prev.meta // {
       description = "Building blocks for creating custom desktop shells (source)";

pkgs/development/libraries/libquotient/default.nix

@@ -10,9 +10,6 @@
   qtkeychain,
 }:
 
-let
-  isQt6 = lib.versions.major qtbase.version == "6";
-in
 stdenv.mkDerivation rec {
   pname = "libquotient";
   version = "0.9.1";
@@ -41,7 +38,6 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [
     "-DQuotient_ENABLE_E2EE=ON"
-    (lib.cmakeBool "BUILD_WITH_QT6" isQt6)
   ];
 
   # https://github.com/quotient-im/libQuotient/issues/551

pkgs/development/python-modules/aiobafi6/default.nix

@@ -6,27 +6,24 @@
   protobuf,
   pytest-asyncio,
   pytestCheckHook,
-  pythonOlder,
   zeroconf,
 }:
 
 buildPythonPackage rec {
   pname = "aiobafi6";
-  version = "0.9.0";
+  version = "0.10.0";
-  format = "pyproject";
+  pyproject = true;
-
-  disabled = pythonOlder "3.10";
 
   src = fetchFromGitHub {
     owner = "jfroy";
     repo = "aiobafi6";
     tag = version;
-    hash = "sha256-QxjrspvNrcMcGChjj1B4QF/SnWCsGmPxnI2bWAL6BiI=";
+    hash = "sha256-7NIpIRVs6PFPByrGfVDA6P7JTvXGrzbH/lOPdPfZH04=";
   };
 
-  nativeBuildInputs = [ poetry-core ];
+  build-system = [ poetry-core ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     protobuf
     zeroconf
   ];
@@ -40,10 +37,10 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Library for communication with the Big Ass Fans i6 firmware";
-    mainProgram = "aiobafi6";
     homepage = "https://github.com/jfroy/aiobafi6";
-    changelog = "https://github.com/jfroy/aiobafi6/releases/tag/0.8.2";
+    changelog = "https://github.com/jfroy/aiobafi6/releases/tag/${src.tag}";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "aiobafi6";
   };
 }

pkgs/development/python-modules/fast-simplification/default.nix

@@ -0,0 +1,68 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  cython,
+  numpy,
+  setuptools,
+  wheel,
+  pytestCheckHook,
+  pyvista,
+  nix-update-script,
+}:
+
+buildPythonPackage rec {
+  pname = "fast-simplification";
+  version = "0.1.11";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "pyvista";
+    repo = "fast-simplification";
+    tag = "v${version}";
+    hash = "sha256-3mqcFTNrq1W376ctJJumzeQccaB4cvoTNW8BHEnv5t8=";
+  };
+
+  build-system = [
+    cython
+    numpy
+    setuptools
+    wheel
+  ];
+
+  dependencies = [
+    numpy
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pyvista
+  ];
+
+  disabledTests = [
+    # need network to download data
+    "test_collapses_louis"
+    "test_human"
+  ];
+
+  # make sure import the built version, not the source one
+  preCheck = ''
+    rm -r fast_simplification
+  '';
+
+  pythonImportsCheck = [
+    "fast_simplification"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Fast Quadratic Mesh Simplification";
+    homepage = "https://github.com/pyvista/fast-simplification";
+    changelog = "https://github.com/pyvista/fast-simplification/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      yzx9
+    ];
+  };
+}

pkgs/development/python-modules/homematicip/default.nix

@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "homematicip";
-  version = "2.0.6";
+  version = "2.0.7";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "hahn-th";
     repo = "homematicip-rest-api";
     tag = version;
-    hash = "sha256-HV+4ZmYr6LsSBbQnr4PUD2u0y6uWxuCMUgNh7gG9IH8=";
+    hash = "sha256-j4/QKNzX8Zi8mgS4DOBVBAwLBsM4qBEXCSIkub04KBQ=";
   };
 
   build-system = [

pkgs/development/python-modules/intervals/default.nix

@@ -0,0 +1,37 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  infinity,
+  pytestCheckHook,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "intervals";
+  version = "0.9.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "kvesteri";
+    repo = "intervals";
+    tag = version;
+    hash = "sha256-5SwbGF7RU+2wgGnqhhFCdV89tsEIum4w7RwPU7+3MRQ=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ infinity ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "intervals" ];
+
+  meta = {
+    description = "Tools for handling intervals (ranges of comparable objects)";
+    homepage = "https://github.com/kvesteri/intervals";
+    changelog = "https://github.com/kvesteri/intervals/blob/${version}/CHANGES.rst";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ jherland ];
+  };
+}

pkgs/development/python-modules/llama-index-vector-stores-postgres/default.nix

@@ -11,13 +11,13 @@
 
 buildPythonPackage rec {
   pname = "llama-index-vector-stores-postgres";
-  version = "0.5.3";
+  version = "0.5.4";
   pyproject = true;
 
   src = fetchPypi {
     pname = "llama_index_vector_stores_postgres";
     inherit version;
-    hash = "sha256-P4gn+1mm4m8iah7F1yAbMm9+cAfyt+WKxH4Jcq+9O2k=";
+    hash = "sha256-328F/9fBSOTTZjqzhs8Fmnb7WbPJs0EQrdl/wVShbio=";
   };
 
   pythonRemoveDeps = [ "psycopg2-binary" ];

pkgs/development/python-modules/pytest-asyncio-cooperative/default.nix

@@ -0,0 +1,43 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  poetry-core,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "pytest-asyncio-cooperative";
+  version = "0.40.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "willemt";
+    repo = "pytest-asyncio-cooperative";
+    tag = "v${version}";
+    hash = "sha256-WA2swhgpn7Ct409tk91gQiHUZCXQLO0eznqskOVlU1U=";
+  };
+
+  build-system = [ poetry-core ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+  disabledTestPaths = [
+    "example/hypothesis_test.py"
+  ];
+  disabledTests = [
+    "test_tmp_path"
+    "test_session_scope_gen"
+    "test_session_scope_async_gen"
+    "test_retry"
+  ];
+
+  pythonImportsCheck = [ "pytest_asyncio_cooperative" ];
+
+  meta = {
+    description = "Use asyncio to run your I/O bound test suite efficiently and quickly";
+    homepage = "https://github.com/willemt/pytest-asyncio-cooperative";
+    changelog = "https://github.com/willemt/pytest-asyncio-cooperative/releases/tag/v${version}";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ jherland ];
+  };
+}

pkgs/development/python-modules/python-ldap/default.nix

@@ -68,7 +68,7 @@ buildPythonPackage rec {
     "test_tls_ext_noca"
   ];
 
-  doCheck = !stdenv.hostPlatform.isDarwin;
+  __darwinAllowLocalNetworking = true;
 
   meta = with lib; {
     description = "Python modules for implementing LDAP clients";

pkgs/development/python-modules/python-mystrom/default.nix

@@ -1,28 +1,31 @@
 {
   lib,
-  buildPythonPackage,
-  fetchPypi,
   aiohttp,
+  buildPythonPackage,
   click,
+  fetchFromGitHub,
+  poetry-core,
   requests,
-  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "python-mystrom";
-  version = "2.2.0";
+  version = "2.4.0";
-  format = "setuptools";
+  pyproject = true;
 
-  src = fetchPypi {
+  src = fetchFromGitHub {
-    inherit pname version;
+    owner = "home-assistant-ecosystem";
-    hash = "sha256-VFsTA/isBw0H7qXQhOX6K2p1QcVxO7q5TIzf8YivVgc=";
+    repo = "python-mystrom";
+    tag = version;
+    hash = "sha256-zG1T+wC0GznNwP3fi8GKtY9Csq9hyX0vw+h7ARVPQFQ=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ poetry-core ];
+
+  dependencies = [
     aiohttp
     click
     requests
-    setuptools
   ];
 
   # no tests are present
@@ -36,14 +39,14 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Python API client for interacting with myStrom devices";
-    mainProgram = "mystrom";
     longDescription = ''
       Asynchronous Python API client for interacting with myStrom devices.
       There is support for bulbs, motion sensors, plugs and buttons.
     '';
     homepage = "https://github.com/home-assistant-ecosystem/python-mystrom";
-    changelog = "https://github.com/home-assistant-ecosystem/python-mystrom/releases/tag/${version}";
+    changelog = "https://github.com/home-assistant-ecosystem/python-mystrom/releases/tag/${src.tag}";
-    license = with licenses; [ mit ];
+    license = licenses.mit;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "mystrom";
   };
 }

pkgs/development/python-modules/python-roborock/default.nix

@@ -24,7 +24,7 @@
 
 buildPythonPackage rec {
   pname = "python-roborock";
-  version = "2.19.0";
+  version = "2.23.0";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     owner = "humbertogontijo";
     repo = "python-roborock";
     tag = "v${version}";
-    hash = "sha256-d0rjMo9/ZsqygxdNf78t3Ct2VJjvYQrCrYkIeG6Zkkc=";
+    hash = "sha256-R4whfpm7DuR5KNbQv0e+KEK9clNO5AN7wCQ6ShyaGC0=";
   };
 
   postPatch = ''

pkgs/development/python-modules/scipy-stubs/default.nix

@@ -0,0 +1,49 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pythonOlder,
+  hatchling,
+  optype,
+  scipy,
+}:
+
+buildPythonPackage rec {
+  pname = "scipy-stubs";
+  version = "1.16.0.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "scipy";
+    repo = "scipy-stubs";
+    tag = "v${version}";
+    hash = "sha256-LuBypvtbLp7Zo8Rou1JwBwJjZr0BBic25dhX5Yg1Esk=";
+  };
+
+  disabled = pythonOlder "3.11";
+
+  build-system = [
+    hatchling
+  ];
+
+  dependencies = [
+    optype
+  ];
+
+  optional-dependencies = {
+    scipy = [
+      scipy
+    ];
+  };
+
+  nativeCheckInputs = [
+    scipy
+  ];
+
+  meta = {
+    description = "Typing Stubs for SciPy";
+    homepage = "https://github.com/scipy/scipy-stubs";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ jolars ];
+  };
+}

pkgs/development/python-modules/tftpy/default.nix

@@ -7,12 +7,12 @@
 
 buildPythonPackage rec {
   pname = "tftpy";
-  version = "0.8.5";
+  version = "0.8.6";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-3TjjdEUw0MMPoccV1/pFQxm8jTmbtAwFg5zHcfBdDmw=";
+    hash = "sha256-9hb2pDo21IHCZlc2CFl7ndPHxjgYQV1yqgTx0XlUgOo=";
   };
 
   nativeBuildInputs = [ setuptools ];

pkgs/servers/monitoring/prometheus/fastly-exporter.nix

@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "fastly-exporter";
-  version = "9.4.0";
+  version = "9.5.0";
 
   src = fetchFromGitHub {
     owner = "fastly";
     repo = "fastly-exporter";
     rev = "v${version}";
-    hash = "sha256-C2lm9E60mjMCkMnUNdm3P+OXx0nUc7JwV1zNYnmlVt0=";
+    hash = "sha256-W3VVnI83RKwNkQj4njvZS+ANklNR27BWIrJmdcmSq2I=";
   };
 
   vendorHash = "sha256-wbkm6b8xTGAQ4bCjIOVvJVA7sckPxtDiwMcjglaL/Pk=";

pkgs/tools/package-management/lix/default.nix

@@ -13,6 +13,7 @@
   editline,
   ncurses,
   clangStdenv,
+  nixpkgs-review,
   nix-direnv,
   nix-fast-build,
   colmena,
@@ -92,6 +93,10 @@ let
             stdenv = lixStdenv;
           };
 
+          nixpkgs-review = nixpkgs-review.override {
+            nix = self.lix;
+          };
+
           nix-direnv = nix-direnv.override {
             nix = self.lix;
           };

pkgs/tools/security/ghidra/build-extension.nix

@@ -21,16 +21,17 @@ let
       platforms = oldMeta.platforms or ghidra.meta.platforms;
     };
 
-  buildGhidraExtension =
+  buildGhidraExtension = lib.extendMkDerivation {
+    constructDrv = stdenv.mkDerivation;
+    extendDrvArgs =
+      finalAttrs:
       {
         pname,
         nativeBuildInputs ? [ ],
         meta ? { },
         ...
       }@args:
-    stdenv.mkDerivation (
+      {
-      args
-      // {
         nativeBuildInputs = nativeBuildInputs ++ [
           unzip
           jdk
@@ -67,18 +68,19 @@ let
           '';
 
         meta = metaCommon meta;
-      }
+      };
-    );
+  };
 
-  buildGhidraScripts =
+  buildGhidraScripts = lib.extendMkDerivation {
+    constructDrv = stdenv.mkDerivation;
+    extendDrvArgs =
+      finalAttrs:
       {
         pname,
         meta ? { },
         ...
       }@args:
-    stdenv.mkDerivation (
+      {
-      args
-      // {
         installPhase = ''
           runHook preInstall
 
@@ -100,8 +102,8 @@ let
         '';
 
         meta = metaCommon meta;
-      }
+      };
-    );
+  };
 in
 {
   inherit buildGhidraExtension buildGhidraScripts;

pkgs/tools/security/ghidra/extensions/findcrypt/default.nix

@@ -3,26 +3,23 @@
   fetchFromGitHub,
   buildGhidraExtension,
 }:
-let
+buildGhidraExtension (finalAttrs: {
-  version = "3.0.6";
-in
-buildGhidraExtension {
   pname = "findcrypt";
-  inherit version;
+  version = "3.0.6";
 
   src = fetchFromGitHub {
     owner = "antoniovazquezblanco";
     repo = "GhidraFindcrypt";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-VWi1MP72Vl4XCrbTvRA6qYPk2QyvRyVb9N8QQ/Zml0A=";
   };
 
   meta = {
     description = "Ghidra analysis plugin to locate cryptographic constants";
     homepage = "https://github.com/antoniovazquezblanco/GhidraFindcrypt";
-    downloadPage = "https://github.com/antoniovazquezblanco/GhidraFindcrypt/releases/tag/v${version}";
+    downloadPage = "https://github.com/antoniovazquezblanco/GhidraFindcrypt/releases/tag/v${finalAttrs.version}";
-    changelog = "https://github.com/antoniovazquezblanco/GhidraFindcrypt/releases/tag/v${version}";
+    changelog = "https://github.com/antoniovazquezblanco/GhidraFindcrypt/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.gpl3;
     maintainers = [ lib.maintainers.BonusPlay ];
   };
-}
+})

pkgs/tools/security/ghidra/extensions/ghidra-delinker-extension/default.nix

@@ -4,22 +4,20 @@
   gradle,
   fetchFromGitHub,
 }:
-let
+ghidra.buildGhidraExtension (finalAttrs: {
-  version = "0.5.1";
-  self = ghidra.buildGhidraExtension {
   pname = "ghidra-delinker-extension";
-    inherit version;
+  version = "0.5.1";
 
   src = fetchFromGitHub {
     owner = "boricj";
     repo = "ghidra-delinker-extension";
-      rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-h6F50Z7S6tPOl9mIhChLKoFxHuAkq/n36ysUEFwWGxI=";
   };
 
   postPatch = ''
     substituteInPlace build.gradle \
-        --replace-fail '"''${getGitHash()}"' '"v${version}"'
+      --replace-fail '"''${getGitHash()}"' '"v${finalAttrs.version}"'
   '';
 
   gradleBuildTask = "buildExtension";
@@ -27,7 +25,7 @@ let
   __darwinAllowLocalNetworking = true;
 
   mitmCache = gradle.fetchDeps {
-      pkg = self;
+    pkg = finalAttrs.finalPackage;
     data = ./deps.json;
   };
 
@@ -38,6 +36,4 @@ let
     maintainers = [ lib.maintainers.jchw ];
     platforms = lib.platforms.unix;
   };
-  };
+})
-in
-self

pkgs/tools/security/ghidra/extensions/ghidra-golanganalyzerextension/default.nix

@@ -3,22 +3,22 @@
   fetchFromGitHub,
   buildGhidraExtension,
 }:
-buildGhidraExtension rec {
+buildGhidraExtension (finalAttrs: {
   pname = "Ghidra-GolangAnalyzerExtension";
   version = "1.2.4";
 
   src = fetchFromGitHub {
     owner = "mooncat-greenpy";
     repo = "Ghidra_GolangAnalyzerExtension";
-    rev = version;
+    rev = finalAttrs.version;
     hash = "sha256-uxozIJ+BLcP1vBnLOCZD9ueY10hd37fON/Miii3zabo=";
   };
 
   meta = {
     description = "Facilitates the analysis of Golang binaries using Ghidra";
     homepage = "https://github.com/mooncat-greenpy/Ghidra_GolangAnalyzerExtension";
-    downloadPage = "https://github.com/mooncat-greenpy/Ghidra_GolangAnalyzerExtension/releases/tag/${version}";
+    downloadPage = "https://github.com/mooncat-greenpy/Ghidra_GolangAnalyzerExtension/releases/tag/${finalAttrs.version}";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.ivyfanchiang ];
   };
-}
+})

pkgs/tools/security/ghidra/extensions/kaiju/default.nix

@@ -24,14 +24,14 @@ let
     }
   );
 
-  self = buildGhidraExtension rec {
+  self = buildGhidraExtension (finalAttrs: {
     pname = "kaiju";
     version = "250610";
 
     src = fetchFromGitHub {
       owner = "CERTCC";
       repo = "kaiju";
-      rev = version;
+      rev = finalAttrs.version;
       hash = "sha256-qqUnWakQDOBw3sI/6iWD9140iRAsM5PUEQJSV/3/8FQ=";
     };
 
@@ -58,7 +58,7 @@ let
     meta = {
       description = "A Java implementation of some features of the CERT Pharos Binary Analysis Framework for Ghidra";
       homepage = "https://github.com/CERTCC/kaiju";
-      downloadPage = "https://github.com/CERTCC/kaiju/releases/tag/${version}";
+      downloadPage = "https://github.com/CERTCC/kaiju/releases/tag/${finalAttrs.version}";
       license = lib.licenses.bsd3;
       maintainers = [ lib.maintainers.ivyfanchiang ];
       platforms = [
@@ -68,6 +68,6 @@ let
         "aarch64-darwin"
       ];
     };
-  };
+  });
 in
 self

pkgs/tools/security/ghidra/extensions/lightkeeper/default.nix

@@ -3,14 +3,14 @@
   fetchFromGitHub,
   buildGhidraExtension,
 }:
-buildGhidraExtension rec {
+buildGhidraExtension (finalAttrs: {
   pname = "lightkeeper";
   version = "1.2.4";
 
   src = fetchFromGitHub {
     owner = "WorksButNotTested";
     repo = "lightkeeper";
-    rev = version;
+    rev = finalAttrs.version;
     hash = "sha256-aGMWg6VQleKH/txlxpSw19QOotWZSqeW5Ve2SpWGhgA=";
   };
   preConfigure = ''
@@ -21,4 +21,4 @@ buildGhidraExtension rec {
     homepage = "https://github.com/WorksButNotTested/lightkeeper";
     license = lib.licenses.asl20;
   };
-}
+})

pkgs/tools/security/ghidra/extensions/wasm/default.nix

@@ -5,17 +5,14 @@
   ghidra,
   ant,
 }:
-let
+buildGhidraExtension (finalAttrs: {
-  version = "2.3.1";
-in
-buildGhidraExtension {
   pname = "wasm";
-  inherit version;
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     owner = "nneonneo";
     repo = "ghidra-wasm-plugin";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-aoSMNzv+TgydiXM4CbvAyu/YsxmdZPvpkZkYEE3C+V4=";
   };
 
@@ -35,9 +32,9 @@ buildGhidraExtension {
   meta = {
     description = "Ghidra Wasm plugin with disassembly and decompilation support";
     homepage = "https://github.com/nneonneo/ghidra-wasm-plugin";
-    downloadPage = "https://github.com/nneonneo/ghidra-wasm-plugin/releases/tag/v${version}";
+    downloadPage = "https://github.com/nneonneo/ghidra-wasm-plugin/releases/tag/v${finalAttrs.version}";
-    changelog = "https://github.com/nneonneo/ghidra-wasm-plugin/releases/tag/v${version}";
+    changelog = "https://github.com/nneonneo/ghidra-wasm-plugin/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.gpl3;
     maintainers = [ lib.maintainers.BonusPlay ];
   };
-}
+})