Merge staging-next into staging

2025-07-01 00:21:10 +00:00 · 2025-07-01 00:21:10 +00:00 · d762c7ac78
commit d762c7ac78
parent 62814d33b6 24a22991b4
76 changed files with 2419 additions and 328 deletions
--- a/nixos/tests/prowlarr.nix
+++ b/nixos/tests/prowlarr.nix
@ -28,10 +28,10 @@
    with subtest("Prowlarr data directory migration works"):
      machine.systemctl("stop prowlarr.service")
      machine.succeed("mkdir -p /tmp/prowlarr-migration")
-      machine.succeed("mv /var/lib/prowlarr/* /tmp/prowlarr-migration")
+      machine.succeed("rsync -a -delete /var/lib/prowlarr/ /tmp/prowlarr-migration")
      machine.succeed("${config.nodes.machine.system.build.toplevel}/specialisation/customDataDir/bin/switch-to-configuration test")
      machine.wait_for_unit("var-lib-private-prowlarr.mount")
-      machine.succeed("mv /tmp/prowlarr-migration/* /var/lib/prowlarr")
+      machine.succeed("rsync -a -delete /tmp/prowlarr-migration/ /var/lib/prowlarr")
      machine.systemctl("restart prowlarr.service")
      # Check that we're using a bind mount when using a non-default dataDir
      machine.succeed("findmnt /var/lib/private/prowlarr | grep /srv/prowlarr")
--- a/pkgs/applications/virtualization/docker/buildx.nix
+++ b/pkgs/applications/virtualization/docker/buildx.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "docker-buildx";
-  version = "0.23.0";
+  version = "0.25.0";

  src = fetchFromGitHub {
    owner = "docker";
    repo = "buildx";
    rev = "v${version}";
-    hash = "sha256-KU9B6ygK6PwMvXDL+SBB79TCBScJDgVMs4m92zgibdE=";
+    hash = "sha256-DdG2z0raDHcbBMDl7C0WORKhG0ZB9Gvie8u4/isE8ow=";
  };

  doCheck = false;
--- a/pkgs/by-name/ai/airwindows/package.nix
+++ b/pkgs/by-name/ai/airwindows/package.nix
@ -8,13 +8,13 @@
 }:
 stdenv.mkDerivation {
  pname = "airwindows";
-  version = "0-unstable-2025-06-08";
+  version = "0-unstable-2025-06-22";

  src = fetchFromGitHub {
    owner = "airwindows";
    repo = "airwindows";
-    rev = "a88ee4caa6e874efec86a1e8c62853dbc1caa514";
-    hash = "sha256-fTVDpDxPMrRxHGUJh8/qGYGkziPdjKj9Q/q3LCd1brE=";
+    rev = "fd36e62f00ce73d371d528ed1f63d0617e445caa";
+    hash = "sha256-XDIXDDkb88Kdf3XQsMB0ee0F8QTyoz82LOLrQcezK1I=";
  };

  # we patch helpers because honestly im spooked out by where those variables
--- a/pkgs/by-name/ar/armadillo/package.nix
+++ b/pkgs/by-name/ar/armadillo/package.nix
@ -11,11 +11,11 @@

 stdenv.mkDerivation rec {
  pname = "armadillo";
-  version = "14.4.2";
+  version = "14.4.3";

  src = fetchurl {
    url = "mirror://sourceforge/arma/armadillo-${version}.tar.xz";
-    hash = "sha256-bf3c+9kecGedfBHpSlljp+/aAC/sNR5vSHWsjiRcURc=";
+    hash = "sha256-w6rdWb2w6kM5sFbymXL5LuGf3FL2jreNMtLkyvTYDDo=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/by-name/at/atlas/package.nix
+++ b/pkgs/by-name/at/atlas/package.nix
@ -8,19 +8,19 @@

 buildGoModule (finalAttrs: {
  pname = "atlas";
-  version = "0.34.0";
+  version = "0.35.0";

  src = fetchFromGitHub {
    owner = "ariga";
    repo = "atlas";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-7s03YrZw7J2LRCHibMqzBBtVUBSPVEf+TMqtKoWSkkM=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-USA3PiZcOF39LK45Xu0Oq/GJi3URMxJpBrUXxIsEkCY=";
  };

  modRoot = "cmd/atlas";

  proxyVendor = true;
-  vendorHash = "sha256-K94zOisolCplE/cFrWmv4/MWl5DD27lRekPTl+o4Jwk=";
+  vendorHash = "sha256-G78KpERRAP4lVsy3ur2ejT6jA6K5T257FHLb7afC/7c=";

  nativeBuildInputs = [ installShellFiles ];

@ -46,7 +46,7 @@ buildGoModule (finalAttrs: {
  };

  meta = {
-    description = "Modern tool for managing database schemas";
+    description = "Manage your database schema as code";
    homepage = "https://atlasgo.io/";
    changelog = "https://github.com/ariga/atlas/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.asl20;
--- a/pkgs/by-name/ba/bazel-buildtools/package.nix
+++ b/pkgs/by-name/ba/bazel-buildtools/package.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "bazel-buildtools";
-  version = "8.2.0";
+  version = "8.2.1";

  src = fetchFromGitHub {
    owner = "bazelbuild";
    repo = "buildtools";
    rev = "v${version}";
-    hash = "sha256-7O82TE6NgJSrYOz1gO+t9nWgrTshyK8EIemI7SM2DuM=";
+    hash = "sha256-YkxEc+hcfOH2zzdHngoJmuCqGD4FWSkFd2cVqIrpHD4=";
  };

  vendorHash = "sha256-sYZ7ogQY0dWOwJMvLljOjaKeYGYdLrF5AnetregdlYY=";
--- a/pkgs/by-name/ba/bazel-gazelle/package.nix
+++ b/pkgs/by-name/ba/bazel-gazelle/package.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "bazel-gazelle";
-  version = "0.43.0";
+  version = "0.44.0";

  src = fetchFromGitHub {
    owner = "bazelbuild";
    repo = "bazel-gazelle";
    rev = "v${version}";
-    hash = "sha256-jj2mAGzz5BOim008LNRH0tVLbJy/mNodsTENMVbjUbk=";
+    hash = "sha256-vkGLzrseERxl0LygFm1zCC7kK7j+pHpTbG2fy4fLztw=";
  };

  vendorHash = null;
--- a/pkgs/by-name/ch/chez-mit/package.nix
+++ b/pkgs/by-name/ch/chez-mit/package.nix
@ -35,6 +35,7 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/fedeinthemix/chez-mit/";
    maintainers = [ maintainers.jitwit ];
    license = licenses.gpl3Plus;
+    broken = stdenv.hostPlatform.isDarwin;
  };

 }
--- a/pkgs/by-name/ci/cimg/package.nix
+++ b/pkgs/by-name/ci/cimg/package.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "cimg";
-  version = "3.5.4";
+  version = "3.5.5";

  src = fetchFromGitHub {
    owner = "GreycLab";
    repo = "CImg";
    tag = "v.${finalAttrs.version}";
-    hash = "sha256-VCgMSIaQAcPH7DWUEfoJahCQDr49lzO7pUw1+NXHA60=";
+    hash = "sha256-vVRdSjrSCprhxraLzZ531zIYXsqbnnxOcoawJddwvgY=";
  };

  outputs = [
--- a/pkgs/by-name/cl/cloudlog/package.nix
+++ b/pkgs/by-name/cl/cloudlog/package.nix
@ -9,13 +9,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "cloudlog";
-  version = "2.6.18";
+  version = "2.6.19";

  src = fetchFromGitHub {
    owner = "magicbug";
    repo = "Cloudlog";
    rev = version;
-    hash = "sha256-GH6vGZRWM2q6ExpZzRRmJf+7VGs4Ymg2S/6TIJgfJEg=";
+    hash = "sha256-nSozkRj4aeZZJ/H0zfzzlH4rWGVThC03ByA4FF6IgT4=";
  };

  postPatch = ''
--- a/pkgs/by-name/de/dependabot-cli/package.nix
+++ b/pkgs/by-name/de/dependabot-cli/package.nix
@ -12,20 +12,20 @@
 }:
 let
  pname = "dependabot-cli";
-  version = "1.66.0";
+  version = "1.67.1";

  # `tag` is what `dependabot` uses to find the relevant docker images.
  tag = "nixpkgs-dependabot-cli-${version}";

  # Get these hashes from
  # nix run nixpkgs#nix-prefetch-docker -- --image-name ghcr.io/github/dependabot-update-job-proxy/dependabot-update-job-proxy --image-tag latest --final-image-name dependabot-update-job-proxy --final-image-tag ${tag}
-  updateJobProxy.imageDigest = "sha256:0b0d8c67cad11fa0885fcc3fe0add06638c29c19f05a83f80077d5dbb70c2037";
-  updateJobProxy.hash = "sha256-7O/1NYdhtmO+MAwfu8BSaJQ1RVkXrFPBpfRy0N7p1lQ=";
+  updateJobProxy.imageDigest = "sha256:0a7207bc265d7daaae61f2f105659d7c5947dc7e70395d6604cf114695d23578";
+  updateJobProxy.hash = "sha256-tQFkP260Vl2j19vTk7kz6/UmbKVg0CtjLuZYe7wHKSA=";

  # Get these hashes from
  # nix run nixpkgs#nix-prefetch-docker -- --image-name ghcr.io/dependabot/dependabot-updater-github-actions --image-tag latest --final-image-name dependabot-updater-github-actions --final-image-tag ${tag}
-  updaterGitHubActions.imageDigest = "sha256:11de6594db1c23e7ed4a6b621e8584b4a3b34484d51f2f8aa850c21fbce9094f";
-  updaterGitHubActions.hash = "sha256-cImOCW7tggBWEPlmE55b4OFMxf/+VGLoqx0tRualowo=";
+  updaterGitHubActions.imageDigest = "sha256:d0b91fa5fcfe306614f3c4307b4571cabe25405e06f3ce737a2b7b225530a71c";
+  updaterGitHubActions.hash = "sha256-yisnwxqFOUUBSq0YPX0C89dNOYYJ/mfNFhyrQCV6yoc=";
 in
 buildGoModule {
  inherit pname version;
@ -34,10 +34,10 @@ buildGoModule {
    owner = "dependabot";
    repo = "cli";
    rev = "v${version}";
-    hash = "sha256-9VgcQgiNv1v6+jnaWK10yccC1ILSxiIj9ZCIhHY57jk=";
+    hash = "sha256-K3ZHLauAtG1pSZsiLwWj9sMWL1epPILLUvc22/+oj+g=";
  };

-  vendorHash = "sha256-gENlo1EPzsML+HkDBg4a2VGTUhyKY8AhlpHVszYWBno=";
+  vendorHash = "sha256-4737CHJCeq7qn8dGz3bYsauCLipKqItltpI5u6uBvuo=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/fa/fasmg/package.nix
+++ b/pkgs/by-name/fa/fasmg/package.nix
@ -14,11 +14,11 @@

 stdenv.mkDerivation rec {
  pname = "fasmg";
-  version = "kp60";
+  version = "ktge";

  src = fetchzip {
    url = "https://flatassembler.net/fasmg.${version}.zip";
-    sha256 = "sha256-gOkAVi3hoHer7Buzu6O8Y66cXVys6CI+tqwEPtTOO9U=";
+    sha256 = "sha256-z/2SeN6FgRvLg8hA+lle/f2qEkce1GF1cC0uSnXExhg=";
    stripRoot = false;
  };

--- a/pkgs/by-name/fa/fastnlo-toolkit/package.nix
+++ b/pkgs/by-name/fa/fastnlo-toolkit/package.nix
@ -105,5 +105,6 @@ stdenv.mkDerivation rec {
    license = licenses.gpl3Plus;
    maintainers = with maintainers; [ veprbl ];
    platforms = platforms.unix;
+    broken = stdenv.hostPlatform.isDarwin;
  };
 }
--- a/pkgs/by-name/fo/forgejo-runner/package.nix
+++ b/pkgs/by-name/fo/forgejo-runner/package.nix
@ -17,17 +17,17 @@ let
 in
 buildGoModule rec {
  pname = "forgejo-runner";
-  version = "6.3.1";
+  version = "6.4.0";

  src = fetchFromGitea {
    domain = "code.forgejo.org";
    owner = "forgejo";
    repo = "runner";
    rev = "v${version}";
-    hash = "sha256-eR7WsdnA9guEf/BXymWuJTy+4TTBUq9YxeFVKgvvAD8=";
+    hash = "sha256-fEsT82h33XIBXyvcIYNsieQiV45jLnxLpFP5ji9pNlg=";
  };

-  vendorHash = "sha256-ZlXx0B2IdyeqPzQchmUI0peOZShUi0m9BMBQ1Xj2ftQ=";
+  vendorHash = "sha256-KV8KYOjy3WO+yfVWEFwKZVAesmx4tFk/k/sTLDKk9lo=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/fr/freecell-solver/package.nix
+++ b/pkgs/by-name/fr/freecell-solver/package.nix
@ -16,11 +16,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "freecell-solver";
-  version = "6.12.0";
+  version = "6.14.0";

  src = fetchurl {
    url = "https://fc-solve.shlomifish.org/downloads/fc-solve/freecell-solver-${finalAttrs.version}.tar.xz";
-    hash = "sha256-oriegEzkuRjvdJAxZ2IQ8glf6jqMsSmAVgKEPHxIhKA=";
+    hash = "sha256-HREl2FQivNUhEC18sefIS3aGP+RF3SGHn5d53Gss59w=";
  };

  outputs = [
--- a/pkgs/by-name/ga/gancio/plugin-telegram-bridge/default.nix
+++ b/pkgs/by-name/ga/gancio/plugin-telegram-bridge/default.nix
@ -11,14 +11,14 @@

 stdenv.mkDerivation rec {
  pname = "gancio-plugin-telegram-bridge";
-  version = "1.0.5";
+  version = "1.0.6";

  src = fetchFromGitLab {
    domain = "framagit.org";
    owner = "bcn.convocala";
    repo = "gancio-plugin-telegram-bridge";
    rev = "v${version}";
-    hash = "sha256-URiyV7bl8t25NlVJM/gEqPB67TZ4vQdfu4mvHITteSQ=";
+    hash = "sha256-J7FIfJjounrq/hPQk58mYXigjD7BZQWoE4aGi0eJ4sY=";
  };

  # upstream doesn't provide a yarn.lock file
--- a/pkgs/by-name/gm/gmic/package.nix
+++ b/pkgs/by-name/gm/gmic/package.nix
@ -31,7 +31,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "gmic";
-  version = "3.5.4";
+  version = "3.5.5";

  outputs = [
    "out"
@ -44,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "GreycLab";
    repo = "gmic";
    rev = "v.${finalAttrs.version}";
-    hash = "sha256-WhhEBhwv2bBwsWPPMDIA2jhUzqcD6yJhHg1Eunu8y14=";
+    hash = "sha256-OPA0diWAtB8MCaw2DOyh89DVi7lQmyCsQ2gqfK7dGW8=";
  };

  # TODO: build this from source
--- a/pkgs/by-name/gn/gnome-commander/package.nix
+++ b/pkgs/by-name/gn/gnome-commander/package.nix
@ -19,14 +19,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "gnome-commander";
-  version = "1.18.2";
+  version = "1.18.3";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    owner = "GNOME";
    repo = "gnome-commander";
    tag = finalAttrs.version;
-    hash = "sha256-dNZDlpvpN5hh/3YccZPJDEFkBLv9I8YOdFT/COp7+Uw=";
+    hash = "sha256-rSaj1Fg2seZKlzlERZZmz80kxJT1vZ+INiJlWfZ9m6g=";
  };

  # hard-coded schema paths
--- a/pkgs/by-name/go/google-lighthouse/package.nix
+++ b/pkgs/by-name/go/google-lighthouse/package.nix
@ -12,18 +12,18 @@
 }:
 stdenv.mkDerivation rec {
  pname = "google-lighthouse";
-  version = "12.6.0";
+  version = "12.7.0";

  src = fetchFromGitHub {
    owner = "GoogleChrome";
    repo = "lighthouse";
    tag = "v${version}";
-    hash = "sha256-XwCitOesSEfzp3N80MsRfJ4gNyX85GzXsYaFMawmsjI=";
+    hash = "sha256-5YSUbqjzgBTjBtZYLwiGFWdWD9aDZ9To8kBZd09Tzkw=";
  };

  yarnOfflineCache = fetchYarnDeps {
    yarnLock = "${src}/yarn.lock";
-    hash = "sha256-5c5xPlFglUDavUkRHxa691qSnKW39qqzv24woJshpTg=";
+    hash = "sha256-ySNsklPfhUm/RkXzAA2wlzx4jg61vL3zxlyhEBppMVE=";
  };

  yarnBuildScript = "build-report";
--- a/pkgs/by-name/hc/hcdiag/package.nix
+++ b/pkgs/by-name/hc/hcdiag/package.nix
@ -8,13 +8,13 @@

 buildGoModule rec {
  pname = "hcdiag";
-  version = "0.5.7";
+  version = "0.5.8";

  src = fetchFromGitHub {
    owner = "hashicorp";
    repo = "hcdiag";
    tag = "v${version}";
-    hash = "sha256-pX3v4HYzQLvzBADOMDrjgS3M+H4tnJOAkUHs32NxwEg=";
+    hash = "sha256-6qsp74wp8LCBgeQTn4Edms8kzpKx9O4soGRwIFUVIk4=";
  };

  vendorHash = "sha256-ZuG++2bItCdnTcSaeBumIS2DqF+U6ZP7UTYM2DC+YGw=";
--- a/pkgs/by-name/le/lean4/package.nix
+++ b/pkgs/by-name/le/lean4/package.nix
@ -15,7 +15,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "lean4";
-  version = "4.20.0";
+  version = "4.21.0";

  # Using a vendored version rather than nixpkgs' version to match the exact version required by
  # Lean.  Apparently, even a slight version change can impact greatly the final performance.
@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "leanprover";
    repo = "lean4";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-1V3Uk96wdNJ3IP+hvXb5Hep8w8QK8GjqaeTVG+KUqXU=";
+    hash = "sha256-IZSx7KmkLMEob8BmK/Bi4sS5nh78NHPQPJYgedv2+6Y=";
  };

  postPatch =
--- a/pkgs/by-name/li/lib3270/package.nix
+++ b/pkgs/by-name/li/lib3270/package.nix
@ -53,5 +53,6 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/PerryWerneck/lib3270";
    license = licenses.lgpl3Plus;
    maintainers = [ maintainers.vifino ];
+    broken = stdenv.hostPlatform.isDarwin;
  };
 }
--- a/pkgs/by-name/li/libfilezilla/package.nix
+++ b/pkgs/by-name/li/libfilezilla/package.nix
@ -45,5 +45,6 @@ stdenv.mkDerivation {
    license = licenses.gpl2Plus;
    maintainers = with maintainers; [ pSub ];
    platforms = lib.platforms.unix;
+    broken = stdenv.hostPlatform.isDarwin;
  };
 }
--- a/pkgs/by-name/li/libslirp/fix-dns-for-darwin.patch
+++ b/pkgs/by-name/li/libslirp/fix-dns-for-darwin.patch
@ -1,46 +0,0 @@
-From 735904142f95d0500c0eae6bf763e4ad24b6b9fd Mon Sep 17 00:00:00 2001
-From: Samuel Thibault <samuel.thibault@ens-lyon.org>
-Date: Wed, 26 Mar 2025 08:42:35 +0100
-Subject: [PATCH] apple: Fix getting IPv4 DNS server address when IPv4 and IPv4
- are interleaved
-
-When getting an IPv4 DNS server address, if libresolv returns
-
-IPv4
-IPv6
-IPv4
-IPv6
-
-(or just IPv4 and IPv6)
-
-we would still have found == 1 on the second iteration and thus take the
-IPv6 even if it's not the proper af. We can as well just completely ignore
-the non-matching af entries.
-
-Fixes #85
---
- src/slirp.c | 7 +++++--
- 1 file changed, 5 insertions(+), 2 deletions(-)
-
-diff --git a/src/slirp.c b/src/slirp.c
-index bccee53..62a018a 100644
--- a/src/slirp.c
-+++ b/src/slirp.c
-@@ -289,9 +289,12 @@ static int get_dns_addr_libresolv(int af, void *pdns_addr, void *cached_addr,
-     found = 0;
-     DEBUG_MISC("IP address of your DNS(s):");
-     for (int i = 0; i < count; i++) {
-        if (af == servers[i].sin.sin_family) {
-            found++;
-+        if (af != servers[i].sin.sin_family) {
-+            continue;
-         }
-+
-+        found++;
-+
-         if (af == AF_INET) {
-             addr = &servers[i].sin.sin_addr;
-         } else { // af == AF_INET6
-- 
-GitLab
-
--- a/pkgs/by-name/li/libslirp/package.nix
+++ b/pkgs/by-name/li/libslirp/package.nix
@ -10,22 +10,16 @@

 stdenv.mkDerivation rec {
  pname = "libslirp";
-  version = "4.9.0";
+  version = "4.9.1";

  src = fetchFromGitLab {
    domain = "gitlab.freedesktop.org";
    owner = "slirp";
    repo = "libslirp";
    rev = "v${version}";
-    sha256 = "sha256-Eqdw6epFkLv4Dnw/s1pcKW0P70ApZwx/J2VkCwn50Ew=";
+    sha256 = "sha256-MKP3iBExaPQryiahI1l/4bTgVht5Vu8AxaDyMotqmMo=";
  };

-  patches = [
-    # https://gitlab.freedesktop.org/slirp/libslirp/-/commit/735904142f95d0500c0eae6bf763e4ad24b6b9fd
-    # Vendorized due to frequent instability of the upstream repository.
-    ./fix-dns-for-darwin.patch
-  ];
-
  separateDebugInfo = true;

  nativeBuildInputs = [
--- a/pkgs/by-name/ma/maiko/package.nix
+++ b/pkgs/by-name/ma/maiko/package.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "maiko";
-  version = "250201-55e20ea9";
+  version = "250616-de1fafba";

  src = fetchFromGitHub {
    owner = "Interlisp";
    repo = "maiko";
    tag = "maiko-${finalAttrs.version}";
-    hash = "sha256-7TmMvDaSmdbMa2fVbETRcyKndGM3CuaxI2cJj00WlSc=";
+    hash = "sha256-RYBV3gqcDPxRteCvUyqm8lKUpW4r0L7kJLlED8M72DI=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/by-name/mo/mongodb-ce/package.nix
+++ b/pkgs/by-name/mo/mongodb-ce/package.nix
@ -15,24 +15,24 @@
 }:

 let
-  version = "8.0.4";
+  version = "8.0.11";

  srcs = version: {
    "x86_64-linux" = {
      url = "https://fastdl.mongodb.org/linux/mongodb-linux-x86_64-ubuntu2204-${version}.tgz";
-      hash = "sha256-N5rwtPrrjVJj7UAk/weBAhV4+7wHRLNowkX6gEWCQVU=";
+      hash = "sha256-XErxsovZyMR1UmwClxn5Bm08hoYHArCtn8TSv/8eDYo=";
    };
    "aarch64-linux" = {
      url = "https://fastdl.mongodb.org/linux/mongodb-linux-aarch64-ubuntu2204-${version}.tgz";
-      hash = "sha256-uBa7/jxfZBNmB0l2jspJW2QQ8VY0GtWxc/tPlkV6UBk=";
+      hash = "sha256-p1eBobdnJ/uPZHScWFs3AOB7/BJn/MZQ8+VpOHonY2A=";
    };
    "x86_64-darwin" = {
      url = "https://fastdl.mongodb.org/osx/mongodb-macos-x86_64-${version}.tgz";
-      hash = "sha256-Ya+HIlRPWXPp9aX1AlRgkh/pfKRgxhqNep/6uuARmCo=";
+      hash = "sha256-RLq+aFJixSt3EginpgIHWnR4CGk0KX5cmC3QrbW3jJ8=";
    };
    "aarch64-darwin" = {
      url = "https://fastdl.mongodb.org/osx/mongodb-macos-arm64-${version}.tgz";
-      hash = "sha256-IZ47PXsxwEn/e890cNOO/3BOVt8qwY1N94Ql4phcz1g=";
+      hash = "sha256-kNzByPEXi5T3+vr6t/EJuKIDEfGybrsbBqJ8vaEV5tY=";
    };
  };
 in
@ -57,9 +57,8 @@ stdenv.mkDerivation (finalAttrs: {
  installPhase = ''
    runHook preInstall

-    install -Dm 755 bin/mongod $out/bin/mongod
-    install -Dm 755 bin/mongos $out/bin/mongos
-
+    install -Dm 755 bin/mongod -t $out/bin
+    install -Dm 755 bin/mongos -t $out/bin
    runHook postInstall
  '';

@ -73,7 +72,6 @@ stdenv.mkDerivation (finalAttrs: {
  doInstallCheck = stdenv.hostPlatform.isDarwin;

  passthru = {
-
    updateScript =
      let
        script = writeShellApplication {
--- a/pkgs/by-name/ne/netpbm/package.nix
+++ b/pkgs/by-name/ne/netpbm/package.nix
@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
  # Determine version and revision from:
  # https://sourceforge.net/p/netpbm/code/HEAD/log/?path=/advanced
  pname = "netpbm";
-  version = "11.10.4";
+  version = "11.10.5";

  outputs = [
    "bin"
@ -31,8 +31,8 @@ stdenv.mkDerivation rec {

  src = fetchsvn {
    url = "https://svn.code.sf.net/p/netpbm/code/advanced";
-    rev = "5076";
-    sha256 = "sha256-oWGgB0f3w8ohFPgaJ9cyVLTdMZGajzXs95eC1Cs+Tyg=";
+    rev = "5085";
+    sha256 = "sha256-04ObCW+xMvGOkhTwYAhVoBG1QIe0/DKfEYbSpDkEGCU=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/init.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/init.py
@ -366,16 +366,37 @@ def main() -> None:
    try:
        execute(sys.argv)
    except CalledProcessError as ex:
-        if logger.level == logging.DEBUG:
-            import traceback
-
-            traceback.print_exc()
-        else:
-            print(str(ex), file=sys.stderr)
-        # Exit with the error code of the process that failed
-        sys.exit(ex.returncode)
+        _handle_called_process_error(ex)
    except (Exception, KeyboardInterrupt) as ex:
-        if logger.level == logging.DEBUG:
+        if logger.isEnabledFor(logging.DEBUG):
            raise
        else:
            sys.exit(str(ex))
+
+
+def _handle_called_process_error(ex: CalledProcessError) -> None:
+    if logger.isEnabledFor(logging.DEBUG):
+        import traceback
+
+        traceback.print_exception(ex)
+    else:
+        import shlex
+
+        # If cmd is a list, stringify any Paths and join in a single string
+        # This will show much nicer in the error (e.g., as something that
+        # the user can simple copy-paste in terminal to debug)
+        cmd = (
+            shlex.join([str(cmd) for cmd in ex.cmd])
+            if isinstance(ex.cmd, list)
+            else ex.cmd
+        )
+        ex = CalledProcessError(
+            returncode=ex.returncode,
+            cmd=cmd,
+            output=ex.output,
+            stderr=ex.stderr,
+        )
+        print(str(ex), file=sys.stderr)
+
+    # Exit with the error code of the process that failed
+    sys.exit(ex.returncode)
--- a/pkgs/by-name/ok/oku/package.nix
+++ b/pkgs/by-name/ok/oku/package.nix
@ -0,0 +1,64 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  wrapGAppsHook4,
+  pkg-config,
+  fuse,
+  glib,
+  gtk4,
+  hicolor-icon-theme,
+  libadwaita,
+  pango,
+  webkitgtk_6_0,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "oku";
+  version = "0.1.1";
+
+  src = fetchFromGitHub {
+    owner = "okubrowser";
+    repo = "oku";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-utbey8DFXUWU6u2H2unNjCHE3/bwhPdrxAOApC+unGA=";
+  };
+
+  cargoHash = "sha256-rwf9jdr+RDpUcTEG7Xhpph0zuyz6tdFx6hWEZRuxkTY=";
+
+  nativeBuildInputs = [
+    wrapGAppsHook4
+    pkg-config
+  ];
+
+  buildInputs = [
+    fuse
+    glib
+    gtk4
+    hicolor-icon-theme
+    libadwaita
+    pango
+    webkitgtk_6_0
+  ];
+
+  # the program expects icons to be installed but the
+  # program does not install them itself
+  postInstall = ''
+    mkdir -p $out/share/icons
+    cp -r ${finalAttrs.src}/data/hicolor $out/share/icons
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Browser for the Oku Network and Peer-to-peer sites";
+    homepage = "https://github.com/okubrowser/oku";
+    changelog = "https://github.com/OkuBrowser/oku/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.agpl3Plus;
+    maintainers = with lib.maintainers; [ ethancedwards8 ];
+    teams = with lib.teams; [ ngi ];
+    mainProgram = "oku";
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/by-name/op/openterface-qt/package.nix
+++ b/pkgs/by-name/op/openterface-qt/package.nix
@ -22,12 +22,12 @@ let
 in
 stdenv.mkDerivation (final: {
  pname = "openterface-qt";
-  version = "0.3.15";
+  version = "0.3.17";
  src = fetchFromGitHub {
    owner = "TechxArtisanStudio";
    repo = "Openterface_QT";
    rev = "${final.version}";
-    hash = "sha256-wU30m8dQirrLcYNFs4lTKIrng7B4HapHeVsyLR619PY=";
+    hash = "sha256-kXDiQINbP7D2qUqKUAZXEW2iJqKEH/AqMSE2zU+jRHg=";
  };
  nativeBuildInputs = [
    copyDesktopItems
--- a/pkgs/by-name/op/optipng/package.nix
+++ b/pkgs/by-name/op/optipng/package.nix
@ -10,11 +10,11 @@

 stdenv.mkDerivation rec {
  pname = "optipng";
-  version = "0.7.8";
+  version = "7.9.1";

  src = fetchurl {
    url = "mirror://sourceforge/optipng/optipng-${version}.tar.gz";
-    hash = "sha256-JaO9aEgfIVAsyqD0wT+E3PayAzjkxOjFHyzvvYUTOYw=";
+    hash = "sha256-wleb5YwsZtrp1jFU7cs9Qn/vZMsA7Ar/B5ydFW7Ebyk=";
  };

  buildInputs = [ libpng ];
--- a/pkgs/by-name/pr/prowlarr/deps.json
+++ b/pkgs/by-name/pr/prowlarr/deps.json
--- a/pkgs/by-name/pr/prowlarr/package.nix
+++ b/pkgs/by-name/pr/prowlarr/package.nix
@ -1,100 +1,195 @@
 {
  lib,
-  stdenv,
-  fetchurl,
-  mono,
-  libmediainfo,
+  stdenvNoCC,
+  fetchFromGitHub,
+  buildDotnetModule,
+  dotnetCorePackages,
  sqlite,
-  curl,
-  makeWrapper,
-  icu,
-  dotnet-runtime,
-  openssl,
+  fetchYarnDeps,
+  yarn,
+  fixup-yarn-lock,
+  nodejs,
  nixosTests,
-  zlib,
+  # update script
+  writers,
+  python3Packages,
+  nix,
+  prefetch-yarn-deps,
+  fetchpatch,
+  applyPatches,
 }:
 let
-  pname = "prowlarr";
-
-  unsupported = throw "Unsupported system ${stdenv.hostPlatform.system} for ${pname}";
-
-  os =
-    if stdenv.hostPlatform.isDarwin then
-      "osx"
-    else if stdenv.hostPlatform.isLinux then
-      "linux"
-    else
-      unsupported;
-
-  arch =
-    {
-      aarch64-darwin = "arm64";
-      aarch64-linux = "arm64";
-      x86_64-darwin = "x64";
-      x86_64-linux = "x64";
-    }
-    .${stdenv.hostPlatform.system} or unsupported;
-
-  hash =
-    {
-      aarch64-darwin = "sha256-IkFkQoEPVaV+eVp2DkZECXTkzJyyNYTUBsCBdXCBZC8=";
-      aarch64-linux = "sha256-uwg5Ec9MC6jLwNdauF1tj2gSkhWdyhvWnUTLt8P1OZw=";
-      x86_64-darwin = "sha256-mdDZvKyhKXnHEKvZRH8Di6dZP80AEktnkMOnIZW+Gik=";
-      x86_64-linux = "sha256-N0KDb6MsGAJKSh5GSm7aiamjflHRXb06fL1KM2T1+bg=";
-    }
-    .${stdenv.hostPlatform.system} or unsupported;
+  version = "1.37.0.5076";
+  # The dotnet8 compatibility patches also change `yarn.lock`, so we must pass
+  # the already patched lockfile to `fetchYarnDeps`.
+  src = applyPatches {
+    src = fetchFromGitHub {
+      owner = "Prowlarr";
+      repo = "Prowlarr";
+      tag = "v${version}";
+      hash = "sha256-uSdZaPq/aXehmRKMobwYNs5iYGPv5R76Ix9lCEVdLzM=";
+    };
+    postPatch = ''
+      mv src/NuGet.config NuGet.Config
+    '';
+    patches = lib.optionals (lib.versionOlder version "2.0") [
+      # See https://github.com/Prowlarr/Prowlarr/pull/2399
+      # Unfortunately, the .NET 8 upgrade will be merged into the v2 branch,
+      # and it may take some time for that to become stable.
+      # However, the patches cleanly apply to v1 as well.
+      (fetchpatch {
+        name = "dotnet8-compatibility";
+        url = "https://github.com/Prowlarr/Prowlarr/commit/21c408a7dac8abaac91c05958f18a556220b2304.patch";
+        hash = "sha256-Es7JEXycOJPMXN+Kgv4wRnJA+l6zltUdP2i/wVodTBs=";
+      })
+      (fetchpatch {
+        name = "dotnet8-darwin-compatibility";
+        url = "https://github.com/Prowlarr/Prowlarr/commit/7a1fca5e23a3e75a9a2b2e1073a33eaa2ce865fe.patch";
+        hash = "sha256-bReCHXC3RHgm1MYmE2kGqStt4fuBHowcupLIXT3fEes=";
+      })
+      (fetchpatch {
+        name = "bump-swashbuckle-version";
+        url = "https://github.com/Prowlarr/Prowlarr/commit/8eec321a0eaa396e2f964576e5883890c719b202.patch";
+        hash = "sha256-SOdzGvq8FFYa451zTOw8yD1CDvM++AiFYFHhFW5Soco=";
+      })
+    ];
+  };
+  rid = dotnetCorePackages.systemToDotnetRid stdenvNoCC.hostPlatform.system;
 in
-stdenv.mkDerivation rec {
-  inherit pname;
-  version = "1.36.3.5071";
+buildDotnetModule {
+  pname = "prowlarr";
+  inherit version src;

-  src = fetchurl {
-    url = "https://github.com/Prowlarr/Prowlarr/releases/download/v${version}/Prowlarr.master.${version}.${os}-core-${arch}.tar.gz";
-    inherit hash;
+  strictDeps = true;
+  nativeBuildInputs = [
+    nodejs
+    yarn
+    prefetch-yarn-deps
+    fixup-yarn-lock
+  ];
+
+  yarnOfflineCache = fetchYarnDeps {
+    yarnLock = "${src}/yarn.lock";
+    hash = "sha256-QVyjo/Zshy+61qocGKa3tZS8gnHvvVqenf79FkiXDBM=";
  };

-  nativeBuildInputs = [ makeWrapper ];
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/{bin,share/${pname}-${version}}
-    cp -r * $out/share/${pname}-${version}/.
-
-    makeWrapper "${dotnet-runtime}/bin/dotnet" $out/bin/Prowlarr \
-      --add-flags "$out/share/${pname}-${version}/Prowlarr.dll" \
-      --prefix LD_LIBRARY_PATH : ${
-        lib.makeLibraryPath [
-          curl
-          sqlite
-          libmediainfo
-          mono
-          openssl
-          icu
-          zlib
-        ]
-      }
-
-    runHook postInstall
+  postConfigure = ''
+    yarn config --offline set yarn-offline-mirror "$yarnOfflineCache"
+    fixup-yarn-lock yarn.lock
+    yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
+    patchShebangs --build node_modules
+  '';
+  postBuild = ''
+    yarn --offline run build --env production
+  '';
+  postInstall = ''
+    cp -a -- _output/UI "$out/lib/prowlarr/UI"
  '';

+  nugetDeps = ./deps.json;
+
+  runtimeDeps = [ sqlite ];
+
+  dotnet-sdk = dotnetCorePackages.sdk_8_0;
+  dotnet-runtime = dotnetCorePackages.aspnetcore_8_0;
+
+  doCheck = true;
+
+  __darwinAllowLocalNetworking = true; # for tests
+
+  __structuredAttrs = true; # for Copyright property that contains spaces
+
+  executables = [ "Prowlarr" ];
+
+  projectFile = [
+    "src/NzbDrone.Console/Prowlarr.Console.csproj"
+    "src/NzbDrone.Mono/Prowlarr.Mono.csproj"
+  ];
+
+  testProjectFile = [
+    "src/Prowlarr.Api.V1.Test/Prowlarr.Api.V1.Test.csproj"
+    "src/NzbDrone.Common.Test/Prowlarr.Common.Test.csproj"
+    "src/NzbDrone.Core.Test/Prowlarr.Core.Test.csproj"
+    "src/NzbDrone.Host.Test/Prowlarr.Host.Test.csproj"
+    "src/NzbDrone.Libraries.Test/Prowlarr.Libraries.Test.csproj"
+    "src/NzbDrone.Mono.Test/Prowlarr.Mono.Test.csproj"
+    "src/NzbDrone.Test.Common/Prowlarr.Test.Common.csproj"
+  ];
+
+  dotnetFlags = [
+    "--property:TargetFramework=net8.0"
+    "--property:EnableAnalyzers=false"
+    "--property:SentryUploadSymbols=false" # Fix Sentry upload failed warnings
+    # Override defaults in src/Directory.Build.props that use current time.
+    "--property:Copyright=Copyright 2014-2025 prowlarr.com (GNU General Public v3)"
+    "--property:AssemblyVersion=${version}"
+    "--property:AssemblyConfiguration=master"
+    "--property:RuntimeIdentifier=${rid}"
+  ];
+
+  # Skip manual, integration, automation and platform-dependent tests.
+  testFilters =
+    [
+      "TestCategory!=ManualTest"
+      "TestCategory!=IntegrationTest"
+      "TestCategory!=AutomationTest"
+
+      # makes real HTTP requests
+      "FullyQualifiedName!~NzbDrone.Core.Test.UpdateTests.UpdatePackageProviderFixture"
+    ]
+    ++ lib.optionals stdenvNoCC.buildPlatform.isDarwin [
+      # fails on macOS
+      "FullyQualifiedName!~NzbDrone.Core.Test.Http.HttpProxySettingsProviderFixture"
+    ];
+
+  disabledTests = [
+    # setgid tests
+    "NzbDrone.Mono.Test.DiskProviderTests.DiskProviderFixture.should_preserve_setgid_on_set_folder_permissions"
+    "NzbDrone.Mono.Test.DiskProviderTests.DiskProviderFixture.should_clear_setgid_on_set_folder_permissions"
+
+    # we do not set application data directory during tests (i.e. XDG data directory)
+    "NzbDrone.Mono.Test.DiskProviderTests.FreeSpaceFixture.should_return_free_disk_space"
+    "NzbDrone.Common.Test.ServiceFactoryFixture.event_handlers_should_be_unique"
+
+    # attempts to read /etc/*release and fails since it does not exist
+    "NzbDrone.Mono.Test.EnvironmentInfo.ReleaseFileVersionAdapterFixture.should_get_version_info"
+
+    # fails to start test dummy because it cannot locate .NET runtime for some reason
+    "NzbDrone.Common.Test.ProcessProviderFixture.should_be_able_to_start_process"
+    "NzbDrone.Common.Test.ProcessProviderFixture.exists_should_find_running_process"
+    "NzbDrone.Common.Test.ProcessProviderFixture.kill_all_should_kill_all_process_with_name"
+  ];
+
  passthru = {
-    updateScript = ./update.sh;
-    tests.smoke-test = nixosTests.prowlarr;
+    tests = {
+      inherit (nixosTests) prowlarr;
+    };
+
+    updateScript = writers.writePython3 "prowlarr-updater" {
+      libraries = with python3Packages; [ requests ];
+      flakeIgnore = [ "E501" ];
+      makeWrapperArgs = [
+        "--prefix"
+        "PATH"
+        ":"
+        (lib.makeBinPath [
+          nix
+          prefetch-yarn-deps
+        ])
+      ];
+    } ./update.py;
  };

  meta = {
    description = "Indexer manager/proxy built on the popular arr .net/reactjs base stack";
-    homepage = "https://wiki.servarr.com/prowlarr";
+    homepage = "https://prowlarr.com/";
    changelog = "https://github.com/Prowlarr/Prowlarr/releases/tag/v${version}";
    license = lib.licenses.gpl3Only;
-    maintainers = with lib.maintainers; [ pizzapim ];
-    mainProgram = "Prowlarr";
-    platforms = [
-      "aarch64-darwin"
-      "aarch64-linux"
-      "x86_64-darwin"
-      "x86_64-linux"
+    maintainers = with lib.maintainers; [
+      pizzapim
+      nyanloutre
    ];
+    mainProgram = "Prowlarr";
+    # platforms inherited from dotnet-sdk.
  };
 }
--- a/pkgs/by-name/pr/prowlarr/update.py
+++ b/pkgs/by-name/pr/prowlarr/update.py
@ -0,0 +1,182 @@
+import json
+import os
+import pathlib
+import requests
+import shutil
+import subprocess
+import sys
+import tempfile
+
+
+def replace_in_file(file_path, replacements):
+    file_contents = pathlib.Path(file_path).read_text()
+    for old, new in replacements.items():
+        if old == new:
+            continue
+        updated_file_contents = file_contents.replace(old, new)
+        # A dumb way to check that we’ve actually replaced the string.
+        if file_contents == updated_file_contents:
+            print(f"no string to replace: {old} → {new}", file=sys.stderr)
+            sys.exit(1)
+        file_contents = updated_file_contents
+    with tempfile.NamedTemporaryFile(mode="w") as t:
+        t.write(file_contents)
+        t.flush()
+        shutil.copyfile(t.name, file_path)
+
+
+def nix_hash_to_sri(hash):
+    return subprocess.run(
+        [
+            "nix",
+            "--extra-experimental-features", "nix-command",
+            "hash",
+            "to-sri",
+            "--type", "sha256",
+            "--",
+            hash,
+        ],
+        stdout=subprocess.PIPE,
+        text=True,
+        check=True,
+    ).stdout.rstrip()
+
+
+nixpkgs_path = "."
+attr_path = os.getenv("UPDATE_NIX_ATTR_PATH", "prowlarr")
+
+package_attrs = json.loads(subprocess.run(
+    [
+        "nix",
+        "--extra-experimental-features", "nix-command",
+        "eval",
+        "--json",
+        "--file", nixpkgs_path,
+        "--apply", """p: {
+          dir = builtins.dirOf p.meta.position;
+          version = p.version;
+          sourceHash = p.src.src.outputHash;
+          yarnHash = p.yarnOfflineCache.outputHash;
+        }""",
+        "--",
+        attr_path,
+    ],
+    stdout=subprocess.PIPE,
+    text=True,
+    check=True,
+).stdout)
+
+old_version = package_attrs["version"]
+new_version = old_version
+
+# Note that we use Prowlarr API instead of GitHub to fetch latest stable release.
+# This corresponds to the Updates tab in the web UI. See also
+# https://github.com/Prowlarr/Prowlarr/blob/7d813ef97a01af0f36a2beaec32e9cd854fc67f3/src/NzbDrone.Core/Update/UpdatePackageProvider.cs
+# https://github.com/Prowlarr/Prowlarr/blob/7d813ef97a01af0f36a2beaec32e9cd854fc67f3/src/NzbDrone.Common/Cloud/ProwlarrCloudRequestBuilder.cs
+version_update = requests.get(
+    f"https://prowlarr.servarr.com/v1/update/master?version={old_version}&includeMajorVersion=true",
+).json()
+if version_update["available"]:
+    new_version = version_update["updatePackage"]["version"]
+
+if new_version == old_version:
+    sys.exit()
+
+source_nix_hash, source_store_path = subprocess.run(
+    [
+        "nix-prefetch-url",
+        "--name", "source",
+        "--unpack",
+        "--print-path",
+        f"https://github.com/Prowlarr/Prowlarr/archive/v{new_version}.tar.gz",
+    ],
+    stdout=subprocess.PIPE,
+    text=True,
+    check=True,
+).stdout.rstrip().split("\n")
+
+old_source_hash = package_attrs["sourceHash"]
+new_source_hash = nix_hash_to_sri(source_nix_hash)
+
+package_dir = package_attrs["dir"]
+package_file_name = "package.nix"
+deps_file_name = "deps.json"
+
+# To update deps.nix, we copy the package to a temporary directory and run
+# passthru.fetch-deps script there.
+with tempfile.TemporaryDirectory() as work_dir:
+    package_file = os.path.join(work_dir, package_file_name)
+    deps_file = os.path.join(work_dir, deps_file_name)
+
+    shutil.copytree(package_dir, work_dir, dirs_exist_ok=True)
+
+    replace_in_file(package_file, {
+        # NB unlike hashes, versions are likely to be used in code or comments.
+        # Try to be more specific to avoid false positive matches.
+        f"version = \"{old_version}\"": f"version = \"{new_version}\"",
+        old_source_hash: new_source_hash,
+    })
+
+    # We need access to the patched and updated src to get the patched
+    # `yarn.lock`.
+    patched_src = os.path.join(work_dir, "patched-src")
+    subprocess.run(
+        [
+            "nix",
+            "--extra-experimental-features", "nix-command",
+            "build",
+            "--impure",
+            "--nix-path", "",
+            "--include", f"nixpkgs={nixpkgs_path}",
+            "--include", f"package={package_file}",
+            "--expr", "(import <nixpkgs> { }).callPackage <package> { }",
+            "--out-link", patched_src,
+            "src",
+        ],
+        check=True,
+    )
+    old_yarn_hash = package_attrs["yarnHash"]
+    new_yarn_hash = nix_hash_to_sri(subprocess.run(
+        [
+            "prefetch-yarn-deps",
+            # does not support "--" separator :(
+            # Also --verbose writes to stdout, yikes.
+            os.path.join(patched_src, "yarn.lock"),
+        ],
+        stdout=subprocess.PIPE,
+        text=True,
+        check=True,
+    ).stdout.rstrip())
+
+    replace_in_file(package_file, {
+        old_yarn_hash: new_yarn_hash,
+    })
+
+    # Generate nuget-to-json dependency lock file.
+    fetch_deps = os.path.join(work_dir, "fetch-deps")
+    subprocess.run(
+        [
+            "nix",
+            "--extra-experimental-features", "nix-command",
+            "build",
+            "--impure",
+            "--nix-path", "",
+            "--include", f"nixpkgs={nixpkgs_path}",
+            "--include", f"package={package_file}",
+            "--expr", "(import <nixpkgs> { }).callPackage <package> { }",
+            "--out-link", fetch_deps,
+            "passthru.fetch-deps",
+        ],
+        check=True,
+    )
+    subprocess.run(
+        [
+            fetch_deps,
+            deps_file,
+        ],
+        stdout=subprocess.DEVNULL,
+        check=True,
+    )
+
+    shutil.copy(deps_file, os.path.join(package_dir, deps_file_name))
+    shutil.copy(package_file, os.path.join(package_dir, package_file_name))
--- a/pkgs/by-name/pr/prowlarr/update.sh
+++ b/pkgs/by-name/pr/prowlarr/update.sh
@ -1,45 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl gnused nix-prefetch jq
-
-set -eou pipefail
-
-dirname="$(dirname "$0")"
-
-updateHash()
-{
-    # nixos
-    version=$1
-    system=$2
-
-    # prowlarr
-    arch=$3
-    os=$4
-
-    url="https://github.com/Prowlarr/Prowlarr/releases/download/v$version/Prowlarr.master.$version.$os-core-$arch.tar.gz"
-    hash=$(nix-prefetch-url --type sha256 $url)
-    sriHash="$(nix hash to-sri --type sha256 $hash)"
-
-    sed -i "s|$system = \"sha256-[a-zA-Z0-9\/+-=]*\";|$system = \"$sriHash\";|g" "$dirname/package.nix"
-}
-
-updateVersion()
-{
-    sed -i "s/version = \"[0-9.]*\";/version = \"$1\";/g" "$dirname/package.nix"
-}
-
-currentVersion=$(cd $dirname && nix eval --raw -f ../../../.. prowlarr.version)
-
-latestTag=$(curl https://api.github.com/repos/Prowlarr/Prowlarr/releases/latest | jq -r ".tag_name")
-latestVersion="$(expr $latestTag : 'v\(.*\)')"
-
-if [[ "$currentVersion" == "$latestVersion" ]]; then
-    echo "Prowlarr is up-to-date: ${currentVersion}"
-    exit 0
-fi
-
-updateVersion $latestVersion
-
-updateHash $latestVersion aarch64-darwin arm64 osx
-updateHash $latestVersion aarch64-linux arm64 linux
-updateHash $latestVersion x86_64-darwin x64 osx
-updateHash $latestVersion x86_64-linux x64 linux
--- a/pkgs/by-name/ql/qlementine-icons/package.nix
+++ b/pkgs/by-name/ql/qlementine-icons/package.nix
@ -8,13 +8,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "qlementine-icons";
-  version = "1.9.0";
+  version = "1.10.0";

  src = fetchFromGitHub {
    owner = "oclero";
    repo = "qlementine-icons";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Ef4WTay44rMp6A39p0DCc2fXc2y/wGZZaKyj7+wpMJc=";
+    hash = "sha256-zsKlcHphTnz1EAjUD90bN+2W8OtGoict8TsIz/4dGyM=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/by-name/rd/rdkafka/package.nix
+++ b/pkgs/by-name/rd/rdkafka/package.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "rdkafka";
-  version = "2.10.0";
+  version = "2.10.1";

  src = fetchFromGitHub {
    owner = "confluentinc";
    repo = "librdkafka";
    tag = "v${finalAttrs.version}";
-    sha256 = "sha256-u4+qskNw18TD59aiSTyv1XOYT2DI24uZnGEAzJ4YBJU=";
+    sha256 = "sha256-+ACn+1fjWEnUB32gUCoMpnq+6YBu+rufPT8LY920DBk=";
  };

  outputs = [
--- a/pkgs/by-name/sc/scalafmt/package.nix
+++ b/pkgs/by-name/sc/scalafmt/package.nix
@ -9,7 +9,7 @@

 let
  baseName = "scalafmt";
-  version = "3.9.7";
+  version = "3.9.8";
  deps = stdenv.mkDerivation {
    name = "${baseName}-deps-${version}";
    buildCommand = ''
@ -19,7 +19,7 @@ let
      cp $(< deps) $out/share/java/
    '';
    outputHashMode = "recursive";
-    outputHash = "sha256-x1hEJtzZ0DmFDc7X5Tua3F0BcWz/Atm2zmMr7GgfkUM=";
+    outputHash = "sha256-mZrRb2n+ZE0DmQaH9iSMzPcpdZPtflekkP8bHv6Qw4k=";
  };
 in
 stdenv.mkDerivation {
--- a/pkgs/by-name/si/signalbackup-tools/package.nix
+++ b/pkgs/by-name/si/signalbackup-tools/package.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "signalbackup-tools";
-  version = "20250626";
+  version = "20250630-2";

  src = fetchFromGitHub {
    owner = "bepaald";
    repo = "signalbackup-tools";
    rev = version;
-    hash = "sha256-RZLe0d/zpWu8x/4qVZBY3zatb9bc5kfKy7L0EdK02uw=";
+    hash = "sha256-/zbBiVWqHoKG2h6ExIDIP6ZQH1F8LByZYWbx8wysGDw=";
  };

  nativeBuildInputs =
--- a/pkgs/by-name/so/sonarr/package.nix
+++ b/pkgs/by-name/so/sonarr/package.nix
@ -21,7 +21,7 @@
  applyPatches,
 }:
 let
-  version = "4.0.14.2939";
+  version = "4.0.15.2941";
  # The dotnet8 compatibility patches also change `yarn.lock`, so we must pass
  # the already patched lockfile to `fetchYarnDeps`.
  src = applyPatches {
@ -29,7 +29,7 @@ let
      owner = "Sonarr";
      repo = "Sonarr";
      tag = "v${version}";
-      hash = "sha256-gtEDrAosI0Kyk712Kf8QDuloUBq9AArKdukX/PKAo8M=";
+      hash = "sha256-1lBUkodBDFpJD7pyHAFb8HRLrbK8wyAboX0A2oBQnTM=";
    };
    postPatch = ''
      mv src/NuGet.Config NuGet.Config
--- a/pkgs/by-name/te/terraform-mcp-server/package.nix
+++ b/pkgs/by-name/te/terraform-mcp-server/package.nix
@ -0,0 +1,42 @@
+{
+  buildGoModule,
+  fetchFromGitHub,
+  lib,
+}:
+buildGoModule (finalAttrs: {
+  pname = "terraform-mcp-server";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "hashicorp";
+    repo = "terraform-mcp-server";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-HYiA0Mfp87czQShiXbS+y20yQzxTn0+hfM0M1kLFZFM=";
+  };
+
+  vendorHash = "sha256-m4J2WGcL0KB1InyciQEmLOSBw779/kagUOIkTwc4CE4=";
+
+  ldflags = [
+    "-X main.version=${finalAttrs.version}"
+    "-X main.commit=${finalAttrs.src.rev}"
+  ];
+
+  subPackages = [ "cmd/terraform-mcp-server" ];
+
+  meta = {
+    description = "Terraform Model Context Protocol (MCP) Server";
+    longDescription = ''
+      The Terraform MCP Server is a Go implementation of the Model Context
+      Protocol (MCP) server that provides seamless integration with Terraform
+      Registry APIs, enabling advanced automation and interaction capabilities
+      for developers and tools.
+
+      This server allows LLMs to interact with Terraform modules, providers,
+      and other Terraform Registry features through structured API interactions.
+    '';
+    homepage = "https://github.com/hashicorp/terraform-mcp-server";
+    license = lib.licenses.mpl20;
+    maintainers = with lib.maintainers; [ connerohnesorge ];
+    mainProgram = "terraform-mcp-server";
+  };
+})
--- a/pkgs/by-name/tu/turbo-unwrapped/package.nix
+++ b/pkgs/by-name/tu/turbo-unwrapped/package.nix
@ -17,13 +17,13 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "turbo-unwrapped";
-  version = "2.5.3";
+  version = "2.5.4";

  src = fetchFromGitHub {
    owner = "vercel";
    repo = "turborepo";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-QcyRuLd+nMoCyrtX1j+8vFtsgVKC2KsQBAUjsvfG+rM=";
+    hash = "sha256-PwZYi7B5gqiqal6qIFqciv8SFJbRBeVJKfIc29zuIxA=";
  };

  useFetchCargoVendor = true;
--- a/pkgs/by-name/tx/txr/package.nix
+++ b/pkgs/by-name/tx/txr/package.nix
@ -8,11 +8,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "txr";
-  version = "300";
+  version = "301";

  src = fetchurl {
    url = "https://www.kylheku.com/cgit/txr/snapshot/txr-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-BcY8UJxdqm+vyeIyEwH0N1GySbP6wIJ/yg4wIyOYVSg=";
+    hash = "sha256-n0irroNVb5UICjspaASO6IGs+zfiD3gK6LyLA+Bppiw=";
  };

  buildInputs = [ libffi ];
--- a/pkgs/by-name/un/unison-ucm/package.nix
+++ b/pkgs/by-name/un/unison-ucm/package.nix
@ -14,21 +14,21 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "unison-code-manager";
-  version = "0.5.41";
+  version = "0.5.42";

  src =
    {
      aarch64-darwin = fetchurl {
        url = "https://github.com/unisonweb/unison/releases/download/release/${finalAttrs.version}/ucm-macos-arm64.tar.gz";
-        hash = "sha256-0Zz8lc1s46y2JC6DAbJjahap+hsz1QuLRl4nGryhSxA=";
+        hash = "sha256-QPUbJTpdvXQvI7zcNnQLrojOLCp+kpcPMc5aHknM5Tk=";
      };
      x86_64-darwin = fetchurl {
        url = "https://github.com/unisonweb/unison/releases/download/release/${finalAttrs.version}/ucm-macos-x64.tar.gz";
-        hash = "sha256-O9H62uhWnOPQp7s4yUhnUXFyk0vNS4BAddaCru4n1GU=";
+        hash = "sha256-DFIDiTLT3JzAdBN9qgXbU2rbYa2oO1AxNO+R3gizyVI=";
      };
      x86_64-linux = fetchurl {
        url = "https://github.com/unisonweb/unison/releases/download/release/${finalAttrs.version}/ucm-linux-x64.tar.gz";
-        hash = "sha256-ul5PCDqjfpsMiZZaZaH04Mrv29U9uS/ik8KwFNmXbgg=";
+        hash = "sha256-NDIk0UsW7gOkhJJ7YDY2R1ZJ26uirG1TYPO+nGzR61M=";
      };
    }
    .${stdenv.hostPlatform.system} or (throw "Unsupported platform ${stdenv.hostPlatform.system}");
--- a/pkgs/by-name/va/vault-bin/package.nix
+++ b/pkgs/by-name/va/vault-bin/package.nix
@ -6,7 +6,7 @@

 stdenv.mkDerivation rec {
  pname = "vault-bin";
-  version = "1.19.5";
+  version = "1.20.0";

  src =
    let
@ -20,11 +20,11 @@ stdenv.mkDerivation rec {
        aarch64-darwin = "darwin_arm64";
      };
      hash = selectSystem {
-        x86_64-linux = "sha256-y/bXonqVjIHZ44UO1wburoOTcN3SFzLtCYaw+UF9MIk=";
-        aarch64-linux = "sha256-radUSrjpnn8L0sIW3I2qxKjSUPx/5cPya4DBJ2J5+hA=";
-        i686-linux = "sha256-Pvt+OjoZVMCp9VQ9QLNvc8LcCb8oaGQv0dAdIF/kH9I=";
-        x86_64-darwin = "sha256-vs5KD0iIuZESpr2L9c8O2zIGtl3eyvSMRwZiJDMBbwM=";
-        aarch64-darwin = "sha256-KSeGNlh0rvkXsBoR8LejDXZQcBgMQAP6PD+ZENN+W28=";
+        x86_64-linux = "sha256-wfp3qQ6vKE/k9lKW+h2LSVG9C/+4yJxsjksg5asfSj4=";
+        aarch64-linux = "sha256-pEnKCiZHrO5xwkfSA1bsqrtASj9BRNTsoTPJdu4hulE=";
+        i686-linux = "sha256-jsQFuiY1F8rSDaqtTdjbOaAfh0/WEITkXkmxgcH8U9g=";
+        x86_64-darwin = "sha256-tT6W9DJu6sehfAkbWmE4Z4MradJM50Ps2iWraQANUok=";
+        aarch64-darwin = "sha256-2bDtbRnMOCF91AZSMaBEgnwLDX44BRHv6Wb1UqZ86Ks=";
      };
    in
    fetchzip {
--- a/pkgs/by-name/xl/xlog/package.nix
+++ b/pkgs/by-name/xl/xlog/package.nix
@ -41,5 +41,6 @@ stdenv.mkDerivation rec {
    license = licenses.gpl3;
    platforms = platforms.unix;
    mainProgram = "xlog";
+    broken = stdenv.hostPlatform.isDarwin;
  };
 }
--- a/pkgs/by-name/xt/xteve/package.nix
+++ b/pkgs/by-name/xt/xteve/package.nix
@ -1,5 +1,6 @@
 {
  lib,
+  stdenv,
  buildGoModule,
  fetchFromGitHub,
 }:
@ -23,5 +24,6 @@ buildGoModule rec {
    license = licenses.mit;
    maintainers = with maintainers; [ nrhelmi ];
    mainProgram = "xteve";
+    broken = stdenv.hostPlatform.isDarwin;
  };
 }
--- a/pkgs/by-name/za/zap-chip/package.nix
+++ b/pkgs/by-name/za/zap-chip/package.nix
@ -1,5 +1,6 @@
 {
  lib,
+  stdenv,
  buildNpmPackage,
  electron,
  fetchFromGitHub,
@ -87,5 +88,6 @@ buildNpmPackage rec {
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ symphorien ];
    mainProgram = "zap" + lib.optionalString (!withGui) "-cli";
+    broken = stdenv.hostPlatform.isDarwin;
  };
 }
--- a/pkgs/desktops/lxqt/lxqt-panel/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-panel/default.nix
@ -35,13 +35,13 @@

 stdenv.mkDerivation rec {
  pname = "lxqt-panel";
-  version = "2.2.1";
+  version = "2.2.2";

  src = fetchFromGitHub {
    owner = "lxqt";
    repo = pname;
    rev = version;
-    hash = "sha256-PKiuFstkUGrRZE4TOvMq8R5991Ay6Ghw17GCtzlybuU=";
+    hash = "sha256-ui+HD2igPiyIOgIKPbgfO4dnfm2rFP/R6oG2pH5g5VY=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/lief/default.nix
+++ b/pkgs/development/libraries/lief/default.nix
@ -17,13 +17,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "lief";
-  version = "0.16.5";
+  version = "0.16.6";

  src = fetchFromGitHub {
    owner = "lief-project";
    repo = "LIEF";
    tag = finalAttrs.version;
-    hash = "sha256-X1hkEOgU7AaQDeVlrFM4VDqweElADdColRffbV8/BfM=";
+    hash = "sha256-SvwFyhIBuG0u5rE7+1OaO7VZu4/X4jVI6oFOm5+yCd8=";
  };

  outputs = [
--- a/pkgs/development/libraries/quarto/default.nix
+++ b/pkgs/development/libraries/quarto/default.nix
@ -38,11 +38,11 @@ let
 in
 stdenv.mkDerivation (final: {
  pname = "quarto";
-  version = "1.7.31";
+  version = "1.7.32";

  src = fetchurl {
    url = "https://github.com/quarto-dev/quarto-cli/releases/download/v${final.version}/quarto-${final.version}-linux-amd64.tar.gz";
-    hash = "sha256-YRSe4MLcJCaqBDGwHiYxOxAGFcehZLIVCkXjTE0ezFc=";
+    hash = "sha256-JiUF49JkWcZOZu/v1LkkDrdV6iDdb+h21qpkx6exPSc=";
  };

  patches = [
--- a/pkgs/development/ocaml-modules/argon2/default.nix
+++ b/pkgs/development/ocaml-modules/argon2/default.nix
@ -0,0 +1,40 @@
+{
+  lib,
+  fetchurl,
+  ctypes,
+  ctypes-foreign,
+  dune-configurator,
+  result,
+  libargon2,
+  buildDunePackage,
+}:
+
+buildDunePackage rec {
+  pname = "argon2";
+  version = "1.0.2";
+
+  minimalOCamlVersion = "4.02.3";
+
+  src = fetchurl {
+    url = "https://github.com/Khady/ocaml-argon2/releases/download/${version}/argon2-${version}.tbz";
+    hash = "sha256-NDsOV4kPT2SnSfNHDBAK+VKZgHDIKxW+dNJ/C5bQ8gU=";
+  };
+
+  buildInputs = [
+    dune-configurator
+  ];
+
+  propagatedBuildInputs = [
+    ctypes
+    ctypes-foreign
+    libargon2
+    result
+  ];
+
+  meta = {
+    homepage = "https://github.com/Khady/ocaml-argon2";
+    description = "Ocaml bindings to Argon2";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ naora ];
+  };
+}
--- a/pkgs/development/python-modules/aider-chat/default.nix
+++ b/pkgs/development/python-modules/aider-chat/default.nix
@ -126,7 +126,7 @@ let
    d.stopwords
  ]);

-  version = "0.84.0";
+  version = "0.85.0";
  aider-chat = buildPythonPackage {
    pname = "aider-chat";
    inherit version;
@ -139,7 +139,7 @@ let
      owner = "Aider-AI";
      repo = "aider";
      tag = "v${version}";
-      hash = "sha256-TOlqwJM9wIAURSimuh9mysYDwgH9AfFev8jY9elLNk8=";
+      hash = "sha256-ZYjDRu4dAOkmz+fMOG8KU6y27RI/t3iEoTSUebundqo=";
    };

    pythonRelaxDeps = true;
@ -385,8 +385,8 @@ let

    meta = {
      description = "AI pair programming in your terminal";
-      homepage = "https://github.com/paul-gauthier/aider";
-      changelog = "https://github.com/paul-gauthier/aider/blob/v${version}/HISTORY.md";
+      homepage = "https://github.com/Aider-AI/aider";
+      changelog = "https://github.com/Aider-AI/aider/blob/v${version}/HISTORY.md";
      license = lib.licenses.asl20;
      maintainers = with lib.maintainers; [
        happysalada
--- a/pkgs/development/python-modules/blosc2/default.nix
+++ b/pkgs/development/python-modules/blosc2/default.nix
@ -32,14 +32,14 @@

 buildPythonPackage rec {
  pname = "blosc2";
-  version = "3.4.0";
+  version = "3.5.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "Blosc";
    repo = "python-blosc2";
    tag = "v${version}";
-    hash = "sha256-dCTASj3jNY4tQdllis9F95yNRD/KwctBxiS4MjkxeX0=";
+    hash = "sha256-Kimcz4L7Ko4cRj9IaYuLXzmU0+3ERQXOmPXr0E9mOyA=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/gcal-sync/default.nix
+++ b/pkgs/development/python-modules/gcal-sync/default.nix
@ -15,7 +15,7 @@

 buildPythonPackage rec {
  pname = "gcal-sync";
-  version = "7.1.0";
+  version = "7.2.0";
  pyproject = true;

  disabled = pythonOlder "3.10";
@ -24,7 +24,7 @@ buildPythonPackage rec {
    owner = "allenporter";
    repo = "gcal_sync";
    tag = version;
-    hash = "sha256-jdhPoZdkgMg9TBIV9j3dvaEnEOpOoa1OKBeR1YAWWKs=";
+    hash = "sha256-cdQwjjZNQlIj6oN4kJ53B576pKkLeYiXjGWqMB/EReU=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/geotorch/default.nix
+++ b/pkgs/development/python-modules/geotorch/default.nix
@ -0,0 +1,41 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  torch,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "geotorch";
+  version = "0.3.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "lezcano";
+    repo = "geotorch";
+    tag = version;
+    hash = "sha256-kkn0PZzQRodXCeX3RcajVvrp1TrhSVgKYwyJGAMuvLM=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    torch
+  ];
+
+  pythonImportsCheck = [ "geotorch" ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  meta = {
+    description = "Constrained optimization toolkit for PyTorch";
+    homepage = "https://github.com/lezcano/geotorch";
+    changelog = "https://github.com/lezcano/geotorch/releases/tag/${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ flokli ];
+  };
+}
--- a/pkgs/development/python-modules/html-sanitizer/default.nix
+++ b/pkgs/development/python-modules/html-sanitizer/default.nix
@ -17,14 +17,14 @@

 buildPythonPackage rec {
  pname = "html-sanitizer";
-  version = "2.4.4";
+  version = "2.6";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "matthiask";
    repo = "html-sanitizer";
    tag = version;
-    hash = "sha256-6OWFLsuefeDzQ1uHnLmboKDgrbY/xJCwqsSQlDaJlRs=";
+    hash = "sha256-egBGhv7vudH32jwh9rAXuXfMzPDxJ60S5WKbc4kzCTU=";
  };

  build-system = [ hatchling ];
@ -43,10 +43,6 @@ buildPythonPackage rec {
    # Tests are sensitive to output
    "test_billion_laughs"
    "test_10_broken_html"
-
-    # Mismatch snapshot (AssertionError)
-    # https://github.com/matthiask/html-sanitizer/issues/53
-    "test_keep_typographic_whitespace"
  ];

  pythonImportsCheck = [ "html_sanitizer" ];
--- a/pkgs/development/python-modules/i-pi/default.nix
+++ b/pkgs/development/python-modules/i-pi/default.nix
@ -17,14 +17,14 @@

 buildPythonPackage rec {
  pname = "i-pi";
-  version = "3.1.5";
+  version = "3.1.5.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "i-pi";
    repo = "i-pi";
    tag = "v${version}";
-    hash = "sha256-jXryhWC8IGdj33rM50KHxX9WONyJlqpUXbzi33VQdPA=";
+    hash = "sha256-az1rQlXwYUyPA4wP5wxBZtmJhQlvHxhRZF2O141i76o=";
  };

  build-system = [
--- a/pkgs/development/python-modules/mkdocs-redoc-tag/default.nix
+++ b/pkgs/development/python-modules/mkdocs-redoc-tag/default.nix
@ -3,34 +3,34 @@
  beautifulsoup4,
  buildPythonPackage,
  fetchFromGitHub,
+  hatchling,
  mkdocs,
  mkdocs-material,
  pytestCheckHook,
  pythonOlder,
-  setuptools,
 }:

 buildPythonPackage rec {
  pname = "mkdocs-redoc-tag";
-  version = "0.1.0";
+  version = "0.2.0";
  pyproject = true;

-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";

  src = fetchFromGitHub {
    owner = "Blueswen";
    repo = "mkdocs-redoc-tag";
    tag = "v${version}";
-    hash = "sha256-TOGFch+Uto3qeVMaHqK8SEy0v0cKtHofoGE8T1mnBOk=";
+    hash = "sha256-pgJMcK8LZOj0niyRcbHi8Szsro2iNTj6hz6r24jrtVw=";
  };

+  build-system = [ hatchling ];
+
  propagatedBuildInputs = [
    mkdocs
    beautifulsoup4
  ];

-  nativeBuildInputs = [ setuptools ];
-
  nativeCheckInputs = [
    mkdocs-material
    pytestCheckHook
--- a/pkgs/development/python-modules/pymonctl/default.nix
+++ b/pkgs/development/python-modules/pymonctl/default.nix
@ -1,5 +1,6 @@
 {
  lib,
+  stdenv,
  buildPythonPackage,
  fetchFromGitHub,
  setuptools,
@ -38,5 +39,6 @@ buildPythonPackage rec {
    license = lib.licenses.bsd3;
    description = "Cross-Platform toolkit to get info on and control monitors connected";
    maintainers = with lib.maintainers; [ sigmanificient ];
+    broken = stdenv.hostPlatform.isDarwin;
  };
 }
--- a/pkgs/development/python-modules/pytensor/default.nix
+++ b/pkgs/development/python-modules/pytensor/default.nix
@ -33,7 +33,7 @@

 buildPythonPackage rec {
  pname = "pytensor";
-  version = "2.31.4";
+  version = "2.31.5";
  pyproject = true;

  src = fetchFromGitHub {
@ -43,7 +43,7 @@ buildPythonPackage rec {
    postFetch = ''
      sed -i 's/git_refnames = "[^"]*"/git_refnames = " (tag: ${src.tag})"/' $out/pytensor/_version.py
    '';
-    hash = "sha256-wHkEZqgnau8DaoOaSFg0Ma6EtjGLmc+y4fskNEyk7yg=";
+    hash = "sha256-9sIFBKuPMwg+5JHA9zhvaSvluxthUtc/rdqMZPl+VZg=";
  };

  build-system = [
--- a/pkgs/games/papermc/versions.json
+++ b/pkgs/games/papermc/versions.json
@ -72,7 +72,11 @@
        "version": "1.21.4-232"
    },
    "1.21.5": {
-        "hash": "sha256-fgI/FO2CzTvUm58G0DKirnQa5ztElxOIGw1r4CbzC4M=",
-        "version": "1.21.5-112"
+        "hash": "sha256-KuauIq30F2mXRuD4n8LvbLbuBQpfZgjO5Y8FNdYLUJ4=",
+        "version": "1.21.5-114"
+    },
+    "1.21.6": {
+        "hash": "sha256-xL/DN+CRAP39Bgo2tmF0voc3DZl1rOTijkXYc86ZLGI=",
+        "version": "1.21.6-47"
    }
 }
--- a/pkgs/servers/http/apache-modules/mod_python/default.nix
+++ b/pkgs/servers/http/apache-modules/mod_python/default.nix
@ -58,5 +58,6 @@ stdenv.mkDerivation (finalAttrs: {
    mainProgram = "mod_python";
    platforms = lib.platforms.unix;
    maintainers = [ ];
+    broken = stdenv.hostPlatform.isDarwin;
  };
 })
--- a/pkgs/servers/monitoring/prometheus/blackbox-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/blackbox-exporter.nix
@ -7,17 +7,17 @@

 buildGoModule rec {
  pname = "blackbox_exporter";
-  version = "0.26.0";
+  version = "0.27.0";
  rev = "v${version}";

  src = fetchFromGitHub {
    inherit rev;
    owner = "prometheus";
    repo = "blackbox_exporter";
-    sha256 = "sha256-pdvYpu2EbcZIMyeWDWzb4TGlRE0cJgvIWJ62pHx7Xsk=";
+    sha256 = "sha256-oIsNqET3gHSajyWTxc+zoLiKQNCIXK77jtthOwYVtQg=";
  };

-  vendorHash = "sha256-Mw1+YQVmK4rqOLGIt6TSFgFsdMeL0h0A7ZJAtoL0klU=";
+  vendorHash = "sha256-UHm3iIQ6/clPx/VBUG4j/WLoOhFN44nbAEZk94L/9EY=";

  # dns-lookup is performed for the tests
  doCheck = false;
--- a/pkgs/tools/graphics/gnuplot/default.nix
+++ b/pkgs/tools/graphics/gnuplot/default.nix
@ -40,11 +40,11 @@ let
 in
 (if withQt then mkDerivation else stdenv.mkDerivation) rec {
  pname = "gnuplot";
-  version = "6.0.2";
+  version = "6.0.3";

  src = fetchurl {
    url = "mirror://sourceforge/gnuplot/${pname}-${version}.tar.gz";
-    sha256 = "sha256-9oo7C7t7u7Q3ZJZ0EG2UUiwAvy8oXM4MGcMYCx7n5zg=";
+    sha256 = "sha256-7FLjr4xAg9RTgVKz8T20f20pkpo/bs7FNlyDTnfyUas=";
  };

  nativeBuildInputs = [
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-libpinyin/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-libpinyin/default.nix
@ -22,13 +22,13 @@

 stdenv.mkDerivation rec {
  pname = "ibus-libpinyin";
-  version = "1.16.3";
+  version = "1.16.4";

  src = fetchFromGitHub {
    owner = "libpinyin";
    repo = "ibus-libpinyin";
    tag = version;
-    hash = "sha256-jkwGx8PfrSzI18Q0Yf37FIss6HRow6i46+5s0tp4IVk=";
+    hash = "sha256-ZIZ485Jk6LkFZ8TKEqlUeTZIIOZqo61uLQtPAfAX/Io=";
  };

  nativeBuildInputs = [
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -29,10 +29,6 @@ let
    else
      alias;

-  # Disabling distribution prevents top-level aliases for non-recursed package
-  # sets from building on Hydra.
-  removeDistribute = alias: if lib.isDerivation alias then lib.dontDistribute alias else alias;
-
  transmission3Warning =
    {
      prefix ? "",
@ -212,10 +208,7 @@ let
    if builtins.hasAttr n super then throw "Alias ${n} is still in all-packages.nix" else alias;

  mapAliases =
-    aliases:
-    lib.mapAttrs (
-      n: alias: removeDistribute (removeRecurseForDerivations (checkInPkgs n alias))
-    ) aliases;
+    aliases: lib.mapAttrs (n: alias: removeRecurseForDerivations (checkInPkgs n alias)) aliases;
 in

 mapAliases {
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -1883,10 +1883,6 @@ with pkgs;

  asmrepl = callPackage ../development/interpreters/asmrepl { };

-  atlas = callPackage ../by-name/at/atlas/package.nix {
-    buildGoModule = buildGo123Module;
-  };
-
  avahi = callPackage ../development/libraries/avahi { };

  avahi-compat = callPackage ../development/libraries/avahi {
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@ -46,6 +46,8 @@ let

        apron = callPackage ../development/ocaml-modules/apron { };

+        argon2 = callPackage ../development/ocaml-modules/argon2 { };
+
        arg-complete = callPackage ../development/ocaml-modules/arg-complete { };

        arp = callPackage ../development/ocaml-modules/arp { };
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -5673,6 +5673,8 @@ self: super: with self; {

  georss-wa-dfes-client = callPackage ../development/python-modules/georss-wa-dfes-client { };

+  geotorch = callPackage ../development/python-modules/geotorch { };
+
  gepetto-gui = toPythonModule (gepetto-viewer.withPlugins [ gepetto-viewer-corba ]);

  gepetto-viewer = toPythonModule (pkgs.gepetto-viewer.override { python3Packages = self; });
--- a/pkgs/top-level/release-cross.nix
+++ b/pkgs/top-level/release-cross.nix
@ -25,6 +25,7 @@
  # Attributes passed to nixpkgs. Don't build packages marked as unfree.
  nixpkgsArgs ? {
    config = {
+      allowAliases = false;
      allowUnfree = false;
      inHydra = true;
    };
--- a/pkgs/top-level/release-lib.nix
+++ b/pkgs/top-level/release-lib.nix
@ -6,6 +6,7 @@
  # Attributes passed to nixpkgs. Don't build packages marked as unfree.
  nixpkgsArgs ? {
    config = {
+      allowAliases = false;
      allowUnfree = false;
      inHydra = true;
    };
--- a/pkgs/top-level/release-python.nix
+++ b/pkgs/top-level/release-python.nix
@ -12,6 +12,7 @@
  # Attributes passed to nixpkgs. Don't build packages marked as unfree.
  nixpkgsArgs ? {
    config = {
+      allowAliases = false;
      allowUnfree = false;
      inHydra = true;
    };
--- a/pkgs/top-level/release-small.nix
+++ b/pkgs/top-level/release-small.nix
@ -16,6 +16,7 @@
  # Attributes passed to nixpkgs. Don't build packages marked as unfree.
  nixpkgsArgs ? {
    config = {
+      allowAliases = false;
      allowUnfree = false;
      inHydra = true;
    };
--- a/pkgs/top-level/release.nix
+++ b/pkgs/top-level/release.nix
@ -37,6 +37,7 @@
  # Attributes passed to nixpkgs. Don't build packages marked as unfree.
  nixpkgsArgs ? {
    config = {
+      allowAliases = false;
      allowUnfree = false;
      inHydra = true;
      # Exceptional unsafe packages that we still build and distribute,